ThreatBook Accredited by IMDA Singapore for Full Cycle Agentic Cybersecurity Solutions - The agentic security company is recognized for its innovation and high growth, and is endorsed to service government and large enterprise customers. - Being accredited gives ThreatBook's customers peace of mind that its suite of security solutions is one of the industry's best. - A significant milestone that empowers the company to further grow in Singapore and the rest of the world. SINGAPORE, Sept. 8, 2026 /PRNewswire/ -- ThreatBook, the agentic security company, today announced being accredited by Singapore's Infocomm Media Development Authority (IMDA) for the company's industry leading solutions. Following IMDA's rigorous evaluation, ThreatBook is now part of the IMDA Accreditation program, which recognizes innovative and high growth information, communications and media (ICM) technology companies as qualified contenders to service government and large enterprise entities. The program provides end users with independent assurance that accredited companies possess solutions with validated core product functionalities and the capability to consistently deliver. The company's solutions were independently assessed and the company's technology, operational capabilities, and ability to support enterprise deployments were validated. Being accredited effectively places the company in the green lane government procurement process, making it easier for public sector entities to purchase ThreatBook solutions. ThreatBook is one of a limited number of vendors that have been accredited to date, further cementing the company's highly respected status among Singapore's tech community. A global cybersecurity company specializing in advanced threat intelligence, detection, and response, ThreatBook equips customers with the clarity and context needed to defend against evolving digital risks. By combining artificial intelligence (AI) with deep threat intelligence, ThreatBook delivers real-time visibility, hyper-accurate detections, and early-warning insights against nation-state actors, cybercriminal groups, and emerging attack campaigns. With unparalleled insights on the tactics, techniques and procedures (TTPs) used by both Eastern
Sep 8, 2026 · via prnewswire.com
Deepfake scams are growing more sophisticated, Arkansas cybersecurity experts warn LITTLE ROCK, Ark. (KATV) — Artificial intelligence is making it easier to create realistic fake videos, images and voice recordings, raising concerns among cybersecurity experts about scams, impersonation and online exploitation. A deepfake is an image, video or audio recording created or altered by artificial intelligence to make it appear that someone said or did something they did not. More than 22,000 reports involving AI-generated or manipulated content were made nationwide last year. Arkansas law enforcement officials say they are also seeing a rapid increase in reports involving AI-manipulated images. Chris Wright, a cybersecurity engineer, said people should be cautious before responding to any unexpected message, call or video. “Slow down. Think before you act. Think before you click. Be skeptical. Don’t be so trusting,” Wright said. Scammers have long used suspicious emails and phone calls to target victims. Now, experts say AI can create convincing videos, voice recordings and images designed to make a scam appear legitimate. Wright said some deepfake programs can adjust a person’s voice and image in real time, making the content appear more realistic. He said the technology can also imitate the tone and word choices of a person or organization. “You can put all the y’alls in the right place to speak to a Southerner and have them think ... this person I know ... actually wrote this because that’s their tone,” Wright said. Dr. Philip Huff, a cybersecurity professor, said the technology behind deepfake scams is advancing quickly. “It’s moving so fast, and some of the ways that you can misuse it to commit crime are emerging much faster than we can stop it,” Huff said. Huff said laws and regulations need to keep pace as artificial intelligence technology continues to evolve. Experts
Sep 7, 2026 · via katv.com
Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. "Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge profiles, bypassing Web Store checks and user prompts by forging Chromium's own Secure Preferences integrity values," SOCRadar said. "A native-messaging tool then extends it beyond browser telemetry to host-level command execution and file management." Once installed, the PEEP "extension" agent polls its command-and-control (C2) server ("206.237.30[.]232" or "xfjcc[.]fun") every 30 seconds over plaintext HTTP for new commands, while exfiltrating browsing history, active-tab metadata, and session cookies. It also functions as a remote access and browser monitoring toolkit that runs host commands, steals credentials, hijacks sessions, and alters web pages. PEEP is built on the foundations of RedExt, an open-source, browser data analysis and red teaming framework that has also been put to use in prior GlassWorm attacks. However, it expands on the toolkit with dedicated installation routines, a native host bridge, heartbeat telemetry, an update channel, and a broader command set. This, in turn, makes PEEP a derivative of RedExt. PEEP is described as a post-compromise framework as it lacks an initial access vector itself, meaning it requires the operator to breach a machine through some other means and deploy the malware. The activity remains unattributed, although the presence of Chinese-language artifacts in the source code points to a Chinese-speaking threat actor. The extension masquerades as "Smart Bookmarks" (ID: ejkndncpkdcjcikfhiamcdehdoegilbj). It's the main agent responsible for executing the beacon loop by polling "/api/commands," harvesting browser data, receiving additional tasking, and sending the results back. The browser add-on also invokes an auxiliary executable ("nm_host.exe") when said task requires operating system access, while browser-based commands (e.g., screenshots, clipboard, or JavaScript injection) are run locally.
