Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Japan Reports Sharp Rise in Web Data Leaks

  Japan is experiencing a sharp rise in personal-data leaks from web systems, according to an October 2026 alert from the JPCERT Coordinatio...

All the recent news you need to know
Rubrik
ai agents AI Code Security Anthropic code Guardian Cyber Security Rubrik

Rubrik Expands Project Hourglass to Bring AI-Powered Code Security to Enterprise

 



When Rubrik launched Project Hourglass at its FORWARD 2026 conference in Las Vegas back in June, the initiative set out to answer a question CISOs were already losing sleep over: what happens when an AI agent writing and deploying your code does something catastrophic and nobody can stop it in time?

On Thursday, at its GSI Summit in Goa, India, the cybersecurity firm announced the next step. Rubrik has expanded Project Hourglass to include a new tool called Rubrik Code Guardian, and has welcomed AHEAD, Trace3, and World Wide Technology (WWT) into the alliance, joining the six systems integrators that signed on at launch. The new capability is powered by Anthropic's Claude Mythos 5 and extends the alliance's reach from securing AI agents during execution to proactively identifying vulnerabilities in software code before deployment.


The Problem Driving All of This

Rubrik Zero Labs surveyed more than 1,600 IT and security leaders for its State of the Agent report and found that 86 percent expect AI agents to outpace their security guardrails within a year, while only 23 percent report full visibility into agents operating in their environments. More than 80 percent said agents require more manual oversight than the efficiency they save.

A separate Rubrik and Economist Enterprise study found 88 percent of enterprises experienced an AI agent security breach in 2026. The picture those numbers paint is one of organizations racing to deploy autonomous systems while the controls meant to govern them are still catching up.


What Code Guardian Does

The original Project Hourglass, which launched with Cognizant, Deloitte, LTM, HCLTech, NTT DATA, and Wipro as founding partners, focused on protecting AI agents at runtime through Rubrik Agent Cloud. That platform operates across three layers: Runtime Agent Security for behavioral guardrails and blast-radius control, Agent Rewind for fast repository recovery, and AI Context Guard for prompt integrity and control-plane protection.

Code Guardian shifts the security lens earlier in the development cycle. Rather than running against live production environments, the system tests a cloned, air-gapped copy of customer repositories. Claude Mythos 5 operates inside Rubrik's security harness to evaluate code against sophisticated, multi-step threat scenarios.

Three core capabilities define the product: isolated red-team analysis inside the air-gapped environment; attack chain discovery that reasons across files, services, identity roles, and cloud perimeters to find chained vulnerabilities that conventional static tools miss; and business impact prioritization that filters findings by actual exploitability and business criticality to reduce alert fatigue.

Alok Agrawal, Chief Solutions Officer at Rubrik, put the challenge plainly. "Engineering teams are turning to AI models to accelerate software delivery, but speed cannot compromise security or architectural integrity. By incorporating Rubrik Code Guardian into Project Hourglass, we are ensuring engineering teams are able to conduct red-team analysis, prioritize business impact and reduce risk."


The New Partners

Each of the three incoming partners brings a different angle to the coalition.

AHEAD, which builds enterprise technology architectures for large clients, framed the problem as one of inherited risk. Steven Sorensen, Specialty Solutions Engineer for Cyber Resiliency at AHEAD, said the goal is to get code attacked, tested, and validated in a safe environment before it ships, so teams can move faster knowing Rubrik's recovery capabilities sit underneath them as a safety net.

WWT's Chris Konrad, Vice President of Global Cyber, pointed to the company's Advanced Technology Center, where isolated threat testing has long been part of how it validates security solutions before recommending them. He said Code Guardian integrates naturally with that process.

Trace3 brought a perspective the others did not: its own teams have been running Rubrik Agent Cloud internally to protect their own agentic AI work before recommending it to clients. Sandy Salty, Chief Marketing Officer at Trace3, said that experience as both a user and a partner gives the firm a clearer view of what actually makes agentic environments more resilient at scale.


Where Things Stand

Rubrik Code Guardian is currently in private preview and accepting select design partners. It is not yet generally available and may change or be discontinued. Rubrik Agent Cloud, the original platform at the center of Project Hourglass, remains available to enterprise clients.

