Application security vendor Black Duck has launched Signal Agentic Fix, a new AI agent designed to shrink the gap between vulnerability discovery and a validated fix reaching production.

The agent is the latest addition to Black Duck Signal, the company’s collection of AI agents aimed at removing the human workflow bottlenecks that stop security teams keeping pace with the rising volume of vulnerabilities and exploits.

Black Duck says the launch responds to two pressures that AI has intensified for defenders. The first is a swelling remediation backlog, fuelled by the surge in AI-generated code, the higher vulnerability rates found in that code, and a steady flood of new supply chain CVEs. The second is a collapsing time to exploit: attackers are now using AI to chain and weaponise vulnerabilities in hours, while human-led remediation is still typically measured in days or weeks.

Scan, triage, fix, validate, submit

Signal Agentic Fix automates the full remediation loop:

• Scan: Black Duck’s deterministic SAST and SCA engines – the same ones behind Polaris, Coverity and Black Duck SCA – identify defects in proprietary code and open source dependencies.
• Triage: AI assesses severity, reachability and exploitability, filtering out false positives and prioritising the highest-risk issues.
• Fix: AI generates code fixes for SAST findings, while SCA findings receive dependency upgrade fixes based on Black Duck Security Advisories, informed by the company’s ContextAI knowledge base.
• Validate: Fixed code is re-scanned and can optionally be run against customer-defined compliance checks and functional tests to confirm no new defects have been introduced.
• Submit: Every change is routed to a human for review, either via the developer’s AI coding agent or as a pull request in source control.

“The differentiator is not that AI can write a fix; it’s whether you can trust it,” said Dipto Chakravarty, Chief Product & Technology Officer at Black Duck. “A harness that pairs deterministic static and software composition analysis with AI-powered triage, fix generation, and validation, plus human-defined guardrails and approval gates is what makes agentic remediation something enterprises can actually trust and deploy.”

Two deployment models

The agent can work as a security collaborator alongside a developer and their AI coding agent, such as Claude Code. In this mode, Signal Agentic Fix runs the scans and triage, passes findings and fix guidance to the coding agent to implement, then re-scans to validate the result. Because the coding agent makes the change, it is governed by the same hooks and skills a team already uses for code generation.

Alternatively, it can sit in the DevOps pipeline, triggering the remediation loop on commits, builds or on demand, generating fixes with a configured LLM and submitting them as pull requests for team approval.

For organisations in regulated and safety-critical sectors, Black Duck has built in configurable remediation rules governing what the agent may fix and how, validation rules that let teams apply their own coding and compliance standards and test suites, and mandatory human-in-the-loop approval before anything is merged.

Availability

Signal Agentic Fix for Claude Code is available in Early Access now, with further coding agent and DevOps pipeline integrations across Polaris, Coverity and Black Duck SCA due in the coming weeks.

The post Black Duck launches AI agent to fix vulnerabilities as fast as attackers exploit them appeared first on IT Security Guru.

Check Point Software Technologies has announced the launch of Firewall-as-a-Subscription, a new offering designed to make advanced AI-powered network security more accessible to organisations without requiring a significant upfront hardware investment.

The new subscription model gives businesses access to Check Point Force Firewalls, AI-powered threat prevention and agentic security management through predictable monthly or annual payments. The offering is designed to help organisations modernise their network defences while managing increasingly constrained cybersecurity budgets.

The announcement comes as businesses face growing financial pressures, with inflation and higher borrowing costs forcing many to delay infrastructure upgrades. According to the IANS Research and Artico Search 2026 Security Budget Benchmark, the median cybersecurity budget remained unchanged this year, with 55% of CISOs reporting flat or declining budgets. Although 64% requested additional funding, just 45% received an increase.

These financial constraints are emerging at a time when AI adoption is introducing new challenges for network security, including the need to inspect AI-generated traffic, protect AI applications and monitor autonomous agents.

Check Point’s Firewall-as-a-Subscription aims to address these challenges by removing the need for large capital investments, allowing organisations to access advanced security capabilities through a subscription-based model.

The offering builds on Check Point’s R82.20 release, introduced in July 2026, which brought AI Network Firewall capabilities designed to inspect AI traffic, protect AI applications and help govern AI agents at the network layer.

The subscription includes Check Point Force Firewalls, with capacity and pricing based on the threat prevention throughput required by each organisation. Customers also receive AI-powered threat prevention, including SandBlast technology, which Check Point claims achieves a 99.9% block rate against zero-day attacks.

Additional features include Live Updates, which enable security updates without reboots or downtime, and Smart-1 cloud-based agentic management. The package also includes 24/7 premium support and professional services credits to assist with activities such as migrating firewall policies from other vendors.

Under the three-year subscription, organisations can increase their firewall throughput as their requirements evolve, with the option to move to new hardware after 36 months.

Pete Finalle, Research Manager, Security and Trust at IDC, commented on the growing demand for more flexible security purchasing models.

“Organizations of all sizes face the same AI-driven threats, but for many, capital budget cycles often force them to delay firewall refreshes or buy more capacity than they need,” he said.

“Consumption models that turn on-premises security hardware into a predictable operating expense, and let organizations scale protection as their needs grow, can help close that gap. We expect demand for this kind of flexibility to rise as AI adoption increases the traffic and risk networks must handle.”

The subscription model could also provide opportunities for channel partners to help customers progress firewall refresh projects that have been delayed by capital expenditure restrictions.

Avi Rembaum, President Global Technical Sales at Check Point Software Technologies, said: “Every organization is adopting AI, and every organization deserves the same level of protection, whatever its size or budget.

“With Firewall-as-a-Subscription, we are making our most advanced AI security, threat prevention and agentic management available through one simple subscription, so organizations can secure their AI transformation today.”

Check Point Firewall-as-a-Subscription will be available from 1 November 2026 through Check Point’s partner network, with monthly and annual payment options.

The post Check Point Launches Firewall-as-a-Subscription as Cybersecurity Budgets Face Growing Pressure appeared first on IT Security Guru.

UK cybersecurity specialist WorkNest Secure has achieved Accredited Organisation status under The Cyber Scheme, providing further independent recognition of the technical expertise and professional standards maintained across its services.

The accreditation recognises organisations that demonstrate professional competence, quality and alignment with established cybersecurity industry standards. It also places particular emphasis on the qualifications and capabilities of the professionals delivering those services.

For WorkNest Secure, the latest recognition builds on its existing technical accreditations and reflects its continued investment in developing and maintaining a highly skilled cybersecurity workforce.

Independent Recognition of Cybersecurity Expertise

The Cyber Scheme is a Licensed Body of the UK Cyber Security Council and works to assess and recognise cybersecurity professionals against established industry standards.

Its Accredited Company Programme is designed to give businesses greater confidence when selecting cybersecurity service providers by linking organisational accreditation to independently verified workforce capabilities.

Unlike certifications focused primarily on processes or technical controls, the programme places significant importance on the people delivering cybersecurity services and their professional competence.

WorkNest Secure already has a number of penetration testing consultants who hold individual accreditations through The Cyber Scheme, making company-wide recognition a natural progression.

Jordan Constantine, Head of Offensive Security at WorkNest Secure, said the accreditation provides customers with independent evidence of the team’s capabilities.

“Becoming accredited under The Cyber Scheme felt like a natural step for WorkNest Secure. It’s one thing to say our team meets a high standard; it’s another to have that verified independently, and many of our penetration testing consultants are accredited under their scheme.”

He added: “Their assessments are respected across government and industry, and that gives our clients real confidence in the people testing their systems. It’s proof, not just a claim.”

Building Trust in Cybersecurity Services

The accreditation comes as organisations increasingly rely on external cybersecurity specialists to help identify vulnerabilities, assess risks and strengthen their defences.

With businesses placing considerable trust in third-party providers, independently verified qualifications and professional standards can provide an important measure of assurance.

Kirsty Fowler, Managing Director of WorkNest Secure, believes the expertise of cybersecurity professionals remains central to delivering effective security services.

“Cybersecurity is a people business. Technology is incredibly important, but customers also need to know that the people testing their systems, advising their teams and helping them respond to risk have the right expertise behind them.”

She added that the accreditation also reflects the company’s commitment to supporting professional development.

“Achieving the Cyber Scheme accreditation gives our customers another level of independent assurance and reflects the investment we continue to make in our people.”

Supporting Continued Growth

WorkNest Secure was formed following the integration of Pentest People and Bulletproof under the WorkNest Group, bringing together expertise across penetration testing, red teaming, attack simulation, information security, data protection and compliance.

The company also provides GuardNest, its proprietary vulnerability management platform, which combines vulnerability visibility, threat intelligence and compliance capabilities.

WorkNest Secure holds CREST and CHECK accreditations for penetration testing and recently achieved CREST STAR-FS accreditation for intelligence-led red teaming within financial services.

