September 21, 2026

What happened

A Sapio Research survey of 1,000 senior IT, operations, and transformation leaders found that 40% of large companies had an AI-related compliance or governance issue in the preceding 12 months. [1]

The surveyed leaders attributed 84% of the incidents to process-related problems. [2]

Why it matters

The researchers linked the exposure to workflows designed around human handling, including approvals, handoffs, and manual exceptions. [3] [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Forty percent of large companies had an AI-related compliance or governance issue in the past 12 months, according to 1,000 senior IT, operations, and transformation leaders surveyed by Sapio Research.

2. [2]

   Those leaders said process-related problems contributed to 84 percent of the incidents.

3. [3]

   The researchers trace the exposure to workflows designed around people.

4. [4]

   Approvals, handoffs, and manual exceptions exist because a person was expected to handle each step.

Read the original article →

What happened

Gopass is a free, open-source, command-line password manager that stores credentials in an encrypted store. [1]

The maintainers designed Gopass as a drop-in replacement for pass, the standard Unix password manager. [2]

By default, Gopass encrypts each secret with GPG and stores the password repository in Git. [3]

Why it matters

Git provides teams with a history of changes and a mechanism for synchronizing one password store across laptops and servers. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Gopass is a free, open-source password manager that stores credentials in an encrypted store and runs from the command line.

2. [2]

   Its maintainers built it as a drop-in replacement for pass, the standard Unix password manager.

3. [3]

   Out of the box, Gopass encrypts each secret with GPG and keeps the store in a git repository.

4. [4]

   Git gives a team a record of every change and a way to sync one store across laptops and servers.

Read the original article →

What happened

Helmit is a parental-control app combining AI-powered social-media monitoring with screen-time management, web filtering, location tracking, and safety alerts. [1]

The app identifies potentially concerning interactions and surfaces the messages associated with an alert. [2]

Helmit is available on iOS, Android, macOS, and Windows. [3]

Parents can create child profiles and connect supported services through the Family dashboard. [4]

Listed integrations include WhatsApp, Instagram, Telegram, Discord, Signal, YouTube, Gmail, and Outlook. [5]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Helmit is a parental control app that combines AI-powered social media monitoring with screen time management, web filtering, location tracking, and safety alerts.

2. [2]

   It identifies potentially concerning interactions and surface the messages associated with an alert.

3. [3]

   Helmit is available on iOS, Android, macOS, and Windows.

4. [4]

   Parents can create profiles for their children and connect supported services from the Family dashboard.

5. [5]

   The current integrations include WhatsApp, Instagram, Telegram, Discord, Signal, YouTube, Gmail, and Outlook, with Helmit … More → The post Product showcase: Helmit alerts parents when online conversations show signs of trouble appeared first on Help Net Security .

Read the original article →

What happened

The interview discusses why some large companies plan to remain on SAP ECC beyond the 2027 deadline and pay SAP for extended support through 2030. [1]

The interview describes what the first 90 days of a phased SAP migration involve. [2]

It also discusses staff with years of knowledge about the legacy system, but the supplied excerpt is truncated before providing further detail. [3]

Why it matters

It addresses the potential cost of staying on ECC, including how fear of disruption can stall migration projects more often than budget constraints. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   In this Help Net Security interview, Guilherme Joventino, COO of MIGNOW, explains why some large companies plan to stay on ECC past the 2027 deadline and pay SAP for extended support until 2030.

2. [2]

   The interview covers what that choice may cost, why fear of disruption stalls projects more often than budget, and what the first ninety days of a phased migration involve.

3. [3]

   It also looks at staff who hold years of knowledge about the old … More → The post Know what was tested before your SAP ECC migration goes live appeared first on Help Net Security .

