Feed

Threat Actors Use Google Ads To Target Ledger Users

In August 2026, Zscaler ThreatLabz analyzed a phishing campaign that used fraudulent Google ads to target Ledger hardware wallet users. The ads redirected users through Google Cloud Storage and Vercel to a Google Sites page containing a phishing page impersonating Ledger in an iframe. During our analysis, the Vercel redirect appeared to change every 15-20 minutes. There, a fake…

Metasploit Wrap Up: Belgian Waffles, Chocolates, and…Modules-Frites?

Two Things Every Cyber Asset Attack Surface Management (CAASM) Tool Needs to Get Right

Cyber Asset Attack Surface Management (CAASM) solved a significant problem. Security teams can now say with confidence what they own. But, two things separate a CAASM tool that stops there from one that actually moves the needle on risk. The first is what the inventory itself carries. The second is what it connects to. 1. An inventory needs to do more than list what exists A list of assets is…

Agents can now set up your website’s security with Turnstile Spin

Misconfiguring Turnstile by skipping backend validation leaves sites exposed to bots. Turnstile Spin fixes incomplete setups by using your preferred AI coding agent to wire up server-side verification.

Darktrace / SECURE AI: Behavioral Security for the AI enterprise

Discover how Darktrace / SECURE AI applies behavioral security to AI usage, prompts, agents, and development to help organizations adopt AI securely.

Wiz Named a Leader in The Forrester Wave™: Proactive Security Platforms, Q3 2026

Forrester’s Proactive Security Platforms evaluation rated Wiz with top scores across eight areas, reflecting our commitment to securing the AI era

How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers

External security researchers at Accomplish identified a vulnerability in Cloudflare Containers that could expose residual disk data from previous workloads. We explain how the issue worked, how we investigated it, and the steps we took to remediate it.

When Business Email Compromise Starts Rewriting Reality

Business Email Compromise (BEC) operates on a familiar playbook. Threat actors breach a mailbox, silently monitor operations, map approval chains, and ultimately exploit that access to divert funds or exfiltrate sensitive assets. This dynamic is central to our analysis as we kick off a series around Rapid7's collaborative research with Zimbra; upcoming installments will explore technical details…

A Decision Model Breaks Like Any Other Language Model: A First Look at Jev

A new kind of AI model returns decisions instead of text. We spent a day trying to change its mind. It cost about 50 cents. In this article Jev is a new kind of AI model that returns typed decisions instead of text, built for software to call rather than for people to read. We put it inside a realistic application and tried to change its verdict from the outside. →every configuration we tested…

Scan for Good: Using AI to discover and fix high-priority exposures across public services and critical infrastructure

New initiative partners with under-resourced organizations to uncover, remediate exploitable risk at scale.

Can We Control Every AI Agent Before It Becomes Our Next Privileged Insider?

AI agents are moving into the enterprise much faster than most security programs were designed to handle. They are no longer just answering questions or generating content. Agents can read email, access SaaS applications, query databases, invoke APIs, use MCP tools, modify records and execute business workflows. In other words, AI is moving from generating answers to taking actions. For CISOs and…

Should you let AI shop for you this holiday season? Here’s what TrendLife found

Should you let AI shop for you? TrendLife tested six AI tools through the same set of realistic shopping tasks. Here's what we found: The post Should you let AI shop for you this holiday season? Here’s what TrendLife found appeared first on TrendLife Blog .

CrowdStrike Named a Leader in The Forrester Wave™: Proactive Security Platforms, Q3 2026

Agent Hijacks: How Conversation History Poisoning Can Turn AI Agents Into Attackers

Darktrace researchers demonstrate how conversation history poisoning can hijack agentic harnesses, convincing AI agents to perform offensive cyber operations with little to no human interaction.

CISA BOD 26-04 Timelines for Three Linux Kernel CVEs

Executive Summary CISA added three actively exploited Linux kernel vulnerabilities: CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its KEV Catalog on September 18, 2026, triggering a 3-day remediation deadline that passed on September 21. Under CISA BOD 26-04, a 3-day window applies to CVE-2025-39682 across all assets, and for the other two, the deadline is 3 days […]

How dynamic application security testing validates risk at runtime

Security teams already have long queues of potential application vulnerabilities. The useful question is what happens next: can they see how a weakness behaves in a running application, reproduce the attack, and give developers enough evidence to fix it? Dynamic application security testing (DAST) helps answer those questions by testing applications as an attacker encounters them. The IDC…

Workforce AI Security Policy Management Is Now Conversational

In this article The new Workforce AI MCP is Check Point’s own Model Context Protocol server for Workforce AI Security. Connect a compatible AI client and you can query, analyze, and manage your employee AI usage policy in natural language instead of working through filters, screens, and individual rule checks. →ask plain questions such as which rule applies to a given user and application, or…

CVE-2026-94127: Critical Unauthenticated RCE in F5 BIG-IP APM

Overview On September 22, 2026, F5 published a security advisory for CVE-2026-94127 , a critical heap-based buffer overflow vulnerability affecting F5 BIG-IP Access Policy Manager (APM). The vulnerability has a CVSS v3.1 score of 9.8. An unauthenticated attacker with network access to an affected virtual server may be able to achieve remote code execution (RCE) by sending specifically crafted…

Detecting Rogue AI Agents: When Enterprise Agents Turn to Hacking

Darktrace researchers found that AI agents tasked with solving impossible challenges frequently resorted to hacking techniques. Learn how Darktrace detects and disrupts rogue agent behavior in real time.