Sep 7, 2026 · via thehackernews.com
Palo Alto Networks Korea, Daol TS, Dongguk University’s College and Graduate School of Police and Criminal Justice, and the Institute of Convergence Security will work together to train cybersecurity professionals. The organizations said on Sept. 7 that they signed a memorandum of understanding to operate a Palo Alto Networks Cybersecurity Academy hub university program aimed at developing professionals with practical cyber investigation and security skills. Under the agreement, Dongguk University has been designated as a hub university for cyber investigation and security education in the Seoul area. The university will operate courses based on the Palo Alto Networks Cybersecurity Academy and share its experience and results with other universities and related organizations. Daol TS will provide industry-academia mentoring and technical lectures, while supporting students in completing global training and certification programs. It will also provide information on employment opportunities and recruitment through its partners. IT infrastructure company Daol TS is a Korean distributor of global cybersecurity company Palo Alto Networks. Its other partners include Dell Technologies and SUSE. “Palo Alto Networks has extensive response experience and technological expertise in global cyber investigations,” said Park Sang-kyu, country manager of Palo Alto Networks Korea. “Based on this expertise, we will provide broad support to help Dongguk University students develop the latest security capabilities required in the field.” “As crime increasingly shifts into the digital domain and the responsibilities and role of police investigations grow, practical cybersecurity education has become essential,” said Lee Chang-han, dean of Dongguk University’s College of Police and Criminal Justice. “By cultivating professionals with specialized expertise, we aim to make a meaningful contribution to the future development of cyber investigations.”
Sep 7, 2026 · via thelec.net
GISEC Global 2026 launches Cyber First, Bringing World Leaders To Dubai To Shape The New Digital Order World's third largest cybersecurity event enters a new era at Dubai Exhibition Centre with expanded global footprint, flagship leadership summit and new quantum security agenda Dubai, United Arab Emirates – September 02, 2026: Artificial intelligence is transforming the global cybersecurity landscape, strengthening cyber defences while simultaneously enabling faster, more sophisticated attacks. According to the World Economic Forum's Global Cybersecurity Outlook 2026, 94% of organisations expect AI to be the biggest driver of cybersecurity change over the coming year, while 87% identify AI-related vulnerabilities as the fastest-growing cyber risk. Against this backdrop, GISEC Global 2026, organised by inD, a joint venture between the Dubai World Trade Centre (DWTC) and Informa, enters a new chapter at Dubai Exhibition Centre, Expo City Dubai, from 16–18 September 2026 under the theme ‘Cyber First: The New Digital Order.’ GISEC Global, the world's third largest cybersecurity event and the Middle East & Africa's most influential cybersecurity platform, will open its 15th edition this month having expanded 20 percent year-on-year, reflecting increasing international demand for cybersecurity innovation, collaboration and investment. Hosted and endorsed by the UAE Cyber Security Council, Dubai Electronic Security Center (DESC), Ministry of Interior and Dubai Police, GISEC Global 2026 will bring together more than 25,000 cybersecurity professionals, 750+ exhibiting brands, 350+ expert speakers and participants from 180+ countries to address the defining cybersecurity challenges shaping the future of the global digital economy. H.E. Dr Mohamed Al Kuwaiti, Head of the UAE Cyber Security Council, said: "Artificial intelligence, geopolitical instability and the rapid evolution of digital technologies are fundamentally reshaping the cybersecurity landscape. As cyber threats become increasingly sophisticated and interconnected, no single nation or organisation can address these challenges alone. The UAE is committed to fostering
Sep 7, 2026 · via linkedin.com