Read the original article →

What happened

A 2017 UK assessment reviewed 15 risks of moving police data—including criminal records, victim statements, police-force information and some potentially secret-level material—to Microsoft Azure. [1] [2] [3]

The assessment identified Microsoft software vulnerabilities that could eventually be exploited by cybercriminals or other attackers, and specifically identified possible access by US government insiders. [4] [5] [6]

The proposed protections included built-in Microsoft encryption, keeping servers updated, and allowing individual police chiefs to decide whether to use the service. [10]

The article describes conflicting statements: police officials said data stays in the UK and cannot be shared without permission, while Microsoft told Police Scotland in 2023 that data can leave the UK and that it cannot guarantee data sovereignty. [13] [14]

Why it matters

Five specialists who reviewed the assessment for The Guardian said the identified risks remain relevant today; the article also states that every UK police force now uses Microsoft’s cloud wholly or partly. [7] [8] [9]

Experts, including Microsoft engineers, said encryption does not prevent Microsoft employees from accessing the data and would not necessarily prevent the US government from obtaining it. [11] [12]

A former senior policing source said cloud logging and information would not necessarily reveal a problem, so officials do not know whether the data has been breached. [15] [16] [17]

Known limitations

The evidence reports continuing risks and unresolved monitoring and data-sovereignty questions; it does not establish that a breach occurred. [7] [14] [16] [17]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A Guardian investigation has surfaced a 2017 document signed off by then City of London police commissioner Ian Dyson, who also held the title of senior information risk owner for the entire country.

2. [2]

   That document reviewed 15 risks tied to moving police data onto Microsoft Azure.

3. [3]

   The files in question include criminal records, victim statements, internal emails, information from more than 40 UK police forces, and some material exceeding standard “official” classification, meaning it may sit at “secret” or “top secret” level.

4. [4]

   The assessment was clear.

5. [5]

   It said Microsoft software had vulnerabilities that could eventually be exploited by cybercriminals and other attackers.

6. [6]

   It also pointed to a more specific and worrying risk: “US government insiders.” “In doing so, officers accepted that “US government insiders” would be able to see the data, and that it could be “transmitted worldwide”, with “the extent of this … unknown”.

7. [7]

   According to five specialists who reviewed the Guardian’s findings, the risks identified in that document persist today.

8. [8]

   Five experts who reviewed the same assessment for The Guardian said the risks are still relevant today.

9. [9]

   Every single UK police force has now put its data, wholly or partly, on Microsoft’s cloud, despite all of this being on record since 2017.

10. [10]

    The proposed protections were fairly simple: use Microsoft’s built-in encryption, keep servers updated and let individual police chiefs decide whether to use the service.

11. [11]

    But experts interviewed by The Guardian, including Microsoft engineers, said encryption does not prevent Microsoft employees from accessing the data.

12. [12]

    They also said it would not necessarily prevent the US government from obtaining it.

13. [13]

    Police officials told the Guardian the data stays in the UK and that Microsoft can’t share it without permission.

14. [14]

    Microsoft, meanwhile, told Police Scotland back in 2023 that data can leave the UK and that it cannot guarantee data sovereignty.

15. [15]

    One former senior policing source summed up the current state of visibility pretty starkly: “All the security guys I worked with when this policy came in expected a big breach by now, and we know it will take that to change the police’s position.” a source told The Guardian.

16. [16]

    “The truth is, however, the level of logging and information in the cloud systems would not necessarily tell us if there was a problem.

17. [17]

    We really don’t know if the data has been breached or not.” That’s the key point.

Read the original article →

What happened

Helpfeel confirmed a data breach affecting its Gyazo screenshot-sharing platform; attackers exploited a vulnerability in an image-upload server and stole approximately 23.62 million user records plus metadata tied to hundreds of millions of images. [1]

Gyazo is a cloud-based screenshot and screen-recording service that automatically uploads captures and generates shareable links. [2]

Known limitations

The supplied evidence does not specify the vulnerability, affected configurations, attack prerequisites, mitigation, fix status, or compromise-check guidance. [1] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Japanese software company Helpfeel has confirmed a data breach on its screenshot-sharing platform Gyazo, in which attackers exploited a vulnerability in its image upload server, stealing approximately 23.62 million user records and metadata tied to hundreds of millions of images.

2. [2]

   Gyazo is a cloud-based screenshot and screen-recording service that uploads users’ captures automatically and generates a shareable link they can post in chats, forums, or social media.

3. [3]

   According to the company, an attacker exploited the … More → The post Hackers exploit Gyazo server flaw to steal 23.6 million user records appeared first on Help Net Security .

