Passkeys Explained, and Choosing the Right Model

Source: Shell is Only the Beginning

Author: Carlos Perez

URL: https://www.darkoperator.com/blog/2026/10/18/passkeys-explained-and-choosing-the-right-model

ONE SENTENCE SUMMARY:

WebAuthn passkeys stop AiTM phishing via origin-bound public-key cryptography, while Entra passkey profiles tailor device-bound versus synced credentials per persona.

MAIN POINTS:

  1. Passkeys are per-site key pairs; only public keys reach Entra ID.
  2. Origin binding prevents authenticators from responding to lookalike phishing domains.
  3. Possession plus biometric/PIN provides MFA in one gesture without shared secrets.
  4. Passkeys don’t address device-code phishing, cookie theft, or social-engineered helpdesks.
  5. Entra supports device-bound options: security keys, Authenticator, Windows Hello, Platform SSO.
  6. Synced passkeys live in E2E-encrypted providers like iCloud, Google, 1Password, Bitwarden.
  7. Attestation enables make/model verification; synced passkeys never support attestation.
  8. AAGUID allow/block lists are reliable only when attestation is enforced at registration.
  9. Persona-based tiers guide controls: admins attested device-bound; workforce may allow synced.
  10. PowerShell/Graph tooling inventories profiles, policies, and user passkeys for enforcement validation.

TAKEAWAYS:

  1. Prefer passkeys to defeat proxy-based phishing because credentials won’t work off-origin.
  2. Use synced passkeys for low-cost rollout, accepting weaker provenance assurance.
  3. Reserve attested device-bound authenticators for Tier 0 and regulated roles.
  4. Build passkey profiles per persona; multiple profiles add allowances, exclusions override all.
  5. Operate AAGUID policy changes carefully since removals can instantly lock out users.

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

Source: Krebs on Security

Author: BrianKrebs

URL: https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/

ONE SENTENCE SUMMARY:

Investigators linked ShinyHunters to negotiators and consultants, exposing conflicts, alleged collusion, and intensified FBI action including FBI theft.

MAIN POINTS:

  1. ShinyHunters has claimed dozens of breaches since 2019 and extorted over $70 million.
  2. Leadership shifted to “Rey,” a teenage hacker from Amman, after prior French arrests.
  3. Late September hack of fbijobs.gov stole personnel medical, SSN, address, and unit data.
  4. Jordan detained Rey, reportedly cooperating, as FBI rapidly pursued anyone communicating with suspects.
  5. Dutch police arrested Pepijn van der Stap while logged into Signal, exposing key contacts.
  6. Seized messages allegedly revealed ransomware negotiators knew victims before victims learned breaches.
  7. Canadian executive Edward Dubrovsky was arrested for extortion-related charges; case records sealed.
  8. Investigators suspect a U.S. consulting executive helped operate ShinyHunters’ “shinywire” extortion site.
  9. “Ghostbyte” nickname and email traces tied Daniel Tobok to earlier Dharma ransomware mediation lore.
  10. DOJ cases highlight negotiators allegedly deceiving clients or conspiring to maximize ransom outcomes.

TAKEAWAYS:

  1. Conflicted fee models (percentage-of-ransom) can incentivize negotiators to favor attackers’ outcomes.
  2. Paying ransoms cannot verify data deletion, enabling repeat or downstream extortion attempts.
  3. Communications seized during arrests can rapidly map ecosystems of facilitators around extortion groups.
  4. Third-party incident response and insurance-directed vendors require rigorous oversight to prevent collusion.
  5. Prosecutions increasingly target intermediaries, not only hackers, for fraud, conspiracy, and extortion conduct.

NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779

Source: Rapid7 Cybersecurity Blog

Author: Rapid7

URL: https://www.rapid7.com/blog/post/ra-netscaler-intrusions-chaining-cve-2026-88771-and-cve-2026-88779

ONE SENTENCE SUMMARY:

Rapid7 analyzed an exploited Citrix NetScaler compromise chaining two CVEs to gain root, persist, recon internal networks, and exfiltrate configuration.

MAIN POINTS:

  1. Analysts investigated a NetScaler ADC running vulnerable 14.1 during active exploitation.
  2. Attackers chained CVE-2026-88771 log-poisoning RCE with CVE-2026-88779 SAML crash.
  3. Username injection text correlated with nsaaad crashes, Pitboss reboot, and root execution.
  4. Post-reboot crash handler reprocessed attacker text, acting as repeatable execution trampoline.
  5. Multiple persistence mechanisms included cron, rc.netscaler hooks, watchdog loops, and reverse agent.
  6. Cookie-authenticated PHP web shells hid behind CSS-like Apache aliases and 404 responses.
  7. Setting /bin/sh to mode 6555 enabled effective root via unprivileged web execution.
  8. Tunneling used Perl TCP pivoting plus Python HTTP-fronted proxy returning data in 404 bodies.
  9. HA-aware logic synced implants and forced failover to preserve access across paired appliances.
  10. Operators staged and exfiltrated /nsconfig configs, backups, keys, and diagnostics via web/C2.

TAKEAWAYS:

  1. Patch fixed builds for CVE-2026-88771 and CVE-2026-88779 and validate prior Citrix fixes.
  2. Assume exposure implies compromise; capture volatile data before rebooting or rebuilding.
  3. Hunt for .slap, .relay, and .nsvm artifacts plus unauthorized Apache PHP/CSS aliases.
  4. Investigate nsaaad crash loops, Pitboss reboots, and crash-handler execution evidence.
  5. Rotate credentials and keys possibly leaked from /nsconfig, including LDAP/RADIUS and SSL material.

