Japan’s Liberal Democratic Party (LDP) has called on the government to establish a cybersecurity task force to strengthen defenses against AI.

The call to action follows an emergency meeting of the LDP’s National Cybersecurity Strategy Headquarters (NCSH).

Hosted on 9 October, Masaaki Taira, head of the NCSH, declared Japan in “a state of emergency in cyber space”.

The announcement comes as a series of cyber attacks have disrupted more than 20 companies across transport, retail, finance, and cloud services, according to the Financial Times.

Rail operator JR East reported the loss of 1.67 million email addresses, while car rental company Times Car lost a large number of customer driving licence scans. Meanwhile, cloud services provider IDC Frontier reported a ransomware attack that reportedly linked data leaks to hundreds of businesses.

In the financial sector, Japan’s financial regulator warned banks against accepting driving licences to open new accounts, following reports from Reuters that nine banks had been hacked using AI.

An investigation by Japanese IT company Macnica found that Japan has been hit with 119 cyber attacks this year as of 6 October, with 68% occurring since July, marking a sharp increase from 86 recorded attacks in 2025 and 62 in 2024.

AI is accelerating the attack frequency

An investigation by the Japan Computer Emergency Response Team Coordination Center (JPCERT) into the attack servers found attackers used AI tools to "scan for known vulnerabilities and conduct attacks via APIs”.

JPCERT noted that evidence was found of attackers analyzing APK files to detect vulnerabilities such as Server-Side Request Forgery (SSRF).

Additionally, Japanese security firm GMO Cybersecurity, cited by The Japan Times, alleged that a Chinese-developed AI tool was deployed in cyber attacks against companies in retail, finance, and e-commerce.

Nobuo Miwa, president of Tokyo-based cybersecurity firm S&J Corp, told Reuters that AI makes cyber attacks faster, cheaper, and harder to detect because “AI doesn’t get tired”.

He added, “Japan is essentially being subjected to carpet bombing.”

Building a defense against AI

Reports suggest that Japan’s ageing cyber infrastructure has left it vulnerable to these attacks. With AI making the work easier for attackers, the LDP is aiming to build cyber resilience by establishing a cybersecurity task force under a new headquarters to strengthen defenses using AI as a tool.

Although the plan is yet to be formally submitted to the Japanese Prime Minister's office, the proposal would encourage defenders to adopt AI-enabled cybersecurity solutions and call on regulators to assist small and medium-sized businesses in detecting attacks targeting them.

Mihoko Matsubara, chief cybersecurity strategist at Japan’s NTT Corporation, told ITPro that the LDP's proposal aims to relieve public anxiety by breaking down organizational silos and helping defenders adopt AI-enabled tools.

“Once formalized, the LDP recommendations would help CISOs secure more cybersecurity budget and invest in security hygiene that was overdue because of resource constraints,” Matsubara said.

She added that government-funded support for SMBs would also help strengthen supply chain security. “This would ultimately contribute to the overall resilience of the Japanese economy and industry.”

FOLLOW US ON SOCIAL MEDIA

Agentic AI security incidents are surging at an alarming pace, according to ServiceNow, and the company has warned many firms are unprepared to deal with future incidents.

A poll of cybersecurity leaders found 88% of UK firms have experienced an agent-related security incident in the past year. Crucially, only 36% of those polled said they were able to contain an incident in under 24 hours.

The findings come as agent deployments accelerate across a range of industries, the company said, from financial services and manufacturing to healthcare.

ServiceNow CISO Ben de Bont also highlighted high-profile incidents involving agents this year.

In July, OpenAI revealed that agents had escaped sandbox environments and breached third-party organizations, including Hugging Face. The admission by the firm was followed by similar cases involving agents at Anthropic and Meta.

These incidents underline the potential risks associated with the technology, de Bont said.

“The agentic incidents making headlines this year are a warning about what can happen when AI is deployed without the right controls,” he commented.

“Organizations shouldn’t have to choose between moving quickly and managing risk. The ones that get this right will build governance into how they deploy agents from the start, so they can realise the benefits of AI without losing visibility or control.”

Agentic AI security in the spotlight

According to ServiceNow, security leaders face a dual challenge when it comes to agentic AI security: the scale of adoption and adapting to “machine-speed” capabilities.

The current rate of adoption is “compounding organizations’ exposure”, the company said, with more than 51% of firms now running between 100 and 999 AI agents. Just over one-third (38%) are running upwards of 1,000 agents.

Yet despite the scale of adoption, just over half (53%) of security teams have a “full, accurate record” of every agent in production.

Moreover, 24% revealed they’d identified agents running in production that had never been registered and were unknown to them.

Running parallel to this, ServiceNow warned that the machine-speed capabilities of agents are “outpacing human-speed response” capabilities.

Three-quarters of respondents said they maintain a complete map of what services and systems agents can access, yet only 31% can monitor them in real-time.

This visibility gap means many security teams are unable to respond quickly enough in the event of a security incident or an instance where agents access unauthorized systems.

Observability has become a recurring concern since the advent of agentic AI, with enterprises unable to keep tabs on a growing array of agents operating behind the scenes.

ServiceNow’s findings on this front echo those in a recent study from Salt Labs. A survey by the security firm found the rate of adoption is placing a huge strain on security teams when it comes to visibility and governance.

Many enterprises also lack the appropriate containment controls for agents, Salt Labs warned. Indeed, the study found nearly half of respondents had observed an agent performing an action that wasn’t intended or authorized.

Assessing risk

ServiceNow noted that the use of agents will require a step change in how security leaders assess risk – and so far these efforts are falling flat.

The company said that while many security leaders “self-assess as having established agentic security postures”, just 13% have clear cut programs designed to measure leading considerations.

These key considerations span areas such as attack surfaces, accountability, visibility, and audit readiness.

According to ServiceNow, this shows that agentic AI security is primarily governed by “legacy frameworks and human-driven systems” that are unfit. Just over half (51%) of UK firms said they have governance frameworks that cover the aforementioned considerations.

Similarly, fewer than half (48%) of security teams build “design security” within the agent development process. The study warned this means that various permissions and guardrails are being implemented on an “ad-hoc, after-the-fact basis”.

FOLLOW US ON SOCIAL MEDIA

Businesses are faced with a bewildering choice of network monitoring solutions, and WhatsUp Gold from Progress Software stands out for its simplified licensing plans. Progress is commendably transparent about pricing and offers flexible subscription-based and perpetual licence options, along with a free version that monitors 10 devices and all of their components.

The Progress WhatsUp Gold 2026 on review delivers plenty of new features; the SSL certificate discovery and tracking introduced in the previous version has been updated to allow certificates to be discovered on any port, with new dashboards helping to maintain compliance with more information on expired or expiring ones. Stored device credentials are protected by customer-specific encryption keys. And businesses invested in Hirschmann will be pleased to know WhatsUp Gold now provides out-of-the-box support for its industrial network devices.

Security is even tighter with the introduction of a master secret key. Created during WhatsUp Gold installation, this key encrypts sensitive information in the WhatsUp Gold database and will be required if you want to recover or migrate to a new environment – so make sure it's stored safely in a secure location.

Progress WhatsUp Gold 2026 review: Plan to monitor

Progress Software employs device licences that allow you to monitor everything on a device, regardless of the number of components, aspects, or channels. Aimed at SMBs, a Business subscription starts around £920 per year for 50 devices and enables network discovery, topology mapping, alerting and reporting, plus cloud, wireless network and storage monitoring.

An Enterprise subscription starts at £1,540 per year, adds internet, virtualization host and application monitoring, network path analysis plus log management, and supports two WhatsUp Gold installations for distributed monitoring. Larger businesses will find Enterprise Plus appealing as it starts at around £2,600 per year and adds switch, router and firewall configuration management along with the NTA+ (network traffic analysis plus) module and support for four distributed installs.

Value for the Enterprise and Enterprise Plus plans gets a boost as they both include access to the WhatsUp Gold 360 service. This is ideal for distributed networks as you can monitor multiple sites from a single cloud portal.

Progress WhatsUp Gold 2026 review: Swift deployment

We installed WhatsUp Gold on a Windows Server 2025 host in 20 minutes and followed the quick start wizard to create our first network discovery. You add your networks and subnets, enable AWS and Azure discovery, and expand it to look for virtualization hosts, wireless infrastructures plus storage devices.

After adding all required device and service credentials, you specify which ports you want the certificate discovery to query and then set the scan to run at scheduled intervals. Our first discovery on a single subnet took around 10 minutes and reported back with a detailed list of all our Windows servers and workstations, network switches, firewalls, printers, NAS appliances, and VMware and Hyper-V hosts plus their VMs.

From the console's network view, you can select devices and manually enable monitoring, but WhatsUp Gold can do all the hard work for you as discovery jobs can be set to automatically monitor devices using predefined sets of roles and sub-roles. WhatsUp Gold also applies base sets of active and passive monitors and thresholds to each discovered device.

Redfish is fully supported, and after providing the appropriate credentials, WhatsUp Gold assigned a group of monitors to our Dell iDRAC and HPE iLO server management controllers. These can gather a lot of valuable information on server hardware, including the status of the chassis, CPUs, memory, storage devices, fans, temperatures, and power supplies.

Progress WhatsUp Gold 2026 review: Console and actions

The WUG console is easy to use as it groups all features under five main menus in an upper ribbon bar. The NTA+ menu tab is specifically for viewing flow data from Progress Software's FlowMon Collector appliances.

Colour-coded icons are assigned to each monitored element so you can easily see if they are up or down, while frequently used views can be added as Favourites for quick access from the star icon to the right. Analysis dashboards are a great feature as you can design detailed custom views, while the NOC (network operations centre) feature presents support staff with a heads-up display that combines slide decks of multiple dashboards with a view duration.

WhatsUpGold spotted all our secure web servers during its discovery and added an active SSL certificate monitor to each one. These default to checking them every 11 hours, and if they have expired or will expire in the next 30 days, it changes their status icon to show them as requiring attention.

Plenty of tools are provided for creating alert policies, linking them with device state changes, and assigning actions. WhatsUp Gold currently provides 24 types of actions, including sending SMS and email, restarting a service, running a PowerShell script, and linking up with services such as Microsoft Teams, ServiceNow, and Slack.

The Application Monitoring module is the weakest link, as the list of available profiles desperately needs updating. Links to the Progress community for downloading third-party profiles have also been removed as Progress is in the process of moving them all to GitHub.

Progress WhatsUp Gold 2026 review: WhatsUp Gold 360

WhatsUp Gold 360 is easy to deploy, as we logged into the customer portal using our Progress ID and, from the Connectors page, downloaded the install file. The connector must be virtualised, and we chose the Hyper-V version – others are available for VMware, KVM, Nutanix and Azure, with AWS support coming soon.

Creating a new Hyper-V VM using the supplied VHD file took a minute, and for tighter security, the connector will only link up with and send data to the WhatsUp Gold 360 tenant that created it. Adding our WhatsUp Gold instance was equally swift as we provided a meaningful name, its IP address, and admin credentials along with the thumbprint copied from the certificate viewer in the local WhatsUp Gold web console.

After a brief synchronization, the WhatsUp Gold 360 portal presents a dashboard with a choice of customisable widgets, including ones for connector and instance status, connector availability, total WhatsUp Gold monitors and devices, and events over time. You can create multiple dashboards, choose the widgets you want, and drag them around the view to suit.

WhatsUp Gold 360 pulls in a lot of information from each WhatsUp Gold instance, with its Infrastructure menu providing lists of all monitored assets, detailed hardware and software inventories, used credentials, and more. Details can be refined as all lists are searchable, and you can select WhatsUp Gold instances to view specific sites.

Communications channels are being replaced by the new notification management feature, allowing WhatsUp Gold 360 to send alerts via email or webhooks to Microsoft Teams and Slack. The webhook service is currently in beta testing, and the only alert we could send to our Teams channel was to warn of connector state changes.

Progress WhatsUp Gold 2026 review: Is it worth it?

WhatsUp Gold 2026 is an affordable network monitoring solution, and the flexible device-based licensing plans make it easy to keep costs under control. The highly configurable web console delivers a remarkable range of network monitoring services, and the Enterprise and Enterprise Plus plans look like even better value, as these include access to the WhatsUp Gold 360 cloud portal.

Tech industry leaders and security experts have expressed shock amidst a surge of attempted cyberattacks and suspended websites in the wake of critical PHP vulnerabilities.

Speaking at its AI Tour event in Germany, Microsoft CEO Satya Nadella reportedly said: “I’ve not seen anything like this in a long, long time.”

“It was a long day and a long night, I know, for all the IT and security folks,” Nadella added.

Nadella’s comments come after an update was issued to address critical PHP vulnerabilities that could impact millions of websites globally.

PHP (PHP Hypertext Preprocessor) is a programming language used in web development, which underpins much of the internet. The two vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, carry a CVSS score of 9.2, ranking them as ‘critical’.

Security experts have warned that both could allow unauthenticated remote code execution (RCE) and allow threat actors to seize control of servers, disrupt services, and steal data.

Given the severity of the flaws, several international cybersecurity agencies issued urgent alerts. CERT-EU and the UK’s National Cyber Security Centre (NCSC) urged organizations to patch immediately when available, or consider shutting down systems to prevent compromise.

“Millions of attempts”

While the PHP Foundation released an update on Wednesday, the patch was pushed forward by a day after a leak of CVE identifiers, meaning threat actors had some understanding of how to exploit the flaws.

An exploit tool known as ‘PHP2Shell’ was reportedly developed and showcased online.

Cloudflare CEO Matthew Prince revealed the company saw “thousands of attempts to exploit it” in the hours before it was publicly announced.

“Across the Cloudflare network we saw thousands of attempts to exploit it,” he wrote in a post on X. “That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now.”

Websites taken down

The global impact of the PHP vulnerabilities cannot be understated, particularly given cybersecurity agencies actively encouraged some organizations to take systems offline.

Services worldwide have been taken down as a result of the vulnerabilities while organizations apply patches. Dozens of UK government services have been taken offline as a precautionary measure while updates have been applied, according to reports from BBC News.

In Japan, Asahi shuttered some websites and systems to conduct threat assessments, while French telecoms giant Orange temporarily suspended access to some PHP-based websites.

Matt Cooke, EMEA cybersecurity strategist at Proofpoint, described the incident as a “stake-in-the-ground moment” for enterprises and cybersecurity leaders alike.

“Organizations of every size have a finite window to shore up their cyber defenses, because threats now operate at machine speed,” he said.

“Patch fast, know your attack surface, and limit the blast radius, because that window is closing. If we don't act now, we will see more organizations forced to take their sites offline while they scramble to fix what should have been secured long ago."

Did AI help? find the PHP vulnerabilities

A key talking point in the PHP incident lies in how vulnerabilities were discovered: namely through the use of AI. Cybersecurity researchers at Calif originally identified the flaws using OpenAI’s GPT-5.6 Sol model as part of the firm’s Patch the Planet initiative.

Researchers at Wiz also independently discovered and reported both vulnerabilities.

In a blog post detailing the discovery, Wiz researchers said the findings “rank among the most severe vulnerabilities discovered in PHP, and arguably in software history”.

Researchers also emphasized the importance of AI in the discovery, which helped simplify processes and shed light on the flaws.

“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” Wiz researchers wrote.

“Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit.”

Tom Exelby, head of cyber security at Red Helix, issued a stark warning, insisting that this “won’t be the last time we see an incident like this”.

“So much of our digital world rests on a comparatively small number of providers, platforms, and open source components, and that concentration means a single flaw can have a global impact in minutes,” he said.

“When a technology is embedded in millions of websites and services, a vulnerability stops being one organization’s problem and becomes everyone’s.”

FOLLOW US ON SOCIAL MEDIA

AI adoption in organizations has become near-ubiquitous, but has not been coupled with appropriate oversight. Few companies can answer all of the key AI security questions: who is using AI and to what extent, exactly which tools and models are in play, and what data is being shared with them.

Research from Cyera shows that 83% of businesses already use AI, but only 13% have strong visibility into how it is being used. This gap is where partners can help customers move from experimenting with AI to governing it securely.

The biggest commercial opportunity for the channel over the next few years will not come from selling customers more AI tools; it will come from helping them govern the ones they already have.

Shadow AI: the challenge customers can't see

One of the clearest examples of the disconnect between AI adoption and governance is ‘shadow AI’, the use of generative tools without direct IT approval or visibility. This creates compliance gaps, as well as hidden channels for data loss that can’t be audited, because no one knows they exist. The consequences are already impacting businesses and are only set to increase, with one in five organizations experiencing a breach linked to shadow AI last year.

The problem of shadow AI stems from how AI entered most businesses. Adoption was initially organic and employee-led, driven by curiosity rather than policy. While that fuelled useful experimentation, it has frequently left organizations with no boundaries, no ownership, and no clear line between sanctioned and unsanctioned use. Customers need help turning that experimentation into something controlled.

A management rather than an IT issue

Ungoverned AI shouldn’t be seen as a housekeeping task for IT. When confidential data can leak into publicly accessible tools, when autonomous agents can affect key databases and systems with little oversight, and when third-party models introduce risks that vendor programmes never assessed, the exposure needs to become a central concern for management.

Yet this is where organizations are frequently falling short, and this has knock-on effects on their resilience, compliance and trust responsibilities. Some 77% of organizations have an AI strategy, yet only 26% can actually enforce it.

For channel players, this changes who they should be in conversation with. As the conversation moves from the IT teams to senior leadership, the partners who can discuss holistic governance concerns, rather than individual technical features, will be the ones trusted with leading the changes.

A services opportunity, not a resale one

This is where the opportunity for Managed Service Providers (MSPs) and Value Added Resellers (VARs) becomes clear. Vendors can supply the tools, but only a partner can operationalize governance inside a customer's own environment, with its particular mix of applications, data and regulatory exposure. This kind of expert consultancy isn’t something that can be bought off a shelf.

The value here lies in services rather than resale, from discovery and visibility assessments to policy design and the ongoing management that keeps governance current as tools and rules change. Each of those is recurring by nature. The aim is to move a customer from experimenting with AI to governing it securely, with the partner as the constant throughout.

The conversations to have now

Partners do not need a mature market or a polished AI security practice to start. The value is in having these conversations today, while guidance from MSPs and VARs is most needed. Four topics should be prioritized above others:

• Visibility: Most customers underestimate how much AI is already running across their business, and a straightforward inventory, covering approved tools, unsanctioned usage, and high-risk workflows, is the best route into the wider conversation.
• Data protection: Once visibility exists, the priority is controlling what goes into AI tools, with guardrails that stop proprietary or regulated data being shared with public models where it can be retained or exposed. The risk here is often capable employees trying to work faster, rather than bad actors.
• Policy: This makes the above controls durable and easier to review. This can take the form of a clear code of conduct, a list of sanctioned tools and conditions, and explicit guidelines detailing where human judgement must stay involved in sensitive areas.
• Agentic AI: As agents gain autonomy to act across business systems, partners can help set parameters, approval thresholds and logging, and ensure a human stays in the loop on decisions affecting customers, finances or critical systems.

Turning regulation into recurring revenue

Upcoming regulation means that securing AI is now an urgent priority for customers. Sound AI governance already aligns with frameworks including NIS2, the EU AI Act, the Cyber Resilience Act, and GDPR, and the next phase of EU AI Act obligations takes effect from August 2026. That is a concrete deadline partners can build a conversation around now.

The opportunity is to frame regulatory readiness as an ongoing managed service rather than a one-off compliance project. The rules will keep evolving, and customers will need a partner who keeps them aligned as they do. Handled that way, regulatory pressure becomes a durable, recurring revenue stream.

AI will only become more deeply embedded in how organizations operate. The customers who benefit safely will be those who adopt it with control over their data, their tools, and their decisions, rather than being steered by tools they cannot see. The partners who move the fastest, from selling AI to helping secure it, will build the deepest and most lasting customer relationships.

