Binance, the world’s largest cryptocurrency exchange by trading volume, has confirmed that attackers stole an estimated $6.3 billion (around £4.7 billion) in digital assets on Thursday evening, in what is now the largest cryptocurrency theft on record. The figure is roughly four times the $1.5 billion taken from Bybit in February 2025, the previous record-holder.

According to blockchain intelligence firm TRM Labs, funds began leaving Binance wallets at around 20:05 UTC on 29 October, spread across ten blockchains including Ethereum, Bitcoin, Tron, the XRP Ledger and Solana. Most of the money was gone within roughly 20 minutes. Binance suspended deposits and withdrawals and, by late Thursday, said around $3 billion had been frozen with help from stablecoin issuers, partners, and law enforcement. Tether and Circle alone froze more than $2.5 billion in USDT and USDC.

Binance’s preliminary findings point to a compromised DevOps engineer’s laptop, which the exchange says gave an attacker access to a service container that could submit withdrawals. The company says it has found “no evidence of any wallet private key leak” and has promised a detailed technical post-mortem once its investigation concludes. Co-CEO Yi He said the exchange would cover all hacking losses, drawing on its Secure Asset Fund for Users (SAFU) and company funds.

Markets reacted quickly. Bitcoin fell around 5% to below $77,000 in the hours that followed, while Binance’s own BNB token dropped about 8%.

The vault held. The process didn’t.

For security professionals, the size of the theft is only part of the story. What sets this incident apart is where the attackers chose to strike.

“I’ve followed a lot of crypto thefts, and the Binance attack stands out less for the money than for how it was done,” said Jayant Dave, APAC CISO at Check Point. “The attackers didn’t break the encryption or steal the private keys. They took over the system that tells the keys what to sign.”

Dave continued: “Binance’s early findings for now point to one compromised engineer’s laptop. From there, the attackers reached a service that could submit withdrawals, and billions moved within minutes. That’s the lesson: a strong vault doesn’t matter if someone controls the process that opens it.”

TRM’s on-chain analysis supports that reading. On Ethereum, the attacker used EIP-7702 authorisations to make a Binance hot wallet execute a sweeper contract under their control, while the other nine chains saw ordinary signed transfers within the same window. TRM assesses that Binance’s hot wallet signing infrastructure was likely compromised, though the exchange has not yet published a root cause.

“The Binance attack raises an important question about how organisations protect their most valuable assets,” said Simon Pamplin, CTO at Certes. “If attackers can move billions of dollars without obtaining the private keys themselves, we need to examine the systems and trusted processes that gave them the ability to authorise those transactions.”

Samuel Hassine, CEO and co-founder at Filigran, agreed that the mundane nature of the entry point is what organisations should focus on. “The record figure will get the headlines, but the ordinary foothold is the lesson,” he said. “Binance says the attack may have started with a compromised engineer’s laptop, used to reach a service that submits withdrawals. It has since found further points of breach. By its own account, no wallet keys were stolen.”

Entry point or root cause?

Those further points of breach matter. Several experts cautioned against reducing a multi-billion-dollar compromise to a single infected device before the full investigation is complete.

“A compromised laptop may explain where an attack started, but it does not, on its own, explain how billions of dollars could leave an exchange,” said Pieter Arntz, researcher at Malwarebytes. “The real question is what allowed that initial foothold to become access to withdrawal systems — and which safeguards failed to stop unauthorised transactions.”

Arntz added: “Until the technical investigation is complete, blaming a single laptop risks confusing the entry point with the full cause of the breach.”

Certes’ Pamplin made the same point. “Initial reports of a compromised engineer’s laptop are significant, but Binance has already indicated that the intrusion involved additional points of breach. The investigation will need to establish how that initial access developed into the ability to initiate withdrawals at this scale,” he said. “The distinction matters because compromising a system that can legitimately instruct transactions may be just as damaging as stealing the credentials or keys used to secure it.”

For Pamplin, that is where long-held security assumptions start to break down. “This is where conventional security assumptions become dangerous. Organisations can have encryption, authentication and access controls in place, yet remain exposed if a compromised application or authorised process can operate within those controls. The real question is what an attacker can reach, read or instruct once that trusted environment is compromised.”

“It reportedly only took one laptop”

Whatever the full chain of events turns out to be, the image of a single endpoint leading to billions in losses has struck a nerve.

“Billions of dollars have been stolen from Binance in a matter of minutes by hackers taking control of the process that authorises withdrawals. And it reportedly only took one laptop,” said Chris Dimitriadis, Chief Global Strategy Officer at ISACA. “It’s a stark reminder that you can spend a fortune protecting your most critical systems, but if just one device is compromised, then your security is only as strong as the weakest machine on the network.”

Camellia Chan, CEO and co-founder of X-PHY, put it bluntly: “The biggest cryptocurrency heist in history may have started with a single compromised laptop. Such is the sophistication of hackers, that that’s all it can take.” She added that “Attackers are constantly looking for ways in, and for organisations handling sensitive financial information or critical infrastructure, employee laptops are particularly valuable targets.”

“The reported cyberattack on Binance is staggering in both its scale and potential consequences,” said Jamie Akhtar, CEO and co-founder of CyberSmart. “The fact that cybercriminals were reportedly able to move billions in digital assets in a matter of minutes demonstrates just how devastating a successful attack can be.” For businesses, he said, “this is a powerful reminder that even the largest organisations with significant cybersecurity resources are not immune to attacks.”

Jake Madders, co-founder and director of Hyve Managed Hosting, framed the incident as a question of access rather than defences. “The cyberattack affecting Binance highlights how attackers don’t always need to break through the front door. Sometimes, they simply exploit the people and systems already holding the keys,” he said.

“Binance says initial checks suggest a compromised engineer’s laptop may have given attackers access to internal systems, enabling unauthorised withdrawals. This raises important questions about how access to critical systems is managed. Protecting where assets are stored is not enough if the routes into them are not equally secure.”

The North Korea question

TRM Labs has attributed the attack “with high confidence” to TraderTraitor, a North Korean state-backed hacking unit linked to the Lazarus Group. The firm points to small Tornado Cash withdrawals used to fund an operator wallet the day before the theft, along with staging and pre-obtained signatures that echo earlier DPRK-linked heists. Independent investigator ZachXBT has also named Lazarus as the likely attacker.

“Blockchain analysts have linked the attack to TraderTraitor, the North Korean state-backed group behind the 2025 Bybit theft,” said Check Point’s Dave. “Governments haven’t confirmed that yet, but it fits a group that goes after people and processes, not cryptography.”

Binance is not the only major exchange hit this autumn. In September, Bitget lost close to $388 million in a breach its chief executive also blamed on North Korea. “This attack isn’t a one-off either – five weeks ago, Bitget lost around USD 388 million the same way: keys untouched, control layer abused,” Dave said. “Two major exchanges in just over a month is a trend we cannot ignore.”

Tim Rawlins, senior adviser and security director at NCC Group, said the targeting of a development engineer fits a well-established pattern. “This attack, reportedly on a development engineer, highlights that security is a critical element of every operational stage and personnel level. When security failures in trusted identities and administrative access can be targeted, attackers can exploit more than just the underlying technical vulnerabilities,” he said.

“Given what we know about the activities of countries like North Korea in targeting cryptocurrency, it’s unsurprising that attackers are prepared to invest considerable effort in targeting individuals who have access to the building blocks of the exchanges.”

Rawlins also flagged the role of artificial intelligence in accelerating these campaigns. “The increasing use of AI in attacks is supporting attackers to chain issues together in a way that might take them longer alone. Organisations are facing adversaries who are prepared to invest time and money to compromise their systems, if the return is large enough.”

ISACA’s Dimitriadis echoed that view: “Hacker groups are often well resourced and patient, and they know how to target people. Organisations, particularly in financial services, that hold high-value assets must assume a breach will happen and plan for it ahead of time.”

The stakes go beyond the exchange itself. TRM’s head of global policy, Ari Redbord, described the attack as “unprecedented”, warning that “When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity.”

Not just a crypto problem

It would be easy to treat the incident as a niche concern for crypto traders. Experts warn that would be a mistake.

“For the public, the message is uncomfortable but important,” said Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress. “Your crypto holdings, your investment portfolio, and your pension fund’s exposure to digital assets can all be materially affected by a security failure at an institution.”

Patel said the market reaction in the hours after the theft showed how far the consequences can travel. “When a cybersecurity incident sends shockwaves through crypto global markets, cybersecurity stops being a tech problem and starts being a systemic financial risk.”

CyberSmart’s Akhtar agreed: “Beyond the financial losses, an incident of this magnitude raises serious concerns about the security of digital financial infrastructure and the potential consequences when highly sophisticated attackers gain access to critical systems.”

For Check Point’s Dave, the same weakness exists well outside the crypto sector. “This goes well beyond crypto. Banks, payment providers, cloud platforms: any organisation whose automated systems move money or data on instruction carries the same risk,” he said. “Attackers have learned that the shortest route to the crown jewels often runs through one employee’s laptop and a trusted internal service.”

Ordinary users also face knock-on risks. “This incident affects trust in cryptocurrency as a whole,” said Dimitriadis. “And high-profile incidents like this are often exploited by hackers on other platforms to trick users into taking immediate action that could compromise their crypto assets.”

Spencer Starkey, Executive VP EMEA at SonicWall, noted that exchanges have long been in attackers’ sights. “Cryptocurrency exchanges are a popular target for cyberattacks, as they hold large amounts of valuable cryptocurrency. Cybercriminals will target cryptocurrency exchanges to steal cryptocurrency, disrupt operations, or even manipulate cryptocurrency prices,” he said.

Starkey placed the Binance theft alongside a run of disruptive attacks closer to home. “Look at the last few weeks. Hackers pushed supermarket fridges across Europe to 50C, destroying food and starting fires. Criminals stole Legal Aid Agency records going back decades, including probation data. A GP dispensary couldn’t order medicines. Cybercriminals won’t wait for procurement to catch up.”

Dimitriadis argued that responsibility for this kind of risk sits at the very top of an organisation. “This is ultimately a governance question, and it belongs in the boardroom, not just the security team. The fallout from an incident like this goes far beyond the money stolen – market confidence drops, customers move their assets elsewhere and regulators start asking questions.”

