September 25, 2026

What happened

Ping Identity announced Enterprise Personal Agent Access, an end-to-end approach combining discovery, secretless privileged access, and runtime control for personal AI agents. [1]

The announcement is described as enterprise security for personal AI agents. [1]

Known limitations

The supplied excerpt does not specify implementation details, deployment availability, affected products beyond the announced offering, or evidence of its effectiveness. [1] [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Ping Identity introduces enterprise security for personal AI agents Ping Identity announced an end-to-end approach that combines discovery, secretless privileged access and runtime control for personal AI agents.

2. [2]

   With Ping Identity’s Enterprise Personal Agent Access, companies can see which AI … More → The post New infosec products of the month: September 2026 appeared first on Help Net Security .

Read the original article →

What happened

Cloudflare Containers had a flaw that let a paying customer read data left behind by other customers’ containers on the same server. [1]

The exposed data was from disk space released by earlier containers, rather than from a live workload. [2]

According to Cloudflare, an attacker could not choose whose leftover data they obtained. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A flaw in Cloudflare Containers let a paying customer read data that other customers' containers had left behind on the same server, Cloudflare and the researchers who found it said on Thursday.

2. [2]

   The data came from disk space that earlier containers had used and given up, not from any live workload, and an attacker could not choose whose data they got, according to Cloudflare.

Read the original article →

What happened

According to the SANS 2026 Threat Hunting Survey, half of security professionals identify data quality or quantity as their biggest barrier to effective threat hunting. [1]

Teams with working playbooks describe their logging as the ceiling for threat-hunting effectiveness, with gaps in cloud logging and identity telemetry cited most often. [2]

Why it matters

Respondents say logging gaps are especially harmful against attackers who blend in with legitimate activity. [3]

Known limitations

The supplied excerpt does not provide the survey sample size, methodology, or detailed recommendations for improving data quality or telemetry coverage. [1] [2] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Half of security professionals name data quality or quantity as their biggest barrier to effective threat hunting, according to the SANS 2026 Threat Hunting Survey.

2. [2]

   Teams with working playbooks describe the logs as their ceiling, and gaps in cloud logging and identity telemetry come up most often.

3. [3]

   Gaps in the logs hurt most against the attackers respondents see most often, the ones who blend in with legitimate activity.

Read the original article →

What happened

Ariel Assaraf, CEO of Coralogix, says a system prompt can describe an AI-agent boundary but cannot enforce it. [1]

Assaraf describes building AI-agent guardrails at the execution layer and limiting context without expanding authority. [2]

He says controls are tuned by risk so agents remain useful during incidents. [2]

Why it matters

Assaraf describes tracking the consequences of agent actions rather than focusing only on what agents say; the supplied excerpt is truncated after this point. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   In this interview with Help Net Security, Ariel Assaraf, CEO of Coralogix, explains why a system prompt can describe a boundary for an AI agent but cannot enforce one.

2. [2]

   Assaraf covers how his team builds AI agent guardrails at the execution layer, limits context without expanding authority, and tunes controls by risk so agents stay useful during incidents.

3. [3]

   He describes how he tracks the consequences of agent actions, since an agent can return 200s and … More → The post Stop watching what AI agents say and start watching what they do appeared first on Help Net Security .

Read the original article →

What happened

Dataiku announced Agent Management, a standalone product intended to discover an enterprise’s AI agents across platforms, measure their business and technical performance, and flag agents posing the greatest risk. [1]

Why it matters

The launch addresses a gap between the pace at which AI agents are created and adopted and organizations’ ability to observe and manage them. [2]

Known limitations

The supplied evidence does not describe Agent Management’s availability, deployment requirements, measurement methods, or risk criteria. [1] [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Dataiku has announced the launch of Agent Management, a standalone product that finds every AI agent an enterprise is running, regardless of which platform built it, measures the business and technical performance, and flags agents that pose the greatest risk.