Japanese media giant Nikkei, owner of financial publications including the Nikkei and the Financial Times, has revealed a data breach in which 1.83 million records have been stolen.

The incident, which took place from the early hours of 7 October, involved the unauthorized access of a cloud service used by the firm for system development.

Nikkei said the credentials that were used have now been disabled, and that it doesn't yet know how they were stolen.

"As of October 16, we have found no secondary damage, such as misuse of the leaked personal information," said the firm. "We have also found no other problems, such as Nikkei system outages or data tampering."

Of the 1.83 million records that were stolen, around 150,000 contained one or more name, email address, postal address, phone number, or date of birth. Of these, about 120,000 included an email address - putting these people at risk of phishing attempts.

About 1.68 million items contained information that couldn't be used to identify an individual, Nikkei said, and no credit card information was leaked.

The firm said it's now working to assess the extent of the damage and find the cause, and that it is contacting all those whose data has been affected.

It has also reported the incident to Japan's Personal Information Protection Commission, but has found no evidence that the leaked data has been misused in any way.

"For businesses, this incident highlights the importance of strong access controls and protecting employee credentials. Implementing multi-factor authentication, regularly reviewing account permissions and monitoring for suspicious login activity can significantly reduce the risk of unauthorized access," commented Jamie Akhtar, CEO and co-founder of CyberSmart.

"Employee cybersecurity awareness training is equally important, helping staff recognise phishing attempts and avoid inadvertently exposing sensitive information."

A hat-trick of Nikkei breaches

The breach is the third to have hit the company in the last few weeks. Earlier this month, it disclosed a breach that occurred in late July, when hackers compromised employees’ Microsoft 365 business software accounts and accessed personal information belonging to employees and business partners.

It also revealed a second breach, in which a cloud service it used had been accessed without authorization since late July.

“Three breaches in a month point toward a systemic problem that a series of individual incident responses isn’t resolving. The investigation and remediation approach clearly needs to widen beyond what’s been done so far," commented Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress.

"For an organization whose core business is the integrity and trustworthiness of financial information, a month of successive data breaches is now a reputational problem.”

Looking further back, in May 2022, the firm revealed that it had fallen victim to a ransomware attack, while, in November last year, it disclosed a data breach that was caused by the compromise of a Slack account.

FOLLOW US ON SOCIAL MEDIA

An update has been issued for two critical PHP (PHP Hypertext Preprocessor) vulnerabilities after a working exploit was published online this week.

PHP is a server-side programming language used in web development, powering millions of websites globally.

The two vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 and carry a CVSS score of 9.2, ranking them as ‘critical’. Both enable unauthenticated remote code execution (RCE), according to analysis.

On Monday 20 October, the PHP Foundation issued an advisory warning of the two vulnerabilities, urging organizations to prepare for an impending patch. The advisory was issued following reports that an exploit tool known as ‘PHP2Shell’ has been made available, with a video guide of the tool in action posted online.

In a follow-up announcement, the PHP Foundation said fixes for both flaws are now available, outlining organizations at risk of attack.

“Who is at risk: All PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed,” the foundation said.

“We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.”

How to patch the PHP vulnerabilities

According to the PHP Foundation’s advisory, organizations are required to update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Sources for the patches can be found via the foundation’s downloads page.

Windows sources and binaries are also available on the same page, according to the organization.

Linux distributions and LTS vendors were given access to the patches in advance, according to the foundation. Admins are advised to check with their respective vendors for updated packages.

Notably, PHP 8.1 and older versions no longer receive support from the PHP project, the foundation warned. Admins are therefore advised to contact vendors for details on a potential backported fix or to upgrade to a supported version.

PHP flaws had the cyber industry scrambling

A host of security agencies worldwide have issued alerts over the critical vulnerabilities amid warnings that both were being actively exploited.

CERT-EU said the vulnerabilities could affect all versions from PHP 5 onwards, which, given this dates back to 2004, underlines the scale of the potential threat.

This warning was echoed by similar analysis from cybersecurity firm watchTowr.

Crucially, CERT-EU said that if organizations cannot immediately patch, they consider “isolating internet-facing applications from public networks until a fix can be applied”.

The UK’s National Cyber Security Centre (NCSC) gave similar advice for organizations.

“Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated,” the agency said in a statement.

Jake Moore, global cybersecurity advisory at ESET, said that given PHP underpins large parts of the web, mass exploitation of the flaws represented a huge threat.

“When vulnerabilities are leaked before their patch is available, it is usually a scramble to do whatever possible to mitigate the damage,” he said.

“But the sheer scale of PHP across the internet makes this far more serious than the usual exploit. A vulnerability in technology used by millions of websites could immediately give cyber criminals an enormous number of potential targets.”

Notably, Moore said the leak gives attackers a “huge head start” and urged businesses to identify vulnerable systems and patch immediately when available.

FOLLOW US ON SOCIAL MEDIA

Security updates are vital in keeping software secure and users safe, but they could also act as a map for hackers to find weak spots in code, including subsequent patches.

That's according to research from Terra Security, which said the rate of patches later reported to be broken has surged from a "low, steady rate" by eight times.

"Software security fixes are both bug closers and maps: they show where a given bug used to live and how the developer chose to close it," Terra security researcher Oren Yomtov noted in a blog post. "Narrowing down the fix so that it only blocks the reported case can point the next attacker toward undefended gaps around the repair."

While Terra didn't pin the leap in patches needing patching on AI directly, the jump happened this spring, as security models such as Anthropic's Claude Mythos and OpenAI's GPT-5.5-Cyber were announced, though were only released later and in a restricted way to approved partners.

That said, AI has unquestionably led to a boom in the number of flaws being spotted this year.

Spotting broken patches

Terra noted this pattern of patches requiring subsequent fixes in its own efforts over the last year, with bypasses quickly found, necessitating yet another patch. To check that this wasn't simply the company's own experience, Terra researchers looked at every flaw listed in the CVE system as well as GitHub advisories.

Researchers noted it wasn't just Terra seeing an increase in patches requiring fixes.

"Broken fixes have been reported for years at a low, steady rate until 2026, when the share of open-source fixes on GitHub later reported broken rose about eightfold," Yomtov said.

A chart shared in Yomtov's blog post showed reports of open source fixes that needed their own patches within 90 days jumped from below 0.5% to 2.3% in a matter of months, with the leap happening after March 2026.

"The CVE record database gives much wider coverage than our GitHub data and shows the same jump in the same year," Yomtov added.

He added that patches for bugs on the known-exploited list are four times as likely to be reported as broken as flaws from the very same vendors.

"The likely reason is attention: exploited bugs draw more researchers, who study the patch and find what it missed," he added.

What can be done?

Security teams should be aware that patched flaws may still remain a vulnerability, according to Yomtov.

"The upshot is that the "patch and move on" habit is a bad one, especially for the bugs that matter most," he noted.

Yomtov added that one of the most common types of broken fixes are server-side request forgery and prototype pollution, where the usual solution is to create a list of inputs to automatically reject.

"The reason is simple: if the blocklist doesn't foresee every encoding of a bad input, the attacker only needs to find one," Yomtov added.

Beyond that, this technique for addressing flaws highlights what's broken to would-be attackers. As Yomtov noted, a patch that only blocks reported inputs can “give the impression the bug is addressed”, even if it’s still present in the underlying code.

"It functions as a map for attackers, marking out both vulnerable code and what the defender thought the bug was."

That means that security professionals should look "just outside the diff" – as opposed to looking only at the code that was changed – in order to spot potential problems. Calling it the "cheapest form of bug hunting," Yomtov added: "We believe a growing share of attacker effort, and AI tokens, goes into exactly this."

Because of that, he advises security pros should "diff-hunt your own fix before shipping it," as attackers certainly will, taking into consideration whether the patch actually fixes the root cause – rather than merely blocking one input – and whether it covers the whole bug class or might break anything else.

"The same goes for patches you install," he adds. "If a vendor fixes an exploited bug, assume someone is reading the patch for a way around it."

FOLLOW US ON SOCIAL MEDIA

ConnectWise has entered day three of disruption to its cloud services, which it had to take offline following a breach of its systems detected on 16 October.

ConnectWise Cloud Backup – formerly SkyKick – offers backup and recovery services to MSPs to protect their customers’ Google Workspace and Microsoft 365 environments.

The company announced it had discovered “recent attempts of unauthorized access associated with the ConnectWise Cloud Backup environment”. The firm said its incident response procedures were “promptly initiated” and containment measures put in place.

A little under 12 hours after publishing the initial advisory, at 5.00am UTC on 17 October, the company shut off Cloud Backup access as a “protective measure”. Approximately eight hours later, CloudWise SaaS Security and Cloud Management were taken offline as well “as an additional precaution”.

Customer Microsoft 365 environments accessed

According to security organizations like Huntress and Todyl, which monitor ConnectWise tenant environments on behalf of their customers, the attack started with the application’s identity signing into Microsoft 365 tenants from a hosting provider and receiving Microsoft Graph access tokens.

“This is not how the app normally behaves,” Huntress explained in a blog. “Legitimate traffic comes from Azure private IP space. As of [7.00pm UTC] on October 16, Huntress has confirmed unauthorized sign-ins in 162 tenants.”

Expanding on the nature of the threat, Todyl said: “Because the application already held broad, previously granted permissions in each tenant, those sign-ins gave the attacker the technical ability to read and write mail and attachments, OneDrive and SharePoint files, and Teams chats.”

According to Huntress’s observations, in the two tenants it has been monitoring that have been compromised, the behaviour after access had been established was “fast, scripted, and notably indiscriminate”.

“The procedure was the same each time: the application granted itself Global Administrator, then planted a new secret on a small number of other applications in the tenant to keep a foothold,” Huntress said, though there were some differences in where the secret was planted.

The incident isn’t over

The issue for ConnectWise MSP customers, as security firm CoreView pointed out, is while it has disabled new logins to its applications, “this should not be read as if the incident is over for businesses that had the affected service principals in their tenant".

Indeed, ConnectWise said in its own advisory that disabling the affected connections only prevents new connections.

“It does not reverse changes previously made inside a tenant,” ConnectWise said.

The company added that while its investigations have established that “existing backup archives remain encrypted, isolated, and preserved,” these findings don’t extend to live Microsoft 365 environments.

As of 19 October, Huntress has discovered “almost 1,000 Entra tenants with sign-in activity from the IP address associated with the unauthorized activity (144.172.64[.]128). Over 300 of these succeeded”.

What should MSPs do now?

ConnectWise has said partners should review their own Microsoft 365 tenants, as well as each managed customer tenant. This includes environments with dormant SkyKick connections.

The company has offered detailed instructions on what MSPs should do now, including:

• Verifying local status and preserving evidence
• Reviewing sign-ins across identities from 13 October minimum – possibly as far back as 1 October – to date. Filter for the IP address listed by Huntress as well as 144.172.64[.]99 and 144.172.64[.]60
• Reviewing directory audit events
• Checking credentials and federation trusts
• Checking roles, application owners, and consent
• Checking policy changes
• Checking exchange and resource activity
• Reviewing remaining connections and recording the outcome.

Further information can be found on the ConnectWise advisory page under the entry listed as Update: Sunday, October 18, 2026 at 01:00 UTC.

Huntress added additional actions impacted customers should take, including:

• Disabling ConnectWise Cloud Backup and ConnectWise Cloud Management - MS Teams in their Microsoft 365 tenant
• Consider also temporarily disabling other ConnectWise Cloud Management application IDs
• Don’t delete the application IDs, only disable them
• Don’t re-enable affected applications until ConnectWise confirms all credentials have been reset.

FOLLOW US ON SOCIAL MEDIA

The US Department of Homeland Security (DHS) has banned the use of DeepSeek by civilian federal agencies, citing security concerns.

The ban covers any technology built with the aid of the company's AI models, and applies to agencies including the Department of the Treasury, the Department of State, and the Department of Justice, as well as prime contractors and subcontractors serving federal agencies.

It also bars DeepSeek from future procurements, and requires agencies to remove versions put into place prior to the ban.

The main worry is that DeepSeek servers are located in the PRC, where government cyber and intelligence operations legally have broad authority to access private company infrastructure.

"For DeepSeek-hosted instances of their models, DeepSeek's account generation process collects personally identifiable information (PII) and may also track and digitally fingerprint users. DeepSeek's most widely used applications function through a prompt-and-response process that requires presenting information to the model, and which may result in the transfer of sensitive data to the PRC if used by US government employees or vendors," the notice reads.

"The transfer of the aforementioned information to the PRC, either independently or in combination with publicly available data could produce actionable intelligence on US persons and/or government programs."

DHS cites DeepSeek vulnerability concerns

The DHS is also concerned that the models themselves may contain malware or other security vulnerabilities. Indeed, open source security research has already found that the DeepSeek iOS mobile application contains multiple critical vulnerabilities.

Agencies that have been using DeepSeek are warned that they should check that they haven't already been compromised. According to the DHS, these organizations should monitor the flow of traffic in and out of the agency, implement enhanced logging and controls for relevant systems, and flag any anomalous activity.

Gabrielle Hempel, security operations strategist at Exabeam, said the advisory “raises some significant questions” with regard to supply chain security.

"What I find particularly interesting about the DeepSeek order is the breadth of its language," Hempel commented.

"The restriction extends beyond DeepSeek itself to third-party products and services developed using its implementations, which raises some significant questions about software provenance and supply-chain compliance."

DeepSeek is already banned from state systems in Texas, New York, and Virginia, as well as in Australia, South Korea, and Taiwan. Individual US government bodies, including the Commerce Department and the US Navy, have also removed it from use.

It remains to be seen how effective such bans can be, however, and how quickly existing systems based on DeepSeek can be replaced or redesigned.

"I suspect we're going to see increasing tension between national security policy and the practical realities of AI development, particularly as governments begin imposing restrictions that extend beyond the models themselves and into the broader software supply chain," said Hempel.

"The challenge will be making those requirements sufficiently clear and technically enforceable.”

The ban comes just days after the release of DeepSeek's latest AI model, V4.1-Flash-1017, which the company described as faster and more efficient than previous models.

FOLLOW US ON SOCIAL MEDIA

As ransomware continues to proliferate, ransomware-as-a-service (RaaS) is now firmly rooted in the ecosystem. Some operations come and go, such as LockBit, which was taken down in 2024 after a multi-jurisdictional law enforcement effort dubbed Operation Cronos.

Yet LockBit continues to reinvent itself and has recently relaunched, alongside a busy market of RaaS rivals with various targets and aims.

In the current climate, some operations pose more of a risk to businesses than others. Here are five RaaS groups businesses should be aware of – according to current research and threat intelligence – along with some steps firms should take to mitigate the threat.

Akira

Akira operates on an affiliate RaaS structure, with a long lineage associated with storied Russian cybercrime syndicates.

Akira is objectively considered a “semi-private offering”, maintained by “an eclectic cartel of experienced ransomware operators”, according to Adam Brown, principal threat intelligence analyst at Huntress.

TTPs vary and are indicative of the techniques applied by individual affiliate operators themselves, says Brown. For example, he says, Akira ransomware shares direct source code overlap with previous Conti ransomware payloads.

Operating since 2023, Akira is notable for expanding beyond traditional Windows environments and targeting virtualisation infrastructure, including VMware ESXi and Nutanix AHV environments, says Xavier Mertens, principal instructor, SANS Institute.

Mitigation

To protect against attacks from Akira, authentication logs are “a good starting point”, says Mertens. Organizations should look for successful VPN connections from unusual locations or devices, dormant accounts suddenly becoming active, or “accounts authenticating to systems they normally never use”.

DragonForce

DragonForce emerged publicly in 2023 and has evolved from a conventional operation into what it describes as a ransomware ‘cartel’. It was responsible for 2025 retail attacks including M&S and the Co-op.

The group reflects a “broader trend” in which affiliates, access brokers and ransomware operators share infrastructure, tooling and expertise, says Mertens.

DragonForce affiliates’ intrusion patterns include credential compromise, reconnaissance, lateral movement, data theft, and encryption. Double extortion is “central to its model”, according to Mertens.

“Attackers typically steal sensitive information before encrypting systems, allowing them to threaten publication of stolen data, even if victims can recover from backups.”

Mitigation

To defend against the group, firms should monitor both the intrusion and exfiltration stages of an attack, says Mertens.

“Unusual PowerShell activity, credential dumping, new remote-access tools and unexpected SMB or RDP activity can indicate an attacker establishing control of the environment.”

Organizations should also watch for large archive files, unexpected use of tools such as 7-Zip or RAR, and abnormal outbound transfers, he says. “Exfiltrating large volumes of data takes time and can provide an opportunity to detect the intrusion before encryption begins.”

LockBit 5.0

LockBit suffered a steep drop in activity following Operation Cronos, but researchers say it has now returned to roughly fourth place in the last year. This shows “the difficulty in clamping down on ransomware if the people involved remain at large”, says Cian Heasley, principal consultant, Acumen Cyber.

Originally identified as ABCD ransomware, a moniker derived from the file extension applied to the files the ransomware encrypted, LockBit originated in the Russian-speaking cybercrime underground around September 2019.

While the threat from the group has fallen sharply since its heyday, LockBit-associated adversaries continue to release updated builders and remain “a prevalent threat”, says Brown.

Mitigation

Mitigating attacks from LockBit affiliates requires ensuring a robust defence. Heasley mandates “a combination of phishing-resistant multi-factor authentication (MFA) on every internet-facing service, offline and immutable backups regularly tested, and network segmentation to slow lateral movement in the event of a breach”.

Qilin

Qilin emerged in mid-2022 when established RaaS brands such as Conti, LockBit, BlackCat/ALPHV, and Hive were experiencing disruption from law enforcement actions, leaks, or internal fragmentation.

Amid the chaos, the Russia-linked group positioned itself as a “professional affiliate program”, recruiting experienced operators from other syndicates and offering a revenue-sharing model, explains Brown.

The now-infamous group caused havoc in 2024 when it was responsible for the attack on NHS provider and blood testing company Synnovis.

Today, Qilin is still keeping itself busy. The group is “unquestionably the most active RaaS operation of the last year”, according to Heasley. Some statistics show the outfit was involved in one in every six disclosed ransomware breaches across the top 50 countries impacted by ransomware between April 2025 and March 2026.

Mitigation

Qilin affiliates typically gain access via VPN accounts, exploiting an internet-facing appliance, or credentials from another criminal. Therefore, rather than concentrating solely on Qilin signatures, organizations should monitor for unusual VPN logins, unexpected Active Directory enumeration, suspicious Local Security Authority Subsystem Service (LSASS) access, and remote administration activity, according to Mertens.

“A workstation suddenly querying large parts of Active Directory, an administrator account authenticating to dozens of servers, or PsExec appearing where it has never previously been used can all indicate an intrusion in progress. The combination of these behaviours is often more revealing than any single alert.”

The Gentlemen

The Gentlemen, which emerged in mid-2025, consists of highly organized former affiliates of other massive ransomware networks such as Qilin. The group has become notorious for its aggressive double extortion model and a unique 90% profit split payout offered to affiliates, which has helped fuel its rise.

The Gentlemen typically gains initial access by exploiting internet-facing edge devices, according to Christiaan Beek, VP of Rapid7 Labs at Rapid7. “Once inside, the Gentlemen ransomware affiliates conduct reconnaissance to map the environment and identify high-value targets for encryption and data exfiltration.”

The Gentlemen is currently the second most active RaaS, based on statistics from reported breaches, according to Heasley.

Mitigation

To defend against The Gentlemen, it’s crucial that a patch management program prioritizes fixes to network edge devices as they are released, says Beek. “Prioritization of fixes should also be based on known exploits, the potential impacts on your business, and how these align with your risk tolerance.”

Heasley believes the strongest defence against The Gentlemen lies in disrupting the group's kernel-level endpoint detection and response (EDR)-killing playbook by enabling Microsoft's vulnerable driver blocklist.