Closing the gap

So what should organisations that move money, or data, on instruction be doing now? The experts were broadly aligned: protect privileged people and devices, assume compromise, and make sure no single foothold can translate into unchecked authority.

“So, protect the people with the most access first,” said Dave. “Treat developer and admin devices as high-value targets. Assume any machine or credential can be compromised and make sure none of them can move large sums without an independent check.”

Speed and limits matter as much as prevention, he added. “Set hard limits on how much and how fast funds can move, and catch anomalies in seconds, not hours. Prevention has to come first, because once money spreads across multiple blockchains, getting it back is the exception.”

NCC Group’s Rawlins stressed the basics. “As we have seen with many of the attacks against crypto exchanges and other platforms, good cyber hygiene and effective security fundamentals are key to defending against attacks that many organisations are still missing,” he said. “Securing trusted identities so funds can’t be moved unchallenged or other privileges exploited comes down to having phishing-resistant MFAs, just in time privileged access, tightly scoped and monitored human and non-human identities, and detection in place for anomalous activities.”

Hyve’s Madders called for a stricter approach to access across the board. “The rule should be simple. People should only have access to the data and systems they need to do their jobs. This access should be tightly controlled, monitored, and removed as soon as it is no longer required. The same discipline must apply to external partners and third-party providers, whose access can create additional entry points for attackers.”

“The Binance incident shows why access management needs to be treated as a fundamental part of cybersecurity, not an administrative afterthought,” he continued. “Ultimately, strong security depends on understanding who has access and what they can reach, not just protecting what is behind the door.”

Certes’ Pamplin argued that controls need to sit closer to the transactions themselves. “Security needs to be enforced at the level of individual data flows and critical transactions, with cryptographic separation between systems and tightly controlled paths for sensitive operations. An attacker gaining access to one part of the environment should not automatically inherit the ability to move valuable assets across the rest of it.”

Filigran’s Hassine urged organisations to map and test their own exposure. “Any company whose systems move money on instruction should know exactly which machines and accounts can trigger a transfer. Assume one of them will be compromised one day, and test whether the controls behind it hold.”

CyberSmart’s Akhtar set out a similar checklist. “Protecting employee devices, implementing strong access controls and multi-factor authentication, and continuously monitoring for suspicious activity should be fundamental priorities. Organisations handling financial assets must also have additional safeguards in place, including strict transaction authorisation processes and controls that limit the damage a single compromised account or device can cause,” he said. “Employee cybersecurity awareness training is equally important, as attackers often exploit human vulnerabilities to gain their initial foothold.”

X-PHY’s Chan agreed that training is necessary but not sufficient. “Businesses can train employees to recognise the warning signs of a cyberattack and if their devices are compromised, but cybersecurity capabilities must also be built into every layer of protection, starting with the hardware itself.”

And for ISACA’s Dimitriadis, it comes back to leadership: “Good governance and building resilience mean the board treating cyber risk as a standing priority, investing in the right skills and making sure every employee is trained to recognise and resist targeted attacks.”

Freezes, compensation and the road to recovery

If there is a positive in the response so far, it is the speed with which a significant share of the stolen funds was frozen. “The estimated impact is around $6.3bn, four times the previous record. About $3bn was frozen within hours, with partners and law enforcement,” said Hassine. “That coordination is the part working well.”

The rest is a different matter. TRM estimates the attacker still controls more than $2.4 billion in ether and bitcoin, and has already begun moving funds through decentralised exchanges and lending protocols including Uniswap, Aave and JustLend.

“Credit to Binance for freezing funds quickly and committing to cover customer losses,” said Dave. “But the industry can’t keep relying on clean-up.”

Binance’s pledge to make customers whole is significant, because crypto users have far less protection than bank customers if an exchange cannot or will not pay. “Unlike money held in a UK bank account, which may be protected by the Financial Services Compensation Scheme (FSCS) up to £120,000 per eligible depositor, cryptoassets generally do not benefit from any equivalent compensation regime,” said James Broomhall, Senior Associate at Grosvenor Law.

“As a result, victims of major crypto thefts are often forced to pursue urgent tracing and recovery action through the courts, including Norwich Pharmacal applications to compel exchanges and other third parties to disclose information identifying fraudsters and tracing the movement of stolen assets.”

What comes next

Binance’s post-mortem should eventually show how a single endpoint became the ability to empty hot wallets across ten blockchains. Until then, much remains unknown.

“As the investigation develops, we’ll gain a clearer understanding of how this attack unfolded,” said Chan. “But the key takeaway for businesses is already clear: security needs to be built into the very foundations of their systems, because there are no limits to the depths attackers will go to find a way in.”

Pamplin agreed that organisations should not wait for the final report before acting. “The scale of this incident makes the consequences impossible to ignore. Security must be designed around the assumption that trusted systems can be compromised, with controls that prevent that compromise from becoming unrestricted authority over the assets they protect.”

Or, as Hassine put it: “Record thefts start with ordinary footholds.”

Dave’s warning may be the one that lingers longest: “The next attack will target the same weak point unless we close it first.”

The post Binance’s $6.3bn heist: how one laptop opened the door to the biggest crypto theft in history appeared first on IT Security Guru.

As artificial intelligence becomes more widely adopted, cybersecurity professionals are facing growing pressure to develop new skills, understand emerging risks and keep pace with technologies that are changing faster than traditional training programmes can respond.

Speaking to IT Security Guru, Matthew Piddington from ISC2 discussed the organisation’s plans to introduce its first dedicated AI security certification, alongside the wider challenges facing the cybersecurity profession.

ISC2 is a global not-for-profit organisation representing approximately 270,000 cybersecurity professionals. It provides professional development opportunities and nine certifications, including the internationally recognised Certified Information Systems Security Professional (CISSP) qualification.

A New Certification for AI Security

One of ISC2’s biggest priorities has been developing a dedicated certification focused on AI security.

More than 7,000 volunteers from around the world are currently helping to shape the certification, including defining the examination content, relevant job roles and the knowledge professionals will need to demonstrate.

According to Piddington, the initiative responds to growing demand from both cybersecurity and AI professionals for clearer governance and recognised standards around AI security.

ISC2 hopes the qualification will eventually achieve the same level of industry recognition as CISSP, which has been established for approximately 30 years.

The organisation is targeting the first beta examinations for the first quarter of 2027, with a wider rollout planned from April onwards.

Cyber Warfare, AI and Quantum Computing

Beyond certification, Matthew highlighted several issues keeping cybersecurity professionals on alert.

Geopolitical tensions remain a significant concern, particularly as cyber warfare becomes an increasingly important consideration during periods of international conflict. Security teams must remain prepared for vulnerabilities being exploited, regardless of the sectors in which they operate.

AI is creating another challenge. Its rapid adoption is introducing new security risks, while the pace of technological development is making it difficult for organisations and professionals to keep up.

Looking further ahead, ISC2 is also considering the implications of quantum computing and the skills cybersecurity professionals will need to address future threats.

For Matthew, ensuring the industry has the right expertise is essential to building a safer digital future.

Watch the full interview to hear more about ISC2’s AI security certification, the changing cybersecurity skills landscape and the threats shaping the profession’s future.

 

The post ISC2 Launches New AI Security Certification as Cyber Skills Demands Grow appeared first on IT Security Guru.

Salt Security has announced Autonomous Defense for its Agentic Security Platform, expanding its Salt Workflows capabilities to automate threat containment, enforcement and remediation. The update enables security teams to trigger actions such as blocking malicious activity, revoking risky access and initiating configuration changes through existing enterprise tools.

The announcement addresses the delay between detecting a threat and taking action. Salt says response processes often depend on manual handovers across disconnected systems, leaving risks unresolved while teams investigate alerts and raise tickets. As AI accelerates the discovery and exploitation of weaknesses, the company argues that these delays can increase exposure.

“Security cannot move at ticket speed when attackers move at machine speed,” said Aner Gelman, VP Product at Salt Security. “Autonomous Defense turns Salt’s security intelligence into action, from blocking malicious activity and revoking risky access to enforcing protections through controls enterprises already use.”

The capabilities draw on Salt’s Agentic Security Graph, which connects AI agents, Model Context Protocol (MCP) servers, tools and downstream APIs with information from source code, configurations, exposure and runtime behaviour. This context helps identify potentially dangerous paths through an organisation’s systems and informs the responses customers choose to automate.

Through Salt Workflows and supported connected controls, security teams can disable unauthorised MCP connections, quarantine shadow tools and remove excessive privileges. They can also push blocking rules to web application firewalls and API gateways, update AI guardrail policies, or trigger configuration changes to address exposed APIs and missing rate limits.

Customers determine which findings trigger immediate action and which changes require approval. They also select the enforcement points used, allowing teams to retain oversight of sensitive operations and maintain an audit trail. Ticketing, notifications and SIEM enrichment remain available as part of the response process.

Salt has embedded a visual, drag-and-drop workflow builder into the platform, supported by more than 200 out-of-the-box connectors and a marketplace of Salt-built integrations. According to the company, workflows can span security, infrastructure, IT and collaboration systems without requiring customers to standardise on a single gateway, agent framework or response product.

“An alert doesn’t stop an attack. Action does,” said Roey Eliyahu, co-founder and CEO of Salt Security. “Salt secures the entire agentic path, from AI agents and MCPs to downstream APIs. Autonomous Defense puts that intelligence to work, helping security teams stop attacks and close dangerous paths before they cause business impact.”

Salt Workflows is available to Salt Security customers now. The company is migrating existing workflows to the new experience, with support for customer-specific requirements. Automated actions depend on customers’ policies and the capabilities of their connected enforcement tools.

The post Salt Security adds autonomous defence capabilities to agentic security platform appeared first on IT Security Guru.

Highland Spring Group, the business behind the UK’s number one bottled water brand, has selected Acumen Cyber to provide round-the-clock cybersecurity monitoring, threat detection and incident response.

The partnership will see Glasgow-based Acumen Cyber deliver its managed security services to Highland Spring, helping the company strengthen its existing defences while giving its internal IT team more time to focus on strategic security improvements.

Founded in 1979 and headquartered in Blackford, Perthshire, Highland Spring Group produces approximately 600 million litres of bottled water annually and employs around 500 people.

