Microsoft Threat Intelligence
9/24/2026Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments
Storm-2570 is a ransomware affiliate that uses consistent post-compromise tools and techniques across deployments involving Qilin, DragonForce, Anubis, and BERT ransomware, and provides guidance to help defenders detect and disrupt this activity before ransomware deployment. The post Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments appeared first on Microsoft Security Blog .
Google Threat Intelligence / Mandiant
9/24/2026Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure
Introduction The landscape of software supply chain security has undergone a significant shift. Recent campaigns demonstrate that sophisticated threat actors are systematically targeting the engineering lifecycle by compromising trusted security and programming tools. These intrusions reveal three key tactics: Attackers target trusted security scanners, utility libraries, and AI developer tools to exploit the elevated privileges granted to these systems within build pipelines. Adversaries target developer workstations and Integrated Development Environments (IDEs) via highly tailored social engineering, malicious extensions, or typosquatted local dependencies to exfiltrate private cryptograp
Scan for Good: Using AI to discover and fix high-priority exposures across public services and critical infrastructure
New initiative partners with under-resourced organizations to uncover, remediate exploitable risk at scale.
When Business Email Compromise Starts Rewriting Reality
Business Email Compromise (BEC) operates on a familiar playbook. Threat actors breach a mailbox, silently monitor operations, map approval chains, and ultimately exploit that access to divert funds or exfiltrate sensitive assets. This dynamic is central to our analysis as we kick off a series around Rapid7's collaborative research with Zimbra; upcoming installments will explore technical details and broader findings based within the Zimbra Collaboration Suite. Our investigation disrupted the traditional BEC model in unexpected ways. We uncovered over 50 vulnerabilities, and found that several allow attackers not just to observe environments, but to actively rewrite them by impersonating send
CrowdStrike Counter Adversary Operations
9/24/2026CrowdStrike Named a Leader in The Forrester Wave™: Proactive Security Platforms, Q3 2026
CrowdStrike Counter Adversary Operations published new research concerning CrowdStrike Named a Leader in The Forrester Wave™: Proactive Security Platforms, Q3 2026. Follow the canonical source for the full analysis.
Recorded Future Insikt Group
9/24/2026Russia Escalating Hybrid Attacks Across Europe
Explore Insikt Group's analysis on Russia's escalation of hybrid and New Generation Warfare (NGW) tactics across Europe since 2022, including cyber attacks, physical sabotage, and airspace incursions, along with projected trends for the next two years.
Microsoft AI Security
9/23/2026Reimagining the SOC for the agentic era in Microsoft Defender
We are announcing ISOC in Microsoft Defender: a foundation built for agentic security that brings leading solutions for SIEM and threat protection together. The post Reimagining the SOC for the agentic era in Microsoft Defender appeared first on Microsoft Security Blog .
arXiv cs.CR (AI security)
9/23/2026GUIAuditor: Enabling Post-hoc Child Safety Forensics via Action-Guided GUI Provenance on Mobile Devices
The proliferation of smart devices exposes children to online risks like grooming and financial scams that are deeply embedded within legitimate applications. Current approaches rely on automated prevention and detection, a paradigm that is fundamentally limited by its inherent fallibility. Whether rule-based or AI-driven, they inevitably produce false positives and negatives, failing to provide reliable protection. In this paper, we argue for a complementary, human-in-the-loop, post-hoc forensic paradigm. We present GUIAuditor, the first system designed to realize this vision by creating GUI Provenance: a queryable, semantic record of a child's interaction sequence. To generate this, GUIAuditor leverages a Multimodal Large Language Model (MLLM) to translate the temporal sequence of GUI events into a human-understandable narrative. To make this practical on mobile devices, a novel eviden
SOCRadar Threat Research
9/23/2026CVE-2026-87902 in WordPress Enables Conditional RCE
CVE-2026-87902 in WordPress Enables Conditional RCE Security updates released for WordPress address CVE-2026-87902 , a severe unauthenticated path traversal flaw within its page-template resolution mechanism. The weaknes
How dynamic application security testing validates risk at runtime
Security teams already have long queues of potential application vulnerabilities. The useful question is what happens next: can they see how a weakness behaves in a running application, reproduce the attack, and give developers enough evidence to fix it? Dynamic application security testing (DAST) helps answer those questions by testing applications as an attacker encounters them. The IDC MarketScape: Worldwide Dynamic Application Security Testing 2026 Vendor Assessment (Doc #US54119126, September 2026). The IDC MarketScape evaluated 16 vendors and named Rapid7 a Leader. We believe the result reflects the strength of Rapid7’s DAST capabilities, but the IDC MarketScape also offers a useful vi
