1password

Three in four AI-generated vulnerability patches leave something broken Ask a frontier model to patch a real vulnerability and it will hand you something that looks like a fix. It reads like the patch a maintainer would write. When there is a test, it often passes. Roughly one time in four, it is a fix. Researchers at 1Password graded 6,080 patches for six freshly disclosed CVEs, and the failures are rarely the obvious kind: an exploit path gated behind a check with the vulnerable code still sitting there behind it, a bug fixed in one function and left untouched in its character-for-character twin, a memory error closed and a new one opened in the same helper. What follows is where those failures cluster, why wrong fix advice does more damage than no advice at all, and what it costs to tell a working patch from a convincing one. Freenginx, a web server, lets site operators write small Perl programs that run when a request comes in. A flaw in that feature, a memory bug of the kind called a use-after-free, lets a visitor crash the server. Trail of Bits sent the maintainers a fix through Patch the Planet, the initiative it runs with OpenAI that hands maintainers finished code instead of another bug report. The maintainers turned it down and wrote their own. The rejected version repairs two of the three spots where the flaw lives; the maintainers’ version repairs all three. Both of them also add a new way to crash the server, and reaching it takes nothing more than an ordinary client that starts a request and then goes quiet. Off-by-1 Labs, the new security research group inside 1Password, spotted that second crash and reported it to the freenginx maintainers on June 29; a fix went out on July 2. The same group then set an automated patcher on the original flaw and had ChatGPT 5.5 write 270 attempts at fixing it. Its reviewer judged 114 of those to have closed the original hole, and found a new problem in every one of the 114. Across 270 attempts, nothing came out clean. That campaign was a case study attached to the larger one, which ran ChatGPT 5.5 and Claude Opus 4.8 against CVEs disclosed this spring and discarded any run where the model went hunting for the real upstream fix. About half of the surviving patches left at least one exploitable path open. Closer to one in twenty introduced a new vulnerability, sometimes on top of failing to close the original. Most of the remaining misses closed the original bug but altered behavior along the way, rejecting inputs the software used to accept or rewriting a parser outright. If you take one thing away from the study, make it the shortage of visible failures. Nothing in a patch that leaves the bug open announces that anything is wrong. The models fix the example, not the bug Hand a model a reproducer that demonstrates one malicious input and it patches that input’s code path. A human reads the same reproducer as one instance of a general problem. The models did not. More than a third of the patches graded as successful were additionally flagged as fragile, meaning they blocked the demonstrated exploit with a narrow check while leaving the vulnerable code sitting there, reachable again the moment someone finds another way in. The Chromium bug, CVE-2026-8512, shows the failure at close range. Chrome watches folders on macOS for changes, and the operating system calls back into Chrome when something moves. The upstream fix routes that callback through a small go-between object, and it requires two separate parts of the code to hold a claim on that object so it cannot be discarded while a callback is still running. Both models routinely arranged the first claim and skipped the second. The flaw did not go away. It moved. The setup that loops until the test stops failing was the worst offender here. Its test never exercises the case the second claim protects against, so an incomplete patch passes and the agent stops there. Wrong advice is worse than none Fix guidance turned out to matter more than model choice or harness design. Prompts carrying a correct fix direction closed the bug about two thirds of the time. Prompts carrying a plausible but wrong direction, of the kind an AI review bot or a confident-but-wrong pentest triage might supply, collapsed to about one in six. These count any patch that shut the original hole, including the ones that broke behavior or opened something new, a looser bar than the one in four above. Bad direction costs far more than good direction buys. If you cannot vouch for the fix you are suggesting to a patching agent, pass the bug and stay quiet. In the runs given confidently wrong direction, the agents’ own tool calls sometimes returned information contradicting the prompt, and the models went with the prompt anyway. Richer correct context did help, and an iterative harness beat a single offline attempt. Neither moved the needle anywhere near as far as guidance correctness did. The same model got wildly different results on different code Claude cleanly fixed the Exim remote code execution bug about three quarters of the time. On the Gemini CLI trust-bypass advisory it managed under one percent, same model and same configuration. The authors did not chase down why, and they say that they cannot: with one CVE per codebase, the bug and the codebase cannot be separated as causes. What that leaves is a warning against reading any industry average as a forecast for your own repository. The tooling behind the study is public for exactly this reason, so an organization can run it against bugs it has already fixed and get a local number instead of someone else’s. Models rebuilt a bug the kernel had already shipped Copy Fail, the Linux kernel privilege escalation disclosed in April, produced the highest new-vulnerability rate of any target for Claude and close to the highest for ChatGPT. The upstream fix for it reverted a memory optimization and, in doing so, dropped an offset guard and introduced an off-by-one heap write that maintainers had to correct in a later commit. Asked to patch the same bug, roughly a third of the patches from each model regenerated that flawed revert, off-by-one included. Sitting in the same stretch of code the models were rewriting was a second flaw, one nobody had asked them to look at. Kernel maintainers closed it separately, in a commit of its own. Every patch in both campaigns walked past it, including the ones that cleanly fixed Copy Fail and the several hundred that edited that exact file. The only patches that closed it came from runs the researchers had already thrown out for copying the official fix. The models patch the bug in the ticket, and nothing else, even when the something else is in front of them. Grading 6,080 patches by hand was not possible, so the study leans on model validators, cross-checked against each other and spot-checked by humans. On a sample, the validators and the human reviewers agreed on the exact grade about two thirds of the time, and the two models disagreed with each other often enough that the authors average their verdicts rather than trusting either. The Copy Fail off-by-one is the clearest thing that slipped past: the automated reviewers caught it in a couple dozen patches out of the roughly 250 that contained it. The study’s new-vulnerability rate should be read as a floor. What this costs Each patch attempt and validation cycle ran between two and three dollars, cheap against an engineer’s afternoon. 1Password researchers wrote that “LLM-produced patches still require review from a skilled engineer with domain expertise.” Their manual review makes the point about why that review is expensive: understanding a patch well enough to certify its security implications takes at least as much work as writing a known-good patch would have. The six CVEs here were chosen for high impact and complex, multi-file fixes, which makes them harder than a random vulnerability, and the authors are direct that their numbers do not describe the average bug. The findings are also a snapshot of two model versions at one moment. A patch that looks right and passes the reproducer remains the expensive kind of wrong, because catching it costs roughly what writing the fix yourself would have cost.

1Password targets standing privileges with new access management capabilities 1Password has launched 1Password Privileged Access, extending the 1Password Unified Access platform with privileged access management (PAM). It enables just-in-time, least-privilege access to critical infrastructure and is accompanied by the public preview of 1Password Credential Broker for GitHub Actions and new Enterprise Password Manager capabilities for developer and AI security. “Most organizations have more standing access in their environments than they can see or justify,” said David Faugno, CEO of 1Password. “That invisible access creates exposure, and too often, companies discover it only after an attacker does. As AI agents act on behalf of employees, access must be granted for a specific task, limited to what the work requires, and removed when the work is done.” Eliminating standing access across critical infrastructure Standing access rarely appears all at once. It accumulates across systems and infrastructure through daily work. The task ends, but access for employees, service accounts, and IAM roles remains. AI agents increase the potential blast radius because they can inherit the privileges of the people who deploy them or retain access to the credentials they receive. 1Password’s recent research found that 40% of developers grant agents persistent access to systems or credentials, underscoring how easily access can persist after a task is completed. That makes an old access problem move at machine speed: more identities, more systems, and more permissions that can persist after the work is done. 1Password Privileged Access provisions access at the moment it is requested, scopes it precisely to the task, and deprovisions it automatically when the work is done. Built on the capabilities of Apono, which joined 1Password in June 2026, 1Password Privileged Access provisions permissions directly in the target system’s native policy layer, across cloud environments, databases, and developer infrastructure, without replacing the tools their teams already use. This ensures the agent never needs direct access to the underlying credentials. With 1Password Privileged Access, organizations can: Discover overprivileged access: Track identities and permissions across cloud, databases, and Kubernetes environments to find access that has accumulated over time and should be reclaimed or right-sized. Provision just-in-time access: Create accounts or privileges at the time of request, scoped to the task, and revoked automatically at the end of each session. Maintain compliance evidence without manual log review: Every request, approval, and access event is logged with full attribution for SOC 2, HIPAA, PCI-DSS, ISO 27001, and GDPR. Govern access based on risk: Apply risk-based approvals without slowing engineers down, with low-risk requests auto-approved by policy and higher-risk requests routed to a reviewer through tools such as PagerDuty, Slack, Microsoft Teams, or Jira. Delivering credentials when AI agents and workloads need them As AI agents move into production, teams need a secure, scalable way to deliver credentials only when they are needed. 1Password Credential Broker, now in public preview for GitHub Actions, issues credentials scoped to each individual workflow run, so teams can keep long-lived static secrets out of pipeline configurations. Before releasing any credential, 1Password Credential Broker verifies that the requesting identity is trusted, scopes the credential to that specific request, and logs every delivery. 1Password Privileged Access and Credential Broker extend the Unified Access platform across the full runtime access lifecycle. Infrastructure access is provisioned in the target system’s native policy layer. Credentials are delivered at runtime to verified machine and agent identities. Together, these controls make credential requests, delivery, and access auditable across the AI ecosystem. “Developers are under constant pressure to move faster, but increasingly sophisticated software supply chain attacks have made securing CI/CD pipelines more challenging than ever,” said Ben De St. Paer-Gotch, Director of Product Management at GitHub. “With 1Password Credential Broker for GitHub Actions now in public preview, engineering teams can eliminate secrets from their pipeline configurations, reducing the risk of credential theft while securely providing GitHub Actions with the credentials needed to build and ship software.” Securing credentials where AI-enabled development begins Security teams often lack a reliable view into what credentials exist across developer tools and local machines, who controls them, or whether the access they represent is still needed. That visibility gap grows as credentials accumulate in plaintext on local machines, API tokens end up inside agent context windows, and .env files move between machines and repositories without any record of where they have been. AI coding tools intensify the problem because they rely on those same credentials to develop and deploy code, creating new paths for secrets to end up inside model context windows at a rate that outpaces any credential hygiene process. Three capabilities, now generally available in 1Password Enterprise Password Manager, address this gap. Developer Watchtower finds exposed credentials in local .env files and guides developers to secure them in 1Password, while giving administrators visibility into credential risk on developer machines. 1Password Environments lets developers import existing .env files into the 1Password vault and access secrets through 1Password’s MCP Server, keeping credentials off disk and out of model context. Credential Governance gives administrators a central view into company-owned credentials across employee and shared vaults, the ability to identify and take ownership of company credentials, and control over how those credentials are accessed over time. These capabilities bring governance to the point where credential risk often begins and where organizational visibility has historically been lowest.

Claude can now sign into websites with 1Password without exposing your credentials 1Password has introduced 1Password for Claude, a beta integration that lets Anthropic’s AI assistant complete browser tasks requiring authentication without accessing users’ passwords or other secrets. The integration is available to paid Claude subscribers (Pro, Max, Team, and Enterprise) using Claude Desktop on macOS and to 1Password customers on individual, family, and business plans. It requires a Mac, Claude Desktop, Claude in Chrome, the 1Password desktop app, and the 1Password browser extension. For Team and Enterprise plans, the integration is disabled by default and must be enabled by an organization owner. Connecting 1Password and Claude Users connect their 1Password account to Claude from the Connectors section in Claude Desktop. After the integration is enabled and the 1Password vault is unlocked, Claude can request credentials whenever it needs to sign in to a website while completing a task. Connecting 1Password and Claude (Source: 1Password) Signing in without exposing credentials When Claude reaches a sign-in page, it requests the required login from 1Password. The extension shows which credential is being requested and why, allowing users to approve the request, choose a different saved login, or deny access. Approval requires Touch ID or another biometric authentication method. Passwords, one-time passwords (TOTP), and other secrets are filled into the page through a secure channel managed by 1Password. According to the company, secret values never enter Claude’s context window, memory, or Anthropic’s infrastructure. Usernames are shared only when needed to complete a sign-in. Access is limited to the current task. When the task ends, Claude must request permission again before using the same credential. To give users visibility and control over browser-based AI agents, 1Password introduced Agentic Mode in its browser extension. The feature prevents agents from interacting with the extension itself and automatically activates when Claude takes control of the browser. The extension locks down, hides its interface from Claude, limits access to the credentials approved for the current task, and keeps the rest of the vault inaccessible. After autofill, 1Password checks that secrets were not exposed on the page before returning browser control to Claude. If a sign-in attempt fails, the extension clears the autofilled values before handing control back. Agentic Mode is enabled by default and works even if 1Password for Claude isn’t configured. Users can open the 1Password extension at any time to confirm that Agentic Mode is active or cancel the current task. “We need a new security model that is purpose-built for agents, not just humans. The answer isn’t handing agents your secrets. It is to let a user give an agent permission to use a credential without letting the agent see it. Claude knows it used your login; it does not need the password or one-time code in its context. That distinction is where trust in agents starts and the foundation we’re building with Anthropic,” Nancy Wang, CTO of 1Password, said. According to 1Password, the integration is intended for agentic workflows such as managing online accounts, completing purchases, and other browser-based tasks that require authentication. Every request for credentials requires explicit user approval, and users can revoke access or stop an active task at any time. Current support At launch, 1Password for Claude supports logins and one-time passwords (TOTP). It doesn’t support payment cards, identities, or other item types. Users experiencing setup issues should verify that Claude Desktop, Claude in Chrome, the 1Password desktop app, and the 1Password browser extension are installed, that the 1Password vault is unlocked, and that the integration is connected in Claude. Team and Enterprise customers also need an organization owner to enable the feature before it can be be used.

A Russian-speaking threat actor known as "bandcampro" used Google's open-source Gemini CLI AI tool as a hacking agent and to operate a small-scale botnet. The AI agent responded to the attacker's prompts, troubleshooting problems on the fly and even proposing operational improvements at least 59 times. In more than 200 sessions between May 19 and April 21, the threat actor worked with the AI tool to deploy and operate an infrastructure that controlled eight systems in a dental clinic and to get access to the OpenDental database. The AI agent assumed the role of an "authorized pen tester" acting without safety disclaimers and automatically saved any credentials. Its skill file contained the command-and-control (C2) playbook, complete with a description of the architecture, standard operations, infection code, commands for persistence, and troubleshooting steps. AI controlling the botnet Trend Micro researchers say that the threat actor used Gemini CLI to migrate the botnet to a new C2 infrastructure. Starting from a single instruction that read ""Study the C2 migration," the AI processed the guide and prepared all the steps and code necessary for the process. The AI migrated the C2 infrastructure, handling the architecture, coding, VPS deployment, Cloudflare configuration, and initial debugging in just six minutes. "The AI read the migration guide, then prepared a migration bundle, a small archive of server code, payloads, and the skill file. It then unpacked the bundle, launched the C&C server on a VPS, and brought up the Cloudflare tunnel," Trend Micro says. When machines initially failed to reconnect, the AI diagnosed conflicting traffic between the old and new servers, and after the actor shut down the old server, all bots reconnected. Daily operation logs show that the threat actor continued to manage the botnet entirely through natural-language requests, asking which machines were online, listing files on particular computers, and generating infection links. From a technical standpoint, the botnet setup was remarkably lightweight, containing all components and instructions in three plain-text files totaling roughly 5 KB. These contained a Gemini jailbreak prompt, a C2 playbook covering infection, persistence, and troubleshooting, and a migration guide for rebuilding the infrastructure. The C2 used an in-memory Python HTTP server and PowerShell agents that polled it every five seconds, and persistence relied on scheduled tasks, WMI events, and registry modifications, depending on privileges. The malware itself was rather unsophisticated, according to Trend Micro, as it did not benefit from obfuscation, packing, or evasion mechanisms. Beyond the botnet, the actor allegedly used AI for password guessing, generating plausible variants of existing passwords for WordPress portals, and analyzing 1Password dumps to find exploitation alleys. The researchers say that the latter failed only due to the operation extending for long enough that the AI lost track of the broader attack concept. The retrieved logs show that Gemini refused to comply in at least one case, when it was asked to build a self-spreading "agent-bomb," but this simply made the threat actor try out other tasks instead. BleepingComputer has contacted Google for a comment on this example of Gemini CLI abuse, but we have not received a response as of publishing. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Thirty-seven cybersecurity-related merger and acquisition (M&A) deals were announced in June 2026. For a detailed view of the more than 420 acquisitions announced in 2025, check out SecurityWeek’s annual M&A report. Here are some of the most important cybersecurity M&A deals announced in June 2026: Password, secret, and access management solutions provider 1Password has acquired Apono, an Israel-based company that specializes in just-in-time access governance for humans, machines, and AI agents. 1Password reportedly paid between $250 million and $300 million for the company that will enable it to enhance and extend its identity security platform. San Jose-based A10 Networks (NYSE: ATEN) has acquired TrojAI, a Canada-based AI security firm, to add AI red-teaming and runtime protection to its security portfolio. Financial terms were not disclosed. Accenture is acquiring a majority stake in Dragos, plus full ownership of runZero and NetRise in transactions valued at a combined $4.175 billion, to build an integrated OT/industrial cybersecurity platform. The combination of the three security firms will deliver a unified solution that provides industrial and critical infrastructure operators with enhanced visibility across their OT environments and improved threat detection and response capabilities. Belgium-based Aikido Security has acquired Root, an agentic vulnerability remediation startup with Israeli roots, in a deal estimated at $70 million – $100 million (not officially disclosed). Root’s automated patching technology will power new Aikido Libraries and Aikido Images products, letting Aikido fix open source vulnerabilities in place without forcing version upgrades. Cisco has announced its intent to acquire WideField Security, a California identity threat detection startup, to strengthen the Agentic SOC capabilities of the Splunk platform by correlating identity, session, and activity data across human, non-human, and AI agent identities. This is Cisco’s third security-related acquisition of 2026, following Astrix Security and Galileo. Data intelligence firm Databricks has agreed to acquire fellow San Francisco company Panther Labs, a cloud-native SIEM and AI SOC platform, in its third cybersecurity acquisition as it builds out a “security lakehouse”. Financial terms were not disclosed, but Panther was last valued at $1.4 billion in 2021. F5 (NASDAQ: FFIV) has acquired Denver-based SurePath AI, a startup specializing in network-based shadow AI detection and discovery, to power its newly launched F5 AI Security Platform. SurePath had previously raised roughly $6 million in venture funding. Francisco Partners has acquired Paris-based EfficientIP, a DNS, DHCP, and IP address management (DDI) and DNS security specialist, from its founders and minority investors TempoCap and Jolt Capital. EfficientIP CEO Norman Girard and the company’s founders are staying on and reinvesting in the business. Rubrik (NYSE: RBRK) has acquired Colorado-based Strata, an identity orchestration company, to power a new Identity Continuity feature that keeps authentication running via automatic failover to a secondary identity provider during cyber incidents. SailPoint (Nasdaq: SAIL) has completed its acquisition of Tel Aviv-based Entro Security, a non-human identity and credentials security specialist, in a deal reportedly worth around $200 million. Entro’s technology will be integrated into SailPoint’s Agentic Fabric platform to expand discovery, governance, and real-time protection of AI agents and machine identities. Other cybersecurity M&A deals announced in June 2026: Related: Cybersecurity M&A Roundup: 26 Deals Announced in May 2026

1Password��OpenAI�Ƌ��Ƃ��A�R�[�f�B���O�G�[�W�F���g�uCodex�v�����Ɂu1Password Environments MCP Server�v��J�n�����BCodex���V�[�N���b�g��ێ������ɁA�K�v�ȃA�N�Z�X���݂̂���d�g�݂���������B ���̋L���͉������ł��B����o�^�i�����j����ƑS�Ă������������܂��B �@1Password��2026�N5��20���i�č����ԁj�AOpenAI�̃R�[�f�B���O�G�[�W�F���g�uCodex�v�����Ɂu1Password Environments MCP Server�v��J�n�����B �@AI�R�[�f�B���O�G�[�W�F���g���f�[�^�x�[�X��API�A�f�v���C�p�C�v���C���𑀍삷��ɂ͔F�؏��i�V�[�N���b�g�j���K�v�ƂȂ�B�������A����ł͂��������F�؏���.env�t�@�C����X�N���v�g�A���|�W�g���Ƀn�[�h�R�[�f�B���O�����P�[�X�������B�e�Ղɏ���o���郊�X�N�����邾���łȂ��A�K�o�i���X��č��̖ʂł��ۑ�ƂȂ��Ă���B �@�u1Password Environments MCP Server for Codex�v�́A1Password��Codex�́u�M���ł���A�N�Z�X���C���[�v�Ƃ��Ĉʒu�t������̂��B�F�؏��̓^�X�N���ƂɁu�W���X�g�C���^�C���v�Ŕ��s����A�p�r�ɉ����čŏ����̃X�R�[�v�Ɍ��肳���B�����ɁA�����̒l��AI���f���̃R���e�L�X�g�E�B���h�E�̊O���ɕۂ����B �@�J���҂͊J���A�f�v���C�ɕK�v�ȃA�N�Z�X���������ŁA�V�[�N���b�g��1Password������ړ����Ȃ��B �@1Password�́uAI�G�[�W�F���g�̃R���e�L�X�g�ɔz�u���ꂽ�F�؏��͘R�������X�N������v�Ǝw�E����B���O�ւ̋L�^�A�L���b�V���A�Z�b�V�������܂������ė��p�AAI�̑z��O�̏o�͂�ʂ��ĊO���ɘI�o����\�������邽�߂��B �@���S�ȃA�[�L�e�N����ł́A�R�[�f�B���O�G�[�W�F���g���uVault�i�ۊnjɁj�v�Ƃ��Ăł͂Ȃ��A�u���p��́i�e�i���g�j�v�Ƃ��Ĉ����K�v������B�G�[�W�F���g�͋Ɩ��𐋍s���邽�߂̈��S�ȃA�N�Z�X���邪�A�V�[�N���b�g���̂��̂̏��L���͎����Ȃ��B �@1Password Environments�͂��̌����Ɋ�Â��č\�z����Ă���B��[���Ԃ�.env�t�@�C�������L������A�F�؏��̒l���n�[�h�R�[�f�B���O�����肷��̂ł͂Ȃ��A�ꌳ�����ꂽ���L�������Ƃ�i�߂�B�V�[�N���b�g�̓A�v���P�[�V�����̎��s���ɂ̂݃v���Z�X�ɒ�������A�R�[�h��^�[�~�i���A���f���̃R���e�L�X�g�ɒl������邱�Ƃ͂Ȃ��Ƃ����B �@���̃Z�L���A�A�N�Z�X���f���́A1Password�̍������x����Vault�Z�p�ƃZ�L�����e�B�A�[�L�e�N������x�[�X�ɂ��Ă���B�V�[�N���b�g�̓G���h�c�[�G���h�ňÍ�������A�����Ǘ������B�A�N�Z�X�̓J�X�^�������ɂ���ĔF���ꂽ���[�U�[��O���[�v�݂̂Ɍ��i�ɐ��������B �@�R�[�f�B���O�G�[�W�F���g���J�����[�N�t���[�ł��哱�I�Ȗ�����S���قǁA���̃A�[�L�e�N����̏d�v���͑����Ƃ����B �@�u���[�J���t�@�C����v�����v�g�ɃR�s�[���ꂽ�F�؏��A���|�W�g���Ƀn�[�h�R�[�f�B���O���ꂽ�F�؏��́A��Ƀ��X�N�ɂ��炳��Ă���B1Password Environments�͊J���X�s�[�h�ƃZ�L�����e�B���g���[�h�I�t�ɂ��Ȃ����[�N�t���[�����������i�������̂��v�i1Password�j �@���[�J�����œ��삷��MCP�iModel Context Protocol�j�T�[�o��p����Codex��1Password Environments��ڑ�����B����MCP�T�[�o�̓p�X���[�h�}�l�W���[����ъJ���Ҍ����c�[���Ƀp�b�P�[�W������Ă���A1Password�̖@�l�����ƌl�����̗��A�J�E���g�ŗ��p�ł���B �@Codex������1Password MCP�T�[�o�ɂ����čł��d�v�Ȃ̂́AMCP�T�[�o�́ACodex���V�[�N���b�g�̒l����ؖڂɂ��邱�ƂȂ��V�[�N���b�g�ɑ��鑀������s�ł���悤�v����Ă���_���B �@�J���҂�Codex�Ɋ��\�����˗������ꍇ�A�o�b�N�G���h�ł͈ȉ��̃��[�N�t���[�����s�����B �@1Password���A�v���P�[�V�������s���ɕK�v�Ȋ��ϐ��ڃv���Z�X�ɒ�������B�l�͔F���ꂽ�v���Z�X�̃��������ɂ̂ݑ��݂��A�v���Z�X���K�v�Ƃ�����Ԃ����ێ������B �@1Password Environments��Codex�̘A�g�ɂ��A�J���҂͐V�K�v���W�F�N�g��1Password�Ǘ����̊��ŊJ�n�ł��A.env�t�@�C���̍쐬�⋤�L���s�v�ɂȂ�B�����v���W�F�N�g�ɂ����Ă��ACodex��p���ă��|�W�g�����̕����V�[�N���b�g���X�L�������A1Password�ֈ��S�Ɉڍs������ŁA�R�[�h���̒l���Q�Ƃɒu�������邱�Ƃ��\���B �@�A�v���P�[�V�����̎��s���ɂ��Ă��A�쐬��Ǘ���Codex�Ɉς˂邱�ƂŁA��ՂƂȂ�V�[�N���b�g��1Password���ɕێ������܂ܓK�ȍ\���ŃR�[�h�����s�ł���B���[�J�������x�[�X���C���Ƃ��Ċ��p���A�X�e�[�W���O����{�Ԋ��v���Ɋg�����邱�Ƃ��e�Ղ��B �@Codex��1Password�����Ƃ肷��ۂ́A��ɖ����I�ȃ��[�U�[���F�����߂���B����ɂ��A�J���҂͗��������A�S�ẴA�N�Z�X�����S�ɐ��䂵�A�K�o�i���X���ێ��ł���B �@���̘A�g�@�\�́A1Password��OpenAI�̑o���̌ڋq�ŁA1Password�̃p�X���[�h�}�l�W���[����ъJ���Ҍ����c�[���ɃA�N�Z�X�ł���S�Ẵ��[�U�[�����p�ł���B Copyright © ITmedia, Inc. All Rights Reserved.