Cyberstarts is looking for another Tel Aviv tower to house its growing startup empire After leasing 15 floors at Landmark B for a shared campus for its portfolio companies, the $1.4 billion cybersecurity fund is now exploring options for a second location. Cyberstarts’ appetite for real estate in Tel Aviv is not yet satisfied. After leasing 15 floors at the Landmark B Tower in Tel Aviv’s Sarona complex to create a shared campus for its portfolio companies, Calcalist has learned that the venture capital fund is now looking for another tower. Gili Raanan, co-founder of Cyberstarts, and general partner Dor Knafo are in talks with several real estate companies to explore options for a second location for the fund’s portfolio companies. The fund, which manages $1.4 billion, is considering the possibility of a dedicated tower built for Cyberstarts, although vacant space is also available in nearby projects such as TOHA2 and the Spiral Tower, which is currently under construction. Nine of Cyberstarts’ 25 portfolio companies are expected to move into Landmark B, which is scheduled to be occupied in about a year. The largest companies in the portfolio, including Island, Upwind and Cyera, will remain in their existing offices. Cyera is currently based in Landmark Tower A. The companies moving to what Cyberstarts calls its “Cyber Campus” are primarily smaller startups with between 100 and 200 employees. They are expected to include Glow, Vega, A Security, Onyx, Surf and Spirit, all of which have raised significant amounts of capital over the past year and are now in periods of rapid expansion. Cyberstarts itself will occupy part of a floor that will serve as a common area for the campus. It is expected to include shared facilities such as a gym and cafe. Each startup will design its own offices, while
Sep 7, 2026 · via calcalistech.com
The global network of KPMG firms has been recognized as a Leader in the IDC MarketScape: European Cybersecurity Governance, Risk, and Compliance Consulting and Professional Services 2026 Vendor Assessment. The assessment evaluates providers of cybersecurity governance, risk and compliance consulting and professional services, also known as cybersecurity GRC.
As noted in the IDC MarketScape report, KPMG’s European cybersecurity practice spans GRC advisory, regulatory compliance, cyber transformation and managed security services. KPMG’s approach includes strategy development, target operating model alignment, quantitative risk management and operational implementation.
KPMG’s strengths recognized by IDC MarketScape also include:
- Integrated risk and audit methodology. KPMG unifies risk management, internal controls and assurance workflows within a cohesive governance model.
- European regulatory compliance breadth. KPMG firms advise clients on NIS2, DORA, GDPR and the Cyber Resilience Act.
- Proprietary risk quantification tooling. The Cyber Risk Insights platform enables clients to quantify and benchmark cyber exposure, supporting data-driven investment decisions and executive reporting.
Sep 7, 2026 · via kpmg.com
New Delhi, Sep 7 : Over 600 internet experts, policymakers and technology leaders will gather in Mumbai for the 62nd APNIC Conference (APNIC 62) from September 4 to September 10, 2026, to discuss AI, cybersecurity and the resilience of Internet infrastructure, an official statement said on Monday. The conference will bring together technical experts, network operators, policymakers and internet community leaders to examine AI‑powered services, network automation, routing security, cybersecurity and Internet governance issues. “As India’s digital ecosystem continues to expand, ensuring secure, resilient and future-ready Internet infrastructure remains a key priority,” said Sushil Pal, Joint Secretary, Ministry of Electronics and Information Technology. APNIC 62 provides an important platform for India to engage with the Asia Pacific technical community, exchanging knowledge and strengthening collaboration towards an open, inclusive and trusted Internet for all, Pal added. The event will feature technical workshops, conference sessions, policy meetings and community events focused on a secure and resilient Internet for the Asia Pacific, the statement said. The event is organised by the Asia Pacific Network Information Centre and hosted by the National Internet Exchange of India and the Internet Service Providers Association of India with support from the Ministry of Electronics and Information Technology (MeitY) and the Maharashtra government. “AI and other major technical and societal shifts are placing unprecedented demands on the networks that underpin our economies and societies. APNIC 62 brings the region’s Internet community together to turn shared expertise into practical action for a more secure, resilient and scalable Internet,” said APNIC Director General Jia Rong Low. “India’s leadership in IPv6 adoption shows what is possible when technical capability, investment and collaboration align,” he added. At the sidelines of APNIC 62, NIXI and APNIC will sign a Memorandum of Understanding (MoU) to enhance the deployment of key Internet infrastructure technologies –