The company has already invested significantly in its IT infrastructure and cybersecurity capabilities but recognised the need for additional specialist support to maintain continuous monitoring and respond to emerging threats.

Strengthening Cybersecurity Across Operations

Under the agreement, Acumen Cyber will provide 24/7 threat monitoring, investigation and response through its CREST-accredited Security Operations Centre (SOC) in Glasgow.

The service combines security information and event management (SIEM), automation, threat intelligence and proactive threat hunting to help identify and respond to suspicious activity.

Highland Spring’s IT team will work directly with UK-based security engineers, providing access to specialist expertise without having to manage round-the-clock security operations internally.

The partnership is also intended to improve visibility of security risks and give Highland Spring’s team more capacity to strengthen infrastructure, address vulnerabilities and develop its longer-term cybersecurity strategy.

Tracy Holbein, Group IT Manager at Highland Spring Group, said maintaining reliable operations was central to the decision.

“Keeping our operations running reliably is essential to Highland Spring. This partnership will give us round-the-clock specialist support and more time for our own team to focus on preventing problems and strengthening our security.”

She added: “Acumen stood out because of the rapport between our teams and their enthusiasm for working with us. That gave us confidence that we could build a close and productive partnership.”

Engineer-Led Security Proves Deciding Factor

Highland Spring selected Acumen Cyber following an extensive tender process, with the provider’s technical expertise, engineer-led approach and security platform playing an important role in the decision.

The ability to work directly with the engineers responsible for delivering the service was particularly attractive, alongside Acumen’s CREST accreditation and fixed, predictable pricing.

Another deciding factor was Acumen’s approach to continuously validating security controls against real-world attack techniques, helping customers understand how effectively their defences would perform during an actual incident.

Mark Robertson, CEO of Acumen Cyber, said the partnership would focus on building a close working relationship with Highland Spring’s existing team.

“Our role is to work as an extension of Highland Spring’s team, with named security engineers who understand the business and take responsibility for strengthening its defences.”

He added: “That means continually improving protection as threats evolve and backing confidence with evidence. We continuously validate our detection capabilities against real-world attack techniques, using the findings to improve the security we deliver.”

Supporting Long-Term Cyber Resilience

The agreement reflects Highland Spring’s continued investment in cybersecurity as part of its wider business operations.

For businesses with complex production, distribution and supply chain requirements, maintaining reliable systems and access to specialist security expertise is an important consideration.

Acumen Cyber’s managed detection and response service is designed to provide continuous oversight while helping internal teams take a more proactive approach to identifying and reducing cyber risk.

The partnership also builds on Acumen’s growing customer portfolio, with the company providing managed cybersecurity, continuous security testing, incident response, threat intelligence and strategic advisory services from its Glasgow headquarters.

The post Highland Spring Appoints Acumen Cyber for 24/7 Cyber Protection appeared first on IT Security Guru.

Application security vendor Black Duck has launched Signal Agentic Fix, a new AI agent designed to shrink the gap between vulnerability discovery and a validated fix reaching production.

The agent is the latest addition to Black Duck Signal, the company’s collection of AI agents aimed at removing the human workflow bottlenecks that stop security teams keeping pace with the rising volume of vulnerabilities and exploits.

Black Duck says the launch responds to two pressures that AI has intensified for defenders. The first is a swelling remediation backlog, fuelled by the surge in AI-generated code, the higher vulnerability rates found in that code, and a steady flood of new supply chain CVEs. The second is a collapsing time to exploit: attackers are now using AI to chain and weaponise vulnerabilities in hours, while human-led remediation is still typically measured in days or weeks.

Scan, triage, fix, validate, submit

Signal Agentic Fix automates the full remediation loop:

• Scan: Black Duck’s deterministic SAST and SCA engines – the same ones behind Polaris, Coverity and Black Duck SCA – identify defects in proprietary code and open source dependencies.
• Triage: AI assesses severity, reachability and exploitability, filtering out false positives and prioritising the highest-risk issues.
• Fix: AI generates code fixes for SAST findings, while SCA findings receive dependency upgrade fixes based on Black Duck Security Advisories, informed by the company’s ContextAI knowledge base.
• Validate: Fixed code is re-scanned and can optionally be run against customer-defined compliance checks and functional tests to confirm no new defects have been introduced.
• Submit: Every change is routed to a human for review, either via the developer’s AI coding agent or as a pull request in source control.

“The differentiator is not that AI can write a fix; it’s whether you can trust it,” said Dipto Chakravarty, Chief Product & Technology Officer at Black Duck. “A harness that pairs deterministic static and software composition analysis with AI-powered triage, fix generation, and validation, plus human-defined guardrails and approval gates is what makes agentic remediation something enterprises can actually trust and deploy.”

Two deployment models

The agent can work as a security collaborator alongside a developer and their AI coding agent, such as Claude Code. In this mode, Signal Agentic Fix runs the scans and triage, passes findings and fix guidance to the coding agent to implement, then re-scans to validate the result. Because the coding agent makes the change, it is governed by the same hooks and skills a team already uses for code generation.

Alternatively, it can sit in the DevOps pipeline, triggering the remediation loop on commits, builds or on demand, generating fixes with a configured LLM and submitting them as pull requests for team approval.

For organisations in regulated and safety-critical sectors, Black Duck has built in configurable remediation rules governing what the agent may fix and how, validation rules that let teams apply their own coding and compliance standards and test suites, and mandatory human-in-the-loop approval before anything is merged.

Availability

Signal Agentic Fix for Claude Code is available in Early Access now, with further coding agent and DevOps pipeline integrations across Polaris, Coverity and Black Duck SCA due in the coming weeks.

The post Black Duck launches AI agent to fix vulnerabilities as fast as attackers exploit them appeared first on IT Security Guru.

Check Point Software Technologies has announced the launch of Firewall-as-a-Subscription, a new offering designed to make advanced AI-powered network security more accessible to organisations without requiring a significant upfront hardware investment.

The new subscription model gives businesses access to Check Point Force Firewalls, AI-powered threat prevention and agentic security management through predictable monthly or annual payments. The offering is designed to help organisations modernise their network defences while managing increasingly constrained cybersecurity budgets.

The announcement comes as businesses face growing financial pressures, with inflation and higher borrowing costs forcing many to delay infrastructure upgrades. According to the IANS Research and Artico Search 2026 Security Budget Benchmark, the median cybersecurity budget remained unchanged this year, with 55% of CISOs reporting flat or declining budgets. Although 64% requested additional funding, just 45% received an increase.

These financial constraints are emerging at a time when AI adoption is introducing new challenges for network security, including the need to inspect AI-generated traffic, protect AI applications and monitor autonomous agents.

Check Point’s Firewall-as-a-Subscription aims to address these challenges by removing the need for large capital investments, allowing organisations to access advanced security capabilities through a subscription-based model.

The offering builds on Check Point’s R82.20 release, introduced in July 2026, which brought AI Network Firewall capabilities designed to inspect AI traffic, protect AI applications and help govern AI agents at the network layer.

The subscription includes Check Point Force Firewalls, with capacity and pricing based on the threat prevention throughput required by each organisation. Customers also receive AI-powered threat prevention, including SandBlast technology, which Check Point claims achieves a 99.9% block rate against zero-day attacks.

Additional features include Live Updates, which enable security updates without reboots or downtime, and Smart-1 cloud-based agentic management. The package also includes 24/7 premium support and professional services credits to assist with activities such as migrating firewall policies from other vendors.

Under the three-year subscription, organisations can increase their firewall throughput as their requirements evolve, with the option to move to new hardware after 36 months.

Pete Finalle, Research Manager, Security and Trust at IDC, commented on the growing demand for more flexible security purchasing models.

“Organizations of all sizes face the same AI-driven threats, but for many, capital budget cycles often force them to delay firewall refreshes or buy more capacity than they need,” he said.

“Consumption models that turn on-premises security hardware into a predictable operating expense, and let organizations scale protection as their needs grow, can help close that gap. We expect demand for this kind of flexibility to rise as AI adoption increases the traffic and risk networks must handle.”

The subscription model could also provide opportunities for channel partners to help customers progress firewall refresh projects that have been delayed by capital expenditure restrictions.

Avi Rembaum, President Global Technical Sales at Check Point Software Technologies, said: “Every organization is adopting AI, and every organization deserves the same level of protection, whatever its size or budget.

“With Firewall-as-a-Subscription, we are making our most advanced AI security, threat prevention and agentic management available through one simple subscription, so organizations can secure their AI transformation today.”

Check Point Firewall-as-a-Subscription will be available from 1 November 2026 through Check Point’s partner network, with monthly and annual payment options.

The post Check Point Launches Firewall-as-a-Subscription as Cybersecurity Budgets Face Growing Pressure appeared first on IT Security Guru.

UK cybersecurity specialist WorkNest Secure has achieved Accredited Organisation status under The Cyber Scheme, providing further independent recognition of the technical expertise and professional standards maintained across its services.

The accreditation recognises organisations that demonstrate professional competence, quality and alignment with established cybersecurity industry standards. It also places particular emphasis on the qualifications and capabilities of the professionals delivering those services.

For WorkNest Secure, the latest recognition builds on its existing technical accreditations and reflects its continued investment in developing and maintaining a highly skilled cybersecurity workforce.

Independent Recognition of Cybersecurity Expertise

The Cyber Scheme is a Licensed Body of the UK Cyber Security Council and works to assess and recognise cybersecurity professionals against established industry standards.

Its Accredited Company Programme is designed to give businesses greater confidence when selecting cybersecurity service providers by linking organisational accreditation to independently verified workforce capabilities.

Unlike certifications focused primarily on processes or technical controls, the programme places significant importance on the people delivering cybersecurity services and their professional competence.

WorkNest Secure already has a number of penetration testing consultants who hold individual accreditations through The Cyber Scheme, making company-wide recognition a natural progression.

Jordan Constantine, Head of Offensive Security at WorkNest Secure, said the accreditation provides customers with independent evidence of the team’s capabilities.

“Becoming accredited under The Cyber Scheme felt like a natural step for WorkNest Secure. It’s one thing to say our team meets a high standard; it’s another to have that verified independently, and many of our penetration testing consultants are accredited under their scheme.”

He added: “Their assessments are respected across government and industry, and that gives our clients real confidence in the people testing their systems. It’s proof, not just a claim.”