Cisco on Thursday announced an agreement to acquire identity lifecycle security company WideField Security to strengthen the capabilities of Splunk’s Agentic SOC. No financial details have been publicly disclosed. WideField raised more than $11 million in Series A funding last year. WideField has developed technology that enables organizations to discover human and non-human identities, map exposures across accounts and roles, and assess hygiene gaps. The company’s platform also enables users to detect misconfigurations in authentication policies and weak authentication paths, providing live session monitoring for real-time threat detection, and AI-powered behavioral analytics. By integrating this into Splunk’s Agentic SOC and Cisco’s broader data fabric, the acquisition brings deeper identity and session intelligence into threat investigations, adding critical details around credentials, active sessions, and potential impact radius. This helps security teams better understand context for both human and AI-driven activity, and organizations gain the visibility needed to run autonomous AI systems securely at scale. This is Cisco’s third cybersecurity-related M&A deal of 2026, after Galileo and Astrix Security. Cisco’s announcement came on the same day Accenture revealed a major OT cybersecurity push via acquisitions totaling $4.1 billion. The professional services giant is taking a majority stake in Dragos and fully acquiring runZero and NetRise. SecurityWeek’s M&A tracker has cataloged approximately 190 deals to date in 2026. Related: SailPoint to Acquire Entro in Reported $200 Million Deal Related: Cybersecurity M&A Roundup: 26 Deals Announced in May 2026 Related: 1Password Acquires Apono in Reported $250M-$300M Deal

Identity governance and security solutions provider SailPoint has announced an agreement to acquire Entro, an Israel-based company specializing in non-human identity (NHI) and credential security solutions. Financial terms of the acquisition have not been officially disclosed, but Calcalist learned that the deal is valued at roughly $200 million. Entro will enable SailPoint to enhance and expand solutions, including its Agentic Fabric product, with capabilities designed for deep secrets discovery, mapping human identities to NHI, and real-time AI agent and machine identity threat detection and protection. Entro raised a total of $24 million in seed and Series A funding. “We are excited to integrate our deep, seamless discovery and lineage mapping engine into SailPoint’s comprehensive identity security framework and Agentic Fabric,” said Itzik Alvas, co-founder and CEO of Entro. “I believe that together, our combined non-human and AI capabilities will supercharge SailPoint’s proven ability to secure every identity, human and non-human, across the global enterprise landscape.” SailPoint returned to public markets via an IPO in early 2025. Its stock experienced positive momentum and gains in May 2026 amid growing investor confidence, but has trended downward in June following its Q1 FY2027 earnings release. The company’s Q1 results exceeded market expectations for revenue and adjusted earnings, but forward guidance was viewed as cautious and came in at the lower end of some estimates. SecurityWeek’s M&A tracker has cataloged roughly 190 deals announced to date in 2026. Related: SailPoint Discloses GitHub Repository Hack Related: 1Password Acquires Apono in Reported $250M-$300M Deal Related: Cybersecurity M&A Roundup: 26 Deals Announced in May 2026

Password, secret, and access management solutions provider 1Password announced this week that it has acquired Apono, an Israel-based company that specializes in just-in-time access governance for humans, machines, and AI agents. Financial details have not been officially disclosed, but Calcalist reported that the deal has been valued at between $250 million and $300 million. Apono provides just-in-time privileged access management that evaluates each request against policy before dynamically granting temporary, narrowly scoped permissions. These permissions are automatically removed once the task is complete, eliminating the need for standing accounts or persistent privileges. The platform integrates with AWS, Azure, Google Cloud, Kubernetes, Snowflake, and Databricks, plus more than 200 enterprise tools, enabling users to request access directly in familiar applications. For AI agents, its Intent-Based Access Control ties permissions to a human delegator and the declared task intent, with real-time monitoring to detect and respond to any behavioral drift. Apono’s technology enables 1Password to enhance and extend its identity security platform to govern human, machine, and AI access. “1Password has long been the vault that enterprises and their users relied upon to keep their secrets safe. With Apono, we become the access layer,” said David Faugno, CEO of 1Password. “For 1Password Unified Access, this is an important step forward. We already help organizations secure credentials, manage access to SaaS applications, strengthen device trust, and broker credentials at the moment they are needed. Apono’s just-in-time privileged access governance completes the picture,” Faugno added. SecurityWeek’s M&A tracker has cataloged 190 deals announced to date in 2026, including 20 involving identity security and secure access solutions providers. More than 420 acquisitions were announced in 2025, and SecurityWeek’s annual M&A report provides a detailed analysis of those deals. Related: Cybersecurity M&A Roundup: 26 Deals Announced in May 2026 Related: Akamai to Acquire AI and Browser Security Firm LayerX for $205 Million

1Password Credential Broker reduces secret sprawl through identity-based credential delivery 1Password has announced 1Password Credential Broker, a new product that securely brokers credentials, tokens, and federated access from 1Password to trusted requesters. The 1Password Credential Broker is available in private beta today, with support for GitHub Actions and a roadmap that extends trusted access across humans, machine workloads, and AI agents through a common identity fabric. For two decades, 1Password has helped consumers and businesses protect the credentials they use to access critical systems. But credentials are no longer requested only by people signing in through a browser. Enterprises now depend on employees, CI/CD pipelines, cloud workloads, service accounts, and AI agents, each of which needs credentials to get work done. Those credentials are often copied into applications, repositories, configuration files, environment variables, and pipelines where they are difficult to govern, rotate, and audit. The 1Password Credential Broker extends the role of 1Password from storing secrets to brokering credentials for the humans, machines, and agents that need them. Instead of distributing long-lived secrets across tools and environments, organizations can keep credentials protected in 1Password and release only the approved credential, token, or access artifact to a trusted requester when work needs to happen. “1Password has always been the place enterprises trust to keep credentials safe. The next step is making that same source of truth work for every credential, whether it is requested by a person, a workflow, or an AI agent,” said Nancy Wang, CTO at 1Password. “The 1Password Credential Broker is about closing the gap between where credentials are protected and where access happens. It helps organizations move away from credentials copied across environments and toward credentials brokered from 1Password, based on trusted identity and logged delivery.” From stored secrets to brokered credentials The 1Password Credential Broker acts as a trusted intermediary between an actor that needs a credential and the system where that credential is stored or issued. In the initial private beta flow, the 1Password Credential Broker uses GitHub Actions identity signals to verify a specific workflow before releasing an approved credential to that workload. With the 1Password Credential Broker, organizations can: Reduce long-lived credentials in applications, repositories, configuration files, service accounts, and CI/CD pipelines. Verify trusted identity signals before releasing credentials, beginning with GitHub Actions workload identity. Deliver approved credentials and tokens when needed rather than copying them across environments. Create an audit trail of credential requests and delivery events. Bring human, machine, and agent credential delivery into the same trusted platform. Build toward a common credential source of truth for every actor that needs access. For organizations already using 1Password to manage credentials and secrets, the 1Password Credential Broker provides a path from vaulting credentials to brokering credentials at the moment of use. It helps teams keep credentials protected in 1Password while making them available to trusted requesters when work needs to happen. Designed to keep credentials out of plaintext and secured in 1Password vaults The 1Password Credential Broker is built around a simple principle: credentials should stay protected in 1Password until they are needed by a trusted requester. In the initial GitHub Actions flow, a workflow presents trusted identity signals to 1Password. The 1Password Credential Broker validates those signals against the configured workload identity before delivering the approved credential to the requesting workflow. This model is designed to reduce the operational burden and security risk created by static credentials. If a credential does not need to be copied into an app, pipeline, or environment file, there are fewer places for that credential to sprawl, leak, or persist beyond its intended use. The 1Password Credential Broker also adds visibility into credential delivery. Each credential request and delivery event can be logged with identity context, giving security teams a clearer record of which actor requested which credential and under what configured trust relationship. Extending 1Password’s zero-knowledge security architecture The 1Password Credential Broker is built on 1Password’s security architecture and is designed so 1Password’s infrastructure does not have persistent access to customer secrets. Customer-managed key material and trusted identity signals both play a role in the access flow: cryptography helps protect credentials from unilateral access, while identity verification helps ensure credentials are released only to approved requesters. Before an approved credential is delivered, the 1Password Credential Broker verifies the requester using trusted identity signals and releases only the credential configured for that requester. The credential foundation for unified access 1Password Credential Broker is part of 1Password Unified Access: a platform vision for securing the credentials, identities, and access patterns that connect people, applications, machines, and AI agents. The 1Password Credential Broker answers a specific question: where should the credential live, and how should it be delivered to the trusted actor that needs it? It keeps 1Password as the credential source of truth and brokers approved credentials from that foundation. Recently acquired by 1Password, Apono addresses a different layer: what an identity is permitted to do in the upstream system, and for how long. Together, these capabilities help organizations move from scattered credentials and fragmented access controls toward a more unified security model. The 1Password Credential Broker secures the credential foundation. Apono governs privileged access in target systems. Both are part of the same larger shift, but they solve different problems.

1Password has partnered with OpenAI to address one of the growing security concerns surrounding AI-powered software development: protecting enterprise credentials from leakage, theft, or misuse by agentic coding systems. The companies on Tuesday announced a new integration for OpenAI Codex that gives AI coding agents access to credentials during development workflows without exposing those secrets in prompts, source code, repositories, terminals, or the model’s context window. AI coding has become the de facto go-to tool for developing new apps. But there are two issues with this approach: the coding tool is agentic AI and inherits all the agentic security concerns; and app development requires widespread company access to credentials. “Every action that AI coding agents take against a database, an API, or a deployment pipeline requires access to credentials,” explain Dennis Kromhout van der Meer and Robert Menke in an accompanying blog post. “Today, these credentials typically live in .env files, scripts, or hardcoded in repositories, where they can be easily exfiltrated and are difficult to govern and audit.” Developing software with a coding agent effectively concentrates multiple secrets into a location that is not inherently secure. The agent could store, leak or expose the secrets. The agent also becomes a high value target for adversaries seeking to steal credentials via prompt injection. 1Password has introduced an Environments MCP Server for Codex in a partnership with OpenAI. It gives Codex access to credentials directly inside coding workflows while keeping those secrets out of prompts, code, and model context. Credentials are issued just-in-time and scoped to the task, while keeping them outside the model’s context window. “As coding agents take on more of the software development lifecycle, the question isn’t whether to give them access, but how,” says Nancy Wang, CTO at 1Password. “A credential that persists is already compromised. That’s why just-in-time credentials are the only viable security model for AI-native development.” The 1Password MCP ensures these secrets never leave 1Password. It provides a secure runtime environment where secrets are mounted, used, and discarded, with user authentication required at the moment of access. The credentials never appear in code, terminals, or model context. The MCP uses 1Password’s vault technology. Secrets remain end-to-end encrypted and centrally managed, with access limited to authorized users and groups, and through custom permissions. It allows teams to use Codex without multiplying the risk by the size of the team. At runtime, 1Password injects the required variables directly into the application process when it runs. The values exist in memory only for the authorized process, and only for as long as the process needs them. The process streamlines the coders’ workflow (for example, by eliminating the need for a manual secrets cleanup) and ensures the security team retains oversight of how secrets are accessed. 1Password thinks of its new Environments MCP Server for Codex as a proof point for a broader thesis about the future of agent access. “Coding agents are the leading edge of a larger shift: AI agents joining the workforce and needing real access to real systems. Every one of them will need credentials, but none of them should have custody of those credentials,” states the blog. “1Password is building the access architecture for a future where every agent: coding, operational, and customer-facing gets access through the same trusted layer. Codex is where that future starts.” Related: Claude Code OAuth Tokens Can Be Stolen Through Stealthy MCP Hijacking

For a hobby project built in my spare time to provide a simple community service, Have I Been Pwned sure has, well, "escalated". Today, we support hundreds of thousands of website visitors each day, tens of millions of API queries, and hundreds of millions of password searches. We're processing billions of compromised records each year provided by breached companies, white hat researchers, hackers and law enforcement agencies. And it's used by every conceivable demographic: infosec pros, "mums and dads", customer support services, and, according to the data, more than half the Fortune 500 who are actively monitoring the exposure of their domains. So yeah, "escalated" seems fair! Amidst all the time spent processing data, we've been trying to figure out where to invest energy in building new stuff. In essence, data breaches are pretty simple: you've got a bunch of exposed email addresses attributed to a source, sitting next to a whole bunch of fields we describe with metadata. Our goal has always been to help people use this data to do good after bad things happen, and today we're launching a bunch of new features to do just that. So, here goes: New Features, New Plans In the beginning (ok, in "recent years"), there was one plan we referred to as "Pwned", and within that, there were various levels. For example, the entry-level plan has been "Pwned 1," and to this day, more than half our subscriptions are on it. That's "a coffee a month" for a simple service that, by the raw numbers, does precisely what most of our subscribers are looking for. These are typically small businesses that make a handful of API queries or monitor a domain or two with a few email addresses. It's simple, effective and... insufficient for larger organisations. So, we added Pwned 2, 3 and 4, and they all added more RPMs for email searches and more capacity for searching larger domains. Then we added Pwned 5, which added stealer log support, and somewhere along the way also added Pwned Ultra tiers for making large numbers of API requests. As a result, that one "plan" added more and more stuff at different levels and ultimately became a bit kludgy. Today, we're launching a bunch of new features to better support the volume and privacy needs of our subscribers, and we're shuffling our existing plans to help do this. Here's what they now look like: Core: The fundamentals, largely being what we already had and designed for entry-level use cases Pro: Contains a bunch of the new features designed for larger orgs and those searching domains on behalf of customers High RPM: The old "Ultra" plan levels, designed solely for making large volumes of requests to the email search API Enterprise: We've had this for many years now, and it's a more tailored offering So, that's the high-level overview. Let's now look at all the new stuff and everything that changes: Supporting MSPs Monitoring on Behalf of Third Parties For most people, this won't sound particularly exciting, but I'm putting it up front because I'll refer to it when describing the more important stuff shortly. In the past, we've had the following carve-out in our terms of use, namely, what you're not permitted to use the service for: the benefit of a third party (including for use by a related entity or for the purpose of reselling or otherwise making the Services available to any third party for commercial benefit) This excluded managed service providers from, for example, monitoring their customers' domains as part of their services. That clause has now been revised with the preceding text: unless you have purchased a Paid Service which expressly allows you to do so Which means we can now welcome MSPs to the Pro and High RPM tiers. They can't just take HIBP and use it to create a competing product (for obvious reasons, that's a pretty standard clause within many online services), but they can absolutely add it to the offerings they provide to their own customers. And we're adding new features to make it easier to do just that, for example: Automating Domain Verification Preserving privacy whilst still providing a practical, effective service has always been a balancing act, one I think we've gotten pretty spot on. But the hoops people have had to jump through for domain verification, in particular, have been cumbersome. An organisation wanting to add a bunch of its domains has had to go through the process one by one via the web interface, then verify control over them one by one. They'd spend a lot of time doing kludgy, repetitive work. Today, we're launching two new ways of adding domains in a much more automated fashion, and the first is the verifying via DNS API: Successfully adding a pre-defined TXT record to DNS is solid proof that whoever is attempting to search that domain genuinely controls it. As well as the old kludgy way of doing it in the browser, waiting for DNS to propagate, then coming back to the browser to complete the verification, we can now fully automate the process via API. Here's how it works: Call the HIBP API to generate the TXT record token Call the API on your DNS provider to add the token to the TXT record Call another HIBP API to validate that the token exists This is easily scripted in your language of choice, and you can enumerate it over as many domains as you like. You can also keep retrying step 3 above as often as needed when DNS takes a little while to do its thing. It's all now fully documented in the latest version of the API, and ready to roll. But what if you don't control the DNS? Perhaps it's a cumbersome process in your org, or you're an MSP monitoring your customers' domains, but you don't have control of DNS. That's where the verifying by email API comes in: We've long had a verification process that involves choosing one of several standard aliases on a domain to email a verification token to. You do this via the dashboard, grab the token sent to the email, paste it back into the dashboard and the domain is now verified. The new API makes that much easier, especially when multiple domains are being verified. Here's how it works: Call the HIBP API and specify one of the pre-defined aliases to send a verification email to Click the link in the email and approve the domain to be added to the requester's account And that's it. We see this being particularly useful for MSPs who can now send a heap of emails on their customers' domains, and so long as someone receives it and clicks the link, that's the verification process done. That API is also now fully documented and ready to roll and is accessible to all Pro plan subscribers. Auto-verifying Subdomains This one was just unnecessarily frustrating for larger customers who spread email addresses over multiple subdomains. Let's say a company owns example.com and they successfully verify control of it, but then they distribute their email addresses by region. They end up with addresses @apac.example.com and @emea.example.com and so on, and in the past, needed to verify each subdomain separately. Turns out we have 154 votes for this feature in User Voice, which is substantially more than I expected. So, in keeping with the theme of the Pro plan making it easier on larger orgs, anyone on that level can now add their apex domain, verify it accordingly, then go to town adding all the subdomains they want without the need for verifying each one. Bringing K-Anonymity Searches to the Masses Until today, every time you took out a subscription via the public website and started searching email addresses, it looked like this: GET https://haveibeenpwned.com/api/v3/breachedaccount/[email protected] Clearly, this involved sending the email address to HIBP's service. Whilst we don't store those addresses, if you're sending data to a service in this fashion, there's always the technical capability for us to see that piece of PII and associate it back to the requester via their API key. This approach is what we'll refer to as "direct email search". Let's now look at k-anonymity searches, and I'll break it down into a few simple steps: Start by creating a SHA-1 hash of the address to be searched, so for [email protected], that's: 567159D622FFBB50B11B0EFD307BE358624A26EE Take the first 6 characters of the hash and pass them to the new API: What's really important here is that those 6 characters are the only identifier sent to HIBP and they're completely useless in identifying which address was actually searched for (that link also explains why SHA-1 is perfectly reasonable for this)GET https://haveibeenpwned.com/api/v3/breachedaccount/range/567159 HIBP then responds with the suffixes of every hash we have that matches that prefix and for each one, the breaches it's appeared against: The prefix presently contains 393 suffixes, and if one of them matches the remaining characters of the hash of the full email address, you know that's the address you're looking for.{ "hashSuffix": "D622FFBB50B11B0EFD307BE358624A26EE", "websites": [ "Adobe", "Stratfor", "Yahoo", ... ] }, ... This is the same methodology we've been using for years with the Pwned Passwords search, and we're currently serving about 18 billion requests a month, so it seems that lots of people have easily gotten to grips with it. It's a pretty simple technical concept with great privacy attributes, and it's fully documented on the API page. K-anonymity searches are now available to all Pro and High RPM subscribers at the same rate limit as the direct searches. That rate limit is shared, so you can either make 100% of them to k-anon or 100% to the direct search or go 50/50. We're really happy with the privacy aspects of this API and we know it ticks a box a lot of orgs have been asking for. Unsmoothing the API Rate Limit Previously, when you took out a 10-request-per-minute API key, we implemented a rate limit of 1 request every 6 seconds. The same logic applied to all the higher-tier products, too, and the reason was simply to distribute the load across each minute more evenly or in other words, "smoothing" the rate at which requests were made. That was important earlier on as the underlying Azure infrastructure had to support that traffic, and sudden bursts could be problematic. But the other thing that was problematic is that people (quite reasonably) assumed that they could make 10 fast requests, wait a minute, then go again. This led to support overhead for us and customer frustration, and neither is good. With these latest updates, 10RPM (and all the other RPMs) is now implemented exactly as it sounds - 10 requests in any one-minute block. Here's our Azure API Management policy: In other words, we've "unsmoothed" it. You can hammer the service 10 times in quick succession, then wait a minute, and you won't see a single HTTP 429 "Too many requests" response. Equally, if you're on a 12,000 RPM plan (and you can actually send that many requests quickly!), you won't see an unexpected 429. We can do this now because of the way we serve a huge amount of content from Cloudflare's edge, unburdening the underlying infrastructure from sudden spikes. It's a little thing, but it'll solve a lot of unnecessary frustration for a bunch of people, including us. That's implemented across every single plan, too, so everyone benefits. We Just Wanna Go (Even) Fast(er) Here's our challenge today: how do we enable millions of people a day to search through billions of records with near instantaneous results... and do it affordably? They're somewhat competing objectives, but every now and then, we find this one neat trick that dramatically improves things. About 18 months ago, I wrote about how we were Hyperscaling HIBP with Cloudflare Workers and Caching. The basic premise is that, as people search the service, we build a cache in Cloudflare's 300+ edge nodes that includes the entire hash range just searched for (see the k-anon section above). We flush that out on every new breach load and as it builds back up to the full 16^6 possible cachable hash ranges, our origin load approaches zero and everything gets served from the edge. Almost, because we have the following problem I described in the post: However, the second two models (the public and enterprise APIs) have the added burden of validating the API key against Azure API Management (APIM), and the only place that exists is in the West US origin service. What this means for those endpoints is that before we can return search results from a location that may be just a short jet ski ride away, we need to go all the way to the other side of the world to validate the key and ensure the request is within the rate limit. Or at least we had that problem, which we've just solved with a simple fix. The quoted problem stemmed from the fact that, to ensure everyone adhered to the rate limit, we performed the APIM check before returning any data. That meant always waiting for packets to make a round trip to America, even when the data was cached nearby. But what we realised is that adhering to the rate limit can be eventually enforced; it really doesn't matter too much if a request or two in excess of the rate limit slips through, then we enforce it. The reason why that epiphany is important is that with that in mind, we can start returning data to the client immediately whilst doing the APIM check asynchronously. If the request exceeds the rate limit, Cloudflare will block subsequent requests until the client starts making requests within their limit. So, the rate limit check is no longer a blocking call; it's a background process that doesn't delay us returning results. What that means is a dramatic reduction in the time til first byte: That's almost a 40% reduction in wait time! It's an awesome example of how continuous investment in the way we run this thing yields tangible results that make a meaningful difference to the value people get from the service. Passkeys! Just one more thing... This is all new, all free and all available to everyone, whether they have a paid subscription or not. Remember when I got phished last year? I sure do, and I vowed to use that experience to maximise the adoption of passkeys wherever possible. So, putting my money (and time) where my mouth is, we've now launched passkeys as an alternate means of signing into your dashboard: This saves you needing a "magic" link via email on every sign-in, and whilst it doesn't constitute 2FA (the passkey becomes a single factor used to sign in), it massively streamlines how you access the dashboard. And because we never used passwords for access in the first place, the only account-takeover risk our customers face is someone gaining access to either their email account or to where they store their passkeys (in either case, they have much bigger problems!). Here's how it works: start by signing into your dashboard, then heading over to the "Passkeys" section on the left of the screen and adding a new one: The name is so you can keep track of which passkey you save where. I save most of mine in 1Password, but you can also save them on a physical U2F key or in your browser, for example. Clicking "Continue" will cause your browser to prompt you for the location where you'd like to store it and again, that's 1Password for me: And that's it - we're done! So, how does it work? Check this out, and don't blink or you'll miss it: Compared to typing in your email address, hitting the "Sign In" button, flicking over to the mailbox, waiting for the mail to arrive, then clicking the link, we're down from let's call it 30 seconds to about 3 seconds. Nice 😎 Even though there isn't much security benefit to doing this on HIBP (you can still sign in via email, too), we wanted to build this as an example of just how easy it is. It took Stefán about an hour to build a first cut of this (with support from Copilot), and, aside from the dev time, building passkey support into your website is totally free. There are no external services you need to pay for, no hardware to buy or special crypto concepts to grasp. Passkeys are dead simple, and web developers with even a passing interest in security and usability should be adding support for them right now. We also wanted to make sure they were freely available to anyone, regardless of whether you have a paid subscription, because security like this should be the baseline, not a paid extra. So, go and give them a go in HIBP now. And just in case you want to really geek out on how passkeys work, Stefán presented this at NDC Security in Oslo earlier this month: All the Plans and Future Changes for Existing Subscribers It's easiest just to see the whole overview all in one image (or jump over to the pricing page on the website), and it largely reflects everything described above: One immediate difference to how we've previously represented the plans is that the annual price is now shown as a monthly figure. It turns out that the vast majority of our subscribers choose annual billing, so leading with the per-month pricing puts the least relevant figures front and centre. As we looked around at other services, that was a pretty consistent trend, especially when one annual subscription is more cost-effective than renewing a monthly one 12 times (annual is roughly 10x a year's worth of month-by-month payments). Another change is that we're going to cap the number of larger domains (those with over 10 breached addresses) that can be searched on each subscription. Let me explain why: Every time we load a data breach, each record in the breach is checked against each domain being monitored. In 2025, we added 2.9 billion breached records, and we have 400k monitored domains. Multiply those out, and we're looking at 1.16 quadrillion checks for our subscribers each year. This is all handled by SQL queries, so it's not like we're getting hit with human overhead at scale, but we're getting hit hard with SQL costs. Across everything we pay to run this service (storage, app hosting, functions, API management, App Insights, bandwidth, etc.), the SQL bill is more than the total for all other services combined. In addition to how we currently calculate plan size based on breached email count, we're adding a cap on the number of domains per plan. Only domains with more than 10 breached addresses are included in the cap. The “10” threshold aligns with the existing requirement for a domain to need a subscription at all, and means this change impacts only a single-digit percentage of subscribers. It also helps filter out noise so the cap reflects domains that actually matter. For those larger domains beyond the cap, all current alerts will continue to work just fine until they run a search. At that time, they'll have the option to upgrade the plan or reduce the number of domains. But none of that affects existing subscribers now: There will be no changes to existing plans until at least August 2 this year. We do an annual price revision each August, and that's already factored into the table above. That applies to any new subscriptions immediately, but it won't touch existing ones until August 2 at the earliest. The revised pricing only kicks in on the next subscription renewal after that date, so it could be as late as August 2027 if you're an existing subscriber. The same goes for the cap on the number of domains being monitored - there's no impact on existing subscribers until at least August. That leaves plenty of time to cancel, downgrade, upgrade, or just do nothing, and the plan will automatically roll over to the new one. We'll be emailing everyone in the coming days with details of precisely what will change. Note: if you had an old Pwned 5 subscription for the sake of stealer log access, we'll be rolling all those folks over to Pro 1 and applying a permanent discount code to ensure there's no change in price by moving to the higher plan (it'll actually drop slightly). That'll be explained in the upcoming email, it just made more sense to keep stealer logs in Pro and move people over, and this'll just give them free access to all the new stuff too. Speaking of which, the thing that (almost) nobody reads but everyone is subject to has been revised to reflect the changes described above - the Terms of Use. For the first time, we've also summarised all the changes and linked through to an archive of the old ones, so if you really love digging through a long document prepared by lawyers, this should make you happy 😊 We're Still Doing Credit Cards via Stripe While I'm here, just a quick comment on our ongoing Stripe dependency and, as a result, the necessity to pay for public services via credit card. I've written before about some of the challenges we've faced with customers' requests to pay by other means and how, push comes to shove, they (almost) always find a way around internal barriers. Let me share a recent empirical anecdote about this: Just the other day, I had a call with a Fortune 500 company that was initially interested in our enterprise services. As the discussion unfolded, it became evident that the public services would more than suffice and that the enterprise route was too burdensome for their particular use case. Be that as it may, the procurement lady on the call was adamant that payment by credit card was impossible, even going to the extent of making a pretty bold statement: No Fortune 500 company is going to pay for services like this via credit card! O RLY? If only I had the data to check that claim... 😊 Based on a list of their domains, 132 unique Fortune 500 companies have paid for our services by credit card. The real number will be higher because many more of their domains are not on that list, or purchases have been made via an email address not on the corporate domain. Let's call it somewhere between a quarter and a third of the Fortune 500 who've puschased direct via the world's most common payment method. In other words, a significantly different number from the "zero" claim. I've dropped the hard facts here out of both frustration from our dealings with unnecessarily artificial barriers and in support of the folks out there who, just like me in my corporate days, had to deal with "Neville" in procurement. Per that linked blog post, push back against "corporate policy" prohibiting payment by card, and statistically, you'll likely find you're not the 1 in 160 who can't make a simple payment. Summary We're continuing to massively invest in expanding HIBP in every way we can find. Nearly 3 billion additional breached records last year, hundreds of billions of free Pwned Passwords queries during that time, a bunch of new tweaks and features everyone gets access to and, of course, all the new stuff we've rolled into the higher plans. These new features are the culmination of a huge volume of work dating back to November, when I took this pic of our little team during our planning meeting together in Oslo. We all hope it helps people use our Have I Been Pwned services to do more good after bad things happen.