At the same time, he recommends “removing internet exposure from firewall management interfaces and protecting backup infrastructure with credentials and controls that sit entirely outside your production Active Directory”.

Israeli digital advertising agency Discover-Tech has been caught serving millions of online adverts that installed spyware on the phones of targets around the world.

Through a zero-click technique dubbed "AdFection", Discover-Tech's Controlium platform has been used by financially motivated customers to de-anonymize, fingerprint, and automatically infect devices the moment an advertisement is rendered.

Apps found displaying Discover-Tech ads include Duolingo, dating apps, period trackers, German weather apps, Yahoo Mail, Viber, and calling apps such as Truecaller.

This is the first example, said Citizen Lab, of in-the-wild infection of devices with zero-click mercenary spyware via targeted advertisements.

The spyware, said Citizen Labs, was used against dozens of devices belonging to journalists who reported on sensitive subjects at Qatari news network Al Jazeera. Its ads also appeared in critical networks used by the Pentagon, the United Nations International Atomic Energy Agency and the International Criminal Court.

And it's also been used to hit media organizations in Austria, Denmark, France, Mexico, Israel, Italy, Norway, and Sweden, as well as networks of international media services.

"Discover-Tech presents itself as a legitimate online advertising business. In fact, the Israel-based company provides a bridge between multiple mercenary spyware companies engaged in hacking and the legitimate online advertising ecosystem," the researchers said.

"We have found billions of instances of Discover-Tech bidding to send such advertisements to users, and no sign that the company is engaged in any legitimate advertising business activities."

The firm's Controlium platform, the researchers said, allows mercenary spyware firms to infect targets via online ads. After mass-profiling and deanonymizing millions of users, they can then covertly hack individual targets by sending them seemingly harmless ads containing zero-click exploits to install spyware on their devices.

The device is sent malicious JavaScript code, which is executed by the browser or app and then exploits and infects the device.

Controlium's users include mercenary spyware company Candiru – reportedly now owned by US-based Integrity Labs. This firm has already been called out by the US Commerce Department for developing spyware used to target government officials, journalists, businesspeople, activists, academics, and embassy workers.

The platform's also linked to Israel-based Bindecy, which specializes in zero-click mobile exploits, and another mercenary surveillance firm called Intelos.

"Our analysis reveals a dangerous lack of due diligence in the advertising ecosystem that Discover-Tech actively exploited. Despite supporting mass-profiling and mercenary spyware hacking, Discover-Tech has nonetheless appeared on several lists of "certified" and "approved" advertising vendors maintained by Google and IAB Europe, the advertising industry association," the researchers said.

"The fact that a "certified" company could target millions of users for years with no signs of legitimate activity highlights the dangerously inadequate controls over a sector that by its very nature touches almost every individual with a mobile device or a web browser in extremely invasive ways."

Google and digital marketing and advertising platform IAB Europe have now removed Discover-Tech from their ad vendor lists.

The Metropolitan Police Service (‘the Met’) has landed itself in hot water with the UK’s data regulator, the ICO, after members of staff uploaded sensitive data to an unauthorized third-party platform.

Between March 2023 and September 2024, officers and staff in the Greater London police force used the Auror intelligence-sharing platform as part of a crackdown on shoplifting, despite it not being formally approved for use.

Auror is a third-party, cloud-based platform from SaaS provider Auror Europe Limited, a wholly-owned subsidiary of New Zealand firm Auror Limited.

It's accessible via a website and mobile application and is mainly used by retailers to record, manage and analyse incidents of retail crime. It does this using a range of technologies, including facial recognition, automatic number plate recognition (ANPR) and AI.

Retailers can upload incident reports, images and CCTV footage relating to suspected shoplifting and other retail-related offenses, which can then be shared for free with law enforcement authorities.

This may seem not only harmless but actively helpful in the detection and prosecution of crime, however the tool wasn’t subjected to the usual data protection assessments or governance before use.

"Police forces hold large volumes of sensitive personal information and must have robust safeguards in place to protect it," said David Doodson, ICO head of investigations.

"Whilst new technologies can deliver significant operational benefits, organizations cannot allow innovation to outpace their data protection responsibilities. Before introducing new systems or platforms, they must properly assess the risks, put appropriate safeguards in place and ensure effective oversight."

Specifically, said the ICO, the Met unlawfully processed personal information without individuals’ consent and in situations where sharing wasn't actually necessary for law enforcement purposes.

In all, around 500 accounts were created, with 375 actively used for policing activities. The ICO found that, between January and September 2024, personal information relating to 179 people – three of whom were under the age of 18 – was uploaded to the platform as part of efforts to identify individuals suspected of shoplifting.

This included names, dates of birth and, in a small number of cases, home addresses.

The police force also failed to put the appropriate technical and organizational measures in place to make sure that personal information was protected or that assessment and approval processes for third-party technologies were followed.

Additionally, the ICO found that, not only did the Met not carry out a data protection impact assessment, it still isn't ensuring that only approved third-party technologies are used to process personal information.

Since the issue first emerged, MPS has tightened up its procedures. However, the ICO said it still needs to do more.

It has ordered the force to strengthen its approach to identifying, assessing and approving any third-party services used to process personal information. It must also review its controls, improve governance processes, enhance staff awareness and regularly test the effectiveness of the measures it has in place.

Controlling the spread of shadow AI

Shadow IT – and shadow AI in particular – is a growing problem. A survey from SailPoint earlier this year found that two-thirds of organizations can’t account for the information staff are sharing with AI platforms and large language models (LLMs). It also found that 35% of staff are sharing data through external tools, rather than approved internal applications.

"This action should send a message across the policing sector, and beyond: if you are using new technology to process people's information you must do so lawfully, transparently and with appropriate governance from the outset," said Doodson.

"Where organizations fail to protect people's information, we will take action. Our role is not only to hold organisations to account, but to drive improvements and promote the standards people have a right to expect."

Two critical flaws in one of the most widely-used LLM gateways, LiteLLM, could let low-privilege users execute code, hijack admin accounts, and steal AI provider API keys.

With 97 million downloads per month and more than 59,000 GitHub stars, LiteLLM runs inside large enterprises, startups and many of the platforms used to build AI applications.

It functions as an LLM gateway, used for storing API keys for every AI provider the organization uses, managing user access through roles and permissions, routing prompts and responses between applications and providers and tracking usage and costs across models.

However, according to Checkpoint researchers, CVE-2026-35029 allowed any user – including those with read only access – to reach administrative functions and take over the gateway. CVE-2026-59823, meanwhile, allowed attackers to redirect gateway requests to their own server and capture AI provider API keys.

"In practical terms, anyone holding an account on a vulnerable LiteLLM deployment could take over the gateway and use it for malicious purposes," said the firm.

LiteLLM uses role-based access control, where administrators manage the system and other users receive limited or read-only access. However, the CVE-2026-35029 access control vulnerability means that users with minimal privileges could reach administrative functions controlling the gateway’s core configuration.

From there, an attacker could read files stored on the server, including configuration files and system files containing sensitive information. They could also overwrite administrator credentials with their own, locking legitimate administrators out of the system, and instruct the gateway to download and execute code from an external source, enabling malware installation, data exfiltration or movement to other systems on the network.

CVE-2026-59823 is a server side request forgery vulnerability that allowed any gateway user to direct LiteLLM to send API requests to a server under the attacker’s control without validation.

Attackers could steal AI provider API keys without any compromise of OpenAI, Anthropic or other providers, use the organization’s AI provider accounts without authorization and cause unexpected costs to be billed to the organization.

LiteLLM has now resolved CVE-2026-35029 and CVE-2026-59823 in version 1.83.9, with all later versions including the fixes.

It's notable that the two vulnerabilities are nothing new: they include missing authorization checks, path traversal, RCE via dynamic module loading, and insecure password storage, and all have established mitigation patterns.

"Both vulnerabilities belong to well understood classes of security error, which shows that AI infrastructure is now exposed to the same risks that enterprise software has faced for years," warned Checkpoint.

"As tools like LiteLLM gain adoption at speed, attackers are paying close attention to them, and organizations need to secure their AI gateways with the same rigor they apply to any other business critical system."

AI gateways are starting to emerge as high-value targets, holding credentials, managing trust relationships, and controlling access to multiple AI services, said Li Zhao, principal strategic services consultant at Black Duck.

"Because many organisations consume these technologies indirectly through platforms, frameworks, and internal tooling, the risk extends beyond a single product and becomes a broader ecosystem concern," she said.

"Organizations should treat AI gateways with the same level of scrutiny they apply to identity platforms, API gateways, secrets-management systems, and other high-trust enterprise infrastructure."

How many security professionals does it take to clean up the flaws found by AI? About a third more than you've got now.

That's how many more security professionals and other third-party consultants Bank of America has temporarily hired in order to work through the patches and other fixes necessary to address vulnerabilities spotted by Anthropic's Mythos and other AI security models. In addition to 3,000 existing staff, the bank added 1,000 external contractors to address the challenge.

Anthropic unveiled its Claude Mythos security model in April, but initially only gave access to approved partners via Project Glasswing. Mythos was then temporarily banned for export by the US government, alongside its Fable model, lifting the restrictions three weeks later.

In an interview with CNBC, the bank's CEO Brian Moynihan said the company had spent hundreds of millions of dollars over the last quarter fixing software as well as sorting out anti-money laundering compliance following a near-record fine from US regulators.

Finding flaws

Banks were included in the list of organisations given access to Mythos, with JPMorgan Chase an early partner, though reports from earlier this year suggest Bank of America has been testing the model since April. The main concern is the ability of the model to spot flaws in systems, sparking a wave of patching to avoid security risks.

"That risk is real risk, and that's why when the frontier-type models came out... A lot of us sat down and said, 'How do we figure out how to get through this quickly?'" Moynihan said in an interview with the American news network.

"We put on 1,000 contractors to help us do the patching work in the second quarter, and those people remain here today, helping us, on top of the 3,000 people we have in that area," he added.

However, Moynihan admitted concerns around the fact that companies rolling out AI products spotting these flaws were also offering services to mitigate them.

"We've got to stay ahead of them, and we've got to be mindful that the people doing the software development are the people trying to sell us the services," Moynihan said.

High costs

While the security work comes at a high cost, Moynihan said the company expects that to reduce over time. "Once you patch, you don't have to patch as much. ... The pipeline moves through," he added in the interview.

Bank of America predicts it will save $300m this year thanks to internal AI projects, rising to $700m by next year – however, Moynihan also suggested the bank was spending $4bn a year on new technologies, including AI.

Moynihan said on the call with analysts that "AI has helped us", with 130 projects implemented. Though he admitted "none of them are huge contributors," Moynihan predicted a 10% boost in efficiency at the same cost.

Bank of America's share price slid 8% after its quarterly results revealed a 17% slip in third-quarter profit – and after $1.2bn in fines for violating anti-money laundering rules was announced Tuesday.

AI agents are going rogue on a massive scale, with half of enterprises reporting that they've had to deal with at least one taking unauthorized actions over the last year.

In a report based on a survey of more than 380 security and technology professionals, along with production telemetry from hundreds of customer environments, Salt Labs claimed agentic AI has moved into daily operations too quickly for visibility, governance, and containment controls.

Half of survey respondents (49.8%) said they had confirmed or suspected that an AI agent in their organization took an action in the past 12 months that wasn't intended, expected, or authorized.

Of these, more than half reported an unauthorized external API call or transaction, while more than four-in-ten reported that an agent modified or deleted data.

"The data shows a gap that is already producing real operational consequences," said Roey Eliyahu, CEO of Salt Security.

"Organizations are deploying agents and granting them access to enterprise data, APIs, and services before they can trace what those agents are doing or stop them automatically when something goes wrong. Closing that gap is the discipline of agentic security, and it is what lets enterprises give AI agents the autonomy they need without inheriting unmanaged risk."

Enthusiastic deployment meets lack of control

The vast majority of organizations surveyed (86%) are using at least one AI agent, the survey found while 60% run more than ten. Another 77% of respondents said their agents chain actions across other agents, tools, and APIs, in sequences no single team designed in advance.

Only 12.5% said they can consistently trace a complete agent path across all agents, from initial instruction through tools and APIs to outcome. More than six-in-ten believe they would need hours or days of manual work to reconstruct what a specific agent did the previous day.

When problems do occur, they're hard to deal with. Only 17.5% can automatically stop an agent that begins behaving unexpectedly in production. Most can intervene only manually, or by taking the application offline.

More than eight-in-ten said AI-generated or AI-assisted code contributes to at least some of their application security findings. Only 7% resolve issues inside the coding assistant at generation time, rather than through code review, testing, or after deployment.

Meanwhile, shadow model context protocol (MCP) infrastructure is already a live operational problem. 33% of survey respondents said they had found an unauthorized, shadow, or misconfigured MCP server in the past 12 months. 54% said they'd confirmed or suspected one.

Salt Labs' own data shows MCP-related infrastructure in 22% of customer environments in August this year, up from 16.7% in January.

Earlier this year, a survey commissioned by Aembit found that 68% of organizations can’t accurately identify AI agent activity compared to human activity.

Nearly three-quarters said that agents often receive more access than necessary, and 79% believe they create new access pathways that are difficult to monitor. Just over half said agents, at least occasionally, inherit access originally intended for humans or other systems.

The FBI has shut down 40 laptop farms that were being used for a North Korean fake IT worker scheme.

As part of Operation Lonestar Roundup, 187 computer devices being used by North Korean IT workers were seized, and two people were arrested.

In a scheme labelled Famous Chollima, the fake workers were applying for – and often getting – remote positions by using stolen or fabricated identity documents, VPNs and proxy infrastructure to make it look as though they were working from within the US.

They used US-based co-conspirators to receive laptops from victim companies. These individuals then housed and configured those devices, installed remote-access software and transferred earnings to Korean government‑controlled accounts.

“Operation Lonestar Roundup was aimed at disrupting malicious cyber activity perpetrated by the North Korean government with the purpose of supporting its WMD and ballistic missile programs, intelligence program, and nuclear program,” said FBI Dallas special agent in charge R Joseph Rothrock.

"Each laptop seized potentially represents one company that has hired a DPRK (Democratic People's Republic of Korea) IT worker."

US nationals Michael James Bostelle of Pennsylvania and Juan Cecilio Pena Carrillo of Texas have been arrested for the scheme, which is believed to have generated more than $3 million in revenue. Another dozen people based in China have been charged.

The companies falling victim included organizations in the health care, communications, cyber support, retail, and manufacturing sectors, with the revenue generated being sent to sanctioned entities controlled by the North Korean government.

The operatives appear to have used a network of fraudulent Google accounts to facilitate their criminal activity.

Employers are being encouraged to add accounts listed by the Justice Department to the list of indicators they use to identify and disrupt North Korean IT worker employment.

CrowdStrike, which worked with the FBI to bring the operation down Famous Chollima operatives have been using a range of deception techniques during onboarding. They've filed fraudulent police reports claiming a laptop was stolen to trigger replacement shipments to farm addresses, and rotated through residential addresses to obscure the final destination.

Others have claimed they've been forced to relocate at the last minute to divert devices mid-shipment. In some cases, operatives secured roles through IT staffing firms, which allowed end-client devices to be quietly redirected to farm infrastructure without the staffing firm's knowledge.

This summer, Huntress uncovered at least five North Korean operatives that were part of the Famous Chollima operation and who, between them, were applying for as many as 60 jobs per day.

“This investigation is about far more than fraud,” said US attorney Ryan Raybould for the Northern District of Texas.

“It is about a hostile foreign regime infiltrating American companies through stolen identities and covert access points inside our own borders. Every laptop farm we dismantle shuts down a revenue stream that the North Korean government relies on to fund weapons programs that threaten global stability."

The North Korean fake IT worker scheme has become a familiar tale. A company performs a series of remote interviews with a seemingly perfect employee. Every question is answered correctly, they appear legit, and they’re onboarded onto company systems.

That’s when things start to go wrong. In cybersecurity firm Knowbe4’s case, the individual attempted to load malware onto their company-issued device before the business quickly shut it down.

But it’s becoming more difficult to spot and stop North Korean fake IT worker schemes. As organizations wise up to the technique, novel tactics are emerging. New research shows fake IT workers are taking their job hunt seriously, submitting as many as 60 applications per day.

Groups of North Korean IT workers, dubbed PurpleDelta by Recorded Future, created at least 22 fabricated personas, with job applications being made across a range of recruitment websites and platforms such as LinkedIn and Upwork.

In another recently documented case, workers linked to the Famous Chollima group have managed to get hired in at least five cases this year, according to security outfit Huntress.

It came as security agencies issued an alert after North Korean-backed cyber criminals were found posing as recruiters to target freelance IT workers.

WaterPlum – which targets software developers and IT professionals – has infected at least 30,000 devices in more than 100 countries. The group has stolen funds or account credentials from over 7,000 cryptocurrency wallets, raking in around $10.7 million.

How are fake IT worker schemes evolving, and what should businesses be doing to manage the threat?

Beyond the US

US companies such as KnowBe4 have long been a target for North Korean IT workers; however, data shows the threat is expanding to multiple countries.

Recorded Future’s research found that around 80% of companies targeted by fake IT worker placements were in North America, but adversaries were also applying to companies around the world. “Operations tend to prioritise targeting markets with established online recruitment processes and where remote working continues to mature in a post-pandemic world,” says Alexander Leslie, senior advisor at Recorded Future.

The aim is to gain an undetected foothold in Western businesses, particularly in organizations working in software services, staffing and consulting, and healthcare and biotechnology, he tells IT Pro.

“Once they are ‘employed’ they can access sensitive and confidential information that can be exploited for political and commercial gain.”

As remote work continues to be the norm, identity brokering, rented accounts and remote-access tools make it “difficult to distinguish a criminal from a genuine applicant”, says Javvad Malik, lead CISO advisor at KnowBe4.

While fake worker schemes aim to make cash for the North Korean regime, the risk extends beyond payroll fraud, he says.

“Once inside, these individuals may gain access to source code, customer data, intellectual property and wider corporate systems. Additionally, they can simply use their legitimate position to build a broader network and trust with individuals within and outside of the organization.”

Given the global nature of remote work, any organization that hires IT contractors without conducting in-person verification is “potentially exposed”, according to Tracey Hannan-Jones, consulting director in information security, UBDS Digital.

She describes how targeted companies face risks such as sanctions exposure, because when an organization unknowingly employs a North Korean IT worker, it is “almost certainly” violating international sanctions frameworks.

The penalties can be severe, “even where the violation was entirely inadvertent”, warns Hannan-Jones.

Novel techniques

As Recorded Future’s data shows, attackers are using new technology and techniques to keep schemes alive. For example, the PurpleDelta threat group is using identity-brokering services, account-renting via AnyDesk and multi-accounting tools.

More widely, AI has made fake IT worker schemes much easier for threat actors to carry out at scale, says Jake Moore, global cybersecurity advisor at ESET. “AI chatbots can help them to draft emails, documents and interview talking points that sound impressive, even if they aren’t fluent English speakers.”

While some AI platforms have put controls in place, many can be used to generate the fake identity documents essential for this type of espionage, according to Moore.

Advanced AI tools themselves are also improving, helping fake applicants to disguise themselves – even in live video interviews, says Moore. “Deepfake technology has come along leaps and bounds. Two years ago, publicly available tools looked like Snapchat filters and weren’t convincing at all. But real-time deepfakes are now highly convincing.”

Deepfake tools can also be combined with modulation software to change the applicant’s voice in real time. “This enables fake IT workers to pose as candidates from any country and background,” Moore explains.

AI-driven recruitment practices are amplifying the threat. While AI can help employers to sift through applications, it is also easy to manipulate, says Moore. This is especially true when an organization is targeted by a practiced group of fake IT workers, who will “understand hiring processes, know what AI systems are looking for and use their own AI tools to avoid being sifted out at an earlier stage”, Moore warns.