Building Trust in Cybersecurity Services

The accreditation comes as organisations increasingly rely on external cybersecurity specialists to help identify vulnerabilities, assess risks and strengthen their defences.

With businesses placing considerable trust in third-party providers, independently verified qualifications and professional standards can provide an important measure of assurance.

Kirsty Fowler, Managing Director of WorkNest Secure, believes the expertise of cybersecurity professionals remains central to delivering effective security services.

“Cybersecurity is a people business. Technology is incredibly important, but customers also need to know that the people testing their systems, advising their teams and helping them respond to risk have the right expertise behind them.”

She added that the accreditation also reflects the company’s commitment to supporting professional development.

“Achieving the Cyber Scheme accreditation gives our customers another level of independent assurance and reflects the investment we continue to make in our people.”

Supporting Continued Growth

WorkNest Secure was formed following the integration of Pentest People and Bulletproof under the WorkNest Group, bringing together expertise across penetration testing, red teaming, attack simulation, information security, data protection and compliance.

The company also provides GuardNest, its proprietary vulnerability management platform, which combines vulnerability visibility, threat intelligence and compliance capabilities.

WorkNest Secure holds CREST and CHECK accreditations for penetration testing and recently achieved CREST STAR-FS accreditation for intelligence-led red teaming within financial services.

The latest accreditation adds to these credentials as the company continues to develop its technical capabilities and strengthen its position in the UK cybersecurity services market.

WorkNest Secure forms part of WorkNest Group, which employs more than 800 people and supports over 50,000 customers across ten countries.

The post WorkNest Secure Gains The Cyber Scheme Accreditation appeared first on IT Security Guru.

Cybersecurity company Huntress has expanded its distribution partnership with Ingram Micro into Canada, Latin America and the Caribbean, strengthening its channel presence across the Americas.

Building on its existing relationship in the United States, the agreement gives Huntress a single distribution route across the region, making it easier for managed service providers (MSPs) and value-added resellers (VARs) to access and deliver its cybersecurity services.

The expansion comes as Huntress continues to grow internationally, following increased investment in its channel operations across Europe, Africa, Australia and New Zealand.

Simplifying Cybersecurity Distribution Across the Americas

By extending its relationship with Ingram Micro, Huntress aims to reduce the complexity of working across multiple markets while taking advantage of the distributor’s established local infrastructure and partner relationships.

For MSPs and resellers, the agreement provides a more straightforward route to sourcing Huntress products and services through a familiar distribution partner.

Kevin Hallmark, Head of Global Distribution at Huntress, said the move would help the company reach more businesses through its channel partners.

“Partners are central to scaling our mission to protect all businesses, and expanding our relationship with Ingram Micro across the Americas gives more partners a simple, familiar path to Huntress.”

He added: “With coverage across the U.S., Canada, and Latin America through a single distributor, we can move faster to deliver stronger security to the businesses targeted by cybercrime.”

New Opportunities for Canadian MSPs

In Canada, the expanded agreement will allow MSPs and VARs to access Huntress through Ingram Micro’s existing distribution network.

The partnership is designed to help Canadian partners strengthen their cybersecurity portfolios without adding unnecessary complexity to their operations.

Alistair Edmondson, Director of Advanced Solutions at Ingram Micro Canada, said the addition of Huntress would support partners looking to expand their managed security offerings.

“Canadian partners are looking for security solutions that strengthen the protection they deliver without adding unnecessary complexity to their businesses.”

He added that bringing Huntress into Ingram Micro’s cybersecurity portfolio would help partners deliver managed security services while building businesses that can scale.

Supporting Growth Across Latin America

The agreement also extends Huntress’ reach across Latin America and the Caribbean, where differing legal, commercial and regulatory requirements can make regional expansion challenging.

Through Ingram Micro’s export division, Huntress will be able to work with a single distribution partner rather than establishing separate agreements in individual countries.

Daniela Rosa, Vice President and Country Chief Executive for Latin America at Ingram Micro, said the expansion would provide partners with greater access to cybersecurity technology.

“Our partners in Latin America are looking for technology relationships that can scale across borders while supporting the realities of doing business locally.”

She added that the agreement would help partners extend enterprise-grade cybersecurity protection to more customers across the region.

Access to Huntress’ Agentic Security Platform

Under the expanded partnership, Ingram Micro channel partners will gain access to the Huntress Agentic Security Platform, supported by the company’s 24/7 AI-centric Security Operations Centre (SOC).

The platform combines protection across endpoints, identities, logs, security posture and employee behaviour with human-led security expertise.

It also incorporates Athena, Huntress’ agentic investigation system, which uses AI to investigate suspicious activity at machine speed while working alongside security analysts to identify and respond to complex threats.

Huntress currently protects more than 280,000 businesses globally, with MSPs and resellers playing a central role in delivering its managed cybersecurity services.

The latest agreement strengthens the company’s distribution network across the Americas as it looks to make managed security more accessible to partners and the organisations they support.

The post Huntress Expands Ingram Micro Partnership Across Canada and Latin America appeared first on IT Security Guru.

UK-based secure data exchange specialist DOQEX has achieved Cyber Essentials certification, adding another recognised security standard to its existing portfolio of accreditations.

The York-based company, which specialises in protecting sensitive information shared between organisations, already holds ISO 27001, ISO 27017 and ISO 27018 certifications. The latest achievement reflects its continued focus on maintaining strong security controls and protecting customer information.

Cyber Essentials is a UK Government-backed scheme designed to help businesses defend themselves against common cyber threats. It assesses five fundamental areas of cybersecurity: firewalls, secure configuration, security update management, user access control and malware protection.

Getting the Cybersecurity Basics Right

While DOQEX already operates under established international security standards, the company said completing the Cyber Essentials certification process provided a valuable opportunity to revisit its existing controls.

Nick Case, Director and Co-Founder of DOQEX, admitted that the company had initially underestimated the process.

“Having already achieved ISO 27001, ISO 27017 and ISO 27018, I’ll admit we initially underestimated Cyber Essentials. We thought we had the fundamentals well covered, but going through the process reminded us why they matter.”

He explained that the certification’s emphasis on practical security measures provided an important reminder that even organisations with mature cybersecurity programmes need to regularly assess their defences.

“Cyber Essentials has a clear focus on practical, verifiable security controls, and that has genuine value. It’s easy to concentrate on more complex security challenges, but the basics still need attention.”

The certification comes as organisations face increasing pressure to demonstrate that appropriate security measures are in place, particularly when handling sensitive business information or working with external suppliers.

Strengthening Trust Across the Supply Chain

As businesses become more reliant on third-party technology providers and external partners, cybersecurity certifications are playing a growing role in procurement decisions and supplier assurance.

Recognised standards can help organisations demonstrate that they have implemented appropriate safeguards, providing customers and partners with greater confidence in how their information is managed.

Case believes improving baseline security across UK businesses is particularly important as supply chains become more interconnected.

“We fully support what Cyber Essentials is trying to achieve. Raising the baseline of cybersecurity across UK businesses is important, particularly as organisations become increasingly dependent on suppliers and third parties. Stronger security across the supply chain benefits everyone.”

Supporting Secure Data Exchange

Founded in 2013, DOQEX helps organisations securely manage and exchange sensitive information between employees, customers, suppliers and business partners.

Its services combine security technology with managed support, helping businesses maintain control over information as it moves between organisations.

The Cyber Essentials certification builds on the company’s existing ISO standards and reinforces its approach to security governance, accountability and data protection.

For DOQEX, the achievement also highlights a wider message for businesses: while cybersecurity threats continue to become more sophisticated, maintaining effective fundamental controls remains an essential part of protecting sensitive information.

The post DOQEX Achieves Cyber Essentials Certification to Strengthen Security Standards appeared first on IT Security Guru.

Cybersecurity researchers at Forescout are drawing attention to the risks posed by exposed refrigeration control systems, warning that weaknesses in operational technology (OT) could have serious consequences for food supplies, business continuity and other temperature-sensitive operations.

The warning comes following cyberattacks against French supermarkets in October 2026, which reportedly disrupted refrigeration systems at hundreds of stores. Attackers were able to interfere with cooling operations, resulting in temperature fluctuations, spoiled stock and significant disruption.

The incidents have raised concerns about the security of internet-connected refrigeration equipment, particularly where older systems, exposed management interfaces and inadequate access controls leave operational technology vulnerable to interference.

Unlike conventional IT attacks, which frequently focus on stealing data or disrupting digital services, attacks against refrigeration controllers can directly affect physical processes.

These systems are responsible for maintaining temperatures across supermarkets, food storage facilities and other environments where consistent cooling is essential.

If attackers gain sufficient access, they may be able to manipulate temperature settings, interfere with defrost cycles or disrupt equipment operations. The consequences can extend beyond IT downtime to include damaged stock, financial losses and potential safety risks.

The issue also extends beyond food retail. Refrigeration and temperature-control systems are used in healthcare, pharmaceuticals, manufacturing and logistics, making their security an important consideration across several industries.

Internet Exposure Creates Opportunities for Attackers

One of the central concerns is the accessibility of operational technology that was not originally designed to withstand direct exposure to the internet.

Remote management capabilities allow engineers and third-party maintenance providers to monitor and adjust refrigeration equipment without visiting individual sites. However, these connections can introduce security weaknesses if they are poorly configured or inadequately protected.

Research into industrial control systems has identified publicly accessible management interfaces, outdated firmware and weak authentication as recurring problems.

In some cases, organisations may not have complete visibility of the equipment connected to their networks, particularly where systems have been installed and maintained by external contractors.

Forescout Finds Nearly 13,000 Exposed Refrigeration Services Worldwide

New research from Forescout’s Vedere Labs has identified 12,976 internet-exposed service observations across ten product groups, associated with 6,017 distinct public IP addresses in 99 countries and territories.

The findings suggest that the weaknesses highlighted by the French supermarket attacks are part of a much wider global problem.

The largest number of observations involved Copeland/Dixell XWEB services, with 7,075 recorded, followed by 4,697 Danfoss StoreView services. Researchers also identified 551 Copeland Site Supervisor services, 513 Carel pCOWeb services and 140 observations across six other product groups.

