September 14, 2026

What happened

AWS’ Deception Benchmark measures whether AI models can distinguish genuine security vulnerabilities from code that appears risky but is safe. [1]

AWS is making the benchmark publicly available so researchers can use its dataset and evaluation process without repeating the cost of generating and refining samples. [2]

Why it matters

Security teams use AI for vulnerability triage, penetration testing, threat modeling, incident response, and code review. [3]

The article states that high false-positive rates can increase workload, contribute to alert fatigue, and reduce confidence in AI-assisted security processes. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   AWS’ Deception Benchmark measures how well AI models distinguish genuine security vulnerabilities from code that looks risky but is safe.

2. [2]

   AWS is making it publicly available so researchers can use the dataset and evaluation process without repeating the cost of generating and refining the samples.

3. [3]

   Security teams use AI for vulnerability triage, penetration testing, threat modeling, incident response, and code review.

4. [4]

   High false-positive rates can create more work, increase alert fatigue, and reduce confidence in … More → The post AWS puts AI vulnerability detection to the test, and false positives pile up appeared first on Help Net Security .

Read the original article →

What happened

DigiCert’s Certificate Management Outlook says the move toward 47-day public TLS certificates by 2029 will increase enterprises’ certificate-management workload. [1]

Why it matters

Under the shorter lifecycle, organizations will need to renew certificates more than eight times as often as under the previous lifecycle and perform 40 times as many domain validations. [2]

The supplied excerpt states that certificate failures can disrupt business and attributes the information to DigiCert. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The move toward 47-day public TLS certificates by 2029 will increase the certificate management workload for enterprises, according to DigiCert’s Certificate Management Outlook.

2. [2]

   Organizations will need to renew certificates more than eight times as often as under the previous certificate lifecycle and conduct 40 times as many domain validations.

3. [3]

   (Source: DigiCert) Certificate failures cause costly outages Certificate failures can disrupt business … More → The post Certificate failures can cost firms over $250,000 appeared first on Help Net Security .

Read the original article →

What happened

A ManageEngine survey of 700 IT and cybersecurity leaders in the US and Canada found that cybersecurity attention often rises after an incident, then recedes as organizations return to existing priorities and practices. [1]

All survey respondents had previously experienced a breach or incident. [2]

Despite that experience, 91% of respondents said they trusted their organization’s current cybersecurity posture. [2] [3]

Only 8% said cybersecurity becomes a permanent priority after the incident is behind them. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Cybersecurity attention often rises after an incident, then recedes as organizations return to their existing priorities and practices, according to a new ManageEngine survey of 700 IT and cybersecurity leaders in the US and Canada.

2. [2]

   (Source: ManageEngine) All of them had already been through a breach or incident.

3. [3]

   Still, 91% said they trust their organization’s current cybersecurity posture.

4. [4]

   Only 8% said cybersecurity becomes a permanent priority once the incident is behind them.

Read the original article →

What happened

Permify is an open-source authorization service that answers runtime access questions, such as whether a user can view a document or edit posts. [1]

The service keeps authorization rules in a centralized location separate from application code. [2]

Permify follows the design of Google Zanzibar, an authorization system used across Google’s products. [3]

Why it matters

The article says teams consider services like Permify when permissions become specific and nested. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Permify is an open-source authorization service that answers access questions at run time: can user X view document Y, which posts can members of team Y edit.

2. [2]

   It keeps those rules in one place, apart from the application code that would otherwise carry them.

3. [3]

   Permify follows the design of Google Zanzibar, the authorization system Google runs across its own products.

4. [4]

   Teams reach for something like it when permissions get specific and start nesting inside each … More → The post Permify: Open-source authorization as a service appeared first on Help Net Security .

Read the original article →

What happened

Someone impersonating a government agency and using an address on that agency’s domain obtained sensitive records from Revolut; the bank confirmed the incident on September 12. [1] [2]

Revolut said a limited number of customers were affected and that it contacted them directly. [3]

The customer notification listed birth dates, postal and email addresses, phone numbers, and copies of identity documents such as passports and driving licences. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Someone impersonating a government agency, using an email address on that agency’s domain, obtained sensitive customer records from Revolut.

2. [2]

   The bank confirmed the incident on Saturday, September 12.

3. [3]

   The London-based fintech told TechCrunch that a limited number of customers were affected and that it had contacted them directly.

4. [4]

   The notification Revolut emailed affected customers listed birth dates, postal and email addresses, phone numbers, and copies of identity documents such as passports and driving licences.

Read the original article →

What happened

A malicious cross-store Twitch browser extension leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service. [1]

The extension is named “Twitch Enhanced Viewer | JeetBot” and lists HISHIMIRO/jeetbot.cc as its developer. [2]

Known limitations

The supplied evidence does not state whether the extension was removed, how to revoke affected tokens, or whether account compromise was confirmed. [1] [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A malicious cross-store Twitch browser extension has leaked OAuth tokens associated with nearly 31,000 users to proxy servers operated by a Russian commercial bot service.

2. [2]

   The extension, named "Twitch Enhanced Viewer | JeetBot," lists HISHIMIRO/jeetbot.cc as its developer and has the following identifiers on the Google Chrome Web Store and Mozilla Firefox Add-Ons store - Chrome -

Read the original article →

What happened

Debian 13.7, codenamed “trixie,” incorporated 92 previously published security advisories and corrections to 106 source packages. [1]

Six of the 92 advisories concern the Linux kernel and list the linux source package with signed amd64 and arm64 builds. [2]

Why it matters

Installations made from older Debian 13 “trixie” media receive package versions that predate the incorporated advisory set. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The Debian project shipped Debian 13.7 codenamed “trixie.” The project folded in 92 security advisories it had already published separately, added corrections to 106 source packages, and rebuilt the installer around both.