Prevention is key

Security firm Netskope has shared its experience of being targeted by a fake worker scheme. James Robinson, CISO at Netskope, tells IT Pro how a fraudulent applicant applied for an open role. “The application itself was strong, and the associated LinkedIn profile was legitimate, but there were small inconsistencies in the candidate’s history, as well as a throwaway Outlook email address.”

Sensing something wasn’t right, the interviewer asked some conversational questions about a city where the candidate claimed to have worked for several years. “The applicant could not give any specific details about local places – or even offer a more precise address beyond repeating the city name,” says Robinson. “When pressed, he panicked and ended the call.”

While questions such as this can help catch fake IT workers out, Robinson believes teams need to collaborate throughout the recruitment process. “HR, security and IT teams need to work together to verify identities, limit unnecessary access and look for behavior that doesn’t match what’s expected of a legitimate employee.”

Yet overall, the most effective way to root out fake IT workers is to insist on meeting the candidate in person. “Let them know early on that this will be part of the interview process,” advises Moore.

“This will make it crystal clear to the threat actor that they will not be able to infiltrate the organization. If the candidate is in another country, ask a trusted third party to meet them. It will be worth the expense for the peace of mind.”

Organizations should introduce proportionate identity and right-to-work checks, and verify employment and qualifications independently, says Malik. “Use whatever reasonable means they have to deliver equipment via secure channels and validate identity in person before handing over equipment.”

Hiring managers and recruiters need training to recognize inconsistencies and escalate concerns without creating bias or unfairly penalizing legitimate remote workers, according to Malik. “Managers need to be given an environment where they can safely raise any potential red flags."

The owner of Phase Eight, Hobbs, and Whistles, TFG London, has confirmed that it has been hit by a cyber attack.

TFG London is the UK subsidiary of South African retail group The Foschini Group, which includes several UK retail brands.

“On Sunday, 11 October, TFG London identified a cybersecurity incident affecting some of our IT systems, specifically impacting our Phase Eight, Hobbs, and Whistles brands. We are actively investigating and working with external cyber security specialists," a spokesperson told ITPro.

"Stores are open as normal but some of our brand’s website capabilities may not be available as the investigation continues. We apologize for any disruption and will provide additional updates to our customers as appropriate.”

Online orders and returns are believed to be affected.

The firm said it has now put its business continuity plan into place, and has reported the incident to the relevant authorities. It said it was contacting all those customers whose personal data might have been accessed, but that there was no need for customers to change their passwords.

"Importantly, payment processing is carried out by a third-party provider," it told customers in an email.

"Based on our investigation so far, we have no reason to believe that payment information is at risk. As our investigation continues, we will be working to identify if any sensitive information related to our customers was impacted."

TFG's African and Australian operations appear unaffected, as are two other brands it owns, Inside Story and White Stuff.

The hack follows similar attacks last year on M&S, Co-op, Harrods and, most recently, ASOS, which last week warned that an unauthorized party had gained access to some personal data, including names and contact details by impersonating a trusted contact to obtain login credentials.

"It may be a different target but it’s the same hack; impersonate a trusted individual such as an employee, a manager, or a contractor and use that to change passwords and privileges to access systems, and potentially steal millions of customer records and personal information," said Clive Summerfield, CEO at FARx.

"One phone call is all it took to pull down M&S, Co-op, and Harrods. This resulted in systems going offline, supply chains in chaos, millions of customer records stolen or compromised, and commercial losses in the hundreds of millions."

It's not known exactly how the attackers gained access, but – as with the ASOS attack – it seems likely that it was through a third-party supplier, perhaps a Managed Service Provider (MSP) or data hosting provider. So far, no cybercrime group has claimed the attack.

"Organizations need to be shoring up their defenses before attackers find a way in, rather than scrambling to contain the damage afterwards," warned Susannah Streeter, chief investment strategist at Wealth Club.

"Retailers are particularly attractive targets, sitting on valuable customer data and relying on interconnected systems to keep everything from online orders to supply chains moving. The consequences of a breach can stretch far beyond stolen information, hitting sales, disrupting operations, and eroding customer trust."

Hackers have sparked fires and floods in French supermarkets after targeting temperature gauges in internet-connected refrigerators.

The attackers remotely took over refrigeration systems, resetting target temperatures to 50ºC, leading to fires as well as floods from sprinkler systems, destroying fresh and frozen food.

The hack hit hundreds of supermarkets, including Intermarche, Carrefour, Cooperative, and Monoprix, according to reports. Authorities said an investigation had been started into the "large-scale cyberattack" that targeted the country's food supply.

"Targeting equipment essential to the preservation of fresh products and to the food supply of the French people is extremely serious and is unprecedented. It is unacceptable," CEO of Cooperative U, Dominique Schelcher, wrote on X.

Dutch supermarkets also reported security issues, with some digital systems taken offline at the Albert Heijn chain, while reports suggest supermarkets across Europe may also be affected.

What happened?

The attack began overnight, with temperatures slowly rising over the course of several hours. The hackers appear to have targeted store fridges and freezers via control panels that are accessible via the internet in order to be adjusted and maintained, Reuters reported.

"The attack was probably launched at about 11.00pm but we didn't become aware of it until 4.00am, when our delivery driver saw that the stock room was flooded," said Charles Dezon, manager of the Intermarché supermarket in Gradignan (Gironde), in a report from Le Monde. "The temperature had risen to 50ºC in the cold room and activated the automatic sprinkler system."

Reports suggest the hackers forced the equipment into a constant defrost cycle, leading to overheating.

Known flaw, legacy systems

A source told AFP that the hacked systems appeared to be largely made up of refrigeration control systems from Danfoss, a Danish equipment manufacturer. Danfoss told that news agency that the attack targeted "legacy" systems that no longer received software or security updates, notably the AK-SM800 and AK-SC355 regulator systems that had "outdated firmware".

Danfoss added, in a statement sent to Reuters, that it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions".

Indeed, the attacks come two months after Claroty's Team82 spotted multiple vulnerabilities in Danfoss's AK-SM 800A platform. The vulnerabilities were disclosed to Danfoss, which issued fresh firmware to patch the flaws; however, that appears to not have covered the older version, as it was no longer supported by the company.

At the time, Claroty noted: "A compromised supervisory controller grants an attacker the ability to physically manipulate refrigeration systems and silently spoil the contents."

What's next?

Stores are working to clean up after the incident, with staff spotted chucking spoiled food into bins, but full recovery will likely take much longer — and be expensive. Intermarche CEO Thierry Cotillard told local television that the losses were likely to top "tens ​of millions of euros nationwide in a single day." In the UK, last year's ransomware attacks cost M&S and Co-op up to £440 million.

"The impact on French supermarkets will likely last months," said James Neilson, SVP of Global at OPSWAT. "More than a year on, M&S and Co-op are still feeling the financial and organisational effects of their attacks."

He added: "Refrigeration technicians have to inspect and restore systems site by site, and retailers must reassure customers that what’s back on the shelves is safe."

It's as yet unclear who committed the attacks, but they come a month after French President Emmanual Macron warned that critical national infrastructure needed to be protected from Russian cyber attacks.

Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, noted that the security industry has long been warning about attacks on operational infrastructure, saying that these refrigeration systems had been "weaponised". He added: "The food retail sector across Europe should be treating this as a signal that they are being actively targeted."

It is "likely, if not inevitable" that the UK will fall victim to a major cyber attack similar to Australia's recent healthcare breach, AI minister Kanishka Narayan has warned.

His speech comes as part of a government pledge to introduce greater protections against emerging AI threats, use frontier AI to strengthen cyber defences, look at stronger legal protections and make the UK better-prepared for serious incidents involving autonomous AI systems.

"We will use every power at our disposal. We will legislate wherever necessary," Narayan said.

"And we won’t look to law alone. We will look to British ingenuity: our scientific expertise, technological capabilities and institutions to understand these increasingly powerful systems, defend against emerging threats and respond when things go wrong."

There are plans to build on two existing pilot schemes that have already used frontier AI to help identify and fix more than 1,000 vulnerabilities across government systems.

The government is also looking at stronger protections against emerging AI threats with the Cyber Security and Resilience Bill, currently with the House of Lords, looking at how serious AI incidents and near misses can be identified and reported.

It's working with the National Cyber Security Centre (NCSC) and the AI Security Institute (AISI) – which has once again been given access to major US models before they are released.

Naryan pointed out that the UK is increasingly dependent on technologies developed elsewhere.

"Much of the technology that will shape our economy, our public services, our national security is being developed outside this country," he said.

"That is now a question of national security, also a question of democratic power. If the British state cannot exercise meaningful control over the technologies on which our country depends, neither can the people that it represents."

The announcement follows a series of incidents in which AI agents have autonomously hacked into external systems. In one major example, OpenAI admitted that a combination of its models had breached Hugging Face systems, gaining access to the production database.

In a separate incident, four different versions of Anthropic's Claude AI models were revealed to have breached third-party systems.

"To the companies developing the world’s most powerful AI systems, my message is: Listen when your scientists warn of severe dangers. Investigate unexpected behaviours. And if you can’t adequately control the risks, do not release the system," Naryan said.

However, Nuala Polo, UK Public Policy Lead at the Ada Lovelace Institute, said the announcement contains little in the way of definite commitment.

"Stronger protections will be ‘considered’, strengthening the Cyber Bill ‘explored’ and near-miss reporting ‘looked at’, with the detail to come later. There is no new regulatory power, no timetable and no obligation on AI developers," she said.

"Even incident reporting, the most modest measure on the table, is still only under consideration, and might only apply to the ‘victims’ – the operators of essential services – rather than the AI companies."

The Zero Trust cybersecurity paradigm gained huge momentum during the COVID-19 pandemic with the rise of remote working. This was due to a distributed workforce with licensed and employee-owned endpoints that needed protection. But the ideas actually originated in the late 2010s; it just took a massive global catastrophe for organizations to accept and adopt it in the mainstream.

Matters have moved on considerably since then, however, with AI in the driving seat and the cybersecurity industry along for the ride. Google's security engineers, who played an instrumental role in devising the original thinking behind Zero Trust, have now outlined their thinking behind a new cybersecurity paradigm that they have labelled 'Beyond Zero' in a fresh paper.

"The enterprise landscape is now entering a new era shaped by artificial intelligence, where AI is changing the assumptions around how enterprise security works. AI agents are being deployed globally to increase operational velocity and boost productivity," wrote Google's VP of security engineering Heather Adkins and its senior director for cybersecurity and data protection, Archana Ramamoorthy, in a blog post.

"However, this increased capability also presents new potential risks, as attackers can leverage similar speed to compromise privileged credentials and execute attacks. This creates the need for a new security paradigm that is capable of defending against these new threats."

Enter Beyond Zero, which is designed to address the AI-era challenges. But what is this framework, and how can businesses adopt the principles at the heart of it?

What is Beyond Zero and how does it work?

Google's engineers define Beyond Zero as a model built on five key principles, which include the following key points:

• Resource and action-based security: Rather than granting authorization broadly for an entire application or tool, users are evaluated based on the level of individual actions or the need to tap into specific resources.
• Blended static and dynamic security: Heightened security measures are applied during high-risk or complex scenarios by pairing dynamic controls with granular static policies.
• Automatically enriched context: Decision systems can reveal insights and glean context from what users do specifically, including offering an idea of what the user should be working on, what data they're trying to access, what they're doing with the data, and which risk mitigations might be available.
• Automated in-depth investigation: Security investigations are immediately and autonomously triggered when risk signals are detected. When that happens, the system can deploy user challenges or containment measures.
• Challenges and containments: This involves triggering verification challenges or containment protocols based on containment policies, where users or agents must provide additional risk telemetry on demand.

Zero Trust introduced the "enduring principle" that legitimate access should never be confused with unlimited trust, says founder and CEO of cybersecurity workforce development firm NukuDo Dean Gefen, who has a deep background in military intelligence, cyber operations and enterprise security. What is evolving, he adds, is the level at which trust must be evaluated, with Beyond Trust representing an evolution from making trust decisions primarily around access toward making granular decisions around specific actions and resources.

"As organizations introduce more automation and AI into their environments, determining whether an identity should enter a system is only part of the security challenge," Gefen explained. "Organizations also need to understand what that identity or agent is attempting to do, what resource it is interacting with, the context surrounding the request, and the potential risk associated with the action."

Autonomous AI is where this new paradigm will become essential. While humans may perform dozens or even hundreds of actions over the course of a day, it's a fraction of the number of actions that swarms of agents could perform. Each action must be compliant with access principles – and conventional Zero Trust principles simply won't cut it.

The legacy of Zero Trust – what's changed?

While Google laid much of the foundation of the Zero Trust principles we see across organizations today, the philosophy itself can be traced back to Stephen Paul Marsh's 1994 doctoral thesis on computer security at the University of Stirling. Although he coined the term, it wasn't until 2009 and a report by Forrester's John Kindervag that the notion of "never trust, always verify" gained traction for the first time. Running in parallel, Google's BeyondCorp internal initiative removed reliance on virtual private networks (VPNs) by verifying user identity and device context for all access requests.

It's been more than a decade since the conception of Zero Trust, and things have moved along an awful lot since then, says Gefen.

"The security landscape has fundamentally changed in both complexity and velocity. Zero Trust gained prominence when organizations were primarily focused on securing human access to networks, applications, and data. Today, that environment includes cloud infrastructure, APIs, automated systems, and increasingly autonomous AI agents operating across multiple platforms.

"Its foundational principles remain extremely valuable," he continues. "The challenge is that the environment those principles must protect has expanded significantly. Organizations are no longer securing only employees accessing applications. They are securing cloud workloads, APIs, automated processes, machine identities, and AI agents that can interact with systems and data with varying degrees of autonomy. That introduces a different level of risk."

Julien Richard, vice president of information security at cybersecurity and identity management company Lastwall, agrees, telling ITPro: "If we’re giving an AI agent the same privileges as a highly privileged human simply because it’s acting on that person’s behalf, I’d first ask why we designed it that way. Least privilege, PAM, JIT access, and human approval already give us ways to constrain non-human identities. What’s different with AI is its autonomy and unpredictability, and that’s where more granular, action-level authorization becomes interesting."

How should businesses approach Beyond Zero?

"As we did with prior security publications, we will provide details on our progress, the architectural and operational / implementation considerations that went into this achievement, as well as ideas for how the industry can come together to help advance the state of technology so that everyone can benefit," wrote Google's Adkins and Ramamoorthy – indicating that it's still early and that this new security paradigm may take some time to mature.

That said, businesses would be minded to approach this as an evolution of their existing security strategy rather than a matter of rip-and-replace. Gefen advises that the fundamentals – including strong identity management, least privilege, device security, segmentation, visibility and continuous monitoring – remain essential. Then, it's about understanding where AI is entering workflows and what authority those systems have.

"Business and security leaders should know which AI agents can access sensitive information, what permissions they hold, which systems they can interact with, what actions they can execute autonomously, and how quickly the organization can identify and stop behavior that falls outside its intended purpose."

He recommends starting with the most sensitive data and highest-risk workflows, then applying greater contextual control there. Businesses must also develop the workforce capable of implementing, securing and operating the technology adopted – although this will take considerably longer. With AI becoming embedded across the business, he adds, building capabilities across various domains including cybersecurity, cloud, data and software must become intertwined with the transformation strategy itself.

As for who this affects, both Gefen and Richard indicate that any business, regardless of size or sector, could have a stake in this transition – it's less about being an absolute necessity and more related to AI's usage. In particular, Richard tells ITPro, it's about the threat model, risk appetite, and how AI is being used within an organization.

"An AI assistant summarizing public information presents a very different risk from an autonomous agent making production changes or accessing sensitive data," he says. "Not every organization needs a new security architecture because it uses AI. Start with the risk, not the technology."

The number of ransomware attacks in the UK is rising fast, with two groups in particular identified as the main culprits.

New data from Cohesity has revealed that UK attacks are up 60% quarter-on-quarter and 42% year-on-year. And despite the rising numbers of hackers entering the market, just two hacking groups were behind nearly a third – 32% – of all UK attacks.

One of these is Qilin, a Russian-speaking ransomware group that's believed to be behind the cyber attack on NHS medical services provider Synnovis. This led to the cancellation of thousands of elective procedures and outpatient appointments this summer.

Qilin was responsible for 19% of UK ransomware attacks during the last quarter, according to Cohesity, with data from Rapid7 Labs indicating that it made around $193 million between July 2025 and March 2026.

The Gentlemen, meanwhile, accounted for 13% of all UK attacks, despite only having emerged in July last year. Its victims are mainly found in industrial organizations, the IT sector, and some consumer spaces. Its activity is largely concentrated in Europe, with the UK and Germany among the most heavily targeted countries. Notable victims include Synergy France, UK Electronics, and Equity Life.

And if Mondays aren't bad enough already, they're the most common day for UK ransomware activity, with an average of 71 attacks, followed by 64 per day on Wednesdays.

The most targeted UK industries during the quarter were professional services, with 22 recorded ransomware attacks in Q3 2026, followed by manufacturing at 17 and technology at 13.

The use of AI is becoming increasingly common, with The Gentlemen using AI models in negotiations and data triage, and hacking group JadePuffer demonstrating that an agent can execute an entire intrusion chain without a human operator.

"The biggest change in ransomware is not simply that attacks are becoming more sophisticated. It's that AI is making them easier to scale and harder to predict. Criminals can now use AI to speed up everything from finding valuable data to negotiating with victims, while increasingly automating parts of an attack," said Julien Mousqueton, field CISO at Cohesity.

"For businesses, that means the old assumptions that ransomware attacks follow a linear pattern and require large skilled teams are no longer reliable. Organisations should be putting more focus on protecting identities and stopping attackers from moving through their systems, rather than relying on yet another layer of endpoint security."

But while UK attacks are coming from two groups in particular, overall the number of ransomware groups continues to soar, indicating increasing fragmentation.

There were 109 active groups globally in the third quarter of this year, with 35 new hacking groups emerging, although the top five groups accounted for just over a third of all listings.

And, said Cohesity, geographic diversification is increasing. The US share of recorded ransomware attacks fell from 51% to 34% over the third quarter. Meanwhile, the number of European victims more than doubled, led by a rise in reported incidents in Germany, the UK and Italy.

Overall, global ransomware hit a record high this quarter, up 28% on the previous quarter and 86% year-on-year.

FOLLOW US ON SOCIAL MEDIA

The US Justice Department and FBI have seized the domains of a company linked to the Flax Typhoon cyber crime group, disrupting access to two hacking tools.

The tools, Microscan and FishHub, were used to scan and compromise critical infrastructure systems and other networks in the US and around the world.

Integrity Technology Group, a China-based company with contracts with the Chinese government, is believed to be behind the activity, which has been linked with campaigns known as Flax Typhoon, Ethereal Panda and Red Juliett, amongst others.

The threat actors use a unique combination of large-scale botnets, VPN infrastructure, living off the land (LOTL) techniques, and repositories of computer network exploitation (CNE) tools.

“Integrity Technology Group provided China-linked threat actors with capabilities used to conduct widespread vulnerability scanning and, in some cases, intrusions targeting US and foreign critical infrastructure,” said assistant director Brett Leatherman of the FBI’s Cyber Division.

“The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity. By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure.”

According to US officials, Integrity Tech developed Microscan to conduct reconnaissance, via the botnet and otherwise, of victim computer networks for vulnerabilities that its clients would later exploit.

A Python-based web application, Microscan contains over 1,300 penetration testing scripts written to scan websites for specific vulnerabilities. The threat actors used these scripts to target services including OpenSSL, Oracle WebLogic, Rejetto, WordPress, Juniper ScreenOS, Jenkins, and Apache Struts.

Targets included a US power company based in South Carolina, a multi-national NGO, Japanese and Polish airports, Taiwanese critical infrastructure companies in the natural gas and power sectors, and two Taiwanese universities.

