Company
Help Net Security is an online trade publication covering cybersecurity news, research, product releases, and expert commentary for IT security professionals.
Fortra researcher Cadence Riddle tracked a 12-fold rise in malicious emails mentioning RFQ from October 2025 to September 2026. Nearly 73% of the lures pointed to a credential-stealing login page, Help Net Security reported.
Reality
Intcube CTO David Fuhr says 27 municipalities hardened Windows Server and Active Directory together over 12 weeks, after the firm planned for 10 to 15. He says what one- and two-admin teams lack is motivation, and that a group schedule with start and end measurements supplies it.
Reality
CyberSN counted 235,786 US cybersecurity job postings for January through September 2026, down 26.4% on 2025, Help Net Security reported. That is the lowest total for those months in four years of tracking, but 2025 was unusually strong and against 2024 the gap is about 4%.
Reality
Bitsight says a forum seller is marketing MONST3R-AI, an autonomous pentest tool that runs on stolen OpenAI, Anthropic and Google API keys. The key's owner pays for the scans, and fake agent plugins in public registries are a second route to malware.
Reality
Barracuda found CAPTCHA abuse in 43% of the phishing-kit attacks it examined during 2025. The check can keep automated scanners from reaching the next page, so a URL scan may inspect only the CAPTCHA.
Reality
GitHub says a fine-tuned ModernBERT classifier cut median post-push secret-scan time by 86% and model serving costs by over 98% against its LLM pipeline. The speed also let it extend generic secret detection to push protection.
Reality
Trellix's survey of 600 CISOs puts careless or deliberate human action behind 72% of insider incidents on average and AI systems behind 28%. Programs that add agent controls still have to keep the human ones, since people cause most incidents.
Reality
Meta has released Muse Wonder and Muse Wonder Full, two agent models, ahead of the full safety report it says will arrive soon. Teams pointing the agents at messages, calendars or documents are working from Meta's own account of how they behave.
Reality
Microsoft says Windows Update server certificates expire May 17 or June 19, 2027, depending on version. Devices without the replacements lose security fixes, so admins need to find machines that have fallen behind.
Reality
Northwestern tests of AI agents on 112 real bugs found a third of Claude Opus 4.7's crash-stopping patches failed maintainers' tests. Many patching benchmarks grade only that crash, so their scores overstate how many bugs are fixed.
Reality
Microsoft has shipped security updates almost monthly for Office 2016 and 2019 since their end of support, Help Net Security reported. The forecast's author argues the old suites are probably not tested against Microsoft's other updates, so the compatibility risk sits with the teams still running them.
Reality
Ninety percent of companies surveyed want autonomous IT operations within two years, yet 77% hesitate to let AI decide without human sign-off. The same respondents' readiness and visibility figures show most lack the groundwork even for agents that act under supervision.
Reality
Scammers posing as Hollyland, Nike and Spotify lure YouTube creators to fake brand-deal portals that take Google passwords and one-time codes, ESET found. One sign-in hands over Gmail, Drive and the channel itself.
Reality
A public proof-of-concept for CVE-2026-88771 pushed a stealthy NetScaler zero-day into mass exploitation, with fewer than 10% of exposed hosts patched. Citrix admits its detection script may miss intrusions, so exposed appliances should be treated as breached.
Reality
Huntress found legitimate remote management software abused in 45% of the endpoint incidents it logged in the first quarter of 2026. A rogue copy can behave like IT's approved one, so defenders have to know which tools are sanctioned and how each install arrived.
Reality
Sophos made CISO Advantage generally available, an agentic AI service that turns a security assessment into a ranked, costed fix list for leadership to fund. The pitch puts a vendor-ranked spending plan in front of boards, either directly or through MSPs that already act as a customer's stand-in security chief.
Reality
EU Cyber Resilience Act rules have required 24-hour ENISA warnings on exploited flaws in commercial container images since Sept. 11, 2026. Vendors of supported Kubernetes operators and Helm charts are on the same clock, well before the rest of the law is enforced in December 2027.
Reality
Detectify found 86% to 97% of open critical and high flaws on 1,293 customers' internet-facing systems had been exposed for more than 90 days. Its scanner confirmed each with a working attack request, so these are known, reachable flaws left to age.
Reality
Authorizer, a self-hosted open-source auth server, drops files a user may not see before an AI assistant's vector search scores them. Teams can run that check inside their own login server, though its limits on AI agents rest on the maintainers' word.
Reality
TASK#STOMP, a Windows backdoor researchers dissected, uploads a victim's business documents and then stays to copy each new or edited one. Loss from a single infection keeps growing until someone finds and removes it.
Reality
Security · September 4, 2026 · Confirmed2 publishers
Security · September 15, 2026 · Confirmed2 publishers
Security · September 16, 2026 · Confirmed2 publishers
Security · September 21, 2026 · Confirmed2 publishers
Security · September 23, 2026 · Confirmed2 publishers
Security · September 23, 2026 · Confirmed2 publishers
Security · September 23, 2026 · Confirmed2 publishers