The latest accreditation adds to these credentials as the company continues to develop its technical capabilities and strengthen its position in the UK cybersecurity services market.

WorkNest Secure forms part of WorkNest Group, which employs more than 800 people and supports over 50,000 customers across ten countries.

The post WorkNest Secure Gains The Cyber Scheme Accreditation appeared first on IT Security Guru.

Cybersecurity company Huntress has expanded its distribution partnership with Ingram Micro into Canada, Latin America and the Caribbean, strengthening its channel presence across the Americas.

Building on its existing relationship in the United States, the agreement gives Huntress a single distribution route across the region, making it easier for managed service providers (MSPs) and value-added resellers (VARs) to access and deliver its cybersecurity services.

The expansion comes as Huntress continues to grow internationally, following increased investment in its channel operations across Europe, Africa, Australia and New Zealand.

Simplifying Cybersecurity Distribution Across the Americas

By extending its relationship with Ingram Micro, Huntress aims to reduce the complexity of working across multiple markets while taking advantage of the distributor’s established local infrastructure and partner relationships.

For MSPs and resellers, the agreement provides a more straightforward route to sourcing Huntress products and services through a familiar distribution partner.

Kevin Hallmark, Head of Global Distribution at Huntress, said the move would help the company reach more businesses through its channel partners.

“Partners are central to scaling our mission to protect all businesses, and expanding our relationship with Ingram Micro across the Americas gives more partners a simple, familiar path to Huntress.”

He added: “With coverage across the U.S., Canada, and Latin America through a single distributor, we can move faster to deliver stronger security to the businesses targeted by cybercrime.”

New Opportunities for Canadian MSPs

In Canada, the expanded agreement will allow MSPs and VARs to access Huntress through Ingram Micro’s existing distribution network.

The partnership is designed to help Canadian partners strengthen their cybersecurity portfolios without adding unnecessary complexity to their operations.

Alistair Edmondson, Director of Advanced Solutions at Ingram Micro Canada, said the addition of Huntress would support partners looking to expand their managed security offerings.

“Canadian partners are looking for security solutions that strengthen the protection they deliver without adding unnecessary complexity to their businesses.”

He added that bringing Huntress into Ingram Micro’s cybersecurity portfolio would help partners deliver managed security services while building businesses that can scale.

Supporting Growth Across Latin America

The agreement also extends Huntress’ reach across Latin America and the Caribbean, where differing legal, commercial and regulatory requirements can make regional expansion challenging.

Through Ingram Micro’s export division, Huntress will be able to work with a single distribution partner rather than establishing separate agreements in individual countries.

Daniela Rosa, Vice President and Country Chief Executive for Latin America at Ingram Micro, said the expansion would provide partners with greater access to cybersecurity technology.

“Our partners in Latin America are looking for technology relationships that can scale across borders while supporting the realities of doing business locally.”

She added that the agreement would help partners extend enterprise-grade cybersecurity protection to more customers across the region.

Access to Huntress’ Agentic Security Platform

Under the expanded partnership, Ingram Micro channel partners will gain access to the Huntress Agentic Security Platform, supported by the company’s 24/7 AI-centric Security Operations Centre (SOC).

The platform combines protection across endpoints, identities, logs, security posture and employee behaviour with human-led security expertise.

It also incorporates Athena, Huntress’ agentic investigation system, which uses AI to investigate suspicious activity at machine speed while working alongside security analysts to identify and respond to complex threats.

Huntress currently protects more than 280,000 businesses globally, with MSPs and resellers playing a central role in delivering its managed cybersecurity services.

The latest agreement strengthens the company’s distribution network across the Americas as it looks to make managed security more accessible to partners and the organisations they support.

The post Huntress Expands Ingram Micro Partnership Across Canada and Latin America appeared first on IT Security Guru.

UK-based secure data exchange specialist DOQEX has achieved Cyber Essentials certification, adding another recognised security standard to its existing portfolio of accreditations.

The York-based company, which specialises in protecting sensitive information shared between organisations, already holds ISO 27001, ISO 27017 and ISO 27018 certifications. The latest achievement reflects its continued focus on maintaining strong security controls and protecting customer information.

Cyber Essentials is a UK Government-backed scheme designed to help businesses defend themselves against common cyber threats. It assesses five fundamental areas of cybersecurity: firewalls, secure configuration, security update management, user access control and malware protection.

Getting the Cybersecurity Basics Right

While DOQEX already operates under established international security standards, the company said completing the Cyber Essentials certification process provided a valuable opportunity to revisit its existing controls.

Nick Case, Director and Co-Founder of DOQEX, admitted that the company had initially underestimated the process.

“Having already achieved ISO 27001, ISO 27017 and ISO 27018, I’ll admit we initially underestimated Cyber Essentials. We thought we had the fundamentals well covered, but going through the process reminded us why they matter.”

He explained that the certification’s emphasis on practical security measures provided an important reminder that even organisations with mature cybersecurity programmes need to regularly assess their defences.

“Cyber Essentials has a clear focus on practical, verifiable security controls, and that has genuine value. It’s easy to concentrate on more complex security challenges, but the basics still need attention.”

The certification comes as organisations face increasing pressure to demonstrate that appropriate security measures are in place, particularly when handling sensitive business information or working with external suppliers.

Strengthening Trust Across the Supply Chain

As businesses become more reliant on third-party technology providers and external partners, cybersecurity certifications are playing a growing role in procurement decisions and supplier assurance.

Recognised standards can help organisations demonstrate that they have implemented appropriate safeguards, providing customers and partners with greater confidence in how their information is managed.

Case believes improving baseline security across UK businesses is particularly important as supply chains become more interconnected.

“We fully support what Cyber Essentials is trying to achieve. Raising the baseline of cybersecurity across UK businesses is important, particularly as organisations become increasingly dependent on suppliers and third parties. Stronger security across the supply chain benefits everyone.”

Supporting Secure Data Exchange

Founded in 2013, DOQEX helps organisations securely manage and exchange sensitive information between employees, customers, suppliers and business partners.

Its services combine security technology with managed support, helping businesses maintain control over information as it moves between organisations.

The Cyber Essentials certification builds on the company’s existing ISO standards and reinforces its approach to security governance, accountability and data protection.

For DOQEX, the achievement also highlights a wider message for businesses: while cybersecurity threats continue to become more sophisticated, maintaining effective fundamental controls remains an essential part of protecting sensitive information.

The post DOQEX Achieves Cyber Essentials Certification to Strengthen Security Standards appeared first on IT Security Guru.

Cybersecurity researchers at Forescout are drawing attention to the risks posed by exposed refrigeration control systems, warning that weaknesses in operational technology (OT) could have serious consequences for food supplies, business continuity and other temperature-sensitive operations.

The warning comes following cyberattacks against French supermarkets in October 2026, which reportedly disrupted refrigeration systems at hundreds of stores. Attackers were able to interfere with cooling operations, resulting in temperature fluctuations, spoiled stock and significant disruption.

The incidents have raised concerns about the security of internet-connected refrigeration equipment, particularly where older systems, exposed management interfaces and inadequate access controls leave operational technology vulnerable to interference.

Unlike conventional IT attacks, which frequently focus on stealing data or disrupting digital services, attacks against refrigeration controllers can directly affect physical processes.

These systems are responsible for maintaining temperatures across supermarkets, food storage facilities and other environments where consistent cooling is essential.

If attackers gain sufficient access, they may be able to manipulate temperature settings, interfere with defrost cycles or disrupt equipment operations. The consequences can extend beyond IT downtime to include damaged stock, financial losses and potential safety risks.

The issue also extends beyond food retail. Refrigeration and temperature-control systems are used in healthcare, pharmaceuticals, manufacturing and logistics, making their security an important consideration across several industries.

Internet Exposure Creates Opportunities for Attackers

One of the central concerns is the accessibility of operational technology that was not originally designed to withstand direct exposure to the internet.

Remote management capabilities allow engineers and third-party maintenance providers to monitor and adjust refrigeration equipment without visiting individual sites. However, these connections can introduce security weaknesses if they are poorly configured or inadequately protected.

Research into industrial control systems has identified publicly accessible management interfaces, outdated firmware and weak authentication as recurring problems.

In some cases, organisations may not have complete visibility of the equipment connected to their networks, particularly where systems have been installed and maintained by external contractors.

Forescout Finds Nearly 13,000 Exposed Refrigeration Services Worldwide

New research from Forescout’s Vedere Labs has identified 12,976 internet-exposed service observations across ten product groups, associated with 6,017 distinct public IP addresses in 99 countries and territories.

The findings suggest that the weaknesses highlighted by the French supermarket attacks are part of a much wider global problem.

The largest number of observations involved Copeland/Dixell XWEB services, with 7,075 recorded, followed by 4,697 Danfoss StoreView services. Researchers also identified 551 Copeland Site Supervisor services, 513 Carel pCOWeb services and 140 observations across six other product groups.