When Your Ransomware Negotiator Works for the Other Side

Source: Dark Reading

Author: Terry J. Maxwell

URL: https://www.darkreading.com/cyber-risk/when-your-ransomware-negotiator-works-other-side

ONE SENTENCE SUMMARY:

Arresting a prominent ransomware negotiator highlights how weak vendor oversight can amplify cyber risk, accountability gaps, and incident-response failures.

MAIN POINTS:

  1. Arrest news underscores third-party risk as a core security and resilience concern.
  2. Vendor programs must validate negotiator credentials, ethics, and legal compliance continuously.
  3. Due diligence should include background checks, sanctions screening, and litigation history reviews.
  4. Contract terms need clear scope, escrowed communications, and auditable decision trails.
  5. Monitoring controls should track vendor actions during incidents, not just pre-onboarding paperwork.
  6. Conflicts of interest can emerge when negotiators profit from prolonged extortion dynamics.
  7. Transparency requirements must cover subcontractors, offshore handling, and data sharing pathways.
  8. Strong governance helps prevent unauthorized payments, fraud, or facilitation of criminal activity.
  9. Incident response playbooks should define negotiator oversight, approvals, and escalation criteria.
  10. Executive accountability improves when vendor performance is measured against risk and outcomes.

TAKEAWAYS:

  1. Strengthen vendor risk management before relying on ransomware negotiation services.
  2. Demand auditability and approvals for every negotiation step and payment-related decision.
  3. Treat negotiators like high-risk providers requiring continuous monitoring and periodic reassessment.
  4. Align contracts with legal counsel to prevent compliance breaches and hidden subcontracting.
  5. Build internal governance so crisis urgency doesn’t override controls and oversight.

Why You Need a Zero Trust Program Management Office

Source: Cloud Security Alliance

Author: unknown

URL: https://cloudsecurityalliance.org/blog/2026/10/15/why-you-need-a-zero-trust-program-management-office

ONE SENTENCE SUMMARY:

A Zero Trust PMO aligns cross-team initiatives, governance, metrics, and resources to deliver measurable enterprise risk reduction continuously.

MAIN POINTS:

  1. Fragmented identity, cloud, data, and network efforts commonly stall Zero Trust progress.
  2. Enterprise-wide Zero Trust impacts users, devices, apps, data, networks, automation, analytics, and governance.
  3. Cross-domain dependencies require coordination to avoid incompatible policies and inconsistent terminology.
  4. A formally chartered ZT PMO provides governance, oversight, and execution alignment under an executive sponsor.
  5. Program-level questions cover protection priorities, sequencing, policy authority, risk acceptance, and success measurement.
  6. Chartering defines vision, scope, operating model, decision rights, escalation, and measurable success criteria.
  7. Oversight cadence spans weekly issue tracking, monthly team reporting, quarterly steering updates, and annual reassessments.
  8. Alignment uses cross-functional participation and RACI clarity while translating outcomes for each stakeholder group.
  9. Progress measurement tracks capability readiness and control effectiveness using risk-focused, application-level metrics.
  10. Implementation acceleration relies on shared standards, playbooks, templates, training, tooling guidance, and reusable reporting.

TAKEAWAYS:

  1. Treat Zero Trust as an operating model requiring sustained governance, not a one-time deployment.
  2. Establish executive sponsorship so funding decisions and policy authority are enforceable enterprise-wide.
  3. Use meaningful KPIs that demonstrate reduced risk, improved resilience, and coverage of critical protect surfaces.
  4. Drive adoption through change management, pilots, feedback loops, and early wins like phishing-resistant MFA.
  5. Pair PMO coordination with a CoE’s technical patterns to avoid bottlenecks and ensure consistent implementation.

Vulnerability Management Isn’t About the Score — It’s About How It Applies to You

Source: Dark Reading

Author: Arielle Waldman

URL: https://www.darkreading.com/cybersecurity-operations/vulnerability-management-isnt-about-the-score-its-about-how-it-applies-to-you

ONE SENTENCE SUMMARY:

Organizations should replace vendor-theoretical security scores with environment-specific, real-world exploit intelligence to prioritize remediation effectively and accurately.

MAIN POINTS:

  1. Prioritization improves when based on confirmed exploit activity rather than theoretical severity.
  2. Vendor-assigned scores often ignore local context like exposure, compensating controls, and asset value.
  3. Real exploit data highlights vulnerabilities attackers actually use, reducing noise in patch queues.
  4. Environment-specific telemetry enables faster identification of high-risk systems and attack paths.
  5. Threat intelligence adds timeliness, reflecting shifting adversary tactics and active campaigns.
  6. Exploitability should be validated with observable evidence, such as exploitation attempts or weaponized code.
  7. Risk scoring must incorporate asset criticality to focus resources on business-impacting targets.
  8. Continuous measurement is needed because exploit prevalence and exposure change over time.
  9. Practical scoring supports better communication between security, IT operations, and leadership.
  10. Outcome-driven metrics align remediation efforts with reducing real attack likelihood and impact.

TAKEAWAYS:

  1. Replace static severity ratings with exploit-informed, context-aware vulnerability management.
  2. Combine internal telemetry, threat intel, and asset inventory to determine true remediation priorities.
  3. Focus patching on vulnerabilities with active exploitation and meaningful business impact.
  4. Treat risk as dynamic by continuously reassessing exposure and exploit trends.
  5. Measure success by reduced attackability, not by closing the highest CVSS items.

