Help Net Security

Microsoft Entra adds a seven-day safeguard against irreversible identity deletion

Anamarija Pogorelec — Thu, 12 Nov 2026 11:04:24 +0000

Microsoft Entra’s Hard Deletion Protection, now in preview, gives administrators a seven-day window to recover selected identities before they can be permanently erased. The feature is designed to help organizations respond to accidental or malicious deletion of critical directory objects. It supports users that are not synchronized from on-premises systems, cloud-only groups, applications, and service principals. Entra Agent ID objects are covered through their underlying identity types. How the recovery window works Entra generally retains … More →

The post Microsoft Entra adds a seven-day safeguard against irreversible identity deletion appeared first on Help Net Security.

Stolen Claude API keys can turn Claude Code into a remote-controlled implant

Mirko Zorz — Thu, 12 Nov 2026 11:00:21 +0000

Darktrace researchers turned Claude Code into a remote-controlled implant in a lab test, steering the coding agent through the memory stores feature of Anthropic’s Claude platform and pulling a 1 GB file out through the Claude Files API. Once the agent was set up, every job and every result traveled through api.anthropic.com, the endpoint the agent already calls for inference, so the attacker’s traffic looked like a coding agent doing its job. The technique needs … More →

The post Stolen Claude API keys can turn Claude Code into a remote-controlled implant appeared first on Help Net Security.

Photos: IRISSCON 2026 cybercrime conference

Zeljka Zorz — Thu, 12 Nov 2026 10:16:07 +0000

IRISSCON 2026, the annual cybercrime conference organized by IRISSCERT, took place at the Aviva Stadium in Dublin on November 11. The all-day event gives attendees a look at the cyber threats businesses are facing right now, along with practical advice on how organizations can respond to them. Help Net Security was there, and here’s a look at the day. Visitors at IRISSCON 2026 Selena Larson, staff threat researcher at Proofpoint, shared insight about GenAI use … More →

The post Photos: IRISSCON 2026 cybercrime conference appeared first on Help Net Security.

AWS Emulator: Open-source tool for testing AWS apps locally, built by autonomous AI agents

Anamarija Pogorelec — Thu, 12 Nov 2026 09:30:46 +0000

Amazon Web Services has released AWS Emulator, a free tool that simulates AWS services on a developer’s laptop, a development server or in a continuous integration (CI) pipeline. The company says autonomous AI agents wrote the tool entirely, with no code written or reviewed by its engineers. There is no additional service fee, users pay for AWS resources when they deploy applications on AWS. How three teams of AI agents build AWS Emulator Three teams … More →

The post AWS Emulator: Open-source tool for testing AWS apps locally, built by autonomous AI agents appeared first on Help Net Security.

Check your GitHub repos: A secret stealer hit tens of thousands of them

Mirko Zorz — Thu, 12 Nov 2026 09:24:32 +0000

A threat actor using stolen GitHub credentials has pushed a credential-stealing payload into tens of thousands of repositories since November 10. In more than 1,800 of them, the malware ran and shipped GitHub Actions secrets and cloud credentials to the attacker. Aikido spotted the campaign and named it wfx-loot. The name comes from the attacker’s own labels, “wfx” for the malware and “loot” for what it steals. Aikido counted 4,837 compromised accounts opening probe pull … More →

The post Check your GitHub repos: A secret stealer hit tens of thousands of them appeared first on Help Net Security.

.NET 11 security changes target the software supply chain

Anamarija Pogorelec — Thu, 12 Nov 2026 08:23:33 +0000

Microsoft has released .NET 11, a Standard Term Support (STS) release that will receive two years of support. .NET 10 is still the Long Term Support (LTS) option. The release covers C# 15, ASP.NET Core, .NET MAUI, and Windows development. Several of the changes affect software supply chain integrity, authentication handling, and platform lifecycle. .NET 8 and .NET 9 are out of support The most urgent item for defenders isn’t a new feature. .NET 8 … More →

The post .NET 11 security changes target the software supply chain appeared first on Help Net Security.

GitHub Agentic Autofix and the question of who owns a bad AI patch

Mirko Zorz — Thu, 12 Nov 2026 07:00:38 +0000

In this Help Net Security interview, Marcelo Oliveira, VP of Product Management at GitHub, talks about who is accountable when an AI-generated patch fixes one flaw and introduces another. He explains how Agentic Autofix re-runs detection engines and project tests, and what a CISO should change before pointing an agent at thousands of old alerts. Oliveira also discusses which metrics show a codebase is getting safer, how GitHub picks the models behind autofix, and whether … More →

The post GitHub Agentic Autofix and the question of who owns a bad AI patch appeared first on Help Net Security.

Dagster: Open-source cloud-native data pipeline orchestrator

Mirko Zorz — Thu, 12 Nov 2026 06:30:08 +0000

Dagster is an open source orchestrator for data pipelines. It decides what runs, in what order, and when. It also tracks how the tables, datasets, machine learning models, and reports it manages connect to the data they came from. When a source table goes bad, the tables built from it carry the problem forward. Dagster’s lineage graph shows which ones sit downstream, and that list is the starting point for fixing a broken dashboard or … More →

The post Dagster: Open-source cloud-native data pipeline orchestrator appeared first on Help Net Security.

Who collects the keys when an AI agent retires?

Help Net Security — Thu, 12 Nov 2026 06:00:57 +0000

Think about the last time a good engineer left your company. Someone collected the laptop and the badge. IT revoked their logins before the end of the day. Their manager reassigned the open tickets, and HR filed their records somewhere they’ll stay for years, in case anyone ever challenges a decision they made. Now think about the last time an AI agent left. Someone probably deleted it from the dashboard. I’ve started describing agents as … More →

The post Who collects the keys when an AI agent retires? appeared first on Help Net Security.

CISOs say OT will survive a cyberattack, but their engineers aren’t so sure

Mirko Zorz — Thu, 12 Nov 2026 05:30:13 +0000

Ask industrial security chiefs whether their plants would keep running through a full IT compromise, and every one who answered the SANS 2026 ICS/OT survey says yes. Thirty-eight percent expect to run indefinitely on islanded ICS/OT systems, and 62% expect to get by temporarily on manual controls. None foresee degradation or a halt. The 696 practitioners SANS surveyed, the people who would run those manual controls, are less sure. Only 15% said their critical processes … More →

The post CISOs say OT will survive a cyberattack, but their engineers aren’t so sure appeared first on Help Net Security.