Importantly, these figures represent exposed services rather than confirmed compromised devices. A single IP address may host multiple services, while one management interface may control several downstream systems.

The researchers also found that 3,762 Danfoss StoreView service observations, representing 80% of the total, were running firmware older than version 4.3.1, making them potentially vulnerable to two previously disclosed security flaws.

Hacktivists Have Targeted Refrigeration Before

Forescout’s research suggests that attacks against refrigeration systems are not a new development.

According to a technical bulletin published by Danfoss, hacktivist attacks in 2022 affected 16 Russian supermarkets and 40 stores in Israel.

Forescout has also tracked more than 20 claimed attacks against refrigeration systems since January 2026, with pro-Russian hacktivist groups Z-Pentest Alliance and NoName057(16) among the most active.

Targets have included supermarkets, wineries, fruit storage facilities and agricultural businesses across Europe.

However, the researchers stress that the initial access methods and identities of those responsible for the recent French attacks have not been confirmed.

Securing the Cold Chain

Forescout is urging organisations to review how refrigeration management systems are connected to the internet and who is authorised to access them.

Recommendations include removing publicly accessible management interfaces, replacing unsupported equipment, applying available security updates and introducing secure remote access for maintenance contractors.

The researchers also recommend multifactor authentication, individual user accounts and continuous monitoring to identify suspicious changes to temperature settings, defrost schedules and alarms.

The challenge is that attackers do not necessarily need to deploy malware to cause disruption. Once they gain sufficient access, they may be able to misuse legitimate management functions, making malicious activity harder to distinguish from routine maintenance.

The research highlights a broader issue for operational technology security: organisations need visibility not only of connected devices, but also of who can access them, what changes they can make and how those changes affect physical operations.

Read the full research here: Cold Chain, Open Control: Exposed Refrigeration Systems Reveal Global Risk

 

The post Exposed Refrigeration Systems Raise Global Cybersecurity Concerns appeared first on IT Security Guru.

Keeper Security has introduced a new AI-powered phishing protection feature designed to prevent users from entering their credentials on fraudulent websites.

Available through the Keeper Browser Extension, the new Phishing Protection capability uses a local AI engine to detect look-alike domains, spoofed websites and brand impersonation attempts. By identifying suspicious login pages directly in the browser, the feature aims to prevent credential theft before sensitive information reaches cybercriminals.

The launch comes as credential-based attacks continue to pose a significant threat to organisations. According to the 2026 Verizon Data Breach Investigations Report, credential abuse was involved in nearly 40% of breaches.

Meanwhile, cybercriminals are increasingly using generative AI to create convincing fraudulent websites and login portals that imitate legitimate services, making phishing attempts more difficult for users and traditional security tools to identify.

Unlike conventional phishing detection tools that may rely on cloud-based analysis, Keeper’s new feature uses machine learning that operates entirely on the user’s device. Built on Keeper’s zero-knowledge security architecture, the technology analyses websites locally without sharing user data.

“Phishing attacks are no longer simple email scams; they are highly automated, AI-driven operations designed to trick users into handing over sensitive credentials and information,” said Darren Guccione, CEO and Co-founder of Keeper Security.

“When an adversary sets up a look-alike domain, form field or unofficial login portal, traditional security controls often fail to identify the threat until the damage is done. By embedding zero-knowledge AI into our browser extension, Keeper stops credential harvesting at the point of entry, giving individuals and organisations greater security and control.”

Detecting Phishing Attempts at the Point of Entry

Keeper’s Phishing Protection feature automatically examines web pages for characteristics commonly associated with credential-harvesting attacks.

These include typosquatting techniques, where attackers use domains that closely resemble legitimate websites, as well as suspicious IP addresses, unusual URL structures and unauthorised websites requesting password information.

When a potential threat is identified, the extension displays a warning explaining the suspicious activity and the specific indicators detected.

Users can review the warning, dismiss it or disable Keeper on the affected website. They can also manage previously blocked sites and restore autofill functionality where appropriate.

The feature is designed to provide an additional layer of protection against phishing attacks that evade existing email security gateways and web filtering technologies.

Privacy and Administrative Control

Keeper has also emphasised the privacy-focused design of the new capability, with its AI engine processing website information locally rather than transmitting sensitive data to external servers.

“Security controls have to work at machine speed, and they cannot come at the expense of the zero-knowledge guarantees our customers depend on,” said Craig Lurey, CTO and Co-founder of Keeper Security.

“We engineered this AI engine to execute entirely on the local device using the customer’s private key. It delivers continuous, proactive verification of web assets, ensuring that autofill is protected against sophisticated domain spoofing without creating a privacy trade-off.”

The feature is optional and disabled by default. Enterprise IT administrators can enable and manage it centrally through the Keeper Admin Console, while individual users can configure their preferences directly within the browser extension.

Keeper Phishing Protection is available now as an opt-in feature in version 18.2.0 of the Keeper Browser Extension.

The post Keeper Security Launches AI-Powered Phishing Protection to Block Credential Theft appeared first on IT Security Guru.

Organised by Eskenzi PR, the tenth annual awards ceremony took place at St Barts Pub in London, bringing together cybersecurity professionals, educators, industry leaders and advocates to recognise those whose work often goes unnoticed.

Unlike many industry awards, the Security Serious Unsung Heroes Awards are free to enter and attend. The initiative celebrates individuals and teams going above and beyond to protect businesses, communities and individuals, while also championing diversity, wellbeing, education and the next generation of cybersecurity talent.

This year’s event was sponsored by CultureAI, Filigran, OneAdvanced and The Zensory, with additional support from CyberASAP and Pulse Conferences. Media partners included Computer Weekly, Information Security Buzz and IT Security Guru.

Yvonne Eskenzi, Director of Eskenzi PR and Founder of the awards, said: “The Security Serious Unsung Heroes Awards are all about recognising the incredible people working tirelessly behind the scenes to keep our businesses, communities and country safe.

“Cybersecurity can often be a thankless profession, with the dedication and achievements of those working in the industry going largely unnoticed. These awards give us the opportunity to shine a spotlight on those individuals who consistently go above and beyond, while also celebrating the fresh perspectives and diverse talent shaping the future of the industry.

“It was fantastic to bring the cybersecurity community together once again to recognise these remarkable individuals. A huge congratulations to all our nominees and winners!”

Security Serious Unsung Heroes Awards 2026: The Winners

This year’s winners represented a broad cross-section of the cybersecurity industry, from frontline security professionals and ethical hackers to educators, content creators and community advocates.

The full list of winners is as follows:

• Cyber Correspondent: Phil Muncaster
• Godfather of Security: Andy James, Founder and CEO of Custodian360
• Godmother of Security: Dr. Emma Philpott, CEO of IASME
• Data Guardian: Peter Slevin, Cyber Engagement Senior Technical Lead at Bank of Ireland
• CISO Supremo: Andrea Litherland, CISO at Domestic & General
• Security Avengers: Revenge Porn Helpline
• Best Educator: Dr. Chidimma Opara, Senior Lecturer in AI at The Manchester Metropolitan University
• Best Ethical Hacker/Pen Tester: Dominic Mortimer, Head of Red Team at WorkNest Secure
• Channel Champion: Olly Carter, Senior Channel Sales Director, EMEA and APJ, at Forescout
• Senior Leader/Mentor: Meera Tamboli, DFIR Analyst at AVEVA
• Cybersecurity Wellbeing Advocate: Nikki Webb, Director at Custodian360
• Best Security Awareness Campaign: Cyber Local, a collaboration involving Cyber Innovations Ltd., Bournemouth University, Cybexer, Dorset Mind, Dorset Chamber and local authority stakeholders
• Diversity Champion: Segan Ebenezer Olaniyan, Information Security Analyst II at Kraken Technologies
• Apprentice/Rising Star: Jordan Daglish, Acumen Cyber
• Cyber Scribe: Dr. Runli Guo, Reducing Blast Radius LinkedIn newsletter
• Voice of Security: Cyber Agony Aunts podcast and Ant Davis, creator of The Awareness Angle
• Best Academic Entrepreneur: Dr. Peter Garraghan, CEO of Mindgard

Winners Highlight the Importance of Community and Collaboration

Among those recognised was Olly Carter of Forescout, who received the Channel Champion Award for his contribution to the cybersecurity channel ecosystem.

Carter said: “It’s a real honour to be recognised with the Channel Champion Award, but the truth is that nobody achieves anything in the channel alone! I’m incredibly fortunate to work alongside such a talented, passionate, and committed team at Forescout, and some truly fantastic partners.

“For me, the channel has always been about people, relationships, trust and working together to achieve something special.”

The Voice of Security Award was jointly awarded to the Cyber Agony Aunts podcast, hosted by Rebecca Taylor and Amelia Hewitt, and cybersecurity content creator Ant Davis.