Importantly, these figures represent exposed services rather than confirmed compromised devices. A single IP address may host multiple services, while one management interface may control several downstream systems.

The researchers also found that 3,762 Danfoss StoreView service observations, representing 80% of the total, were running firmware older than version 4.3.1, making them potentially vulnerable to two previously disclosed security flaws.

Hacktivists Have Targeted Refrigeration Before

Forescout’s research suggests that attacks against refrigeration systems are not a new development.

According to a technical bulletin published by Danfoss, hacktivist attacks in 2022 affected 16 Russian supermarkets and 40 stores in Israel.

Forescout has also tracked more than 20 claimed attacks against refrigeration systems since January 2026, with pro-Russian hacktivist groups Z-Pentest Alliance and NoName057(16) among the most active.

Targets have included supermarkets, wineries, fruit storage facilities and agricultural businesses across Europe.

However, the researchers stress that the initial access methods and identities of those responsible for the recent French attacks have not been confirmed.

Securing the Cold Chain

Forescout is urging organisations to review how refrigeration management systems are connected to the internet and who is authorised to access them.

Recommendations include removing publicly accessible management interfaces, replacing unsupported equipment, applying available security updates and introducing secure remote access for maintenance contractors.

The researchers also recommend multifactor authentication, individual user accounts and continuous monitoring to identify suspicious changes to temperature settings, defrost schedules and alarms.

The challenge is that attackers do not necessarily need to deploy malware to cause disruption. Once they gain sufficient access, they may be able to misuse legitimate management functions, making malicious activity harder to distinguish from routine maintenance.

The research highlights a broader issue for operational technology security: organisations need visibility not only of connected devices, but also of who can access them, what changes they can make and how those changes affect physical operations.

Read the full research here: Cold Chain, Open Control: Exposed Refrigeration Systems Reveal Global Risk

 

The post Exposed Refrigeration Systems Raise Global Cybersecurity Concerns appeared first on IT Security Guru.

Keeper Security has introduced a new AI-powered phishing protection feature designed to prevent users from entering their credentials on fraudulent websites.

Available through the Keeper Browser Extension, the new Phishing Protection capability uses a local AI engine to detect look-alike domains, spoofed websites and brand impersonation attempts. By identifying suspicious login pages directly in the browser, the feature aims to prevent credential theft before sensitive information reaches cybercriminals.

The launch comes as credential-based attacks continue to pose a significant threat to organisations. According to the 2026 Verizon Data Breach Investigations Report, credential abuse was involved in nearly 40% of breaches.

Meanwhile, cybercriminals are increasingly using generative AI to create convincing fraudulent websites and login portals that imitate legitimate services, making phishing attempts more difficult for users and traditional security tools to identify.

Unlike conventional phishing detection tools that may rely on cloud-based analysis, Keeper’s new feature uses machine learning that operates entirely on the user’s device. Built on Keeper’s zero-knowledge security architecture, the technology analyses websites locally without sharing user data.

“Phishing attacks are no longer simple email scams; they are highly automated, AI-driven operations designed to trick users into handing over sensitive credentials and information,” said Darren Guccione, CEO and Co-founder of Keeper Security.

“When an adversary sets up a look-alike domain, form field or unofficial login portal, traditional security controls often fail to identify the threat until the damage is done. By embedding zero-knowledge AI into our browser extension, Keeper stops credential harvesting at the point of entry, giving individuals and organisations greater security and control.”

Detecting Phishing Attempts at the Point of Entry

Keeper’s Phishing Protection feature automatically examines web pages for characteristics commonly associated with credential-harvesting attacks.

These include typosquatting techniques, where attackers use domains that closely resemble legitimate websites, as well as suspicious IP addresses, unusual URL structures and unauthorised websites requesting password information.

When a potential threat is identified, the extension displays a warning explaining the suspicious activity and the specific indicators detected.

Users can review the warning, dismiss it or disable Keeper on the affected website. They can also manage previously blocked sites and restore autofill functionality where appropriate.

The feature is designed to provide an additional layer of protection against phishing attacks that evade existing email security gateways and web filtering technologies.

Privacy and Administrative Control

Keeper has also emphasised the privacy-focused design of the new capability, with its AI engine processing website information locally rather than transmitting sensitive data to external servers.

“Security controls have to work at machine speed, and they cannot come at the expense of the zero-knowledge guarantees our customers depend on,” said Craig Lurey, CTO and Co-founder of Keeper Security.

“We engineered this AI engine to execute entirely on the local device using the customer’s private key. It delivers continuous, proactive verification of web assets, ensuring that autofill is protected against sophisticated domain spoofing without creating a privacy trade-off.”

The feature is optional and disabled by default. Enterprise IT administrators can enable and manage it centrally through the Keeper Admin Console, while individual users can configure their preferences directly within the browser extension.

Keeper Phishing Protection is available now as an opt-in feature in version 18.2.0 of the Keeper Browser Extension.

The post Keeper Security Launches AI-Powered Phishing Protection to Block Credential Theft appeared first on IT Security Guru.

Organised by Eskenzi PR, the tenth annual awards ceremony took place at St Barts Pub in London, bringing together cybersecurity professionals, educators, industry leaders and advocates to recognise those whose work often goes unnoticed.

Unlike many industry awards, the Security Serious Unsung Heroes Awards are free to enter and attend. The initiative celebrates individuals and teams going above and beyond to protect businesses, communities and individuals, while also championing diversity, wellbeing, education and the next generation of cybersecurity talent.

This year’s event was sponsored by CultureAI, Filigran, OneAdvanced and The Zensory, with additional support from CyberASAP and Pulse Conferences. Media partners included Computer Weekly, Information Security Buzz and IT Security Guru.

Yvonne Eskenzi, Director of Eskenzi PR and Founder of the awards, said: “The Security Serious Unsung Heroes Awards are all about recognising the incredible people working tirelessly behind the scenes to keep our businesses, communities and country safe.

“Cybersecurity can often be a thankless profession, with the dedication and achievements of those working in the industry going largely unnoticed. These awards give us the opportunity to shine a spotlight on those individuals who consistently go above and beyond, while also celebrating the fresh perspectives and diverse talent shaping the future of the industry.

“It was fantastic to bring the cybersecurity community together once again to recognise these remarkable individuals. A huge congratulations to all our nominees and winners!”

Security Serious Unsung Heroes Awards 2026: The Winners

This year’s winners represented a broad cross-section of the cybersecurity industry, from frontline security professionals and ethical hackers to educators, content creators and community advocates.

The full list of winners is as follows:

• Cyber Correspondent: Phil Muncaster
• Godfather of Security: Andy James, Founder and CEO of Custodian360
• Godmother of Security: Dr. Emma Philpott, CEO of IASME
• Data Guardian: Peter Slevin, Cyber Engagement Senior Technical Lead at Bank of Ireland
• CISO Supremo: Andrea Litherland, CISO at Domestic & General
• Security Avengers: Revenge Porn Helpline
• Best Educator: Dr. Chidimma Opara, Senior Lecturer in AI at The Manchester Metropolitan University
• Best Ethical Hacker/Pen Tester: Dominic Mortimer, Head of Red Team at WorkNest Secure
• Channel Champion: Olly Carter, Senior Channel Sales Director, EMEA and APJ, at Forescout
• Senior Leader/Mentor: Meera Tamboli, DFIR Analyst at AVEVA
• Cybersecurity Wellbeing Advocate: Nikki Webb, Director at Custodian360
• Best Security Awareness Campaign: Cyber Local, a collaboration involving Cyber Innovations Ltd., Bournemouth University, Cybexer, Dorset Mind, Dorset Chamber and local authority stakeholders
• Diversity Champion: Segan Ebenezer Olaniyan, Information Security Analyst II at Kraken Technologies
• Apprentice/Rising Star: Jordan Daglish, Acumen Cyber
• Cyber Scribe: Dr. Runli Guo, Reducing Blast Radius LinkedIn newsletter
• Voice of Security: Cyber Agony Aunts podcast and Ant Davis, creator of The Awareness Angle
• Best Academic Entrepreneur: Dr. Peter Garraghan, CEO of Mindgard

Winners Highlight the Importance of Community and Collaboration

Among those recognised was Olly Carter of Forescout, who received the Channel Champion Award for his contribution to the cybersecurity channel ecosystem.

Carter said: “It’s a real honour to be recognised with the Channel Champion Award, but the truth is that nobody achieves anything in the channel alone! I’m incredibly fortunate to work alongside such a talented, passionate, and committed team at Forescout, and some truly fantastic partners.

“For me, the channel has always been about people, relationships, trust and working together to achieve something special.”

The Voice of Security Award was jointly awarded to the Cyber Agony Aunts podcast, hosted by Rebecca Taylor and Amelia Hewitt, and cybersecurity content creator Ant Davis.

Taylor and Hewitt said: “Cyber Agony Aunts comes from a very real place for us – it’s all about community, honesty and reminding people that behind the technology, cyber is ultimately about people.

“We’ve had some incredibly open conversations, plenty of laughs and a few tears along the way, so to see the podcast recognised like this is something we’re incredibly proud of. This award belongs just as much to our guests and the community as it does to us.”

Nikki Webb, Director at Custodian360, was recognised as Cybersecurity Wellbeing Advocate for her work supporting people across the industry.

Webb said: “Our industry asks a lot of people, long hours, high pressure, and the weight of protecting others. Looking after the people behind the screens matters just as much as the technology itself, and I’m so proud to see that recognised.”

Recognising Education, Innovation and Awareness

The awards also highlighted the importance of making cybersecurity more accessible through education, awareness and research.

Dr. Chidimma Opara received the Best Educator Award for her contribution to inspiring the next generation of cybersecurity professionals.

Reflecting on her win, Opara said: “What makes this award so special is knowing that the work I love doing as an educator is making a meaningful difference in motivating the next generation of cybersecurity professionals.

“If my students leave my classroom feeling valued, believing in themselves a little more, and inspired to reach their potential, then I know I am doing something worthwhile.”

Meanwhile, Cyber Local received the Best Security Awareness Campaign Award, recognising a collaborative initiative involving academic institutions, local organisations and cybersecurity specialists.