Dev Rishi, GM of AI at Rubrik, has previously described the core problem in stark terms: with AI agents, there is the potential for ten times the damage in one-tenth the time. That framing captures why the urgency behind Project Hourglass is unlikely to ease. As the volume of AI-generated code increases across enterprise environments, the window between a vulnerability being introduced and it being found by someone with bad intentions keeps getting smaller.



Read more »
Hacker attack
Critical security flaw Cryptominers CVE CVE exploits CVEs Cyber Attacks Cyber Software Hacker attack

Hackers Exploit Two Unpatched AhsayCBS Flaws to Deploy Webshells and Cryptominers

 

Two security flaws in AhsayCBS backup management software are currently being actively exploited by attackers to initiate remote access to the targeted systems, establish webshells, and cryptocurrency miners. Huntress reported that the flaws are being used in attacks that chain the two issues together to bypass authentication and run commands on vulnerable systems. 

At least five companies have been reported targeted as of October 8, 2026. The vulnerabilities tracked as CVE-2026-105133 and CVE-2026-105134 are generic for the AhsayCBS product, which serves as a centralized management system for managed service providers and system integrators that need to configure and control backup policies and schedules, storage, and users. Both flaws are caused by improper function arguments, which enable an attacker to bypass authentication and execute operating system commands. 

The National Institute of Standards and Technology (NIST) published information about the disclosed security issues on October 4, 2026. Initially, all AhsayCBS versions up to 10.3.2. were considered to be affected. However, Huntress revealed that the company’s latest version at the time, 10.3.4., was also vulnerable. One of the vulnerabilities, CVE-2026-105134, is a remote code execution issue that allows an unauthenticated attacker to run code with System-level privileges. It utilizes an API in AhsayCBS’s Replication Receiver component to establish a reverse connection to an attacker-controlled server. 

An attacker can leverage the Replication Receiver bug by creating a fake replication receiver and delivering a Java Server Page webshell in the application directory served by AhsayCBS. After establishing initial access to the system, the threat actor performs inventory collection and uses Microsoft Edge-labeled XMRig cryptocurrency miners. Huntress discovered that the attackers used an AI-powered PowerShell script that terminates itself if the Task Manager is opened for more than 50 seconds. 

In addition, the script monitors whether the Task Manager has been closed and reopened. The attackers also create a new Windows service that masquerades as Microsoft Edge Updater. It employs an alternate data stream and runs as a System process when using the Non-Sucking Service Manager tool. The service carries the msedge.exe file with custom modifications applied.  The modifications to the Non-Sucking Service Manager allow it to maintain a durable process that restarts applications that were terminated due to an error or when the system restarts. 

The attackers also installed a legitimate but deprecated kernel-mode driver called WinRing0x64.sys, which provides userspace programs with kernel-mode privileges. This component enables the cryptocurrency miner process to maintain persistence even after system reboots. AhsayCBS software, utilized in the attacks, does not currently have a patch available. 

As such, organizations are recommended to restrict access to the management portal by only allowing specific IP addresses or networks, such as those provided by a virtual private network. 

In addition to that, administrators should monitor their systems for signs of compromise, such as webshells, unknown services, scripts, and cryptomining activities. Attackers are currently leveraging the AhsayCBS flaws to target businesses. 

The widespread nature of the issues, as well as the utilization of the latest version of the software at the time of publication, should compel organizations using it to consider limiting access and conducting comprehensive reviews.
Read more »
Severe Flaw
Cyber Security Microsoft Microsoft Exchange Organization Security Severe Flaw

Microsoft Exchange Vulnerability Could Leak Confidential Organizational Info


Microsoft has issued an emergency security update to fix a vulnerability in Exchange Server that could expose confidential organizational communications. The flaw, tracked as CVE-2026-96940, has received a CVSS severity score of 8.8 out of 10.

Reported by TechRadar, the vulnerability could allow attackers who already have valid login credentials to increase their privileges within Exchange and access mailboxes belonging to other users. Microsoft released the fix on October 2, ahead of its originally intended schedule.

About the flaw

The security issue stems from a weakness in authorization controls, which determine what information a user can access. By exploiting the flaw over a network, an authenticated attacker could gain permissions beyond those assigned to their account.

Threat actors could first obtain credentials through phishing attacks or by purchasing stolen login details from underground online markets. Once inside an organization’s Exchange environment, they could exploit the vulnerability to read emails and attachments belonging to other employees.