Taylor and Hewitt said: “Cyber Agony Aunts comes from a very real place for us – it’s all about community, honesty and reminding people that behind the technology, cyber is ultimately about people.

“We’ve had some incredibly open conversations, plenty of laughs and a few tears along the way, so to see the podcast recognised like this is something we’re incredibly proud of. This award belongs just as much to our guests and the community as it does to us.”

Nikki Webb, Director at Custodian360, was recognised as Cybersecurity Wellbeing Advocate for her work supporting people across the industry.

Webb said: “Our industry asks a lot of people, long hours, high pressure, and the weight of protecting others. Looking after the people behind the screens matters just as much as the technology itself, and I’m so proud to see that recognised.”

Recognising Education, Innovation and Awareness

The awards also highlighted the importance of making cybersecurity more accessible through education, awareness and research.

Dr. Chidimma Opara received the Best Educator Award for her contribution to inspiring the next generation of cybersecurity professionals.

Reflecting on her win, Opara said: “What makes this award so special is knowing that the work I love doing as an educator is making a meaningful difference in motivating the next generation of cybersecurity professionals.

“If my students leave my classroom feeling valued, believing in themselves a little more, and inspired to reach their potential, then I know I am doing something worthwhile.”

Meanwhile, Cyber Local received the Best Security Awareness Campaign Award, recognising a collaborative initiative involving academic institutions, local organisations and cybersecurity specialists.

Emily Rosenorn-Lanng, CEO and Co-Founder of Cyber Innovations Ltd., as well as pioneer of the Cyber Local project, said: “Ours has always been about helping people feel confident and supported when something goes wrong online, so to win Best Security Awareness Initiative, in a category full of such strong work, means a huge amount to me, to the Cyber Innovations team and to everyone who worked on it with us.”

The newly introduced Cyber Scribe category was awarded to Dr. Runli Guo for her LinkedIn newsletter, Reducing Blast Radius, which explores emerging cybersecurity challenges, particularly those associated with agentic AI.

Guo explained: “Agentic AI is quickly becoming the most discussed topic in cybersecurity, yet the associated threats and risks aren’t always fully understood. With the rapid rate of change in this space, CISOs and architects simply don’t have the time to read every update.”

She added that her work focuses on sharing practical insights and hands-on demonstrations to help security professionals understand and reduce the potential impact of emerging threats.

Dr. Peter Garraghan, CEO of AI security company Mindgard, was also recognised with the Best Academic Entrepreneur Award, highlighting the role of academic research and commercial innovation in addressing new cybersecurity challenges.

A Decade of Celebrating Cybersecurity’s Unsung Heroes

The ceremony was hosted by Yvonne Eskenzi and Clive Room, Director of Pulse Conferences, with winners selected by a judging panel comprising representatives from across the cybersecurity industry, academia and media.

This year’s judges included Alex Scroxton of Computer Weekly, Sam Soares of CultureAI, Joe Pettit of Bora, Emma Fadlon of CyberASAP, Beth Maundrill of Infosecurity Magazine, Stuart Coulson of HiddenText and Holly Foxcroft of OneAdvanced, alongside Eskenzi and Room.

The evening also raised £250 for NSPCC Childline through a charity raffle.

Now in its tenth year, the Security Serious Unsung Heroes Awards continues to recognise the individuals whose contributions extend beyond technical expertise, celebrating mentorship, collaboration, community engagement and the people helping to make cybersecurity a more inclusive and supportive profession.

Further information about the awards is available at www.securityserious.com.

The post Security Serious Unsung Heroes Awards Celebrates 10 Years of Recognising Cybersecurity’s Hidden Heroes appeared first on IT Security Guru.

Salt Security has won three categories at Cyber Defense Magazine’s 2026 Top InfoSec Innovators awards, recognising its work in agentic AI and API security.

The company received the Most Promising Agentic AI Security Solution, Trailblazing AI-based Cybersecurity Innovation and Transformational API Security Solution awards. The awards were announced at CyberDefenseCon 2026 in Orlando as part of the programme’s 14th annual edition.

The recognition comes as organisations face challenges in overseeing AI agents and securing the APIs through which they access data and carry out tasks.

Salt Security’s State of Agentic AI and API Security 2H 2026 report, released this month, surveyed more than 380 security and technology professionals. It found that nearly half of enterprises had confirmed or suspected that an AI agent took an unauthorised action in the past year. Fewer than one in five could automatically stop a misbehaving agent.

“Our research shows that the governance gap is not theoretical: agents are already acting in ways organizations did not intend, and most organizations cannot stop them in time. We are honored to be recognized as leaders in addressing that problem,” said Roey Eliyahu, CEO of Salt Security.

The company’s Agentic Security Platform discovers AI agents, Model Context Protocol (MCP) servers and APIs within an organisation’s environment. It also governs their connections and permissions, monitors agent behaviour during operation and identifies vulnerabilities before deployment.

Gary S. Miliefsky, publisher of Cyber Defense Magazine, said the judging criteria included an understanding of emerging threats, cost-effective solutions and innovation that could help reduce cyber risk.

The full list of winners is available on the Cyber Defense Awards website.

The post Salt Security wins three InfoSec Innovator awards appeared first on IT Security Guru.

Forescout’s Vedere Labs has identified a previously undocumented malware delivery platform being used in ClickFix campaigns, alongside new delivery techniques associated with malware loaders linked to Vice Society ransomware activity.

The findings, published in two research blogs, examine what happens after victims fall for ClickFix lures. These attacks trick users into copying and running malicious commands, often under the pretence of fixing a technical problem or completing a verification step.

The investigations reveal how attackers deliver different malware families, conceal malicious files and establish access that could support further compromise.

ROMULUS serves multiple malware loaders

During an incident investigation, Forescout researchers discovered a server hosting a panel called ROMULUS. Further analysis identified six IP addresses exposing the same authentication interface and revealed a platform capable of delivering multiple malware loaders.

One of those addresses had previously been identified by Huntress in a campaign that abused ChatGPT’s Custom GPTs to direct victims towards pages hosting ClickFix lures. Forescout independently observed the same malware package being delivered from another ROMULUS server.

Researchers analysed two delivery routes. One used a trojanised installer containing legitimate Stardock software to load malicious code. The other delivered LegionLoader, a malware loader active since 2019, through a series of encrypted archives.

In the LegionLoader route, an archive smaller than 1 MB expanded into an executable exceeding 880 MB. Most of the executable’s size came from artificial padding, which can push files beyond security scanners’ upload limits or sandbox analysis thresholds.

A ROMULUS statistics page also displayed installation and execution counts, a timeline and a breakdown by country, potentially allowing operators to monitor campaign performance.

Forescout said the platform’s operators remain unknown. Researchers could not determine whether ROMULUS is a private tool, a commercial criminal service, an affiliate framework or software shared between operators.

Loader investigation reveals possible connection

The second blog examines Lorem Ipsum and Axolotl, two malware loaders whose relationship had not previously been documented in public research.

The investigation followed a September incident in which attackers used ClickFix to deploy Lorem Ipsum Loader and a Python tunnel client. Forescout contained the incident before ransomware was deployed, although researchers believe ransomware delivery was the attackers’ intended goal.

The tradecraft has previously been attributed to Vice Society, a cybercriminal group associated with several ransomware families, including Rhysida.

Researchers analysed five Lorem Ipsum samples from the incident and 39 Axolotl samples. They identified an additional Lorem Ipsum delivery method using MSI installers and multi-stage PowerShell, as well as three Axolotl variants using different host programs.

The analysis also found overlapping infrastructure and similarities in the loaders’ command-and-control communications. Although their code is distinct, Forescout said the findings suggest Lorem Ipsum may be a later iteration of Axolotl. Researchers could not establish that relationship conclusively.

Forescout recommends monitoring suspicious PowerShell activity, silent installer execution and unexpected DLL loading, alongside educating users about ClickFix and related lures that direct victims to Windows Terminal or PowerShell.

The post Forescout uncovers ROMULUS malware delivery platform behind ClickFix attacks appeared first on IT Security Guru.

Nearly half (49.8%) of organisations have confirmed or suspected that an AI agent took an unintended, unexpected or unauthorised action in the past year, according to new research from Salt Security.

The findings, published in the company’s State of Agentic AI and API Security 2H 2026 report, highlight growing concerns around the security of autonomous AI systems as enterprises increasingly integrate agents into everyday operations.

Based on a survey of more than 380 security and technology professionals, alongside Salt Labs production telemetry from hundreds of customer environments, the research suggests that AI adoption is outpacing organisations’ ability to monitor, govern and contain agent activity.

Among respondents who reported confirmed or suspected unintended agent actions, more than half experienced an unauthorised external API call or transaction, while over 40% reported an agent modifying or deleting data.