Read the original article →

What happened

Siemba announced automated insecure direct object reference (IDOR) testing within its API Security Testing capability for REST, GraphQL and SOAP APIs. [1]

The capability is described as testing vulnerability classes most likely to expose customer data. [1]

Why it matters

Siemba states that a 200-endpoint API collection can be tested for IDOR in under an hour. [2]

The source contrasts this with human testing, which has typically taken days or weeks endpoint by endpoint, followed by a written report days later. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Siemba has announced automated testing for insecure direct object reference (IDOR) as part of its API Security Testing capability, which tests REST, GraphQL and SOAP APIs for the vulnerability classes most likely to expose customer data.

2. [2]

   A 200-endpoint API collection can be tested for IDOR in under an hour.

3. [3]

   The same coverage has typically taken a human tester days or weeks, working endpoint by endpoint, and produced a written report days after that.

Read the original article →

What happened

The FBI warns that scammers impersonate police officers and federal agents, threaten victims with arrest, and demand payment. [1]

According to the FBI, many complaints involve callers accusing victims of involvement in a crime and threatening arrest, prosecution, or imprisonment unless victims pay. [2]

Why it matters

The FBI’s IC3 updated a 2022 alert and cited losses totaling more than $1.6 billion between January 2025 and July 2026. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Scammers are posing as police officers and federal agents, threatening arrest unless victims pay up, the FBI warns.

2. [2]

   According to the FBI, most complaints involve a caller who accuses the victim of committing or being connected to a crime, then threatens “arrest, prosecution, or imprisonment” unless the … More → The post Scammers impersonate cops, use arrest threats to extort victims appeared first on Help Net Security .

3. [3]

   The FBI’s Internet Crime Complaint Center (IC3) updated an alert it first issued in 2022, citing “losses totaling more than $1.6 billion” between January 2025 and July 2026.

Read the original article →

What happened

Ireland’s Data Protection Commission fined Google €403 million over its processing of users’ location data and ordered compliance within six months. [1]

The DPC inquiry examined Google’s location-data practices from May 25, 2018, through February 4, 2020. [2]

Why it matters

The DPC launched the inquiry on its own initiative in February 2020 after complaints from several European consumer-rights organizations, including BEUC. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Ireland’s Data Protection Commission (DPC) has fined Google €403 million (about $463 million) over its processing of users’ location data and ordered the company to bring that processing into compliance within six months.

2. [2]

   The inquiry examined Google’s practices from May 25, 2018, to February 4, 2020.

3. [3]

   The DPC launched it on its own initiative in February 2020 after receiving complaints from several European consumer-rights organizations, including the European Consumer Organisation (BEUC).

Read the original article →

What happened

Attackers are targeting Rust Project members and maintainers of widely used Rust crates to compromise their devices and accounts and ultimately publish malware. [1]

The Rust Project’s crates.io team and security response working group warned of a recurring scam pattern involving invitations to video calls presented as job, contract, or collaboration opportunities. [2]

Targets are then nudged into installing something or running an unspecified item; the supplied text is truncated before describing the full action or outcome. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Attackers are targeting members of the Rust Project and maintainers of widely used crates (Rust code libraries), dangling attractive opportunities to compromise their devices and accounts and, ultimately, publish malware.

2. [2]

   The warning came last week from the Rust Project’s crates.io team and security response working group, and described a recurring pattern: a target is invited to a video call framed as a job, contract, or collaboration opportunity, then nudged into installing something or running an … More → The post North Korea’s job interview scam runs both ways appeared first on Help Net Security .

Read the original article →

What happened

Blackpoint identified ChainScript as a previously undocumented Node.js remote access trojan distributed through ClickFix activity and disguised as software installers, including Spotify, Zoom Workplace, and Microsoft Teams versions. [1] [2] [3] [4] [5]

The infection uses msiexec.exe, a bundled Node.js runtime, hidden PowerShell and VBScript stages, and user-profile execution that does not require administrator rights. [4] [6] [7] [8]

ChainScript queries a Polygon smart contract for a WebSocket command-server address, validates and caches the result for five minutes, and can receive a replacement address without changing the malware. [9] [10] [11] [12] [13] [14]