However, the flaw does not provide unrestricted access across different customer environments, known as tenants. It also does not directly grant administrator-level or SYSTEM-level privileges on the underlying Windows server.

What happens in case of successful exploitation?

Successful exploitation could expose sensitive business information, including financial records, invoices, contracts, customer correspondence, internal discussions, and confidential documents.

Attackers could use the stolen information to support further cyberattacks. For example, they might impersonate company employees, send convincing fraudulent emails, or conduct business email compromise (BEC) scams to trick organizations into transferring money or disclosing additional information.

The vulnerability is particularly problematic because an ordinary employee’s compromised account could potentially provide an entry point for accessing information held in other employees’ mailboxes.

Affected products

The vulnerability affects the following on-premises products:

  • Microsoft Exchange Server Subscription Edition RTM
  • Microsoft Exchange Server 2016 Cumulative Update 23
  • Microsoft Exchange Server 2019 Cumulative Updates 14 and 15

Microsoft has confirmed that Exchange Online customers are protected by a server-side fix. Organizations running affected on-premises installations should install the appropriate security updates promptly.

Exchange Server 2016 and 2019 have reached the end of their standard support lifecycle. Eligible organizations must be enrolled in Microsoft’s Extended Security Update programme to receive the relevant updates for these versions. Microsoft recommends that organizations without the required coverage migrate to Exchange Server Subscription Edition.

Microsoft’s response 

Microsoft reported no evidence that the vulnerability was being actively exploited at the time of the report. However, the company assessed that exploitation was more likely, making timely patching important.

Administrators should run Microsoft’s Exchange Server Health Checker after installing the update to verify successful deployment and identify any additional actions required.

Read more »
Ukraine Cyber Attacks
cyber espionage malware MATCHBOIL Malware Russian Cyber Espionage Russian Hackers Spear-Phishing Attacks UAC-0099 Ukraine Cyber Attacks

Russian-Aligned Spies Upgrade MATCHBOIL Malware Targeting Ukraine


The Russian-aligned cyber espionage group UAC-0099 has continued developing the MATCHBOIL malware for use in attacks against Ukrainian companies involved in transportation, manufacturing, and energy. Several changes have been made to the malware since 2024, according to research conducted by cybersecurity firm ESET, with newer versions adding techniques designed to make detection and analysis of the malware more difficult.

Researchers at ESET analyzed MATCHBOIL samples collected between April 2024 and April 2026 in a report published on October 8, 2026. Based upon the findings, the downloader appears to be becoming more sophisticated with each new version. While the Ukrainian Computer Emergency Response Team (CERT-UA) first documented the malware in August 2025, earlier samples indicate that the malware had been developing for at least a year prior. 

Matchboy is a C#-based downloader designed for retrieving additional malicious payloads from a command-and-control (C2) server, installing them on compromised systems, and maintaining their presence ESET's telemetry identified victims exclusively in Ukraine, including transportation companies between July and August 2025, a manufacturing organization in December 2025 and a company in the energy sector in June 2026. 

In order to spread the malware, spear-phishing emails containing malicious links are used. Once a recipient clicks the link, an archive containing VBScript is downloaded. MATCHBOIL is then downloaded and executed on the victim's computer, thereby giving the attackers the opportunity to introduce further malicious components. 

Although the level of confidence in UAC-0099's alignment with Russian interests was described as medium, ESET concluded that it was likely aligned with Russian interests. This group has previously targeted Ukrainian government agencies, financial institutions, and media institutions, proving MATCHBOIL to be another component of its broader cyber espionage activities. 

MATCHBOIL has modified its code so that it is harder to inspect, thereby making its activity less visible. It was previously obfuscated with basic Unicode, but newer samples use Eziriz .NET Reactor, which complicates reverse engineering. The malware has also been updated to detect virtual or analysis environments and to stop it from running under these conditions. 

Additionally, the malware's execution pattern has changed. A version seen from late 2025 started checking in roughly once every two minutes for additional or updated components, as opposed to earlier versions that contacted the command-and-control server once to retrieve a payload. It has also evolved over time to keep the malware active on compromised systems, switching between Windows Registry Run keys and scheduled tasks. 

Researchers have also noted attempts to make the malware appear legitimate in the past. The late-2025 variant was able to display a daily planner interface when manually launched, but interface errors rendered it unconvincing. 

