Tag: control
-
Anthropic calls for ‘verifiable effort’ to control frontier AI
After Claude Mythos circumvented guardrails in July, Anthropic now wants an industry effort to control the pace of frontier model development First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366650194/Anthropic-calls-for-verifiable-effort-to-control-frontier-AI
-
Agentic AI Security: Key Findings from New IDC Research on the Identity Control Plane
Agentic AI Security: Key Findings from New IDC Research on the Identity Control Plane September 10, 2026 Laura Babbili BLOG 5 min. TL;DR A new IDC whitepaper, commissioned by GuidePoint Security, explores why identity is the foundational control plane for… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/agentic-ai-security-key-findings-from-new-idc-research-on-the-identity-control-plane/
-
12 Best Application Control Allowlisting Tools Compared (2026): Features Pricing
Quick Answer: For dedicated deny-by-default allowlisting, ThreatLocker and Airlock Digital lead in 2026; Microsoft WDAC/AppLocker is the free native option for Windows estates with engineering capacity; CyberArk and BeyondTrust pair control with privilege management. Pricing is typically per endpoint; Microsoft’s is bundled. Application control flips endpoint defense from “block known bad” to “allow only known…
-
Watchdog Finds Critical Access Control Gaps at CBP
DHS Inspector General Finds CBP Left Privileged Account Open to All Network Users. A U.S. Customs and Border Protection service account with elevated privileges was reachable by the agency’s entire workforce of more than 76,000 users, and auditors mapped more than 100 attack paths through the network, according to a new Department of Homeland Security…
-
Ryanair calls for government action over Nats IT failure
The National Air Traffic Control System was not fully operational for over eight hours, causing major disruption to airlines and passengers First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366650160/Ryanair-calls-for-government-action-over-Nats-IT-failure
-
Your AI Didn’t Lie to You: It Was Just Being Manipulated
Hidden AI Activity Creates Security Gaps That Traditional Controls Can’t Detect As AI agents gain access to critical business systems, prompt injection, shadow AI and poisoned data can manipulate decisions without triggering traditional controls. Full-pipeline telemetry and continuous testing can help security teams investigate incidents while maintaining human accountability. First seen on govinfosecurity.com Jump to…
-
The Silent Failure Problem: Your Security Controls Rot Without Telling You
Tags: controlIn 2025, URIports analyzed the top one million domains and found that 53.6 percent of BIMI-enabled domains had at least one error preventing their logo from displaying, up from 41.8 percent the year before. More than half of the organizations… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/the-silent-failure-problem-your-security-controls-rot-without-telling-you/
-
Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs
A human-operated intrusion campaign in which attackers abuse Microsoft Teams external collaboration to impersonate internal IT or helpdesk staff, persuade employees to grant remote control of their PCs, and then move toward critical enterprise infrastructure. The campaign does not exploit a Microsoft Teams vulnerability. Instead, it weaponizes trust in familiar support workflows, combining Teams chats…
-
Webinar: The forgotten Google Workspace access that can lead to a breach
Third-party applications connected to Google Workspace can retain access long after their original purpose is forgotten. This webinar examines how overly permissive integrations contribute to breaches and which security controls can help fast-growing companies reduce their exposure. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/webinar-the-forgotten-google-workspace-access-that-can-lead-to-a-breach/
-
ASUS Control Center Critical Flaw Allows Unauthenticated Attackers to Gain Root Access
ASUS has released a security update for the Control Center Express Agent to address CVE-2026-19397, a high-severity vulnerability related to missing authentication. This vulnerability allows an unauthenticated nearby attacker to potentially take control of an affected host through a direct connection to the agent. The issue affects versions before 1.7.24 and was published and updated…
