Stop Trying to Control AI Behavior. Control What AI Can Reach

AI agents are inherently unpredictable, so security should focus on the credentials, tools, and enterprise systems they can actually reach rather than trying to enumerate every possible action. The article argues for mapping agent blast radius, reducing local secret exposure, and enforcing controls at the moment credentials are accessed to limit damage from tools like Cursor, MCP, AWS IAM, Microsoft Entra, and Okta. #Cursor #MCP #AWSIAM #MicrosoftEntra #Okta #GitGuardian

Read More
Ransom! Optimum First Mortgage (Pear’s acting group’s promotional blog) (SEP-2026)

Optimum First Mortgage (Pear’s acting group’s promotional blog) in the USA reported a ransomware claim by blacknevas involving the alleged theft and encryption of approximately 9.3TB of financials, HR, clients’ private data, PII/PHI, email correspondence/mailboxes, database exports, and OneDrive-stored data. The threat actor is said to have leveraged access via dark-web download links for optimumfirst.com. #UnitedStates

Read More
Ransom! Optimum First Mortgage (Pear’s acting group’s promotional blog) (SEP-2026)

HandyTrac Greystar AZ (US) claims ransomware activity by Threat Actor “ShadowByt3$,” stating they locked out management and staff and are extending negotiations to September 22, 2026 at 3:00pm while possessing key maps/reports, property intelligence and vulnerability logs, employee credential data, financial/vendor records, and administrative portal control. The claim includes “proof of lockout” imagery and asserts the attacker disabled systems and data, with the impacted country listed as #UnitedStates.

Read More
Cohesity adds recovery capabilities for AI agents and the data they manage

Cohesity has launched Agent Resilience to discover, protect, and recover the infrastructure behind enterprise AI agents, closing a critical gap when agent actions corrupt or change systems. The company also unveiled its vision for Autonomous Cyber Resilience and a free AI Resilience Academy course to help organizations manage the risks of AI agents as they move from advising to acting. #Cohesity #CohesityAgentResilience #AutonomousCyberResilience #CohesityDataCloud #AmazonBedrock #CohesityRecoveryAgent #CohesityMaestro #CohesityGaiaCatalog

Read More
Self-improving AI should slow down, von der Leyen tells EU lawmakers

Ursula von der Leyen urged frontier AI development to slow down, warning that upcoming models could enable hacking at an unprecedented level and that self-improving systems may pose growing security risks. She said the EU will work with Canada, the U.K., and other partners on model evaluation, verification, early warning, and AI security, while also pushing AI use across key sectors like health, transport, agrifood, manufacturing, and defense. #UrsulaVonDerLeyen #EuropeanCommission #AIAct #CETA #HuggingFace

Read More
CISA promotes a fresh way to deter cyberattackers: Lie to them

CISA has released new guidance encouraging critical infrastructure operators to use cyber decoys, such as fake systems, accounts, and data, to detect and distract intruders already inside their networks. The 22-page guide explains how honeytokens and other decoy techniques can support zero-trust and assume-compromise defenses at low cost. #CISA #CyberDecoys #Honeytokens

Read More
Cybersecurity News | Daily Recap [15 Sep 2026]

Daily Recap, Cisco patched an actively exploited Secure Email Gateway zero-day that enables command execution as root, while China-linked actors chained a Chrome-Windows zero-day to deploy GRIMWEDGE. Attackers also targeted WooCommerce/WordPress via a third-party plugin, abused exposed Vite dev servers for AWS/Azure secrets, and leveraged a Telegram Desktop HTML export flaw to exfiltrate messages, alongside ongoing ransomware exploitation of a VMware vCenter RCE flaw.
#Cisco #GRIMWEDGE #WooCommerce #WordPress #Vite #AWS #Azure #TelegramDesktop #VMwarevCenter #ClickFix #PasteSwitch #DDROP #BlackAxe

Read More
Spain’s data agency gets first report of AI-powered data breach

The Spanish Data Protection Agency (AEPD) was notified of a breach allegedly carried out by an AI agent using a known large language model, which autonomously searched for vulnerabilities, logged into systems, and accessed personal and financial data. The incident underscores how AI can speed up, scale, and adapt attacks, prompting a review of identity security, response procedures, and data protection models. #AEPD #OpenAI #HuggingFace #GoogleGemini #AnthropicClaude

Read More
Malware bypasses browser checks to force install Chrome, Edge extensions

A banking malware campaign active since mid-2025 has used the KREMLIN toolkit to silently install malicious Chrome and Edge extensions that steal credentials, session tokens, and browser data. Elastic Security Labs linked the operation to a Brazilian threat actor, confirmed 1,515 infected systems, and disrupted part of the campaign by registering a key anti-sandbox domain. #KREMLIN #ElasticSecurityLabs #REMCOS #PulsarRAT #Brazil

Read More
Iranian hackers use CHOSEN BRICK Windows malware to spy on targets

Government agencies warn that Iranian state-linked hackers are using CHOSEN BRICK to spy on dissidents, activists, and journalists by stealing messages, screenshots, and audio. The malware is spread through social engineering on WhatsApp and Telegram, hides with Windows persistence, and sends stolen data through Telegram and cloud services. #CHOSENBRICK #Iranian #Telegram #WhatsApp #FBI

Read More
Windows 11 KB5124008 update breaks domain trust for some users

Microsoft is investigating reports that the Windows 11 KB5124008 security update is breaking domain trust relationships on some enterprise systems, causing valid domain credentials to fail after reboot. Administrators say the issue appears linked to the Machine Identity Isolation feature in Windows 11 25H2, with some systems recovering after disabling it and repairing the secure channel. #Microsoft #Windows11 #KB5124008 #MachineIdentityIsolation #ActiveDirectory

Read More
Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

Zscaler reports that APT36 ran Operation RapidRust in August 2026, targeting government and defense organizations in India and Afghanistan with new tooling including RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The campaign used private GitHub repositories, typosquatted Indian media domains, and Backblaze-hosted payloads to enable encryption, exfiltration, persistence, and USB-based propagation. #APT36 #RUSTYSHADE #RUSTYMOVE #PSNATCH #BASHNATCH #GitHub #Backblaze

Read More