arXiv cs.CR (AI security)
9/23/2026Your Model Is Leaking: Covert Information Transfer through LLM Residual Streams
Privacy-sensitive organizations may run large language models (LLMs) in restricted or air-gapped environments while exporting selected diagnostic artifacts. We show that a compromised runtime component can hide sensitive information in intermediate activations that are allowed to leave the restricted environment. An offline observer can recover this information with a simple linear decoder. The attack requires no model retraining or weight modification, no attacker-controlled egress, and no control over the recorder or transfer process. We introduce a residual-stream covert-channel attack that maps messages to codewords and injects them into an intermediate residual stream through a compromised runtime hook. To maintain recoverability, the injection strength is scaled with the local residual norm using the signal-to-residual-norm ratio. Across eleven models from seven architecture famili
CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM
Overview On September 22, 2026, F5 published a security advisory for CVE-2026-94127 , a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM). The vulnerability has a CVSS v3.1 score of 9.8. An unauthenticated attacker with network access to an affected virtual server may be able to achieve remote code execution (RCE) by sending specifically crafted traffic. BIG-IP APM provides identity-aware access control for applications and other corporate resources and can integrate with authentication technologies including OAuth, OpenID Connect, and SAML. CVE-2026-94127 is not exposed in a default configuration: exploitation requires a BIG-IP virtual server
Netskope Threat Labs
9/23/2026Gemini’s Breakout Is a Reminder the Basics Still Matter
In May, an Israeli security firm called Irregular put Google’s Gemini through a capture-the-flag exercise, testing how well the model could find its way through systems belonging to fictional companies. Perhaps unsurprisingly, Gemini didn’t stay inside the exercise. Google has confirmed that, through an unintended connection to the open internet, the model reached three real […]
arXiv cs.CR (AI security)
9/23/2026A Bulletproof Business? Towards Detecting Infrastructure-as-a-Service Offerings on Telegram
Cybercriminal operations increasingly depend on reusable digital infrastructure---including hosting, proxies, and virtual private networks (VPNs)---rented through Cybercrime-as-a-Service markets and advertised on platforms such as Telegram. We present a taxonomy for identifying Telegram messages advertising cybercriminal Infrastructure-as-a-Service (IaaS). The taxonomy comprises six service categories across compute, network, and communication infrastructure, together with three trust attributes: Bulletproof, Payment Security, and Transparency. Using 261 human-annotated messages, we evaluate keyword-based and TF--IDF classifiers and examine prompt-based large language models as exploratory baselines. We select a TF--IDF pipeline and apply it to 1,116,071 messages from 167 cybercrime-related Telegram communities. The pipeline assigns at least one infrastructure category to 207,244 message
arXiv cs.CR (AI security)
9/23/2026Only Pay What You Must Spend: On-Demand Privacy Budget Payment for Differentially Private RAG
Deploying large language models (LLMs) on sensitive data via Retrieval-Augmented Generation (RAG) introduces severe privacy risks. Recent studies apply Differential Privacy (DP) to LLMs with RAG for formal privacy guarantees. However, existing DP-RAG frameworks rapidly exhaust the privacy budget. Although recent efforts attempt to save the budget by narrowing the retrieval scope or sparsifying private generation, these methods themselves cumulatively consume the budget, whereas they could actually rely merely on public information or at a negligible one-time privacy cost. This mismatch fails to align budget expenditure with the model's actual reliance on private data, causing substantial waste on operations that require no private access. To address this, we propose SparsePay-RAG, adopting "only pay what you must spend" as its core principle. Using public information as a zero-privacy pr
arXiv cs.CR (AI security)
9/23/2026Automated Extraction of Records of Processing Activities (RoPA) Using Hybrid RAG and Locally Deployed Large Language Models
Vietnam's Personal Data Protection Law (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP, effective January 1, 2026, require organizations to establish and maintain Records of Processing Activities (RoPA). Manual RoPA preparation is labor-intensive, while cloud-hosted large language models (LLMs) may conflict with data-sovereignty requirements. We propose RoPA Manager, a system for automated RoPA information extraction using hybrid retrieval that combines lexical ranking over tsvector, dense-vector search, Reciprocal Rank Fusion (RRF), and locally deployed LLMs. We introduce a Vietnamese RoPA benchmark with 32 organizations, 77 processing activities, 12 field groups, and 4,338 reference values. Evaluation is reported at three distinct levels. The automated scorer, tested on perturbed data without invoking an LLM, achieved F1 = 0.9493 [0.9436, 0.9548]; this measures scorer robustness r
Recorded Future Insikt Group
9/23/2026The Lure Isn't The Malware. It's Your Logo.
