Secure World News

For years, the U.S. government asked one of its digital forensics vendors a simple question: Who owns you, and where is your code written? According to federal prosecutors, the answers it got back were false—and the software it bought was being developed in Moscow by the same operation that sold its tools to Russia’s Federal Security Service (FSB).

The cyber extortion group ShinyHunters says it breached the FBI’s network and stole personal data on thousands of current, former, and prospective employees. The FBI is investigating but has not confirmed where, or whether, its systems were breached.

A new line of attack has opened in the fight over how Washington should respond to this summer’s agentic AI incidents. According to a New York Post report published September 19th, tech insiders say OpenAI and Anthropic oversold their “rogue AI” hacks to push federal regulators toward rules that would entrench the two frontier labs and lock out future competitors.

Security champion programs were never really about adding another security responsibility to someone’s job.

Ask any CISO whether their network is segmented, and the answer is almost always yes. New research from Forescout’s Vedere Labs suggests that answer deserves a follow-up question: segmented from what, exactly?

For years, security teams have talked about bot traffic as a background nuisance: scrapers hitting product pages, credential-stuffing scripts testing stolen passwords, the occasional scalping bot cleaning out concert tickets before a human can click “buy.”

Reviewing threat models and security designs has been a large part of my work throughout my career. Increasingly, I come across documents that appear to have been drafted with the help of generative AI. I can often tell within a few seconds. Writing a document has become almost free. So has producing something that looks like reasoning. What has not become free is reasoning that actually holds up. For every design that genuinely works through the problem, that sits with the current state, digs into why it looks the way it does, and only then proposes a solution, I see many more that give me a clean, high-level overview and stop there. The polish is real. The reasoning underneath is thin.

For most of the security operations center’s existence, detection has been a signal-to-noise problem: sift through a mountain of legitimate activity for the sliver that isn’t. U.S. CISA’s newest guidance, Using Cyber Decoys to Strengthen Detection and Response, argues that decoys break that math entirely. Plant an asset nobody legitimate has any reason to touch, and the noise problem disappears—any interaction is the signal.

Two years after the Change Healthcare ransomware attack froze claims processing at pharmacies and hospitals nationwide, Congress is trying again to write mandatory cybersecurity rules into federal health law. On September 17, U.S. Senators Mark R. Warner (D-VA) and Ron Wyden (D-OR) reintroduced the Health Infrastructure Security and Accountability Act, a bill that would replace the healthcare sector’s long-standing reliance on voluntary cybersecurity guidance with enforceable minimum standards, mandatory audits, and steep new penalties for executives who lie about compliance.

A verified HBO Max Reddit account was hijacked and used to push 108 malicious ads over roughly 48 hours, redirecting users to fake app downloads that quietly infected their Windows and macOS devices with infostealer malware.

If a stranger walked into your organization headquarters with no ID badge, no background check, and no manager who’d requested them, security would stop them at the door. Every time, without exception.

Cybersecurity leaders have never been more confident in their teams. They’ve also never been more likely to have just survived a significant breach. Those two facts, side by side in Arctic Wolf’s newly released 2026 AI & Cybersecurity Trends Report, form the throughline of one of the year’s more revealing industry surveys.

Anthropic CEO Dario Amodei called on the AI industry this month to slow its development, warning that without intervention, a swarm of AI agents could take over the internet within six to 12 months. His essay, “We Must Pace the Frontier,” lays out a three-step plan: embed third-party evaluators inside frontier labs, coordinate among AI companies in democratic countries, and eventually negotiate with China.

For years, building AI felt like the Wild West: move fast, break things, ship the model, and let legal & compliance worry about it during the next funding round or supplier review.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has refreshed its flagship Insider Threat Mitigation Guide for the first time since 2020, and the timing is not incidental.

A researcher’s public resignation from Anthropic went viral this week for its apocalyptic framing—AI systems that could “kill us all by the end of the decade.” But strip away the extinction-risk headlines, and what’s left is a narrower, more immediate problem that security and compliance leaders don’t need to resolve the superintelligence debate to act on: the labs building agentic AI still can’t say, in public, how they’d contain a system that stopped behaving as intended.

On September 8, 2026, the U.S. National Security Agency, the Cybersecurity and Infrastructure Security Agency, and the FBI released a joint Cybersecurity Advisory with an unusually direct title: “China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies.” It’s the U.S. government’s most detailed public accounting to date of how Chinese AI developers have been extracting the outputs of American frontier models—not as an occasional research shortcut, but, in the agencies’ words, as the “critical core” of their model development strategy.

Picture a composite scenario, assembled from the failure modes that show up in real after-action reports. At 2:07 a.m., an alert fires on suspicious activity in a production cloud workload. The SOC analyst on shift sees it within minutes, which turns out to be the last thing that goes smoothly tonight. The one engineer with rights to isolate that workload isn’t answering. The cloud provider’s escalation path is, at this hour, a support ticket in a queue. Legal’s standing guidance says preserve evidence before anyone changes the system, and nobody on the call can say with confidence which logs even exist, let alone who’s allowed to export them.

I’ve been in several conversations recently where the first question is: “Which post-quantum algorithm should we implement?”

When a service goes down, the outage itself is only half the crisis. The other half is silence; or worse, a status page full of hedging and marketing language while customers, network defenders, and critical infrastructure operators are left guessing whether they’re under attack. On September 2, 2026, six government agencies decided that guessing game has gone on long enough.