However, the sample identified in February 2026 was more conspicuous, showing a text-search utility. Other malicious tools have also been associated with MATCHBOIL, including MATCHWOK, a backdoor that enables the execution of remote commands, and DRAGSTARE, a cookie and browser credential stealer.

This combination allows the group to expand beyond initial access and engage in further activities on compromised systems. ESET's findings indicate that UAC-0099 continues to refine MATCHBOIL for future operations. There is no accurate figure of the number of organizations affected by the campaign, as neither ESET nor Ukraine's CERT-UA have provided a confirmation of the number of victims.

Read more »
PoeLLM Malware
AI Infrastructure Security AI Server Security Canto Incognito cryptocurrency mining Cryptojacking Cybersecurity Threats GitHub C2 LiteLLM Vulnerability malware PoeLLM Malware

PoeLLM Campaign Compromises 3,400+ Servers for Crypto Mining


Cryptocurrency mining campaigns have compromised over 3,400 servers since April 2026, with attackers primarily targeting exposed artificial intelligence and large language model infrastructures. The campaign is referred to as Canto Incognito and exploits vulnerable internet-facing services through PoeLLM malware, which becomes part of a growing mining botnet by exploiting vulnerable internet-facing services. 

Infections have largely been reported in the U.S. and Western Europe with nearly 2,200 affected servers at its peak at mid-June. Lumen Black Lotus Labs has reported that the malware has affected enterprise deployments such as LiteLLM, Ollama, Gotenberg, Gitea, and possibly Ivanti Sentry. 

The choice of artificial intelligence-based infrastructure has a significant impact on cryptocurrency mining due to the substantial computing resources that such systems are capable of providing. Some of the compromised servers may also be used to scan for additional vulnerable systems, which can help the attacker expand the botnet once they have been compromised. 

PoeLLM stands out due to its unique command-and-control mechanism (C2) Instead of placing the server address directly in the malware, the attacker concealed it in a poem hosted on GitHub. On April 13, 2026, the repository was created under the username “ejejejdfbbebebe,” with the first relevant commit being recorded. Throughout the campaign's change to its C2 infrastructure, the poem, titled "On the Nature of Connection," has been modified several times. 

By using a dictionary embedded in its code, the malware extracts selected words from fixed sections of the poem and maps them to numerical values. Those values are combined to determine the IPv4 address of the active C2 server. If the attacker changes the selected words, infected systems will be able to determine the new address without requiring a new sample of malware. 

A campaign's effectiveness is not only determined by the initial compromise. Once PoeLLM gains access to a compromised server, it can use the compromised system to locate additional targets. Black Lotus Labs observed a significant amount of scanning activity involving ports 3000 and 4000, which are commonly used to access Gotenberg and LiteLLM deployments. In order for vulnerable systems to retrieve malware from the active C2 infrastructure, crafted HTTP requests were sent to them. LiteLLM was a significant target in this activity. 

The analyzed malware sample referenced CVE-2026-42271, a command injection vulnerability associated with /mcp-rest/test/connection. In addition to providing attackers with access to exposed artificial intelligence infrastructure, PoeLLM also features cryptocurrency mining capabilities. This allowed attackers to launch further attacks on compromised systems. 

Infection involves the deployment of XMRig and Iron miners as well as the connection of compromised systems to the Kryptex mining service. The attackers can benefit greatly from the use of AI infrastructure because many such environments are run on advanced hardware with GPUs capable of providing significant computing power for mining. 

The malware does not limit itself to mining. According to researchers, infected servers are able to perform additional malicious activities by using remote shell functionality, HTTP/S scanning, and exploit deployment. Recent activity against SSH ports and other login interfaces suggests that the operator may also be testing distributed brute-force attacks, though this capability is currently at an early stage. As a result of assessing the campaign with moderate confidence, Black Lotus Labs has determined that the attacker is an Italian-speaking individual. 

A combination of Italian-language comments found on malicious software and associated GitHub pages, as well as network traffic analysis, contributed to the assessment. There has been no identification of a specific individual or established criminal group. 

In this campaign, it illustrates the dual purpose of exposed artificial intelligence infrastructure for attackers: its computing resources can be monetized, while compromised machines are also able to assist in locating and compromising the next set of vulnerable systems. 