Recorded Future's Insikt GroupⓇ has been tracking ClickFix, a social engineering technique that turns a familiar logo or verification prompt into the entry point for an attack. Here's what that research reveals about catching it, and why it's now running inside Malicious Site Monitoring, part of our newly launched Digital Risk Protection solution.
arXiv cs.CR (AI security)
9/22/2026The Like Trap: Multi-Stage Poisoning against Agents in Similarity-based Recommendation Systems
With recent advancements in large language models (LLMs) and LLM-based agents, these agents are becoming increasingly autonomous and gaining broader access to act on users' behalf on the internet. However, the vulnerability of automated agents deployed on social media platforms (e.g., for managing a user's personal account) remains underexplored. Existing studies on agent poisoning typically assume that the adversary can expose poisoned content to the agent. Although such an attack is direct and effective, it is more easily detected and mitigated. In the context of social media platforms, this leaves open whether the recommendation system itself would surface such content to the agent in a more subtle manner. Through theoretical analysis, we show that the like-score mechanism used in OASIS can be exploited, and we characterize the conditions under which a multi-stage chain of poisoned po
Microsoft Threat Intelligence
9/22/2026Unmasking EvilTokens: Getting to the root of device code phishing
EvilTokens has quickly become one of the top PhaaS platforms, enabling device code phishing attacks through AI-assisted lures, automated infrastructure, and token theft. In collaboration with partners, Microsoft Digital Crimes Unit (DCU) facilitated a disruption of EvilTokens infrastructure and operations. The post Unmasking EvilTokens: Getting to the root of device code phishing appeared first on Microsoft Security Blog .
SOCRadar Threat Research
9/22/2026Berlin Data Leak: What Rhysida Published, and What Is Still Unresolved
Berlin Data Leak: What Rhysida Published, and What Is Still Unresolved This post consolidates what has been confirmed by the State of Berlin, what remains the threat actor's own claim, and what the published file listing
Proofpoint Threat Research
9/22/2026Proofpoint Breaks Down the Divide Between Data Security and AI Security with the Industry’s First Unified Agentic System
Proofpoint Threat Research published new research concerning Proofpoint Breaks Down the Divide Between Data Security and AI Security with the Industry’s First Unified Agentic System. Follow the canonical source for the full analysis.
Proofpoint Threat Research
9/22/2026Proofpoint Stops the Attacks Traditional Defenses Miss in the AI Era
Proofpoint Threat Research published new research concerning Proofpoint Stops the Attacks Traditional Defenses Miss in the AI Era. Follow the canonical source for the full analysis.
SOCRadar Threat Research
9/22/2026Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures
Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures Since 2009, the Democratic People’s Republic of Korea (DPRK) has fully integrated cyber operations into its national strategy, leveraging state-ne
The Closed Quorum: Inside the first reported autonomous AI C2 implant
CLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). It represents a shift in effort displacement for attackers, in which expanding portions of the attack chain can be executed without operator involvement.
Introducing CAIRN: Frontier tracking for AI-integrated malware
Talos is releasing CAIRN, a research toolkit for hunting, classifying, and tracking emerging AI-integrated malware.
SOCRadar Threat Research
9/22/2026August 2026: GTA VI Leak, Keyv & Carhartt Breaches
August 2026: GTA VI Leak, Keyv & Carhartt Breaches August 2026 brought a wide mix of cyber incidents, from large-scale data breaches affecting millions of people to software supply chain attacks targeting developers and
Netskope Threat Labs
9/22/2026Mizuho Financial Group Uses Netskope to Scale AI Agent Development Securely
Mizuho Financial Group, Inc., one of Japan’s leading global financial groups, is advancing AI Transformation to create new value for customers and society by augmenting employee capabilities and transforming business processes. At the heart of this initiative is the group’s in-house development lab. As Mizuho Financial Group accelerated the development of AI agents at scale, it faced a critical challenge: balancing security with developer productivity. To address this, the group deployed Netskope in its in-house development environment, establishing a security foundation designed to address emerging risks in the age of AI agents. With ongoing operational support from Netskope, Mizuho Financi
Security Awareness Curriculum
FortiGuard Labs published new research concerning Security Awareness Curriculum. Follow the canonical source for the full analysis.