Attackers exploit Palo Alto PAN-OS flaw for root access as CISA orders three-day fix

Source: CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4235787/attackers-exploit-palo-alto-pan-os-flaw-for-root-access-as-cisa-orders-three-day-fix.html

ONE SENTENCE SUMMARY:

CVE-2026-0322 enables authenticated root code execution on PAN-OS management interfaces, prompting urgent patching and forensic compromise checks.

MAIN POINTS:

  1. Palo Alto disclosed CVE-2026-0322 on October 14 with high urgency and 8.6 severity.
  2. Vulnerability allows authenticated network-access attackers to execute arbitrary code as root.
  3. Limited exploitation observed targeting the Palo Alto management interface.
  4. CISA added it to Known Exploited Vulnerabilities, ordering federal remediation by October 17.
  5. Binding Operational Directive 26-04 requires forensic triage to detect pre-patch compromise.
  6. Affected include PA-Series, VM-Series, and Panorama (virtual and M-Series) running PAN-OS.
  7. Cloud NGFW and Prisma Access are explicitly not impacted.
  8. Fixed releases issued for PAN-OS 10.2, 11.1, 11.2, 12.1, and 12.2 maintenance lines.
  9. No workaround exists; Threat Prevention IDs 510046/510047 offer limited, SSL-decryption-dependent detection.
  10. Likely initial access stems from poor management-access hygiene and stolen or reused admin credentials.

TAKEAWAYS:

  1. Patch quickly across all supported PAN-OS versions and migrate off unsupported releases immediately.
  2. Perform forensic review of Panorama and managed firewalls before changes, preserving evidence.
  3. Restrict management interface exposure to trusted internal IPs and minimize external reachability.
  4. Audit admin logins and configuration changes for persistence tactics or unauthorized reconfiguration.
  5. Treat credential protection and post-login anomaly detection as primary controls, not just jump boxes.

Penetration testing every deployment with AWS Continuum

Source: AWS Security Blog

Author: Jigar Bhatt

URL: https://aws.amazon.com/blogs/security/penetration-testing-every-deployment-with-aws-continuum/

ONE SENTENCE SUMMARY:

AWS Continuum adds AI-scoped, post-deploy penetration testing gates to CI/CD, confirming exploitability per-change and blocking promotions via OIDC-authenticated automation.

MAIN POINTS:

  1. SAST/SCA/DAST flag patterns; penetration tests confirm actual exploitability of vulnerabilities.
  2. Continuum runs server-side AI agents to find and validate exploitable issues in running apps.
  3. Gate executes post-deployment in staging, blocking production promotion above chosen severity thresholds.
  4. Change-based scoping tests only commit range since last passing gate, enabling per-deploy speed.
  5. Scoping outcomes include in scope, scoped out, or scope conflict with configurable blocking behavior.
  6. Setup requires configured pentest, IAM role for pipeline, and a pipeline gate step.
  7. OIDC federation replaces long-lived AWS keys, reducing common CI/CD credential leakage risks.
  8. Trust and permissions policies must be tightly scoped; pin sub claims to branches/environments.
  9. GitHub example needs contents: write to advance baseline marker and avoid widening ranges.
  10. Rollout settings independently control severity, scope conflict, and infrastructure-error fail-open/closed behavior.

TAKEAWAYS:

  1. Per-deploy pentesting becomes practical when tests are scoped to just-deployed changes.
  2. A failing gate signals a reproducible exploitable vulnerability, not a signature-based suspicion.
  3. Baseline advances on any passing run, so report-only periods can “clear” commits permanently.
  4. Using OIDC with least-privilege IAM roles strengthens pipeline security and eliminates stored keys.
  5. Production-grade adoption needs pinned action versions, restricted variable overrides, and fail-closed on infra errors.

CQURE Hacks #85: CQUSNDeepAnalyzer: Turn the USN Journal into a Forensic Timeline

Source: CQURE Academy

Author: Daniel

URL: https://cqureacademy.com/blog/cqure-hacks-85-cqusndeepanalyzer-turn-the-usn-journal-into-a-forensic-timeline/

ONE SENTENCE SUMMARY:

CQUSNDeepAnalyzer converts noisy NTFS USN Journal data into enriched, interactive timelines highlighting ransomware-like behavior and malware indicators quickly.

MAIN POINTS:

  1. USN Journal is highly valuable for NTFS forensics but produces overwhelming noise.
  2. CQUSNDeepAnalyzer parses the raw $J stream for detailed file-operation insights.
  3. Optional MFT integration enables full path reconstruction for clearer investigative context.
  4. Built-in YARA rules support detection of known malicious binaries and patterns.
  5. Behavioral detection flags suspicious sequences like mass renames and deletions.
  6. Enrichment from EVTX and Prefetch correlates filesystem activity with host execution evidence.
  7. Demo results show over 1,500 rename records occurring in a concentrated burst.
  8. Analysis identifies nearly 50,000 file deletion events within the journal timeline.
  9. Fifteen new file extensions appear only late in the timeline, indicating anomaly.
  10. Interactive HTML reporting includes heatmaps, Sankey diagrams, treemaps, and ranked findings.

TAKEAWAYS:

  1. Transforming raw USN records into structure is key to actionable investigations.
  2. Bursty renames plus mass deletions and novel extensions can indicate early ransomware.
  3. Cross-artifact correlation (USN+EVTX+Prefetch+MFT) strengthens confidence in conclusions.
  4. Searchability, filtering, and CSV export reduce manual review and speed casework.
  5. Webinar promotes PAWs, secure passkeys, and validation of monitoring and alerting coverage.

