Help Net Security

AI is giving attackers a head start, Microsoft warns

Sinisa Markovic — Fri, 02 Oct 2026 12:47:00 +0000

Threat actors are using AI to find bugs, build malware and run intrusions faster than defenders can keep up. Microsoft’s 2026 Digital Defense Report, covering July 2025 to June 2026, describes a near-term period in which attackers collect the benefits of AI first and defenders have to move quickly to close the gap. “AI is changing the physics of cybersecurity,” the company said. Bugs found faster than they get fixed Vulnerability discovery and weaponization once … More →

The post AI is giving attackers a head start, Microsoft warns appeared first on Help Net Security.

Chinese spies impersonate White House, Anthropic figures to phish AI policy experts

Sinisa Markovic — Fri, 02 Oct 2026 10:21:55 +0000

A China-aligned espionage group has been posing as a former White House official and a prominent economist to get into the cloud accounts of AI policy experts in the US, Proofpoint have found. The group, which the researchers track as TA419, ran several credential phishing campaigns in July 2026. “In July 2026, TA419 impersonated multiple individuals, including a former member of the White House Office of Science and Technology Policy leadership team, in credential phishing … More →

The post Chinese spies impersonate White House, Anthropic figures to phish AI policy experts appeared first on Help Net Security.

Critical FortiMail zero-day exploited in the wild (CVE-2026-104286)

Sinisa Markovic — Fri, 02 Oct 2026 08:50:59 +0000

Fortinet is warning customers that attackers are exploiting a zero-day vulnerability (CVE-2026-104286) in FortiMail, its email security gateway. Fortinet says the flaw has been reported to be exploited in the wild, and urges customers to apply the workaround it shared until fixes are available. About CVE-2026-104286 “An Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) [CWE-22] and Improper Neutralization of NULL Byte or NULL Character [CWE-158] vulnerability may allow an unauthenticated attacker … More →

The post Critical FortiMail zero-day exploited in the wild (CVE-2026-104286) appeared first on Help Net Security.

Criminal recruiters want people on your payroll

Anamarija Pogorelec — Fri, 02 Oct 2026 06:00:05 +0000

Legitimate employee access can let criminals circumvent security controls that would be difficult to overcome from outside an organization. Routine actions such as information lookups, account resets, transaction approvals and shipment changes can become services sold to criminal customers, according to Intel 471’s Insiders for Hire: Underground Recruitment, Access Claims and Insider-Enabled Services report. A market for insider capabilities Cybercriminals sought employees at specific organizations, offered payments to brokers and referrers to find suitable personnel, … More →

The post Criminal recruiters want people on your payroll appeared first on Help Net Security.

Android 17 makes it harder for spyware to cover its tracks

Anamarija Pogorelec — Fri, 02 Oct 2026 05:30:37 +0000

When a journalist suspects their phone has been hacked, the first question is whether any trace of the attack is left. Google has added six features to Advanced Protection in Android 17, including one that keeps a copy of that evidence off the device. Existing users will receive a notification when the new capabilities become available on their devices. Forensic logging and data retention Intrusion Logging records security and network events, including app activity. Users … More →

The post Android 17 makes it harder for spyware to cover its tracks appeared first on Help Net Security.

Botnets, adversarial attacks and data poisoning top leaders’ AI threat list

Sinisa Markovic — Fri, 02 Oct 2026 05:00:28 +0000

Companies are putting more money into AI while naming attacks on AI systems as the threat they are least ready to face. PwC surveyed 3,934 business and technology leaders in 71 countries between May and July 2026. Half of the security and technology executives among them ranked such attacks in their top five preparedness gaps, ahead of every other threat on the list. More than half of the leaders asked about AI-enabled attacks put three … More →

The post Botnets, adversarial attacks and data poisoning top leaders’ AI threat list appeared first on Help Net Security.

AI agents keep access to company data after their work is done

Anamarija Pogorelec — Fri, 02 Oct 2026 04:30:21 +0000

IT teams responsible for identity security are concerned about AI agents’ ongoing access to company systems and the actions they take on users’ behalf, according to a Delinea’s 2026 Identity Security Report: The AI Enforcement Gap. “Written policy is only as good as your ability to enforce it at the moment an AI agent acts,” said Art Gilliland, CEO of Delinea. “Our research echoes what I hear from leaders constantly: they have the AI policies … More →

The post AI agents keep access to company data after their work is done appeared first on Help Net Security.

New infosec products of the week: October 2, 2026

Anamarija Pogorelec — Fri, 02 Oct 2026 04:00:35 +0000

Here’s a look at the most interesting products from the past week, featuring releases from BlackFog, Genea, Vega, and Thales. Vega II brings security-trained AI and lasting memory to the SOC Vega has introduced Vega II, its biggest platform release since emerging from stealth. The update brings frontier AI trained for security operations into the SOC, gives teams a lasting record of what they have learned, and removes the legacy SIEM and data pipeline barriers … More →

The post New infosec products of the week: October 2, 2026 appeared first on Help Net Security.

16-year-old suspected leader of KillSec ransomware group arrested

Sinisa Markovic — Thu, 01 Oct 2026 13:59:02 +0000

A 16-year-old is suspected of being the main operator of KillSec, a ransomware group that Eurojust says is responsible for almost 1,000 attacks worldwide. Seizure notice (Source: Eurojust) According to Eurojust, KillSec has been active since 2024. The group got into organizations’ systems by exploiting poorly secured access, particularly access linked to cloud storage. “Once inside, the KillSec group stole data and copied it to their own infrastructure. They then threatened to make the stolen … More →

The post 16-year-old suspected leader of KillSec ransomware group arrested appeared first on Help Net Security.

DeepKeep’s AI Lens flags coding agent data leaks and routes destructive commands for approval

Industry News — Thu, 01 Oct 2026 13:57:07 +0000

DeepKeep has announced AI Lens for Developers, a new extension to the company’s AI usage control and runtime protection modules to secure software developers and their coding agents that can write, modify, and execute code on their behalf. The capability gives security teams policy enforcement, audit visibility, and runtime security over coding agents such as Cursor and Claude Code, closing a critical gap most security programs have ever had to cover before. 90% of developers … More →

The post DeepKeep’s AI Lens flags coding agent data leaks and routes destructive commands for approval appeared first on Help Net Security.