Check Point Research
9/21/202621st September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 21st Setpember, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Japan’s Digital Agency, which operates the Government Solution Service used by multiple ministries, has confirmed a data breach after attackers exploited a vulnerability in a VPN appliance. Approximately 246,000 records were exposed, […] The post 21st September – Threat Intelligence Report appeared first on Check Point Research .
SOCRadar Threat Research
9/21/2026Click2Shell: WordPress Flaw Enables RCE Chain
Click2Shell: WordPress Flaw Enables RCE Chain Click2Shell is a vulnerability in WordPress Core that allows a logged-in administrator's browser to be manipulated into installing and previewing a theme without explicit con
SOCRadar Threat Research
9/21/2026Clop Hack: ShinyHunters Hijacks Data Leak Site
Clop Hack: ShinyHunters Hijacks Data Leak Site ShinyHunters has turned the tables on rival cybercrime operation Clop (a.k.a. Cl0p), hijacking and defacing the ransomware gang’s own Dark Web leak site (DLS). The Clop hack
One does not simply defend agentically
Defenders can’t use AI in the same way attackers can, but there’s much they can do to unlock the potential of agentic cyber defence.
Palo Alto Unit 42
9/21/2026From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies
We explore how AWS neutralizes exposed IAM credentials using managed policies, detailing GitHub secret scanning and CloudTrail monitoring strategies. The post From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies appeared first on Unit 42 .
The SMB cybersecurity squeeze: AI agents at work, old attacks in overdrive
As AI opens new paths to company data while making familiar attacks faster and cheaper, SMBs need protection designed around the time and expertise available to operate it
SOCRadar Threat Research
9/21/2026Dominican Republic Leak, Celestial Malware, Money Network Sale, CVV Auction, and US VPN Access
Dominican Republic Leak, Celestial Malware, Money Network Sale, CVV Auction, and US VPN Access SOCRadar Dark Web Team identified several new underground posts, including an alleged Dominican Republic citizen data leak ,
Netskope Threat Labs
9/21/2026Government AI Use Cases Have Passed 3,600. Security Must Catch Up
With encouragement from the highest levels of government, federal agencies are creating thousands of AI use cases. As these use cases come online, agency leaders must ensure that the appropriate cybersecurity protections are in place to prevent AI tools from inadvertently exposing government data and infrastructure to malicious actors. The Office of Management and Budget […]
Elastic Security Labs
9/21/2026Cloud Threat Emulation on Autopilot: Context is Everything
Cloud threat emulation is more than detonation. A plan-first methodology for cloud detection engineering: scope, victim model, telemetry, coverage, cleanup. Learn how to properly leverage AI to automate your emulations.
AI Incident Database
9/19/2026Exclusive: US military had close call after using AI for false intelligence report, sources say
The intelligence report, circulated across the US military this spring in the midst of the war with Iran, immediately set off alarm bells: A Chinese ship in the Middle East was transporting components of a nuclear weapons program. The US m ... (https://incidentdatabase.ai/cite/1701#7982)
AI Incident Database
9/19/2026Images of Trump kissing Natalie Harp went viral. They’re AI-generated fakes.
Images purporting to show President Donald Trump kissing White House aide Natalie Harp on a golf course ricocheted about social media this week, amassing millions of views across online platforms. They were fakes — circulated with no clear ... (https://incidentdatabase.ai/cite/1699#7980)
AI Incident Database
9/19/2026US woman falsely charged with bank theft sues for $10m over AI facial recognition
A Tennessee woman who was falsely charged with bank theft in North Dakota and jailed for six months has sued for $10m in damages, alleging in a federal lawsuit that Fargo police improperly relied on an artificial intelligence (AI) facial re ... (https://incidentdatabase.ai/cite/1416#7979)
AI Incident Database
9/19/2026Gemini Hacked Three Companies in First Known Breakout by Google’s AI
Google’s Gemini model accessed the internet and hacked other companies during a test of its cybersecurity capabilities, the first known example of the company’s artificial-intelligence systems autonomously committing such an act. The hacks ... (https://incidentdatabase.ai/cite/1700#7981)
AI Incident Database
9/19/2026Former Costa Mesa Police Officer Pleads Guilty to Contacting His Mistress Thousands of Times Through Text, Phone Calls, and Social Media Messages, Including More than 100 Times in a Day, Illegally Acc
SANTA ANA, Calif. -- A former Costa Mesa police officer pleaded guilty to contacting his mistress thousands of times through text, telephone calls, and social media messages, sometimes more than 100 times in a day, over nine months and use ... (https://incidentdatabase.ai/cite/1697#7977)
AI Incident Database
9/19/2026Sisters sue Española over traffic stop they say was illegal
Two Rio Arriba County sisters have filed lawsuits against the city of Española, contending they were subjected to an illegal traffic stop after a surveillance camera mistakenly flagged their car as one that had been stolen in Rio Rancho. E ... (https://incidentdatabase.ai/cite/1698#7978)
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
North Korean operators built a foothold on a DevOps engineer's Mac in a campaign whose job interview lures deliver malware via Terraform lock files.