Cybersecurity is a leadership problem: Why the management model needs to catch up

Source: CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4234532/cybersecurity-is-a-leadership-problem-why-the-management-model-needs-to-catch-up.html

ONE SENTENCE SUMMARY:

Despite advancing tools, cybersecurity persists as a governance challenge requiring clear authority, shared ownership, disciplined execution, and board continuity enterprise.

MAIN POINTS:

  1. Management failures from 2015—silos, short-termism, weak accountability—still hinder security today.
  2. Frameworks define what to do; organisations struggle with implementation, ownership, and authority.
  3. Security capabilities improved via cloud, identity, automation, and AI-enabled operations.
  4. CISOs often remain accountable for risks they cannot directly control or fix.
  5. Reporting-line debates mask ambiguity about whether the CISO is technologist, control function, or strategist.
  6. CIO–CISO tension is normal; effective governance must arbitrate competing priorities.
  7. Rising budgets don’t guarantee results; cybersecurity can be undermanaged as well as underfunded.
  8. Compliance and certifications raise baselines but can reward activity over real resilience.
  9. Board visibility now exists; boards must drive priorities, test assumptions, and sustain oversight.
  10. Incident-driven cycles create a ‘spiral of failure’ unless strategic continuity and execution discipline persist.

TAKEAWAYS:

  1. Define CISO mandate, decision rights, and escalation paths before changing org charts.
  2. Embed cyber accountability in business and IT owners who control processes and platforms.
  3. Measure conversions of spend into durable capability, not project milestones alone.
  4. Use governance forums to turn risk tradeoffs into timely decisions, then track follow-through.
  5. Maintain multi-year resilience roadmap independent of incident-driven urgency swings.

Download: The IT and security field guide to AI adoption

Source: Help Net Security

Author: Help Net Security

URL: https://www.tines.com/access/guide/the-it-and-security-field-guide-to-ai-adoption/

ONE SENTENCE SUMMARY:

AI adoption in security and IT often fails due to workflow mismatch, rising complexity, eroded trust, and added risk, requiring disciplined evaluation and human oversight.

MAIN POINTS:

  1. Security and IT teams face intense pressure to adopt AI quickly.
  2. Demo-ready AI tools frequently fail under real operational workloads.
  3. Practical adoption can increase complexity across existing processes and systems.
  4. Trust deteriorates when AI outputs are inconsistent or hard to validate.
  5. Workload may grow as staff must supervise, tune, and verify AI results.
  6. New risks emerge from incorrect recommendations and automation mistakes.
  7. Oversight burdens rise due to monitoring, auditing, and accountability needs.
  8. Adoption failures often stem from poor alignment with real workflows.
  9. A field guide offers a clearer end-to-end path from evaluation to rollout.
  10. Human-in-the-loop approaches are emphasized for safer, sustainable implementation.

TAKEAWAYS:

  1. Prioritize workflow-fit testing over impressive demonstrations during tool selection.
  2. Plan for added governance, validation, and monitoring responsibilities from day one.
  3. Treat trust as a core requirement, ensured through transparency and repeatability.
  4. Measure success by reduced risk and friction, not marketing claims.
  5. Keep humans accountable for decisions while using AI to augment, not replace.

The Threat Hunting Flywheel: Why Threat Hunting Isn’t About Finding Bad Things

Source: Black Hills Information Security

Author: Faan Rossouw

URL: https://www.blackhillsinfosec.com/threat-hunting-fly-wheel/

ONE SENTENCE SUMMARY:

Threat hunting’s goal is continuous security improvement by iteratively focusing, investigating, learning, and refining defenses to reduce future risk.

MAIN POINTS:

  1. Ultimate objective shifts from incident discovery to lowering future compromise probability.
  2. Debugging analogy shows hunts teach system lessons and improve security “testing.”
  3. Viewing hunting as a cycle reinforces iterative learning and compounding program maturity.
  4. Choosing a focus solves the “where do we start?” problem in large log environments.
  5. Hypothesis-driven hunts leverage threat intelligence to target likely adversary behaviors.
  6. Baselining defines normal operations, making deviations easier to spot and assess.
  7. Statistical tools like RITA prioritize anomalous connections and behaviors for review.
  8. Machine learning flags deviations with confidence scoring to guide investigation starts.
  9. Investigations narrow iteratively, separating known-good context from suspicious threads.
  10. Refinement turns findings into detections, documentation, hypothesis generation, and gap closure.

TAKEAWAYS:

  1. Treat “no findings” as valuable validation and detection-quality assessment.
  2. Blend multiple hunting approaches over time for a more mature program.
  3. Convert recurring hunt patterns into automated detection rules to scale effort.
  4. Document environmental baselines and share learnings to multiply team effectiveness.
  5. Expect compounding benefits, often accelerating after 12–18 months of sustained hunting.

Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)

Source: Tenable Blog

Author: Research Special Operations

URL: https://www.tenable.com/blog/microsofts-october-2026-patch-tuesday-addresses-1407-cves-cve-2026-96951

ONE SENTENCE SUMMARY:

October 2026 Patch Tuesday fixed 1,407 Microsoft CVEs, including two zero-days, emphasizing urgent patching and end-of-support transitions across many products.

