Security news

Better AI Returns Start With Stronger Foundations

Data Quality and Governance Help Technology Leaders Scale AI Organizations with mature AI governance and data practices were 15 times more likely to report strong returns, SAS and IDC found. As agentic AI moves into production, CIOs need explainability, oversight and reliable data to scale the technology with confidence.

FDA Pilot Gives AI Health Tools a Real-World Test Bed

4 Manufacturers Will Test Tools for Diabetes, Hypertension and Mental Health The FDA's TEMPO pilot allows selected AI-enabled health devices to reach chronic care patients before formal marketing authorization while manufacturers collect real-world evidence regulators can use to evaluate safety, performance and patient outcomes.

US Warns Chinese AI Firms Are Illicitly Distilling Models

CISA Says DeepSeek, Alibaba and Others Extracted Billions of Tokens From US Frontier AI Systems The U.S. government warned that Chinese AI companies are illicitly distilling American-made AI models, formally acknowledging complaints from frontier labs like Anthropic and OpenAI.

Ukraine Must Cultivate 'Security-Minded' Cyber Defense

Ask 'Why Has It Been Compromised?' Says Security Service of Ukraine Official Ukrainian cyber defenders, now in their fifth year of fending off a Russian invasion that includes combined cyber operations and kinetic strikes, need a more "security-minded" point of view, one of the country's top cyber defense officials said Tuesday.

[Virtual Event] Building a Secure AI Strategy for the Enterprise

September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows

Possibly wormable bugs and two zero-day holes highlight the almost 1,000 fixes issued today by Microsoft in its September Patch Tuesday release. The 964 vulnerabilities, another record since Microsoft began using AI in the middle of the year to find holes, require customer action. Excluded are 174 third-party/open-source CVEs and 23 Chromium/Edge CVEs, as well as nine Microsoft mitigated vulnerabilities in applications like Azure, Entra, and Copilot Studio where no customer action is required.…

Cisco bundles fixes for multiple vulnerabilities, some critical, into one patch

Cisco is looking to get ahead of attackers with a new set of more than a half-dozen fixes, some of them critical, for its IOS XR Linux-based network operating system (OS). As part of its regular testing, Cisco’s software engineering team flagged “multiple internally-discovered vulnerabilities,” the company said. These flaws could allow attackers to perform remote code execution (RCE) and gain root access on a router, thereby allowing them to intercept traffic. Other potential risks could…

Microsoft adds age-awareness APIs that can tell if users are children, teens, or adults

Microsoft is adding new age-awareness APIs to Windows 11 that will allow apps to determine whether someone is a child, teenager, or adult without exposing their exact date of birth. [...]

Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

While the vendor hit another monthly record, it hasn’t resulted in a flood of active exploits. Researchers encourage customers to focus on their specific areas of risk and exposure. The post Microsoft discloses two actively exploited zero-days among 974 vulnerabilities appeared first on CyberScoop.

Attackers Use Multi-Hop Google Redirects for Phishing Campaign

Threat actors are abusing multiple Google services to evade detection, ultimately harvesting credentials or installing ScreenConnect remote access.

Feds accuse China of ‘systematic’ distillation of U.S. AI models

A joint advisory alleges Chinese companies are using sophisticated systems to route millions of data requests to US AI models across different accounts and platforms. The post Feds accuse China of ‘systematic’ distillation of U.S. AI models appeared first on CyberScoop.

OpenAI Agents Took Over Wiki Site Before Hugging Face Attack

Researchers and OpenAI disagree on whether the earlier incident involving DseWiki was a “hack” that the company did not disclose.

DoppelCart fraud network uses 119,000 fake shops to steal credit cards

A massive operation dubbed "DoppelCart" uses more than 119,000 domains to run a network of fake e-shops that steal payment card details. [...]

Russian national extradited to US for alleged involvement in bank-account takeover scheme

Authorities accuse the 36-year-old and co-conspirators of collecting more than 5,000 victim login credentials to various banks. The post Russian national extradited to US for alleged involvement in bank-account takeover scheme appeared first on CyberScoop.

The EU CRA's Real Question: What Shipped, and When Did You Know?

The EU Cyber Resilience Act's vulnerability reporting requirements take effect September 11, giving software vendors as little as 24 hours to report actively exploited flaws. ActiveState explains why knowing exactly what shipped and when vulnerabilities were discovered will be critical to meeting the new requirements. [...]

Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit

A Linux rootkit targeting devices in F5 BIG-IP APM environments can intercept PHP file loading and inject a fileless web shell directly into memory, avoiding the need to write malicious code to disk. [...]

CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

The deputy director cited Operation Absolute Resolve as evidence that cyber teams have become central to CIA missions. The post CIA’s Michael Ellis says cyber intelligence is changing how the agency operates appeared first on CyberScoop.

Microsoft releases Windows 10 KB5122878 extended security update

Microsoft has released the Windows 10 KB5122878 extended security update, which includes this month's record-breaking September 2026 Patch Tuesday fixes, along with a few bug fixes. [...]

Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day

Tracked as CVE-2026-75650, the exploited defect allows unauthenticated attackers to execute arbitrary code. The post Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day appeared first on SecurityWeek.

Why federal cyber defense demands an offense-driven mindset

Static checklists and annual penetration tests leave agencies with dangerous blind spots. True resilience requires moving from reactive attestation to continuous, automated validation. The post Why federal cyber defense demands an offense-driven mindset appeared first on CyberScoop.

Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

Today is Microsoft's September 2026 Patch Tuesday, with security updates released for a record-breaking 966 flaws, including two actively exploited zero-day vulnerabilities. [...]