2. [2]

   The launch addresses a disconnect between how fast agents are being created and adopted and organizations’ ability to observe and manage them.

Read the original article →

What happened

Abnormal AI announced additions to its AI Security suite for enterprise AI adoption and protection against threats created or accelerated by AI. [1]

The suite includes generally available Abnormal AI Governance and AI Cloud Security, which was previously announced in private preview. [2]

Three newly announced products are AI Employee Guardrails, AI Agent Security, and AI Security Workbench. [2]

Why it matters

The announcement positions the suite as combining governance, cloud security, and threat investigation for enterprises adopting AI across business functions. [1] [2] [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Abnormal AI has unveiled the newest additions to its AI Security suite, designed to help enterprises adopt AI securely while protecting against new threats created or accelerated by AI.

2. [2]

   The suite brings together Abnormal AI Governance, which is generally available, and AI Cloud Security, previously announced in private preview, with three newly announced products: AI Employee Guardrails, AI Agent Security, and AI Security Workbench.

3. [3]

   Enterprises are adopting AI across nearly every part of the business … More → The post Abnormal AI brings governance, cloud security, and threat investigation into one suite appeared first on Help Net Security .

Read the original article →

What happened

Allure Security found an attacker offering fake desktop applications for three large U.S. payroll and HR platforms that had not released desktop applications. [1]

Running one of the installers installs ScreenConnect, a legitimate remote-access tool configured to let the attacker control the computer without the user’s knowledge. [2]

Why it matters

The reported campaign targets users of payroll and HR services and provides the attacker with remote control of an infected computer. [1] [2]

Known limitations

The evidence identifies the products as browser-accessed web applications, but does not name the three providers or describe the campaign’s scale, delivery channels, or confirmed access to payroll data. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   An attacker has been offering “desktop apps” for three large US payroll and HR platforms that have never released one, Allure Security have found.

2. [2]

   Anyone who runs the installer gets a copy of ScreenConnect, a legitimate remote access tool, configured to let the attacker control the computer without the user knowing.

3. [3]

   According to Ryan Merritt, Director of Security Research at Allure Security, all three providers deliver their products as web applications accessed through a browser, … More → The post Fake payroll desktop apps hand attackers a route to company paychecks appeared first on Help Net Security .

Read the original article →

What happened

Docker announced Docker Cloud Sandboxes as a solution for secure, isolated AI-agent execution, allowing agentic workflows to continue running in the cloud after a developer’s laptop shuts down. [1]

The announced sandboxes are intended to let organizations run agentic workloads at scale without tying up developers’ hardware, provisioning their own infrastructure, or paying for unused capacity. [2]

Known limitations

The supplied evidence does not substantiate the article title’s claim about OCI-based Kits or explain how agents and guardrails are packaged. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Docker has announced Docker Cloud Sandboxes, a new solution for secure, isolated AI agent execution that enables complex agentic workflows to continue running in the cloud long after a developer’s laptop shuts down.

2. [2]

   Launched at WeAreDevelopers North America, Docker Cloud Sandboxes let organizations run agentic workloads at scale without tying up developers’ hardware, provisioning their own infrastructure, or paying for unused capacity.

3. [3]

   Docker Cloud Sandboxes give developers a straightforward path to move their agentic workflows … More → The post Docker introduces OCI-based Kits to package agents and their guardrails appeared first on Help Net Security .

Read the original article →

What happened

Kaspersky reports that a new MacSync variant targets Mac users with an infostealer and persistent backdoor designed to steal credentials, cryptocurrency-wallet data, and files. [1]

Researchers found MacSync spreading through the Toria cryptocurrency-wallet app, which had its own website and was promoted on X and Telegram. [2]

MacSync is a Mac-malware family that emerged in 2025 as Mac.c and was later renamed. [3]

The supplied text states that early MacSync versions used AppleScripts resembling AMOS, but the sentence is truncated and does not provide further detail about the iCloud Calendar technique. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A new MacSync variant targets Mac users with an infostealer and persistent backdoor designed to steal credentials, crypto wallet data, and files, according to Kaspersky.

