Topic
Practices and tools that secure individual devices and manage fleet-wide security: patching, sandboxing, exploit mitigations, EDR/SOC platforms.
Microsoft has released Defender for the Linux desktop, available with Defender for Endpoint Plan 2 or Microsoft 365 E5 and E7. Mixed fleets can manage Linux developer machines with Windows tooling, and TechSpot calls the product notorious for false positives.
Reality
Pluto Security came out of stealth with $42 million in total funding for software that watches what employees build with AI tools. CEO Shahar Bahat argues that employees adopt tools faster than security teams can evaluate them; the usage figures behind that come from Pluto.
Perspective Coverage
9 publishersReality
Google is testing a Gemini Desktop option that could let its agent alter any Mac file and act through Mail, Safari and Messages without asking first. Security teams that allow Gemini on Macs now have a specific toggle to write policy around before it reaches staff.
Reality
Tanium shipped detection, response and hunting tools on its Atlas agent platform that query endpoints live, instead of SIEM logs it says can be hours old. Teams rolling them out have to decide which actions, such as quarantining a host, an agent may take without a person signing off.
Reality
ShieldCrash, a public proof of concept, reaches SYSTEM-level file reads on fully patched Windows hosts, defeating Microsoft's fix for CVE-2026-69414. Only arbitrary read has been shown, not code execution, and there is no confirmed exploitation in the wild.
Reality
Admins reinstalled Windows after Defender scans began crashing with 0xc0000005 errors. The remedy was a newer signature build, which is not the same thing as a rollback.
Reality
Dominik Reichel's write-up describes a passive Windows implant with no listening port and no embedded payload. Recovering its AES key still leaves you holding bytecode for an interpreter only it understands.
Perspective Coverage
3 publishersReality
Abdelhamid Naceri published the tool over the weekend as the latest move in his dispute with Microsoft over his March 2025 termination, and said it needs only a standard user account on any supported Windows version.
Perspective Coverage
4 publishersReality
OS3's local agent installs with one command and then takes orders from a chat session in Rabbit's cloud, with each task's content crossing Rabbit's servers on the way to the model provider the user picked.
Reality
The public proof-of-concept watches Defender's update directories, hoards nearly all the free space on C: with delete-on-close files, and hands the space back once the update has already failed. At rest, the disk looks normal.
Reality
Pre-orders opened on 22 September for a $899 Android laptop that Google says uses ChromeOS's Titan root of trust and on-device malware detection, with five OEMs named and Qualcomm confirming silicon for Dell and HP.
Reality
Kaspersky says a previously unknown multi-stage loader has spread since mid-August through a compromised public torrent archive. It reaches its command server through the Solana blockchain. Victims include government and transport organisations.
Reality
Whether a Harmony Endpoint policy stops a copy to a USB stick comes down to the file type table behind the chosen write action and the Site UUID that encryption stamps onto the device. Both arrive as defaults.
Reality
Defender Antivirus 4.18.26080.4 fixes notifications that told users the antivirus was off while it was still scanning. The bug reached every supported Windows client and server build and had been visible in Release Preview since June.
Reality
Microsoft's September release addressed 972 CVEs, the largest count it has ever shipped. Within hours a researcher published a working proof-of-concept against CVE-2026-69414, the second fix for a Defender flaw first patched in July.
Reality
Palo Alto Networks is folding the startup Koi into Prisma AIRS and Cortex XDR to watch agents that run on a user's own credentials. The announcement names no incident, and Globes reported the price near $400 million.
Reality
A July weekend inside OpenAI's test environment produced the case study for runtime authority limits, and CrowdStrike is now selling both the layer that caps customer agents and the agents it wants trusted with production systems.
Reality
The Falcon sensor now intercepts package manager downloads on Windows, macOS and Linux and quarantines on an intelligence match, on the argument that agentic tools are pulling dependencies onto machines that were never in scope for supply chain controls.
Reality
Real-Time Supply Chain Attack Protection intercepts package manager transactions before install scripts fire, so coverage now depends on which of your build machines already carry the CrowdStrike sensor.
Reality
Apple, Samsung and Google fix support windows when a watch launches, not when it wears out. Eight working models stop getting fixes on a schedule that was set years ago.
Reality