A new info-stealing malware called Torg Grabber is stealing sensitive data from 850 browser extensions, more than 700 of them for cryptocurrency wallets. Initial access is obtained through the ClickFix technique by hijacking the clipboard and tricking the user into executing a malicious PowerShell command. According to researchers at cybersecurity company Gen Digital, Torg Grabber is actively developed, with 334 unique samples compiled in three months (between December 2025 and February 2026) and new command-and-control (C2) servers registered every week. Apart from cryptocurrency wallets, Torg Grabber steals data from 103 password managers and two-factor authentication tools, and 19 note-taking apps. Rapid evolution In a technical report this week, Gen Digital researchers say that Torg Grabber's initial builds used a Telegram-based and then a custom, encrypted TCP protocol for data exfiltration. On December 18, 2025, the two mechanisms were abandoned in favor of an HTTPS connection routed through Cloudflare infrastructure. The method supports chunked data uploads and payload delivery. The malware features several anti-analysis mechanisms, multi-layered obfuscation, and uses direct syscalls and reflective loading for evasion, running the final payload entirely in memory. On December 22, 2025, Torg Grabber added App-Bound Encryption (ABE) bypass to beat Chrome’s (and Brave's, Edge's, Vivaldi's, and Opera's) cookie protection system, like many other information stealers. However, the researchers also discovered a standalone tool called Underground, used for extracting browser data. It injects a DLL reflectively into the browser to access Chrome’s COM Elevation Service and extract the master encryption key, a method also recently seen in VoidStealer. Extensive data theft capabilities Gen Digital found that Torg Grabber targets 25 Chromium-based browsers and 8 Firefox variants, trying to steal credentials, cookies, and autofill data. Of the 850 browser extensions it targets, 728 are for cryptocurrency wallets, covering "essentially every crypto wallet ever conceived by human optimism." "The marquee names are all there - MetaMask, Phantom, TrustWallet, Coinbase, Binance, Exodus, TronLink, Ronin, OKX, Keplr, Rabby, Sui, Solflare," the researchers say. "But the list doesn’t stop at the big names. It keeps going, deep into the long tail, past projects with install counts you could fit in a phone booth." Apart from wallets, the malware also targets a large list of 103 extensions for passwords, tokens, and authenticators: LastPass, 1Password, Bitwarden, KeePass, NordPass, Dashlane, ProtonPass, Enpass, Psono, Pleasant Password Server, heylogin, 2FAAuth, GAuth, TOTP Authenticator, and Akamai MFA. Torg Grabber also targets information from Discord, Telegram, Steam, VPN apps, FTP apps, email clients, password managers, and desktop cryptocurrency wallet apps. The malware can also profile the host, create a hardware fingerprint, document installed software (including 24 antivirus tools), take screenshots of the user’s desktop, and steal files from the Desktop/Documents folders. Also notable is its capability to execute shellcode on the compromised device, delivered in ChaCha-encrypted zlib-compressed form from the C2. Gen Digital cautions that Torg Grabber continues to develop rapidly, registering new C2 domains weekly, and that its operator base is expanding, with 40 tags documented by the time of analysis. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

As hundreds of vendors descend on San Francisco for the RSAC 2026 Conference, the sheer volume of news can be overwhelming. To help you navigate the noise, SecurityWeek is providing a daily digest of the most significant announcements. Below is our curated roundup of the essential product and service updates from the days leading up to the event. 1Password announced 1Password Unified Access, a new agent security platform that enables organizations to securely deploy AI agents and automated workflows without losing control of credentials, secrets, and machine identities. Unified Access gives AI builders the ability to discover, secure, and audit access at the moment it occurs. At launch, 1Password is collaborating with Anthropic, Cursor, GitHub, Perplexity, and Vercel, as well as other category leaders in AI infrastructure, AI developer tools, MCP gateways, and AI browsers. Action1 has announced new integrations between its endpoint management platform and four major vulnerability management and endpoint security tools from Rapid7, Tenable, CrowdStrike, and Microsoft. Each integration correlates vulnerability scan data from the respective platform with Action1’s endpoint inventory and automated patching capabilities. Additionally, Action1 introduced a universal vulnerability data ingestion feature that accepts exported scan data from any vulnerability management tool. Arcjet has released a prompt injection protection capability that inspects and blocks malicious prompts before they reach AI models. Rather than relying on the model itself to resist adversarial input, enforcement happens earlier in the request path, where full application context (such as identity, session state, and routing) is available. The feature integrates with Arcjet’s existing controls, including bot detection, rate limiting, and sensitive information detection. Bonfy has released Adaptive Content Security (ACS) 2.0, a platform designed to monitor and control how sensitive data is accessed and handled by AI agents, copilots, and unsanctioned AI tools. It covers a broad range of systems (Microsoft 365, Google Workspace, Salesforce, Slack, AWS S3, and on-premises file stores) and introduces an MCP server interface that allows AI agents to label and risk-score content before it reaches external services. A browser extension provides real-time inspection of web traffic to detect shadow AI usage. The platform also adds a ‘data surface visibility’ view that maps where sensitive content resides across an organization’s data stores and tracks how employees and agents interact with it. Booz Allen Hamilton launched Vellox, a suite of five AI-native cybersecurity tools covering malware analysis, detection engineering, adversary emulation, compliance monitoring, and autonomous remediation. Vellox Reverser (generally available) automates malware reverse engineering to produce defensive recommendations; Vellox Ranger (limited preview) autonomously maps customer environments to generate tailored detection logic; and Vellox Striker (limited preview) emulates AI-powered attackers to stress-test defenses. Vellox Navigator (real-time compliance monitoring) and Vellox Responder (autonomous remediation across cloud and infrastructure) are announced but not yet available. Cobalt expands its offensive security platform with new AI capabilities and managed program service Cobalt announced two additions to its Offensive Security Platform: new AI-driven pentesting capabilities and a Security Program Manager service. On the AI side, the platform now automates reconnaissance, vulnerability discovery, credential validation, and finding deduplication. The Security Program Manager is a dedicated human expert who handles scheduling, remediation tracking, and asset inventory management for enterprise-scale pentesting programs, and produces executive-ready reporting from technical findings. Druva Identity Resilience extends the company’s data security platform to include identity protection and recovery across Okta, Microsoft Active Directory, and Microsoft Entra ID in a single SaaS platform. Rather than treating identity as a static list of directory objects, the platform models it as a continuously evolving state (tracking how permissions, relationships, and non-human identities change over time) to help teams reconstruct what happened during an incident and restore access to a known-good state. Entro Security has launched Agentic Governance & Administration (AGA), a new module that extends identity governance principles to AI agents and the non-human identities they use. AGA builds a profile for each agent by correlating its sources (endpoint telemetry, agent foundries, cloud environments, MCP servers), the enterprise assets it accesses, and the identities it relies on. It also provides MCP activity monitoring and policy enforcement. Graylog announced three new capabilities for its SIEM platform. A threat prioritization engine groups related alerts using entity context, asset criticality, vulnerability data, and threat campaign intelligence to surface high-priority incidents and suppress noise. Context-aware incident response workflows automate evidence collection and generate AI-driven step-by-step response recommendations. An open MCP server connects compatible LLMs to Graylog security data, enabling natural-language queries and agentic workflows such as automated triage, MITRE ATT&CK coverage mapping, and false-positive analysis. Huntress has launched Managed Endpoint Security Posture Management (ESPM) and Managed Identity Security Posture Management (ISPM) as new additions to its platform. Managed ESPM controls which applications can run on endpoints, integrates with Microsoft Defender for Endpoint for vulnerability prioritization and remediation, and generates compliance-ready reports. Managed ISPM applies expert-built policies to Microsoft 365, continuously checks for misconfigurations, and automatically rolls back unauthorized changes within minutes. Both products are currently in Early Access, with general availability expected by summer 2026. Nagomi Security has launched Agentic Exposure Ops, which extends the platform’s focus from exposure visibility to automated remediation. Agents investigate exposures by correlating vulnerability data, control telemetry, and threat signals across domains, then route remediation tasks to the appropriate owners with contextual tickets. Once a fix is applied, the agents continuously re-verify that the closure holds as environments change, producing evidence at each stage of the detect-investigate-remediate-verify loop. Opal Security has introduced three new capabilities forming a closed loop for access governance. Paladin is an AI access evaluation agent that sits directly in the approval chain, reviews requests against the requester’s history, resource sensitivity, and referenced project tickets, and either approves or escalates them. OpalScript is a Python-like policy language that lets teams codify access rules as executable automations (such as separation-of-duties enforcement or time-limited access grants). OpalQuery allows security and GRC teams to interrogate the organization’s identity and access graph using plain-language queries, with results exportable as audit evidence. Orca Security has announced four new capabilities for its platform. A Threat Investigation Agent automatically correlates signals across cloud environments and produces investigation reports with recommended containment actions, while an AppSec Triage Agent analyzes SAST findings to filter out false positives. Runtime AI Threat Detection identifies when workloads, identities, and processes interact with AI models, MCP servers, and third-party AI tools, providing visibility into how AI is being used at runtime and where sensitive data may be exposed. Orca also introduced code reachability analysis, which determines whether vulnerable code paths are actually invoked in running applications, and Orca Missions, which groups related findings into tracked remediation initiatives. Onapsis announced Agentic Gateway, an Agentic AI for SAP cybersecurity, enabling organizations to interact with security and compliance data through natural language queries from their existing corporate-sanctioned AI platforms. Security teams can bridge the gap between complex SAP security telemetry and autonomous enterprise AI agents to optimize the full scope of Onapsis platform capabilities. The capability provides an MCP Gateway for SAP Security, Agentic workflows, Context-Aware Reasoning, Enterprise-Grade Privacy and Rapid ‘Shields-Up’ SAP Visibility for all users. Panther has announced the general availability of its AI SOC Platform, in which AI agents have native access to the platform’s data lake, detection engine, and organizational knowledge to investigate and triage alerts autonomously. A key architectural feature is closed-loop detection tuning: every triage outcome is fed back as a label that automatically adjusts detection logic over time. Other capabilities include an AI Detection Builder that converts natural-language threat hypotheses into Python-based detection rules, proactive threat hunting that runs scheduled analysis across the full data lake, and cross-tool context assembly via MCP integrations with identity providers, ticketing systems, and code repositories. Pentera has released Pentera 8, which introduces Pentera Peer, a natural-language, agentic interface embedded directly into the platform’s adversarial testing workflow. The interface is context-aware, tailoring its outputs to the user’s role and organizational context, such as industry and geography. Pentera 8 is expected to reach general availability in Q2 2026. Secure Code Warrior has unveiled ‘SCW Trust Agent: AI’, which provides commit-level visibility into which LLMs (both sanctioned and shadow AI tools) influenced specific code commits, and correlates that AI usage with vulnerability exposure and developer skill levels to enforce policy before code reaches production. It also tracks active MCP servers to prevent AI agents from accessing internal tools or databases through unvetted connections. Sevii has released an Autonomous Proactive Security (APS) module as an expansion of its Autonomous Defense and Remediation (ADR) platform. APS continuously ingests threat intelligence from external partners, open source feeds, and attack data generated within a customer’s own environment, then autonomously generates and executes hunting hypotheses and remediation actions. The platform deploys agentic Cyber Warrior agents to the edge of enterprise networks to process and act on detections across endpoint, identity, and cloud environments. Simbian has announced a unified security operations platform anchored by the Simbian Context Lake, a shared intelligence layer that stores an organization’s environment data, past investigation decisions, and institutional knowledge to inform multiple AI agents. The platform brings together three agents (an AI SOC Agent for alert triage and response, an AI Pentest Agent for automated penetration testing, and an AI Threat Hunt Agent in private preview) that share findings with each other in real time, so a vulnerability uncovered during a pentest can automatically elevate the priority of a related SOC alert. The platform integrates with over 90 security tools and includes case management capabilities, with the SOC and Pentest agents generally available now. Varonis has released Atlas, a platform that covers the full AI security lifecycle (inventory, posture management, runtime guardrails, detection and response, compliance, and third-party risk) in a single solution. A key differentiator is its integration with the Varonis Data Security Platform, which enriches AI security findings with data sensitivity and access context so teams can understand not just what an AI system is doing but what sensitive data it can reach. An AI Gateway enforces real-time guardrails inline (blocking policy violations before they reach the model or downstream systems) while keeping all prompt and response telemetry within the customer’s own environment. Veracode has launched Fix for Software Composition Analysis (SCA), extending its existing AI-powered code remediation capability to cover vulnerabilities in open source dependencies. The solution performs contextual analysis of how third-party libraries interact with first-party code to avoid introducing breaking changes, then bundles all required configuration and source file modifications into a single, reviewable pull request delivered directly into the developer’s Git environment. Automated fixes are grounded in a proprietary, human-verified vulnerability database. The product is currently in Early Access. Vicarius has launched vIntelligence, a new flagship product that adds continuous exposure validation and agentic orchestration to complement its existing vRx remediation platform. vIntelligence is a new engine built to solve the assurance gap by continuously validating risk across fragmented security data, turning raw findings into actionable guidance. vIntelligence combines its own validation engine with an agentic AI layer, enabling teams to query their environment in natural language, generate custom validation logic, identify detection gaps, and recommend remediation actions, all within a human-in-the-loop model.

Agentic web browsers that leverage artificial intelligence (AI) capabilities to autonomously execute actions across multiple websites on behalf of a user could be trained and tricked into falling prey to phishing and scam traps. The attack, at its core, takes advantage of AI browsers' tendency to reason their actions and use it against the model itself to lower their security guardrails, Guardio said in a report shared with The Hacker News ahead of publication. "The AI now operates in real time, inside messy and dynamic pages, while continuously requesting information, making decisions, and narrating its actions along the way. Well, 'narrating' is quite an understatement - It blabbers, and way too much!," security researcher Shaked Chen said. "This is what we call Agentic Blabbering: the AI Browser exposing what it sees, what it believes is happening, what it plans to do next, and what signals it considers suspicious or safe." By intercepting this traffic between the browser and the AI services running on the vendor's servers and feeding it as input to a Generative Adversarial Network (GAN), Guardio said it was able to make Perplexity's Comet AI browser fall victim to a phishing scam in under four minutes. The research builds on prior techniques like VibeScamming and Scamlexity, which found that vibe-coding platforms and AI browsers could be coaxed into generating scam pages or carrying out malicious actions via hidden prompt injections. In other words, with the AI agent handling the tasks without constant human supervision, there arises a shift in the attack surface wherein a scam no longer has to deceive a user. Rather, it aims to trick the AI model itself. "If you can observe what the agent flags as suspicious, hesitates on, and more importantly, what it thinks and blabbers about the page, you can use that as a training signal," Chen explained. "The scam evolves until the AI Browser reliably walks into the trap another AI set for it." The idea, in a nutshell, is to build a "scamming machine" that iteratively optimizes and regenerates a phishing page until the agentic browser stops complaining and proceeds to carry out the threat actor's bidding, such as entering a victim's credentials on a bogus web page designed for carrying out a refund scam. What makes this attack interesting and dangerous is that once the fraudster iterates on a web page until it works against a specific AI browser, it works on all users who rely on the same agent. Put differently, the target has shifted from the human user to the AI browser. "This reveals the unfortunate near future we are facing: scams will not just be launched and adjusted in the wild, they will be trained offline, against the exact model millions rely on, until they work flawlessly on first contact," Guardio said. "Because when your AI Browser explains why it stopped, it teaches attackers how to bypass it." The disclosure comes as Trail of Bits demonstrated four prompt injection techniques against the Comet browser to extract users' private information from services like Gmail by exploiting the browser's AI assistant and exfiltrating the data to an attacker’s server when the user asks to summarize a web page under their control. Last week, Zenity Labs also detailed two zero-click attacks affecting Perplexity's Comet that use indirect prompt injection seeded within meeting invites to exfiltrate local files to an external server (aka PerplexedComet) or hijack a user's 1Password account if the password manager extension is installed and unlocked. The issues, collectively codenamed PerplexedBrowser, have since been addressed by the AI company. This is achieved by means of a prompt injection technique referred to as intent collision, which occurs "when the agent merges a benign user request with attacker-controlled instructions from untrusted web data into a single execution plan, without a reliable way to distinguish between the two," security researcher Stav Cohen said. Prompt injection attacks remain a fundamental security challenge for large language models (LLMs) and for integrating them into organizational workflows, largely because completely eliminating these vulnerabilities may not be feasible. In December 2025, OpenAI noted that such weaknesses are "unlikely to ever" be fully resolved in agentic browsers, although the associated risks could be reduced through automated attack discovery, adversarial training, and new system-level safeguards.

