Help Net Security

AI agents exploited PaperCut flaws to breach 395 organizations

Sinisa Markovic — Fri, 11 Sep 2026 10:05:32 +0000

A threat actor built a working exploit for PaperCut print management software, then handed the job of breaking into hundreds of organizations to AI agents that did most of the work on their own, according to GreyNoise. The result was at least 440 compromised PaperCut instances across 395 identified organizations in 48 countries. Attacker, believed to be Russian-speaking, first built a private lab environment with a vulnerable copy of PaperCut NG/MF and an Active Directory … More →

The post AI agents exploited PaperCut flaws to breach 395 organizations appeared first on Help Net Security.

IDScan confirms breach after 153 million driver’s licenses leak on dark web

Sinisa Markovic — Fri, 11 Sep 2026 08:39:33 +0000

Days after reports linked IDScan to a dark web database holding more than 153 million driver’s license scans, the identity verification company has confirmed hackers accessed customer data stored on its cloud platform. The Louisiana-based firm, which processes ID checks for car rental companies, retailers and cannabis dispensaries, posted a notice on its website September 4 acknowledging the incident. “On or around September 1, 2026, IDScan.net received information indicating that certain data may have been … More →

The post IDScan confirms breach after 153 million driver’s licenses leak on dark web appeared first on Help Net Security.

Kiteworks expands runtime data governance with Bonfy.AI acquisition

Industry News — Fri, 11 Sep 2026 08:04:07 +0000

Kiteworks has acquired Bonfy.AI, extending runtime data governance across its control plane. The acquisition enables organizations to govern data exchanges as they happen, whether initiated by a person, machine, or autonomous agent. The acquisition addresses a structural gap in how enterprises protect sensitive data. Enterprises have invested a decade in data discovery and posture management, building detailed inventories of the sensitive data that sits inside their data stores. With this acquisition, Kiteworks complements that value … More →

The post Kiteworks expands runtime data governance with Bonfy.AI acquisition appeared first on Help Net Security.

Automox Mitigation Worklets cut endpoint exposure to unpatchable flaws

Industry News — Fri, 11 Sep 2026 07:48:56 +0000

Automox has announced its AI-speed Mitigation Worklet Pipeline, which automates mitigation to reduce risk from the increased volume and velocity of frontier-model AI vulnerabilities. Now the time from vulnerability disclosure to exposure mitigation is shortened from days or weeks to minutes or hours. Since 2019, Automox Worklets have mitigated risk across billions of policy runs and millions of endpoints. A Worklet is an automation that takes verifiable action on an endpoint, whether that’s enforcing a … More →

The post Automox Mitigation Worklets cut endpoint exposure to unpatchable flaws appeared first on Help Net Security.

Getting a stranger’s phone kicked off the cellular network costs a few dollars

Mirko Zorz — Fri, 11 Sep 2026 06:00:16 +0000

Researchers at Michigan State University and three partner schools bought a Samsung Galaxy Z Fold 7, copied the identification number printed on the sealed box, and reported the phone to its carrier as lost. Then they opened the box and set the phone up the way a launch-day buyer would. It would not connect. The phone was new, unopened, and sitting on a lab bench the entire time. The team found six weaknesses in the … More →

The post Getting a stranger’s phone kicked off the cellular network costs a few dollars appeared first on Help Net Security.

Building a ransomware decision tree before the call comes in

Help Net Security — Fri, 11 Sep 2026 05:30:53 +0000

In this Help Net Security video, Kerri Shafer-Page, VP of Incident Response at Arctic Wolf, walks through the ransomware decision tree in this video. She covers four areas where decisions need settling in advance, starting with containment. Someone has to know the network well enough to judge what pulling a system offline does to client data, a manufacturing line, or a website. Then comes the extortion demand. Who is authorized to negotiate, and what is … More →

The post Building a ransomware decision tree before the call comes in appeared first on Help Net Security.

Companies may be measuring phishing resilience the wrong way

Anamarija Pogorelec — Fri, 11 Sep 2026 05:00:07 +0000

Companies that judge phishing simulation programs by how often employees click simulated attack emails may be overlooking more important indicators of cyber resilience, according to Pistachio’s Phishing Behaviour Report 2026. Examples of difficult simulations (Source: Pistachio) The analysis covered 648 organizations with a complete 12-month record and 123,692 users between June 1, 2025, and May 31, 2026. Its central finding is that phishing resilience is better understood through a combination of clicking, credential submission, and … More →

The post Companies may be measuring phishing resilience the wrong way appeared first on Help Net Security.

AI is changing what Salesforce security needs to govern

Anamarija Pogorelec — Fri, 11 Sep 2026 04:30:42 +0000

Existing security and governance practices have largely focused on identities, permissions, access, configurations and controls. WithSecure’s Navigating Trust in the Modern Salesforce Ecosystem paper says Salesforce environments also require organizations to understand what information they rely on, how trust extends across connected systems, what actions are performed and what outcomes those actions produce. A Trust Relationship (Source: WithSecure) What trust means The paper describes trust as the belief that people, systems, information and connected services … More →

The post AI is changing what Salesforce security needs to govern appeared first on Help Net Security.

Ubuntu 24.04.5 LTS release patches security bugs across ten flavors

Anamarija Pogorelec — Fri, 11 Sep 2026 04:07:41 +0000

Canonical shipped Ubuntu 24.04.5 LTS, bundling security updates and fixes for high-severity bugs into new installation media for the “Noble Numbat” release. Anyone installing fresh now gets those corrections baked in from the start, cutting the batch of updates that would normally follow setup. The point release covers more than the desktop and server editions. Nine other flavors, including Kubuntu, Xubuntu, Ubuntu MATE, Ubuntu Studio, and Edubuntu, also moved to version 24.04.5, each carrying its … More →

The post Ubuntu 24.04.5 LTS release patches security bugs across ten flavors appeared first on Help Net Security.

New infosec products of the week: September 11, 2026

Anamarija Pogorelec — Fri, 11 Sep 2026 04:00:08 +0000

Here’s a look at the most interesting products from the past week, featuring releases from Akeyless, Orchid Security, Scytale, and Securin. Securin Platform helps security teams prove when attack paths are closed Securin has announced the general availability of the Securin Platform, an AI-native Preemptive Exposure Management platform designed to answer three questions security teams struggle with every day: What can attackers actually exploit? What should we fix first? And did the fix actually work? … More →

The post New infosec products of the week: September 11, 2026 appeared first on Help Net Security.