The research also found that AI agents are now firmly embedded in enterprise environments, with 86.4% of respondents reporting at least one operating within their organisation and 59.5% running more than ten. Furthermore, 76.8% reported agents capable of chaining actions across other agents, tools and APIs, creating complex sequences that may not have been anticipated by individual teams.

Despite this widespread adoption, visibility remains limited. Just 12.5% of organisations can consistently trace an agent’s complete journey, from its initial instruction through the tools and APIs it accesses to the final outcome. More than 60% would require hours or days of manual investigation to reconstruct an agent’s activity from the previous day.

The ability to respond to unexpected behaviour is similarly concerning. Only 17.5% of respondents said their organisation could automatically stop an AI agent behaving unexpectedly in production. For the majority, intervention remains a manual process, potentially requiring an application to be taken offline.

“The data shows a gap that is already producing real operational consequences,” said Roey Eliyahu, CEO of Salt Security. “Organisations are deploying agents and granting them access to enterprise data, APIs, and services before they can trace what those agents are doing or stop them automatically when something goes wrong.”

Shadow AI Infrastructure and AI-Generated Code Raise Further Concerns

The report also identified emerging risks associated with Model Context Protocol (MCP) infrastructure, which enables AI systems to interact with external tools and data sources.

Nearly a third (32.9%) of respondents reported discovering an unauthorised, shadow or misconfigured MCP server in the past year, while 54.3% had either confirmed or suspected encountering one.

Salt Labs’ own telemetry revealed that MCP-related infrastructure was detected in 21.6% of customer environments in August 2026, compared with 16.7% in January, representing a relative increase of approximately 30%.

Meanwhile, AI-generated code is introducing additional application security challenges. Some 83.5% of respondents estimated that AI-generated or AI-assisted code contributed to at least some of their application security findings.

However, just 6.8% reported resolving these issues directly within coding assistants at the point of generation, leaving vulnerabilities to be identified during subsequent code reviews, testing or after deployment.

Recent Manus Vulnerability Highlights Agentic AI Risks

The findings follow recent research from Salt Labs, which demonstrated how a single malicious email could be used to hijack the Manus agentic AI platform and potentially access a user’s connected email, cloud storage and code repository accounts.

The attack did not require a stolen password or the victim to click a malicious link. Although the platform’s guardrails detected the malicious activity, they were unable to prevent the code from executing.

The vulnerability was responsibly disclosed and has since been remediated.

According to Salt Security, the incident demonstrates how traditional detection mechanisms may struggle to keep pace with autonomous systems capable of executing multiple actions before human intervention is possible.

“The Manus research and this survey data are two views of the same problem,” said Yaniv Balmas, Head of Research at Salt Security.

“In the field, we showed how an agent can be weaponised through a single malicious email, how the guardrail detected the attack at exactly the right moment, and still could not stop the code from running. The survey quantifies how widespread that architecture is.”

The findings underline the need for organisations to strengthen visibility into agent activity, establish appropriate governance controls and develop automated containment capabilities as AI agents gain greater autonomy and access to critical enterprise systems.

The full State of Agentic AI and API Security 2H 2026 report includes sector-specific findings, recommendations for CISOs and further analysis of Salt Labs production telemetry.

The post Nearly Half of Organisations Report Unauthorised AI Agent Actions, Research Finds appeared first on IT Security Guru.

Huntress researchers have uncovered an SEO-poisoning campaign that harvests SSL VPN credentials through a lookalike WatchGuard download page, then hands victims the real, validly signed installer from WatchGuard’s own CDN, leaving endpoint tools with nothing to detect.

The activity, detailed by the Huntress SOC on 13 October, centres on watchguard-vpn[.]net, a lookalike domain posing as a download page for WatchGuard’s Mobile VPN with SSL client. Unlike earlier waves of the campaign, which relied on trojanised installers, this iteration strips the malware out entirely.

A typo and a search result

The incident Huntress investigated began on 7 October, when an administrator at a managed service provider searched Bing for “watchguard vpn sll download”. Eight seconds later they had clicked through to the fake site via a standard Bing result redirect, which Huntress says points to SEO poisoning rather than malvertising.

Two bites at the password

Clicking any download option on the site opens a pop-up asking for the VPN server address, username and password, the same three values the legitimate client requests. The logic sits in roughly 150 lines of unobfuscated JavaScript (popup.js), which posts the entries as JSON to a separate collection domain, watchguard-ssl[.]online.

The first submission is always rejected with an “incorrect data” message, prompting victims to retype carefully or try a different password. That gives the operators a second, likely more accurate, set of credentials, along with the server address they need to log in.

The payload is the real thing

After the second submission, the script triggers a download of WatchGuard’s genuine Mobile VPN with SSL installer (version 12.11.5) direct from cdn.watchguard.com. Huntress verified the file’s Authenticode signature from WatchGuard Technologies and confirmed the binary had not been altered.

With no trojanised MSI or sideloaded DLL in the chain, there is nothing for EDR to flag, and the victim gets exactly the install they expected. Detection was thin across the board: as of 8 October only seven VirusTotal vendors flagged the lure domain and two flagged the collector.

Old domain, new backend

WatchGuard’s Secplicity team first reported watchguard-vpn[.]net in January as part of a wider credential-harvesting campaign spoofing WatchGuard, F5, Fortinet, SonicWall and Sophos clients, though at that point the domain had no working backend. Microsoft later attributed related activity to Storm-2561, a financially motivated actor active since May 2025. WHOIS data shows the domain was registered again on 22 August, with the collector domain following on 14 September. Huntress says it cannot establish whether the same operators controlled both registrations.

In the case investigated, Huntress flagged the activity 21 seconds after the site loaded, and browser history suggests the user did not complete both rounds. The domain was offline as of 13 October, and Huntress has shared infrastructure details with WatchGuard.

Recommendations

• Reset passwords for any account entered on the site and treat the associated VPN endpoint as known to the attacker.
• Enforce MFA on SSL VPN access.
• Monitor for VPN logins from hosting providers, unfamiliar ASNs or new countries.
• Block watchguard-vpn[.]net, watchguard-ssl[.]online, 80.249.132[.]140 and 158.94.209[.]19.
• Publish and bookmark official download links such as software.watchguard.com.

Full research: https://www.huntress.com/blog/fake-watchguard-vpn-credential-phishing

The post Fake WatchGuard VPN site steals credentials, then serves the genuine signed client appeared first on IT Security Guru.

Certes has received Frost & Sullivan’s 2026 Global Enabling Technology Leadership Recognition in post-quantum cryptography (PQC), following an independent evaluation of vendors in the market.

The recognition centres on a problem most security teams are now facing: migrating embedded cryptography across legacy applications, cloud environments and critical infrastructure will take years, but “harvest now, decrypt later” attacks mean data intercepted today could be exposed once sufficiently powerful quantum computers arrive. Frost & Sullivan notes that the risk is greatest for data with long regulatory, legal or commercial lifespans, and that protecting it needs to run in parallel with the longer migration effort rather than wait for it to finish.

Separating cryptography from the stack

At the heart of Certes’ platform is its Cryptographic Abstraction Layer (CAL), which sits between applications and infrastructure and lifts cryptographic protection out of the underlying technology stack. Rather than waiting for each vendor to ship a quantum-safe update and then managing disruptive upgrades, security teams can manage cryptographic change centrally and apply it to data flowing between systems.

The platform comprises the Certes Enforcement Point (CEP), which encrypts and decrypts within the data path, and the Certes Policy Manager (CPM), which manages policies and cryptographic controls centrally. Frost & Sullivan singled out its policy-specific key architecture as a key differentiator: each policy-controlled application or data flow can have its own key material, separate rotation schedules and customer-controlled key components. This is combined with quantum-based random number generation and customer-owned keys to support data sovereignty.

Certes’ patented Layer 4 payload protection encrypts the payload while preserving original network headers, so routing, QoS, monitoring, SD-WAN and flow visibility tools continue to work without applications being rewritten or networks re-architected. Deployment options span physical appliances, virtual machines on VMware ESXi, KVM, Red Hat and Nutanix AHV, and Windows and Linux client agents. Version 7 extends enforcement closer to workloads and users through expanded agent and cloud deployment options, reducing unprotected segments in the data’s journey.

Beyond quantum

The report also highlights uses beyond PQC migration. Cryptographic segmentation can separate IT and OT environments and limit lateral movement in flat networks, while a virtual air gap capability can dynamically isolate critical applications, data flows and backups during an active attack while preserving recovery. Certes’ encryption can also stop sensitive data being exposed to internal or external LLMs, giving organisations tighter governance over AI adoption.

Ozgun Pelit, Senior Industry Analyst at Frost & Sullivan, said: “Certes stands out in the emerging post-quantum security market through its focus on protecting data independently of the applications and infrastructure around it. Its combination of cryptographic abstraction, crypto-agility and centralized policy enforcement provides organisations with a practical way to reduce near-term quantum risk while navigating what will inevitably be a complex, multi-year migration.”

