Material Security followed suspected North Korean fake IT workers through the hiring pipelines of organizations it monitors and counted 27 personas that…
Category: Help Net Security
How attackers turned a Teams meeting booking into a device code phishing trap
Attackers used a fake Microsoft Teams meeting scheduler to trick an employee at a construction company into approving a device code sign-in. They got a…
Your pinned MCP server may not be as pinned as you think
An MCP server configured to run one fixed release on an administrator’s workstation ran with 15 different sets of dependencies over five weeks, with its…
Digital sovereignty leaves enterprises chasing their own audit trails
94% of surveyed enterprises experienced at least one digital sovereignty challenge in the past three years, according to IBM’s Digital Sovereignty Index.…
Google smart glasses privacy features cover wearers and the people around them
Google has built its Gemini-powered intelligent eyewear to stop taking photos and video when someone covers or tampers with the outward-facing recording…
PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14
The PostgreSQL Global Development Group released PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, fixing 52 security vulnerabilities and…
Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters
EfficientIP Research Labs traced a ClickFix campaign that used fake Zillow apartment-review pages to install NetSupport RAT on visitors’ Windows…
Self-hosted Claude Managed Agents keeps agent credentials in your environment
Anthropic has released a self-hosted version of Claude Managed Agents. Companies can run the agent harness, sandboxes, credentials, and session history in…
Picus puts AI agents on the offensive with autonomous pentesting
Picus Security has announced Picus Autonomous Penetration Testing, an agentic pentesting capability that puts AI agents on the offensive: they think like…
Attackers breached 10 organizations with an open-source AI pentest framework
Chinese-speaking attackers used Cairn, an open-source AI penetration testing framework, to run 25 operations against at least 19 organizations in August…
Operation Endgame malware takedown turns up over 6 million stolen logins
Police in nine countries, working with Europol, took down servers behind the Gootloader, CastleRAT and StealC malware operations this week and recovered…
Microsoft Entra adds a seven-day safeguard against irreversible identity deletion
Microsoft Entra’s Hard Deletion Protection, now in preview, gives administrators a seven-day window to recover selected identities before they can be…
Stolen Claude API keys can turn Claude Code into a remote-controlled implant
Darktrace researchers turned Claude Code into a remote-controlled implant in a lab test, steering the coding agent through the memory stores feature of…
Photos: IRISSCON 2026 cybercrime conference
IRISSCON 2026, the annual cybercrime conference organized by IRISSCERT, took place at the Aviva Stadium in Dublin on November 11. The all-day event gives…
AWS Emulator: Open-source tool for testing AWS apps locally, built by autonomous AI agents
Amazon Web Services has released AWS Emulator, a free tool that simulates AWS services on a developer’s laptop, a development server or in a continuous…
Check your GitHub repos: A secret stealer hit tens of thousands of them
A threat actor using stolen GitHub credentials has pushed a credential-stealing payload into tens of thousands of repositories since November 10. In more…
.NET 11 security changes target the software supply chain
Microsoft has released .NET 11, a Standard Term Support (STS) release that will receive two years of support. .NET 10 is still the Long Term Support (LTS)…
GitHub Agentic Autofix and the question of who owns a bad AI patch
In this Help Net Security interview, Marcelo Oliveira, VP of Product Management at GitHub, talks about who is accountable when an AI-generated patch fixes…
Dagster: Open-source cloud-native data pipeline orchestrator
Dagster is an open source orchestrator for data pipelines. It decides what runs, in what order, and when. It also tracks how the tables, datasets, machine…
Who collects the keys when an AI agent retires?
Think about the last time a good engineer left your company. Someone collected the laptop and the badge. IT revoked their logins before the end of the…