Sep 7, 2026 · via ap7am.com
Vitalik Buterin optimistic about Bitcoin's resilience against cybersecurity threats Vitalik Buterin, the co-founder of Ethereum, expressed confidence on September 7 that Bitcoin can handle emerging technical security challenges without relying on social consensus, arguing that simple client and mining pool upgrades would be sufficient to address network-layer threats. The comments directly counter a growing narrative in crypto circles: that artificial intelligence could pose an existential risk to Bitcoin, potentially causing its value to drop more than 50% over the next two years. Buterin's verdict on the likelihood of anyone breaking Bitcoin's core cryptographic elements, including its hashes and proof-of-work model? "Tiny." Bitcoin's proof-of-work system has accumulated roughly 2^96 hashes over its lifetime. The sheer computational weight behind the network means that mounting a successful attack would require resources that currently border on the physically impossible. Bitcoin has never experienced a successful 51% attack, the scenario where a single entity gains majority control of the network's mining power and can manipulate transactions. Buterin's argument hinges on a distinction between threats that require social coordination to solve, like contentious protocol upgrades or governance disputes, and purely technical challenges that can be addressed through software updates. In Bitcoin's case, he believes the technical defenses are robust enough that the community doesn't need to engage in consensus-building exercises to stay secure. In an earlier essay published on May 18, Buterin explored AI's dual role in cybersecurity. On one hand, AI creates new categories of sophisticated attacks. On the other, it enables powerful defensive tools, particularly through formal verification strategies that can mathematically prove the correctness of code in blockchain systems, including consensus mechanisms and post-quantum architectures. Bitcoin relies on elliptic-curve cryptography, which is considered robust against today's computational capabilities but could theoretically be vulnerable to a sufficiently powerful quantum computer. Current quantum systems are
Sep 7, 2026 · via tradingview.com
ZAWYA: GCC central banks step up cybersecurity, fintech co-operation By Staff Writer A preparatory committee for the Gulf Cooperation Council’s central bank governors reviewed regional cooperation on payment systems, banking supervision, financial technology and cybersecurity at its sixth meeting, Bahrain’s central bank said. The virtual meeting, held under Bahrain’s presidency of the 46th session of the GCC, was chaired by Hesa Abdulla Al Sada, Executive Director of Central Banking and Macro-Prudential Oversight at the Central Bank of Bahrain. Representatives from GCC member states on the preparatory committee took part in the meeting, along with Khalid bin Ali Al Sunaidi, Assistant Secretary-General for Economic and Development Affairs at the GCC General Secretariat. In her opening remarks, Al Sada underscored the vital role of the Preparatory Committee and the importance of continuing to strengthen joint GCC cooperation in accordance with the directives and recommendations of the GCC Central Bank Governors. Al Sada said the committee had an important role in strengthening cooperation among GCC central banks in line with the directives and recommendations of the central bank governors. She also stressed the importance of sharing expertise and developing policies aimed at strengthening the resilience of financial systems across the region. The committee reviewed recommendations from GCC committees and working groups covering payment systems, banking sector supervision and financial technology. It also discussed mechanisms for sharing cybersecurity information relating to the banking sector and efforts by GCC member states to combat money laundering and terrorist financing.-TradeArabia News Service Copyright 2026 Al Hilal Publishing and Marketing Group Provided by SyndiGate Media Inc. (Syndigate.info).
Sep 7, 2026 · via tradingview.com
JavaScript is disabled in your browser.
Please enable JavaScript to proceed.
A required part of this site couldn’t load. This may be due to a browser extension, network issues, or browser settings. Please check your connection, disable any ad blockers, or try using a different browser.
Sep 7, 2026 · via lemonde.fr
via Pentera 🙌🏻
Ramel Robinson 💧
14h
You're missing the bag of pistachios. I must have those for snacking when my anxiety flares up.
Oswaldo Roman, HTTPS, cuack
Marco M.
14h
Hilarious and true!!