Paul German, CEO at Certes, said: “The next cryptographic revolution could arrive before many organizations have finished implementing the last one. Post-quantum cryptography is only the beginning. As AI and quantum technologies advance, cryptographic change will accelerate, and organisations cannot afford to rebuild their applications, networks and security infrastructure every time it happens.”

He added: “In a world where cryptography must constantly evolve, the ability to change it without changing everything else isn’t a luxury. It’s a necessity.”

The full Frost & Sullivan report is available HERE

The post Certes wins Frost & Sullivan PQC recognition for decoupling encryption from infrastructure appeared first on IT Security Guru.

Check Point Research has disclosed two high-risk vulnerabilities in LiteLLM, the open-source gateway that sits between enterprise applications and AI providers such as OpenAI, Anthropic and Google. The flaws could allow a user with minimal privileges to take full control of the gateway, read sensitive files, execute arbitrary code and harvest the API keys an organisation uses to access its AI providers.

LiteLLM is downloaded around 97 million times a month and has more than 59,000 stars on GitHub. Both issues, tracked as CVE-2026-35029 and CVE-2026-59823, are fixed in version 1.83.9.

One endpoint, three attack paths

The more serious flaw, CVE-2026-35029, is a missing authorisation check on LiteLLM’s /config/update endpoint, which controls the proxy’s runtime configuration. Unlike other administrative endpoints, it did not verify that the caller held the PROXY_ADMIN role.

Compounding this, any user who logs in through the LiteLLM dashboard is issued a session token tied to a special “litellm-dashboard” team, and those tokens are checked against a looser list of permitted UI routes. That list includes “/config”. Because the check uses simple prefix matching, requests to /config/update were allowed for any logged-in user, whatever their role.

Testing against LiteLLM version 1.77.7, the researchers showed the flaw could be used to:

• Read arbitrary files, by injecting an environment variable that sets the path of the dashboard logo and pointing it at sensitive files such as /etc/passwd
• Take over the built-in admin account, by overwriting the UI_USERNAME and UI_PASSWORD variables and logging in with attacker-chosen credentials
• Execute remote code, by registering a “pass-through endpoint” that loads a Python module from an attacker-controlled S3 or GCS bucket, which LiteLLM then downloads and runs

Stealing keys without touching the provider

The second flaw, CVE-2026-59823, is a server-side request forgery (SSRF) issue in LiteLLM’s “Clientside LLM Credentials” feature. By passing a user_config parameter to the /chat/completions endpoint, an authenticated user could create a router pointing at their own server. Requests, along with the provider API keys attached to them, would then be sent to the attacker rather than to the AI provider.

Check Point notes that this code path sidestepped restrictions LiteLLM already placed on client-supplied api_base and api_key parameters.

The researchers also found that password hashes were exposed to low-privileged users and were stored without salting, using a single hash iteration. These issues duplicated an existing advisory, GHSA-69×8-hrgq-fjj8.

Old bugs, bigger blast radius

Check Point is clear that none of these are new classes of “AI” vulnerability. Missing authorisation checks, SSRF and unsafe dynamic module loading are all well understood. What raises the stakes is where they sit. An LLM gateway stores provider keys, manages user permissions and routes every prompt and response, making it a single point of compromise for an organisation’s AI estate. And because LiteLLM is embedded in many other AI platforms and internal tools, some organisations may be running it without realising.

“The industry’s focus has largely been on securing AI models, but this research highlights an equally important reality: AI infrastructure is becoming a new critical layer of enterprise security,” said Mateo Rojas-Carulla, Head of Research, AI Agent Security at Check Point Software Technologies. “As organisations increasingly rely on gateways such as LiteLLM to connect applications, users and AI services, these platforms become attractive targets because they sit at the centre of trust.”

“For LiteLLM users, the immediate priority is patching and reviewing access controls, but the broader lesson extends beyond a single product,” he added. “Attackers will naturally target the layer that gives them the greatest access with the least resistance.”

What defenders should do

Check Point recommends that organisations:

• Upgrade to LiteLLM 1.83.9 or later across every deployment, including instances embedded in other tools
• Audit gateway user accounts and remove any that are not needed
• Rotate AI provider API keys if there is any sign of unauthorised access before patching
• Test that limited roles are enforced in practice, not just on paper
• Bring LLM gateways into scope for regular security assessments

The vulnerabilities were reported to LiteLLM’s maintainers through a coordinated disclosure process that began in October 2025.

Full technical write-up: https://research.checkpoint.com/2026/when-llm-gateways-go-wrong-findings-from-litellm/

The post LiteLLM flaws let low-privileged users hijack AI gateway and steal provider keys appeared first on IT Security Guru.

A coordinated attack on the operational technology (OT) behind supermarket refrigeration has hit hundreds of stores across France, in what security experts are calling one of the clearest examples yet of cyber sabotage with physical consequences.

Retailers confirmed the attack on Monday 12 October, with disruption reportedly beginning on Sunday night. Intermarché and its Netto brand said at least 300 shops were affected, Coopérative U more than 100 and Carrefour 80, with Monoprix, E.Leclerc and Auchan also reporting impacted stores. According to BFM TV, attackers remotely forced refrigeration units into continuous defrost cycles, driving temperatures up to 50°C. Paris prosecutors said the attack also caused fires.

“This incident is not surprising. A supermarket refrigerator is no longer just an electrical appliance. It is a computerized system connected to a network, enabling remote monitoring and control. While this connectivity allows refrigeration systems to be managed efficiently, it also exposes them to cyber security risks, particularly when operational equipment runs for years on outdated software, without regular security updates, and with management interfaces accessible from the internet,” said Oded Vanunu, Head of Vulnerability Research at Check Point.

Unpatched, internet-facing and end of life

The affected equipment has been traced to refrigeration management systems from Danish manufacturer Danfoss. A source close to Prime Minister Sébastien Lecornu said France’s National Cybersecurity Agency (ANSSI) had identified a vulnerability in Danfoss software, and the agency has been ordered to investigate.

Danfoss said most of the compromised units were “legacy” products that no longer receive software or security updates, singling out its AK-SM800 and AK-SC355 controllers, and noted that an affected version of the AK-SM800 was running outdated firmware. The company said it had long advised customers to upgrade or replace these models.

Known vulnerabilities in the control software date back to 2023, some rated critical, with patches available. In August, OT security firm Claroty published research describing flaws in Danfoss systems that could allow attackers to bypass authentication. Reports suggest attackers may have used the Shodan search engine to locate exposed devices, some of which are connected via 3G cards for remote monitoring.

“One of the significant aspects of this incident is that the attackers did not necessarily need sophisticated cyber capabilities. Refrigeration systems have legitimate operational functions, such as defrost cycles, and when an unauthorized party gains access to the system, those same functions can be exploited to disrupt operations. Unlike attacks aimed at stealing data or encrypting files, the impact here is on the physical operation of the equipment itself, with direct consequences such as food inventory losses and potential safety hazards.” Vanunu continued.

“In previous research conducted by Check Point on smart devices, including LG products, we demonstrated how a vulnerability in a centralised management platform could allow attackers to gain control of connected devices. However, in the current incident, it is still unclear exactly how the attackers gained access to the systems.”

OT in the crosshairs

No group has claimed responsibility, and there is no evidence of a ransom demand or data theft. The Paris prosecutor’s cybercrime unit has opened an investigation into what it described as a “large-scale” attack on connected refrigerators at several major food retailers, while ANSSI is coordinating with European counterparts. Sekoia analyst Felix Aime said stores in Spain, Portugal, Poland, Germany and Belgium were also affected.

“The refrigeration systems in supermarkets are operational technology. Building management controls, HVAC, cold chain infrastructure. These are the same category of systems that the security industry has been warning about as the next frontier for sabotage attacks, and they’ve now been weaponised against food retail infrastructure in one of Europe’s largest economies,” said Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress.

ANSSI had already listed sabotage of industrial control systems among the main threats facing France in its most recent threat report.

“Heating fridges to 50 degrees for six hours is not data theft; it is physical sabotage executed through software, and that is the lesson for every sector. Refrigeration controllers, building systems and point-of-sale equipment are now connected and remotely managed, often through a handful of suppliers, so one weak link scales to hundreds of stores overnight,” said Samuel Hassine, CEO and co-founder of Filigran.

“The problem extends beyond a single refrigeration system or an isolated security vulnerability. Operational equipment is often designed to remain in service for 15 years or more, while cyber threats and technologies evolve at a much faster pace. In addition, the same controllers and management systems are deployed across retail chains worldwide, meaning that a compromise affecting widely used technology could potentially impact a large number of locations,” added Check Point’s Vanunu.

