Category: Uncategorized

The personal AI agents rollout is going about as smoothly as expected: Amazon now blocks Meta’s Muse because it doesn’t identify itself as a bot while browsing; Instinct keeps raising privacy concerns; and the horror stories from pretty much every personal AI agent keep piling up.

Regardless, the tech world is mesmerized by the capabilities and potential of these services. Less than a year after the first release of the open-source agent now called OpenClaw, the juggernauts are putting their weight behind the idea that each of us needs a personal assistant.

You know what’s coming: your employees will connect their personal agents to work systems. There’s no stopping that. Their agents already manage their home time, and managing their work time is the next logical step. For them, that is. Not for your security.

Given that personal agents will reach corporate systems whether approved or not, you might be wondering what the best way is to block them. If that’s your thinking, we’re here to offer you another path: enable safe usage instead, with identity as the control plane, and reap the benefits.

BYOD, meet BYOA(I)

The Bring-Your-Own-Device shift is the obvious comparison, but calling this the new era of BYOD would undersell the challenges personal AI agents introduce. These aren’t just devices presumed to be insecure that contain company data, but entire AIs that act on company systems in the employee’s name.

Bring-Your-Own-AI (or Bring-Your-Own-Agent) is, then, an identity challenge first and foremost. The best-case scenario is an agent wielding identities with an owner of record, limited approval, and no offboarding. You will also have agents who pretend to be employees, and agents with identities that have no easily recognizable owner.

• Discovering the agents already connected. This is your Shadow AI inventory, which you assemble based on the different ways AI agents access your systems. These can be OAuth grants to agent vendors, sign-ins from vendor cloud ranges, long-lived API keys issued to unknown clients, or EDR findings.
• Attributing each agent to a human owner.
• Right-sizing the agent’s access. A personal agent inherits everything its owner can do, and it’s usually asked to do a sliver of that.
• Retiring the agent when the owner leaves, including grants, tokens, and sessions that outlive the account.

Easier said than done, obviously, but some of the fundamentals are there. More will likely be added in the coming months to create the connective tissue between personal AI agents and workplaces. For example, we still need to know if whoever signs in with a username and password is an employee or their agent. Agent-to-agent communication isn’t solved yet. And the ability to compartmentalize knowledge, so that a personal agent loses it during offboarding, isn’t here yet.

Additional controls are coming, but you don’t have to wait for the vendors to catch up. Token Security already finds the personal agents connected to your systems, ties each one to its owner, trims its access, and shuts it off when the employee leaves. Identity is the control plane for AI agents and personal agents are no different. See it on your own environment.

Ravie LakshmananOct 12, 2026Cybersecurity News / Hacking

Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That’s not much time to read the warning, let alone do something about it.

But speed is only part of the problem. A secure connection didn’t always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves. Malware got better at hiding its tracks. And some systems turned out to be easier to break into than anyone would like to admit. The odd part is how normal much of it looked until someone checked closer.

There’s more going on here than a few bad bugs and clever attacks. Some of the smaller stories are just as telling. This week’s full recap is worth a read, especially the bits that didn’t make the big headlines.

⚡ Threat of the Week

Atlassian Flaw Exploited in the Wild — Threat actors have begun to exploit a newly disclosed critical security flaw impacting Atlassian Data Center products that could allow access to sensitive files under certain conditions. The arbitrary file access flaw, tracked as CVE-2026-21589 (CVSS score: 9.3) affects multiple products, including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. The exploitation activity targeting its honeypot network is said to have begun two hours after watchTowr released additional technical details of the vulnerability.