A oltre un anno dall’entrata in vigore dei primi divieti (2 febbraio 2025), il quadro regolatorio dell’AI Act sta entrando nella sua fase più complessa. L’Unione Europea, pur mantenendo il primato normativo globale, si trova oggi a gestire una fase di transizione critica: se da un lato le restrizioni sulle pratiche a rischio “inaccettabile” sono ormai consolidate, dall’altro il mercato attende la piena operatività dei modelli di IA di portata generale, i cui obblighi sono scattati nell’agosto 2025. Nonostante l’ambizione di Bruxelles, l’effetto trascinamento globale (Bruxelles effect) appare meno marcato rispetto al GDPR. Diversi ordinamenti extra-UE continuano a prediligere approcci di soft-law o regolamentazioni settoriali, osservando con scetticismo la rigidità burocratica europea che, secondo alcuni analisti finanziari, potrebbe influenzare l’attrattività del mercato unico per le big tech. Indice degli argomenti Il sistema dei rischi e i divieti operativi dell’Ai Act L’impianto normativo resta incardinato su un approccio basato sul rischio, volto a tutelare i diritti fondamentali sanciti dalla Carta dell’UE. Ad oggi, risultano pienamente operative le interdizioni per i sistemi che presentano rischi inaccettabili, ovvero quelli che: Manipolano il comportamento umano con tecniche subliminali o sfruttando vulnerabilità specifiche. Attuano il cosiddetto social scoring (classificazione sociale basata su comportamenti o personalità). Utilizzano l’identificazione biometrica remota “in tempo reale” in spazi pubblici per fini di contrasto (salvo deroghe autorizzate per minacce terroristiche imminenti o ricerca di persone scomparse). Estraggono immagini facciali da internet o CCTV per creare database di riconoscimento non mirati. Deducono emozioni nei luoghi di lavoro o nelle istituzioni educative. Sanzioni e conformità: i costi della non-compliance dell’Ai Act Il regime sanzionatorio rappresenta uno dei principali driver di spesa per il risk management aziendale. Le sanzioni sono parametrate per esercitare un effetto deterrente proporzionale alla capacità finanziaria: Violazioni di pratiche vietate: fino a 35 milioni di euro o al 7% del fatturato mondiale annuo. Inosservanza di altri requisiti: fino a 15 milioni di euro o al 3% del fatturato. Fornitura di informazioni inesatte: fino a 7,5 milioni di euro o all’1,5% del fatturato. Per le PMI e le startup è previsto un trattamento di favore, con l’applicazione dell’importo più basso tra i due parametri, nel tentativo di non soffocare l’ecosistema dell’innovazione europea. Resta fondamentale l’integrazione con il GDPR e la direttiva NIS2 per una gestione olistica della cybersecurity. Tabella di marcia dell’Ai Act: verso il 2027 Siamo attualmente in una fase intermedia della roadmap attuativa: Agosto 2025 (traguardo superato): piena applicazione per i modelli di IA di portata generale (GPAI). Le aziende hanno dovuto adeguare la documentazione tecnica e i controlli sulla trasparenza. Agosto 2027 (prossima scadenza): sarà il termine ultimo per la conformità dei sistemi di IA ad alto rischio integrati in prodotti regolamentati (dispositivi medici, veicoli, infrastrutture critiche). In questa fase, la pressione sui produttori aumenterà sensibilmente a causa degli obblighi di certificazione e sorveglianza post-market. Governance e sfide future dell’Ai Act L’Ufficio Europeo per l’IA coordina ora la vigilanza insieme alle autorità nazionali. In Italia, la definizione dell’autorità competente ha richiesto un lungo iter normativo, essenziale per fornire alle imprese un interlocutore certo per le valutazioni d’impatto sui diritti fondamentali. Il dibattito economico resta però acceso: il rischio è che un eccesso di oneri amministrativi possa innescare una perdita di competitività rispetto a mercati più deregolamentati. L’equilibrio tra protezione etica e dinamismo economico sarà il parametro su cui si misurerà il successo dell’AI Act nei prossimi anni. AI e protezione dei dati: un consiglio operativo In un contesto dove l’IA elabora volumi massivi di informazioni sensibili, la difesa del perimetro informativo non è più solo un obbligo legale, ma un asset strategico. Le aziende, le istituzioni, le agenzie o gli organismi dell’UE che non rispetteranno le disposizioni previste dall’AI Act rischiano sanzioni pesanti: fino a 35 milioni di euro o al 7% del fatturato mondiale totale annuo dell’esercizio precedente (se superiore) per violazioni relative a pratiche vietate o per l’inosservanza di requisiti in materia di dati; fino a 15 milioni di euro o al 3% del fatturato mondiale totale annuo dell’esercizio precedente per l’inosservanza di qualsiasi altro requisito o obbligo del regolamento; fino a 7,5 milioni di euro o all’1,5% del fatturato mondiale totale annuo dell’esercizio precedente per la fornitura di informazioni inesatte, incomplete o fuorvianti agli organismi notificati e alle autorità nazionali competenti in risposta a una richiesta. Per ciascuna categoria di violazione, la soglia per le PMI sarebbe l’importo più basso tra i due previsti, mentre per le altre imprese sarebbe l’importo più elevato. Le multe possono arrivare fino a 35 milioni di euro o al 7% del fatturato globale annuo, a seconda di quale valore sia maggiore. Questo include anche le aziende internazionali che operano all’interno dell’Unione Europea, applicando l’AI Act con un effetto extraterritoriale. In questo contesto, è fondamentale per le aziende operanti nell’UE comprendere l’interazione tra l’AI Act e altri regolamenti europei, come il Gdpr e la direttiva NIS2, per evitare sovrapposizioni di obblighi e per garantire una gestione corretta degli incidenti e dei rischi. L’AI Act classifica i sistemi di IA in quattro categorie di rischio: inaccettabile alto limitato minimo o nullo: include applicazioni come videogiochi abilitati all’IA o filtri antispam, che sono esenti da normative stringenti e la stragrande maggioranza dei sistemi di IA attualmente utilizzati nell’UE rientra in questa categoria. Le implicazioni di questa classificazione sono fondamentali per capire come la legge influenzerà i vari settori. Ecco le pratiche con rischio inaccettabile riguardano i sistemi di IA che: manipolano le decisioni degli individui in modo subliminale o ingannevole; sfruttano le vulnerabilità come l’età, la disabilità o lo status socio-economico per influenzare il comportamento; valutano o classificano gli individui in base al loro comportamento sociale o alle caratteristiche della personalità; valutano o prevedono il rischio di un individuo di commettere un reato basandosi sui loro tratti di personalità e caratteristiche; creano o espandono database di riconoscimento facciale attraverso la raccolta non mirata di immagini del viso da internet o da riprese di telecamere a circuito chiuso; deducono le emozioni nei luoghi di lavoro o nei centri educativi; classificano gli individui in base ai dati biometrici per dedurre la loro razza, opinioni politiche, appartenenza sindacale, credo religioso o filosofico, vita sessuale o orientamento sessuale; raccolgono informazioni biometriche “in tempo reale” in spazi pubblici accessibili per l’applicazione della legge, salvo eccezioni ben definite e regolamentate. Tali eccezioni includono la ricerca di un bambino scomparso o la prevenzione di una specifica e imminente minaccia terroristica, ma richiedono l’autorizzazione di un’autorità giudiziaria o indipendente e sono soggette a limiti temporali, geografici e di database di ricerca. I sistemi di IA che operano con tecniche manipolatorie, come il riconoscimento delle emozioni sul posto di lavoro o la creazione di profili biometrici per classificare individui in base alla razza, l’orientamento sessuale o la religione, sono considerati troppo pericolosi per essere utilizzati. Il divieto riguarda anche pratiche come il social scoring e l’uso di IA per prevedere crimini sulla base dell’aspetto fisico di una persona. Questi divieti sono il risultato di un’approfondita riflessione sulla natura dei rischi che l’IA può comportare. La legge si pone l’obiettivo di ridurre i danni derivanti dall’uso irresponsabile delle tecnologie, proteggendo i diritti fondamentali degli individui da violazioni gravi. L’AI Act proibisce espressamente queste applicazioni, considerando che i danni potenziali sarebbero troppo grandi e difficili da mitigare. Alto: comprende applicazioni in infrastrutture critiche (come i trasporti), nell’istruzione, nella sicurezza dei prodotti, e nella giustizia, nell’ applicazione dell’IA nella chirurgia assistita da robot o software medici basati sull’IA, servizi pubblici e privati essenziali (per esempio il credit scoring che nega ai cittadini la possibilità di ottenere un prestito). Questi sistemi devono rispettare rigorosi obblighi di valutazione prima di essere immesse sul mercato. Rischio limitato: si riferisce alla trasparenza e include obblighi per informare gli utenti quando interagiscono con sistemi di IA, come chatbot o contenuti generati da IA; Il cuore dell’AI Act è l’identificazione di un “rischio inaccettabile”, un concetto che implica che alcune applicazioni di IA possano nuocere gravemente alla sicurezza, ai diritti e alla dignità delle persone. L’intelligenza artificiale è uno strumento formidabile ma alcuni sistemi la utilizzano per usare ed elaborare informazioni che contengono dati personali e sensibili. Dunque, ogni utente deve proteggersi e creare intorno a se e ai propri dispositivi una barriera. Inoltre, occorre sempre più mettersi al riparo dalle minacce esterne con sistemi all’avanguardia. L’implementazione dell’AI Act, unitamente ai rigidi dettami del GDPR e della direttiva NIS2, impone alle organizzazioni un innalzamento dei protocolli di sicurezza. In un panorama dove l’intelligenza artificiale viene spesso utilizzata come vettore per attacchi di ingegneria sociale e data exfiltration, l’adozione di soluzioni tecnologiche di difesa diventa un pilastro della business continuity. Per mitigare i rischi legati alla gestione delle identità e degli accessi, l’utilizzo di gestori di password aziendali come NordPass e 1Password rappresenta oggi uno standard necessario per prevenire il credential stuffing e garantire la segregazione dei privilegi. Parallelamente, la protezione del dato a riposo richiede sistemi di cifratura avanzata; in questo ambito, soluzioni di archiviazione crittografata come NordLocker permettono di mantenere la riservatezza delle informazioni sensibili, riducendo l’impatto finanziario di potenziali data breach. Sul fronte della prevenzione attiva e della difesa dell’endpoint, suite come Kaspersky Plus offrono monitoraggio in tempo reale contro malware e minacce ibride, integrando strumenti di rilevamento che si allineano alle richieste di vigilanza del regolatore europeo. Infine, la gestione della presenza digitale e la riduzione della superficie di attacco passano per la rimozione dei dati personali dai database dei broker di dati, un processo automatizzabile attraverso servizi come Incogni, essenziali per limitare il rischio di profilazione non autorizzata. Compatibilità: Windows, Mac, Android, iOS, Linux Estensioni web: Chrome, Firefox, Edge, Safari, Opera, Brave Crittografia: XChaCha20 2FA: ✓ Compilazione automatica: ✓ Versione Gratuita: ✓ Prezzo: da 1,29 €/mese NordPass è un password manager sicuro e intuitivo che consente di salvare e compilare automaticamente le credenziali, archiviare dati in modo protetto, accedere da più dispositivi, monitorare la salute delle password e rilevare eventuali violazioni di dati. Tra le funzionalità extra troviamo anche l’allegato di file e il mascheramento delle e-mail. Per le aziende, NordPass propone soluzioni dedicate con controlli centralizzati e impostazioni a livello organizzativo, integrazione con SSO (Google Workspace, Entra ID, MS ADFS, Okta) e dashboard di sicurezza e gestione di cartelle condivise. Premium: Sconto del 50% sul piano biennale; Family: Fino a 6 utenti, con tutte le funzionalità Premium e sincronizzazione multi-dispositivo; 30 giorni di garanzia soddisfatti o rimborsati su tutti i piani. Teams: ideale per piccoli gruppi, con gestione centralizzata; Business: Pensato per medie imprese, include SSO e dashboard avanzata; Enterprise: Per grandi organizzazioni, con supporto dedicato e provisioning personalizzato. Oltre alla componente economica, la scelta del piano incide direttamente sulle capacità di governance e integrazione IT dell’azienda: Focus: sicurezza essenziale per micro-imprese. Incluso: condivisione sicura, MFA, accesso offline e login tramite Google Workspace. Vincolo: fatturazione fissa per 10 licenze, indipendentemente dall’utilizzo effettivo inferiore. Focus: gestione del rischio e conformità per PMI. Incluso (oltre a Teams): condivisione per cartelle e gruppi, Data Breach Scanner (monitoraggio violazioni dominio) e integrazione con la piattaforma di compliance Vanta. Vantaggio: offre il miglior rapporto tra costo e strumenti di prevenzione proattiva. Focus: automazione e integrazione in infrastrutture complesse. Incluso (oltre a Business): SSO avanzato (Entra ID, Okta, ADFS), Provisioning automatico degli utenti e integrazione con sistemi SIEM come Splunk o Microsoft Sentinel. Vantaggio: massima scalabilità e controllo centralizzato dei log di accesso per audit di sicurezza. ⚡ Velocità upload: Veloce 🔄️ Accesso ai file offline: ✔️ 💰 Costo: da 2,99 €/mese 📱 Mobile: Android, iOS 💻 Desktop: Windows, macOS 🔐 Sicurezza: AES-256 🧑💻 Facilità di utilizzo: Molto facile 🔥 Offerte attive: SCONTO fino al 53% NordLocker è una soluzione avanzata di cloud storage sicuro che offre crittografia end-to-end per proteggere i file sia in locale che online. Grazie alla sincronizzazione su più dispositivi, consente di accedere ai dati in modo protetto da qualsiasi piattaforma, inclusi Windows, macOS, Android, iOS e browser. Funzionalità principali di NordLocker: Crittografia completa: i file sono protetti durante la memorizzazione e la trasmissione; Architettura zero-knowledge: solo l’utente può accedere ai contenuti; NordLocker non conserva né conosce le chiavi di crittografia; Condivisione sicura: possibilità di condividere file o cartelle protette, mantenendo sempre il controllo degli accessi; Accesso protetto da autenticazione a due fattori (2FA); Supporto clienti attivo 24/7 e priorità per gli utenti Premium. NordLocker, prodotto gemello di NordPass e NordVPN, si posiziona nel mercato del Cloud Storage sicuro con una proposta focalizzata sulla crittografia end-to-end. A differenza dei servizi cloud tradizionali, NordLocker adotta un approccio Zero-Knowledge, garantendo che solo l’utente proprietario delle chiavi di cifratura possa accedere al contenuto dei file. La strategia di penetrazione del mercato di NordLocker si basa su una forte scontistica per il primo anno di sottoscrizione, mirata a incentivare la migrazione da servizi meno sicuri. I prezzi sono espressi in USD come da offerta originale; l’IVA può essere applicata al momento del checkout. L’offerta di NordPass si distingue per l’integrazione di strumenti di cyber-resilienza avanzati: Crittografia “Ironclad”: utilizzo di algoritmi di cifratura avanzati per proteggere i file sia localmente (sul computer) che nel cloud. Sincronizzazione e backup: protezione automatica contro la perdita di dati. In caso di smarrimento o danneggiamento del dispositivo hardware, i dati rimangono recuperabili tramite il vault remoto. Condivisione sicura (Locker Sharing): a differenza dell’invio di file singoli, l’utente condivide l’intero “locker” (archivio cifrato), mantenendo il controllo granulare su chi può accedere e quando. Autenticazione a più fattori (MFA): un ulteriore livello di sicurezza per prevenire accessi non autorizzati all’account. Il risparmio maggiore si ottiene scalando verso il piano da 2 TB, dove il costo per gigabyte diventa estremamente competitivo rispetto al piano intermedio. L’adozione di NordLocker risulta particolarmente indicata per: Professionisti e Business: gestione di documenti legali, fiscali o sanitari che richiedono la conformità a standard di privacy rigorosi. Protezione contro ransomware: poiché i file sono cifrati e backuppati nel cloud, un eventuale attacco hacker locale non compromette la disponibilità dei dati remoti. Collaborazione protetta: possibilità di inviare grandi quantità di dati sensibili senza affidarsi a protocolli email non sicuri. Garanzia di recesso: come per la linea NordPass, anche NordLocker include una garanzia di rimborso di 30 giorni, permettendo una valutazione tecnica dell’interfaccia “drag and drop” e dei tempi di caricamento prima del consolidamento dell’investimento. Compatibilità: Windows, Mac, Android, iOS, Linux Estensioni web: Chrome, Firefox, Edge, Safari, Opera, Brave Crittografia: AES-256 2FA: ✓ Compilazione automatica: ✓ Versione Gratuita: ❌ Prezzo: da 2,65 €/mese L’attuale offerta di 1Password si delinea come una soluzione di gestione delle identità digitali cross-platform, caratterizzata da un modello di pricing a due velocità che incentiva la fidelizzazione annuale attraverso una riduzione del canone mensile superiore al 30% per i nuovi clienti. La tabella seguente evidenzia il risparmio ottenibile optando per la fatturazione annuale rispetto a quella mensile: Questi piani sono orientati alla sicurezza domestica e individuale. Il piano Families risulta particolarmente efficiente sotto il profilo dei costi, consentendo la condivisione di caveau illimitati e il controllo amministrativo sugli accessi dei membri. Una funzionalità distintiva è la Travel Mode, che permette di nascondere temporaneamente i caveau sensibili durante l’attraversamento delle frontiere. Le soluzioni aziendali di 1Password si concentrano sulla governance e sull’integrazione dei sistemi: Teams Starter Pack: un pacchetto a costo fisso per 10 utenti, ideale per startup. Business: include l’integrazione con fornitori di identità (Identity Providers) come Okta, Entra ID e OneLogin. inoltre, offre la funzionalità Watchtower per il monitoraggio proattivo della “salute” delle password aziendali e report sull’utilizzo del team. Integrazione AWS: è prevista la possibilità di acquisto tramite il marketplace AWS per semplificare la fatturazione consolidata all’interno di infrastrutture cloud esistenti. Il valore aggiunto di 1Password risiede nell’architettura di sicurezza basata sulla Secret Key (chiave segreta), che integra la password principale per generare una cifratura AES a 256 bit end-to-end. Sotto il profilo operativo, l’adozione di un piano Business permette di mitigare i rischi di data breach attraverso: Autenticazione a due fattori (2FA) e supporto alle Passkeys. Recovery dei conti: possibilità per gli amministratori di recuperare l’accesso degli utenti bloccati. Provisioning automatico: integrazione con strumenti SIEM (Splunk, Elastic) per il monitoraggio in tempo reale degli eventi di sicurezza. L’offerta promozionale indicata (es. € 2,74 per il piano Individual) è riservata ai nuovi clienti e limitata al primo anno di sottoscrizione con fatturazione annuale. Al termine del periodo promozionale, è prevista l’applicazione delle tariffe standard di listino. Tutti i piani includono una prova gratuita di 14 giorni senza obbligo di acquisto immediato. Incogni, servizio specializzato nella protezione dell’identità digitale, ha lanciato una campagna promozionale in occasione del Safer Internet Day. L’offerta mira a ridurre l’esposizione degli utenti a stalking, doxing e furti d’identità attraverso la rimozione automatizzata dei dati personali dai database dei data broker. L’iniziativa prevede uno sconto fino al 55% sui piani annuali utilizzando il codice coupon PROTECT26, con una finestra temporale di attivazione limitata . La strategia di pricing di Incogni incentiva la sottoscrizione annuale, dimezzando di fatto il canone mensile rispetto alla fatturazione ricorrente standard. L’algoritmo di Incogni interviene su tre livelli critici della filiera dei dati: Automazione su larga scala: il sistema invia e gestisce richieste di rimozione a oltre 420 broker di dati noti, ripetendo il processo periodicamente per evitare che i dati vengano reinseriti (recupero dei dati). Rimozioni personalizzate (piano Unlimited): gli utenti possono segnalare siti specifici dove hanno individuato i propri dati. Il team di Incogni gestisce la pratica senza richiedere la compilazione di moduli aggiuntivi. Monitoraggio e reporting: il servizio fornisce report mensili sull’andamento delle pratiche, offrendo una metrica tangibile sulla riduzione della propria “impronta digitale”. L’adozione di Incogni risponde alla necessità di mitigare i rischi derivanti dai data breach: rimuovendo i propri dati dai broker, si riduce la probabilità di essere bersaglio di campagne di phishing mirate, chiamate di spam e tentativi di frode creditizia. Procedura d’Ingresso: l’attivazione richiede la firma di un modulo di autorizzazione digitale, necessario affinché Incogni possa legalmente agire per conto dell’utente presso i soggetti terzi. Codice sconto: l’applicazione del codice PROTECT26 è necessaria per sbloccare la tariffa agevolata del 55%. Garanzia di rimborso: è prevista una clausola di salvaguardia di 30 giorni (money-back guarantee). Qualora il servizio non soddisfi i requisiti tecnici dell’utente, è possibile richiedere il rimborso integrale entro il primo mese. Massimo dispositivi: 5 Versione Free: Prova gratuita di 30 giorni Sistemi Operativi: Windows, macOS, Android, iOS Dark Web Monitoring: ✔ Protezione minori: ✔ VPN: inclusa Offerte attive: SCONTO fino al 45% 🔥 L’attuale offerta di Kaspersky si articola su una struttura modulare progettata per rispondere alle diverse esigenze di protezione del mercato consumer. La strategia commerciale punta sull’ottimizzazione delle performance e sulla riduzione del rischio d’identità, offrendo sconti significativi fino al 58% per il primo anno di sottoscrizione. L’ecosistema Kaspersky 2026 si basa su tre pilastri fondamentali per la continuità operativa e la protezione del dato: Tutti i piani Kaspersky, Standard, Plus e Premium includono un motore antivirus premiato (vincitore del premio “Product of the Year” di AV-Comparatives). Le statistiche operative riportano oltre 437 milioni di attacchi bloccati nell’ultimo anno, evidenziando l’efficacia delle tecnologie di intelligenza artificiale applicate alla scansione degli URL e degli oggetti dannosi. A partire dal piano Plus, viene integrata una VPN illimitata e superveloce (supporto WireGuard®), essenziale per la cifratura del traffico su reti non protette. Il “Controllo fughe di dati” monitora costantemente se le password o le email associate all’account sono state esposte in violazioni note. Il piano Premium di Kaspersky si configura come la soluzione di fascia alta, includendo: Wallet Identità: Archivio criptato per documenti sensibili. Supporto IT Prioritario: Accesso remoto di esperti per la risoluzione di problemi tecnici. Family Protection: Inclusione gratuita per un anno di Kaspersky Safe Kids per il monitoraggio GPS e il filtraggio dei contenuti per i minori. È fondamentale per l’utente considerare la struttura del modello di abbonamento: Fatturazione anticipata: l’addebito per il rinnovo avviene automaticamente circa 15 giorni prima della scadenza del periodo in corso. Variazione tariffe: il prezzo promozionale è limitato al primo periodo. Al rinnovo, verrà applicato il prezzo standard (es. € 84,99 per il Premium). Diritto di Recesso: Kaspersky offre una garanzia di rimborso entro 30 giorni sia per l’acquisto iniziale che per i rinnovi già addebitati. Incentivo Amazon: il Buono Regalo da 20 € legato al piano Premium rappresenta un ritorno economico immediato, abbattendo il costo effettivo del primo anno a soli € 14,99. Il software Kaspersky garantisce la piena operatività cross-platform: Mobile: Android 11 – 16 e iOS 26.nno rispetto al prezzo di rinnovo; 30 giorni di prova gratuita e garanzia di rimborso entro 30 giorni. Windows: 7 SP1 fino a Windows 11. macOS: Versioni 14 – 26. Massimo dispositivi: 10 Versione Free: prova gratuita di 30 giorni Sistemi Operativi: Windows, macOS, Android, iOS Dark Web Monitoring: ✔ Protezione minori: ✔ VPN: ✔ Offerte attive: SCONTO fino al 66% (per il primo anno) 🔥 Norton offre diverse soluzioni per computer e altri dispositivi tra cui anche smartphone e tablet. Norton aiuta a mantenere protetti i dati che, durante la navigazione, sono particolarmente esposti. Norton AntiVirus Plus con backup nel cloud da 2GB L’analisi dell’offerta commerciale di Norton, aggiornata al primo trimestre del 2026, evidenzia una strategia di posizionamento aggressiva volta a consolidare la quota di mercato nel settore della cybersecurity consumer e Small Business. La struttura dei prezzi riflette una marcata differenziazione tra il costo di acquisizione del cliente e le tariffe di rinnovo a regime, con sconti che raggiungono il 68% sulle soluzioni multidevice. Dal punto di vista funzionale, l’offerta Nordon integra la protezione antivirus tradizionale con tecnologie emergenti di intelligenza artificiale. Il modulo “Protezione anti-truffa”, incluso nei piani 360, è progettato per il rilevamento proattivo di tentativi di phishing, messaggistica fraudolenta e, dato di rilievo tecnico, l’identificazione di contenuti manipolati tramite deepfake. Il piano Deluxe, proposto a 34,99 € per il primo anno (circa 2,92 €/mese), rappresenta il punto di equilibrio economico per i nuclei familiari o i professionisti con più endpoint. Il vantaggio competitivo di questa configurazione risiede nel Dark Web Monitoring, una funzionalità che scansiona i mercati illegali alla ricerca di credenziali compromesse, operando in sinergia con il Password Manager integrato. Oltre alla protezione malware, l’abbonamento include garanzie e strumenti ausiliari di rilievo: Promessa protezione Virus al 100%: un impegno contrattuale che prevede il rimborso qualora gli esperti Norton non riescano a rimuovere un’infezione. Assistente Genie (IA): tool basato su intelligenza artificiale conversazionale specializzato nel triage di messaggi e offerte sospette. Supporto identità (Piano Advanced): assistenza dedicata per il ripristino dei documenti e in caso di furto del portafoglio fisico, estendendo la protezione oltre il perimetro digitale. In linea con le direttive europee sulla protezione dei dati, è opportuno ricordare che l’efficacia di questi sistemi dipende dall’integrazione fluida con i protocolli di sicurezza aziendali. Per le piccole imprese, la soluzione Norton Small Business offre una scalabilità specifica per la protezione dei dati dei clienti, un requisito fondamentale per la compliance normativa. Norton 360 Standard con SafeCam per PC Protezione per 1 dispositivo: PC, Mac, dispositivo Android o iOS. Funzionalità aggiuntive rispetto ad AntiVirus Plus: Secure VPN per una navigazione sicura e privata; SafeCam per PC, che blocca gli accessi non autorizzati alla webcam; Backup nel cloud da 10 GB per PC. Protezione per fino a 5 dispositivi: PC, Mac, dispositivi Android o iOS. Funzionalità aggiuntive rispetto a Standard: Protezione minori per monitorare e proteggere l’attività online dei bambini; Dark Web Monitoring: avvisa se le informazioni personali vengono trovate nel Dark Web; Backup nel cloud da 50 GB per PC. Protezione per fino a 10 dispositivi: PC, Mac, dispositivi Android o iOS. Funzionalità aggiuntive rispetto a Deluxe: Assistenza per il ripristino dell’identità in caso di furto di identità; Assistenza in caso di furto del portafoglio; Monitoraggio dei social media per rilevare attività sospette. Backup nel cloud da 200 GB per PC. Tutti i piani includono la Promessa Protezione Virus 100% che garantisce un rimborso nel caso in cui Norton non riesca a rimuovere un virus Disclaimer: Questo articolo contiene link di affiliazione: acquisti o ordini effettuati tramite tali link permetteranno al nostro sito di ricevere una commissione. I servizi potrebbero subire variazioni di prezzo dopo la pubblicazione. FAQ: ai act categorie di rischio L’AI Act classifica i sistemi di IA in quattro categorie di rischio: 1. Rischio inaccettabile: sistemi vietati che minacciano diritti e libertà fondamentali, come il social scoring, il riconoscimento facciale indiscriminato e la manipolazione emotiva. 2. Alto rischio: comprende applicazioni in infrastrutture critiche (trasporti), istruzione, sicurezza dei prodotti, giustizia, chirurgia assistita da robot e servizi essenziali come il credit scoring. Questi sistemi devono rispettare rigorosi obblighi di valutazione prima di essere immessi sul mercato. 3. Rischio limitato: si riferisce alla trasparenza e include obblighi per informare gli utenti quando interagiscono con sistemi di IA, come chatbot o contenuti generati da IA. 4. Rischio minimo: tutti gli altri sistemi di IA che non presentano rischi significativi e sono soggetti a requisiti minimi. I sistemi di IA considerati a rischio inaccettabile e quindi vietati dall’AI Act includono: – Sistemi di social scoring che classificano le persone in base al loro comportamento sociale – Tecnologie di riconoscimento facciale indiscriminato in spazi pubblici – Sistemi che utilizzano tecniche manipolatorie o subliminali per influenzare il comportamento – Sistemi che sfruttano le vulnerabilità di gruppi specifici basate su età o disabilità – Sistemi per il riconoscimento delle emozioni sul posto di lavoro o in ambito educativo – Creazione di profili biometrici per classificare individui in base a caratteristiche come razza, orientamento sessuale o religione – Sistemi per prevedere crimini sulla base dell’aspetto fisico di una persona Questi divieti sono entrati in vigore dal 2 febbraio 2025 e rappresentano il risultato di un’approfondita riflessione sui rischi che l’IA può comportare per i diritti fondamentali. I sistemi di IA ad alto rischio secondo l’AI Act comprendono applicazioni che operano in settori critici come: – Infrastrutture critiche (come i trasporti) – Istruzione e formazione professionale – Sicurezza dei prodotti – Giustizia e processi democratici – Applicazioni dell’IA nella chirurgia assistita da robot o software medici – Servizi pubblici e privati essenziali (come il credit scoring che può negare ai cittadini la possibilità di ottenere un prestito) Questi sistemi AI ad alto rischio, pur essendo consentiti, sono fortemente regolati e devono rispettare rigorosi obblighi prima di essere immessi sul mercato, tra cui: – Valutazioni di impatto sui diritti fondamentali – Sistemi di gestione della qualità e del rischio – Sorveglianza continua anche dopo il rilascio – Documentazione tecnica dettagliata – Qualità e rappresentatività dei dati di addestramento L’AI Act prevede sanzioni pesanti per le aziende, istituzioni, agenzie o organismi dell’UE che non rispettano le disposizioni. Le multe possono arrivare fino a 35 milioni di euro o al 7% del fatturato globale annuo, a seconda di quale valore sia maggiore. Questo include anche le aziende internazionali che operano all’interno dell’Unione Europea, applicando l’AI Act con un effetto extraterritoriale. Per le PMI, la soglia sanzionatoria è l’importo più basso tra i due previsti, mentre per le altre imprese si applica l’importo più elevato. È fondamentale per le aziende operanti nell’UE comprendere l’interazione tra l’AI Act e altri regolamenti europei, come il GDPR e la direttiva NIS2, per evitare sovrapposizioni di obblighi e garantire una gestione corretta degli incidenti e dei rischi. L’AI Act non pone nessun tipo di limite dimensionale o settoriale, quindi anche le PMI e le microimprese dovranno affrontare un percorso di compliance proporzionato all’impatto dell’AI nel loro business. Il regolamento distingue tra due principali categorie di soggetti: i provider (chi sviluppa e/o modifica modelli di GPAI per trarne profitto) e gli utilizzatori (chi usa strumenti di AI per scopi aziendali). Per le piccole imprese, è consigliabile: 1. Iniziare con un’analisi delle reali esigenze di strumenti AI, individuando reparti, funzioni e utenti coinvolti 2. Mappare i modelli di AI utilizzati secondo le categorie di rischio previste dal regolamento 3. Stabilire un piano d’azione che includa test, audit, documentazione e procedure da tenere costantemente aggiornati 4. Investire nella formazione di dipendenti e dirigenti, senza sottovalutare nessuna mansione Per facilitare l’adeguamento delle PMI, la Commissione europea ha pubblicato un Codice di buone pratiche sull’IA che fornisce indicazioni per un approccio responsabile e semplificato. L’AI Act introduce obblighi stringenti in materia di cyber security per le aziende che sviluppano e adottano sistemi di intelligenza artificiale. Questi includono: – Conservazione dei file di log per garantire la tracciabilità delle operazioni – Implementazione di solide pratiche di data governance – Predisposizione di documentazione tecnica dettagliata – Creazione di meccanismi di controllo umano (human oversight) – Sicurezza e qualità dei dataset utilizzati per l’addestramento, che devono essere equamente rappresentativi e non discriminatori – Etichettatura chiara di chatbot, sistemi generativi e contenuti sintetici per evitare manipolazioni La dimensione della cyber security diventa particolarmente rilevante per i sistemi classificati come ad alto rischio, come quelli utilizzati da banche e assicurazioni. Per garantire la conformità, le aziende devono costruire “un sistema interno che parte dalla definizione di un modello di governance” in cui la cyber security assume un ruolo trasversale, diventando parte integrante dei processi di controllo e monitoraggio. Secondo l’AI Act, un sistema di IA è definito come: “Un sistema basato su macchina progettato per operare con diversi livelli di autonomia e che può mostrare adattabilità dopo il suo impiego, e che, per obiettivi espliciti o impliciti, deduce, in base agli input che riceve, come generare output come previsioni, contenuti, raccomandazioni o decisioni che possono influenzare ambienti fisici o virtuali”. Questa definizione si articola in sette elementi chiave: 1. È un sistema basato su macchina 2. È progettato per operare con diversi livelli di autonomia 3. Può mostrare adattabilità dopo l’impiego 4. Opera per obiettivi espliciti o impliciti 5. Deduce, sulla base degli input ricevuti 6. Genera output come previsioni, contenuti, raccomandazioni o decisioni 7. Può influenzare ambienti fisici o virtuali Due caratteristiche emergono come distintive: l’autonomia e l’inferenza. L’autonomia permette al sistema di agire indipendentemente, mentre l’inferenza consente di prendere decisioni e fare previsioni basate sui dati analizzati. L’AI Act si applicherà in diverse fasi, con scadenze e requisiti graduali per facilitare l’adozione e la conformità: – 1-2 febbraio 2025: entrata in vigore dei divieti per i sistemi di IA a rischio inaccettabile – Agosto 2025: entrata in vigore degli obblighi per i sistemi di intelligenza artificiale a finalità generali – Agosto 2026: applicazione completa di tutti i requisiti di sicurezza e governance Tuttavia, recenti sviluppi indicano che la Commissione UE starebbe valutando una moratoria/pausa su alcune disposizioni dell’AI Act, con lo scopo di concedere alle imprese più tempo per adeguarsi. Si starebbe considerando un “grace period” di un anno per le aziende che utilizzano sistemi AI ad alto rischio o che li hanno già immessi sul mercato prima della data di entrata in vigore delle nuove norme. Parallelamente, per le obbligazioni legate alla trasparenza si valuterebbe un possibile rinvio delle sanzioni fino ad agosto 2027. L’utilizzo dell’AI Generativa in azienda comporta diversi rischi di conformità normativa. Con questi strumenti è molto facile violare la normativa privacy quando vengono utilizzati per trattare dati personali, o la normativa sul diritto d’autore quando si utilizzano come fonti opere protette. Per quanto riguarda la privacy, si verificano due specifiche fattispecie di possibili violazioni: 1. I dati inseriti potrebbero essere utilizzati per migliorare il modello stesso, comportando una comunicazione di dati personali di cui l’interessato non è a conoscenza 2. Se si trattano dati personali con un sistema di AI per profilare soggetti, si entra nell’ambito dell’articolo 22 del GDPR, che disciplina in modo rigoroso tale aspetto Inoltre, alcuni usi di questi strumenti potrebbero configurare una condizione classificata ad alto rischio dall’AI Act. Ad esempio, se si chiede a un sistema di AI generativa di valutare le anomalie di comportamento dei dipendenti basate sui dati delle timbrature, si entra nell’ambito dell’analisi comportamentale, classificata come ad alto rischio. È quindi fondamentale che le aziende definiscano una policy specifica sull’uso degli strumenti di AI generativa, che indichi il possibile uso, i divieti, le attenzioni necessarie, e preveda una formazione adeguata del personale. Lo standard ISO/IEC 42001:2023 rappresenta una risorsa preziosa per le organizzazioni che desiderano allinearsi ai requisiti dell’AI Act, in quanto fornisce linee guida dettagliate per la creazione, gestione e miglioramento continuo di un sistema di gestione dell’IA. Lo standard si inquadra nel contesto della cosiddetta soft law, ossia delle pratiche volontarie di adozione dei sistemi di gestione e di qualità certificabili da enti terzi accreditati che mirano a consolidare la conformità normativa. L’adozione di questi modelli attuativi extra legislativi è incoraggiata dalle politiche e norme comunitarie. Lo standard ISO/IEC 42001:2023 offre un quadro per la gestione del rischio legato all’intelligenza artificiale, fornendo una serie di controlli e obiettivi, intesi come presidi dell’equità, della sicurezza, della trasparenza, della privacy e della robustezza. Rispecchia molte delle disposizioni dell’AI Act, richiedendo valutazioni regolari dei rischi associati ai sistemi di IA, audit frequenti, una gestione continua della qualità e dei rischi. L’ISO/IEC 42001 pone un’enfasi particolare sulla gestione e la qualità dei dati lungo l’intero ciclo di vita del sistema di IA, fornendo linee guida dettagliate per garantire che i dati utilizzati siano adeguati, affidabili e sicuri. Questo aspetto è fondamentale anche per l’AI Act, che richiede sistemi di IA equi e non discriminatori.