Emily Rosenorn-Lanng, CEO and Co-Founder of Cyber Innovations Ltd., as well as pioneer of the Cyber Local project, said: “Ours has always been about helping people feel confident and supported when something goes wrong online, so to win Best Security Awareness Initiative, in a category full of such strong work, means a huge amount to me, to the Cyber Innovations team and to everyone who worked on it with us.”

The newly introduced Cyber Scribe category was awarded to Dr. Runli Guo for her LinkedIn newsletter, Reducing Blast Radius, which explores emerging cybersecurity challenges, particularly those associated with agentic AI.

Guo explained: “Agentic AI is quickly becoming the most discussed topic in cybersecurity, yet the associated threats and risks aren’t always fully understood. With the rapid rate of change in this space, CISOs and architects simply don’t have the time to read every update.”

She added that her work focuses on sharing practical insights and hands-on demonstrations to help security professionals understand and reduce the potential impact of emerging threats.

Dr. Peter Garraghan, CEO of AI security company Mindgard, was also recognised with the Best Academic Entrepreneur Award, highlighting the role of academic research and commercial innovation in addressing new cybersecurity challenges.

A Decade of Celebrating Cybersecurity’s Unsung Heroes

The ceremony was hosted by Yvonne Eskenzi and Clive Room, Director of Pulse Conferences, with winners selected by a judging panel comprising representatives from across the cybersecurity industry, academia and media.

This year’s judges included Alex Scroxton of Computer Weekly, Sam Soares of CultureAI, Joe Pettit of Bora, Emma Fadlon of CyberASAP, Beth Maundrill of Infosecurity Magazine, Stuart Coulson of HiddenText and Holly Foxcroft of OneAdvanced, alongside Eskenzi and Room.

The evening also raised £250 for NSPCC Childline through a charity raffle.

Now in its tenth year, the Security Serious Unsung Heroes Awards continues to recognise the individuals whose contributions extend beyond technical expertise, celebrating mentorship, collaboration, community engagement and the people helping to make cybersecurity a more inclusive and supportive profession.

Further information about the awards is available at www.securityserious.com.

The post Security Serious Unsung Heroes Awards Celebrates 10 Years of Recognising Cybersecurity’s Hidden Heroes appeared first on IT Security Guru.

Salt Security has won three categories at Cyber Defense Magazine’s 2026 Top InfoSec Innovators awards, recognising its work in agentic AI and API security.

The company received the Most Promising Agentic AI Security Solution, Trailblazing AI-based Cybersecurity Innovation and Transformational API Security Solution awards. The awards were announced at CyberDefenseCon 2026 in Orlando as part of the programme’s 14th annual edition.

The recognition comes as organisations face challenges in overseeing AI agents and securing the APIs through which they access data and carry out tasks.

Salt Security’s State of Agentic AI and API Security 2H 2026 report, released this month, surveyed more than 380 security and technology professionals. It found that nearly half of enterprises had confirmed or suspected that an AI agent took an unauthorised action in the past year. Fewer than one in five could automatically stop a misbehaving agent.

“Our research shows that the governance gap is not theoretical: agents are already acting in ways organizations did not intend, and most organizations cannot stop them in time. We are honored to be recognized as leaders in addressing that problem,” said Roey Eliyahu, CEO of Salt Security.

The company’s Agentic Security Platform discovers AI agents, Model Context Protocol (MCP) servers and APIs within an organisation’s environment. It also governs their connections and permissions, monitors agent behaviour during operation and identifies vulnerabilities before deployment.

Gary S. Miliefsky, publisher of Cyber Defense Magazine, said the judging criteria included an understanding of emerging threats, cost-effective solutions and innovation that could help reduce cyber risk.

The full list of winners is available on the Cyber Defense Awards website.

The post Salt Security wins three InfoSec Innovator awards appeared first on IT Security Guru.

Forescout’s Vedere Labs has identified a previously undocumented malware delivery platform being used in ClickFix campaigns, alongside new delivery techniques associated with malware loaders linked to Vice Society ransomware activity.

The findings, published in two research blogs, examine what happens after victims fall for ClickFix lures. These attacks trick users into copying and running malicious commands, often under the pretence of fixing a technical problem or completing a verification step.

The investigations reveal how attackers deliver different malware families, conceal malicious files and establish access that could support further compromise.

ROMULUS serves multiple malware loaders

During an incident investigation, Forescout researchers discovered a server hosting a panel called ROMULUS. Further analysis identified six IP addresses exposing the same authentication interface and revealed a platform capable of delivering multiple malware loaders.

One of those addresses had previously been identified by Huntress in a campaign that abused ChatGPT’s Custom GPTs to direct victims towards pages hosting ClickFix lures. Forescout independently observed the same malware package being delivered from another ROMULUS server.

Researchers analysed two delivery routes. One used a trojanised installer containing legitimate Stardock software to load malicious code. The other delivered LegionLoader, a malware loader active since 2019, through a series of encrypted archives.

In the LegionLoader route, an archive smaller than 1 MB expanded into an executable exceeding 880 MB. Most of the executable’s size came from artificial padding, which can push files beyond security scanners’ upload limits or sandbox analysis thresholds.

A ROMULUS statistics page also displayed installation and execution counts, a timeline and a breakdown by country, potentially allowing operators to monitor campaign performance.

Forescout said the platform’s operators remain unknown. Researchers could not determine whether ROMULUS is a private tool, a commercial criminal service, an affiliate framework or software shared between operators.

Loader investigation reveals possible connection

The second blog examines Lorem Ipsum and Axolotl, two malware loaders whose relationship had not previously been documented in public research.

The investigation followed a September incident in which attackers used ClickFix to deploy Lorem Ipsum Loader and a Python tunnel client. Forescout contained the incident before ransomware was deployed, although researchers believe ransomware delivery was the attackers’ intended goal.

The tradecraft has previously been attributed to Vice Society, a cybercriminal group associated with several ransomware families, including Rhysida.

Researchers analysed five Lorem Ipsum samples from the incident and 39 Axolotl samples. They identified an additional Lorem Ipsum delivery method using MSI installers and multi-stage PowerShell, as well as three Axolotl variants using different host programs.

The analysis also found overlapping infrastructure and similarities in the loaders’ command-and-control communications. Although their code is distinct, Forescout said the findings suggest Lorem Ipsum may be a later iteration of Axolotl. Researchers could not establish that relationship conclusively.

Forescout recommends monitoring suspicious PowerShell activity, silent installer execution and unexpected DLL loading, alongside educating users about ClickFix and related lures that direct victims to Windows Terminal or PowerShell.

The post Forescout uncovers ROMULUS malware delivery platform behind ClickFix attacks appeared first on IT Security Guru.

Nearly half (49.8%) of organisations have confirmed or suspected that an AI agent took an unintended, unexpected or unauthorised action in the past year, according to new research from Salt Security.

The findings, published in the company’s State of Agentic AI and API Security 2H 2026 report, highlight growing concerns around the security of autonomous AI systems as enterprises increasingly integrate agents into everyday operations.

Based on a survey of more than 380 security and technology professionals, alongside Salt Labs production telemetry from hundreds of customer environments, the research suggests that AI adoption is outpacing organisations’ ability to monitor, govern and contain agent activity.

Among respondents who reported confirmed or suspected unintended agent actions, more than half experienced an unauthorised external API call or transaction, while over 40% reported an agent modifying or deleting data.

The research also found that AI agents are now firmly embedded in enterprise environments, with 86.4% of respondents reporting at least one operating within their organisation and 59.5% running more than ten. Furthermore, 76.8% reported agents capable of chaining actions across other agents, tools and APIs, creating complex sequences that may not have been anticipated by individual teams.

Despite this widespread adoption, visibility remains limited. Just 12.5% of organisations can consistently trace an agent’s complete journey, from its initial instruction through the tools and APIs it accesses to the final outcome. More than 60% would require hours or days of manual investigation to reconstruct an agent’s activity from the previous day.

The ability to respond to unexpected behaviour is similarly concerning. Only 17.5% of respondents said their organisation could automatically stop an AI agent behaving unexpectedly in production. For the majority, intervention remains a manual process, potentially requiring an application to be taken offline.

“The data shows a gap that is already producing real operational consequences,” said Roey Eliyahu, CEO of Salt Security. “Organisations are deploying agents and granting them access to enterprise data, APIs, and services before they can trace what those agents are doing or stop them automatically when something goes wrong.”

Shadow AI Infrastructure and AI-Generated Code Raise Further Concerns

The report also identified emerging risks associated with Model Context Protocol (MCP) infrastructure, which enables AI systems to interact with external tools and data sources.

Nearly a third (32.9%) of respondents reported discovering an unauthorised, shadow or misconfigured MCP server in the past year, while 54.3% had either confirmed or suspected encountering one.

Salt Labs’ own telemetry revealed that MCP-related infrastructure was detected in 21.6% of customer environments in August 2026, compared with 16.7% in January, representing a relative increase of approximately 30%.

Meanwhile, AI-generated code is introducing additional application security challenges. Some 83.5% of respondents estimated that AI-generated or AI-assisted code contributed to at least some of their application security findings.

However, just 6.8% reported resolving these issues directly within coding assistants at the point of generation, leaving vulnerabilities to be identified during subsequent code reviews, testing or after deployment.

Recent Manus Vulnerability Highlights Agentic AI Risks

The findings follow recent research from Salt Labs, which demonstrated how a single malicious email could be used to hijack the Manus agentic AI platform and potentially access a user’s connected email, cloud storage and code repository accounts.

The attack did not require a stolen password or the victim to click a malicious link. Although the platform’s guardrails detected the malicious activity, they were unable to prevent the code from executing.

The vulnerability was responsibly disclosed and has since been remediated.

According to Salt Security, the incident demonstrates how traditional detection mechanisms may struggle to keep pace with autonomous systems capable of executing multiple actions before human intervention is possible.

“The Manus research and this survey data are two views of the same problem,” said Yaniv Balmas, Head of Research at Salt Security.

“In the field, we showed how an agent can be weaponised through a single malicious email, how the guardrail detected the attack at exactly the right moment, and still could not stop the code from running. The survey quantifies how widespread that architecture is.”

The findings underline the need for organisations to strengthen visibility into agent activity, establish appropriate governance controls and develop automated containment capabilities as AI agents gain greater autonomy and access to critical enterprise systems.