CISO starter pack 10% strategy and 90% explaining why security still needs budget 😅
Really accurate. Especially the security budget. Risk accepted by management, controls expected by everyone else, and somehow the budget still gets squeezed until there’s barely anything left. The important part is remembering that security isn’t about eliminating all risk. It’s about making sure leadership understands what they’re accepting. Preferably before the breach turns it into next year’s priority. 😉
Sep 7, 2026 · via linkedin.com
ESTsecurity Corp., the security-focused subsidiary of ESTsoft, said on the 7th that the Naver Cloud consortium in which it participates was selected as the final executing organization for the "cybersecurity-specialized artificial intelligence (AI) foundation model development" project led by the Ministry of Science and ICT and the National IT Industry Promotion Agency (NIPA). The project is a state-led initiative to respond to cyberthreats arising from advances in high-performance AI and to secure a domestically developed, security-specialized AI model. The Naver Cloud consortium that includes ESTsecurity Corp. was selected as the final operator. In the Naver Cloud consortium, ESTsecurity Corp. will provide malware data accumulated in the endpoint security field and Cyber Threat Intelligence (CTI) expertise. By combining endpoint threats, Cyber Threat Intelligence (CTI), incident analysis, and analytic know-how, it will play a role in strengthening Korea's AI security response capabilities. Recently, ESTsecurity Corp. has been building its own AI security ecosystem, including the launch of "Alyac Agentic EDR," which applies its proprietary foundation model "K-EXAONE," and the signing of a "business agreement for next-generation K-AI security solution development and technology cooperation" with domestic AI Semiconductor corporations. The company said it will proactively lay the groundwork for building a sovereign AI infrastructure specialized for domestic AI security by applying domestic AI accelerators to its AI solutions and maximizing synergy. Jung Sang-won, CEO of ESTsecurity Corp., said, "We are very pleased to have been finally selected as a key partner in the project to build a cybersecurity-specialized AI foundation model," adding, "We will fully mobilize the commercialization capabilities of AI security services proven by the launch of Alyac Agentic EDR and ESTsecurity Corp.'s unrivaled security data and analytic capabilities to help elevate the nation's cyber defense capabilities to the next level."
Sep 7, 2026 · via biz.chosun.com
Intrado: Charles Gifford outlines 911 cybersecurity challenges
Together, we power an unparalleled network of 220+ online properties covering 10,000+ granular topics, serving an audience of 50+ million professionals with original, objective content from trusted sources. We help you gain critical insights and make more informed decisions across your business priorities.
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
Charles Gifford, Intrado vice president and chief information security officer (CISO), highlights the cyberthreats faced by 911 centers and the importance of migrating to ESInet platforms. Gifford spoke with IWCE’s Urgent Communications Editor Donny Jackson during the APCO 2026 event conducted last month in San Antonio.
Donny Jackson is director of content for Urgent Communications. Before joining UC in 2003, he covered telecommunications for four years as a freelance writer and as news editor for Telephony magazine. Prior to that, he worked for suburban newspapers in the Dallas area, serving as editor-in-chief for the Irving News and the Las Colinas Business News.
Sep 7, 2026 · via urgentcomm.com
For retailers, the holiday shopping season puts operational resilience to the test as transaction volumes surge, distribution networks operate at peak capacity, and customer expectations for fast, seamless fulfillment intensify. Behind the scenes, retailers depend on an increasingly interconnected environment of applications, suppliers, facilities, employees, and third-party services to keep products moving. This concentration of activity also makes the holiday season an attractive period for cyberattacks. However, the biggest risk isn’t simply that a retailer gets breached or that an application goes offline. During the 2025 holiday shopping season, Deloitte forecast total retail sales would grow 2.9% to 3.4% year over year, while e-commerce sales were expected to grow 7% to 9%. That growth represents significant revenue at stake: when a cyberattack disrupts a critical service during peak shopping season, the impact can quickly ripple across operations, disrupting orders, employee access, suppliers and customer experiences at precisely the time demand is highest. For retailers preparing for another high-pressure holiday season in 2026, cybersecurity planning needs to be connected to enterprise resilience. With online sales expected to grow faster than the broader retail market, the ability to understand operational dependencies, prioritize critical services, and recover quickly can directly influence how much revenue a disruption puts at risk. A Cyberattack Is Only the Beginning Security teams are rightly focused on detecting, containing, and remediating threats. But once a disruption occurs, executives have to answer fundamental business questions: What is impacted? What happens next? What is the financial exposure? What should we prioritize? A cyberattack against an e-commerce application, for example, may initially appear to be an IT problem. But that application may support order processing or customer service capabilities that may depend on other applications, employees, suppliers, and facilities. A disruption in one area can therefore create a cascade of consequences elsewhere.