MAIN POINTS:

  1. Release contained 69 critical, 1,337 important, and one low vulnerability.
  2. Updates covered 301 products/components; Excel, DNS Server, and Windows Kernel led counts.
  3. Elevation of Privilege comprised 47.9% of fixes; RCE accounted for 22.3%.
  4. CVE-2026-96951 zero-day in Windows Shell bypassed Mark of the Web via malicious files.
  5. CVE-2026-108398 .NET Framework bypass allowed loading malicious assemblies to evade WDAC.
  6. CVE-2026-70229 AD DS RCE enabled crafted packets to execute code; exploitation more likely.
  7. CVE-2026-70279 Exchange spoofing relied on social engineering; admin victims risk data access/modification.
  8. CVE-2026-70571 Exchange RCE triggered by malicious email content-conversion; exploitation more likely.
  9. Additional high-risk issues included Dynamics BC RCE, BITS RCE, and multiple Windows Update EoPs.
  10. Support milestones: Server 2012 ESU ended; Server 2022 moved to extended support through 2031.

TAKEAWAYS:

  1. Prioritize rapid deployment of this month’s fixes for high-impact, likely-exploited attack paths.
  2. Reduce attachment-driven compromise by strengthening MOTW-related handling and user file execution controls.
  3. Reassess application control posture to ensure WDAC protections aren’t undermined by assembly registration.
  4. Accelerate upgrade projects for products that no longer receive security updates to avoid permanent exposure.
  5. Operationalize continuous verification using scanning and Tenable plugin IDs 192813, 182965, and 192817.

AI vulnerability patching has a grading problem

Source: Help Net Security

Author: Anamarija Pogorelec

URL: https://www.helpnetsecurity.com/2026/10/12/ai-vulnerability-patching-grading-problem/

ONE SENTENCE SUMMARY:

Northwestern evaluated AI bug-fixing on real vulnerabilities, finding crash-only benchmarks overstate success because many patches fail maintainer tests.

MAIN POINTS:

  1. Researchers tested AI coding agents on 112 real-world security bugs.
  2. Dataset spanned 84 open-source projects in C/C++, Go, and Rust.
  3. Maintainer-authored tests accompanying upstream fixes were collected and reused for evaluation.
  4. Crash-stopping patches frequently failed maintainer checks, despite eliminating proof-of-concept crashes.
  5. Claude Opus 4.7 stopped crashes about 90% but passed maintainer tests only ~61%.
  6. Some patches avoided crashes by rejecting unusual inputs, breaking intended functionality.
  7. Web search enabled agents to retrieve upstream fix commits and mirror their approaches.
  8. Providing full git history let agents locate and replicate prior related fixes.
  9. Benchmark harness flaws sometimes mis-scored correct fixes due to stalls or test conflicts.
  10. Review of 13 benchmarks found AI-agent datasets commonly leave evaluation pitfalls unaddressed.

TAKEAWAYS:

  1. Prefer evaluations using maintainer regression tests, not merely crash disappearance on one input.
  2. Restrict or disclose internet and repository-history access to prevent “answer leakage.”
  3. Ensure harnesses accurately handle timeouts, tooling stalls, and pipeline errors in scoring.
  4. Provide explicit build-and-test instructions, as guidance alone can raise success substantially.
  5. Vendor claims should be challenged with questions about test rigor, tool access, prompts, and error handling.

Mastering Cybersecurity with VMware vDefend and Avi via Hands-on Labs

Source: VMware Security Blog

Author: Tuan Nguyen and Apoorv Malmane

URL: https://blogs.vmware.com/security/2026/10/mastering-cybersecurity-with-vmware-vdefend-and-avi-via-hands-on-labs.html

ONE SENTENCE SUMMARY:

VMware’s updated vDefend and Avi Hands-on Labs teach practical Zero Trust, threat prevention, virtual patching, and load-balancing security for VCF.

MAIN POINTS:

  1. Cybersecurity Awareness Month highlights rising AI-driven threats against private cloud environments.
  2. VMware released updated vDefend and Avi Cybersecurity Hands-on Labs for VCF defense.
  3. Labs bridge theory to practice for security engineers, SOC analysts, and platform administrators.
  4. Micro-segmentation enables workload-level Zero Trust and visibility into lateral traffic flows.
  5. Advanced Threat Prevention combines IDS/IPS, NTA, and behavioral analytics to detect attacks.
  6. Modern software-defined load balancing improves performance, availability, and traffic management.
  7. HOL-2770-01 teaches DFW 1-2-3-4, ATP 1-2-3, plus AI Assistant troubleshooting.
  8. HOL-2770-02 focuses on virtual patching and correlated detections to shorten response times.
  9. HOL-2770-03 hardens VCF infrastructure using predefined vDefend security policies and best practices.
  10. Avi labs cover integration, WAF security, GSLB resiliency, and migration using conversion tooling.

TAKEAWAYS:

  1. Hands-on lab progression provides a measurable path toward implementing Zero Trust in VCF.
  2. Layered defenses improve outcomes by combining firewalling, IDPS, NTA, and NDR.
  3. Virtual patching reduces exposure windows by shielding vulnerable workloads before OS patching.
  4. Container environments benefit from integrated Avi plus vDefend for east-west and egress controls.
  5. Explore 2026 session recordings reinforce lab workflows like DFW automation and AI-driven ATP.

Claude Skill 04: Map ATT&CK Techniques

Source: Feedly Blog

Author: Josh Darby MacLellan

URL: https://feedly.com/ti-essentials/posts/claude-skill-04-map-att-and-ck-techniques

ONE SENTENCE SUMMARY:

Free Claude Skill maps report-described adversary behaviors to current MITRE ATT&CK techniques, providing evidence, confidence, and Navigator-ready outputs.

