2026-09-12

Cylake Gets $245M to Build Cloud-Free Cybersecurity Platform

Cylake, a startup founded by Palo Alto Networks founder Nir Zuk, raised $245 million to develop an on-premises cybersecurity platform that integrates hardware, storage, security software, and local artificial intelligence (AI). The platform targets regulated organizations that cannot transmit sensitive security data to cloud providers.

Why it matters: Regulated enterprises and those under data residency constraints need to evaluate whether this on-premises alternative addresses their ability to run modern security operations without external cloud dependencies.

Anthropic Says AI Is Lowering the Bar for Sophisticated Attacks

Anthropic's Threat Intelligence team published findings showing that multi-agent artificial intelligence (AI) tools enable less-skilled attackers to execute complex, wide-ranging operations with minimal resources. The report emphasizes that the risk lies not in AI's speed of exploit development, but in how accessible sophisticated attack infrastructure has become to broader threat actor populations.

Why it matters: Security teams and incident responders need to prepare defenses against complex, multi-vector attacks from less-technical threat actors who can now leverage AI tools to scale their capabilities.

Ukrainian Conti Ransomware Developer Gets 4 Years in US Prison

Ukrainian national Oleksii Lytvynenko received a four-year prison sentence from a U.S. court after admitting to developing malware and stealing data for Conti ransomware. Conti has been attributed to over 1,000 victims and approximately $150 million in ransom payments.

Why it matters: Organizations targeted by Conti should monitor for ongoing activity from affiliated developers and prepare for potential follow-up attacks, as the network likely remains operational despite individual arrests.

ID Verification Firm IDScan.net Confirms Data Breach

IDScan.net, a Louisiana-based identity verification firm, confirmed a data breach linked to the alleged darkweb sale of over 153 million U.S. and Canadian driver's licenses. The company's breach notice did not disclose the number of affected individuals or the attack vector used by threat actors.

Why it matters: Organizations relying on IDScan.net for identity verification should determine whether their data was included and assess customer notification obligations; individuals with U.S. or Canadian driver's licenses may face identity theft risk if their records were compromised.

Webinar | Who Controls the AI Acting on Your Behalf? The Identity Problem Behind Autonomous AI

This is a webinar announcement addressing identity and authorization challenges in autonomous artificial intelligence (AI) systems. The content examines how organizations can maintain control and accountability when AI agents act independently within their infrastructure.

Why it matters: Security teams and infrastructure owners need clarity on identity management and access control for autonomous AI to prevent unauthorized actions and audit trail gaps.

CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV

CISA has added five vulnerabilities affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS to its Known Exploited Vulnerabilities (KEV) catalog on September 12, 2026, based on confirmed active exploitation. CVE-2026-42016, an authorization flaw in one of these products, carries a CVSS score of 8.1.

Why it matters: Security teams using Artifactory, ScreenConnect, or RouterOS should prioritize patching these flaws immediately, as they are already being exploited in attacks and listed on CISA's KEV catalog.

Spies, surveillance and rogue AI: Best infosec long reads 9/12/26

A New Yorker article examines Flock Safety's nationwide license plate recognition (ALPR) surveillance network, which trades anonymity for promised crime reduction. The piece documents growing public and political opposition across conservative and liberal states, including documented misuse by police for stalking, ICE enforcement, and reproductive surveillance. Founder Garrett Langley deflects responsibility for how the technology is deployed while framing privacy concerns as obstacles to safety.

Why it matters: Security practitioners and organizations evaluating surveillance infrastructure must understand the operational and reputational risks of ALPR systems: documented abuse patterns, bipartisan pushback leading to frozen funding and revoked permits in major states, and the liability exposure when vendors disclaim responsibility for misuse.

Revolut confirms customer data breach through fake government requests

Revolut experienced a customer data breach resulting from fraudulent government requests. The company notified impacted customers and reported the incident to government agencies, law enforcement, and financial regulators.

Why it matters: Revolut customers face identity and fraud risk from exposed data; fintech users should verify account security and monitor for unauthorized activity.

BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days

BlueMoon exploit kit chains recent Chrome and Windows zero-day vulnerabilities to enable opportunistic attacks. Multiple espionage-motivated threat actors have rapidly deployed the kit in the wild.

Why it matters: Organizations running unpatched Chrome and Windows systems face immediate compromise risk from active exploitation by nation-state and criminal threat actors using this chained attack vector.

From Hacks to Bioweapons, Claude Misuse Is Now Everywhere

Claude, an artificial intelligence (AI) model, is being misused across multiple domains ranging from cyberattacks to generating harmful biological content. The report also covers law enforcement disruption of a major dark web marketplace, prosecution of a Conti ransomware group member, and Meta's struggles to prevent AI-generated child sexual abuse material.

Why it matters: Security teams must monitor AI model abuse vectors in their threat environment, law enforcement actions affect underground market operations and criminal enterprise viability, and practitioners should evaluate content moderation controls given the proliferation of synthetic abuse material.

When the Whole Company Adopts AI: What It Does to Your SOC

Enterprise security operations centers are observing a surge in alerts generated by artificial intelligence (AI) tools and agents deployed across organizations. These alerts stem from routine AI usage by developers and staff rather than attacks targeting AI systems, creating new noise in security monitoring workflows.

Why it matters: Security operations center teams need to adapt alert tuning and baseline models to distinguish legitimate AI tool activity from genuine threats, or risk alert fatigue and missed signals.

OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers

Researchers identified that a coordinated attack on RubyGems in May 2026 involved OpenAI agents operating as a swarm to target the package manager. The incident resulted in remote code execution (RCE) on RubyDoc servers and represented a significant supply chain security incident.

Why it matters: Ruby developers and organizations using RubyGems packages face supply chain compromise risk; practitioners should review their dependency management and audit package integrity for any affected versions from that period.

Grouped: the same names (SPENCER KITTS, SYDNEY VON ARX, THOMAS LARSEN).

NCSC-2026-0367 [1.00] [H/H] Kwetsbaarheid verholpen in GitLab Community en Enterprise Editions

GitLab patched a path traversal vulnerability in its Community and Enterprise Editions that allows unauthenticated users to read arbitrary files through the repository commits application programming interface (API). The vulnerability stems from improper path confinement and missing authentication controls on the API endpoint. The flaw is tracked as CVE-2026-85706 with a CVSS score of 10.0, has been added to CISA's Known Exploited Vulnerabilities catalog, and public exploit code is available.

Why it matters: Organizations running internet-facing, self-hosted GitLab instances face immediate risk of sensitive file exposure without authentication; patch to GitLab 19.1.8, 19.2.6, 19.3.2 or later immediately, review API logs for suspicious requests with file.path parameters, and rotate any exposed credentials.

Users in Houthi-Held Yemen Tried to Develop Advanced Weapons With AI, Anthropic Says

Anthropic disclosed that users in Houthi-controlled Yemen attempted to leverage its artificial intelligence (AI) systems to develop advanced weapons, though they did not achieve an operational device. The group conducted a failed test of a guided rocket using artificial intelligence (AI) assistance.

Why it matters: Security teams must monitor for nation-state and non-state actors exploiting AI services for weapons development, as Anthropic's disclosure reveals gaps in access controls and content moderation that could enable proliferation risks.