Sep 6, 2026 · via cybersecurity-insiders.com
Key Facts: - Japan's JC-STAR cybersecurity conformity scheme will become a grid-connection requirement for high-voltage and extra-high-voltage solar and battery storage projects from 1 April 2027, and for low-voltage projects below 50 kW from 1 October 2027. - The relevant compliance point is when a grid-connection contract application is **accepted** by the utility, rather than when it is submitted, making early planning critical for projects already in development. - Equipment with IP communication functionality - including PCS, BMS, EMS and monitoring and control systems - is particularly affected, meaning cybersecurity conformity must be assessed at the specific product and model level during procurement. - The requirements reflect a broader shift as connected energy assets face growing cybersecurity risks; a 2024 cyberattack affected approximately 800 remote monitoring devices at solar power facilities in Japan. - GBP has obtained JC-STAR ★1 conformance labels for its GBP60M Modular PCS and GBP-EMS-001 Energy Management System, offering equipment options for projects preparing to meet the upcoming requirements. New grid-connection requirements will make cybersecurity conformity an increasingly important consideration for developers, EPCs and system integrators planning energy projects in Japan. Cybersecurity is set to become an increasingly important part of equipment selection for solar power and battery storage projects in Japan as new JC-STAR-related requirements begin taking effect from 2027. JC-STAR is Japan's cybersecurity conformity assessment and labeling scheme for connected products. It is operated by the Information-technology Promotion Agency, Japan (IPA) under a policy framework established by Japan's Ministry of Economy, Trade and Industry (METI). Products that meet the applicable cybersecurity requirements can receive a JC-STAR conformance label. For the energy sector, the significance of the scheme is becoming increasingly practical as JC-STAR ★1 conformity is incorporated into certain grid-connection requirements for solar and battery storage projects. New requirements from 2027 For high-voltage and extra-high-voltage
Sep 6, 2026 · via miragenews.com
Mac backup is a different conversation than Windows or Linux, mostly because macOS already ships with a genuinely good free tool. Time Machine covers the basics for most people without anyone needing to go looking for alternatives. Where this list gets useful is past that point – off-site cloud copies, commercial-use licensing, and the kind of control Time Machine deliberately doesn’t give you. Five tools below, starting with what’s already on your Mac and moving outward from there. One framing worth keeping in mind: nothing free on this list does Windows-style disk imaging with bootable recovery media. Time Machine can restore a Mac through macOS Recovery, but everything else here is a file-level backup tool, not a disk-imaging product. At a Glance Who Should Read This Most Mac users don’t need to read past Time Machine. Plug in a drive, turn it on, done – it’s already solved your problem. You’ll want something more if you’re a freelancer or small business that needs off-site backup with a license that actually permits commercial use. Kopia is the clear pick here; MSP360 Free covers the cloud workflow but stays personal-use-only no matter how you configure it. Power users who already think in terms of repositories, encryption keys, and SSH access get more out of Vorta or Restic – both built on tools that don’t care what platform they’re running on. What to Look For Time Machine and everything else on this list solve different problems, so the usual criteria need a Mac-specific filter. Local vs. off-site is the first fork. Time Machine is excellent local protection and has zero off-site story – no cloud option exists, full stop. Everything else here exists specifically to fill that gap. Retention control matters more than people expect. Time Machine manages its own retention automatically and
Sep 6, 2026 · via cybersecurity-insiders.com
Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store's server without logging in, Dutch e-commerce security company Sansec said in an advisory published on September 5. Sansec, which discovered the flaw and named it StyleSmuggler, said attacks started on September 4. "Sansec is publishing early because stores are being compromised right now," the company said. As of September 6, Adobe has not published an advisory, a CVE identifier, a patch, or a workaround, and its Adobe Commerce security bulletin index lists nothing after the August 11 update. A successful attack gives the attacker code execution on the store's server and installs a persistent backdoor. Sansec said all current versions are affected, including 2.4.9, and that it reproduced the full unauthenticated chain on clean Magento Open Source installations of 2.4.7, 2.4.8, and 2.4.9. Its first victim ran 2.4.6-p15 with