MAIN POINTS:

  1. Skill ingests threat reports via paste, file attachment, or URL trigger in Claude.
  2. Workflow starts with recommended defaults or customizable options across up to six questions.
  3. Options include explanation depth, unmapped behaviors, candidate techniques, and output selections.
  4. It checks current ATT&CK version via Version History and attack-stix-data index.
  5. Behaviors map to Enterprise, ICS, or Mobile techniques depending on described activity.
  6. Outputs include Markdown, Word document, and ATT&CK Navigator layers per domain.
  7. Each technique includes quote, location, occurrence status, confidence rating, and rationale.
  8. Script validates quotes against source text and technique IDs against pinned ATT&CK bundle.
  9. Vendor-cited ATT&CK IDs are reconciled as current, revoked, merged, refined, or unsupported.
  10. Optional Feedly MCP integration compares results to Threat Graph profiles and produces comparison layers.

TAKEAWAYS:

  1. Automates CTI “processing” by converting narrative reporting into defensible ATT&CK technique mappings.
  2. Separating occurrence status from confidence reduces ambiguity about evidence versus fit.
  3. Version verification and ID reconciliation help prevent stale or incorrect ATT&CK references.
  4. Navigator layers with quote-backed comments accelerate visualization and stakeholder communication.
  5. Open, editable Skill code enables teams to tailor defaults, naming conventions, and scoring rules.

How AI can fix cybersecurity compliance: From dashboards to continuous execution

Source: Help Net Security

Author: Help Net Security

URL: https://www.helpnetsecurity.com/2026/10/08/espresso-labs-ai-cybersecurity-compliance/

ONE SENTENCE SUMMARY:

Manual compliance wastes effort proving security; AI-native platforms continuously enforce controls, collect evidence automatically, and match machine-speed attackers.

MAIN POINTS:

  1. Proving compliance often consumes more effort than improving actual security outcomes.
  2. CMMC Level 2 assessment costs exclude implementation, driving total program expenses far higher.
  3. DoW paused CMMC Phase 2, yet contractors still must self-assess and comply.
  4. Frameworks like SOC 2 and ISO require continuous control operation plus evidence production.
  5. Compliance functions like an endless assembly line, not a one-time checklist.
  6. Organizations commonly stitch 20+ tools, providers, auditors, and coordinators into fragile workflows.
  7. Traditional GRC dashboards document controls but cannot deploy, enforce, or remediate them.
  8. Adversaries automate intrusions, shrinking breach timelines to minutes or even seconds.
  9. Many successful attacks exploit basics already required: MFA, hardened ports, and patching.
  10. AI-native platforms execute controls, detect drift, remediate issues, and generate evidence continuously.

TAKEAWAYS:

  1. Shifting evidence collection into daily operations dramatically reduces audit scramble and staleness.
  2. Enforced controls every day make organizations harder targets than quarterly checkbox reviews.
  3. Automation should close gaps immediately and escalate only judgment-heavy decisions to humans.
  4. Consolidating mappings across frameworks reduces duplicate work while improving real-time posture visibility.
  5. SMBs can achieve mature security by pairing AI-driven execution with expert oversight, without proportional headcount.

Pricing your bad days and how to build an economic model for security decisions

Source: Help Net Security

Author: Mirko Zorz

URL: https://www.helpnetsecurity.com/2026/10/08/ivan-milenkovic-qualys-cyber-risk-quantification/

ONE SENTENCE SUMMARY:

Security leaders should quantify cyber risk in money via loss-scenario models, prioritize remediation by value-at-risk, and report consistently to boards, CFOs, and underwriters.

MAIN POINTS:

  1. Many security metrics lack a financial anchor, leaving boards unable to assess value delivered.
  2. Effective models start with business loss scenarios, then map down to driving assets.
  3. Assign a loss range to each scenario, improving estimates with real outcomes over time.
  4. Prefer system-sourced inputs; distrust numbers manually adjusted or curated by humans.
  5. Prioritization should reflect value at risk, not technical severity scores alone.
  6. Compare exposures on revenue-impacting systems versus low-value assets like unused test servers.
  7. Board reporting should stay above CVE detail, focusing on enterprise control scaling and residual loss.
  8. Demonstrate “nothing happened” value through measurable changes: exposure windows, overdue risk, tested controls.
  9. CFOs expect spreadsheet-ready ranges, likelihoods, spend options, and consequences of inaction with an owner.
  10. A single underlying model can serve board decisions and insurance underwriting with different evidence depth.

TAKEAWAYS:

  1. Reverse the usual approach: model losses first, then trace vulnerabilities to business impact.
  2. Use value-at-risk to depoliticize remediation decisions and justify resource allocation.
  3. Prove prevention by tracking consistent, time-series indicators tied to key scenarios.
  4. Translate security into finance language: ranges, probabilities, and decision-linked investment outcomes.
  5. Align board narratives and underwriting submissions so claims-time scrutiny matches reported reality.

Post Quantum Cryptography is Not an Algorithm Upgrade

Source: Cloud Security Alliance

Author: unknown

URL: https://cloudsecurityalliance.org/blog/2026/10/05/post-quantum-cryptography-is-not-an-algorithm-upgrade

ONE SENTENCE SUMMARY:

Successful PQC migration requires distinguishing NIST algorithms, mapping crypto dependencies to data and systems, prioritizing risk, proving production usage.

