Tag: control
-
Startup JetStream Secures $34M Seed Round for AI Governance
Blueprint Model From Ex-CrowdStrike Product Leader Targets MCP Servers, Cost Sprawl. JetStream has raised $34 million in seed funding to tackle enterprise AI governance challenges. The startup introduced blueprint-based controls to manage shadow AI, MCP servers and token-level spending while helping CISOs gain visibility and enforce guardrails across cloud and SaaS environments. First seen on…
-
Groups Push Back on HHS’ Proposed Health IT Rollbacks
CHIME, AHA, Others Contend Privacy, Security Burden Would Shift to Providers. Proposals to eliminate certain longstanding health IT certification criteria – including privacy and security related controls – will shift regulatory burden from health IT developers to healthcare providers, some industry groups contend in their public response to proposed federal rulemaking. First seen on govinfosecurity.com…
-
Human vs. AI Identity: Why AI Agents Are Breaking Identity
4 min readTraditional IAM was built for predictable workloads. Learn why AI agents demand a new approach to identity, access control, and credential management. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/human-vs-ai-identity-why-ai-agents-are-breaking-identity/
-
Fake Tech Support Spam Deploys Customized Havoc C2 Across Organizations
Threat hunters have called attention to a new campaign as part of which bad actors masqueraded as fake IT support to deliver the Havoc command-and-control (C2) framework as a precursor to data exfiltration or ransomware attack.The intrusions, identified by Huntress last month across five partner organizations, involved the threat actors using email spam as lures,…
-
AI Emerges as the New Insider Threat: Thales Releases the 2026 Data Threat Report
Tags: access, ai, api, attack, business, cloud, compliance, container, control, credentials, cyber, data, deep-fake, encryption, governance, identity, infrastructure, risk, saas, skills, software, strategy, theft, threat, toolAI Emerges as the New Insider Threat: Thales Releases the 2026 Data Threat Report madhav Tue, 03/03/2026 – 15:00 Over the past year, I’ve watched AI move to operational reality across nearly every industry we work with. The conversation is no longer about whether AI will transform business. It already has. Cybersecurity Todd Moore –…
-
Zenity Details Perplexity AI Browser Vulnerability
Zenity, a provider of a platform for securing artificial intelligence (AI) applications and agents, today detailed how a zero-click attack could be launched against the Comet AI browser developed by Perplexity. Company CTO Michael Bargury said the attack vector, dubbed PerplexedComet, enables a malicious attacker to control content in a way that can be used..…
-
OAuth phishers make ‘check where the link points’ advice ineffective
Tags: authentication, automation, awareness, business, cloud, control, edr, email, encryption, endpoint, exploit, governance, identity, login, malicious, microsoft, monitoring, phishing, saas, threat, toolContext, not the URL, is the new red flag: Sakshi Grover, Senior Research Manager at IDC Asia/Pacific, said the longstanding advice to hover over a link and verify its domain was built for an era of lookalike domains and that it no longer holds in environments where authentication flows routinely pass through trusted identity providers.”Organizations…
-
HPE AutoPass Vulnerability Allows Remote Attackers to Bypass Authentication
Hewlett Packard Enterprise (HPE) has disclosed a remote authentication-bypass vulnerability in HPE AutoPass License Server (APLS) that could let unauthenticated attackers bypass login controls over the network. The issue is tracked as CVE-2026-23600 and is fixed in APLS 9.19 and later.”‹ Item Details Vendor bulletin HPESBGN05003 rev.1 (Security Bulletin), initial release 27 Feb 2026; last…
-
Chrome security flaw enabled spying via Gemini Live assistant
A Google Chrome vulnerability lets malicious extensions hijack Gemini Live to spy on users and steal sensitive files. Researchers at Palo Alto Networks found a Chrome vulnerability, tracked as CVE-2026-0628, that could let malicious extensions take control of the Gemini Live AI assistant. By abusing the flaw, attackers could spy on users and exfiltrate sensitive…
-
7 factors impacting the cyber skills gap
Tags: ai, attack, automation, breach, business, ciso, control, cyber, cybercrime, cybersecurity, data, defense, detection, group, incident response, intelligence, jobs, risk, service, skills, strategy, technology, threat, tool, training, vulnerability2. Emerging technologies: New technologies, particularly AI, are contributing to a cyber landscape that’s evolving so quickly it’s hard for even highly skilled cybersecurity professionals to pace, says Dan Lohrmann, CISO at enterprise strategy and consulting firm Presidio.AI-driven threats keep moving the target, allowing cybercriminals to attack with unprecedented levels of speed and agility, Lohrmann…