arXiv cs.CR (AI security)
9/18/2026Watermarkable Multi-Draft Speculative Sampling via Poisson Processes
Large language models (LLMs) have achieved state-of-the-art performance across a wide range of tasks, motivating two important aspects of deployment: inference efficiency and output provenance, which can be tackled by speculative sampling and watermarking, respectively. However, recent works have shown that combining these two goals is highly nontrivial and can be potentially impossible. In this work, we develop a novel multi-draft speculative sampling algorithm based on Poisson processes that improves the frontier of this fundamental trade-off. The proposed algorithm has strong sampling efficiency on its own and, more interestingly, is naturally watermarkable: we can embed an unbiased watermark without degrading speculative acceptance. Moreover, our algorithm is based on an exact list-coupling-without-communication scheme, which yields a drafter invariance property that benefits both sa
arXiv cs.CR (AI security)
9/18/2026CASCADE Against Jailbreaks: Combination Across Stages with Controlled Attack-Defense Evaluation
Defenses against jailbreak attacks on Large Language Models (LLMs) operate at different pipeline stages, such as input modification or output guard, but it remains unclear which defenses to deploy at each stage and how to combine them. Prior empirical studies, fragmented by inconsistent attack-success-rate definitions and experimental settings, have evaluated defenses largely in isolation. Here we present the first systematic study, to our knowledge, of defense combinations both within and across pipeline stages, under a consistent threat model of direct, black-box, single-turn attacks. Our decision framework standardizes evaluation through a principled attack-success-rate formulation with controlled query budgets, together with explicit fairness rules. Across 19 attacks and 15 defenses, we find that no single defense is universally best, but well-chosen combinations achieve substantial
SOCRadar Threat Research
9/18/2026CVE-2026-91843: Check Point Root RCE
CVE-2026-91843: Check Point Root RCE Check Point has patched CVE-2026-91843 , a critical stack-based buffer overflow flaw in the login process of its Security Management and Log Server products. If exploited, an unauthen
arXiv cs.CR (AI security)
9/18/2026CIPL: A Channel-Aware Framework for Recoverable Privacy Leakage in LLM Agents
Privacy leakage in LLM agents is commonly evaluated within individual components such as memory, retrieval, or tool-use pipelines, which makes it difficult to distinguish internal exposure from information that an external observer can actually recover. We present CIPL (Channel Inversion for Privacy Leakage), a channel-aware evaluation framework for black-box privacy leakage in LLM agents. CIPL represents a target through sensitive source, selection, assembly, execution, observation, and extraction stages and evaluates the transition from selected sensitive units to attacker-recoverable output under a shared protocol. Experiments across memory-based, retrieval-mediated, and tool-mediated targets, together with a BrowserUse live-agent case study, show that storage labels alone do not determine recoverability. Memory targets form a near-saturated reference case, retrieval-mediated leakage
arXiv cs.CR (AI security)
9/18/2026Micro-Collaborative Poisoning: A Distributed Attack on RAG Systems
Retrieval-Augmented Generation (RAG) improves large language models by grounding outputs in external knowledge sources, but this dependency also creates a surface for poisoning attacks. This paper introduces Micro-Collaborative Poisoning, a distributed attack in which a false target claim is divided across multiple locally plausible documents instead of being concentrated in a single malicious passage. We evaluate the attack across 108 RAG configurations by varying dataset, retriever architecture, retrieval depth, database composition, number of poisoned databases, and generator model. The results indicate that Micro-Collaborative Poisoning is not driven by a single dominant poisoned passage, but by the accumulation of weak adversarial signals across retrieved sources. Increasing top-$k$ and poisoning multiple databases make it more likely that these signals will appear together in the r
Palo Alto Unit 42
9/18/2026A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity
Analysis of how default configurations in AWS AgentCore Harness allow prompt injection to exfiltrate credentials, and key steps to secure your agents. The post A Vault with a Heap-View: The Uncomfortable Space Between AgentCore Harness and Identity appeared first on Unit 42 .