MAIN POINTS:

  1. Clarify ML-KEM, ML-DSA, SLH-DSA roles; they aren’t interchangeable with FIPS numbers.
  2. FIPS 203 ML-KEM provides key establishment, enabling symmetric encryption like AES.
  3. FIPS 204 ML-DSA replaces classical signature uses such as RSA signatures and ECDSA.
  4. FIPS 205 SLH-DSA adds hash-based signatures, improving cryptographic diversity beyond lattices.
  5. FIPS 202 defines SHA-3 hashing, not a PQC migration algorithm.
  6. Shor breaks RSA/DH/ECC; Grover only reduces symmetric margins, focusing urgency on public-key.
  7. Inventorying “RSA-2048” is insufficient; prioritize based on what data and services it protects.
  8. Harvest-now-decrypt-later makes long-lived confidentiality a present risk despite uncertain QC timelines.
  9. Signature risks differ from confidentiality, impacting PKI, secure boot, device identity, and roots of trust.
  10. Crypto agility requires discoverability, changeability, and verification of actual negotiated production cryptography.

TAKEAWAYS:

  1. Begin with data lifetimes and business impact, then select PQC mechanisms accordingly.
  2. Treat confidentiality migration and signature/PKI modernization as distinct timelines and engineering efforts.
  3. Build dependency context across apps, protocols, keys, suppliers, and hardware lifecycles.
  4. Prove operational reality: negotiated algorithms, presented certificates, enforced policies, and drift detection.
  5. Plan for hybrid transition and supplier constraints within procurement and product lifecycle management.

The Credential Layer Is Expanding Faster Than Security Teams Can See It

Source: The Hacker News

Author: info@thehackernews.com (The Hacker News)

URL: https://thehackernews.com/2026/10/the-credential-layer-is-expanding.html

ONE SENTENCE SUMMARY:

Explosive software and AI-agent growth expands credential sprawl; unified detection across repos, endpoints, and collaboration enables contextual risk control enterprise.

MAIN POINTS:

  1. GitGuardian frames credential-layer security as Detect, Remediate, and Prevent, starting with discovery.
  2. Commit volume is surging, driving more infrastructure, integrations, automations, and authentication points.
  3. Public GitHub saw 28.65M new hardcoded secrets in 2025, up 34% YoY.
  4. AI-service credential leaks grew 81%, reflecting rapid adoption of new tools and agents.
  5. Perimeters don’t contain credentials; secrets migrate across accounts, devices, repos, and knowledgebases.
  6. Internal repositories are about six times likelier than public ones to contain secrets.
  7. Collaboration platforms originate roughly 28% of secret incidents outside source-code repositories.
  8. Infostealers shifted to developer laptops, turning endpoints into supply-chain entry points.
  9. Adversaries exploit boundary-crossing credentials; compromised credentials caused 22% of initial access.
  10. Contextual inventory needs validity, ownership, permissions, dependency mapping, and fingerprinted exposure histories.

TAKEAWAYS:

  1. Establish continuous credential discovery before remediation or prevention programs can succeed.
  2. Correlate findings across source control, public exposure, endpoints, and collaboration systems for full visibility.
  3. Prioritize secrets using enriched context: still-valid, high-privilege, widely-exposed, workload-dependent credentials.
  4. Treat developer machines and AI agent tooling as first-class credential surfaces requiring monitoring.
  5. Measure secrets-management coverage against the total credential population, not just vault-held records.

Open brain holocron

Source:

Author: unknown

URL: https://github.com/belouve/open-brain-holocron

ONE SENTENCE SUMMARY:

Open-brain-holocron is a GitHub project repository intended to store and share “holocron”-style knowledge artifacts for reuse.

MAIN POINTS:

  1. Repository hosted on GitHub under belouve/open-brain-holocron.
  2. Project name suggests a structured “knowledge vault” concept.
  3. Intended use appears to be capturing and organizing reusable information.
  4. Likely contains documentation describing goals, structure, and contribution process.
  5. May provide templates or schemas for consistent knowledge entries.
  6. Could include tooling or scripts supporting ingestion, search, or organization.
  7. Collaboration model probably leverages issues, pull requests, and version control.
  8. Security-relevant content may include notes, references, and operational practices.
  9. Licensing information should define reuse and redistribution permissions.
  10. Repository activity (commits/releases) indicates maintenance status and maturity.

TAKEAWAYS:

  1. Review the README to understand scope, structure, and expected workflows.
  2. Check license terms before reusing content or integrating it into other projects.
  3. Inspect contribution guidelines to safely collaborate and maintain consistency.
  4. Evaluate included automation for potential security implications and dependencies.
  5. Use repository history to judge stability, responsiveness, and long-term viability.

How to Turn a Risk Appetite Statement Into a Usable Curve

Source: Rivial Security Blog

Author: Randy Lindberg

URL: https://www.rivialsecurity.com/blog/risk-appetite-statement-to-risk-tolerance-curve

ONE SENTENCE SUMMARY:

Translate board cyber risk appetite statements into quantified tolerance curves linking loss impact and likelihood, enabling prioritized, defensible security decisions.

MAIN POINTS:

  1. Policy appetite sentences rarely influence security because they cannot evaluate specific assessed risks.
  2. Risk appetite expresses board philosophy, whereas risk tolerance defines operational acceptability thresholds.
  3. A tolerance curve connects likelihood and dollar impact into one acceptability boundary.
  4. Rare, high-impact losses and frequent, low-impact losses require different tolerance treatments.
  5. Convert percent-of-net-worth appetite into a dollar maximum loss figure.
  6. Anchor the maximum loss to a convention like 1% annual likelihood for curve calibration.
  7. Extend the curve downward as likelihood increases, reducing tolerable loss amounts.
  8. Presenting the implied curve to the board drives true ownership and possible appetite revision.
  9. Plot each system’s quantified risk against the curve to identify out-of-tolerance exposures.
  10. Use curve exceedance to justify budgets, satisfy examiner scrutiny, and detect risk drift over time.