In Blackpoint’s analysis, the contract returned different server addresses after the initial connection, demonstrating backend rotation through the contract during the observed activity. [15] [16]

After connection, the malware supports an interactive shell, file read and write operations, screenshots, additional payload delivery, arbitrary JavaScript execution, self-update, and cleanup. [17] [18] [19]

The malware enumerates installed cryptocurrency wallets but, according to the source, contains no dedicated code for stealing seed phrases or private keys. [20] [21]

Why it matters

The source reports that domain and IP indicators may become short-lived when attackers can change the blockchain-resolved server address. [22] [23]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Blackpoint’s Adversary Pursuit Group was chasing a ClickFix campaign spreading an unknown RAT namend ChainScript.

2. [2]

   The malicious code is a previously undocumented Node.js remote access trojan that hides its command server on a public blockchain.

3. [3]

   The infection starts with a familiar ClickFix trick.

4. [4]

   The victim gets talked into pasting and running a command that fires up msiexec.exe, which pulls down an installer dressed up as Spotify.

5. [5]

   Alongside the Spotify build, other versions turned up posing as Zoom Workplace and Microsoft Teams, each with its own package name but the same code underneath.

6. [6]

   Inside that installer sits a full Node.js runtime and a JavaScript agent ready to launch.

7. [7]

   A hidden PowerShell script kicks off a VBScript file, which then starts the bundled Node.js runtime.

8. [8]

   None of this needs admin rights, since the installer is set to run entirely within the user’s own profile.

9. [9]

   Instead of having a fixed server address that security teams could block, the malware asks a smart contract on the Polygon blockchain for the address.

10. [10]

    It sends a request to the contract, gets an address back and then connects to it.

11. [11]

    The malware contacts the smart contract and receives a string starting with ws:// or wss:// .

12. [12]

    It then saves that address for five minutes and uses it to connect to the attackers’ server.

13. [13]

    If the attackers want to move to a different server, they only need to update the smart contract.

14. [14]

    “ChainScript ABI decodes the returned string, verifies that it begins with ws:// or wss:// , caches the result for five minutes, and uses it in place of the panel value stored directly in the configuration” Blackpoint watched this play out live.

15. [15]

    During analysis, the contract first pointed the agent to one server, which stayed active for about 18 minutes while exchanging heartbeat traffic.

16. [16]

    Twelve minutes after the connection reset, the same contract handed back a completely different address, proving the backend can rotate without anyone ever updating the malware itself.

17. [17]

    Once connected, ChainScript doesn’t just sit and listen.

18. [18]

    It hands operators a full interactive shell, file read and write access, desktop screenshots, the ability to push additional payloads, a scan for installed crypto wallets, arbitrary JavaScript execution, and a self-update function.

19. [19]

    That’s complete control of the machine, with a cleanup command built in for when the job is done.

20. [20]

    On the wallet front, the malware stops at reconnaissance.

21. [21]

    It lists which wallets are installed and where, but there’s no dedicated code for stealing seed phrases or private keys.

22. [22]

    For defenders, this changes where they should focus their attention.

23. [23]

    Tracking domains and IP addresses is still useful, but those indicators may not stay valid for long if the attackers can simply change the blockchain contract.

Read the original article →

What happened

TASK#STOMP is a Windows backdoor that searches victims’ drives for business documents, uploads them to attacker servers, and monitors for newly added or edited documents. [1]

The malware steals saved Wi-Fi passwords and clipboard text, takes screenshots, and executes commands sent by its operators. [2]

Known limitations

Securonix Threat Research based its analysis on one infected machine and could not determine how many organizations were affected. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Researchers have taken apart TASK#STOMP, a Windows backdoor that searches a victim’s drives for business documents, uploads them to attacker servers, and then stays put to grab each new or edited document.

2. [2]

   The same malware steals saved Wi-Fi passwords and clipboard text, takes screenshots, and runs whatever command its operators send.

3. [3]

   Akshay Gaikwad and Aaron Beardslee of Securonix Threat Research built their analysis from one infected machine, so Securonix cannot say how many organizations are … More → The post The TASK#STOMP Windows backdoor takes Wi-Fi passwords, screenshots, and business files appeared first on Help Net Security .

Read the original article →