The full State of Agentic AI and API Security 2H 2026 report includes sector-specific findings, recommendations for CISOs and further analysis of Salt Labs production telemetry.

The post Nearly Half of Organisations Report Unauthorised AI Agent Actions, Research Finds appeared first on IT Security Guru.

Huntress researchers have uncovered an SEO-poisoning campaign that harvests SSL VPN credentials through a lookalike WatchGuard download page, then hands victims the real, validly signed installer from WatchGuard’s own CDN, leaving endpoint tools with nothing to detect.

The activity, detailed by the Huntress SOC on 13 October, centres on watchguard-vpn[.]net, a lookalike domain posing as a download page for WatchGuard’s Mobile VPN with SSL client. Unlike earlier waves of the campaign, which relied on trojanised installers, this iteration strips the malware out entirely.

A typo and a search result

The incident Huntress investigated began on 7 October, when an administrator at a managed service provider searched Bing for “watchguard vpn sll download”. Eight seconds later they had clicked through to the fake site via a standard Bing result redirect, which Huntress says points to SEO poisoning rather than malvertising.

Two bites at the password

Clicking any download option on the site opens a pop-up asking for the VPN server address, username and password, the same three values the legitimate client requests. The logic sits in roughly 150 lines of unobfuscated JavaScript (popup.js), which posts the entries as JSON to a separate collection domain, watchguard-ssl[.]online.

The first submission is always rejected with an “incorrect data” message, prompting victims to retype carefully or try a different password. That gives the operators a second, likely more accurate, set of credentials, along with the server address they need to log in.

The payload is the real thing

After the second submission, the script triggers a download of WatchGuard’s genuine Mobile VPN with SSL installer (version 12.11.5) direct from cdn.watchguard.com. Huntress verified the file’s Authenticode signature from WatchGuard Technologies and confirmed the binary had not been altered.

With no trojanised MSI or sideloaded DLL in the chain, there is nothing for EDR to flag, and the victim gets exactly the install they expected. Detection was thin across the board: as of 8 October only seven VirusTotal vendors flagged the lure domain and two flagged the collector.

Old domain, new backend

WatchGuard’s Secplicity team first reported watchguard-vpn[.]net in January as part of a wider credential-harvesting campaign spoofing WatchGuard, F5, Fortinet, SonicWall and Sophos clients, though at that point the domain had no working backend. Microsoft later attributed related activity to Storm-2561, a financially motivated actor active since May 2025. WHOIS data shows the domain was registered again on 22 August, with the collector domain following on 14 September. Huntress says it cannot establish whether the same operators controlled both registrations.

In the case investigated, Huntress flagged the activity 21 seconds after the site loaded, and browser history suggests the user did not complete both rounds. The domain was offline as of 13 October, and Huntress has shared infrastructure details with WatchGuard.

Recommendations

• Reset passwords for any account entered on the site and treat the associated VPN endpoint as known to the attacker.
• Enforce MFA on SSL VPN access.
• Monitor for VPN logins from hosting providers, unfamiliar ASNs or new countries.
• Block watchguard-vpn[.]net, watchguard-ssl[.]online, 80.249.132[.]140 and 158.94.209[.]19.
• Publish and bookmark official download links such as software.watchguard.com.

Full research: https://www.huntress.com/blog/fake-watchguard-vpn-credential-phishing

The post Fake WatchGuard VPN site steals credentials, then serves the genuine signed client appeared first on IT Security Guru.

Certes has received Frost & Sullivan’s 2026 Global Enabling Technology Leadership Recognition in post-quantum cryptography (PQC), following an independent evaluation of vendors in the market.

The recognition centres on a problem most security teams are now facing: migrating embedded cryptography across legacy applications, cloud environments and critical infrastructure will take years, but “harvest now, decrypt later” attacks mean data intercepted today could be exposed once sufficiently powerful quantum computers arrive. Frost & Sullivan notes that the risk is greatest for data with long regulatory, legal or commercial lifespans, and that protecting it needs to run in parallel with the longer migration effort rather than wait for it to finish.

Separating cryptography from the stack

At the heart of Certes’ platform is its Cryptographic Abstraction Layer (CAL), which sits between applications and infrastructure and lifts cryptographic protection out of the underlying technology stack. Rather than waiting for each vendor to ship a quantum-safe update and then managing disruptive upgrades, security teams can manage cryptographic change centrally and apply it to data flowing between systems.

The platform comprises the Certes Enforcement Point (CEP), which encrypts and decrypts within the data path, and the Certes Policy Manager (CPM), which manages policies and cryptographic controls centrally. Frost & Sullivan singled out its policy-specific key architecture as a key differentiator: each policy-controlled application or data flow can have its own key material, separate rotation schedules and customer-controlled key components. This is combined with quantum-based random number generation and customer-owned keys to support data sovereignty.

Certes’ patented Layer 4 payload protection encrypts the payload while preserving original network headers, so routing, QoS, monitoring, SD-WAN and flow visibility tools continue to work without applications being rewritten or networks re-architected. Deployment options span physical appliances, virtual machines on VMware ESXi, KVM, Red Hat and Nutanix AHV, and Windows and Linux client agents. Version 7 extends enforcement closer to workloads and users through expanded agent and cloud deployment options, reducing unprotected segments in the data’s journey.

Beyond quantum

The report also highlights uses beyond PQC migration. Cryptographic segmentation can separate IT and OT environments and limit lateral movement in flat networks, while a virtual air gap capability can dynamically isolate critical applications, data flows and backups during an active attack while preserving recovery. Certes’ encryption can also stop sensitive data being exposed to internal or external LLMs, giving organisations tighter governance over AI adoption.

Ozgun Pelit, Senior Industry Analyst at Frost & Sullivan, said: “Certes stands out in the emerging post-quantum security market through its focus on protecting data independently of the applications and infrastructure around it. Its combination of cryptographic abstraction, crypto-agility and centralized policy enforcement provides organisations with a practical way to reduce near-term quantum risk while navigating what will inevitably be a complex, multi-year migration.”

Paul German, CEO at Certes, said: “The next cryptographic revolution could arrive before many organizations have finished implementing the last one. Post-quantum cryptography is only the beginning. As AI and quantum technologies advance, cryptographic change will accelerate, and organisations cannot afford to rebuild their applications, networks and security infrastructure every time it happens.”

He added: “In a world where cryptography must constantly evolve, the ability to change it without changing everything else isn’t a luxury. It’s a necessity.”

The full Frost & Sullivan report is available HERE

The post Certes wins Frost & Sullivan PQC recognition for decoupling encryption from infrastructure appeared first on IT Security Guru.

Check Point Research has disclosed two high-risk vulnerabilities in LiteLLM, the open-source gateway that sits between enterprise applications and AI providers such as OpenAI, Anthropic and Google. The flaws could allow a user with minimal privileges to take full control of the gateway, read sensitive files, execute arbitrary code and harvest the API keys an organisation uses to access its AI providers.

LiteLLM is downloaded around 97 million times a month and has more than 59,000 stars on GitHub. Both issues, tracked as CVE-2026-35029 and CVE-2026-59823, are fixed in version 1.83.9.

One endpoint, three attack paths

The more serious flaw, CVE-2026-35029, is a missing authorisation check on LiteLLM’s /config/update endpoint, which controls the proxy’s runtime configuration. Unlike other administrative endpoints, it did not verify that the caller held the PROXY_ADMIN role.

Compounding this, any user who logs in through the LiteLLM dashboard is issued a session token tied to a special “litellm-dashboard” team, and those tokens are checked against a looser list of permitted UI routes. That list includes “/config”. Because the check uses simple prefix matching, requests to /config/update were allowed for any logged-in user, whatever their role.

Testing against LiteLLM version 1.77.7, the researchers showed the flaw could be used to:

• Read arbitrary files, by injecting an environment variable that sets the path of the dashboard logo and pointing it at sensitive files such as /etc/passwd
• Take over the built-in admin account, by overwriting the UI_USERNAME and UI_PASSWORD variables and logging in with attacker-chosen credentials
• Execute remote code, by registering a “pass-through endpoint” that loads a Python module from an attacker-controlled S3 or GCS bucket, which LiteLLM then downloads and runs

Stealing keys without touching the provider

The second flaw, CVE-2026-59823, is a server-side request forgery (SSRF) issue in LiteLLM’s “Clientside LLM Credentials” feature. By passing a user_config parameter to the /chat/completions endpoint, an authenticated user could create a router pointing at their own server. Requests, along with the provider API keys attached to them, would then be sent to the attacker rather than to the AI provider.

Check Point notes that this code path sidestepped restrictions LiteLLM already placed on client-supplied api_base and api_key parameters.

The researchers also found that password hashes were exposed to low-privileged users and were stored without salting, using a single hash iteration. These issues duplicated an existing advisory, GHSA-69×8-hrgq-fjj8.

Old bugs, bigger blast radius

Check Point is clear that none of these are new classes of “AI” vulnerability. Missing authorisation checks, SSRF and unsafe dynamic module loading are all well understood. What raises the stakes is where they sit. An LLM gateway stores provider keys, manages user permissions and routes every prompt and response, making it a single point of compromise for an organisation’s AI estate. And because LiteLLM is embedded in many other AI platforms and internal tools, some organisations may be running it without realising.

“The industry’s focus has largely been on securing AI models, but this research highlights an equally important reality: AI infrastructure is becoming a new critical layer of enterprise security,” said Mateo Rojas-Carulla, Head of Research, AI Agent Security at Check Point Software Technologies. “As organisations increasingly rely on gateways such as LiteLLM to connect applications, users and AI services, these platforms become attractive targets because they sit at the centre of trust.”

“For LiteLLM users, the immediate priority is patching and reviewing access controls, but the broader lesson extends beyond a single product,” he added. “Attackers will naturally target the layer that gives them the greatest access with the least resistance.”

What defenders should do

Check Point recommends that organisations:

• Upgrade to LiteLLM 1.83.9 or later across every deployment, including instances embedded in other tools
• Audit gateway user accounts and remove any that are not needed
• Rotate AI provider API keys if there is any sign of unauthorised access before patching
• Test that limited roles are enforced in practice, not just on paper
• Bring LLM gateways into scope for regular security assessments

The vulnerabilities were reported to LiteLLM’s maintainers through a coordinated disclosure process that began in October 2025.