arXiv cs.CR (AI security)
9/18/2026HE-Guardrail: A Homomorphic Guardrail Against Jailbreak Attacks for Encrypted Large Language Model Inference
Homomorphic encryption (HE) has emerged as a promising approach to privacy-preserving machine learning (PPML), enabling computation directly over encrypted data. In HE-based PPML, a client submits an encrypted input to the server, which evaluates models such as large language models (LLMs) without access to the underlying plaintext. However, we identify a critical security vulnerability in this setting: HE-LLM inference is vulnerable to malicious clients that submit adversarial prompts, such as jailbreak attacks. The same confidentiality that protects benign clients also prevents the server from inspecting incoming prompts or generated responses, making adversarial attempts difficult to detect or block and potentially allowing successful attacks to remain entirely invisible to the server. To address this vulnerability, we propose HE-Guardrail, a framework that evaluates guardrail mechani
arXiv cs.CR (AI security)
9/18/2026CESBench: Benchmarking Large Language Models on Cryptographic Engineering Security for IoT Devices
For Internet of Things (IoT) devices, a secure algorithm alone is not enough: an attacker with physical access can attack the implementation directly, and its flaws are hard to fix once deployed. Large language models (LLMs) are now used to build and analyze such implementations. LLM benchmarks exist for cryptography and general cybersecurity, but none covers cryptographic engineering. In this paper, we present CESBench, 380 expert-written items across six sub-domains of cryptographic engineering security for IoT devices: side-channel, fault injection, implementation, countermeasures, evaluation, and integration. Four task types target different competences: 209 multiple-choice items test recall, 67 judgment items require a security verdict and its justification, 63 scenario items require an engineering diagnosis, and 41 code tasks are graded by 572 test cases. To validate the benchmark,
AI Incident Database
9/18/2026Vero Beach man arrested in explicit deepfake investigation; police fear more victims
VERO BEACH, Fla. (CBS12) — A Vero Beach man was arrested and is being held on a $1 million bond after creating and distributing AI-generated sexually explicit images of women without consent. Officers with the Vero Beach Police Department ... (https://incidentdatabase.ai/cite/1696#7976)
AI Incident Database
9/18/2026Error by AI scribe during medical appointment leaves patient devastated
Artificial Intelligence is listening to many people's medical appointments, but it is not always hearing things correctly. When Rebecca Green arrived for her first appointment with a urologist, she was asked whether she consented to having ... (https://incidentdatabase.ai/cite/1695#7975)
Elastic Security Labs
9/18/2026One SOC, 100 projects: running centralized alert triage on Elastic Security Serverless
We linked one Elastic Security project to 100 others and ran the full prebuilt detection catalog from the origin, with all the ingest landing in the linked projects. It held up, and where it deliberately does not reach is the interesting part.
August 19, 2026 Fake AI, real malware: Attackers impersonating AI brands
Sophos X-Ops published new research concerning August 19, 2026 Fake AI, real malware: Attackers impersonating AI brands. Follow the canonical source for the full analysis.
Palo Alto Unit 42
9/17/2026Inside the Modern SOC: Defending the Cross-Environment Pivot
Cross-environment attacks demand a new approach to security operations. Learn how Unit 42 Managed XSIAM helps SOC teams investigate complete attack paths. The post Inside the Modern SOC: Defending the Cross-Environment Pivot appeared first on Unit 42 .
Should you care about an “AI slowdown?”
In this week's Threat Source, David talks about why focusing on your security basics is still your best bet, even in a world with rapid AI advancements.
Microsoft AI Security
9/17/2026From guidance to action: Security fundamentals that materially reduce risk
AI has made fundamental changes to the operating environment for cybersecurity. Explore exposure management guidance on recommended controls and take action and stay ahead of cyberthreats. The post From guidance to action: Security fundamentals that materially reduce risk appeared first on Microsoft Security Blog .
