September 2026 Microsoft Patch Tuesday
This month, Microsoft released patches for a record-breaking 973 vulnerabilities, including 113 rated critical. It is by far the largest Patch Tuesday to date, well ahead of the previous high of 664 s
Search Intelligence
Why federal cyber defense demands an offense-driven mindset
Static checklists and annual penetration tests leave agencies with dangerous blind spots. True resilience requires moving from reactive attestation to continuous, automated validation. The post Why fe
AIs as Modern Genies
This essay was written with Barath Raghavan, and originally appeared in Lawfare . In April, an artificial intelligence (AI) agent conducting a routine task at a company hit a snag, tried to solve it,
The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT
Research by: Alexey Bukhteyev Key Takeaways Introduction Over the past several years, AI assistants have moved far beyond text generation. Modern systems can execute code, install additional dependenc
The Numbers Behind CISO Burnout And Turnover
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Sep. 8, 2026 – Read the Report The 2026 CISO Report from Cybercrime Magazine in partnership with Sophos
Stealing AI Reasoning Traces
Interesting research: " Stealing Reasoning Traces from Proprietary LLM APIs ": Abstract: Leading large language model providers now conceal their models’ step-by-step reasoning, or chain-of-thou
MikroTik router flaws allow takeover without a password
Attackers are exploiting critical RouterOS flaws to take control of routers with SSH exposed to the internet.
ISC Stormcast For Tuesday, September 8th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Loyalty points fraud is funding hacker holidays (Lock and Code S07E18)
This week on the Lock and Code podcast, we speak with Kim Sutherland about loyalty points fraud and how everyday people can stay safe.
7th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 7th Setpember, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Thomson Reuters, a global information and technol
LG TV flaws could let attackers listen in, even in standby mode
Testing found that LG smart TVs can track viewing and scan home networks, while security flaws could let attackers record conversations.
A week in security (August 31 – September 6)
Last week on Malwarebytes Labs: Stay safe!
Critical MikroTik Vulnerability - Patch Now
Mikrotik released a patch late last week for an already-exploited vulnerability. The vulnerability allows an SSH authentication bypass and is already being exploited. At this point, assume compromise.
numbat - AI agent observability
​​​​​​​ 
Friday Squid Blogging: Squid on a Stick at the New York State Fair
Looks tasty . As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.
How to secure edge AI in customer-owned environments
As AI moves into customer-owned environments, organizations need new ways to verify the systems, software, and AI assets they trust before releasing sensitive data, credentials, and models. The post H
The hidden work of modernizing Malwarebytes
Why disciplined dependency modernization is one of the highest-leverage engineering investments a security product can make.
Using a VM to Contain an AI Agent
It won’t work : My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable AI agents, an
Early Bird Registration For Black Hat Europe 2026 In London
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Sep. 4, 2026 Black Hat Europe returns to the Excel in London with a four-day program, Dec. 7-10. The event w
X Money rollout linked to password-reset attacks
As X expands into payments, users are receiving password-reset emails they didn’t request. Here’s what may be happening and how to stay safe.