Full technical write-up: https://research.checkpoint.com/2026/when-llm-gateways-go-wrong-findings-from-litellm/

The post LiteLLM flaws let low-privileged users hijack AI gateway and steal provider keys appeared first on IT Security Guru.

A coordinated attack on the operational technology (OT) behind supermarket refrigeration has hit hundreds of stores across France, in what security experts are calling one of the clearest examples yet of cyber sabotage with physical consequences.

Retailers confirmed the attack on Monday 12 October, with disruption reportedly beginning on Sunday night. Intermarché and its Netto brand said at least 300 shops were affected, Coopérative U more than 100 and Carrefour 80, with Monoprix, E.Leclerc and Auchan also reporting impacted stores. According to BFM TV, attackers remotely forced refrigeration units into continuous defrost cycles, driving temperatures up to 50°C. Paris prosecutors said the attack also caused fires.

“This incident is not surprising. A supermarket refrigerator is no longer just an electrical appliance. It is a computerized system connected to a network, enabling remote monitoring and control. While this connectivity allows refrigeration systems to be managed efficiently, it also exposes them to cyber security risks, particularly when operational equipment runs for years on outdated software, without regular security updates, and with management interfaces accessible from the internet,” said Oded Vanunu, Head of Vulnerability Research at Check Point.

Unpatched, internet-facing and end of life

The affected equipment has been traced to refrigeration management systems from Danish manufacturer Danfoss. A source close to Prime Minister Sébastien Lecornu said France’s National Cybersecurity Agency (ANSSI) had identified a vulnerability in Danfoss software, and the agency has been ordered to investigate.

Danfoss said most of the compromised units were “legacy” products that no longer receive software or security updates, singling out its AK-SM800 and AK-SC355 controllers, and noted that an affected version of the AK-SM800 was running outdated firmware. The company said it had long advised customers to upgrade or replace these models.

Known vulnerabilities in the control software date back to 2023, some rated critical, with patches available. In August, OT security firm Claroty published research describing flaws in Danfoss systems that could allow attackers to bypass authentication. Reports suggest attackers may have used the Shodan search engine to locate exposed devices, some of which are connected via 3G cards for remote monitoring.

“One of the significant aspects of this incident is that the attackers did not necessarily need sophisticated cyber capabilities. Refrigeration systems have legitimate operational functions, such as defrost cycles, and when an unauthorized party gains access to the system, those same functions can be exploited to disrupt operations. Unlike attacks aimed at stealing data or encrypting files, the impact here is on the physical operation of the equipment itself, with direct consequences such as food inventory losses and potential safety hazards.” Vanunu continued.

“In previous research conducted by Check Point on smart devices, including LG products, we demonstrated how a vulnerability in a centralised management platform could allow attackers to gain control of connected devices. However, in the current incident, it is still unclear exactly how the attackers gained access to the systems.”

OT in the crosshairs

No group has claimed responsibility, and there is no evidence of a ransom demand or data theft. The Paris prosecutor’s cybercrime unit has opened an investigation into what it described as a “large-scale” attack on connected refrigerators at several major food retailers, while ANSSI is coordinating with European counterparts. Sekoia analyst Felix Aime said stores in Spain, Portugal, Poland, Germany and Belgium were also affected.

“The refrigeration systems in supermarkets are operational technology. Building management controls, HVAC, cold chain infrastructure. These are the same category of systems that the security industry has been warning about as the next frontier for sabotage attacks, and they’ve now been weaponised against food retail infrastructure in one of Europe’s largest economies,” said Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress.

ANSSI had already listed sabotage of industrial control systems among the main threats facing France in its most recent threat report.

“Heating fridges to 50 degrees for six hours is not data theft; it is physical sabotage executed through software, and that is the lesson for every sector. Refrigeration controllers, building systems and point-of-sale equipment are now connected and remotely managed, often through a handful of suppliers, so one weak link scales to hundreds of stores overnight,” said Samuel Hassine, CEO and co-founder of Filigran.

“The problem extends beyond a single refrigeration system or an isolated security vulnerability. Operational equipment is often designed to remain in service for 15 years or more, while cyber threats and technologies evolve at a much faster pace. In addition, the same controllers and management systems are deployed across retail chains worldwide, meaning that a compromise affecting widely used technology could potentially impact a large number of locations,” added Check Point’s Vanunu.

Counting the cost

Intermarché chief executive Thierry Cotillard told BFM TV that losses could run to “tens of millions of euros nationwide in a single day”, while Coopérative U’s Dominique Schelcher said larger stores could each lose up to €180,000–200,000 in stock. France’s retail federation, the FCD, has called on Danfoss to provide “full transparency”.

“The immediate financial consequences are significant and visible. Failures at the stores means total write-off of perishable stock across every affected location simultaneously. The operational disruption compounds quickly. Staff cannot trade normally without functioning refrigeration. Products cannot be restocked until systems are restored and verified safe. The food retail sector across Europe should be treating this as a signal that they are being actively targeted,” Huntress’ Patel warned.

“The cyberattack on French supermarkets is a stark reminder that cyber threats extend far beyond stolen data and financial losses. Hackers reportedly manipulated refrigeration systems, raising temperatures to 50°C, causing fires and forcing retailers to dispose of large quantities of food. With hundreds of stores affected, the incident highlights how vulnerabilities in connected systems can have serious real-world consequences, disrupting operations, damaging equipment and potentially putting public safety at risk,” said Jamie Akhtar, CEO and Co-founder of CyberSmart.

Mitigation: find the exposure first

Experts agree that defenders’ first priority should be identifying which OT assets are reachable from the internet, and who holds remote access to them.

“To reduce these risks, the first step is to identify which controllers and management interfaces are directly exposed to the internet and eliminate any unnecessary exposure. It is also important to keep systems updated, replace default passwords, restrict remote access, and enable multi-factor authentication wherever supported. Separating operational control networks from other networks and monitoring unusual changes in system behaviour are also essential measures. These recommendations apply not only to refrigeration systems, but also to HVAC, building management systems, and other operational infrastructure.” said Vanunu.

“It also demonstrates how increasingly interconnected technology can create new opportunities for cybercriminals. For businesses, this reinforces the importance of securing all connected devices and systems, not just traditional IT infrastructure. Organisations should prioritise regular software and firmware updates, strong access controls, multi-factor authentication where supported and network segmentation to prevent attackers moving between systems. Regular security assessments and employee cybersecurity awareness training are also essential for identifying vulnerabilities before they can be exploited. Ultimately, businesses must recognise that cybersecurity is no longer just about protecting data, but also about safeguarding physical operations, customers and business continuity.” said CyberSmart’s Akhtar.

Filigran’s Hassine urged security leaders to put the issue in front of the board: “Boards should ask three questions this week. Which connected equipment could cause physical or financial damage if someone changed a setting, and who can reach it from outside. Which third parties hold remote access, and how that access is monitored and segmented. And has anyone tested that the response works, from detection to switching to manual operation. Resilience in retail now means knowing your exposure before an attacker maps it for you.”

The post Legacy refrigeration controllers exploited in OT attack on hundreds of French supermarkets appeared first on IT Security Guru.

Attackers are exploiting two newly disclosed vulnerabilities in AhsayCBS, the management console for Ahsay’s cloud backup software, to take over servers and quietly run cryptocurrency miners, according to researchers at Huntress.

AhsayCBS (Cloud Backup Server) is mainly used by managed service providers (MSPs) and system integrators to create users and manage backup policies for their clients. As of 8 October, Huntress had seen five organisations targeted via the flaws.

From disclosure to exploitation in three days

The two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, were published to the US National Vulnerability Database (NVD) on 4 October. Huntress began seeing exploitation attempts on 7 October at 23:20 UTC.

CVE-2026-105133 is a medium-severity flaw in the checkSysPwd function that can lead to improper authentication. CVE-2026-105134 is a critical-severity vulnerability in the /rps/api/json/UpdateReceivers.do endpoint of the Replication Receiver component. It contains an authentication bypass that allows a random token to stand in for valid credentials, leading to unauthenticated remote code execution as NT AUTHORITY\SYSTEM.

Attackers chained the two flaws, first bypassing authentication and then gaining code execution. They configured a malicious replication receiver and dropped a JSP webshell into the application directory served by CBS. Huntress first spotted the activity through suspicious command lines spawned by the cbssvcX64.exe service.

Versions up to 10.3.2 are affected. Version 10.3.4, released on 5 August, is not vulnerable.

A miner in disguise

Once inside, the attackers downloaded a set of payloads from an Alibaba Cloud object storage host. These included an XMRig Monero miner disguised as Microsoft Edge (edge.exe), and a modified copy of the NSSM service utility (msedge.exe). The attackers used it to run the miner as a SYSTEM-level service named MicrosoftEdgeUpdateSvc, mimicking the genuine Edge update service. The miner connected to a Monero mining pool on port 8029.

A PowerShell script, Taskgmr.ps1, was used to help the miner avoid detection. If Task Manager was opened, the script stopped the fake Edge service to hide the mining activity. It also killed Task Manager at 18:00, as well as whenever it had been left open for more than an hour overnight, based on the endpoint’s local clock rather than UTC. Huntress said the script appears to be AI-assisted, given its commented code.

In one incident, the attackers also loaded WinRing0x64.sys, a legitimate but vulnerable kernel driver. Huntress noted that attackers often use vulnerable drivers to disable endpoint security tools. In this case, loading the driver gave the miner kernel-level access to the hardware.

[Optional: approved spokesperson quote to be inserted here]

What defenders should do

Huntress is urging organisations running AhsayCBS to:

• Upgrade to version 10.3.4 immediately.
• Restrict access to the AhsayCBS management web interface to trusted IP addresses only, or require VPN access.
• Fully re-image any compromised host from a trusted backup, as attackers may have left additional backdoors.
• Deploy the Sigma detection rules and block the indicators of compromise published by Huntress, including the mining pool, payload URLs and file hashes.

Huntress said it is working with potentially affected organisations across its customer base to apply these mitigations.

Full research, including indicators of compromise and detection rules: https://www.huntress.com/blog/ahsaycbs-flaws-exploit

The post Attackers exploit AhsayCBS backup flaws to deploy disguised crypto miners appeared first on IT Security Guru.