Bitwarden announced support for logging into Windows 11 devices using passkeys stored in the manager's vault, enabling phishing-resistant authentication. The new feature is available for all plans, including the free tier, and allows logging into Windows by selecting the security key option and scanning a QR code with a mobile device to confirm access to the passkey stored in the Bitwarden encrypted vault. Bitwarden is an open-source password and secrets manager that can store account passwords, passkeys, API keys, credit card details, identity data, and private notes. To use the new feature, there are three required conditions: Have Entra ID–joined devices FIDO2 security key sign-in is enabled Have a registered Entra ID passkey stored in their Bitwarden vault “Windows now supports industry-standard passkeys secured in the Bitwarden vault, enabling passwordless authentication during sign-in,” Bitwarden says in a press release. “Users can choose to log in with a passkey stored in the Bitwarden vault, allowing Windows to authenticate using cryptographic credentials rather than passwords, without transmitting shared secrets.” Bitwarden acts as the passkey provider in the Windows authentication flow, storing the credential in the user’s synced vault rather than binding it to a single device. This also allows recovery using other devices in case of losing the phone. More importantly, by removing password entry from the login process and using cryptographic challenges signed with private keys stored in the vault, the risk of credential exposure to phishing drops dramatically. Bitwarden states that Microsoft will roll out passkey login on Windows this month, and it depends on the Microsoft Entra ID configuration. In November 2025, Microsoft announced the introduction of a passkey provider API on Windows 11, allowing third-party apps like Bitwarden and 1Password to store and manage passkeys for websites and apps on the OS. The latest announcement extends this further, to a more fundamental authentication layer, that of the OS itself. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cybersecurity researchers have disclosed details of a new phishing suite called Starkiller that proxies legitimate login pages to bypass multi-factor authentication (MFA) protections. It's advertised as a cybercrime platform by a threat group calling itself Jinkusu, granting customers access to a dashboard that lets them select a brand to impersonate or enter a brand's real URL. It also lets users choose custom keywords like "login," "verify," "security," or "account," and integrates URL shorteners such as TinyURL to obscure the destination URL. "It launches a headless Chrome instance – a browser that operates without a visible window – inside a Docker container, loads the brand's real website, and acts as a reverse proxy between the target and the legitimate site," Abnormal researchers Callie Baron and Piotr Wojtyla said. "Recipients are served genuine page content directly through the attacker's infrastructure, ensuring the phishing page is never out of date. And because Starkiller proxies the real site live, there are no template files for security vendors to fingerprint or blocklist." This login page proxying technique obviates the need for attackers to update their phishing page templates periodically as the real pages they're impersonating get updated. Put differently, the container acts as an AitM reverse proxy, forwarding the end user's inputs entered on the spoofed live page to the legitimate site and returning the site's responses. Under the hood, every keystroke, form submission, and session token is routed through attacker-controlled infrastructure and is captured for account takeover. "The platform streamlines phishing operations by centralizing infrastructure management, phishing page deployment, and session monitoring within a single control panel," Abnormal said. "Combined with URL masking, session hijacking, and MFA bypass, it gives low-skill cybercriminals access to attack capabilities that were previously out of reach." The development comes as Datadog revealed that the 1Phish kit had evolved from a basic credential harvester in September 2025 into a multi-stage phishing kit targeting 1Password users. The updated version of the kit incorporates a pre-phishing fingerprint and validation layer, support for capturing one-time passcodes (OTPs) and recovery codes, and browser fingerprinting logic to filter out bots. "This progression reflects deliberate iteration rather than simple template reuse," security researcher Martin McCloskey said. "Each version builds upon the previous one, introducing controls designed to increase conversion rates, reduce automated analysis, and support secondary authentication harvesting." The findings show that turkey solutions like Starkiller and 1Phish are increasingly turning phishing into SaaS-style workflows, further lowering the skill barrier necessary to pull off such attacks at scale. They also coincide with a sophisticated phishing campaign targeting North American businesses and professionals by abusing the OAuth 2.0 device authorization grant flow to sidestep multi-factor authentication (MFA) and compromise Microsoft 365 accounts. To achieve this, the attacker registers on the Microsoft OAuth application and generates a unique device code, which is then delivered to the victim via a targeted phishing email. "The victim is directed to the legitimate Microsoft domain (microsoft.com/devicelogin) portal to enter an attacker-supplied device code," researchers Jeewan Singh Jalal, Prabhakaran Ravichandhiran, and Anand Bodke said. "This action authenticates the victim and issues a valid OAuth access token to the attacker's application. The real-time theft of these tokens grants the attacker persistent access to the victim's Microsoft 365 accounts and corporate data." In recent months, phishing campaigns have also targeted financial institutions, specifically U.S.-based banks and credit unions, to harvest credentials. The campaign is said to have taken place over two distinct phases, an initial wave beginning in late June 2025 and a more sophisticated set of attacks beginning in mid-November 2025. "The actors began registering [.]co[.]com domains spoofing financial institution websites, presenting credible impersonations of real financial institutions," BlueVoyant researchers Shira Reuveny and Joshua Green said. "These [.]co[.]com domains serve as the initial entry point in a refined multi-stage chain." The domain, when visited from a clickable link in a phishing email, is designed to load a fraudulent Cloudflare CAPTCHA page that mimics the targeted institution. The CAPTCHA is non-functional and creates a deliberate delay before a Base64-encoded script redirects users to the credential harvesting page. In an effort to evade detection and prevent automated scanners from flagging the malicious content, directly accessing the [.]co[.]com domains trigger a redirect to a malformed "www[.]www" URL. "The adversary's deployment of a more advanced multi-layered evasion chain – incorporating referrer validation, cookie-based access controls, intentional delays, and code obfuscation – effectively creates a more resilient infrastructure that presents barriers for automated security tools and manual analysis," BlueVoyant said.