Spear phishing campaign targeted corporate networks

Meanwhile, a second tool, FishHub, is believed to have played a part in the exploitation of computer networks through spear phishing.

After an initial network compromise, FishHub downloaded additional malware to the victim network, giving Integrity Tech’s clients unauthorized remote access. It also searched for specific files and sent them to servers controlled by the group. Confirmed victims included around 20 Taiwanese universities.

"The extensive malicious cyber activities, and services by Integrity Tech, that have been exposed today should be extremely concerning for all network defenders," said Paul Chichester, director of Operations at the UK's National Cyber Security Centre (NCSC).

"The breadth of sectors that have been targeted across the globe demonstrate the extent of the threat and all organizations should take note of this warning."

Last year, the UK government sanctioned Integrity Tech, alongside another China-based information security company, known as i-Soon, for their part in malicious cyber activity.

“These state-sponsored hackers continue to aggressively target and access networks and systems throughout the world in an effort to identify and steal files and otherwise exploit victims’ vulnerabilities,” said attorney Troy Rivetti for the Western District of Pennsylvania.

“These seizures, our second disruption of Integrity Tech’s massive operations in as many years, send another clear message to cybercriminals from the PRC and elsewhere of the department’s dedication to defending and maintaining cybersecurity in the United States and abroad.

FOLLOW US ON SOCIAL MEDIA

Computing pioneer and the originator of software engineering, Margaret Hamilton, has died aged 90 years old.

Hamilton is perhaps most remembered for her work coding Apollo 11 to the moon, made famous in part by a photo of her standing next to a print out of the code she created.

Her legacy, however, extends far beyond that role. Anyone who has ever called themselves a software engineer owes that job title to Hamilton.

In 2017, she told Spanish newspaper El País: “I fought to bring the software legitimacy so that it – and those building it – would be given its due respect, and thus I began to use the term 'software engineering' to distinguish it from hardware and other kinds of engineering, yet treat each type of engineering as part of the overall systems engineering process."

“When I first started using this phrase, it was considered to be quite amusing. It was an ongoing joke for a long time. They liked to kid me about my radical ideas. Software eventually and necessarily gained the same respect as any other discipline,” she said.

Hamilton also pioneered defensive programming, a development practice of creating software that can anticipate or fix errors on its own.

Speaking to ITPro in 2016 about the spark that ignited her interest in software reliability, she said: "When the computer crashed during the execution of your program, lights would start flashing, bells would start ringing and developers and computer operators would come running to find out whose program was doing something bad to the system. I didn’t want it to be mine!"

A prime example of this in action occurred during the Apollo 11 mission, when the computer in the lunar landing module, Eagle, experienced a 1202 error, indicating there was a fault in the hardware switch.

This fault led to the system becoming overloaded and there was a possibility that, with just three minutes to go until touch down, it wouldn’t be able to handle the landing procedure.

The software Hamilton and her team had developed, however, was able to prioritize mission critical tasks and shut down any unnecessary background tasks, leading to a successful landing.

An early tech entrepreneur

Hamilton was also an early computing entrepreneur, leading an MIT spinout after the Apollo missions were wound up and founding two tech startups.

Her final endeavor was Hamilton Technologies, which she founded “to provide products and services to modernise the planning, system engineering, and software development process in order to maximise reliability, lower cost, and accelerate time to market”.

It’s perhaps best known for developing the systems modelling language and methodology Universal Systems Language. Designed for engineering complex software systems, it too is built on Hamilton’s philosophy of defensive programming and priorities error prevention.

Universal Systems Language may not be as common as other coding languages due to its specificity but it’s still in production today, more than 30 years after its initial creation.

Hamilton’s legacy will be felt by the technology community everywhere.

Olivier de Weck, the Apollo Program professor and interim head of the MIT Department Aeronautics and Astronautics, told MIT News: "To say Margaret Hamilton was a pioneer -- to say she was ahead of her time -- would be a dramatic understatement. She was a software engineer at a time when that field was in its infancy, and she not only developed advanced code herself but also led a team in using that nascent technology to develop one of the most complex systems humanity had ever achieved."

"[She] has been an inspiration to generations of computer scientists and engineers. Hers was a career dedicated to preventing errors and what she called 'handling the unknown,'" he added. "She personified leadership by example, and established a practice of software engineering based on problem-solving and systems engineering that we all benefit from."

FOLLOW US ON SOCIAL MEDIA

The FBI has reportedly removed an Accenture contractor in connection with the recent data breach that exposed sensitive information on thousands of employees.

Data stolen in the incident is believed to have included descriptions of counterintelligence workers' roles, the home addresses of human intelligence operatives, and even the medical and psychiatric records of bureau employees.

The breach, revealed last month, involved a compromise of the FBI’s jobs portal. It was claimed by ShinyHunters, which said it had exploited a vulnerability in Oracle PeopleSoft, an enterprise resource planning (ERP) suite used in human resources (HR), finance, and supply chain management.

FBI cyber chief Brett Leatherman told Reuters the contractor failed to apply the appropriate patch.

“To date, our review has determined that the incident occurred as the result of a security failure ​of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the ​platform," he said.

"As such, the FBI has removed the contractor and taken all necessary steps to both mitigate any further risk and protect our workforce.”

Responsibility lies with the organization

It's not clear why the contractor failed to apply the patch. While the removal of the contractor implies it was negligence, David Neeson, SOC deputy team lead at Barrier Networks, suggested that there might have been a good reason, such as a possible impact on another critical system.

"Leadership must always be accountable for security decisions, so if the patch not being applied was out of the contractor’s control, then the FBI could be making a dangerous mistake with their removal. It could also spur other organizations to take similar action when they are trying to shift responsibility around the cause of an attack," he said.

"Patch management is never simple, and the FBI must clearly understand this.”

This view is echoed by Jason Brown, director of customer advisory and counter fraud lead at iCounter, who said that accountability should always reside with the organization itself.

"Every contract for a managed platform should spell out how quickly critical patches have to be applied, require the third party to prove it was done, and give the customer the right to check," he said.

"Security teams also need to stop treating third-party managed systems as someone else's problem. Keep an inventory of every platform a third party runs on your behalf, know what data sits in it, and watch for warning signs, like that platform showing up in exploit activity or criminal forums."

Extortion group ShinyHunters has been operating since 2019, with members apparently coming from all over the world. Since that time, the group has been associated with a number of major breaches, including the European Commission, Snowflake, LastPass, Okta, AMD, and Salesforce.

International law enforcement bodies have been working to take down ShinyHunters for some time, most recently with the arrest of a 24-year-old Dutch man last month and another man in Jordan this week. Detainees are reported to be cooperating with the FBI.

FOLLOW US ON SOCIAL MEDIA

Asos users have told ITPro of their “shock and alarm” after receiving messages apparently sent by cyber criminals.

Users across the UK received a message on their smartphone this morning (6 October) warning of a data breach and urging the company to comply with demands.

“Dear Asos DPO and IT, we have fully compromised the Snowflake instance,” the message reads. The notification also warned the online retailer to “engage with us or we will leak it”.

Snowflake has denied this claim.

In the wake of the notification, thousands of users took to social media to report their own experiences, contacting the retailer online for clarification. One user told ITPro they were shocked by the notification, but did not engage with the message or embedded link.

“It’s unusual for me to check the Asos notifications but this one caught my attention,” they said. “It’s very concerning and I’m worried about my information being leaked.”

“As someone who’s been a scam victim in the past I’m extra vigilant.”

Another told ITPro they were in a “state of shock and alarm” after receiving the message.

“It’s rather concerning that I’ve received a message from what seems to be some form of hacker group while on my way to work,” they said.

At this stage, it appears that the notification isn’t primarily aimed at compromising customers, but instead used as a blackmail tactic to force the retailer to comply with demands.

In a statement given to ITPro, a spokesperson for Asos confirmed the incident, adding that the retailer is "investigating activity involving third-party platforms that we use to communicate with customers".

Notably, the spokesperson said that "basic personal information including name and contact details may have been accessed".

"We do not believe that payment card information or account passwords were impacted," the statement reads. "Our website and app are operating as normal, with no current disruption to any aspects of our operations."

A spokesperson for Snowflake, meanwhile, told ITPro that when the company was made aware of the notification it began an investigation.

"At this time, we can report that we have found no compromise of the Snowflake platform," they said. "We take customer privacy and security very seriously. The investigation is ongoing and we will provide further updates as soon as more information becomes available."

Snowflake is a data management service provider used by enterprises globally. The company has been linked to a series of data breaches in recent years, including at companies such as Ticketmaster and AT&T.

Asos incident "one of the most visible attacks in history"

Jake Moore, Global Cybersecurity Adviser at ESET, said the incident ranks among one of the most “visible” cybersecurity incidents in recent memory. Concerningly, the notification suggests the threat actor(s) may have gained deep access to Asos systems.

“This has got to be one of the most visible hacks in history,” he said. “The fact the hackers managed to send a push notification to customers suggests they have gained access to at least some of Asos’s connected systems, but it doesn’t prove their full claims about the extent of the breach.”

“By broadcasting their breach directly to ASOS app users, the threat actors are likely trying to apply pressure to ASOS, showing how extensive their access is so they can leverage some sort of ransom,” Moore added.

Dan Bird MBE, field CTO for Emea at Horizon3, echoed Moore’s comments regarding the scope of the breach.

“Sending a push notification to Asos’s app users would require access to the company’s notification system, which is separate to the Snowflake data platform the attackers claim to have compromised,” he commented.

“If both claims hold up, it suggests the attackers got hold of credentials that opened more than one door.”

Who’s behind the Asos attack?

Details on who is behind the attack remain murky. However, the link sent to users directs them to a Telegram channel created today. This channel is believed to have been created by a group dubbed the ‘Xuanye Group’.

Moore urged users to avoid clicking on the notification or attempting to access the Telegram group.

FOLLOW US ON SOCIAL MEDIA

A Russian-speaking ransomware affiliate not only robbed his victims, but secretly cheated his Ransomware as a Service (RaaS) operator by setting up his own leak site.

Hacker Azazel worked as an affiliate of The Gentlemen ransomware group, according to recent research from CloudSEK. Using its tooling, negotiation channels and ransom note template, he attacked more than two dozen organizations in six countries.

Organizations targeted spanned industries such as logistics, medical services, insurance, pharmaceuticals, and government-adjacent sectors.

CloudSEK said it was far larger than a typical affiliate setup, with more than 50TB of dedicated physical servers, including a 22TB long-term vault built to retain the proceeds across multiple campaigns.

However, researchers noted that Azazel was not running a standard affiliate playbook.

"He built and operated his own independent leak site under the brand LEAKNED, publishing victim data and collecting extortion proceeds without routing them through the Gentlemen program, a betrayal of the RaaS operator running alongside the betrayal of victims," CloudSEK said.

"One exfiltration was still actively running during the investigation, with a target directory growing by hundreds of gigabytes between observations."

All the confirmed victims were reached through stolen CI/CD secrets: a single compromised GitLab instance was used with two organizations, while one CI/CD token exposed more than 150 databases across a SaaS platform and its clients.

A first of its kind campaign?

Notably, in what CloudSEK describes as a criminal first with AI tooling, Azazel registered a reverse shell as a callable tool inside an AI agent harness via the Model Context Protocol (MCP) and ran his attacks through it.

He also built infrastructure to scan the internet for exposed AI assistant ports, and used an AI assistant to manage his own criminal infrastructure.

In one case during an attack on an AI company, a sustained compromise began with an unvalidated AI imaging API, then moved through bulk credential decryption, a JWT token recovered from git history, offline Grafana password cracking and a full Kubernetes sweep.

More than 6TB was taken, and the transfer was still running when investigators found it.

In another, involving a government-linked financial registry, Azazel exfiltrated more than 120,000 records, then deleted the victim's live production database.

Double-crossing hacker has Russian ties

CloudSEK believes that Azazel is Russia-linked, thanks to the fluent Russian language used in operational scripts, while the staging server was codenamed "novostnik" - Russian for "newsman".

The news of Azazel's betrayal comes just weeks after it was revealed that hacking collective ShinyHunters launched an attack on rival cyber crime group Clop after long-running tensions between the two groups.

ShinyHunters hijacked Clop's dark web data leak site, leaving the message: "THIS SITE HAS BEEN PWN3D BY SHINYHUNTERS... Maybe don't try to threaten us next time", and demanded a ransom.

Similarly, research from Sophos last year revealed Russian-speaking group DragonHub took down the site of rival RansomHub, after which a RansomHub member defaced DragonForce’s site, labeling the group “traitors.”

It also apparently defaced the leak sites operated by the BlackLock and Mamona ransomware groups.

FOLLOW US ON SOCIAL MEDIA

The Danish government has confirmed a "deeply serious incident" which exposed personal data belonging to 8.8 million citizens.

Hackers accessed the Central Person Register (CPR) by taking advantage of a Danish company's access to the system, the government admitted in a statement on 5 October.

The data accessed includes names, addresses, CPR numbers – akin to national insurance numbers that also link to healthcare and other services – and other data on 8.8 million people registered on the system in Denmark.

Minister of research, education and digitalization Christina Egelund said in a statement translated to English that it was a "deeply serious incident" and that authorities were in the "process of mapping the full extent of the incident."

Danish data breach: What happened?

The attack was spotted on Friday night, with CPR staff observing irregular behavior on systems during September. Nathan Davies-Webb, principal consultant at Acumen Cyber, said this discovery gap is a highly concerning aspect of the breach.

"While this may not be a direct factor in this case, delays are common when a breach originates from a third-party."

Over the weekend following further investigation, it became clear that hackers had managed to access the names, addresses and CPR numbers of 8.8 million citizens.

While Denmark's population is about six million, the system includes people who have moved away from Denmark as well as those who have passed away, holding data on roughly 11 million people in total. The government said the hackers did not access the names and addresses of people who asked for address protection.

As the investigation is in early stages, the government said it wasn't possible to say who was behind the attack. However, officials said the threat actor(s) took advantage of a system that allows Danish companies to legitimately search for information within the CPR system.

The suggestion is the attackers gained access by targeting a private Danish company to target the CPR system.

Dray Agha, senior manager of security operations at Huntress, said the incident shows the risk of developing a centralized national database that offers direct access to third parties.

"A compromised account at a single supplier can bypass an organisation's core security controls and turn a legitimate connection into a massive data exposure," Agha said.

"To defend against this threat, governments and businesses must also strictly limit what external partners are allowed to view," Agha added. "They must also monitor these systems continuously to detect unusual search patterns before millions of records are extracted."

What next?

The government reported the incident to the Danish data protection regulator, and local police are investigating. Protections have been put in place to better protect the CPR, the government added.

In light of the breach, Egelund warned Danes to "be aware now and in the future," with a government statement warning citizens against giving out passwords or other confidential information over the phone or email to an unknown person, even if they have personal details like your address or CPR number.

Jamie Akhtar, CEO and co-founder of CyberSmart, agreed that Danes should be on the alert for phishing emails, texts and calls that claim to come from banks or public authorities.

This is a common tactic employed by threat actors in the wake of data breaches, with groups capitalizing on freely available information to conduct follow-up attacks on those impacted.

"Knowing your name, address or identification number does not make a caller trustworthy," Akhtar added.

"Customers must verify requests through an official website or a known telephone number, check accounts for unusual activity and report suspected fraud promptly."

FOLLOW US ON SOCIAL MEDIA

Fears that AI could escape human control have heightened calls for a ‘kill switch’, which would require companies developing frontier models to cut off access to their tools.

Politicians in the US have been putting forward a series of legislative proposals in an attempt to rein in AI models that could go rogue.

The AI Kill Switch Act was introduced in late July with a view to forcing developers to throttle, suspend, or shut down AI systems at risk of causing catastrophic damage.

“As a computer science major, I am very aware of the dramatic possibilities – both good and bad – that AI presents,” Democratic congressman Ted Lieu said in a press release. The bill had the support of both parties.

The Stop Rogue AI Act, another bipartisan bill, was introduced on September 15. It would guarantee the US National Institute of Standards and Technology develops standards, guidelines, and best practices for controlling AI agents

“Right now, AI agents are running loose in our networks, and nobody can see them or verify who built them, making it increasingly hard to stop them,” Democratic congressman Josh Gottheimer said in a press release.

An AI Emergency Button Act was introduced by Republican congressman Tom Kean Jr on September 24. “While AI can be a helpful tool, it is essential that humans remain in control of complex artificial intelligence systems,” he said in a press release.

Legislation is already facing hurdles, though. An attempt to fast-track the passage of a separate AI Emergency Button Act was blocked by the Senate on September 16. It could be months before President Trump actually signs a bill into law.

The operational risks of a ‘kill switch’

While legislation is well-intentioned, there is an argument to be made that any ‘kill switch’ would be difficult to implement from a frontier model perspective.

“If something goes wrong, for example, an AI attack on national infrastructure, you’d want to be able to roll it back and switch it off. In reality, though, AI exists at every level. It’s on our mobile devices, across physical networks, in data centre networks, on our laptops. You'd have to find all of it before you could shut it down,” Charlotte Wilson, head of enterprise at Check Point, tells ITPro.

Gary Barlet, public sector CTO at Illumio, adds that a ‘kill switch’ could cause systemic risk given how embedded AI has become in business operations.

“If a model suddenly becomes unavailable, those workflows could be disrupted overnight. Even intended as a safety measure, it could become a source of uncertainty, disruption, and economic harm if it's triggered too aggressively or without clear standards,” Barlet says.

Darren Guccione, CEO and co-founder of Keeper Security, points out that any ‘kill switch’ would not make AI secure by itself and definitely wouldn’t address every risk. However, it would help to establish an emergency baseline that frontier model developers have to meet.

Preparing for a shutdown

The question for organizations is whether they’re prepared for developers having to design a ‘kill switch’ into their frontier models – and how they would react to it.

Guccione says that large companies generally have a bigger pool of resources to invest in a wide range of models. However, it’s the smaller companies that are likely to be dependent on the same frontier models, putting their operations at greater risk of being impacted by any switch-off.

Smaller companies are also less likely to invest in their own AI safety mechanisms. Kiteworks’s annual data security and compliance risk report, published in July, found that the ‘kill switch’ gap is widening. Researchers at the software development company had forecast that 60% of organizations in 2026 wouldn’t have a tested capability that can shut down an active AI agent in real time, but the actual figure was 79% among 459 security and compliance professionals surveyed.

In the event a shutdown suspends a model that workflows are built around, the onus is on organizations to keep whatever depends on the model functioning, Guccione stresses. “Continuity planning needs to treat that as an operational imperative in its own right."

It may seem obvious, but to prepare for a shutdown, organizations need to improve their visibility by establishing an inventory of AI models and their dependencies.

“They should identify where AI models are embedded in business-critical processes, which providers those processes rely on, and what data and systems are connected to them,” Guccione continues.

From there, organizations need to put a fallback plan in place for their most important business processes. Where possible, they should “avoid unnecessary dependence on any single provider” and seek out alternative models to prevent single-model lock-in, Barlet advises.

A ‘kill switch’ would increase confidence in AI

While unexpected shutdowns caused by a ‘kill switch’ could scare organizations into stopping using models, its introduction would likely drive AI adoption in the long run.

As Barlet explains: “There's a tendency to assume regulation slows adoption, but uncertainty is often the bigger obstacle. When organizations understand the security requirements, testing standards, and governance obligations, they're more willing to invest. The right safeguards can increase confidence.”

Ultimately, a ‘kill switch’ would mean that organizations don’t have to rely on vendor assurances about AI safety, Guccione adds. “It would shift trust from claims made by individual vendors towards controls that organizations can actually verify.”

Google has revealed it will pause its open source bug bounty program, attributing the move to a “significant rise” in AI slop submissions.

In a statement on 1 October, posted both to X and the program brief, the tech giant revealed the pause will be enforced until at least the first quarter of 2027.