Microsoft AI Security
9/17/2026Improving email security outcomes with real-world Microsoft Defender insights
The latest email security benchmarking reports show strong Microsoft Defender performance across pre-delivery and post-delivery scenarios and reveal where threats and defenses continue to evolve. The post Improving email security outcomes with real-world Microsoft Defender insights appeared first on Microsoft Security Blog .
arXiv cs.CR (AI security)
9/17/2026Towards TEE-Certified DP: Verifiable Differentially Private Training on Legacy GPUs
Wide adoption of machine learning has created growing policy and regulatory demand for protecting sensitive training data, with differential privacy (DP) emerging as a key mechanism. Yet a less-studied problem is how to certify the faithful execution of DP during training: an external verifier should be able to check that a released model was trained with proper DP protection, without accessing the private training data. Existing cryptographic approaches, such as zero-knowledge proofs, provide strong guarantees but often incur prohibitive overhead, in some cases by orders of magnitude. Trusted Execution Environments (TEEs) offer a more efficient alternative, but the multi-GPU TEE support needed for training and fine-tuning large language models remains limited to recent platforms and is absent or inefficient on legacy GPUs. To address this, we propose a practical framework for verifiable
Check Point Research
9/17/2026AI Threat Landscape Digest: July–August 2026
The defining development of the period came not from attackers but from the AI labs themselves, whose models broke out of controlled evaluations and reached real systems. In the wild, the criminal and state use of AI continued to mature along the lines tracked in earlier editions: models now act as attack operators, an underground […] The post AI Threat Landscape Digest: July–August 2026 appeared first on Check Point Research .
Exploring the new AWS Sign Up experience
This post will explore what this new concept does, how it works with the new Account Access capability, and why a strong security posture still requires upgrading out of the sandbox.
arXiv cs.CR (AI security)
9/17/2026Fingerprinting Multimodal Large Language Models
While multimodal large language models (MLLMs) enable a wide range of image-text reasoning tasks, recent incidents indicate that they are vulnerable to illicit deployment and unauthorized distillation. Existing solutions for model provenance are typically confounded by shared language backbones in MLLMs and struggle to detect violations of distillation. To bridge this gap and safeguard model ownership, we present the first study on multimodal model fingerprinting. Inspired by recent findings that self-attention acts as a low-pass filter and that its low-frequency components are informative, we develop AttnPrint for white-box provenance. Specifically, we extract cross-modal attention distributions and isolate their low-frequency components to serve as model fingerprints. To facilitate black-box auditing, we further introduce DistillTrace, which employs hypothesis testing of MLLM outputs t
SOCRadar Threat Research
9/17/2026CVE-2026-76460: Cisco ISE Flaw Actively Exploited
CVE-2026-76460: Cisco ISE Flaw Actively Exploited CVE-2026-76460 represents a critical security flaw in Cisco’s Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). Because the vulnerability bypas
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
Ransomware incidents in Japan rose 4.7% year over year. The Gentlemen was the most active group, with leak-site listings more than doubling from January to July. Qilin ranked second and appeared to use AI, while SMEs with capital under JPY 1 billion represented 80% of victims.
Beware the SparroWock: The backdoor that bites, the commands that catch
ESET researchers document SparroWocky, the new flagship backdoor of the FamousSparrow APT group
SOCRadar Threat Research
9/17/2026Manage SOCRadar Alerts Where Your Team Already Works with SOCRadar and Zendesk
Manage SOCRadar Alerts Where Your Team Already Works with SOCRadar and Zendesk A new high-severity alert lands in your threat intelligence platform. Someone notices it eventually, copies the details into a ticket, assign
arXiv cs.CR (AI security)
9/17/2026ALIBI: Adversarial Legitimacy Injection in Binary Input against LLM Malware Analyzers
Large language models are being integrated into malware triage workflows as reasoning components that summarize static evidence and produce analyst-facing verdicts. This paper shows that the same reasoning capability introduces a new attack surface. We present ALIBI, a semantic cover story attack against frontier LLM-based malware analyzers. ALIBI adds a small, non-executed read-only section to a compiled binary, containing a coherent but false security product narrative, without altering imports or executable behavior. Instead of issuing direct instructions to the model, it reframes suspicious evidence as expected behavior of a benign endpoint security tool. On a frozen PE set of 50 malicious samples, the payload flips 30 of the 35 baseline-malicious samples to benign on Gemini 2.5 Pro, while GPT-5.5 Pro and Claude Opus 4.7 produce substantial severity downgrades with significant confid
CrowdStrike Counter Adversary Operations
9/17/2026CrowdStrike Named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026
CrowdStrike Counter Adversary Operations published new research concerning CrowdStrike Named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026. Follow the canonical source for the full analysis.