Counting the cost

Intermarché chief executive Thierry Cotillard told BFM TV that losses could run to “tens of millions of euros nationwide in a single day”, while Coopérative U’s Dominique Schelcher said larger stores could each lose up to €180,000–200,000 in stock. France’s retail federation, the FCD, has called on Danfoss to provide “full transparency”.

“The immediate financial consequences are significant and visible. Failures at the stores means total write-off of perishable stock across every affected location simultaneously. The operational disruption compounds quickly. Staff cannot trade normally without functioning refrigeration. Products cannot be restocked until systems are restored and verified safe. The food retail sector across Europe should be treating this as a signal that they are being actively targeted,” Huntress’ Patel warned.

“The cyberattack on French supermarkets is a stark reminder that cyber threats extend far beyond stolen data and financial losses. Hackers reportedly manipulated refrigeration systems, raising temperatures to 50°C, causing fires and forcing retailers to dispose of large quantities of food. With hundreds of stores affected, the incident highlights how vulnerabilities in connected systems can have serious real-world consequences, disrupting operations, damaging equipment and potentially putting public safety at risk,” said Jamie Akhtar, CEO and Co-founder of CyberSmart.

Mitigation: find the exposure first

Experts agree that defenders’ first priority should be identifying which OT assets are reachable from the internet, and who holds remote access to them.

“To reduce these risks, the first step is to identify which controllers and management interfaces are directly exposed to the internet and eliminate any unnecessary exposure. It is also important to keep systems updated, replace default passwords, restrict remote access, and enable multi-factor authentication wherever supported. Separating operational control networks from other networks and monitoring unusual changes in system behaviour are also essential measures. These recommendations apply not only to refrigeration systems, but also to HVAC, building management systems, and other operational infrastructure.” said Vanunu.

“It also demonstrates how increasingly interconnected technology can create new opportunities for cybercriminals. For businesses, this reinforces the importance of securing all connected devices and systems, not just traditional IT infrastructure. Organisations should prioritise regular software and firmware updates, strong access controls, multi-factor authentication where supported and network segmentation to prevent attackers moving between systems. Regular security assessments and employee cybersecurity awareness training are also essential for identifying vulnerabilities before they can be exploited. Ultimately, businesses must recognise that cybersecurity is no longer just about protecting data, but also about safeguarding physical operations, customers and business continuity.” said CyberSmart’s Akhtar.

Filigran’s Hassine urged security leaders to put the issue in front of the board: “Boards should ask three questions this week. Which connected equipment could cause physical or financial damage if someone changed a setting, and who can reach it from outside. Which third parties hold remote access, and how that access is monitored and segmented. And has anyone tested that the response works, from detection to switching to manual operation. Resilience in retail now means knowing your exposure before an attacker maps it for you.”

The post Legacy refrigeration controllers exploited in OT attack on hundreds of French supermarkets appeared first on IT Security Guru.

Attackers are exploiting two newly disclosed vulnerabilities in AhsayCBS, the management console for Ahsay’s cloud backup software, to take over servers and quietly run cryptocurrency miners, according to researchers at Huntress.

AhsayCBS (Cloud Backup Server) is mainly used by managed service providers (MSPs) and system integrators to create users and manage backup policies for their clients. As of 8 October, Huntress had seen five organisations targeted via the flaws.

From disclosure to exploitation in three days

The two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, were published to the US National Vulnerability Database (NVD) on 4 October. Huntress began seeing exploitation attempts on 7 October at 23:20 UTC.

CVE-2026-105133 is a medium-severity flaw in the checkSysPwd function that can lead to improper authentication. CVE-2026-105134 is a critical-severity vulnerability in the /rps/api/json/UpdateReceivers.do endpoint of the Replication Receiver component. It contains an authentication bypass that allows a random token to stand in for valid credentials, leading to unauthenticated remote code execution as NT AUTHORITY\SYSTEM.

Attackers chained the two flaws, first bypassing authentication and then gaining code execution. They configured a malicious replication receiver and dropped a JSP webshell into the application directory served by CBS. Huntress first spotted the activity through suspicious command lines spawned by the cbssvcX64.exe service.

Versions up to 10.3.2 are affected. Version 10.3.4, released on 5 August, is not vulnerable.

A miner in disguise

Once inside, the attackers downloaded a set of payloads from an Alibaba Cloud object storage host. These included an XMRig Monero miner disguised as Microsoft Edge (edge.exe), and a modified copy of the NSSM service utility (msedge.exe). The attackers used it to run the miner as a SYSTEM-level service named MicrosoftEdgeUpdateSvc, mimicking the genuine Edge update service. The miner connected to a Monero mining pool on port 8029.

A PowerShell script, Taskgmr.ps1, was used to help the miner avoid detection. If Task Manager was opened, the script stopped the fake Edge service to hide the mining activity. It also killed Task Manager at 18:00, as well as whenever it had been left open for more than an hour overnight, based on the endpoint’s local clock rather than UTC. Huntress said the script appears to be AI-assisted, given its commented code.

In one incident, the attackers also loaded WinRing0x64.sys, a legitimate but vulnerable kernel driver. Huntress noted that attackers often use vulnerable drivers to disable endpoint security tools. In this case, loading the driver gave the miner kernel-level access to the hardware.

[Optional: approved spokesperson quote to be inserted here]

What defenders should do

Huntress is urging organisations running AhsayCBS to:

• Upgrade to version 10.3.4 immediately.
• Restrict access to the AhsayCBS management web interface to trusted IP addresses only, or require VPN access.
• Fully re-image any compromised host from a trusted backup, as attackers may have left additional backdoors.
• Deploy the Sigma detection rules and block the indicators of compromise published by Huntress, including the mining pool, payload URLs and file hashes.

Huntress said it is working with potentially affected organisations across its customer base to apply these mitigations.

Full research, including indicators of compromise and detection rules: https://www.huntress.com/blog/ahsaycbs-flaws-exploit

The post Attackers exploit AhsayCBS backup flaws to deploy disguised crypto miners appeared first on IT Security Guru.

WorkNest Secure has achieved CREST Simulated Targeted Attack & Response for Financial Services (STAR-FS) accreditation, recognising its ability to deliver intelligence-led red teaming assessments for organisations operating in high-risk and regulated environments.

The accreditation confirms that WorkNest Secure meets CREST’s standards for conducting threat-led penetration testing, using realistic attack scenarios to assess how effectively organisations can prevent, detect and respond to sophisticated cyber threats.

Developed in collaboration with the Bank of England, Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA), STAR-FS is designed to help financial institutions assess the resilience of their critical business services against realistic cyberattacks.

Moving Beyond Traditional Penetration Testing

While conventional penetration testing focuses on identifying technical vulnerabilities, red teaming takes a broader approach by simulating how a determined attacker might target an organisation’s people, processes and technology.

STAR-FS assessments use commercial threat intelligence to develop scenarios based on the tactics, techniques and procedures used by real-world threat actors. These scenarios are then used to test an organisation’s security controls, detection capabilities and incident response processes.

The aim is to identify not only where weaknesses exist, but how effectively an organisation would respond if an attacker attempted to exploit them.

Kirsty Fowler, Managing Director of WorkNest Secure, said organisations are increasingly looking for more comprehensive ways to assess their cyber resilience.

“There is growing demand for security testing that goes beyond identifying technical vulnerabilities. Red teaming provides organisations with a much clearer understanding of how well their people, processes and technology work together when faced with a determined attacker.”

She added: “Achieving CREST STAR-FS accreditation is an important milestone for WorkNest Secure. It recognises the expertise of our red team and ability to deliver intelligence-led assessments that meet one of the highest standards in the industry.”

Strengthening Offensive Security Expertise

The accreditation follows the launch of WorkNest Secure, which brought together the cybersecurity expertise of Pentest People and Bulletproof under a single brand.

It also reflects the company’s continued investment in offensive security services, particularly as organisations face increasing pressure to demonstrate that their security controls and response capabilities can withstand realistic attacks.

Dominic Mortimer, Head of Red Team at WorkNest Secure, said effective red teaming should challenge assumptions about how well an organisation is protected.

“Red teaming is about understanding what would happen if a skilled attacker genuinely targeted your organisation. It’s designed to replicate realistic attack scenarios, challenge assumptions and provide organisations with valuable insight into how effectively their security controls, detection capabilities and response processes perform under pressure.”

Mortimer added that achieving STAR-FS accreditation demonstrates the company’s commitment to maintaining high technical standards while continuing to develop its offensive security capabilities.

The accreditation expands WorkNest Secure’s existing portfolio of CREST-accredited services and supports its focus on helping organisations adopt a more proactive, intelligence-led approach to managing cyber risk.

The post WorkNest Secure Achieves CREST STAR-FS Accreditation for Red Teaming appeared first on IT Security Guru.