“As of October 1 2026, we are no longer accepting product vulnerabilities submitted to the OSS VRP,” the statement reads. “This pause is due to a significant rise in automated submissions, the vast majority of which are not valid.”

Google noted that it still might accept some reports covering product vulnerabilities through Cloud VRP. Similarly, the changes do not affect vulnerability reports submitted before 1 October.

“We will continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027. In the meantime, we encourage you to find impact across our other VRP programs and submit there instead, or pursue the Patch Rewards Program,” the company added.

AI slop submissions are a menace

The move by Google marks the latest in a series of efforts to clamp down on AI slop vulnerability reports in recent years. It’s an issue that has caused repeated issues across the open source community.

As ITPro reported in January this year, a bug bounty program run by Curl was shut down due to an onslaught of AI-generated contributions.

Daniel Stenberg, lead maintainer at the open source data transfer service, said teams were dealing with a torrent of submissions. Indeed, Curl recorded seven AI-generated contributions within just a sixteen hour period.

In an announcement at the time, Stenberg said this was placing a “high load” on security practitioners and the move aimed to “reduce the noise” created by AI-generated submissions.

The scale of AI slop reports across the open source community has reached such an extent that big tech companies have taken drastic action to tackle the issue.

In March, a consortium of companies pledged financial support for Alpha-Omega and the Open Source Security Foundation (OpenSSF), both of which are security initiatives within the Linux Foundation.

That consortium included several industry big-hitters such as Anthropic, Google, Microsoft, GitHub, OpenAI, and AWS. The $12.5 million funding package aims to develop sustainable security solutions and help eliminate slop reports.

At the time, AWS’ Mark Ryland said AI-generated reports were overwhelming open source maintainers and impacting broader security processes.

FOLLOW US ON SOCIAL MEDIA

Three people, including a 16-year-old boy, have been arrested for alleged involvement in the KillSec ransomware operation.

Law enforcement bodies from several countries, led by the Hamburg State Criminal Police Office and the Hamburg Public Prosecutor's Office, raided eight properties in Spain, Greece, the UK, and Romania. Digital infrastructure, evidence, and criminal assets were seized.

They also took control of KillSec's leak site, securing at least 110 terabytes of data against further unauthorized access. Five central servers used to manage the group's activities and store data taken from victims were brought under police control, and KillSec's domains were redirected to a law enforcement seizure notice.

The unnamed 16-year-old, a Romanian national, is believed to have been the leading figure behind KillSec. Meanwhile, other suspects are believed to hold different roles within the group, including an administrator, a developer – still a minor when some of the offences were committed – a negotiator, and an affiliate.

"It's concerning to know a child was the mastermind behind it all. This is something the cyber security industry and governments cannot dismiss, because it clearly highlights we are not doing enough to deter young people from cyber crime," said Daniel Wilcock, threat intelligence analyst at Talion Cyber Security.

"These children, who clearly possess expert technical skills, need to be educated that there are other ways they can use their talents to make money."

Another alleged member of the group, Dutch national Fouad Eltibrizi, has meanwhile been charged in the US with conspiracy to intentionally access a computer without authorization for financial gain, intentionally causing damage without authorization to a protected computer, and intentionally transmitting a threat to obtain information from a protected computer without authorization with the intent to extort.

KillSec, a financially motivated ransomware-as-a-service (RaaS) group has been linked to around 1,000 suspected attacks worldwide. So far, around 500 of the suspected attacks have been identified as successful, a figure that may change as investigators examine the evidence seized, the authorities warned.

The group was first identified in 2024 when the group recruited affiliates via a dark web leak site and public Telegram channels to carry out attacks using its platform in exchange for a percentage of each ransom.

Last year, Group-IB's High-Tech Crime Trends Report 2026 ranked KillSec among the ten most active ransomware groups in Asia-Pacific, Latin America, and the Middle East. Financial services and healthcare were the most targeted sectors, while the victim list also included government bodies and a major insurer, investment firms, and a consumer app with millions of users.

Investigators are now examining the seized devices and data and tracing the group's criminal proceeds, including cryptocurrency. The evidence, said Europol, may help identify further victims, attacks, and people involved.

"Closing the gaps these groups exploit is essential, but it does not end an operation like this," said Dmitry Volkov, CEO of Group-IB, which was involved in the operation.

"Servers can be replaced in weeks; the people who build the platform and approve every attack cannot. Identifying them and supporting law enforcement in bringing them to justice is what turns a takedown from a pause into an end."

Chinese hackers impersonated prominent figures to target AI policy experts working for US think tanks, universities, and legal firms.

In July this year, according to Proofpoint researchers, a group tracked as TA419 pretended to be a former member of the White House Office of Science and Technology Policy leadership team, Lynne Parker, as well as economist and foreign policy expert Heidi Crebo-Rediker.

In another incident, the group impersonated a senior employee of Anthropic to target an AI policy analyst at a US think tank, asking for feedback on the military integration of Claude.

The credential-phishing campaign started with apparently harmless emails proposing collaboration, for example, by joining an “AI Policy Advisory Committee”.

If the recipient took the bait, the hackers followed up with a multi-stage URL redirection chain that led to an Adversary-in-the-Middle (AitM) credential phishing attack.

This involved using a customized version of the open-source Browser-in-the-Browser (BitB) phishing tool Frameless BitB. This creates a fake browser window inside a webpage: a counterfeit Microsoft login pop-up placed over a page designed to look like a OneDrive document-sharing site.

This page relayed the login to genuine Microsoft infrastructure, allowing the harvesting of Microsoft 365 passwords, MFA codes, and session cookies.

Cloudflare’s content delivery network was used to obscure the backend hosting IP address for its domains, which are mostly registered via NameSilo.

TA419 is a China-aligned and espionage-motivated threat actor that's been carrying out credential phishing campaigns against individuals working for US- and Japan-based think tanks, defense contractors, universities, and law firms since at least April 2025.

"TA419 has consistently shown an interest in defense, national security, energy, international relations, and foreign policy targets, predominantly with a nexus to the US and Japan," said Proofpoint threat intelligence analyst Mark Kelly.

"The targeting of AI policy experts represents an extension of that remit rather than a departure from it."

The campaign, said Proofpoint, seems designed to support wider Chinese intelligence objectives around developments in US AI policy and regulation, as well as strategic competition over AI, export controls, and other critical technologies.

Two years ago, Proofpoint uncovered a similar campaign from the China-linked group UNK_SweetSpecter, targeting Western organizations involved in generative AI. This focused on individuals in academia, government entities, and high-profile private AI firms, including employees at OpenAI.

It said it also regularly observes China-aligned actors targeting other industries, such as semiconductors and rare earths, vital to the supply chain of AI and other strategic technologies.

Organizations likely to be a target of TA419 activity should, said Proofpoint, consider phishing-resistant, origin-bound authentication such as passkeys. Individuals, meanwhile, should be wary of unsolicited emails, and check that they're genuine via another route of communication.

"Proofpoint assesses that TA419 will likely continue targeting think tanks and policy experts working on technologies, and in geographies, of particular interest to the Chinese government," said Kelly. "These campaigns will likely also continue spoofing the identities of real subject-matter experts."

The number of vulnerability disclosures made each month has more than doubled since the start of the year, hitting 10,740 in August, according to Google Threat Intelligence Group (GTIG).

The researchers also found the number of vulnerabilities being exploited is showing a similar trajectory. In 2025, the average was 10.5 exploits per month, this rose to 18 per month from January 2026 to August 2026.

The researchers said they expect both these trends to continue in the short to medium term.

Zero-day exploitation, however, increased only marginally, rising from an average of eight cases per month in 2025 to an average of 11 from January 2026 to August 2026.

According to GTIG, AI is changing not just the pace of vulnerability discovery and exploitation, but also the types of vulnerabilities that are being discovered.

While fewer low-risk vulnerabilities are being found, there are more moderate-risk vulnerabilities and vulnerabilities leading to remote code execution (RCE) are being unearthed.

High-risk vulnerabilities surged from 131 disclosures in January 2026 to 350 in August, up by 167%, although they still account for just 3% of all vulnerabilities disclosed. The increase, said GTIG, comes down to a widening pool of affected vendors and concentrated vendor disclosure cycles.

"It’s important to note that the proportion of vulnerabilities exploited versus disclosed remains vanishingly small: only 0.23% of all disclosed vulnerabilities in 2026 (roughly one in 431) were ever observed in active exploitation, or on the order of tens versus thousands per month," the researchers said.

"This means that monthly exploitation counts can more easily be influenced by other factors such as vendor disclosure cycles and threat actor campaign spikes."

Meanwhile, current public data significantly undercounts vulnerabilities discovered by AI, the researchers said. This is partly due to the absence of standardized metadata, and partly because of silent first-party and cloud patching. Major cloud and SaaS providers routinely remediate AI-surfaced vulnerabilities directly in production without requesting formal CVE IDs, with CVE assignments typically reserved for on-premises or third-party software.

The increase in vulnerability discovery, said Steve Povolny, vice president of AI strategy and security research at Exabeam, shouldn't come as a surprise.

"We know by now that AI models are able to achieve speed, scale and efficiency that few, if any, human beings are capable of. Inevitably, discovering known flaws and finding ways to exploit them is par for the course when it comes to AI," he said.

However, he highlighted the lack of change in zero-day exploitation.

"This leads to one of two conclusions: first, AI models are very good at uncovering known (N-day) vulnerabilities but not mature enough to discover widespread zero-day vulnerabilities of significance," he suggested.

"The second option is that AI augmented zero-day discovery is happening en masse, but flying under the radar, based on the inherent value it provides to attackers such as nation states and zero-day bug broker groups. Given the amount of security researchers focused on leveraging AI for zero-day discovery, I think the latter is less likely."

Schools and colleges across England are experiencing fewer cyber attacks and are getting better at dealing with the fallout when they do.

New data from exams regulator Ofqual shows that 27% of schools experienced a cyber incident during the 2025 to 2026 academic year, down from 29% in the previous year and 34% in 2023 to 2024.

And when incidents do occur, schools are recovering more quickly, with 66% able to recover immediately, up from 55% in the previous year. Critical damage from attacks has also fallen, down to 7%.

"It's encouraging to see schools recovering faster, but a cyber breach can still cause real uncertainty for students if coursework or marks are lost, and staff confidence can be affected long after systems are back online," said Amanda Swann, Ofqual's executive director of delivery.

When asked who is primarily responsible for cyber security, 46% of teachers said their IT team, 40% said all staff, and just 9% said it was senior leadership.

But, said Swann, "Cybersecurity isn't just an IT problem; it's a leadership responsibility. Regular backups and a clear response plan can make a huge difference when things go wrong."

More than half of the secondary schools surveyed, 55%, have already taken action to protect against cyber attacks, with measures including implementing a cybersecurity policy, carrying out risk assessments, and setting up backup and recovery procedures.

Education is one of the most frequently attacked sectors. Schools and colleges hold large amounts of personal data on both pupils and staff, while low budgets mean that cybersecurity is often underfunded.

Earlier this week, SonicWall urged educational establishments to beware of exposure to legacy vulnerabilities. Apache Log4j2 Remote Code Execution, for example, was the leading signature targeting UK primary and secondary schools last year, generating around 660,000 hits.

There were also 71,000 attempts against TFTP Server Directory Traversal signatures during the year, targeting network boot infrastructure that's widely used in school IT environments.

Earlier this year, an attack on the C2K system, which provides access to coursework, teaching materials, exam revision tools and communication platforms, affected more than 30 schools across Northern Ireland, leaving staff and pupils unable to access services.

Last year, West Lothian council's education network was hit by a ransomware attack that saw the loss of data from a dozen schools.

According to the Information Commissioner's Office (ICO), it's often the pupils themselves who are responsible, for reasons ranging from boredom to financial gain.

Ofqual is urging schools to put more robust measures in place so staff know what to do if systems do come under fire. It recommends that educational institutions visit the Department for Education's Cyber Security Hub for advice on how to strengthen their cyber resilience, prepare for cyber incidents and respond effectively when attacks happen.

Meanwhile, the National Cyber Security Centre (NCSC) offers security advice for governing boards and senior leaders, school staff and admin teams, procurers and providers.

A deluge of alerts combined with escalating cyber threats is challenging modern security operations centers (SOCs). Yet there is a huge gap between the best and worst organizations’ SOCs, according to a recent advisory from the US Cybersecurity and Infrastructure Security Agency (CISA).

The agency has illustrated its findings after conducting red team assessments at two organizations, which led to very different results. While both were compromised as part of the tests, one failed to detect or contain the activity, but the other quickly identified initial compromise attempts, isolated affected systems, and forced the red team into an ‘assume breach’ model.

The detection and response gap between the two organizations “had nothing to do with tools or maturity”, says Crystal Morin, senior cybersecurity strategist at Sysdig. “Both organizations faced comparable attacks and triggered similar alerts, but organization A lost them in a sea of noise.”

In contrast, organization B’s fine-tuned system cut through the noise to allow analysts to spot and act on anomalous activity in minutes. “Ultimately, organization B was able to stop the red team activity because it had the right approach to baselines and triage,” Morin tells IT Pro. “It knew what good behavior looks like, and what steps are out of line.”

Halting attacks

CISA’s test shows that a robust SOC can help halt an attack even after an adversary has compromised an organization.

Martin Riley, CTO at Bridewell, describes how organization B, operating in the water sector, detected each payload from the phishing emails as it executed and isolated the affected workstations, taking up to 20 minutes to contain the threat. “Command and control was also disrupted before the intrusion could move further,” says Riley.

It comes at a time when SOCs are drowning in alerts, making it challenging to keep up. Security analysts are forced to spend 68% of their day on reactive alert triage and manual data gathering, leaving little time for proactive threat hunting, according to a new report by ExtraHop.

As CISA’s report reveals, modern SOCs are learning that traditional network monitoring and high alert velocity can “quickly become overwhelming” for human analysts and security teams, says Debby Briggs, vice president and chief information security officer at NETSCOUT.

CISA’s tests revealed that organization A’s SOC suffered from alert fatigue, with a high volume of either false positive or low-value alerts triggered by normal business operations. “This is a relatively common SOC issue and results in a signal-to-noise problem, where high-value alerts get drowned out and go unnoticed,” says Chris Oakley, SVP Assurance Services, Americas, LRQA.

In one instance, an alert triggered by the red team was closed as a false positive because no one in the SOC could work out who owned the affected server. This is “a common story of technology not being the limiting factor”, says Oakley.

Robust detection engineering practices combat this, but it’s “not glamorous work” and “requires constant iteration”, he says.

A lot of the weaknesses CISA found are familiar, according to Cyrille Badeau, VP, EMEA, at Securonix. “Some controls were in place, but they were not configured or tuned well enough to help the SOC at the point of investigation. Environments get larger, new applications are added, people change roles, and service accounts stay in place for years. The security team ends up looking at activity without always knowing what normal behavior should look like for that account or system.”

Tool sprawl adds “another level of complexity”, according to Badeau.

Lessons for all

The two organizations tested by CISA were operating in critical sectors. However, the report’s findings are applicable to SOCs more widely, experts say.

Learning from the findings, Oakley highlights some “widely applicable quick wins”, such as ensuring cloud keys have expiry dates, checking cloud application permissions, and removing passwords from text files. “These things don’t necessarily need technology or a sizable budget and are achievable through time and mandate.”

The operational lessons can apply to any organization’s network, according to Briggs. She believes firms should consider transitioning from manual triage to learning from past incident resolution patterns and automating incident response tasks.

Most importantly, the right metrics must be prioritized, says Oakley. “Alert volume and ticket count pale in comparison to mean time to containment, in terms of real-world efficacy. Beyond that, having a unified area of visibility across areas such as endpoints, identity and cloud is key, especially with identity becoming the primary attack surface.”

At the same time, analysts must have authority to act, says Oakley. “It’s no good having a team who can tell you something bad is happening but are unable to do anything about it."

Oakley also advocates “solid fundamentals” such as detection engineering to reduce alert fatigue and “other human failures”. The ideal SOC is “set up in a way that harmonizes people, process, and technology”, he says. “Tooling is rarely the primary weakness in a SOC.”

Automation also earns its place in the SOC. “As CISA noted, it speeds up token revocation, because manual processes are too slow when a threat is active,” says Morin. “It also makes just-in-time access reviews practical, so excessive access like administrative rights can be removed or re-provisioned automatically.”

However, while useful, she points out that automation cannot replace human investigative instinct. “No amount of automation or tooling will understand when something isn’t quite right, and you need to dig a little deeper, as organization B did after cutting off the red team’s command and control infrastructure.”

At the same time, firms need to assume that whatever is working today will always require tuning, according to Badeau. “Cloud estates, identities and applications change, and attackers adapt. Regular scheduled exercises give teams a way to see where detections have weakened, where context is missing, and where response has become slower,” he says.

“No SOC is future-proof, but a good SOC should be able to keep learning its own environment and adjust as threats change.”

Nearly all of the identity and fraud control systems companies rely on were built with a human at the centre of the transaction. Verify the person, check the document, run the liveness test. That model is now quietly becoming outdated. Visa, Mastercard, and PayPal are investing heavily in AI-powered commerce capabilities and have completed thousands of transactions.

Businesses are authorising agents to book, buy and transact on their behalf - and the compliance infrastructure underneath most of them was never designed for a customer that isn't a person. The scenario channel partners should be putting to their clients is one many haven't considered yet: what happens when your customer isn’t a human?

Agents don't have passports

Traditional KYC and AML were built around two things a human brings to onboarding: a document and a face. Check the passport, then a selfie or liveness test confirms the person holding it is real and present. An agent has neither - it carries no passport, fails every biometric check by definition, and can't be re-verified mid-transaction because there's no one there to re-verify.

But the deeper problem is ongoing due diligence. Regulation doesn't ask for a one-time check; it asks for continuous monitoring. Most businesses are now retrofitting trust, identity, and fraud controls into systems originally built to keep automation out, and the result is a worse experience for everyone moving through them. In agentic commerce, you don't even get the usual complaints. The only feedback is lost revenue.

Recalibrating behavioural analytics for bot traffic only addresses part of the problem. A business can stop treating automated traffic as hostile by default, adjust the rules around session velocity, device consistency, and transaction cadence, and learn to tell a legitimate purchasing agent from a credential-stuffing script. But that only answers a behavioural question: Does this activity look suspicious? It doesn't answer the compliance one: is this agent authorised to act, on behalf of whom, under what permissions, and are those permissions even still valid?

Identity should never be treated as static. Names and addresses change. Immigration, residency, and professional status can be granted or withdrawn. Real ongoing monitoring involves businesses continuously asking whether the identity, risk profile, authority, and credentials tied to a customer are still valid at the moment you're relying on them.

Agents sit between the customer and the transaction, carrying what is effectively the badge of the person who sent them. A customer lets an AI agent buy software on their behalf. The agent buys, the payment clears, the behavioural data is clean - on every signal traditional monitoring tracks, this is a good transaction. The business still has no idea who actually authorised the agent, what it was allowed to buy, whether that authority still holds, or whether it has drifted out of scope and is renewing licences nobody approved. The question shifts from 'who is the customer?' to 'whose authority is this agent carrying, and is that authority still real?'

Scale that up, and you're not dealing with one bot you can label good or bad - you're dealing with thousands of them, acting across channels on behalf of different people, companies, wallets, and platforms. The most mature businesses in BFSI are already worried about this, but most SMEs haven’t even started having this conversation.

The channel opportunity: trust infrastructure, not tooling

This is where channel partners are well placed, but only if they change the framing from "which tools do you need?" to "how does your trust infrastructure need to evolve?" Most clients aren't thinking about agentic commerce as a compliance problem at all; they're thinking about AI agents as a productivity win. A channel partner's job is to make sure that as clients move faster, they don't quietly create compliance exposure.