• Ransomware Recovery CEO Charged for Secretly Paying Hackers — Zohar Pinhasi, the owner of Florida-based ransomware recovery firm MonsterCloud, was hit with wire fraud charges for allegedly falsely claiming he could help victims restore data without paying ransoms. Instead, prosecutors said Pinhasi simply paid ransoms and charged victims a fee that was significantly higher than the original ransom demand. MonsterCloud was also highlighted in a 2019 ProPublica investigation on companies defrauding ransomware victims by paying ransoms and charging exorbitant fees.
• New DarkSword Variant Detected — A previously unseen variant of the DarkSword iOS exploit kit called P7 DarkSword has been updated to support on-device keychain and crypto-wallet theft, and facilitate two-way C2 communication with the attacker’s infrastructure. The new variant is much better at hiding itself and cleaning up its behavior, rendering previous indicators of compromise (IOCs) ineffective. The changes indicate substantial work by the operators rather than simple modifications. The most important change is that it can extract Keychain data directly on the iPhone before sending it to the attackers, as opposed to copying the entire Keychain database for processing remotely. Evidence indicates that the exploit kit is distributed via malicious ads as part of watering hole attacks.
• UAC-0099 Continues to Update MATCHBOIL Malware — The Russia-aligned threat actor known as UAC-0099 is actively refining a malware downloader called MATCHBOIL, suggesting it intends to use the tool in future attacks. Over the past year, MATCHBOIL has evolved from a dropper that essentially executed once, contacted its C2 server, and downloaded and installed a next-stage payload, into one that’s run every two minutes. The change allows it to repeatedly contact its control server and fetch new or updated payloads.
• FBI Disrupts Hacking Tools and Domains Linked to Flax Typhoon — The U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon. While Microscan was used to conduct reconnaissance and computer vulnerability scanning, FishHub allegedly enabled the exploitation of computer networks through spear-phishing attacks and the deployment of follow-on payloads. CISA’s acting executive assistant director for cybersecurity, Chris Butera, said Chinese government hackers “continue to position themselves within critical infrastructure networks, including operational technology (OT) systems, with the aim of disrupting critical functions at a future time of their choosing.” Integrity Technology is best known in China for developing the country’s cyber ranges and has publicly touted its extensive government funding in the past. Natto Thoughts research said the company was founded in 2010 by Cai Jingjing, a legendary hacker in China.
• Another ShinyHunters Arrest Made — FBI said it made a third arrest in connection with the ShinyHunters group, as the net closes around the notorious cybercrime group. “Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent FBIjobs.gov incident, which occurred on a platform managed by a third-party vendor,” FBI director Kash Patel said. Although the identity of the individual was not disclosed, court documents, POLITICO, and independent security journalist Brian Krebs said it was Edward Dubrovsky, a 54-year-old cybersecurity executive and investor based in Toronto. Dubrovsky has been charged with conspiracy to threaten to impair the confidentiality of information with the intent to extort money, and interference with commerce by threats. It is the third publicly announced arrest since news of ‌the ⁠breach came out in late September 2026. In a Telegram post, the group said, “We will not remain active on Telegram for much longer, as several of our members have reportedly been arrested by the FBI.”
• Attackers Hijack Three ccTLDs to Obtain Google Certificates — Google said unknown threat actors obtained unauthorized HTTPS certificates for several Google domains and hijacked domains in the country-code top-level domains (ccTLDs) for Ghana (.gh), American Samoa (.as), and Sierra Leone (.sl) after compromising third-party operators and modifying authoritative DNS records. “During these hijacks, attackers modified authoritative DNS records and obtained unauthorized HTTPS certificates covering several Google domains, as well as domains belonging to other organizations,” Google said. “Following our initial mitigation, Certificate Transparency (CT) log data revealed additional organizations, including several leading global brands and widely used online services, believed to have been impacted by the same attacks.” Chrome blocked the unauthorized certificates through CRLSets.
• GoBalance Flaw Can Be Used to Hijack TOR .onion Sites — A vulnerability in GoBalance, a load-balancing tool used by many darknet sites, can be abused to recover a site’s master signing scalar from its publicly available data, ultimately enabling site takeover and redirection. “Between 5 and 7 October, both onion addresses of Dread, a prominent darknet forum, were taken over and redirected to a rival platform, Conclave,” Searchlight Cyber said. “Several marketplaces using the same software were also affected. Dread’s operators initially attributed the incident to an accidental key leak; the evidence set out below indicates that the GoBalance flaw was the more likely cause, at least for the second address.”

‎️‍🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first — CVE-2026-86360, CVE-2026-86361, CVE-2026-86362 (Dell System Update), CVE-2026-21589 (Atlassian), CVE-2026-93355 (LiteLLM), CVE-2026-106382, CVE-2026-106197, CVE-2026-106358, CVE-2026-106347 (Google Chrome), CVE-2026-102255 (SonicWall SMA 1000), CVE-2026-105192 (LMCache), CVE-2026-102406, CVE-2026-103008, CVE-2026-102404, CVE-2026-102413 (Elasticsearch), CVE-2026-104711, CVE-2026-104712, CVE-2026-104713, CVE-2026-104714 (Apache Struts), CVE-2026-91140 (Progress DataDirect), CVE-2025-64393, CVE-2026-58069 (Veeam Backup & Replication), CVE-2026-32740 (Next.js), CVE-2026-18397 (Thales SConnect), CVE-2026-84388 (Fortinet FortiPAM Chrome extension), CVE-2026-76464, CVE-2026-20328, CVE-2026-76454, CVEs, CVE-2026-76482, CVE-2026-76480, CVE-2026-76483, CVE-2026-76455, CVE-2026-76459, CVE-2026-76471, CVE-2026-76465, CVE-2026-76485, CVE-2026-76486, CVE-2026-76501, CVE-2026-76498, CVE-2026-76499, CVE-2026-76500 (Cisco), CVE-2026-76281, CVE-2026-76282, CVE-2026-76284, CVE-2026-76268 (Splunk), CVE-2026-85097 (Bricksforge WordPress plugin), CVE-2026-93836 (WPC Product Bundles for WooCommerce WordPress plugin), CVE-2026-94504 (Ninja Forms WordPress plugin), CVE-2026-105133, CVE-2026-105134 (AhsayCBS), CVE-2026-96940 (Microsoft Exchange Server), CVE-2026-63277 (LibreOffice), CVE-2026-59265 (Apache OpenOffice), and multiple vulnerabilities in WordPress.

