AI agents have broken the old security assumption that enterprise environments are predictable, because they can act autonomously, borrow human access, and spread across systems faster than traditional tools can track them. The article argues that security teams should buy the foundation and build the operational layer on top of a live identity control plane, so they can govern agent access without slowing innovation. #TokenSecurity #IdentitySecurity #AgenticAI
Category: Cyber Security News
Spirals, a new ransomware actor, completed a full intrusion against an IT services firm in South Asia in less than 24 hours, stealing data and encrypting systems after compromising an exposed IIS server. Symantec says the attacker used web shells, credential dumping, lateral movement tools, and destructive defense evasion tactics before deploying the payload and threatening to leak stolen data. #Spirals #Symantec #IIS #PsExec #Cloudflare
UAT-11795 is a financially motivated Russian threat actor using trojanized installers to deploy Starland RAT and steal credentials, cryptocurrency wallet data, and other sensitive information from victims. Cisco Talos reported attacks since June 2025, with U.S. users primarily targeted and additional victims seen in Germany, Romania, and Venezuela. #UAT-11795 #StarlandRAT #CiscoTalos #MobaXterm #WebEx #Zoom #DBeaver #FaceIT #CastleStealer #Remcos
CISA has ordered U.S. federal agencies to patch Oracle E-Business Suite systems by Saturday after confirming active attacks against CVE-2026-46817, a critical flaw in Oracle Payments that allows unauthenticated takeover over HTTP. Oracle and threat researchers said the issue has been exploited in the wild, with more than 1,000 Internet-exposed Oracle EBS instances tracked and many located in the United States. #CVE-2026-46817 #OracleEBusinessSuite #OraclePayments #CISA
Microsoft has announced that Windows 10 Enterprise LTSB 2016 and Windows 11 24H2 Home and Pro editions will reach end of updates on October 13, 2026, meaning they will stop receiving monthly security and preview fixes. The company is urging users to move to Windows 11 25H2, while Enterprise and Education editions remain supported until October 12, 2027. #Windows10 #Windows11 #Windows1125H2
Two leading members of Scattered Spider received five-year-and-six-month prison sentences for the 2024 attack on Transport for London. The breach disrupted TfL services, exposed customer data, caused major financial losses, and led to arrests and further international charges tied to wider attacks. #ScatteredSpider #TransportforLondon #TfL #ThalhaJubair #OwenFlowers
F5 released an out-of-band update for NGINX and BIG-IP that fixes eight vulnerabilities, including CVE-2026-42533, a critical heap buffer overflow issue in NGINX Plus and NGINX Open Source. The patches also address multiple high-severity flaws in NGINX Ingress Controller and BIG-IP that could enable memory leaks, process restarts, configuration abuse, and…
Splunk and Zoom released patches this week for multiple critical and high-severity vulnerabilities across their products, including flaws that could lead to credential exposure, file writing outside intended directories, and account takeover. Neither company says the issues have been exploited in the wild, and Splunk’s updates also cover serious bugs in…
Oak has emerged from stealth with $60 million in seed funding to build an AI-powered Identity Operating System that unifies identity governance across human, AI, and machine identities. The platform connects to cloud, on-premises, SaaS, and homegrown systems to replace fragmented legacy tools with continuous, evidence-based identity control and real-time remediation….
Trend Micro, ESET, Tenable, and Tanium all released updates this month to fix severe vulnerabilities in their products, including issues that could lead to remote code execution, privilege escalation, and denial of service. Although there is no evidence of exploitation yet, security products are frequent targets and recent in-the-wild attacks have…
Nightmare Eclipse has released another Windows zero-day, LegacyHive, a local privilege escalation flaw in the Windows User Profile Service that can let an attacker load other users’ hives, including administrator hives. The researcher also shared a stripped proof-of-concept that works on systems with Microsoft’s July 2026 patches, while Microsoft has not…
ESET warns that 11 old Microsoft-signed UEFI shim bootloaders can let attackers bypass Secure Boot on UEFI-based systems that trust the Microsoft Corporation UEFI CA 2011 certificate. Microsoft revoked the vulnerable shims in June 2026 and added them to the UEFI DBX, but administrators must update trusted boot components before applying…
The Trump administration launched Gold Eagle, a federal AI-driven clearinghouse housed in the Treasury Department to rapidly detect, prioritize, and patch cybersecurity vulnerabilities across industry, critical infrastructure, and government systems. The effort brings together the Pentagon, DHS, CISA, open-source software providers, and Anthropic models, while also relying on a secure coordination…
Mozilla has patched two critical Firefox vulnerabilities, CVE-2026-15718 and CVE-2026-15719, after warning that exploit code was already public. Adobe, Google, and Broadcom also released major security updates for products including ColdFusion, Chrome, Commerce, Experience Manager, Illustrator, and VMware Avi Load Balancer. #Firefox #CVE-2026-15718 #CVE-2026-15719 #Chrome #ColdFusion #AdobeCommerce #MagentoOpenSource #AdobeExperienceManager #VMwareAviLoadBalancer…
OkoBot is a Windows malware framework active since April 2025 that uses its SeedHunter module to steal hardware wallet recovery phrases by injecting fake recovery pages into legitimate Ledger Live, Ledger Wallet, and Trezor Suite software. Kaspersky found hundreds of victims across more than 25 countries, with notable concentration in Brazil,…