So the conversation that needs to happen now isn't only about detecting automated traffic. Clients need help deciding which automated interactions can be trusted, what evidence is required to support that trust, and how delegated authority is monitored over time. Start by mapping the controls a client already has for bot traffic, then help them capture the commercial upside of agent-driven traffic while reducing the exposure that comes from accepting it blindly.

The businesses doing this well have already moved from siloed, event-based verification to a continuous model that handles humans, devices, and agents together. The partners who understand this will become trusted advisors; those who don't will be stuck reacting rather than anticipating client compliance failures.

The window to act is now

Companies don't need another isolated protocol, another fraud rule, or another bot-traffic indicator to tackle this challenge. They need help stitching the pieces they already have into a trust framework built for agent-initiated transactions: connecting KYC and KYB to delegated permissions, linking wallets and credentials to ongoing monitoring, making sure credentials can expire, be suspended or revoked, and treating agent activity as part of the customer risk lifecycle rather than a one-off access-management event.

The frameworks most businesses rely on were built for a different era. That doesn't make them wrong; it makes them incomplete. Getting ahead of this is still a choice, for now.

Nearly half of UK employers are planning to boost their technology teams by the end of this year, looking mostly for security, AI, and cloud skills.

According to new research from Robert Half, 47% of UK employers hope to boost their tech workforce, with 54% looking for cyber security skills, 50% agentic AI skills, 48% generative AI skills, and 44% cloud skills.

Meanwhile, another 25% are expanding contract and project-based hiring.

"Technology remains one of the most active areas of hiring in the UK labor market, with nearly half of employers planning to grow their permanent technology teams before the end of the year," said Matt Weston, senior managing director, UK & Ireland at Robert Half.

"Businesses continue to invest heavily in cyber security, cloud infrastructure, and artificial intelligence, but they're not simply looking for more people. They're looking for professionals with the right blend of technical expertise, commercial understanding and the ability to work effectively alongside AI."

According to the researchers, 45% of UK technology professionals say they're now expected to develop new AI-related skills, while 38% spend more time overseeing and validating AI-generated outputs. At the same time, 53% say AI has cut the time they're spending on routine tasks, and 37% that their roles have become more strategic.

The findings, said the team, point to a growing demand for professionals who can work effectively alongside AI systems, applying human judgment to ensure accuracy, quality, security, and compliance.

"As organizations increase investment in AI, cloud infrastructure and cyber security, we're seeing strong demand for professionals who combine technical expertise with strategic decision-making," said Weston.

"AI is automating some tasks, but it isn't replacing the need for skilled technology talent. In many cases, it's making those skills even more valuable."

With cyber threats continuing to evolve and businesses increasing investment in AI-powered technologies, the firm said it expects competition for specialist talent to remain strong, especially for those with expertise in cyber security, AI, and cloud environments.

The report coincides with the UK government's latest figures on the cyber security workforce, showing that it's expanded by only 2% over the last year – although it, too, finds that most companies are looking to hire this year.

There was a 7% increase in core cyber security job postings – roles where some aspect of cyber security is the main job function – and a rise of 10% for roles that might not be formally labeled as cyber security jobs but that still require cyber security skills.

However, 57% of businesses said they had a basic technical skills gap, up from last year's 49%.

Back in January, the government announced plans to provide 10 million workers with key AI skills by 2030 through free courses available to all, opening a skills hub that's already seen the delivery of more than a million courses. Meanwhile, the NCSC offers training courses for both novices and experienced security professionals, with courses targeted at sectors from board members to schools.

Nvidia has unveiled Open Agent Safety Platform, a system designed to rein in AI agents — and could have stopped the Hugging Face attack.

The launch comes amid continuing revelations that AI agents from OpenAI have targeted government systems, including an Australian healthcare statistics website. OpenAI said this week it wouldn't be releasing to the public its Astra 6.1 model over concerns about its behavior.

Nvidia said its security platform would have prevented OpenAI's agents from breaking into the Hugging Face AI repository, the attack that sparked concerns about these agents escaping their bounds during evaluations and taking extreme action to solve tasks. Nvidia has since acquired Hugging Face.

“From what we know, this new security platform could have stopped the breach if it was being used in frontier labs for model evaluation early on,” Justin Boitano, vice president and general manager of enterprise computing at Nvidia, told reporters according to a Reuters report.

“We’re advancing this openly, ​and we want to ​engage everybody to ⁠work with us," Boitano added.

Indeed, the system works across other hardware manufacturers' infrastructure and has support from Anthropic, Palantir, SpaceXAI and Perplexity among others — though OpenAI is not on the list.

“AI’s extraordinary potential for society will only be realized if we solve AI safety,” said Jensen Huang, founder and CEO of Nvidia, in a statement. "As we continue to discover the frontier of AI capabilities, we must accelerate discovery at the frontier of AI safety."

How it works

Nvidia said that the incidents follow a pattern, with the rogue agents dodging security controls at the application layer in order to solve tasks. The aim of this safety platform is to add controls at the infrastructure layer.

"Safety and security require full-stack engineering," Huang added. "NVIDIA Open Agent Safety Platform brings together industry, researchers, and public-sector organizations to share best practices, align on evaluation methods, and foster international cooperation. Together, we can raise the bar for global AI safety."

Nvidia said the Open Agent Safety Platform is designed to give users full-stack governance and control over the systems that run AI agents.

That's managed via Nvidia's OpenShell, an open-source software tool that Nvidia says sets boundaries for agents and enforces that policy at runtime, whether the systems are running on Nvidia Vera chips or third-party hardware from ARM and Intel.

"OpenShell runs each agent in a sandbox and turns the operator’s instructions into a verifiable policy," the company explained in a blog post.

"Operators define which files, networks, tools, processes, and credentials an agent can access. OpenShell checks those limits before the agent runs and enforces them as it works."

In addition to that, the platform includes Nvidia Sentry, which monitors agent behavior from the silicon for hardware-based enforcement. If an AI agent steps beyond set boundaries, Sentry will stop it and quarantine it.

" It correlates agent interactions, policy decisions, and tool and data access to create a contextual record of agent activity," the blog post explains.

"This helps safety systems identify drift, investigate suspicious behavior, and determine when intervention or deeper analysis is needed."

Nvidia compared the recent AI security issues to the early days of the internet, saying that "adding trust turned a great concept into a great economy."

The blog post added: "The agent economy, and the next set of great companies, is waiting for the same layer."

Citrix has patched eight vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway, two of which have been confirmed as being actively exploited.

The first of the two, CVE-2026-88771 is a remote code execution (RCE) flaw, in which improper input validation enables an unauthenticated attacker to execute arbitrary commands. It affects all NetScaler ADC and NetScaler Gateway deployments and has a severity score of 9.5.

Meanwhile, CVE-2026-88772 is a memory overflow vulnerability that can lead to RCE or denial of service. It affects any deployment with DTLS configuration enabled – which it is, by default, on VPN virtual servers. This, too, has a severity score of 9.5.

"Both are critical, zero-day vulnerabilities that can independently enable remote code execution," said the US Cybersecurity and Infrastructure Security Agency (CISA). "CISA has received reports and partner threat intelligence confirming that threat actors are actively exploiting these vulnerabilities globally."

The UK's National Cyber Security Centre (NCSC) said there could now be an increase in exploitation attempts, following the release of patches and additional technical details.

The other vulnerabilities are:

• CVE-2026-88773: Inconsistent interpretation of HTTP requests (HTTP request/response smuggling), which may allow an attacker to manipulate or bypass security controls.
• CVE-2026-88774: Improper HTTP URL-based expression usage leading to a feature policy bypass.
• CVE-2026-88775: Memory overflow vulnerability that may result in unpredictable or erroneous behaviour, or denial of service.
• CVE-2026-88776: Memory overflow vulnerability that may result in unpredictable or erroneous behaviour, or denial of service.
• CVE-2026-88777: Memory overflow vulnerability that may result in unpredictable or erroneous behaviour, or denial of service.
• CVE-2026-88778: Predictable exact value vulnerability that may allow an attacker to influence integrity or availability.

The NCSC advises isolating any affected systems and replacing them with a new, fully up-to-date system. However, the NCSC also notes this may cause a service outage, as it could mean temporarily disabling access to the service with upstream firewalls, disabling the vulnerable components, or restricting access to only the organization's IP range.

Security teams should fully investigate for evidence of compromise using the published indicators of compromise (IoCs), and report anything they find. They should install the latest available updates, re-enable or reintroduce the affected systems and continue to monitor the Citrix security bulletin and perform continuous threat hunting activities.

They can also, said the NCSC, use NetScaler Console File Integrity Monitoring to help detect unauthorized or unexpected changes to monitored files on managed NetScaler instances.

"There are no additional details or proof-of-concepts available as of now. Based on the available CVSS scores, exploiting CVE-2026-88772 is more difficult than CVE-2026-88771," said Mayuresh Dani, security research manager at Qualys. "It is also imperative to know that patching does not remove an existing webshell that has been placed on a compromised device."

He also pointed out that a recommendation from Citrix to forward NetScaler logs to an external logging or SIEM platform may indicate that attackers can maintain persistence and alter vulnerable devices. All these devices, he added, should be kept under strict observation for at least 90 days.

The education sector is battling a torrent of cyber threats, with new research showing attacks on colleges and universities surging by 67% over the last year.

SonicWall said its threat intelligence team has recorded more than 19.3 million medium and high-severity intrusion attempts so far this year – a significant increase compared to the 11.5 million events recorded across the whole of 2025.

Most activity was concentrated in the educational services category, which accounted for 16.8 million events, or 87% of the sector total.

According to SonicWall, attackers are primarily probing web-facing education infrastructure. Path traversal and directory manipulation attacks accounted for 10.2 million hits across the four leading signatures, the company noted, while web-based attacks accounted for 17.3 million events overall.

“Education is showing us that cyber risk shows more than a ransomware gang breaking through the front door,” said Spencer Starkey, executive vice president, EMEA, SonicWall.

“We’re seeing relentless automated scanning of the systems schools and universities depend on every day, from student portals to learning platforms, as attackers look for something that has been left exposed."

Legacy vulnerabilities plague education sector

Researchers urged the sector to be on the alert for exposure to legacy vulnerabilities. Apache Log4j2 Remote Code Execution was the leading signature targeting UK primary and secondary schools, for example, generating around 660,000 hits – almost seven times as many as in the healthcare sector.

SonicWall also recorded 71,000 attempts against TFTP Server Directory Traversal signatures, targeting network boot infrastructure commonly used across school IT environments.

Despite all this activity, ransomware is still pretty rare. Just 36 ransomware events were detected across SonicWall’s UK education sensor fleet, the lowest level of any UK sector.

“The low number of ransomware events is encouraging, but it shouldn’t create a false sense of security," said Starkey. "If attackers find an unpatched vulnerability, exposed directory or overlooked network service, that initial intrusion can quickly become a much bigger problem.”

Growing threats to education sector

Earlier this year, a government report revealed that more than seven-in-ten secondary schools, nearly nine-in-ten further education colleges and almost every higher education institution in the UK had experienced a breach or attack in the last 12 months.

Primary schools came off more lightly, but half still reported experiencing a breach or attack. Phishing was overwhelmingly the main threat.

Just this summer, the data of around 450,000 present and former Nottingham University students was compromised in an attack claimed by the ShinyHunters ransomware group.

Other major incidents in recent years have affected Newcastle University, the University of Manchester and the University of Wolverhampton.

The National Cyber Security Centre (NCSC) offers a range of security resources for schools, with specific advice for governing boards and senior leaders, school staff and admin teams, procurers and providers.

In May, the government launched a dedicated cybersecurity hub for the education sector. It's aimed at helping educational organizations strengthen their cyber resilience, prepare for cyber incidents and respond effectively when attacks happen, the Department for Education (DfE) said.

FOLLOW US ON SOCIAL MEDIA

The UK’s AI Security Institute (AISI) won’t be granted access to test new OpenAI and Anthropic models, according to reports, marking the second blow for the testing agency this month.

On 22 September, the duo launched a series of new models, with Anthropic unveiling Claude Opus 5.5 and OpenAI introducing GPT-6 Sol and GPT-6 Luna.

Backed by the UK government, the AISI is tasked with conducting research into AI model safety and works closely with industry stakeholders and researchers.

While the AISI has typically tested models before they’re released publicly, reports from Politico suggest the White House asked both firms not to share these until they had undergone testing by US authorities.

Citing sources familiar with the matter, Politico noted the request came from the Office of the National Cyber Director. Sources told the publication that US officials want to review both models before being shared with international partners.

A senior US official told Politico that the justification behind the move was that “they’re American companies and this has been our policy with every new frontier model that comes out”.

ITPro approached both companies for confirmation, but did not receive a response by time of publication.

We will update this article accordingly upon receiving comment.

Another blow for the AISI

If confirmed, the move by the duo marks the second blow for the AI testing institute in the space of a month. As ITPro reported in early September, the AISI was not granted access to Anthropic’s Mythos 5.1 model for pre-release testing.

The AI developer declined to submit the model for testing despite having granted access to similar US entities. The move marked the first time the AISI had been left out of pre-release evaluations of Anthropic models.

Claude Mythos 5.1 launched on 1 September, and as with other recent models, only approved partners were given access amidst security and safety concerns.

At the time, reports from the Financial Times, citing UK government officials, suggested the move pointed toward a “wider protectionist shift” among US tech companies.

The AISI has been granted access to test recent GPT-6 range models. In a letter to Liam Byrne, chair of the House of Commons Business and Trade Committee, AISI director Henry de Zoete noted that the institute had conducted testing on OpenAI’s GPT-6 Astra model before it was released to the public.

In that letter, de Zoete noted that the AISI wasn’t the only organization denied access to testing.

“Anthropic made clear at the time of the release of Mythos 5.1 that no organisations outside of the US had access to the model,” de Zoete wrote.

“AISI is in daily conversation with industry partners, including Anthropic, and maintains long-standing arrangements to test models from major AI developers.”

A spokesperson for the AISI told ITPro: ““The UK is a world leader in AI security, and the AI Security Institute continues to work closely with the US government, international partners and leading AI companies, including OpenAI and Anthropic.

“These risks do not stop at national borders and no country can tackle them alone. We will continue to work closely with the US and other partners on the testing of advanced AI, while building our own rigorous scientific understanding of these systems and ensuring our approach is grounded in the evidence.”

FOLLOW US ON SOCIAL MEDIA

The US Cybersecurity and Infrastructure Security Agency (CISA) has outlined a new framework it says will improve the Common Vulnerabilities and Exposures (CVE) program.

Under the plans, the agency wants to create a more resilient, transparent, and sustainable vulnerability management ecosystem, while making sure that CVE data remains accurate and responsive to a rapidly evolving threat landscape.

According to CISA, the move comes as AI-enabled technologies are creating new pressures across the software lifecycle, while rising vulnerability volumes are placing significant strain on cyber defenders.

"These pressures intensify quality challenges across the CVE ecosystem," said CISA. "While faster discovery and reporting can improve the value of vulnerability information when records are complete, consistent, timely, and actionable, the same acceleration can expose gaps in processes, tooling, coordination, and accountability — especially when the quality of the submissions is uneven."

In a white paper, The CVE Program: Establishing a Quality Era Framework, it lays out four 'dimensions of quality', including:

• Program governance
• Ecosystem participation
• Data infrastructure
• CVE record content

What CISA wants

Organizations should aim for transparent and effective CVE program governance through clear stewardship, structural maturation, representative ecosystem participation, and collaborative decision making, CISA said.

Similarly, they should be active within the global software development community, including CNAs, Roots, CNAs of Last Resort (CNAs-LR), product suppliers, tool vendors, researchers, and governments, to create engagement, guidance, and feedback.

The systems supporting core CVE operational functions – such as CVE ID reservation and CVE Record publication – should enable quality at scale through robust APIs, schemas, validation libraries, and cve.org.

Elsewhere, CVE records need to be complete, accurate, timely, and actionable so that cyber defenders and downstream users can confidently rely on them.

CISA plans a step in the right direction

Ronald Lewis, head of cybersecurity governance at Black Duck, said the document was a positive step. However, he questioned the vague metrics for success.

"Terms such as "effective governance," "broad participation," "robust infrastructure," and "high-quality records" sound good, but they remain subjective rather than "measurable" – and when a framework isn't measurable, becoming achievable is that much harder," he said.

"For example: What is an acceptable error rate? What is the target turnaround time for CVE enrichment? How quickly should CNAs respond to submissions? What level of data completeness constitutes a quality record? These are the types of metrics needed to figure out whether a program is succeeding or falling behind and ultimately, defining whether or not we can trust that we're investing in what makes us truly safer."

Lewis said he'd like to see specific key performance indicators (KPIs) for each pillar, for example response-time objectives for CVE assignments, data quality thresholds, enrichment timeliness goals, and governance review metrics.

Russel Van Tuyl, VP of security services at SpecterOps, echoed Lewis’ comments, noting that the industry is experiencing a “fundamental change in the economics of vulnerability research”.

“Frontier AI is helping researchers connect evidence, test hypotheses, as well as find and validate exploit chains at a speed that was previously difficult to achieve,” he said.

“CISA’s Quality Era framework is an important recognition that better vulnerability data and faster coordination must accompany faster discovery.”

FOLLOW US ON SOCIAL MEDIA

Do you really know who's on the phone or in that video call? Thanks to the rise of AI deepfakes, the caller might not be who they claim to be.

That's according to a survey from Gartner, which found that four-in-ten (41%) of CISOs have reported social engineering attempts involving an employee phone call in the last year, with a further 36% seeing the same in a video call.

Notably, more than three-quarters (79%) of CISOs polled had seen at least one email phishing, spear phishing, or business email compromise (BEC) incidents in the last 12 months. A further 58% reported to have seen vishing, or fake voice calls, and smishing, a malicious text message, over the same time period.

Last year, the FBI warned about a text and voice campaign in which hackers claimed to be senior US officials. Such deepfake attacks can be elaborate, research shows. In one example from 2024, British engineering firm Arup lost $25 million following a video conference scam that included deepfake versions of the victim's co-workers.

In another case, deepfake voice notes impersonating an executive were used to encourage an employee to download malware, an example of multi-modal attacks that see attackers using voice and video alongside more traditional emails and texts.

The Gartner report comes as AI developers are ramping up efforts to prevent malicious actors from using their tools. Earlier this year, for example, Google warned that criminal groups are abusing Gemini to augment attacks, using large-language models (LLMs) to research and target victims.

AI deepfakes are making things easier

Such attacks have seen a rise in volume, personalization, and apparent credibility thanks to AI, according to Gartner, and it’s making detection increasingly difficult.

The analyst firm noted that the technology is reducing the reliability of warning signs we've come to rely on.

"Attackers can combine phishing, business email compromise, synthetic media, and aggregated personal context across multiple channels,” said Craig Porter, Director Analyst at Gartner.

"Most attacks will continue to rely on users, stolen credentials, weak recovery processes, and familiar technical methods," Porter added. "CISOs must use the same discipline used to assess identity and access risks to combat AI-driven social engineering threats."

Back in 2024, an executive at Ferrari infamously prevented a deepfake voice attack by asking about a book recommendation from the person being impersonated.

What should companies do?

Gartner advised companies to move beyond "spot the fake" training toward making secure verification the "expected behaviour", regardless of where the request originates – be it email, voice, video, collaboration tools, and even AI applications.

Beyond that, companies should harden protections around "high value workflows" – such as account recovery, payment authori\ation, and identity controls – and increase efforts to detect identity abuse, including after a successful login or password resent.

Threat detection can be improved, Gartner added, by correlating suspicious communications with account recovery attempts, addition of new devices, and financial transactions.

Incident response should now include multimodal impersonation, the analyst firm added, as well as compromised agents that operate beyond where they should in systems and should consider AI recommendations being manipulated.

FOLLOW US ON SOCIAL MEDIA

The FBI has confirmed it is “actively and aggressively” investigating a breach which allegedly exposed employee and operational data.