2. [2]

   Researchers found the malware spreading through a crypto wallet app called Toria, which had its own website and was promoted on X and Telegram.

3. [3]

   MacSync is a family of Mac malware that emerged in 2025 as Mac.c and was later renamed.

4. [4]

   Early versions used AppleScripts that closely resembled the AMOS … More → The post MacSync info-stealing malware hides malicious commands in an iCloud calendar appeared first on Help Net Security .

Read the original article →

What happened

The Canadian Centre for Cyber Security warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild. [1]

CVE-2026-48842 is described as a CVSS 8.1 pre-authentication SQL injection in Roundcube Webmail’s virtuser_query plugin. [2]

The affected versions are Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1. [2]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   The Canadian Centre for Cyber Security has warned that a now-patched Roundcube Webmail vulnerability is being actively exploited in the wild.

2. [2]

   The vulnerability in question is CVE-2026-48842 (CVSS score: 8.1), a pre-authentication SQL injection in the virtuser_query plugin of Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1.

Read the original article →

What happened

Bitget said suspected North Korean threat actors stole $351.6 million from its hot and warm wallets. [1]

Bitget said its security systems identified unauthorized transfers involving a limited number of hot wallets at 18:31 UTC on September 24, 2026. [2]

Known limitations

The supplied evidence truncates Bitget’s statement about its cold wallets and most platform assets, so their status cannot be determined from these spans. [3]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets.

2. [2]

   "At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets," BitGet said in a post shared on X.

3. [3]

   "Bitget's cold wallets and the overwhelming majority of platform assets remain

Read the original article →

What happened

The source says AI has made failed cyberattacks cheap to retry, rather than necessarily creating an entirely new class of attack. [1] [2]

The described routine begins when an attacker gains access to a low-privilege cloud account and an initial privilege-escalation attempt fails. [3] [4]

Why it matters

The source contrasts the current cost of retrying a failed attack with the past cost, when a dead end could require hours of documentation reading. [2] [5]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Security leaders keep debating whether AI will produce an entirely new class of cyberattack.

2. [2]

   The nearer change is quieter and already visible: AI has made a failed attack cheap to retry.

3. [3]

   The routine version looks like this.

4. [4]

   An attacker lands on a low-privilege cloud account, and the first try at privilege escalation goes nowhere.

5. [5]

   That dead end used to cost hours of documentation reading,

Read the original article →

What happened

A detection rule may appear deployed on a coverage dashboard yet never fire when an attacker uses the technique it was designed to detect. [1]

Conifers assessed 14,652 detections across customer-written rules and vendor-managed detections in SIEM, endpoint, cloud, identity, email, and network tools. [2]

Why it matters

The research found that 47% of detections in the average organization need attention. [3]

Known limitations

The supplied evidence does not describe the five failure groups beyond naming them, so their specific causes cannot be summarized. [4]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   A detection rule can show up as deployed on a coverage dashboard and still never fire when an attacker uses the technique it was built to catch.

2. [2]

   Conifers assessed 14,652 detections in its customer base, including rules written by customers and detections managed by vendors in SIEM, endpoint, cloud, identity, email and network tools.

3. [3]

   The research found that 47% of detections in the average organization need attention.

4. [4]

   The failures fall into five groups Logic bugs … More → The post Threat detection dashboards are masking security coverage gaps appeared first on Help Net Security .