AI went from assistant to autonomous actor and security never caught up Enterprise AI deployments have shifted from pilot programs to production systems handling customer data, executing business transactions, and integrating with core infrastructure. That has exposed a significant gap between what AI agents can do and what security teams can observe or control. A briefing published by the AIUC-1 Consortium, developed with input from Stanford’s Trustworthy AI Research Lab and more than 40 security executives, documents the security conditions that emerged in 2025 and projects the risks most likely to affect organizations in 2026. The contributors include CISOs from Confluent, Elastic, UiPath, and Deutsche Börse, along with security researchers and advisors from MIT Sloan, Scale AI, and Databricks. According to an EY survey cited in the briefing, 64% of companies with annual turnover above $1 billion have lost more than $1 million to AI failures. One in five organizations reported a breach linked to unauthorized AI use, commonly described as shadow AI. Three security problems are dominating the field The briefing identifies three categories of risk that security practitioners are dealing with now. The first is the agent challenge. AI systems have moved past assistants that respond to queries and into autonomous agents that execute multi-step tasks, call external tools, and make decisions without per-action human approval. This creates failure conditions that exist without any external attacker. An agent with overprivileged access and poor containment boundaries can cause damage through ordinary operation. Eighty percent of organizations surveyed reported risky agent behaviors, including unauthorized system access and improper data exposure. Only 21% of executives reported complete visibility into agent permissions, tool usage, or data access patterns. Omar Khawaja, VP and Field CISO at Databricks, noted that AI components change constantly across the supply chain and that existing security controls assume static assets, creating blind spots when behavior shifts. The second category is the visibility challenge. Sixty-three percent of employees who used AI tools in 2025 pasted sensitive company data, including source code and customer records, into personal chatbot accounts. The average enterprise has an estimated 1,200 unofficial AI applications in use, with 86% of organizations reporting no visibility into their AI data flows. Shadow AI breaches cost an average of $670,000 more than standard security incidents, driven by delayed detection and difficulty determining the scope of exposure. The third is the trust challenge. Prompt injection moved from academic research into recurring production incidents in 2025. OWASP’s 2025 LLM Top 10 list ranked prompt injection at the top. The vulnerability exists because LLMs cannot reliably separate instructions from data input. Fifty-three percent of companies now use retrieval-augmented generation or agentic pipelines, each of which introduces new injection surfaces. Existing frameworks are not sufficient for agent-specific risks Frameworks such as NIST AI RMF and ISO 42001 provide organizational governance structures, including risk committees and documentation requirements. They do not address the specific technical controls that CISOs need for agentic deployments, such as tool call parameter validation, prompt injection logging, or containment testing for multi-agent systems. Sanmi Koyejo, who leads Stanford’s Trustworthy AI Research Lab, acknowledged that large-scale longitudinal studies comparing incident rates between organizations using technically specific frameworks and those relying on broader governance do not yet exist. “AIUC-1 is still in its early adoption phase, and the field of AI agent security is too nascent for that kind of controlled comparison,” he told Help Net Security. His lab’s research found that model-level guardrails alone are insufficient: fine-tuning attacks bypassed Claude Haiku in 72% of cases and GPT-4o in 57%. Technically specific controls add input validation, action-level guardrails, and reasoning chain visibility that model-level safety misses. Koyejo drew an analogy to MFA adoption in conventional cybersecurity, noting that specific, auditable technical controls reduced breach risk in ways that high-level policy commitments could not. Early adopters of technically grounded AI security standards report faster procurement cycles, clearer audit readiness, and reduced friction when deploying agents in regulated environments, according to Koyejo. A case study on applying structured AI security controls at AllianceBernstein, a financial services firm, has been published by Virtue AI, which Koyejo co-founded. Resourcing continuous adversarial testing The briefing recommends that organizations integrate continuous red-teaming into agent operations on an ongoing basis. Nancy Wang, CTO of 1Password, said the operating model for enterprises that lack in-house AI security expertise should combine platform defaults, automation, and targeted expertise rather than rely on large specialized teams. “Baseline guardrails must be built into the platforms themselves,” Wang said. “Sandboxed tool execution, scoped and short-lived credentials, runtime policy enforcement, and comprehensive audit logging should not require custom engineering.” Adversarial testing, she said, should be integrated into CI and release workflows so that model updates, prompt changes, or agent reconfigurations automatically trigger predefined attack suites. Human experts then investigate meaningful deltas rather than rerunning entire playbooks manually. Wang recommended tiering agents by risk level. Agents with access to sensitive data or production systems warrant continuous adversarial testing and stronger review gates. Lower-risk agents can rely on standardized controls and periodic sampling. “The goal is to make continuous validation part of the engineering lifecycle,” she said. Koyejo’s lab has pursued the automation question directly. Research on what the lab calls AutoRedTeamer demonstrated that automated attack selection can reduce computational costs by 42 to 58% compared to naive approaches, with broader vulnerability coverage. He recommended that resource-constrained organizations start with automated continuous testing tied to deployment pipelines, implement runtime guardrails before any agent with access to sensitive data or real-world tools goes to production, and use human red-teaming selectively for high-stakes deployments. In identity and cloud security, Wang noted, the shift from high-level policy statements to enforceable controls such as least privilege, short-lived credentials, and scoped tokens materially reduced lateral movement and constrained impact when incidents occurred. “Agents with tightly scoped capabilities and time-bound credentials simply cannot access what they were never granted,” she said. “That is a concrete and observable difference.”

Se c’è una promessa che il marketing dei password manager ha trasformato in un mantra, è quella della zero-knowledge encryption: “i vostri dati sono cifrati end-to-end, nemmeno noi sappiamo cosa custodite nel vault”. Una garanzia che ha convinto milioni di utenti e migliaia di aziende ad affidare a questi servizi cloud le credenziali più critiche, tra cui accessi a sistemi bancari, piattaforme aziendali e infrastrutture IT. Lo scorso 16 febbraio 2026, l’Applied Cryptography Group del Politecnico federale di Zurigo (ETH Zurich)[1] ha pubblicato una ricerca che sta scuotendo il settore. Il paper “Zero Knowledge (About) Encryption: A Comparative Security Analysis of Three Cloud-based Password Managers”[2] verrà presentato alla conferenza USENIX Security 2026 e rappresenta il primo studio sistematico sull’architettura crittografica dei principali password manager cloud-based[3]. Il titolo gioca volutamente con le parole: zero knowledge non indica solo la promessa commerciale, ma la reale conoscenza (o meglio: la mancanza di essa) che i fornitori dimostrano circa la sicurezza dei loro stessi sistemi. “Il punto non è se i password manager sono inutili, ma che il marketing della zero-knowledge li ha venduti come cassaforte inviolabile e l’ETH Zurich gli ha appena tolto il lucchetto davanti a tutti”, sottolinea Sandro Sana, Ethical Hacker e membro del Comitato Scientifico Cyber 4.0. Giorgio Sbaraglia, consulente aziendale cyber security e membro del Comitato Direttivo Clusit, aggiunge anche altre importanti considerazioni: “La scoperta delle vulnerabilità nel modello zero-knowledge che è alla base del funzionamento dei password manager è certamente preoccupante, ma vanno fatte alcune considerazioni”. “Non esiste un sistema sicuro al 100%, cioè qualunque sistema è vulnerabile”, continua Giorgio Sbaraglia, “ma è importante valutare almeno questi aspetti: Quanto è effettivamente sfruttabile la vulnerabilità? E quali sono le alternative? In altre parole: non tutti i password manager sono sicuri allo stesso livello, ma rimangono comunque – oggi – il miglior compromesso tra sicurezza e praticità. Almeno fino a quando continueremo ad utilizzare le password come sistema di autenticazione”. Indice degli argomenti Per comprendere la portata della ricerca è necessario capire il modello di attacco adottato dai ricercatori. In particolare, il team di ricerca ha simulato uno scenario in cui un server del password manager risulta compromesso e stiamo parlando di una condizione non solo teorica, considerato che LastPass ha subito una violazione significativa dei propri sistemi nel 2022 che ha portato alla compromissione di dati cifrati degli utenti. Il presupposto è il cosiddetto malicious server threat model: in pratica, il server è in mano a un attaccante che può deviare arbitrariamente dal comportamento atteso e interagire in modo malevolo con i client degli utenti (browser extension, app mobile, client desktop). I ricercatori hanno quindi configurato server propri che si comportavano come versioni compromesse dei password manager originali. La cosa sorprendente e preoccupante è che non sono stati necessari exploit sofisticati: gli attacchi sfruttano interazioni di routine come il semplice login all’account, l’apertura del vault, la visualizzazione di una password o la sincronizzazione dei dati tra dispositivi, azioni che ogni utente compie più volte al giorno. “Se il threat model ‘server compromesso’ produce 25 attacchi concreti su Bitwarden, LastPass e Dashlane, allora la promessa “anche noi non possiamo leggere nulla” non basta più come garanzia: serve integrità oltre alla cifratura”, è il punto su cui richiama l’attenzione Sandro Sana. Invece, riprendendo le sue considerazioni iniziali, Giorgio Sbaraglia aggiunge che: “La domanda “quanto è effettivamente sfruttabile la vulnerabilità?” rappresenta un discrimine sostanziale per comprendere la gravità del problema”. “Il team di ricercatori di ETH Zurich ha simulato uno scenario in cui un server del password manager risulta compromesso: questa è una condizione possibile (e già accaduta con LastPass), ma comunque non semplice da ottenere da parte dell’attaccante”, fa notare giustamente Sbaraglia, aggiungendo che: “La compromissione del server è il requisito per lo sfruttamento delle vulnerabilità scoperte: non si tratta quindi di exploit eseguibili da remoto, quindi non così semplici da realizzare”. Integrity violations: modifica silenziosa di specifiche voci nel vault di un utente target Full vault compromise: accesso completo a tutte le credenziali di un’organizzazione Credential substitution: sostituzione di URL associati a una password (phishing facilitato) Key recovery attacks: recupero della chiave master in particolari condizioni di sincronizzazione Share/recovery feature abuse: sfruttamento delle funzioni di condivisione e recupero account “Siamo rimasti sorpresi dalla gravità delle vulnerabilità”, ha dichiarato il professor Kenneth Paterson, titolare della cattedra di Computer Science all’ETH Zurich. Una sorpresa che ha una spiegazione precisa: i password manager sono tra i pochi servizi cloud che promettono cifratura end-to-end e ci si aspettava che proprio per questa ragione il loro codice fosse sottoposto a un livello di scrutinio crittografico superiore alla media. Ma, evidentemente, così non è stato. La causa principale identificata dai ricercatori è una tensione strutturale tra usabilità e sicurezza. Le aziende sviluppatrici investono molto nell’aggiungere funzionalità che rendono il servizio più comodo: recupero dell’account in caso di perdita della master password, condivisione del vault con familiari o colleghi, sincronizzazione multi-dispositivo, piani Enterprise con gestione centralizzata degli accessi. Ciascuna di queste funzionalità introduce nuovi flussi crittografici, nuove interazioni tra client e server, nuovi percorsi di codice che espandono la superficie d’attacco. “Il codice diventa più complesso e confuso, e amplia i potenziali vettori per gli hacker”, spiega Matteo Scarlata, dottorando dell’Applied Cryptography Group che ha condotto parte degli attacchi. Un ulteriore problema è l’inerzia tecnologica: molti provider continuano a usare primitive crittografiche degli anni ’90, obsolete secondo gli standard attuali, con la motivazione dichiarata che gli aggiornamenti possano impedire ai clienti di accedere ai propri dati. Un timore comprensibile perché perdere l’accesso a migliaia di credenziali aziendali sarebbe catastrofico, ma che non può giustificare indefinitamente l’uso di crittografia vulnerabile. I ricercatori hanno ovviamente seguito il processo di responsible disclosure contattando i tre provider 90 giorni prima della pubblicazione dei risultati della loro ricerca. Bitwarden, LastPass e Dashlane hanno risposto in modo cooperativo, ma con tempi di remediation diversi e non tutte le vulnerabilità risultano corrette al momento della pubblicazione della ricerca. Tutti i dettagli tecnici sono disponibili nel paper di ricerca, di seguito riportiamo una sintesi sui dati più importanti: Bitwarden, 12 vulnerabilità. Bitwarden, il più popolare tra i password manager open source e molto diffuso in ambito Enterprise grazie alla sua opzione self-hosted, presenta il maggior numero di vulnerabilità documentate: 12. La nature open source del codice non ha impedito queste falle, a dimostrazione che la trasparenza del codice non è sufficiente senza un’analisi crittografica formale sistematica. LastPass, 7 vulnerabilità. LastPass si conferma ancora una volta sotto i riflettori negativi. I 7 attacchi documentati includono scenari di compromissione completa del vault. Il precedente storico rende questa notizia particolarmente significativa per le organizzazioni che non hanno ancora migrato a soluzioni alternative. Dashlane, 6 vulnerabilità. Spesso considerato il password manager più orientato alla sicurezza tra i tre, presenta 6 vulnerabilità. Meno degli altri, ma sufficiente a dimostrare che nessun provider analizzato può attualmente garantire le promesse di sicurezza assoluta presenti nei propri materiali di marketing. Prima di cedere al panico e di cancellare in massa gli account sui password manager è necessario inquadrare correttamente la portata della ricerca. Le vulnerabilità documentate richiedono che un attaccante abbia già compromesso i server del provider. Non si tratta di exploit eseguibili da remoto senza accesso all’infrastruttura, né di falle nel client locale. Questo, tuttavia, non riduce la gravità del problema per due ragioni fondamentali. Innanzitutto, gli attacchi ai server di password manager sono già avvenuti (LastPass 2022 docet) e rappresentano target ad alto valore per gruppi APT e criminali organizzati. La seconda ragione è la promessa zero-knowledge su cui si basa l’intera proposta di valore di questi servizi e che presuppone che anche un server compromesso non metta a rischio i dati degli utenti. Questa promessa è ora formalmente falsificata. La conclusione di Sandro Sana è perentoria: “Per le aziende la morale è semplice: le credenziali privilegiate non stanno in un vault cloud “perché è comodo”, stanno sotto PAM/controlli dedicati e con segmentazione seria. I password manager restano utili, ma da oggi vanno trattati come infrastruttura critica, non come app da smartphone con la password Master123!”. Il professor Paterson raccomanda di scegliere un password manager che sia trasparente riguardo alle vulnerabilità, sottoposto ad audit esterni regolari e con la cifratura end-to-end abilitata per impostazione predefinita. Di seguito riportiamo anche alcuni criteri concreti per orientare la scelta: Preferire provider che pubblicano regolarmente report di audit di terze parti (es. Cure53, NCC Group, Trail of Bits). Verificare che la cifratura E2E sia attiva di default, non come funzionalità opzionale. Valutare soluzioni self-hosted (es. Bitwarden self-hosted, Vaultwarden) se avete le competenze tecniche per gestirle: eliminano il vettore “server compromesso dal provider”. Abilitare l’autenticazione a più fattori (MFA) sul vault: non risolve le vulnerabilità strutturali, ma riduce significativamente il rischio di accesso non autorizzato. Utilizzare master password robuste e uniche, ossia non riutilizzate altrove. Audit dell’inventario: censire tutti i password manager in uso (sia approvati che shadow IT). Classificazione del rischio: le credenziali di sistemi critici (directory, firewall, cloud IAM) non dovrebbero essere esclusivamente protette da password manager cloud-based senza controlli aggiuntivi. Segmentazione delle credenziali: usare soluzioni enterprise on-premise o PAM (Privileged Access Management) per le credenziali privilegiate, riservando i password manager cloud agli accessi meno sensibili. Formazione: comunicare internamente la notizia evitando allarmismo eccessivo, ma sensibilizzando sulla natura reale delle garanzie offerte dai vendor. Monitoring: implementare alerting su accessi anomali ai vault aziendali. Inventariate quali password manager cloud-based sono in uso nella vostra organizzazione. Verificate se tra i provider in uso figurano Bitwarden (cloud), LastPass o Dashlane. Valutate se avete abilitato funzionalità di sharing, family/team plan o recovery account: queste aumentano la superficie d’attacco. Richiedete ai vendor una comunicazione ufficiale sulle patch rilasciate in risposta alla ricerca ETH. Considerare un audit crittografico formale del password manager aziendale se trattate dati critici o regolamentati (NIS2, GDPR, settore bancario/sanitario). Il team ETH non si è limitato a documentare le vulnerabilità, ma ha fornito indicazioni concrete per migliorare la sicurezza del settore. La proposta centrale di Scarlata è pragmatica: aggiornare gradualmente i sistemi per i nuovi clienti secondo gli standard crittografici più recenti, in particolare l’adozione di schemi autenticati e resistenti alla manipolazione come AEAD (Authenticated Encryption with Associated Data) in modalità binding robuste. È importante, inoltre, abbandonare le primitive crittografiche legacy degli anni ’90. Per i clienti esistenti, la proposta è offrire una migrazione volontaria al nuovo sistema, con piena trasparenza sulle vulnerabilità del sistema attuale. Un approccio che rispetta sia le esigenze di continuità del servizio sia il diritto degli utenti di fare scelte informate. “Vogliamo che il nostro lavoro contribuisca a cambiare questo settore”, ha dichiarato Paterson. “I provider di password manager non dovrebbero fare false promesse ai propri clienti riguardo alla sicurezza, ma comunicare in modo più chiaro e preciso quali garanzie le loro soluzioni offrono davvero.” È un principio che va ben oltre i password manager: si applica a qualsiasi prodotto di sicurezza che fa marketing basato su garanzie crittografiche. Trasparenza, audit indipendenti e standard aggiornati non sono optional: sono precondizioni per la fiducia. Ci sono altre due considerazioni importanti da fare a commento di questa notizia. La prima è che i password manager non sono tutti uguali: ce ne sono molte decine reperibili sugli store, ma alcuni sono migliori di altri. Avendo personalmente testato molti password manager ritengo che 1Password sia uno dei migliori (come interfaccia e funzionalità) ma soprattutto uno dei più sicuri. E anche lo studio condotto da ETH Zurich lo conferma: 1Password nei loro test ha dimostrato una resistenza maggiore rispetto ai suoi concorrenti. Ciò è dovuto in gran parte all’uso di una “chiave segreta” ad alta entropia combinata con la password principale dell’utente durante la crittografia. 1Password combina infatti la sicurezza della funzione PBKDF2 con l’uso della chiave segreta (Secret Key). Questa offre una protezione aggiuntiva e più forte qualora i server di 1Password dovessero essere violati. La Secret Key, lunga oltre 30 caratteri, viene creata nel browser o nel client 1Password sul computer dell’utente quando questi crea il suo account 1Password. Tutto ciò avviene interamente sul computer dell’utente e non viene inviato ai server di 1Password, che quindi non conosce la Secret Key. Questo ulteriore livello di sicurezza aumenta significativamente la resistenza agli attacchi di forza bruta, con i ricercatori che osservano che tali attacchi sarebbero “fuori portata” in condizioni normali. La seconda considerazione è più generale: l’autenticazione con password è comunque intrinsecamente debole: come ha ribadito il NIST nel suo recente documento SP 800-63-4 la password non è un’autenticazione resistente al phishing. Quindi dobbiamo andare verso soluzioni diverse dalla password, che peraltro già esistono: per esempio le Passkeys. È un progetto presentato da Apple, Google e Microsoft sotto l’egida della Fido Alliance oltre tre anni fa, nel maggio 2022. Passkeys rappresenta una soluzione di autenticazione sicura e “passwordless”, basata sulla biometria e sulla crittografia asimmetrica. Ma nella mia attività di consulente aziendale constato che il tasso di adozione di questa soluzione è ancora molto basso e fatica a crescere. Esiste, quindi, un problema culturale di fondo – e a tutti i livelli – sull’uso dei sistemi di autenticazione e sulla consapevolezza della loro importanza. Giorgio Sbaraglia I password manager rimangono strumenti preziosi e, per la maggior parte degli utenti, rappresentano un significativo miglioramento rispetto all’alternativa di usare password deboli o riutilizzate. Nulla in questa ricerca suggerisce di abbandonarli in massa. Quello che cambia – e che deve cambiare – è il contesto di fiducia. Le promesse di sicurezza assoluta, di zero-knowledge totale, di “nemmeno noi possiamo accedere ai vostri dati” devono essere sostituite da comunicazioni più oneste, audit pubblici regolari e aggiornamenti crittografici sistematici. Come professionisti della sicurezza, dobbiamo dunque trasmettere ai nostri clienti e stakeholder un messaggio equilibrato: i password manager sono strumenti con un profilo di rischio specifico, come qualsiasi altro strumento. Comprenderlo ci rende più sicuri, non meno. [1] ETH Zurich: “Password managers less secure than promised”. [2] Scarlata M, Torrisi G, Backendal M, Paterson K: “Zero Knowledge (About) Encryption” — USENIX Security 2026, preprint.

Self-spreading npm malware targets developers in new supply chain attack Security researchers have uncovered another supply chain attack targeting developers: 19 typosquatting npm packages published on npmjs.com that steal credentials, infect projects, and propagate themselves across developer environments. The operation, dubbed “SANDWORM_MODE,” represents a (still) rare example of worm-like malware designed to spread through software supply chains rather than traditional end-user systems. New npm worm builds on Shai-Hulud’s playbook After last year’s bombshell appearance of the self-replicating “Shai-Hulud” worm on the official npm registry, the emergence of this campaign shouldn’t come as a shock. “Whether this worm represents a direct descendant or a copycat, it stays consistent with the Dune flavored theming seen in Shai-Hulud analysis and bakes it into operator controls, including Sandworm themed SANDWORM_* environment variable switches that gate behavior at runtime,” the Socket research team noted. Unlike that previous campaign, this one leverages typosquatting npm packages impersonating popular utilities (e.g., AI coding tools like Claude Code, OpenClaw, supports-color, crypto tools) and preserves the expected behavior of the impersonated libraries. The packages were published by two accounts, using npm publisher aliases official334 and javaorg. Once imported by developers, the malicious npm packages: Execute a hidden loader that decrypts embedded code Search for and exfiltrate sensitive data: API keys and access tokens, .npmrc credentials, SSH keys, environment variables, and cryptocurrency wallet keys (the latter are the first data to be exfiltrated, within seconds of installation) Delay the execution of the second stage by 48 to 96 hours, depending on the host. The exception is if the loader detects continuous integration (CI) environments (GITHUB_ACTIONS, GITLAB_CI, CIRCLECI, JENKINS_URL, BUILDKITE), when it foregoes this delay Decrypt and run the second stage module, then start another round of harvesting of sensitive information. “Stage 2 performs deep harvesting: password managers (Bitwarden, 1Password, LastPass via their respective CLIs), local SQLite stores (Apple Notes, macOS Messages, Joplin, clipboard history), and a full filesystem scan for wallet files and crypto configs beyond the working directory,” the researchers shared. “It then exfiltrates all collected data npm/GitHub tokens, environment secrets, proxy credentials, .npmrc credentials, crypto artifacts, LLM API keys, and propagation results through three channels in cascade: HTTPS POST to a Cloudflare Worker at https://pkg-metrics[.]official334[.]workers[.]dev/exfil; authenticated GitHub API uploads to threat actor-created private repositories using double-base64 encoding; and DNS tunneling via base32-encoded queries to freefan[.]net (primary) and fanfree[.]net (secondary), with a DGA fallback seeded by ‘sw2025’ that generates domains across ten TLDs.” The second stage module also performs propagation actions, establishes persistence, and performs MCP server injection. It scans the local machine for Git repositories and authentication tokens for services like GitHub or npm, and if it finds usable credentials, it automatically modifies project files to include a malicious package. It then pushes those changes or publishes compromised packages using the victim’s own account. To make sure it survives cleanup attempts, the malware installs a malicious Git hook, which can re-download or re-execute the malicious payload whenever the developer works on code. The malware also targets modern AI coding assistants – Claude Code, Claude Desktop, Cursor, VS Code Continue, and Windsurf/Codeium – by injecting a rogue Model Context Protocol (MCP) server into their configuration. This allows the threat actor to feed hidden instructions to the assistant, prompting it to read sensitive files and transmit their contents externally. “As a secondary collection step, the module also harvests API keys for nine LLM providers, OpenAI, Anthropic, Google, Groq, Together, Fireworks, Replicate, Mistral, and Cohere, from environment variables and .env files, validating each against its known format regex,” the researchers added. Finally, the malware contains a built-in self-mutation system, but it’s switched off in this version. What should victims do? After Socket alerted the relevant providers, coordinated takedown actions quickly disrupted the campaign’s infrastructure: Cloudflare shut down network services the attackers were using to receive stolen data and control infected systems, GitHub removed repositories and accounts linked to the operation, and npm deleted the malicious packages from its registry. Socket has published a list of the known malicious npm packages and has advised developers affected by this supply chain attack to: Remove any malicious packages they installed and delete the node_modules/ directory Treat any system where the packages ran (developer machine or CI environment) as potentially compromised, and rotate all potentially exposed credentials (including npm tokens, GitHub tokens, and CI/CD secrets) Review recent changes to package.json, lockfiles, and .github/workflows/ for suspicious or unexpected additions Check for persistence mechanisms by auditing global Git hook templates and inspecting hook directories for unfamiliar scripts, and examine local AI coding assistant configuration files for unexpected or unknown mcpServers entries. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