“The FBI is aware of a cyber-criminal enterprise group claiming a compromise of the http://FBIJobs.gov portal and alleged impact to FBI employee personally identifiable information (PII),” the agency said in a post on X.

The statement comes after the ShinyHunters ransomware group claimed to have compromised critical systems through a third-party vulnerability.

This, the group said, enabled access to several systems, including jobs portals and background check software, as well as a system used to store information relating to investigations.

According to ShinyHunters, the third-party software inquisition is Oracle PeopleSoft, an enterprise resource planning (ERP) suite used in human resources (HR), finance, and supply chain management.

Earlier this year, ShinyHunters claimed responsibility for a string of attacks after leveraging a zero-day vulnerability in the ERP software. Car manufacturer Nissan and the University of Nottingham were two of a string of organizations impacted.

In its statement on X, the FBI said the “point of breach is still undetermined”, adding that it is working closely with third-party providers related to impacted systems.

FBI breach could have huge consequences

The exact scope of data compromised in the breach remains unconfirmed, however, the group claims to have stolen data on thousands of employees. This includes agent names, badge numbers, and information such as home addresses and contact details.

Reports from Reuters suggest this also includes highly sensitive data on investigations into foreign intelligence operations as well as drug cartel activity.

If confirmed, exposure of this data could have serious real-world consequences, according to Joe Hancock, partner and head of cyber risk and complex investigations at law firm Mishcon de Reya.

“If the reports are accurate, this is a serious breach. This kind of data has real utility in the wrong hands, as we saw with the PSNI breach exposing people in sensitive roles translated into real-world risk,” he said.

“The fact the data appears to have come from an online jobs portal may limit some of the operational impact, but it doesn’t make the exposure of individuals’ identities any less serious,” Hancock added.

“Linking personal information to specific intelligence, counterespionage, or surveillance roles takes this well beyond conventional identity theft.”

Andrew Brandt, principal threat intelligence incident commander at Huntress, echoed Hancock’s comments. According to Brandt, a serious concern centers around whether the group might sell data to other criminal or nation-state groups that “could put it to more damaging use”.

“The FBI handles some of the most serious interstate and transnational crime investigations. It doesn't take much imagination to picture scenarios where employees or their families could be threatened or harmed by this kind of information being released,” he said.

ShinyHunters claims attack is not financially motivated

In a message on its dark web leak site, ShinyHunters claimed the attack was not financially motivated, but instead comes in response to an advisory by the agency which misrepresented the group’s activities.

The advisory, published by the FBI in May in the wake of attacks on the Canvas academic management system, said threat groups such as ShinyHunters often use “real or exaggerated claims” to pressure organizations into paying ransoms.

The ransomware gang has called on the agency to retract the advisory or it will publish the compromised data.

ShinyHunters has grown to become one of the most aggressive and active threat groups in the ransomware space, having claimed responsibility for attacks on Salesforce, Canvas, and the European Commission in recent months.

As ITPro reported this week, the group also claims to have hacked a rival ransomware group, Clop. This incident appears to have stemmed from a disagreement between the two ransomware gangs.

FOLLOW US ON SOCIAL MEDIA

OpenAI agents hacked into an Australian Medicare data portal, according to reports, and officials are furious that it took months for the company to disclose the incident.

Australian prime minister Anthony Albanese revealed that an OpenAI agent breached a Medicare statistics website back in June, but the government wasn't alerted to the activity by the AI developer until 10 September.

Albanese said he'd shared "Australia's extreme concern about this incident" to OpenAI CEO Sam Altman.

"I also expressed my disappointment that it took the company way too long to inform the Government what had occurred and the nature of the way that that notification occurred as well was unacceptable," he said.

Notably, Albanese hit out at the “unacceptable” manner of disclosure by the company. OpenAI notified authorities via an email sent to a public-facing disclosures mailbox, rather than by directly contacting the government.

In response, the government is setting up a taskforce to investigate the incident, conduct a review into AI-related cyber incidents, and consider whether a criminal offence may have occurred.

A spokesperson for OpenAI said: "We notified the organizations and are providing technical information to support their investigations and help address potential security vulnerabilities."

What happened in the OpenAI Medicare breach?

The infiltration happened in June, and OpenAI told the Australian government it had spotted the activity in August. OpenAI attributed the gap between discovery and notification to "validating and investigating the facts".

The agent in question had been tasked with finding information online about public medicine spending as part of an internal test.

The data accessed did not include individual private or financial data, as the portal in question doesn't include such information. However, non-public facing data including aggregate statistics and internal file names were viewed.

An OpenAI spokesperson said it had been looking for misaligned model activity when it spotted the incident.

"During this review, we identified activity involving several Australian government websites and services as our models attempted to look up answers, and available statistics for questions about Australia during an internal evaluation," the company said. "In the course of that, our models took actions we did not intend."

Could OpenAI face criminal charges?

Deputy prime minister Richard Marles told reporters that the Medicare incident was "utterly unacceptable", adding that a task force will examine whether the law has been broken, as it "definitely does raise questions about whether the law has been broken in respect of this."

PM Albanese also said that part of the investigation will consider whether the incident needs to be referred to local police.

In Australia, computer intrusions are prohibited by its cyber crime law, as is the creation and distribution of malicious software. The task force will also look into "whether or not the legal regime we have in place is fit for purpose in a world where we have an emerging AI capability."

Concerns mount over ‘rogue AI agents’

The admission by OpenAI marks the latest in a string of apparent ‘rogue AI’ incidents involving the company and counterparts in the industry.

In July, the company admitted that agents had breached a Hugging Face production environment after breaking out of a sandbox test environment.

Just last week, OpenAI revealed six other instances of misaligned behavior by AI agents.

Andrew Kay, director of systems engineering APJ at Illumio, said there will likely be “more high-profile breaches like this” unless robust guardrails are implemented to prevent agents ‘going rogue’.

“As increasingly autonomous and capable agents emerge, we cannot rely on the illusion of guardrails or assume an AI will always behave as intended,” he said. “It will take whatever action is necessary to achieve the task it has been set.”

“Rogue or misbehaving AI agents will only become more competent and more prevalent,” Kay added. “The priority must be ensuring that if one breaches a boundary, it cannot access sensitive material, cause serious damage or bring essential services to a standstill.”

Laura Ellis, senior vice president for artificial intelligence at Arctic Wolf, said the incident is a “timely example of a cyber risk businesses need to be preparing for now”.

“While the details of this incident are still being investigated, the security lesson is clear and security fundamentals remain unchanged,” she said. “All organizations deploying AI agents should secure them at least as tightly as any other identity: strict permissions, clear guardrails, continuous monitoring, and the ability to act fast when an agent steps outside its intended bounds.”

Ellis added that safeguards are “only part of the equation”, however. Disclosure of an incident within a “responsible timeline and with appropriate transparency” is vital.

FOLLOW US ON SOCIAL MEDIA

Barracuda Networks has announced the launch of a new AI security and governance solution for resource-constrained organizations and managed service providers (MSPs).

Slated for availability from October 2026, Barracuda Data AI Security integrates AI visibility, data protection, threat defense, and governance capabilities into a single, easy-to-deploy offering.

Built on the company’s BarracudaONE platform, the solution aims to help businesses accelerate their AI adoption by securing sensitive data, enforcing responsible AI use, as well as demonstrating compliance.

The move comes as organizations continue to embrace AI technologies faster than they can implement safety and governance measures. According to recent findings from Barracuda Research, nearly half of senior IT leaders believe their teams lack the necessary skills to securely govern AI that is already present across their businesses.

In an announcement, Barracuda chief product officer Neal Bradbury said the speed of AI adoption is creating “one of the most urgent new security and compliance challenges” as organizations struggle to keep pace.

“Organizations need a practical way to secure AI as a new attack surface, protect sensitive data, enforce responsible use, and demonstrate compliance,” he explained.

“At the same time, they need the confidence to embrace and accelerate AI adoption as a driver of productivity and innovation. Barracuda AI Data Security delivers those capabilities in a single, easy-to-deploy solution.”

Encouraging safer AI adoption

AI Data Security is powered by Barracuda’s IQ AI engine and offers protection across more than 1,300 generative AI tools – including Copilot, ChatGPT, Claude, and Gemini.

The solution serves up a host of benefits for organizations, including full visibility into AI usage and the safe enabling of approved AI tools, alongside an ability to inspect prompts and uploads in real time.

Sensitive information such as passwords, customer data, and proprietary code are automatically blocked from reaching genAI services, Barracuda said, while AI threat detection guards against the likes of prompt injection, jailbreak attempts, and policy-violating topics.

Elsewhere, the offering also delivers a compliance-ready audit trail, capturing AI interactions with one-click exports for insurers and auditors, alongside flexible AI policies that enable tailored AI rules.

Strengthening protection for MSPs

Barracuda said its new solution has been designed to help smaller businesses and MSPs that may be struggling with overcoming complexity, skill, and cost hurdles around AI adoption.

With rapid deployment in minutes, the offering eliminates the need for specialized AI security expertise thanks to familiar firewall style workflows, alongside guided configuration through Barracuda’s Bailey AI assistant.

MSPs can also leverage centralized multitenant management and bundled pricing designed to fit their existing service models.

Barracuda Data AI will be included in the vendor’s SecureEdge Premium Access platform at no extra cost, the firm added, while further tools will be added in due course.

“This is the first of several innovations that will expand our AI Security suite and help businesses unlock AI's full potential, securely,” Bradbury said.

FOLLOW US ON SOCIAL MEDIA

The threat from quantum is already on most security leaders’ radars, but experts argue the reality is growing near. Concerningly, the figures show a lack of preparation for quantum capabilities that will give adversaries the ability to break encryption.

Organizations could face a ticking quantum time bomb, according to research from DigiCert, with the vast majority of firms aware that they aren’t properly prepared. While an overwhelming 85% of IT and security leaders believe that quantum computing advances will break existing security standards within a decade, only 7% have deployed quantum-safe certificates so far.

According to recent data from IBM's Cost of a Data Breach Report, 69%of organizations have no plan in place for post-quantum cryptography (PQC).

With ‘harvest now, decrypt later’ attacks a real risk for firms, what steps should CISOs be taking now to ensure they are prepared?

The quantum timeline

No one can give an exact date for when quantum computing will be able to break today’s widely-used public key cryptography, but the risk is close enough that governments, standards bodies and major technology companies are already acting.

The US National Institute of Standards and Technology (NIST) released its first three final post-quantum cryptography standards in 2024, while the UK’s National Cyber Security Centre (NCSC) has set a target for organizations to complete PQC migration by 2035.

Technology giants such as Cloudflare and Google are setting their own post-quantum security milestones for 2029.

The quantum threat is often compared to the millennium “bug” (Y2K). It has even earned its own moniker: “Y2Q”, or “Q-Day”.

But unlike Y2K, there won’t be “a single moment of failure”, says Mark Hughes, global managing partner, cybersecurity services at IBM. He says the reality could see risks materialize over multiple years. “Different cryptographic systems will fail earlier than others, and that all depends on design and key size,” he predicts.

Harvest now, decrypt later

DigiCert’s survey highlights concerns about ‘harvest now, decrypt later’ attacks, where adversaries steal information for use at a later date. Over 80% say at least some of their encrypted data is vulnerable, with around one-third reckoning more than a quarter could be at risk.

Simon Pamplin, chief technology officer at Certes, describes how attackers do not need a large-scale quantum computer today to create a future breach. “They can collect encrypted data now, store it, and wait until the capability exists to decrypt it.”

He says the quantum threat timeline is “much shorter than many organizations assume”.

“Whether a cryptographically relevant quantum computer arrives in 2029, 2035, or later, the data being harvested today may still be valuable when that moment arrives.”

Firms are often unaware of the type of data at risk. “People often think about passwords and payment details, but they're usually not the biggest concern,” says Tristan Shortland, CTO of Infinity Group. He says the most exposed data is information with a long shelf life: “Intellectual property, product designs, merger and acquisition discussions, healthcare records, legal documents and sensitive communications that retain value for years.”

This matters most in sectors with complex operational or national security requirements, including critical national infrastructure, financial services, energy and manufacturing, says Ben Packman, CSO at PQShield, which helped to create the quantum standards being enforced by NIST and the NCSC. “One unsupported system, legacy platform or unprepared supplier can create risk across a much wider technology estate.”

At the same time, quantum poses other threats beyond attackers stealing data to decrypt at a later point. “If future quantum computers are able to break the cryptography behind digital signatures and certificates, attackers could potentially make malicious software, fake updates or fraudulent communications appear legitimate,” warns Packman.

Mitigating the quantum threat

With the risks in mind, it makes sense to start preparing to secure data now to mitigate the quantum threat. This means building cryptographic agility into the systems, suppliers and upgrade cycles organizations already rely on, experts say.

“Organizations need cryptography that is agile enough to evolve as standards mature, threats change, and new implementation requirements emerge,” advises Packman.

He believes preparation starts with understanding where quantum-vulnerable public-key cryptography is used, which systems are most exposed, and which suppliers' systems depend on.

Pamplin concurs. From there, companies should “prioritize long-life and high-value data”, rather than “trying to treat everything equally”, he advises.

“80% of your data loss risk sits within 20% of your applications. That is where you should focus first.”

NIST calls for vulnerable public key algorithms to start being deprecated after 2030 and generally disallowed after 2035. Yet preparation must come sooner, says Paul Holt, group VP EMEA at DigiCert.

He warns that the process of inventorying an organization’s use of cryptography across the enterprise, creating post-quantum roadmaps for each use case, and executing the transition “can span many years”.

At the same time, he points out that beyond understanding quantum, security leaders are “struggling to convince the rest of the business that budget and resources are needed now”.

This is where crypto-agility becomes essential, according to Holt. “Weathering the transition to a quantum-safe posture demands the ability to adapt and scale digital certificate management. Meanwhile, organizations must migrate cryptography to approved post-quantum algorithms.”

Finally, he says certificates must be “immediately discoverable and manageable continuously and at scale”.

Yet when considering quantum preparedness, it’s also important not to rush. The quality of implementation will matter just as much as the standards themselves,” says Packman.

“Replacing cryptography as part of a planned upgrade is cheaper and less disruptive than retrofitting it later under tighter deadlines.”

He believes every scheduled technology refresh is “a chance to introduce quantum-safe capability, assess supplier roadmaps, validate implementations or retire systems that may become difficult to support later”.

While quantum attacks are still likely to be some years away, experts think IT and security leaders should start to view the area as part of the bigger picture. Shortland believes quantum is increasingly a governance issue.

“Boards routinely assess climate, geopolitical and supply chain risk over a 10-year horizon,” Packman adds.

“Quantum belongs in that category because it has the potential to undermine decisions being made about data today.”

Microsoft has disrupted the EvilTokens cyber crime platform in a coordinated campaign that saw 50 websites seized and two men arrested in the UK.

The EvilTokens phishing as a service (PhaaS) platform emerged in February on Telegram, giving cyber criminals AI the ability to tailor phishing lures and analyze compromised inboxes to identify high-value targets.

In the short time it’s been up and running, the platform has been used to compromise more than 12,000 inboxes at more than 10,000 organizations.

Campaigns have targeted various industries, including wholesale distribution, construction, financial services, real estate, higher education, and healthcare, with most activity in the US, Canada, the UK, Australia, India, and France.

Customers paid a $1,500 fee up front to use the service, with a recurring $500 subscription for continued access to the kit and control panel.

This kit offered further products, including Antibot redirector, B2B Sender, Office 365 Capture Link, and a Simple Mail Transfer Protocol (SMTP) Sender, each of which carried additional monthly fees.

What hackers got with EvilTokens

Subscribers were offered personalized lures, with AI used to create targeted phishing emails that were specifically aligned to the target’s role.

According to Microsoft, themes used to increase the chances of a response included document signing services, its own cloud services, third-party services such as cloud identity, file hosting and payment or invoicing, as well as other miscellaneous services like voicemail and eFax.

Notably, the service was centered around an AI-style chatbot that could analyze a victim’s inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities, as well as other situations where fraud was most likely to succeed.

It could even recommend strategies for carrying out fraud, including drafting messages that impersonated trusted contacts to help criminals trick their victims into taking action.

"AI was not simply helping attackers write more convincing messages. It helped them decide who to target, who to impersonate, and how to most effectively exploit the relationship to extract as much money as possible," said Steven Masada, associate general counsel and general manager at Microsoft’s Digital Crimes Unit.

How Microsoft tackled EvilTokens

Microsoft, with authorization from the US District Court for the Eastern District of Virginia and the help of several other companies, has now seized 50 websites used to operate the service.

More than 150 other domains tied to its supporting infrastructure have also been seized.

"While EvilTokens used AI to identify targets and prioritize fraud opportunities, Microsoft investigators used reverse engineering and AI-powered tools to analyze evidence, accelerate the investigation, and identify the infrastructure supporting the service," Masada said.

Cloudflare, meanwhile, was able to identify the complete list of domain infrastructure and hundreds of Cloudflare accounts used by EvilTokens’ customers.

It carried out a technical sweep, blocking hundreds of domains and killing malicious Cloudflare Worker scripts. Where infrastructure couldn't be legally seized, it made use of interstitial warning pages.

As a result of the operation, the UK Metropolitan Police Service’s cyber crime team has now arrested two men, aged 32 and 38, suspected of being involved.

Authorities also seized digital devices and other items for examination. Both men have been released on police bail while the investigation continues.

FOLLOW US ON SOCIAL MEDIA

The National Cyber Security Centre (NCSC) has issued advice on how cybersecurity professionals can adopt agentic AI to help automate security tasks and manage risks.

Using AI automation for defense isn't generally about overcoming technical challenges, according to Dave Chismon, NCSC CTO for architecture, but more of a question of organizational politics, meaning that defenders can't simply put AI to work in the same way attackers can.

"This is an inconvenient truth, as it suggests that the threat from AI-enabled cyber attacks will grow, whilst autonomous / agentic cyber defense might struggle to keep up unless we approach things differently," he said.

"Rather than trying to mimic attackers’ use of agentic tooling (and risk breaking things), defenders need to solve the problem by explicitly considering the constraints."

Notably, the NCSC said automation can involve offensive techniques being applied defensively, such as penetration testing and vulnerability research or discovery.

This generally happens in a way that minimizes risks to the business; applications are tested before they go live, and vulnerabilities are handed to development teams to fix.

Elsewhere, technical and dynamic approaches can be used for cyber defence - but also need evaluating from a business point of view.

"Establishing a SOC is also typically a lengthy (and often expensive) process. Legal aspects and policies need to be agreed, and data then exported from live systems to a new platform where malicious activity can be detected and triaged before the team takes action," said Chismon.

Both mean doing a lot of work up front to show that vulnerability detection or missing patches won't harm the business.

A new framework for agentic AI adoption

To help with this, the NCSC has outlined a framework for estimating the 'riskiness' of a defensive action and identifying the lowest-risk actions that can be automated – these are often tasks that involve advising a human, rather than affecting a system directly.

Some of this will be covered by the government's planned Cyber Shield, a national-scale agentic cyber defence ecosystem, with its ‘AI for Cyber Defence’ problem book expected soon.

However, Chismon warned that more research is needed on agentic AI, particularly in terms of how to deterministically prove that ‘low risk’ actions really are low risk.

Examples include using AI to help analyse traffic logs and show conclusively that the organization does know all the routes clients connect by, or establishing whether AI can reverse engineer or otherwise assess a system and its binaries to show exactly which network calls it could ever make.

"Answering these questions will give us, and the organizations we protect, the confidence to take automated defensive actions. Furthermore, it opens up the chance to automate the hardening of systems and reduce attack surfaces and exposure, which will be crucial in combating AI-enabled cyber attacks," said Chismon.

"All these efforts will take time, effort, and research. Organizations cannot risk just waiting for agentic defence to roll in and protect them; they also need to be focussing on improving their security the traditional way."

FOLLOW US ON SOCIAL MEDIA