Read the original article →

What happened

Attackers compromised legitimate Ukrainian business websites, injected hidden iframes, and displayed fake Cloudflare CAPTCHA pages to deliver Psychedelic Stealer. [1] [2] [3]

The campaign uses a ClickFix-style flow: clicking the fake CAPTCHA copies a Windows Installer command, then instructs the visitor to press Windows+R, paste it, and press Enter. [4] [5] [6] [7]

The downloaded MSI installs psychedeliclove.exe, which targets saved browser passwords, browser account tokens, and cryptocurrency wallets. [8] [9] [10]

Why it matters

After installation, the malware establishes persistence, profiles the host, polls command-and-control infrastructure, and supports additional EXE, COM, BAT, CMD, MSI, and PowerShell payloads. [11] [12] [13]

The lure appeared on trusted-looking business websites, which the source says could make the fake CAPTCHA harder for visitors to recognize. [14] [15] [16] [17]

At collection time, the management panel recorded 557 views, 426 clicks, and 79 complete events across 32 countries; Ukraine accounted for 446 views and 351 clicks. [18] [19]

Known limitations

The panel labeled complete events as executions, but the report says they confirm only that a user clicked Done in the browser, not that the command was run or the host was compromised. [20] [21]

Cited source evidence

These excerpts support the numbered claims above. They come from one source article and do not establish independent corroboration.

1. [1]

   Attackers hijacked Ukrainian websites to deliver a fake Cloudflare CAPTCHA that installs Psychedelic Stealer and steals browser and crypto credentials.

2. [2]

   Psychedelic Stealer is being distributed through compromised Ukrainian business websites.

3. [3]

   Attackers injected hidden iframes into legitimate pages and used them to display a fake Cloudflare verification screen to visitors.

4. [4]

   When the victim clicks the fake CAPTCHA, the page silently copies a Windows Installer command to the clipboard.

5. [5]

   It then tells the user to press Windows+R, paste the command and press Enter.

6. [6]

   Instead, the command directly launches msiexec.exe .

7. [7]

   It also includes the fake Cloudflare verification text, making the command in the Run window look like part of the verification process.

8. [8]

   The downloaded MSI file then installs a 64-bit executable called psychedeliclove.exe , which Arctic Wolf Labs tracks as Psychedelic Stealer.

9. [9]

   The malware targets saved passwords from browsers such as Chrome, Edge, Brave, Opera, Opera GX, Vivaldi and Yandex.

10. [10]

    It also steals browser account tokens and targets cryptocurrency wallets, including Exodus, Atomic Wallet, Electrum, Bitcoin Core and Litecoin Core.

11. [11]

    Beyond the one-time credential grab, the implant installs browser components and sets up a native messaging bridge that lets deployed browser content communicate with a local process on the machine.

12. [12]

    It creates a scheduled task for persistence named psychedelicloveUtils, profiles the host in detail including antivirus status and installed browsers, and then starts polling its command-and-control server for additional tasks.

13. [13]

    As Arctic Wolf Labs puts it: “The implant tracks task state in executed_tasks.json, downloads attachments into downloads\<taskid>_<filename>, and supports EXE, COM, BAT, CMD, MSI, and PowerShell files.” states the report.

14. [14]

    These were legitimate businesses with established social media profiles and third-party listings.

15. [15]

    Visitors were therefore directed to a trusted website they may have visited before, making the fake Cloudflare CAPTCHA harder to recognize.

16. [16]

    Visitors didn’t stumble onto an obvious fake domain.

17. [17]

    They landed on a site they may have visited before, for a business they already had some reason to trust, and got served a fake CAPTCHA instead of the page they were looking for.

18. [18]

    At collection time the panel showed 557 views, 426 clicks, and 79 complete events across 32 countries.

19. [19]

    Ukraine accounted for 446 of those views and 351 of the clicks, which combined with Ukrainian-language instructions and Ukrainian business websites makes the targeting intent about as clear as it gets.

20. [20]

    The Done button remains disabled for about 35 seconds after the command is copied.

21. [21]

    The panel labeled its complete events as “executions” and calculated a conversion rate from them, which Arctic Wolf correctly points out overstates actual confirmed compromises, since a complete event only means someone clicked Done in the browser, not that they ran anything.

Read the original article →