We just shipped support for the ugliest part of HTTP: Vary

Vary support is now available in Cache Rules on every plan. You can normalize known negotiation headers, pass exact values through to the origin when those small differences matter, or bypass cache when the variation is too unpredictable.

Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616

As part of Check Point’s Frontier AI Readiness Program, we continue to release Jumbo hotfixes with security fixes and hardening improvements for our Firewall and Management products. This advisory addresses the active exploitation described below, and the immediate steps customers should take to protect affected systems. Check Point Research has identified active exploitation of two…

Introducing Worker Previews: Isolated preview environments for every change your agent makes

Worker Previews gives every branch its own URL, configuration, state, and observability, so you and your agents can test changes in parallel without affecting production.

Introducing Unit 42 Continuous Frontier AI Defense

Cybersecurity is in the middle of a generational shift. AI has disrupted a 30-year balance of power between defenders and adversaries. Armed with agentic AI tools and open-weight models stripped of safety … The post Introducing Unit 42 Continuous Frontier AI Defense appeared first on Palo Alto Networks Blog .

Growing the WIN AI Ecosystem with Agent Integrations

WINning AI with AI: How the Wiz MCP for WIN partners accelerates a connected ecosystem

Proofpoint Stops the Attacks Traditional Defenses Miss in the AI Era

Proofpoint Breaks Down the Divide Between Data Security and AI Security with the Industry’s First Unified Agentic System

The fake “your cloud is almost full” text hitting phones right now

Got a text saying that your cloud drive is full and that your files will disappear in six hours unless you tap the link? It's a scam. The post The fake “your cloud is almost full” text hitting phones right now appeared first on TrendLife Blog .

Human Judgement in the Agentic AI Age | Darktrace

As AI agents take on more decisions, human judgement becomes critical. Explore the challenges of AI governance and how behavioral security can help.

Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation

Vidar is an information stealer that was first observed in 2018. Across its iterations, Vidar has continued to improve its string obfuscation to make detection and analysis more difficult by changing deobfuscation algorithms, constants, and primitives. From May through early September 2026, Zscaler ThreatLabz tracked Vidar’s string obfuscation as it evolved from basic XOR to ChaCha20,…

Python Workers are now generally available

Python Workers allow developers to run Python web frameworks and AI orchestration libraries natively in the Cloudflare Workers runtime. You can seamlessly integrate with Cloudflare's ecosystem including D1, R2, and Workers AI without writing any JavaScript glue code.

Proofpoint Recognizes 2026 Global Partner Award Winners at Flagship Event

Defining the Standard for AI Security

Palo Alto Networks Named a Market Shaper in 2026 September Gartner® Emerging Market Quadrant for AI Application Security — Established Vendors. When we set out to solve AI security, we knew it … The post Defining the Standard for AI Security appeared first on Palo Alto Networks Blog .

The End of Point-in-Time Compliance: Why Continuous Audit Readiness Matters to You in the AI Era

AI-driven threats are outpacing traditional audits. Discover how continuous monitoring, automated evidence collection, and risk-based remediation help security teams close compliance gaps and maintain audit readiness as environments change daily.

The Autonomous Engine Behind Remediation, and What Finally Makes It Safe

Executive Summary Vulnerability exploitation now happens at a speed that manual, ticket-based remediation can’t match. Qualys’s Enterprise TruRisk Management Platform closes that gap with autonomous remediation: exposures are prioritized by threat, business, and environmental context, then validated by TruConfirm and Agent Val before any resource is committed, eliminating over 90% of remediation…

Exploring the new AWS Sign Up experience

This post will explore what this new concept does, how it works with the new Account Access capability, and why a strong security posture still requires upgrading out of the sandbox.

Building an AI Detection Engine That Understands Agent Intent

Analyzing model input and output logs in an AI-native detection pipeline to understand and uncover malicious AI agent behavior

We joined the viral 1980s AI photo trend. Here’s what it tried to charge us.

1980s AI photo trend across social media: TrendLife tested how the trend can be exploited and shared steps to protect yourself. The post We joined the viral 1980s AI photo trend. Here’s what it tried to charge us. appeared first on TrendLife Blog .

CrowdStrike Named a Leader in The Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026

CrowdStrike SafeMind: When the Best Offense Builds the Best Defense

Operation RapidRust: APT36 Deploys RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH

In August 2026, Zscaler ThreatLabz observed new activity by the Pakistan-nexus threat actor APT36 in a campaign we’re tracking as Operation RapidRust. Since our last publication about the group’s activity in January 2026, APT36 has maintained a high operational tempo and updated their tactics, techniques, and procedures (TTPs) in continued attacks targeting government and defense…