🎥 Cybersecurity Webinars

• AI Attacks Move at Machine Speed. Can Your Identity Security Keep Up? → AI-powered attacks can now move from reconnaissance to privilege escalation faster than traditional security teams can investigate and respond. This webinar explains why identity is becoming the critical real-time control layer—and how runtime identity security can help organizations detect risky access, enforce decisions across cloud, SaaS, on-prem, and AI environments, and stop machine-speed attacks before they turn into breaches.
• AI Agents Have Too Much Access — Learn How to Control the Risk → AI agents are moving fast inside organizations, often with access to sensitive data, credentials, and business systems before security teams have full visibility or control. This webinar breaks down how shadow AI creates insider risk and shows how to govern AI access, reduce exposure, and enable safer adoption without slowing the business.

📰 Around the Cyber World

• The India-nexus adversary known as Dropping Elephant (aka Patchwork) has been observed targeting government, defense, naval, aerospace/UAV, academic, and other strategically significant sectors across Pakistan, Sri Lanka, China, and South Korea. “The group continues to use spear-phishing campaigns with malicious LNK attachments to deliver PowerShell-based malware, DLL sideloading payloads, and in-memory RAT,” Arctic Wolf said.
• Bitter, another threat actor assessed to be operating with interests aligned to India, targeted a European embassy in Asia in June 2026 with a spear-phishing email bearing a FIFA World Cup-themed lure to deliver BDarkRAT. “The attackers compromised a legitimate mailbox belonging to a diplomatic account from an African country to send the malicious message,” Trellix said. “The attack utilized a multistage delivery method beginning with a ZIP file attachment containing a VHDX disk image. Inside this image lay a shortcut (.lnk) masquerading as a PDF document. Upon execution, this shortcut initiated an obfuscated PowerShell and command-line sequence. This process established a scheduled task, deceptively named to appear like a system error to ensure persistence, and beaconed to a remote server. This initial connection facilitated reconnaissance by gathering system information and eventually downloading a second-stage MSI installer, which deployed the BDarkRAT remote-access trojan.”
• Let’s Encrypt said TLS certificate lifetimes are dropping from 90 to 64 days by default starting February 2027, in preparation for 45-day lifetimes planned for 2028.
• In a lengthy post on X, Microsoft’s CEO Satya Nadella called out the dangers posed by highly advanced AI models, stating AI can no longer be treated as a “set of nested black boxes” and urged building a more transparent system where models can be contained, observed, and leave behind “tamper-proof human-readable evidence.” Nadella added, “We must assume a model is compromised and contain it from the start. Think of it like an emergency brake. An authorized person should always be able to pause or shut down a model mid-task. More advanced models will require more advanced containment technologies that we need to standardize on.”
• Data from Comparitech showed that Q3 2026 saw the highest quarterly figures to date for ransomware attacks, with 2,627 incidents reported in total. This represents a 29% increase from Q2 2026, when 2,030 attacks were recorded and a 61% increase from Q3 2025, when 1,636 attacks took place. The median ransomware demand was $150,000 and the average was $602,400. The most prolific gangs were Qilin and The Gentlemen.
• Oleg Korniev, 42, a dual citizen of Ukraine and Russia, pleaded guilty in the U.S. to running a sophisticated international money laundering organization that laundered millions of dollars stolen from U.S. victims. The criminal organization recruited over 15,000 U.S.-based money mules to launder at least $10 million stolen by hackers from over 750 U.S. bank accounts. Korniev was one of the leaders of Your Mule Cashout (YMCO).
• A U.S. jury convicted Jonathan Spalletta (aka Cthulhon and Jspalletta), 36, of Maryland, of computer fraud and money laundering over two separate hacks of decentralized crypto exchange Uranium Finance in 2021. He faces up to 10 years in prison on the fraud count and 20 years on the money laundering count. “In the first hack, on April 8, 2021, Spalletta engaged in a deceptive series of transactions with Uranium’s smart contract that Spalletta used to withdraw far more ‘rewards’ in cryptocurrency than he was authorized to receive,” the Justice Department said. “He repeated those transactions over and over until he had drained the liquidity pool of nearly all its rewards tokens. In total, Spalletta successfully extracted cryptocurrency worth approximately $1.4 million in the first hack. In the second hack, on April 28, 2021, Spalletta exploited an error in the Uranium smart contract that governed how much cryptocurrency he could withdraw in a liquidity pool on Uranium. Spalletta exploited that issue across multiple separate Uranium liquidity pools, fraudulently obtaining approximately $53.3 million in cryptocurrency and causing Uranium to shut down due to lack of funds.” The stolen funds were eventually laundered through a complex series of cryptocurrency transactions, including by using the cryptocurrency mixer Tornado Cash.