arXiv cs.CR (AI security)
9/17/2026SoK: Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes
Autonomous large language model (LLM) agents are moving rapidly into high-stakes domains, yet existing agentic-AI security studies remain largely domain-agnostic and overlook the distinctive, high-consequence attack surface such settings create. We examine this gap through financial trading agents, a representative case of high-stakes agentic security, where a single compromised agent has direct execution authority over real capital in an adversarial, reflexive market. To this end, we present FARSIGHT (Financial Agent Robustness and Security Investigation and Global Holistic Testing), a framework that performs scheme-level evaluation of financial LLM agents on two axes: robustness under market turbulence (including flash-crash-like scenarios), and security against three attack types: attacks on information sources, attacks on agents, and agent-as-attacker behaviors. Applying FARSIGHT to
arXiv cs.CR (AI security)
9/17/2026Red-Teaming Auto Mode: Improving Blocking Classifiers Against Malign Coding Agents
To keep coding agents from going off the rails, production systems now review each proposed action with a blocking monitor that can reject it before it runs (Auto Mode in Claude Code, Guardian in OpenAI's Codex). Prior evaluations of such monitors largely measure robustness to accidental harm or prompt injections from untrusted sources looking to hijack the agent. Less understood is how they hold up when the agent they monitor is persistently misaligned. To understand this risk, we task an adversarial agent with evading production blocking monitors and causing catastrophic harm, e.g. by exfiltrating its own weights. We find that when instructed with high-level attack strategies, adversarial agents can succeed through several distinct mechanisms, such as agent-generated prompt injection against the monitor, multi-agent attacks, and malicious compaction. In particular we find that in 79% o
Recorded Future Insikt Group
9/17/2026The New Rules of Machine Speed Defense
Experts from Recorded Future and Mastercard explore how security organizations can shift to proactive, machine-speed defense by leveraging high-quality threat intelligence and adhering to evolving global security frameworks designed to help mitigate AI-enabled risks.
Recorded Future Insikt Group
9/17/2026Our View on What It Takes To Be Named an Industry-Recognized Threat Intelligence Leader
A behind-the-scenes look at how Recorded Future earned its spot as a threat intelligence leader in the latest Forrester Wave.
AI Incident Database
9/17/2026Smith v. Flock Safety, Memorandum of Opinion and Order
Smith v. Flock Safety United States District Court Northern District of Ohio, Eastern Division Case No. 5:23-CV-2198 Judge: Benita Y. Pearson Document: Memorandum of Opinion and Order Resolving: ECF Nos. 7, 11, 12, 14, 22, 26, 31 Date: Apr ... (https://incidentdatabase.ai/cite/1694#7974)
arXiv cs.CR (AI security)
9/16/2026Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Models
Autonomous systems increasingly rely on Large Language Models (LLMs) yet the safety infrastructure surrounding these models introduces latency and compute overhead. This limits utility in resource-constrained, time-critical deployments. Existing external guardrail models remain blind to the model's internal workings, creating a fundamental assurance gap. We ask: does the model already know when the content is harmful? We extract activations from LLaMA-3.1-8B and train lightweight MLP classifier probes (12.6M parameters) to detect harmful prompts. Evaluated on WildJailbreak, Beavertails, and AEGIS 2.0, our probes achieve F1 scores of 99%, 83%, and 84%, respectively competitive with 1000x larger guard models while cutting latency and compute costs.
Qualys Threat Research Unit
9/16/2026Oracle Critical Security Patch Update, September 2026 Review
Oracle released its September edition of Critical Security Patch Update. The update received patches for 673 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including third-party components in Oracle products. Out of the 673 security updates published, a total of 104 […]
SOCRadar Threat Research
9/16/2026CVE-2026-76461: Cisco Email Gateway Flaw Exploited
CVE-2026-76461: Cisco Email Gateway Flaw Exploited Cisco has confirmed active exploitation of CVE-2026-76461 , a critical SQL injection vulnerability in Cisco Secure Email Gateway that can lead to operating-system comman
SOCRadar Threat Research
9/16/2026CVE-2026-27540 WooCommerce Flaw Exploited
CVE-2026-27540 WooCommerce Flaw Exploited Attackers are actively exploiting CVE-2026-27540 , a critical arbitrary file-upload vulnerability in the WooCommerce Wholesale Lead Capture plugin for WordPress. The flaw allows
Securing the unpatchable in an age of AI-driven vulnerabilities
Advances in AI technology will continue to identify vulnerabilities that in some circumstances are difficult, or effectively impossible, to patch. Appropriate network segmentation, rigorous visibility, and the deployment of NGFW/IPS combinations can provide a powerful compensatory layer.