Adobe's July and August 2026 security updates applied, which is the latest patch level Adobe offers for that release line and one that Adobe's August bulletin labels 2.4.6-2026-aug. Sansec has not published a reproduction on Adobe Commerce or on Adobe Commerce on Cloud, and Adobe has not confirmed which versions are affected. Sansec has not said how many stores have been compromised. The researchers' interim advice for stores not running its Shield product is to temporarily disable GraphQL until Adobe releases a fix. Disrex Group, a Magento hosting and development company that hosts and responded to two of the compromised stores, notes that headless and progressive web app storefronts require GraphQL, whereas most classic and Hyvä storefronts do not. Adobe's next scheduled security release is on September 8, Sansec said, and it is not yet known whether that release will cover this bug. Disrex's findings are independent
Sep 6, 2026 · via thehackernews.com
The growing threat of cyberattacks against individuals, organisations and governments has created an urgent need to bridge the shortage of skilled cybersecurity professionals, said Director General of Police Manoj Abraham. Speaking at the second edition of the Kerala Cyber Suraksha Summit (KCSS), organised by F9 Infotech in collaboration with the Kerala Startup Mission (KSUM), Abraham said cyberattacks could cripple nations and organisations, disable critical infrastructure and disrupt military operations without a single shot being fired. “There is a 389 per cent rise in ransomware victims worldwide year-on-year, while reported financial losses due to cyber fraud in India alone stood at ₹19,813 crore in 2025. We are at a juncture where we need more defenders to take on cyber attackers. Worldwide, there are 4.8 million unfilled cybersecurity jobs,” he said. He said Kerala had a distinct advantage in addressing the global shortage, given its established talent base and pool of technology professionals. Hibi Eden, MP, lauded F9 Infotech’s initiative to provide cybersecurity training, awareness programmes and certification free of cost to government educational institutions across the State. F9 Infotech Founder Jayakumar Mohanachandran said cybersecurity should not remain confined to boardrooms or technology conferences, but should ultimately serve to protect every business, institution and individual. “Over the last three years, more than ₹56,000 crore has been reported in cyber fraud complaints across India. At the same time, India’s cyber-fraud response systems have helped save more than ₹11,000 crore across 32 lakh complaints. The question is no longer how we stop the next cyberattack, but how we build a digital future that people can trust,” he said. Air Commodore Prasanth Balakrishnan Nair, KSIDC chairman C Balagopal, Digital University Kerala Vice-Chancellor Saji Gopinath, Data Security Council of India CEO Vinayak Godse, and F9 Infotech senior leaders Rajesh Radhakrishnan and Rajesh Vikraman attended the summit.
Sep 6, 2026 · via thehindubusinessline.com
The U.S. military has disabled advertising tracking tools in government-issued phones, computers and other devices, officials recently told Congress. The different military branches confirmed they had done so, some only this summer, following reporting that commercially available data taken from these devices and sold freely by data brokers, was being used by Iran and other adversaries to track and in some cases target American bases and personnel. The confirmation came from a letter shared by Sen. Ron Wyden (D-Ore.) and Rep. Pat Harrigan (R-NC). The letter calls on the Department of Defense Office of the Inspector General to review department security guidelines. Wyden and others revealed in a similar letter in May that foreign groups were using commercially available location data to target U.S. troops. “The sale of location data, particularly that of U.S. government personnel, poses a serious threat to national security,” Wyden wrote. According to Wyden and Harrigon’s letter, the Army, Navy, Air Force, Marine Corps and Special Operations Command all confirmed they have disabled mobile advertising IDs on government-issued devices. However, that has only been recent for some service branches; the Air Force admitted in its letter to the members of Congress that it only directed disabling ad trackers in July. Mobile advertising IDs, also known as MAIDs , are unique identifying numbers that go with specific devices. They are a key part of the data collected by mobile apps and can track location, common routes and habits, something that can be exploited by adversarial groups. Disabling those MAIDs is “a very simple and straightforward way that you can close a loophole,” according to Eva Galperin, Director of Cybersecurity for the Electronic Frontier Foundation. MAIDs aren’t the only way devices can be tracked, but are a major one. “Minimizing the attack surface is always good, even if
Sep 6, 2026 · via taskandpurpose.com