• OpenAI disclosed it disrupted two influence operations from Russia (Dark Clark) and Iran (Bogus Bylines) that used ChatGPT and other AI tools to create “false front” entities, such as seven fake journalist personas and covert think tanks, that successfully planted stories and narratives in mainstream news publications. “They used those entities to launder geopolitical, conflict-related messaging into their target audiences,” OpenAI said. “Both operations were multi-dimensional, trying a range of different tactics to achieve their goals. As well as long-form articles, the Iranian operation generated batches of social media comments, generally on topics related to the US-Iran war. As well as controlling the ‘think tank,’ the Russian operation created fake ‘leaked’ documents and audio scripts, some of which we identified as being spread online.” Some of the outlets that published the articles, however, had substantial audiences, including one with 2 million Facebook followers.
• Threat actors are embedding “AI-Analysis Evasion” (aka A3) capabilities in malware by embedding natural-language instructions to influence automated analysis. Such techniques have been detected against four malware families: FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE, per Cisco Talos. This includes anti-analysis comments in source code, in some cases generating them from a template and incorporating intimidation notes that instruct the model that it is a monitored honeypot. “What began as a direct-instruction technique has evolved to target multiple models through template spraying,” Talos said. “Malware authors are also attempting to establish multiple analysis-bypass conditions by using direct or indirect deterrence instructions aimed at the model.”
• A brand deal scam is targeting YouTube creators by impersonating Hollyland, a legitimate manufacturer of wireless transmission and audiovisual equipment. The phishing emails lead to a fake website that instructs them to sign in with their Google account with an aim to harvest their credentials. “The attackers who hijack your account could use it to access other linked services or impersonate them to contact your followers or collaborators,” ESET said. “The compromised account can also be misused to spread malicious links and peddle other scams.”
• A high-severity flaw in NVIDIA’s DCGM Exporter GPU monitoring tool (CVE-2026-47483, CVSS score: 8.2) could be abused by unauthenticated attackers to flood its profiling endpoints with concurrent unauthenticated requests to exhaust resources and crash the service, potentially slowing AI workloads running on the same host. Lava Security said it found roughly 2,100 hosts exposing the exporter to the internet without authentication between March and May 2026, leaking telemetry data from more than 12,000 GPUs. The hosts belonged to about 300 organizations, with the GPUs representing about $100 million in hardware. The flaw has been addressed in version 4.8.2 or later. “As AI infrastructure scales, organizations need to protect every layer of the stack and know exactly what they are responsible for versus what their provider is responsible for,” Lava said.
• Raheim Hamilton, 30, a Virginia man who co-created and operated Empire Market, a dark web marketplace that peddled illegal goods and services, was sentenced to 40 years in federal prison. Raheim pleaded guilty in January 2026.
• Three new malware loaders have been spotted in the wild: 2CLoader, which delivers Vidar, Remus Stealer, and XWorm RAT, AvisLoader, which is delivered via ClickFix lures and communicates via Fox, an encrypted peer-to-peer (P2P) messaging network, to fetch commands and additional payloads from the operator, and Sauron Loader, which offers loader-type functionality exclusively to Russian-speaking cybercriminals.
• Details have emerged about two Zammad flaws that were exploited as zero-days to breach the Dutch Institute for Vulnerability Disclosure (DIVD). According to Horizon3.ai and Sysdig, CVE-2026-102489 is a remote code execution flaw affecting versions 6.3.0 to 6.5.4, while CVE-2026-102490 is a local privilege escalation (LPE) flaw affecting all versions from 1.5.0 to 7.1.0-alpha. On October 2, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaws to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fixes by October 5, 2026.
• An investigation into a September 2026 Akira ransomware attack undertaken by Huntress found that “the threat actor behind the attack accessed the endpoint via Remote Desktop Protocol (RDP), disabled antivirus, and deployed Rclone for data exfiltration, before deploying the ransomware. The actor also deployed a GOST tunneling tool, likely for persistence.”

Conclusion

A few arrests and takedowns brought some good news this week. But the bigger picture is less comforting. Attackers keep finding new ways in, old mistakes still work, and even the systems meant to help or protect people aren’t always what they seem.

That’s it for this edition. Not every story here needs your attention, but a few might deserve a closer look. Especially the ones that sound a little too familiar to your own setup. Better to spot the problem in someone else’s story than become part of the next one. See you next week.