TAKEAWAYS:

  1. Turning appetite into a curve makes board policy actionable for real-world risk decisions.
  2. Simple math can operationalize tolerance: dollars from net worth, likelihood anchor, then slope.
  3. Visualizing systems against tolerance removes prioritization arguments and clarifies remediation order.
  4. Board review of the curve converts passive approval into an explicit, defensible mandate.
  5. Continuous monitoring against the curve reveals control decay and scope changes before surprises occur.

From Models to MCP Servers, Skills, and Plugins: Rethinking Trust in the AI Supply Chain

Source: Cloud Security Alliance

Author: unknown

URL: https://www.akto.io/blog/ai-supply-chain-security

ONE SENTENCE SUMMARY:

Agentic AI expands supply-chain risk from artifacts to instructions and execution, requiring continuous governance over components, inputs, permissions, and runtime actions.

MAIN POINTS:

  1. A benign npm MCP package later exfiltrated emails via a hidden update.
  2. Traditional controls help but miss instruction and agency risks unique to agents.
  3. AI supply chain includes datasets, weights, libraries, pipelines, and deployment infrastructure.
  4. Serialized model artifacts can execute code, so third-party weights resemble untrusted binaries.
  5. MCP servers shape risk through tool code, definitions, auth, and returned content.
  6. Skills combine natural-language guidance with scripts, influencing tool selection and execution.
  7. Plugins bundle multiple components, obscuring nested dependencies and external instruction sources.
  8. Agent configuration is security logic governing tools, memory, approvals, and execution behavior.
  9. Three trust decisions exist: artifact provenance, instruction influence, and execution authority.
  10. Runtime gaps enable tool poisoning, rug pulls, and malicious tool outputs to trigger data leaks.

TAKEAWAYS:

  1. Treat approval as time-bound; re-review whenever components, definitions, or references change.
  2. Maintain an AI bill of materials capturing versions, owners, permissions, and deployment contexts.
  3. Constrain blast radius with scoped identities, least-privilege credentials, and restricted environments.
  4. Evaluate full packages: instructions, scripts, metadata, dependencies, and remote content sources.
  5. Apply runtime policy enforcement plus tracing to stop violations and support rapid containment.

WSL containers are generally available on Windows

Source: Help Net Security

Author: Anamarija Pogorelec

URL: https://www.helpnetsecurity.com/2026/09/30/microsoft-wsl-containers-available/

ONE SENTENCE SUMMARY:

Microsoft’s generally available WSL containers bring Linux container workflows to Windows with Intune governance, tooling integrations, and Defender visibility, though Compose support remains missing.

MAIN POINTS:

  1. WSL containers are now generally available for running Linux containers on Windows.
  2. Installation occurs via wsl --update or Microsoft’s GitHub releases.
  3. Administrators can disable the feature or constrain image sources for security.
  4. Intune adds controls to enable/disable WSL containers on managed endpoints.
  5. Registry allow-listing restricts image pulls to approved container registries.
  6. A new CLI, wslc.exe, includes container.exe alias for familiar commands.
  7. Windows apps can invoke Linux containers through a provided API.
  8. Added functionality includes restart, file copy, environment state checks, and health checks.
  9. VS Code dev containers and Aspire integrate with WSL containers as a runtime.
  10. Defender for Endpoint correlates container process, file, and network telemetry to the Windows host.

TAKEAWAYS:

  1. Governance improves by managing WSL container availability and registries through Intune.
  2. Development teams gain container tooling parity via CLI, API, and IDE/runtime integrations.
  3. Security investigations are streamlined with Defender’s host-linked container telemetry.
  4. Performance claims cite faster Windows-file access, but lack disclosed benchmarking conditions.
  5. Compose support is the largest current limitation, with compatibility a stated goal.

TeamViewer urges users to patch severe flaws “as soon as possible”

Source: BleepingComputer

Author: Sergiu Gatlan

URL: https://www.bleepingcomputer.com/news/security/teamviewer-urges-users-to-patch-severe-flaws-as-soon-as-possible/

ONE SENTENCE SUMMARY:

TeamViewer urged immediate updates to version 15.82, fixing five high-severity flaws enabling remote bypass, code execution, and privilege escalation.

MAIN POINTS:

  1. Vendor issued a rare advisory urging customers to patch immediately.
  2. CVE-2026-92370 allows remote session access control bypass via improper access control.
  3. Affected products include TeamViewer Full Client and Host across Windows, Linux, and macOS.
  4. Unauthorized actions could lead to remote code execution on targeted systems.
  5. CVE-2026-19743 addresses a path traversal vulnerability.
  6. CVE-2026-92368 fixes a heap-based buffer overflow weakness.
  7. CVE-2026-92369 resolves a TOCTOU race condition issue.
  8. CVE-2026-92371 corrects improper path validation enabling escalation to SYSTEM/root.
  9. Company stated no known public exploits or active in-the-wild exploitation.
  10. Attackers often abuse remote access tools like TeamViewer for malware and ransomware deployment.

TAKEAWAYS:

  1. Upgrade endpoints to TeamViewer 15.82 or supported maintenance/legacy releases immediately.
  2. Prioritize mitigation of remote access control bypass risks due to potential RCE.
  3. Treat local-to-remote execution and privilege escalation paths as high-impact operational threats.
  4. Monitor TeamViewer usage aggressively because legitimate tools are frequently abused by criminals.
  5. Incorporate vendor advisories into rapid patch workflows, given TeamViewer’s history of security incidents.