-
MS-Agent Vulnerability Exposes AI Agents to Remote Hijacking, Granting Full System Control
A critical vulnerability has been discovered in the MS-Agent framework, a lightweight software tool used to build and run autonomous AI agents. Tracked as CVE-2026-2256, this command injection flaw allows remote attackers to hijack these AI agents, potentially granting them full control over the underlying computer systems. MS-Agent is designed to help developers create AI…
-
Latest OpenClaw Flaw Can Let Malicious Websites Hijack Local AI Agents
Oasis Security researchers find another security problem with the OpenClaw autonomous AI agent, uncovering a vulnerability dubbed “ClawJacked” that allows malicious websites to silently take full control of a developer’s system and steal data. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/latest-openclaw-flaw-can-let-malicious-websites-hijack-local-ai-agents/
-
Russia-linked APT28 exploited MSHTML zero-day CVE-2026-21513 before patch
Russia-linked APT28 reportedly exploited MSHTML zero-day CVE-2026-21513 before Microsoft patched it, a high-severity bypass flaw. Akamai reports that Russia-linked APT28 may have exploited CVE-2026-21513 CVSS score of 8.8), a high-severity MSHTML vulnerability (CVSS 8.8), before Microsoft patched it in February 2026. The vulnerability is an Internet Explorer security control bypass that can lead to code…
-
âš¡ Weekly Recap: SD-WAN 0-Day, Critical CVEs, Telegram Probe, Smart TV Proxy SDK and More
This week is not about one big event. It shows where things are moving. Network systems, cloud setups, AI tools, and common apps are all being pushed in different ways. Small gaps in access control, exposed keys, and normal features are being used as entry points.The pattern becomes clear only when you see everything together.…
-
Pakistan’s Top News Channels Hacked and Hijacked With Anti-Military Messages
Major Pakistani TV channels, including Geo News and ARY News, were hit by a coordinated cyberattack on 1 March 2026. Hackers took control of live satellite feeds to display unauthorised messages. Read more about the breach, the regional impact, and the reported counter-cyber response. First seen on hackread.com Jump to article: hackread.com/pakistan-news-channels-hacked-anti-military-messages/
-
ClawJacked flaw exposed OpenClaw users to data theft
“ClawJacked” flaw let malicious sites hijack OpenClaw AI agents to steal data; patch released in version 2026.2.26. A high-severity vulnerability called ClawJacked in OpenClaw allowed malicious websites to brute-force and take control of local AI agent instances. Oasis Security discovered the flaw, which enabled silent data theft. OpenClaw addressed the issue with version 2026.2.26, released…
-
ClawJacked flaw exposed OpenClaw users to data theft
“ClawJacked” flaw let malicious sites hijack OpenClaw AI agents to steal data; patch released in version 2026.2.26. A high-severity vulnerability called ClawJacked in OpenClaw allowed malicious websites to brute-force and take control of local AI agent instances. Oasis Security discovered the flaw, which enabled silent data theft. OpenClaw addressed the issue with version 2026.2.26, released…
-
A scorecard for cyber and risk culture
Tags: access, automation, awareness, breach, business, compliance, control, credentials, cyber, finance, governance, identity, jobs, metric, mitigation, phishing, risk, service, strategy, tool, trainingWhen someone asks for an exception.When a change goes in late.When an alert fires at 2 a.m.When a junior analyst spots something odd and wonders if it’s worth escalating.When an executive wants speed, and the team wants safety. Ownership means people act like the risk is partly theirs. They don’t outsource judgment to “security.” They…
-
North Korean Hackers Publish 26 npm Packages Hiding Pastebin C2 for Cross-Platform RAT
Cybersecurity researchers have disclosed a new iteration of the ongoing Contagious Interview campaign, where the North Korean threat actors have published a set of 26 malicious packages to the npm registry.The packages masquerade as developer tools, but contain functionality to extract the actual command-and-control (C2) by using seemingly harmless Pastebin content as a dead drop…
-
How to maintain control over your AI and its actions
How Can Organizations Effectively Manage Non-Human Identities? What strategies can organizations implement to safeguard their digital assets against misuse of Non-Human Identities (NHIs)? The journey to securing cloud environments against such threats begins with understanding how NHIs operate within cybersecurity frameworks. NHIs, essentially machine identities, serve as the backbone of secure communication and operations in……
-
Who is the Kimwolf Botmaster “Dort”?
