Reverse-Engineering Flock Cameras
Hackers captured a Flock camera and got a look (alternate link ) at the software: While much of the automatic license plate reader’s (ALPR) most sensitive storage remained encrypted and inaccess
Search Intelligence
Gemini’s breach of real companies exposes an AI guardrail problem
Gemini crossed the boundaries of a capture-the-flag test and accessed systems belonging to three real companies.
The Cyber Guild’s Uniting Women In Cyber Conference, Oct. 8, 2026
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Sep. 21, 2026 – Listen to the Podcast Episode In a recent Cybercrime Magazine Podcast episode, advisory board mem
SAML: A fractal of bad design
Born out of academia and raised in corporate IT departments, the Security Assertion Markup Language (SAML) authentication protocol continues to be a staple in these organizations. However, it’s
ShinyHunters hacks rival extortion gang and takes over its dark web site
Hackers hacked the hackers as a feud between two cybercrime groups escalated, leaving ShinyHunters with the upper hand over rival Clop.
A week in security (September 14 – September 20)
A list of topics we covered in the week of September 14 to September 20 of 2026
ISC Stormcast For Monday, September 21st, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Friday Squid Blogging: On Squid Egg Sacs
Short essay about squid egg sacs. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.
Are AIs Still Struggling with CAPTCHAs?
Anthropic’s recent security-incident document contains a bit about how CAPTCHAs are still frustrating Claude. In the transcript, the Claude model that is so powerful that Anthropic is gatekeepin
Auditing in the age of (good enough) AI
Security firms have published numerous blog posts describing how they pointed their agent harness at a codebase and found dozens of bugs (we’re one of them). However, these posts tend to focus on agen
HTTP QUERY Method: The Grey Zone Between GET And POST.
In June 2026 the IETF published RFC 10008[ 1 ], defining a new HTTP method: "QUERY". The HTTP protocol faced already by changes (HTTP/2, HTTP/2) but it's the first new standard HTTP verb
ISC Stormcast For Friday, September 18th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Flashpoint Named A Customer Favorite in The Forrester Wave™
In this blog we explore the recently published Forrester Wave™: External Threat Intelligence Service Providers, Q3 2026 report which named Flashpoint a Customer Favorite, along with naming the organiz
The Odyssey and trojans again: MovieReaper attacks users in multiple countries via compromised torrents
Kaspersky experts have discovered a new MovieReaper campaign. The multi-stage Trojan spreads through movie torrents, such as "The Odyssey," and uses the Solana blockchain to hide its C2 infrastructure
ISC Stormcast For Thursday, September 17th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Data Broker Radaris Loses Domains in Privacy Fight
The consumer data broker Radaris.com has long had a reputation for ignoring requests to remove personal information from its vast empire of people-search services online. That reputation caught up wit
Google Pixel owners urged to patch actively exploited modem flaw
Google’s September Pixel update fixes 110 vulnerabilities, including a modem flaw being used in limited, targeted attacks.
NightEagle targets Russian companies
Kaspersky GERT experts have uncovered a new campaign by the NightEagle APT, featuring the GhostContainer backdoor and tools hosted on GitHub. The group is also exploiting vulnerabilities in Active Dir
ISC Stormcast For Wednesday, September 16th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
AWS STS simplifies session token size limits and adds session token size monitoring
AWS Security Token Service (AWS STS) has simplified session token size limits, giving you more room for your session policies and session tags. STS has replaced the packed policy size and the overall