2. [2]

   Six of the 92 advisories cover the Linux kernel, each listing the linux source package alongside the signed amd64 and arm64 builds: DSA-6381, DSA-6393, DSA-6405, DSA-6415, DSA-6466 and DSA-6477.

3. [3]

   Anyone installing from older trixie media gets package versions that predate this whole set, … More → The post Debian 13.7 ships the fixes behind 92 security advisories, updates 106 packages appeared first on Help Net Security .

Read the original article →

What happened

WhatsApp is building Restricted Chat, a per-chat setting that keeps a selected conversation on one primary phone. [1] [2]

The setting appears in the Android beta distributed through Google Play as version 2.26.36.5. [2]

Why it matters

When enabled, Restricted Chat stops the selected conversation from syncing to linked devices, including WhatsApp Web and a secondary phone using the same account. [2] [3]

Known limitations

The evidence describes Restricted Chat as being built and available in an Android beta; it does not establish general release availability or broader platform support. [1] [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   WhatsApp is building a per-chat setting that keeps a conversation on a single phone.

2. [2]

   The setting, called Restricted Chat, sits in the Android beta distributed through Google Play as version 2.26.36.5, and it stops the app from syncing a chosen conversation to linked devices.

3. [3]

   Switch it on and the chat stays on the primary mobile device, out of reach of WhatsApp Web and any secondary phone signed in to the same account.

Read the original article →

What happened

The source states that vulnerability discovery is becoming faster and operating at greater scale, while defenders must determine which findings warrant action. [1]

The source reports that 35,853 CVEs were published in the first half of 2026, described as roughly 49% more than the truncated comparison period. [2]

Known limitations

The supplied evidence truncates the comparison for the reported 49% increase, so its reference period cannot be determined. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Vulnerability discovery is getting faster and happening at a much greater scale, while defenders still have to work out which findings actually deserve their action.

2. [2]

   In the first half of 2026, a whopping 35,853 CVEs were published, roughly 49% more than in the

Read the original article →

What happened

ENISA switched on the Cyber Resilience Act’s Single Reporting Platform on 11 September 2026, when the law’s reporting obligations began binding manufacturers. [1]

ENISA built the platform and operates it day to day under Article 16(1) of the Cyber Resilience Act. [2]

Organizations placing products with digital elements on the EU market must report actively exploited vulnerabilities and severe incidents through the portal. [3]

Known limitations

The supplied evidence truncates the description of when the reporting clock starts, so its timing condition cannot be determined. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The EU Agency for Cybersecurity switched on the Cyber Resilience Act‘s Single Reporting Platform on 11 September 2026, the same day the law’s reporting obligations started binding manufacturers.

2. [2]

   ENISA built the tool and runs its day-to-day operations, a job Article 16(1) of the CRA hands to the agency.

3. [3]

   Anyone placing a product with digital elements on the EU market now reports actively exploited vulnerabilities and severe incidents through that one portal.

4. [4]

   The clock starts when … More → The post ENISA launched the CRA Single Reporting Platform for actively exploited vulnerabilities appeared first on Help Net Security .

Read the original article →

What happened

Dataminr announced Dataminr Advanced for Corporate Security, which it says delivers agentic AI capabilities for protecting people, sites, and operations before risks escalate. [1]

The offering includes Agentic Corroboration, Agentic Context, and Near-Term Predictive Intelligence. [2]

Dataminr says these capabilities help security teams understand what happened first, why it matters, and what may happen next as an event unfolds. [2]

Why it matters

The source characterizes the offering as addressing the gap between detecting a threat and acting on it. [2]

Known limitations

The supplied spans do not provide independent evidence about prediction accuracy, verification performance, deployment conditions, or customer outcomes. [1] [2] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Dataminr has announced Dataminr Advanced for Corporate Security, delivering agentic AI capabilities that give corporate security teams the confidence to protect their people, sites, and operations before risk escalates.

2. [2]

   With Agentic Corroboration, Agentic Context, and Near-Term Predictive Intelligence, corporate security teams know what happened first, why it matters, and what may happen next as an event unfolds, closing the gap between detecting a threat and acting on it.

3. [3]

   With agentic AI, Dataminr is opening a … More → The post Dataminr uses agentic AI to predict and verify security threats appeared first on Help Net Security .

Read the original article →

What happened

Entrust unveiled new Cryptographic Security Platform capabilities intended to help organizations turn Cryptographic Bill of Materials data into action. [1]

Why it matters

The source identifies government, financial, healthcare, and other critical-infrastructure organizations as facing increased cyber threats, shorter certificate lifecycles, growth in machine and AI identities, evolving compliance requirements, and the transition to post-quantum cryptography. [2]

The source states that managing these changes depends on a comprehensive view of where cryptography resides and how assets and … [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Entrust has unveiled new capabilities for its Cryptographic Security Platform (CSP) that help organizations turn Cryptographic Bill of Materials (CBOMs) data into action.

2. [2]

   Government agencies, financial institutions, healthcare organizations, and other critical infrastructure operators are navigating increased cyber threats, shorter certificate lifecycles, the rapid growth of machine and AI identities, evolving compliance requirements, and the transition to post-quantum cryptography.

3. [3]

   Managing these changes depends on a comprehensive view of where cryptography resides and how assets and … More → The post Entrust turns cryptographic inventory data into security action appeared first on Help Net Security .

Read the original article →