In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was used to assemble Kimwolf, the world’s largest and most disruptive botnet. Since then, the person in control of Kimwolf — who goes by the handle “Dort” — has coordinated a barrage of distributed denial-of-service (DDoS), doxing and email flooding attacks…
-
iOS Penetration Testing: Definition, Process and Tools
Tags: breach, control, data, flaw, iphone, penetration-testing, reverse-engineering, tool, vulnerabilityWhile iPhones boast robust security, attackers constantly seek weak points. Enter iOS penetration testing the security validation exercise against your controls attempting to stop data breaches and unauthorised access. Through manual and automated techniques like vulnerability scanning and reverse engineering, it uncovers hidden flaws in your iOS apps, protecting sensitive data and user trust…. First…
-
Hackers Exploit Windows File Explorer and WebDAV to Distribute Malware
Cybersecurity researchers at Cofense Intelligence have uncovered an ongoing campaign where threat actors abuse Windows File Explorer to distribute malware. By exploiting the legacy WebDAV protocol, attackers are tricking victims into downloading Remote Access Trojans (RATs) while bypassing traditional web browser security controls and some Endpoint Detection and Response (EDR) systems.”‹ WebDAV Exploit WebDAV (Web-based…
-
Security hole could let hackers take over Juniper Networks PTX core routers
The hole is “especially dangerous, because these devices often sit in the middle of the network, not on the fringes,” said Piyush Sharma, CEO of Tuskira. “If an attacker gains control of a PTX, the impact is bigger than a single device compromise because it can become a traffic vantage point and a control point…
-
NDSS 2025 CASPR: Context-Aware Security Policy Recommendation
Session 14A: Software Security: Applications & Policies Authors, Creators & Presenters: All From The Institute of Information Engineering, Chinese Academy of Sciences: Lifang Xiao, Hanyu Wang, Aimin Yu, Lixin Zhao, Dan Meng PAPER CASPR: Context-Aware Security Policy Recommendation Nowadays, SELinux has been widely used to provide flexible mandatory access control and security policies are critical…
-
Aeternum botnet hides commands in Polygon smart contracts
Aeternum botnet uses Polygon blockchain smart contracts for C&C, making its infrastructure harder to detect and disrupt. Qrator Labs researchers uncovered Aeternum, a botnet that runs its command-and-control infrastructure through smart contracts on the Polygon blockchain. By decentralizing its C2, the malware avoids traditional server-based takedowns and becomes far harder to disrupt or shut down,…
-
Juniper PTX Flaw Could Allow Full Router Takeover
A critical Juniper flaw could let attackers take full control of PTX core routers. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/juniper-ptx-flaw-could-allow-full-router-takeover/
-
Researchers Unveil Aeternum C2 Infrastructure with Advanced Evasion and Persistence Tactics
For years, defenders have relied on a simple strategy to dismantle botnets find and seize their command-and-control (C2) servers. That weakness enabled global law enforcement operations to disrupt massive botnets such as Emotet, TrickBot, and QakBot. But a newly identified C2 framework,Aeternum, may render those tactics obsolete. Instead of using centralized servers or domains, Aeternum…