-
ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2
Cisco Talos is tracking a cryptocurrency-stealing campaign that abuses the Google Visualization API for command and control (C2), retrieving obfuscated JavaScript from a publicly published Google Sheets document and injecting it into the victim’s browser session. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/clickfix-moves-into-the-browser/
-
The Best DNS Security Solutions, Compared and Priced (2026)
DNS security delivers more blocked attacks per dollar than any other network control when you buy the right shape at the right tier. The value verdict: DNSFilter and SafeDNS own transparent per-user pricing for SMBs, Cloudflare Gateway starts free and scales to national infrastructure (it now runs the UK’s public-sector PDNS with Accenture), Cisco Umbrella…
-
Hackers Create Domain Admin Account and Disable Security Tools Inside Windows Network
A newly documented ransomware intrusion attributed to The Gentlemen shows how attackers can convert a foothold in a Windows environment into domain-wide control by elevating accounts, turning off endpoint defenses, and abusing trusted Active Directory infrastructure to distribute ransomware. The operation illustrates a recurring enterprise risk: attackers do not need highly customized malware to compromise…
-
Hackers Steal Microsoft 365 Sessions to Hijack Accounts Even After MFA
Cybercriminals are using a rebranded Evilginx2 phishing-as-a-service platform dubbed BigBear 2.0 to intercept authenticated Microsoft 365 sessions, allowing them to take over accounts even after victims complete multi-factor authentication (MFA). CloudSEK’s TRIAD team uncovered the operation after gaining administrative access to its control panel in June 2026 The campaign demonstrates a critical reality for Microsoft…
-
OpenAI Confirms AI Agents Used German Wiki to Bypass Restrictions
OpenAI agents used a German wiki to coordinate and bypass restrictions, exposing gaps in read-only internet controls and AI agent containment. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-openai-agents-wiki-restrictions-emea-germany/
-
How to Build a Shared AI Engineering Framework Without Killing Developer Autonomy
Every engineering leader is running the same experiment right now, whether they admit it or not. Developers are already using AI. The only open question is whether leadership knows about it, controls it, and gets value from it, or whether… First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/09/how-to-build-a-shared-ai-engineering-framework-without-killing-developer-autonomy/
-
MikroTik Issues Patches for Routers Amid Zero-Day Attacks
Chaining Two Flaws Leads to Full Compromise, Warn Polish Incident Responders. Latvian router-maker MikroTik has issued emergency patches in the face of in-the-wild MikroTrick attacks that chain together exploits for two zero-day vulnerabilities in the RouterOS operating system that runs MikroTik devices to obtain full, remote control of any device with SSH access enabled. First…
-
KI-natives Cybersicherheits-Verteidigungssystem
Entwickelt für eine durch KI veränderte Bedrohungslandschaft vereint Sophos-Fusion von Sophos Security-Operations, Endpoint-Protection, Netzwerksicherheit, Identitäts-, E-Mail- und Cloud-Sicherheit in einem einzigen Verteidigungssystem, das Bedrohungen mit KI-Geschwindigkeit verhindert, erkennt, untersucht und darauf reagiert. Ein Cybersicherheits-Verteidigungssystem stellt eine neue Kategorie innerhalb der Branche dar: eine einzige, offene Architektur, in der jeder Control-Point jeder Service, jede Datenquelle und…
-
Global Phishing Campaign Abuses Google Infrastructure to Evade Security and Steal Credentials
Tags: access, control, credentials, cyber, email, google, infrastructure, network, phishing, serviceA large-scale phishing operation is abusing trusted Google services as a multi-stage redirect network to bypass email security controls, deliver highly personalized credential-harvesting pages, and, in some cases, install ScreenConnect remote-access software. The campaign’s central advantage is that it presents trusted Google-owned domains at nearly every point a gateway, proxy, or analyst is likely to…
-
Hackers exploit new MikroTik RouterOS flaws to hijack routers
Hackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-new-mikrotik-routeros-flaws-to-hijack-routers/
-
Hackers exploit new MikroTik RouterOS flaws to hijack routers
Hackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-new-mikrotik-routeros-flaws-to-hijack-routers/
-
Hackers exploit new MikroTik RouterOS flaws to hijack routers
Hackers are exploiting a chain of two recently disclosed vulnerabilities in MikroTik routers to take control of devices with SSH services exposed to the internet. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-new-mikrotik-routeros-flaws-to-hijack-routers/
-
BYOTC Attack Abuses Trusted Windows Clients to Access Privileged Kernel Driver Operations
A newly documented Windows attack pattern, dubbed Bring Your Own Trusted Caller (BYOTC), shows how attackers can bypass driver-level authorization controls without exploiting a traditional memory-corruption flaw. Instead of attacking a privileged kernel driver directly, an adversary compromises or abuses the legitimate user-mode application that the driver already trusts. The technique expands on the well-known…
-
Why AI Agent Sandboxes Are Failing Security Tests
Autonomous AI agents escaped a sandbox and accessed Hugging Face via reward hacking, exposing serious architectural control and isolation flaws. The recent case involving OpenAI test agents and Hugging Face should concern security teams, but not for the reason implied by headlines about an imminent AI “takeover.” The documented issue is more concrete: autonomous agents,…
-
Hackers Exploit PaperCut NG/MF Flaws to Steal Credentials and Deploy Meterpreter
Threat actors are actively exploiting two critical vulnerabilities in PaperCut NG/MF, identified as CVE-2026-81578 and CVE-2026-82078. These exploits allow attackers to take control of print management servers, steal credentials, and deploy Meterpreter payloads within enterprise networks. Analysts Jens Pose and Ross Phillips from Arctic Wolf reported that these intrusions progressed from remote command execution to…
-
JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies
Cybersecurity researchers have unpacked JSCeal, a sophisticated compiled V8 JavaScript (JSC) malware with credential harvesting, surveillance, and traffic-interception capabilities.”The payloads are protected with javascript-obfuscator, using multiple techniques including RC4-protected strings, control-flow flattening, proxy functions, and operation wrappers,” Check Point Research said in a First seen on thehackernews.com Jump to article: thehackernews.com/2026/09/jsceal-malware-can-bypass-google.html
-
Fake Minecraft Mod Drops Myth Stealer RAT to Steal Passwords and Remotely Control PCs
A trojanized Minecraft optimization mod posing as a companion to the legitimate Lithium project has been used to deploy Myth Stealer 3.2-FIX, a password-stealing malware family with remote-access, surveillance, persistence, and victim-harassment capabilities. The malicious archive, tracked as MythStealer.jar_, masquerades as Lithium Extras 0.15.0+mc1.21.1 by “soder.” It abuses the reputation of CaffeineMC’s legitimate Lithium performance…
-
Weekly Cybersecurity Newsletter Top 50 Biggest Cybersecurity Stories of the Week
Welcome to this week’s edition of the GBHackers cybersecurity newsletter, your weekly cybersecurity bulletin covering the 50 most important stories from August 31 September 5, 2026. AI ran through the whole week: OpenAI’s GPT-6 Astra built working exploits, Anthropic shipped Claude Fable 5.1 and Mythos 5.1, Claude gained the ability to control computers, […] The…
-
Hackers Actively Exploiting MikroTik RouterOS MikroTrick Flaws to Take Full Control of Routers
Threat actors are actively exploiting critical vulnerabilities in MikroTik RouterOS, collectively known as MikroTrick, to compromise internet-exposed routers and gain complete administrative control. The attacks primarily target devices with SSH management access that are exposed to public networks, prompting urgent patching recommendations from MikroTik, CERT Polska, and Latvia’s national CERT.LV. On September 3, MikroTik issued…
-
Critical ASUS Control Center CVE-2026-75754 Flaw Allows Unauthenticated Root Access
ASUS has issued a security bulletin regarding a critical vulnerability in ASUS Control Center Enterprise (ACC), identified as CVE-2026-75754. This flaw affects ACC version 4.0.0.2 and earlier, allowing for unauthenticated root access. Critical ASUS Control Center Flaw The advisory was published on September 4, 2026, and was last updated on the same day. While the…