Recent attack by hackers motivated by financial gain has demonstrated how exposed AI and developer infrastructure can become valuable targets for attackers with financial motivations. As AI deployments expand across enterprises, strong patching, restricted internet exposure and proactive monitoring remain essential.
Read more »
utility companies
Alabama Cyberattack Data Breach energy systems Georgia utility companies

Southern Company Discloses Data Breach Affecting 400,000 Georgia Power and Alabama Power Customers

 



Southern Company, the Atlanta-based energy holding giant, has confirmed that an unauthorized third party broke into its online customer portal and accessed account information belonging to roughly 400,000 customers across its electric subsidiaries, Georgia Power, Alabama Power, and Mississippi Power.

The company publicly disclosed the breach on October 5, 2026, stating that the intrusion, which occurred in September, was detected through its own monitoring systems. Upon discovery, Southern Company said it moved quickly to shut down the unauthorized access and notified law enforcement.

"Southern Company recently detected suspicious activity involving our online customer portal," the company said in a statement. "An unauthorized third party accessed certain, limited information about the accounts of approximately 400K customers. Upon detection, we took immediate steps to stop the activity and have engaged law enforcement."

Of the roughly 400,000 accounts compromised, approximately 300,000 belong to Georgia Power customers. Alabama Power accounts for the remaining 100,000, which represents about 6% of its 1.6 million-customer base. Mississippi Power was named in the company's public notice as affected, but Southern Company has not released a customer count for that subsidiary.

According to the company's published incident notice, the data the attacker accessed includes customers' names, mailing addresses, phone numbers, email addresses, and the last four digits of their Social Security numbers, along with other unspecified basic account details. The company was clear about what was not taken: bank account numbers, payment card numbers, and driver's license numbers were not part of what the attacker pulled from the portal.

The online portal in question is the same platform customers use to pay bills and manage their accounts.

Despite the company's confirmation that it caught and stopped the intrusion, Southern Company has not said when exactly in September the breach occurred, nor has it explained how the attacker got past the portal's defenses in the first place. That absence of technical detail leaves open questions about the attack method, whether it involved stolen credentials, a software vulnerability, or some other approach.

Customers whose information was involved are being notified directly by both mail and email. Southern Company is also offering each affected customer one year of free credit monitoring through Equifax. Those with additional questions were directed to a dedicated assistance line at 1-800-900-6021, available Monday through Friday.

Southern Company, incorporated in 1945 and headquartered in Atlanta, is one of the largest energy holding companies in the United States. It supplies electricity through its subsidiaries to customers across three states and operates natural gas distribution businesses in four more. Its total customer base numbers over 9 million.

The incident sits alongside a string of recent cyberattacks targeting utility companies in North America and beyond. Just weeks earlier, in September 2026, Houston-based CenterPoint Energy disclosed that an unauthorized third party had obtained personal information on a portion of its customers through one of the company's external-facing systems. That disclosure came after a threat actor claimed on a cybercrime forum to have extracted 7.49 million customer records from the utility and ultimately leaked the data after the company failed to respond. In March 2025, Nova Scotia Power, Canada's largest electric utility in that province, suffered a cyberattack that disrupted its customer support line and web portal.

Research published by cybersecurity firm Trustwave in 2025 found that roughly 67% of credential access techniques used against energy and utilities companies involved brute force methods, which are largely automated attacks that cycle through large lists of usernames and passwords. That tactic, known as credential stuffing when it draws on passwords stolen from previous breaches on other platforms, has been used against utility customer portals before. In 2021, UK energy supplier Npower had to shut down its mobile app entirely after attackers used stolen credentials from other websites to access thousands of customer accounts.

The energy sector's digital attack surface has expanded considerably as utilities push more customer services online. Customers log into portals to check bills, set up autopay, and track usage, all of which requires storing personal data behind web-based logins. Security researchers have long pointed out that these portals often receive less security investment than back-end operational systems, even though they handle data that is directly useful for phishing, identity fraud, and social engineering.

Southern Company said it has found no evidence of ongoing unauthorized access following the breach, and noted that it continues to monitor its systems around the clock. The company's public notice also cautioned customers to be alert for fraudulent contact from individuals claiming to be Georgia Power or Alabama Power representatives, reminding them that neither utility will ever threaten immediate service disconnection or demand payment over the phone.

Anyone who believes they may have been affected and has not yet received notification from the company can contact Georgia Power customer service directly through the number listed on their bill.



Read more »
Subscribe to: Posts (Atom)

Featured