Organisations worldwide faced an average of 2,803 cyber attacks per week in September 2026, up 16% on August and 48% on the same month last year, according to new data from Check Point Research.

The figures point to sustained growth rather than a one-off spike. Weekly attacks per organisation have climbed 36% in five months, from 2,055 in May.

UK organisations faced an average of 1,920 attacks per week, a 50% increase year on year. Europe recorded the fastest growth of any region, with attacks up 61%, while Latin America faced the highest volume at 3,813 weekly attacks per organisation, followed by Africa (3,701) and APAC (3,593).

“September’s data shows cyber risk increasing in both volume and breadth,” said Barnaby Nickels, regional manager for exposure management (UKI & North EU) at Check Point.

Education hit hardest as term begins

Education was again the most targeted sector, averaging 6,656 weekly attacks per organisation. That is up 59% year on year and 24% on August, the second-highest monthly rise of any industry, as students, staff and parents reconnected to institutional networks at the start of the academic year. Telecommunications ranked second globally with 3,483 weekly attacks (up 29%), followed by Government with 3,443 (up 37%).

The picture was similar in the UK, where Education and Government were the two most targeted sectors, followed by Media & Entertainment, Energy & Utilities and Software.

The Gentlemen tops ransomware rankings

A total of 824 ransomware attacks were published on double-extortion groups’ leak sites in September, 53% more than in September 2025. The Gentlemen was the most prolific group, responsible for 13% of published attacks, ahead of Qilin (9%) and Akira (5%). A further 80 extortion groups also posted victims during the month.

The Gentlemen is a fast-growing ransomware-as-a-service (RaaS) operation founded in mid-2025. It operates as both a RaaS provider and an initial access broker, and supports Windows, Linux and ESXi environments.

Business Services accounted for 31.3% of reported victims, followed by Consumer Goods & Services (15.2%) and Industrial Manufacturing (11.0%). Because business services providers often hold data or system access on behalf of multiple clients, a single incident can spread well beyond the organisation first hit. North America accounted for 46% of reported incidents, Europe 25% and APAC 17%.

Phishing more frequent, and mostly link-based

One in every 91 emails (1.1%) was classified as phishing in September, up from 1 in 112 (0.89%) in August. Malicious links remained the main delivery method, appearing in 81% of phishing emails, while 11% carried attachments and the rest relied on social engineering alone.

Associations & Nonprofits saw the highest phishing rate at 2.17%, or 1 in 46 emails, roughly double the global average. Construction & Engineering followed at 2.05% (1 in 49) and Real Estate, Rentals & Leasing at 1.38% (1 in 72). North America was the most affected region, with 1 in 79 emails classified as malicious.

GenAI prompts exposing infrastructure details

Enterprise GenAI use continued to expand, with the average user generating 131 prompts in September and each organisation using an average of eight tools. One in every 39 prompts posed a high risk of sensitive data leakage, affecting 89% of organisations that regularly use GenAI. A further 14% of prompts contained potentially sensitive information.

Network and IT infrastructure data was the most commonly exposed category, observed in prompts at 71% of organisations. This includes hardware and network configurations and IP addresses, details that could give attackers valuable insight into an internal environment. It was followed by financial data (70%), legal and regulatory data (68%), employee and HR data (62%) and personally identifiable information (60%).

By industry, Business Services had the highest high-risk prompt rate at 1 in 20, followed by Financial Services (1 in 25) and Healthcare & Medical (1 in 29).

“With attacks rising across every region, phishing becoming more frequent, ransomware remaining elevated and GenAI use expanding alongside sensitive-data exposure, security teams cannot rely on fragmented defences. They need prevention-first protection that combines visibility, control and automation across network, cloud, endpoint, email and AI usage to stop threats before they disrupt operations or expose sensitive information,” concludes Nickels.

The full September 2026 report is available here: https://blog.checkpoint.com/research/september-2026-cyber-threat-landscape-global-attacks-jump-48-as-phishing-and-genai-data-exposure-rise/

The post Global cyber attacks up 48% as ransomware and phishing climb, Check Point finds appeared first on IT Security Guru.

Filigran has announced the speaker line-up for THREAD, its first annual event for the cyber defence and threat intelligence community, taking place in Paris on 15 October. The free, one-day gathering at Les Jardins de Saint-Dominique will feature speakers from Accenture, Centrica, Thales Group and the FBI. Its programme combines strategic discussions with practical sessions on threat intelligence, exposure management and cyber resilience.

Morning sessions will be followed by afternoon tracks featuring cyber threat intelligence (CTI) and computer emergency response team (CERT) practitioners from Dassault Systèmes, Hermès and Richemont, who will share their experiences and approaches. According to Filigran, the event will focus on hands-on labs and community-led workshops. It builds on the community model behind its open-source platforms, with users contributing connectors, sharing playbooks and helping shape product development.

“Defenders get ahead when they share what they see,” said Samuel Hassine, CEO and co-founder of Filigran. “Public organisations, corporations and practitioners have built OpenCTI and OpenAEV with us from day one. THREAD brings that community into one room to compare what works in the field, and decide together what we build next.”

A “Build Your Own Agent” lab will allow attendees to use the XTM One agent wizard to turn their workflows into AI agents. Tasks will include triaging threat reports and converting intelligence into attack scenarios, demonstrating how agentic AI can support continuous threat exposure management (CTEM).

Filigran will also unveil the beta programme for OpenCRQ, a cyber risk quantification module within its XTM Platform. The platform connects threat intelligence through OpenCTI, exposure validation through OpenAEV and cyber risk quantification through OpenCRQ, with XTM One providing the agentic core.

The programme caters for CTI analysts, security operations teams and red, blue and purple team practitioners. CISOs will be able to join closed-door, off-the-record roundtables organised by industry, alongside strategic sessions covering CTEM, NIS2 and DORA.

Attendees can also discuss Filigran’s product roadmap directly with its teams in a Community Zone. The company publishes its roadmap and allows users to vote on future features.

Places can be requested through the THREAD event website.

The post Filigran announces speakers for first THREAD event appeared first on IT Security Guru.

UK cybersecurity specialist Core to Cloud has appointed David Brown as Managing Director, strengthening its leadership team as the company looks to expand its managed security services business.

Brown brings more than 20 years of experience across cybersecurity, managed services and enterprise technology. He will oversee the day-to-day operations of Core to Cloud, working alongside CEO and Founder James Cunningham to support the company’s next stage of growth.

Based at the company’s Cirencester headquarters, The Castle, Brown will focus on strengthening operations, developing its services and building on its existing customer relationships.

Bringing Extensive Cybersecurity Experience

Before joining Core to Cloud, Brown held senior leadership positions at QuoIntelligence, CounterCraft, Forescout and ZeroFOX, where he helped build and scale commercial and operational teams across UK and international markets.

His appointment comes as Core to Cloud continues to develop its position in the managed cybersecurity market, supporting organisations that need specialist expertise and ongoing security support.

The company currently works with more than 150 organisations across sectors including the NHS, retail, financial services, manufacturing and critical national infrastructure.

Its services cover five core areas: Managed Detection and Response (MDR), Third-Party Cyber Risk Management, Security Assurance, Dark Web Monitoring and Threat Intelligence, and Cyber Crisis Simulation.

Core to Cloud operates as an extension of its customers’ security teams, combining technical expertise with ongoing support to help organisations improve their cyber resilience.

Supporting the Next Stage of Growth

James Cunningham, CEO and Founder of Core to Cloud, said the appointment marks an important moment for the business.

“We’ve reached an important stage in Core to Cloud’s growth, and David will play an important part in what comes next. We have built a strong business with a talented team, trusted customer relationships and a clear opportunity to grow. David has the experience and leadership skills to turn that opportunity into something much bigger.”

Cunningham added that Brown’s experience in scaling businesses, combined with his understanding of the cybersecurity market, would be important as the company continues to develop.

“He understands how to scale a business without losing sight of the people, culture and customer relationships behind its success. His commercial experience, operational discipline and knowledge of the cybersecurity market make him the right person to lead the day-to-day business through its next phase.”

Maintaining a Customer-First Approach

For Brown, a key priority will be building on Core to Cloud’s existing strengths while ensuring the company maintains its approach to customer relationships as it grows.

“Core to Cloud has earned the trust of its customers by combining strong technical expertise with a genuinely personal approach. That combination stood out to me,” he said.

“The company understands that customers do not simply need more security products; they need a partner that knows their business, works alongside their teams and helps them achieve better outcomes.”

Brown added that his focus would be on strengthening the company’s operations and services while retaining the responsiveness and customer focus that have helped establish its reputation.

The appointment follows Core to Cloud’s recent addition of former Currys CIO Andy Gamble as Advisory Board Chair, further strengthening its leadership as it prepares for its next phase of development.

The post Core to Cloud Appoints David Brown as Managing Director appeared first on IT Security Guru.