AWS coding agents gain new plugin support across development tools AI coding assistants have become a routine part of many development workflows, helping engineers write, test, and deploy code from IDEs or command line interfaces. One recent change in this ecosystem makes it possible for those agents to interact with AWS in a broader set of ways by adding a library of plugins that give agents specific AWS knowledge and actions. Agent plugins offer AWS deployment capabilities The repository includes a first plugin that can respond to natural language prompts such as a request to deploy an application to AWS. As AWS explains, “Today’s launch includes an initial deploy-on-aws agent plugin, which lets developers enter deploy to AWS and have their coding agent generate AWS architecture recommendations, AWS service cost estimates, and AWS infrastructure-as-code to deploy the application to AWS.” When activated in a supported agent, the plugin combines generative language capability with AWS-specific skills to produce actionable outputs that developers can review before moving forward. These agent plugins install into supported coding agent environments. At launch, the deploy-to-AWS capability works with coding agents hosted in environments such as Claude Code and Cursor. Developers add the plugin to those agents and then issue a simple prompt like “deploy this app to AWS.” The agent combines its generative language capability with the plugin’s AWS skills to produce actionable outputs, including deployment guidance and infrastructure code that developers can review before moving forward. Open source availability and ecosystem context The repository for Agent Plugins for AWS is publicly available under an open source license. It includes tooling that helps coding agents analyze application code, recommend AWS services, estimate costs, and generate templates for infrastructure definition languages. The plugins are packaged so that teams can version and reuse specific capabilities within their workflows. Developer uptake and future additions Support for the initial plugin will expand in the coming weeks with additional capabilities planned for the repository. The availability of this system means teams that rely on AWS can bring certain deployment workflows under the control of configurable agent plugins, reducing manual work around architecture selection and infrastructure code generation while keeping developers in the loop for final decisions and execution. Read more: 1Password open sources a benchmark to stop AI agents from leaking credentials Security at AI speed: The new CISO reality

Design weaknesses in major password managers enable vault attacks, researchers say Can cloud-based password managers that claim “zero-knowledge encryption” keep users’ passwords safe even if their encrypted-vault servers are compromised? Researchers at ETH Zurich and Università della Svizzera italiana set out to answer that question, and the answer is (unfortunately) no. Attack paths against encrypted vaults Cloud-based password managers store users’s passwords in a password vault, which is created and encrypted by the user’s client software by using a cryptographic key derived from the user’s master password. The client software uploads the encrypted vault to a server run by the service provider and the provider can’t decrypt it. Only the user’s client software can: it retrieves the vault and uses the user’s master password to decrypt it locally (i.e., on the user’s device). But, as the researchers demonstrated, attackers who manage to compromise a server that stores the password vaults can, in some cases, recover users’ passwords, fully compromise the vault, modify its contents, and more. The researchers probed four popular password managers: Bitwarden, LastPass, Dashlane, and 1Password. They presented 12 distinct attack scenarios against Bitwarden, 7 against LastPass, 6 against Dashlane, and 3 against 1Password. The attacks are grouped in four categories, depending on the password manager feature they exploit: Key escrow (used for vault recovery, in case the user forgets their master password, or for account recovery), Item-level vault encryption (data items in the vault and user settings are encrypted as separate objects, and often combined with unencrypted or unauthenticated metadata) Credential sharing Backwards compatibility (to support older software client versions) Across these categories, they found that design weaknesses – such as missing key authentication, lack of authenticated encryption, poor key separation, and legacy cryptographic support – can allow attackers who tamper with server-stored data to manipulate keys, metadata, or ciphertext. In many cases, these flaws can lead to severe outcomes such as full vault compromise, loss of confidentiality, or loss of integrity. Importantly, several attacks require little or no user interaction (sometimes just a login or sync) and affect multiple products studied. “We were surprised by the severity of the security vulnerabilities,” said Prof. Dr. Kenneth Paterson, from the Applied Cryptography Group at ETH Zurich. “Since end-to-end encryption is still relatively new in commercial services, it seems that no one had ever examined it in detail before.” (Some) fixes are available The researchers proposed a set of changes that can be implemented to mitigate all of these attacks, but noted vendors’ reluctance to introduce changes that would break functionality or, at worst, lead to irretrievable loss of access to vaults/passwords. “To this aim, we propose the use of specialized password manager clients, with no functionality besides implementing a forced migration to the new vault format. This would prevent any user from losing access to their data, while preserving security for the entire user base,” the researchers advised. The four affected vendors were appraised of the research many months before it was made public. They have since moved to fix some of these exploitable design flaws, while pointing out that others – like the verification of public key authenticity – are industry‑wide challenges that are yet to be successfuly solved. While they all pointed out that this research was valuable to help them keep their users safe, they noted that they have found no indication that any of these attacks have been successfully leveraged to compromise their customers. The researchers themselves noted that while most users are unlikely to be targeted via the attacks they presented, as they require considerable skills and knowledge from the attackers, but higher risk individuals and organizations might be. “Unfortunately, we cannot exclude the possibility that our attacks were already known to advanced threat actors – after all, we have learned from the Snowden revelations that national security agencies are routinely tasked with penetrating systems like the ones we analyse and are willing to conduct active attacks on targets,” they said. “The best mitigation for these parties is to trust that vendors will rapidly and effectively patch their systems, and here we have made real effort to engage with the affected vendors to assist them in this process.” UPDATE (February 17, 2026, 02:00 p.m. ET): “Our security team reviewed the paper in depth and found no new attack vectors beyond those already documented in our publicly available Security Design White Paper,” 1Password’s CISO/CIO Jacob DePriest told Help Net Security. “We are committed to continually strengthening our security architecture and evaluating it against advanced threat models, including malicious-server scenarios like those described in the research, and evolving it over time to maintain the protections our users rely on,” he added. “For example, 1Password uses Secure Remote Password (SRP) to authenticate users without transmitting encryption keys to our servers, helping mitigate entire classes of server-side attacks. More recently, we introduced a new capability for enterprise-managed credentials, which from the start are created and secured to withstand sophisticated threats.” Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

A team of security researchers from ETH Zurich in Switzerland has analyzed popular password managers and identified ways in which threat actors could compromise users’ vaults and access sensitive data. However, the researchers did not test the password managers against external or client-side attacks. Instead they targeted zero-knowledge encryption, a security model where the service provider is unable to access the user’s encrypted data and the data should be protected even if the provider’s servers are compromised. As such, the ETH Zurich researchers conducted an analysis of popular cloud-based password managers under the assumption that the servers storing user vaults are “fully malicious”. The researchers targeted password managers from Bitwarden, Dashlane, LastPass, and 1Password, each having millions of users and overall accounting for a significant share of the market. Although 1Password was included in the research, the analysis focused on the other password managers. Several types of attacks were conducted against each of the tested password managers to degrade security guarantees, undermine expected protections, and fully compromise user accounts. The experts targeted features used for account recovery and SSO login, as well as features designed for backward compatibility. They conducted attacks leveraging improper vault integrity and attacks enabled by sharing features, which allow families or businesses to use the same credentials. For each of the tested password managers, the researchers managed to achieve vault compromise, including full vault compromise for Bitwarden and LastPass, and shared vault compromise for Dashlane. They demonstrated that in many cases an attacker could not only view users’ credentials but also modify them. Password managers respond Some of the vendors pointed out that the attack methods identified by the researchers require full compromise of a password manager’s servers and advanced skills to conduct cryptographic attacks. Dashlane told SecurityWeek that some of the findings require “either specific circumstances and/or an extremely significant window of time”. The vendors have been notified and rolled out patches and mitigations for many of the vulnerabilities, but pointed out that some issues are difficult to address. “When users share items, symmetric keys are encrypted with the recipient’s public keys. As with most server‑mediated end-to-end encrypted (E2EE) systems, this creates a structural dependency on the authenticity of the public key directory,” Dashlane’s Frederic Rivain explained in a blog post. “If an attacker were able to substitute the user’s public key with their own, the attacker could gain access to the contents of shared items encrypted with the malicious public key.” Rivain added, “This is a known, industry‑wide challenge.” Bitwarden noted that of the 10 issues reported by the researchers — each rated as having medium or low impact — seven have been or are in the process of being addressed. However, three of the flaws “have been accepted as intentional design decisions necessary for product functionality”. LastPass told SecurityWeek that it appreciates the research but also suggested that it disagrees with some of the researchers’ assessments. “While our own assessment of these risks may not fully align with the severity ratings assigned by the ETH Zurich team, we take all reported security findings seriously. We have already implemented multiple near‑term hardening measures while also establishing plans to remediate or reinforce the relevant components of our service on a timeline commensurate with the assessed risk,” a spokesperson stated. [ Read: LastPass Users Targeted With Backup-Themed Phishing Emails ] 1Password has also been analyzed and the researchers managed to achieve full compromise of vault confidentiality and integrity, allowing an attacker to obtain passwords and other sensitive data stored in the vault, as well as to add items to the vault. However, Jacob DePriest, CISO and CIO of 1Password, told SecurityWeek that the attack vectors identified by the researchers had already been documented in the company’s publicly available Security Design White Paper. “We are committed to continually strengthening our security architecture and evaluating it against advanced threat models, including malicious-server scenarios like those described in the research, and evolving it over time to maintain the protections our users rely on,” DePriest said. He added, “For example, 1Password uses Secure Remote Password (SRP) to authenticate users without transmitting encryption keys to our servers, helping mitigate entire classes of server-side attacks. More recently, we introduced a new capability for enterprise-managed credentials, which from the start are created and secured to withstand sophisticated threats.” Related: Password Managers Vulnerable to Data Theft via Clickjacking Related: Analysis of 6 Billion Passwords Shows Stagnant User Behavior

A group of academic security researchers have detailed a set of vulnerabilities in four popular cloud-based password managers that could allow an attacker to view and change the passwords stored in a victim’s vaults. The researchers, from ETH Zurich and the Università della Svizzera italiana (USI), in Switzerland, developed 27 successful attack scenarios targeting cloud-based password management services from Bitwarden, LastPass, Dashlane and 1Password. The attacks ranged in severity from integrity violations to the complete compromise of all vaults in an organization, with many of these scenarios allowing attackers to recover passwords. These attack scenarios challenged the password management providers’ claims of offering ‘zero-knowledge encryption,’ which conveys the idea that the server storing the user vaults cannot learn anything about its contents, even if it is compromised. The findings were published in a peer-reviewed paper released on February 16 and will be the subject of a talk at the next USENIX Security Symposium, which will be held in Baltimore, MD in August 2026. Attacking End-to-End Encryption Claims The 27 attack scenarios developed by the researchers revealed common design anti-patterns and cryptographic misconceptions, including unauthenticated public keys, lack of ciphertext integrity, insufficient key separation and missing cryptographic binding between data and metadata. They fell into four categories based on the password manager feature they exploited: Key escrow: full vault compromise via unauthenticated key escrow and account recovery features (four successful attacks: three against Bitwarden, one against LastPass) Vault encryption: integrity violations, metadata leakage, field swapping and key derivation function (KDF) downgrade through flawed item-level encryption (11 successful attacks: five against LastPass, four against Bitwarden, one against Dashlane and one against 1Password) Sharing: organization and shared vault compromise via unauthenticated public keys (five successful attacks: two against Bitwarden, one against LastPass, one against Dashlane, one against 1Password) Backwards compatibility: downgrade to insecure legacy encryption, enabling confidentiality loss and brute-force attacks (seven successful attacks: four against Dashlane, three against Bitwarden) In total, the researchers presented 12 distinct attack scenarios against Bitwarden, seven against LastPass, six against Dashlane and two against 1Password. They noted that, unlike the other three password managers, 1Password includes a high-entropy cryptographic key in the key derivation – which the company calls a “secret key” – alongside the master password a user needs to access its vaults and passwords. This grants 1Password with a security advantage and means “brute-force attacks should be out of reach,” the researchers added. Kenneth Paterson, professor at ETH Zurich’s Department of Computer Science and one of the lead authors of the paper, said that he and his colleagues were “surprised by the severity of the security vulnerabilities.” He explained that his team had already discovered similar vulnerabilities in other cloud-based services but had assumed a significantly higher standard of security for password managers due to the critical data they store. “Since end-to-end encryption is still relatively new in commercial services, it seems that no one had ever examined it in detail before,” he said. Malicious Auto-Enrolment Against Bitwarden An example of an attack developed by the researchers was a ‘malicious auto-enrolment’ attack against a cloud-based Bitwarden vault (BW01). This exploited a critical flaw in Bitwarden’s organization onboarding process, where an adversary controlling the server could silently hijack a user’s vault the moment they accepted an invitation, even from a trusted source. The core issue was in the lack of integrity protection for organization data fetched during onboarding, including policies and cryptographic keys. When a user joins an organization, their client blindly trusts the server’s response, allowing an attacker to manipulate it. By enabling auto-enrolment in the account recovery policy and swapping the organization’s legitimate public key with their own, an attacker could force the client to encrypt the user’s master key under the malicious key, handing it over without resistance. The attack unfolds in three key steps. The adversary intercepts the user’s request to join the organization, replacing the server’s response with a tampered policy (setting auto-enrolment to true) and a forged public key The client, unaware of the deception, encrypts the user’s master key under the attacker’s key and sends it back as an ‘account recovery ciphertext’ Finally, the attacker decrypts this ciphertext using their private key, exposing the master key With the user’s master key in hand, the attacker could gain full access to all stored passwords, notes, and sensitive data, as well as the ability to modify or delete entries undetected. The impact can be severe: a single compromised server can lead to the mass compromise of users, even if they join legitimate, trusted organizations. Worse, the attack scales exponentially. If an attacker breaches one user in an organization, they gain access to the organisation’s private key, which could be shared among several members of their team. Remediation Underway at Bitwarden, LastPass and Dashlane The researchers disclosed their findings to Bitwarden, LastPass and Dashlane through a coordinated 90-day disclosure process that included detailed descriptions of all vulnerabilities. They also offered support through video conferences, email exchanges and patch review. All three vendors notified the researchers that remediation of these vulnerabilities is underway. 1Password, also made aware of the two attack scenarios performed by the researchers against their services, did not request an embargo period but said the company regards the vulnerabilities as “arising from already known architectural limitations.” Jacob DePriest, CISO/CIO at 1Password told Infosecurity that the firm's security team reviewed the paper in depth and found no new attack vectors beyond those already documented in their publicly available Security Design White Paper. He also explained that 1Password regularly evaluates the company's security architecture against advanced threat models, including malicious-server scenarios like those described in the research, and evolve it when needed. "For example, 1Password uses secure remote password (SRP) to authenticate users without transmitting encryption keys to our servers, helping mitigate entire classes of server-side attacks. More recently, we introduced a new capability for enterprise-managed credentials, which from the start are created and secured to withstand sophisticated threats," DePriest added. Dashlane shared a blog post addressing the paper’s findings and detailing a fix the firm deployed to mitigate the issue. LastPass said the company was "grateful" for the research. "While our own assessment of these risks may not fully align with the severity ratings assigned by the ETH Zurich team, we take all reported security findings seriously," a LastPass spokesperson told Infosecurity. "We have already implemented multiple near‑term hardening measures while also establishing plans to remediate or reinforce the relevant components of our service on a timeline commensurate with the assessed risk.” The ETH Zurich researchers noted that they have “no reason to believe” that the password manager vendors are currently malicious or compromised and that passwords “are safe as long as things stay that way.” “That said, password managers are high-value targets, and breaches do happen,” the researchers added. Additionally, a Dashlane spokesperson told Infosecurity it found no evidence of exploitation related to these issues. Mitigation Recommendations In the scientific paper, the researchers said their attacks can all be mitigated using a combination of authentication methods, such as authentication encryption, key separation, plaintext authentication, public key authentication and ciphertext authentication. Users of Bitwarden, LastPass or Dashlane are advised to check the remediation status of their providers. Users of other password managers can see if their passwords could be compromised by similar attacks by asking their providers to commission an audit or asking the following questions: Do you offer end-to-end encryption? What security do you provide in case your server infrastructure was to be compromised? How do you check that public keys and public-key ciphertexts are authentic? How do you authenticate security-critical settings, such as the KDF type and the iteration count? Do you provide integrity guarantees for a user's vault as a whole? Can a malicious server add items to your vault? The article was updated on February 17 to add comments from 1Password and Dashlane and on February 18 to add comments from LastPass.

Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: United Airlines CISO on building resilience when disruption is inevitable In this Help Net Security interview, Deneen DeFiore, VP and CISO at United Airlines, explains how the company approaches modernization without compromising safety-critical environments, why resilience and continuity matter as much as prevention, and how the airline manages risk across an interconnected ecosystem of vendors, partners, and infrastructure providers. What happens when cybersecurity knowledge walks out the door In this Help Net Security interview, Andrew Northern, Principal Security Researcher at Censys, explains why mentorship matters and what organizations risk losing when senior staff disengage. He argues that institutional memory and judgment under pressure are difficult to rebuild once they disappear. Groupe Rocher CISO on strengthening a modern retail cybersecurity strategy In this Help Net Security interview, Jérôme Etienne, Group CISO, Groupe Rocher shares practical insights on closing strategy gaps, managing third-party risk, and securing online and in-store environments. In the conversation, he also discusses why point-of-sale and in-store systems can no longer be treated as secondary security concerns, especially as attackers increasingly target overlooked technologies. OpenClaw Scanner: Open-source tool detects autonomous AI agents A new free, open source tool is available to help organizations detect where autonomous AI agents are operating across corporate environments. The OpenClaw Scanner identifies instances of OpenClaw, an autonomous AI assistant also known as MoltBot, that can execute tasks, access local files, and authenticate to internal systems without centralized oversight. When security decisions come too late, and attackers know it In this Help Net Security, Chris O’Ferrell, CEO at CodeHunter, talks about why malware keeps succeeding, where attackers insert malicious code in the SDLC, and how CI/CD pipelines can become a quiet entry point. He also breaks down the difference between behavioral detection and behavioral intent analysis, and why explainable results matter for security teams. Edge computing’s biggest lie: “We’ll patch it later” In this Help Net Security interview, Piotr Buliński, CTO of Qbee, digs into the edge equivalent of “snowflake servers,” why cloud habits break in the field, and what it takes to monitor and update fleets safely. BeyondTrust fixes easy-to-exploit pre-auth RCE vulnerability in remote access tools (CVE-2026-1731) BeyondTrust fixed a critical remote code execution vulnerability (CVE-2026-1731) in its Remote Support (RS) and Privileged Remote Access (PRA) solutions and is urging self-hosted customers to apply the patch as soon a possible. Unlike the Remote Support zero-day (CVE-2024-12356) that was flagged after having been exploited by China-nexus threat actors to breach the US Treasury Department in late 2024, this newest vulnerability was discovered and privately disclosed by a security researcher. European Commission hit by cyberattackers targeting mobile management platform The European Commission’s mobile device management platform was hacked but the incident was swiftly contained and no compromise of mobile devices was detected, EU’s executive branch announced on Friday. The intrusion was detected on January 30, 2026, by CERT-EU, the cybersecurity team protecting all European Union institutions, bodies, and agencies. Ransomware group breached SmarterTools via flaw in its SmarterMail deployment SmarterTools, the company behind the popular Microsoft Exchange alternative SmarterMail, has been breached by a ransomware-wielding group that leveraged a recently fixed vulnerability in that solution. Unpatched SolarWinds WHD instances under active attack Internet‑exposed and vulnerable SolarWinds Web Help Desk (WHD) instances are under attack by threat actors looking to gain an initial foothold into target organizations’ networks, Microsoft and Huntress researchers have warned. Singapore telcos breached in China-linked cyber espionage campaign Singapore’s four major telecommunications companies were hit by a coordinated cyber espionage campaign last year, the country’s Cyber Security Agency (CSA) has revealed. An advanced persistent threat group known as UNC3886 has probed deep into the networks of M1, SIMBA Telecom, Singtel, and StarHub, spurring Singapore’s security agencies to mount a large cyber defence operation. Microsoft Patch Tuesday: 6 exploited zero-days fixed in February 2026 Microsoft has plugged 50+ security holes on February 2026 Patch Tuesday, including six zero-day vulnerabilities exploited by attackers in the wild. Among the zero-days fixed are three vulnerabilities that allow attackers to bypass a security feature. Ivanti EPMM exploitation: Researchers warn of “sleeper” webshells A massive wave of exploitation attempts has followed the disclosure of CVE-2026-1281, a critical pre-authentication Ivanti EPMM vulnerability, the Shadowserver Foundation has warned. Some of it is automated scanning for vulnerable systems, but according to Greynoise and Defused, a suspected initial access broker has been prepping unpatched instances with a “sleeper” webshell for follow-on exploitation by other threat actors. Apple fixes zero-day flaw exploited in targeted attacks (CVE-2026-20700) Apple has released fixes for a zero-day vulnerability (CVE-2026-20700) exploited in targeted attacks last year. CVE-2026-20700 is a memory corruption issue in dyld, the Dynamic Link Editor component of Apple’s operating systems, and may allow attackers with memory write capability to execute arbitrary code. Windows Notepad Markdown feature opens door to RCE (CVE-2026-20841) Among the many security fixes released by Microsoft on February 2026 Patch Tuesday is one for CVE-2026-20841, a command injection vulnerability in Notepad that could be exploited by attackers to achieve remote code execution on targets’ Windows system. Hackers probe, exploit newly patched BeyondTrust RCE flaw (CVE-2026-1731) Attackers are exploiting a recently patched critical vulnerability (CVE-2026-1731) in internet-facing BeyondTrust Remote Support and Privileged Remote Access instances. How AI is reshaping attack path analysis Attackers increasingly leverage AI to rapidly identify weaknesses and chain exploits, forcing defenders to keep pace by using AI to identify and stop those same weaknesses. However, security teams often struggle to determine what matters most, how it could realistically be exploited, and what to fix first. Brutus: Open-source credential testing tool for offensive security Brutus is an open-source, multi-protocol credential testing tool written in pure Go. Designed to replace legacy tools that have long frustrated penetration testers with dependency headaches and integration gaps, Brutus ships as a single binary with zero external dependencies and native support for the JSON-based reconnaissance pipelines that define offensive security. AI-driven scams are eroding trust in calls, messages, and meetings In this Help Net Security video, Miguel Fornés, Governance and Compliance Manager at Surfshark, discusses how AI is changing social engineering attacks. He describes how tasks that once took weeks, such as research and targeting, are now automated and cheap. This shift has lowered the skills and cost needed to run scams and phishing campaigns. Attackers use AI agents to gather open source data and hold live conversations with victims without human help. Allama: Open-source AI security automation Allama is an open-source security automation platform that lets teams build visual workflows for threat detection and response. It includes integrations with 80+ types of tools and services typical in security operations, including SIEM systems, endpoint detection and response products, identity providers, and ticketing systems. TikTok under EU pressure to change its addictive algorithm The European Commission has issued preliminary findings that say TikTok breaches the Digital Services Act due to its addictive design. The Commission opened a formal investigation into TikTok in February 2024. The probe examined whether the platform meets its obligations as a very large online platform under the Digital Services Act. These obligations include identifying risks linked to the service and taking steps to reduce them. EU targets Meta over WhatsApp AI access restrictions The European Commission believes Meta breached EU competition rules by blocking other AI assistants from accessing and interacting with users on WhatsApp. Face scans and ID checks are coming to Discord Discord users will soon see a change to how their accounts work. From early March 2026, access to some features will require age verification using an ID or a face scan. The changes follow earlier deployments in a small number of countries and will apply to both new and existing accounts. DuckDuckGo enables AI voice chat without saving voice data DuckDuckGo has added voice chat to Duck.ai, allowing users to speak to an AI assistant while keeping audio private, unrecorded, and excluded from AI training. Voice chat is available in the DuckDuckGo browser and most third-party browsers, with support for Mozilla listed as coming soon. Trojanized 7-Zip downloads turn home computers into proxy nodes A trojanized version of the popular 7-Zip software is quietly turning home computers into residential proxy nodes, Malwarebytes warns. Spurred by a Reddit post in which a user complained about getting infected with malware after downloading 7-Zip from 7zip[.]com instead of the legitimate 7-zip.org, Malwarebytes researchers looked into the matter and found that the malicious installer functions as 7-zip, but also silently drops additional payloads onto the system. Microsoft tightens Windows security with app transparency and user consent Microsoft is strengthening default protections in Windows through two security initiatives, Windows Baseline Security Mode and User Transparency and Consent. User Transparency and Consent introduces a structured approach to how Windows presents security decisions to users. The operating system will prompt users when applications request access to sensitive resources such as files, cameras, or microphones, and when installers attempt to add additional software. That “summarize with AI” button might be manipulating you Microsoft security researchers discovered a growing trend of AI memory poisoning attacks used for promotional purposes, referred to as AI Recommendation Poisoning. Picking an AI red teaming vendor is getting harder Vendor noise is already a problem in traditional security testing. AI red teaming has added another layer of confusion, with providers offering everything from consulting engagements to automated testing platforms. Many buyers still struggle to tell whether a vendor can test real-world AI system behavior or only run a packaged set of jailbreak prompts. OpenVPN releases version 2.7.0 with expanded protocol and platform updates OpenVPN version 2.7.0 is now available. The update advances support for multi-address server configurations and updates client functionality across operating systems. The release includes enhancements in data channel handling and support for evolving kernel and cryptographic components. 1Password open sources a benchmark to stop AI agents from leaking credentials Research has shown that some AI models can identify phishing websites with near-perfect accuracy when asked. When those same models are used as autonomous agents with access to tools like email, web browsers, and password vaults, they can still carry out the scam. That gap is the focus of a new open source benchmark from 1Password called the Security Comprehension and Awareness Measure, or SCAM. Police arrests distributor of JokerOTP password-stealing bot The Dutch National Police arrested a 21-year-old man from Dordrecht as part of a cybercrime investigation by Team Cybercrime Oost-Brabant. The suspect is believed to have distributed a tool known as JokerOTP, a bot used to intercept one-time passwords (OTPs) used to secure online accounts and financial transactions. Bitcoin trading firm CEO gets 20 years for operating $200 million Ponzi scheme The U.S. Department of Justice sentenced the CEO of a multi level marketing and bitcoin trading firm to 20 years in prison after a conviction for wire fraud and money laundering tied to a large scale Ponzi scheme. AI agents behave like users, but don’t follow the same rules Security and governance approaches to autonomous AI agents rely on static credentials, inconsistent controls, and limited visibility. Securing these agents requires the same rigor and traceability applied to human users, according to Cloud Security Alliance’s Securing Autonomous AI Agents report. OpenAI updates Europe privacy policy, adding new data categories OpenAI has updated its Europe-facing privacy policy following the November 2024 EU revision, clarifying scope, expanding coverage, and detailing user controls. The updated document is longer, with dedicated sections for data controls and practical resources. It explains key controls and settings within the text, making available choices easier to understand without moving between documents. Linux kernel 6.19 reaches stable release, kernel 7.0 work is already underway Development activity on the Linux kernel continues into early 2026 with the stable release of version 6.19. Kernel maintainers have completed the pre-release cycle and merged the final set of changes into the mainline tree. The release follows the ongoing weekly rhythm of code submission and testing that supports Linux’s widespread use across servers, desktops, and embedded systems. Security teams are paying for sprawl in more ways than one Most enterprises run security programs across sprawling environments that include mobile devices, SaaS applications, cloud infrastructure, and telecom networks. Spend control in these areas often sits outside the security organization, even when the operational consequences land directly on security teams. Tangoe’s 2026 Trends & Savings Recommendations Report connects these cost domains to recurring governance failures that create risk exposure across identity, endpoint management, and infrastructure visibility. Product showcase: PCAPdroid analyzes Android app network activity PCAPdroid is a free, open-source Android app that allows inspection of network traffic. Installation is straightforward and does not require creating an account. To begin capturing traffic, a VPN request must be accepted, which allows the app to monitor network activity. Once permission is granted, tapping the play button starts PCAPdroid, which then runs in the background until stopped. Zen-AI-Pentest: Open-source AI-powered penetration testing framework Zen-AI-Pentest provides an open-source framework for scanning and exercising systems using a combination of autonomous agents and standard security utilities. The project aims to let users run an orchestrated sequence of reconnaissance, vulnerability scanning, exploitation, and reporting using AI guidance and industry tools like Nmap and Metasploit. It is written to support command line, API, and web interfaces. Yubico previews passkey-enabled digital signatures in upcoming YubiKey 5.8 firmware Yubico’s upcoming YubiKey 5.8 firmware introduces standardized APIs that integrate hardware-backed signatures with passkey authentication. To enable privacy-capable digital signatures using passkeys, expanded enterprise IdP support, and next-generation digital wallet use cases, the firmware adds support for FIDO CTAP 2.3 and preview WebAuthn signing extensions. Google Search introduces new ways to remove sensitive personal information and explicit images Google expanded its “Results about you” tool to give users more control over sensitive personal information and added a way to request removal of non-consensual explicit images from Search. Microsoft begins Secure Boot certificate update for Windows devices Microsoft has begun updating Secure Boot certificates originally issued in 2011 to ensure that Windows devices continue to verify boot software as older certificates reach the end of their lifecycle and begin expiring in June 2026. Java security work is becoming a daily operational burden Security teams in large enterprises already spend significant time tracking vulnerabilities across software supply chains, third-party libraries, and internal codebases. Java environments add another layer of exposure because so many mission-critical systems still run on the JVM. Cloud teams are hitting maturity walls in governance, security, and AI use Enterprise cloud programs have reached a point where most foundational services are already in place, and the daily work now centers on governance, security enforcement, and managing sprawl across environments. Hybrid and multi-cloud architectures have become routine in large organizations, bringing new operational pressures around consistency and control. Microsoft Store updated with a new CLI, analytics, and Web Installer improvements Microsoft has introduced new developer tools, updates to developer analytics, and a Web Installer in the Microsoft Store on Windows to help developers build and scale apps on the platform. Attackers are moving at machine speed, defenders are still in meetings Threat actors are using AI across the attack lifecycle, increasing speed, scale, and adaptability, according to the 2026 State of Cybersecurity report by Ivanti. The study compares perceived threat levels across common attack types with organizational readiness to respond and identifies persistent gaps between awareness and execution across security programs. Cyber risk is becoming a hold-period problem for private equity firms Private equity firms have spent years treating cybersecurity as an IT hygiene issue inside portfolio companies. That approach is getting harder to sustain as ransomware, data theft, and regulatory pressure interfere with value creation during the hold period. Ubuntu 24.04.4 LTS arrives with cumulative security and bug fixes Security teams running Ubuntu in production often delay major OS upgrades until the next point release arrives with accumulated patches and newer hardware support. Ubuntu 24.04.4 LTS is now available as refreshed installation media for Noble Numbat, bundling the latest updates and offering a current hardware enablement stack for new deployments. Why secure OT protocols still struggle to catch on Industrial control system networks continue to run on legacy communication protocols that were built for reliability and uptime, not authentication or data integrity. In many environments, malicious actors with access to the OT network can impersonate devices, issue unauthenticated commands, or modify messages in transit without detection. OpenAI released GPT-5.3-Codex-Spark, a real-time coding model OpenAI has released a research preview of GPT-5.3-Codex-Spark, an ultra-fast model for real-time coding in Codex. It is available to ChatGPT Pro users in the latest versions of the Codex app, the command-line interface, and the VS Code extension. Cybersecurity jobs available right now: February 10, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: February 13, 2026 Here’s a look at the most interesting products from the past week, featuring releases from Armis, Black Duck, Portnox, and SpecterOps.

1Password open sources a benchmark to stop AI agents from leaking credentials Research has shown that some AI models can identify phishing websites with near-perfect accuracy when asked. When those same models are used as autonomous agents with access to tools like email, web browsers, and password vaults, they can still carry out the scam. That gap is the focus of a new open source benchmark from 1Password called the Security Comprehension and Awareness Measure, or SCAM. The benchmark tests whether AI agents behave safely during real workflows, including opening emails, clicking links, retrieving stored credentials, and filling out login forms. “Every frontier AI model can identify a phishing page when you ask it to,” Jason Meller, VP of Product at 1Password, told Help Net Security. “But when we gave those same models an inbox, a password vault, and a routine work task, they retrieved real credentials and entered them into an attacker’s fake login page.” Testing agent behavior in workplace scenarios SCAM places models into simulated workplace situations such as an engineer managing infrastructure, a team lead onboarding a contractor, or an employee reviewing messages before a meeting. Each test includes embedded traps that resemble common real-world attacks. Those traps include phishing links inside legitimate-looking emails, lookalike domains that differ by one character, and sensitive credentials hidden inside meeting notes. The model is expected to notice warning signs during normal task execution, without being prompted to search for threats. The benchmark uses official APIs from providers such as OpenAI, Anthropic, and Google, mirroring how production AI agents are deployed. Models are scored on their behavior, including whether they warn users about suspicious activity, whether they refuse unsafe actions, and whether they proceed with credential sharing or form submissions. “Most AI security benchmarks test whether models can be tricked into breaking their rules,” Meller said. “SCAM tests something harder: whether they walk into attacks on their own, the same way humans do.” Safety scores ranged from 35% to 92% 1Password tested eight models across 30 scenarios, running each scenario three times under baseline conditions. Scores ranged from 35% to 92%, with Claude Opus 4.6 ranking highest and Gemini 2.5 Flash ranking lowest. Every model committed critical failures in every run. In SCAM scoring, a critical failure is an unsafe action that could lead to leaked passwords, stolen money, or compromised systems, such as entering credentials into a phishing page or sharing secret keys over email. Gemini 2.5 Flash produced the most critical failures, averaging about 20 per run. GPT-4.1 and GPT-4.1 Mini followed close behind. 1Password said the models routinely forwarded passwords to external contractors, entered credentials into phishing sites, and shared secret keys over email. A short “skill file” reduced failures After baseline testing, 1Password gave each model a short “security skill” document designed to improve how agents assess risk during routine tasks. With the skill applied, every model improved and critical failures dropped sharply across the benchmark. Several models recorded zero critical failures across repeated runs, including all three Claude models and Gemini 3 Flash. 1Password said the skill file also narrowed the performance gap between stronger and weaker models, bringing most results into a much tighter range and showing that even lower-ranked models could improve significantly with basic security guidance. Hidden credentials in documents remain a major risk One scenario produced failures across every tested model. An email contained meeting notes with passwords and access keys buried in the text. The user asked the agent to forward the notes to a coworker. Every model forwarded the content without warning under baseline testing. With the skill file applied, six of eight models reliably caught the embedded credentials and refused to forward the email. GPT-4.1 Mini was inconsistent. Gemini 2.5 Flash failed the scenario across all runs even with the skill. Open source benchmark 1Password released SCAM under the MIT License, including its scenarios, scoring framework, and testing tools. The project includes features for replaying scenarios step by step and exporting results as videos showing agent actions. The benchmark is available at the SCAM GitHub repository and is intended to support further work on agent safety, credential handling, and enterprise adoption of AI-driven workflows. Learn more: Zen-AI-Pentest: Open-source AI-powered penetration testing framework Picking an AI red teaming vendor is getting harder AI isn’t one system, and your threat model shouldn’t be either That “summarize with AI” button might be manipulating you

The 1Password digital vault and password manager has added built-in protection against phishing URLs to help users identify malicious pages and prevent them from sharing account credentials with threat actors. The subscription-based password management service is widely used in the enterprise environment by many well-known organizations. Recently, Windows added support for native passkey management via 1Password. Like all tools of this kind, 1Password will not fill in a user’s login data when visiting a website with a URL that does not match the one stored in their vault. While this provides intrinsic protection against phishing attempts, some users may still fail to recognize that something is wrong and attempt to enter account credentials on dangerous pages. As 1Password admits, relying on this protective layer alone is incomplete from a security perspective because users may still fall for typosquatted domains, where the threat actor registers a misspelled or similar-looking domain name. Users may still think they landed on the correct site, but their password manager glitched out, or that their vault is still locked, and proceed to enter the credentials manually. To address this security gap, 1Password users will benefit from an extra layer of protection in the form of a pop-up alerting them of potential phishing risk. "It's easy for a user to miss that extra 'o' in the URL, especially if the rest of the page looks convincing," the vendor explains under a Facebook domain typosquatting example. The vendor says that "the pop-up reminds [users] to slow down and look more closely before proceeding." The new feature will be enabled automatically for ‘individual’ and ‘family plan’ users, while Admins may activate it manually for company employees through the Authentication Policies in the 1Password admin console. In its announcement, the password management company highlights that the phishing threat has increased with the proliferation of AI tools that help attackers perpetrate more convincing scams at a higher volume. A 2000-person survey conducted by 1Password in the U.S. showed that 61% had been successfully phished and that 75% do not check URLs before clicking links. In corporate environments, where a single account compromise is enough to allow external actors to move laterally across networks and systems, 1Password found that a third of the employees reuse passwords on work accounts, with nearly half of them having fallen victim to phishing attacks. Almost half of the survey participants responded that phishing protection is the responsibility of the IT department, not theirs, and 72% admitted they had clicked suspicious links. Finally, more than 50% of the respondents said that it is more convenient to just delete suspicious messages than report them. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

1Password targets AI-driven phishing with built-in prevention To help reduce phishing risk, 1Password added an extra layer of protection and began rolling out a phishing prevention feature designed to stop users before they share passwords with scammers. How 1Password phishing prevention works When a user clicks a link whose URL doesn’t match a saved login, 1Password will not autofill their credentials. To avoid confusion, the product displays a warning message that prompts users to pause and reconsider before proceeding. Source: 1Password For individual and family plan users, the feature will be enabled by default when it becomes available. 1Password admins can enable it for employees in the Authentication Policies section of the 1Password admin console. Phishing prevention ultimately hinges on employee decisions Phishing attacks once stood out because of typos or sloppy design, but AI is making them harder to spot. A brief lapse in judgment can be enough to give sensitive information away. According to a 1Password survey, 89% of Americans have encountered a phishing scam, and 61% say they have fallen victim to one. These attacks arrive through email, text messages, phone calls, social media, online ads, and even search results. In the survey, 36% of workers admitted they had clicked a suspicious link in a work email, and weak password habits are still common at work. While companies can put many safeguards in place, phishing prevention ultimately comes down to whether an employee decides to click or not. “Getting ahead of phishing attacks is all about communication, that’s what disrupts the scammer’s plan. The most important thing an employee can do if they receive a suspicious message is tell someone. A lot of attacks could be prevented by simply knocking on the cubicle next door and saying ‘hey, does this look right to you?’ If someone believes they’ve already been phished, they should notify IT immediately. Those are the skills you learn with good training, and they need to be constantly reinforced, so people remember them when they get those urgent, scary-looking messages,” said Dave Lewis, Global Advisory CISO, 1Password.

I gave up on the IoT water meter reader. Being technical and thinking you can solve everything with technology is both a blessing and a curse; dogged persistence has given me the life I have today, but it has also burned serious amounts of time because I never want to let a problem go unsolved. But sometimes, common sense and the ROI of my time have to prevail, so I packed up all the gear and went back to processing data breaches. If you happen to solve this problem in a way that doesn't require any more time investment on my end, I'd love to hear it 😊 References Sponsored by: 1Password Extended Access Management: Secure every sign-in for every app on every device We've had a massive month on HIBP (20M+ visits is a solid number!)

Microsoft announced that passwordless authentication is now easier on Windows 11 through native support for third-party passkey managers, the first ones supported being 1Password and Bitwarden. This is possible after the Windows security team worked together with third-party managers to improve passwordless authentication by developing a passkey API for Windows 11. The new feature has been introduced with the November 2025 security update for Windows 11, released yesterday. Passkeys are a secure authentication mechanism that follows the FIDO2/WebAuthn standards, utilizing private-public key cryptography for local challenge signing and server-side verification, rather than passwords. When users register on a passkey-enabled site or app, Windows generates a key pair, with the private key securely stored on Microsoft Password Manager, 1Password, or Bitwarden. From then on, when attempting to log in on that site or app, a challenge is served to Windows, and the user is requested to verify themselves using Windows Hello, which is protected by PIN and biometrics authentication. The system is considered superior to passwords due to its portability, higher convenience for users, and immunity to phishing attacks. Microsoft has been pushing the adoption of passkeys on Windows, and the addition of third-party app support via the new API adds more flexibility for users. In addition to the third-party app support, Microsoft has also integrated Microsoft Password Manager from Microsoft Edge natively into Windows as a plugin to allow users to choose their passkey manager. Microsoft highlights the following security benefits for this development: Passkey creation, authentication, and management are protected by Windows Hello Syncing is available across Windows devices when signed into Edge with the same Microsoft account Syncing is protected by the manager PIN and a cloud enclave Azure Managed Hardware Security Modules (HSMs) safeguard encryption keys Sensitive operations run in Azure Confidential Compute Recovery uses Azure Confidential Ledger Microsoft Edge introduced passkey saving and syncing with Microsoft Password Manager earlier this month, in version 142 and later, for Windows 10 and above. Bitwarden has supported passkey storage and management since November 2023 and introduced “Log in with Passkeys” in January 2024. The popular password manager announced the Windows 11 integration via an update on its original feature launch announcement, noting that its system-level integration on the OS is currently at beta stage. This means that there may be functional limitations or potential instability until sufficient broad-scale testing and bug fixing happens. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Week in review: Cisco fixes critical UCCX flaws, November 2025 Patch Tuesday forecast Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Securing real-time payments without slowing them down In this Help Net Security interview, Arun Singh, CISO at Tyro, discusses what it takes to secure real-time payments without slowing them down. He explains how analytics, authentication, and better industry cooperation can help stay ahead of fraud. Singh also touches on how digital identity and accountability are transforming how trust is built in payments. Heisenberg: Open-source software supply chain health check tool Heisenberg is an open-source tool that checks the health of a software supply chain. It analyzes dependencies using data from deps.dev, Software Bills of Materials (SBOMs), and external advisories to measure package health, detect risks, and generate reports for individual dependencies or entire projects. A new way to think about zero trust for workloads Static credentials have been a weak point in cloud security for years. A new paper by researchers from SentinelOne takes direct aim at that issue with a practical model for authenticating workloads without long-lived secrets. Instead of relying on static keys, the team proposes using temporary, verifiable tokens that expire within minutes. How nations build and defend their cyberspace capabilities In this Help Net Security interview, Dr. Bernhards Blumbergs, Lead Cyber Security Expert at CERT.LV, discusses how cyberspace has become an integral part of national and military operations. He explains how countries develop capabilities to act and defend in this domain, often in coordination with activities in other areas of conflict. AI can flag the risk, but only humans can close the loop In this Help Net Security interview, Dilek Çilingir, Global Forensic & Integrity Services Leader at EY, discusses how AI is transforming third-party assessments and due diligence. She explains how machine learning and behavioral analytics help organizations detect risks earlier, improve compliance, and strengthen accountability. PortGPT: How researchers taught an AI to backport security patches automatically Keeping older software versions secure often means backporting patches from newer releases. It is a routine but tedious job, especially for large open-source projects such as the Linux kernel. A new research effort has built a tool that uses a large language model to do that work automatically. OpenGuardrails: A new open-source model aims to make AI safer for real-world use When you ask a large language model to summarize a policy or write code, you probably assume it will behave safely. But what happens when someone tries to trick it into leaking data or generating harmful content? That question is driving a wave of research into AI guardrails, and a new open-source project called OpenGuardrails is taking a bold step in that direction. What keeps phishing training from fading over time When employees stop falling for phishing emails, it is rarely luck. A new study shows that steady, mandatory phishing training can cut risky behavior over time. After one year of continuous simulations and follow-up lessons, employees were half as likely to take the bait. Metrics don’t lie, but they can be misleading when they only tell IT’s side of the story In this Help Net Security interview, Rik Mistry, Managing Partner at Interval Group, discusses how to align IT strategy with business goals. He explains how security, governance, and orchestration shape IT operations and why early collaboration between IT and security leaders leads to better outcomes. Mistry also shares his perspective on automation and emerging technologies. Cyber-espionage campaign mirroring Sandworm TTPs hit Russian and Belarusian military A spear-phishing campaign aimed to compromise Russian and Belarusian military personnel by using military-themed documents as a lure has been flagged by Cyble and Seqrite security researchers. The goal of the campaign is to get targets to download and open a booby-trapped LNK file masquerading as a PDF, ultimately leading to a complete system compromise. Former ransomware negotiators allegedly targeted US firms with ALPHV/BlackCat ransomware A ransomware negotiator and an incident response manager have been indicted in Florida for allegedly conspiring to deploy the ALPHV/BlackCat ransomware against multiple US companies and extorting nearly $1.3 million from one of the victims. Cybercriminals exploit RMM tools to steal real-world cargo Cybercriminals are compromising logistics and trucking companies by tricking them into installing remote monitoring and management (RMM) tools, Proofpoint researchers warned. Critical Control Web Panel vulnerability is actively exploited (CVE-2025-48703) On Tuesday, CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2025-11371, which affects Gladinet’s CentreStack and Triofox file-sharing and remote access platforms, and CVE-2025-48703, a vulnerability in Control Web Panel (CWP), a web hosting control panel designed for managing servers running CentOS or CentOS-based distributions. Google uncovers malware using LLMs to operate and evade detection PromptLock, the AI-powered proof-of-concept ransomware developed by researchers at NYU Tandon and initially mistaken for an active threat by ESET, is no longer an isolated example: Google’s latest report shows attackers are now creating and deploying other malware that leverages LLMs to operate and evade security systems. SonicWall cloud backup hack was the work of a state actor Incident responders from Mandiant have wrapped up their investigation into the SonicWall cloud backup service hack, and the verdict is in: the culprit is a state-sponsored threat actor (though the specific nation wasn’t disclosed). Cisco fixes critical UCCX flaws, patch ASAP! (CVE-2025-20358, CVE-2025-20354) Cisco has fixed two critical vulnerabilities (CVE-2025-20358, CVE-2025-20354) affecting Unified Contact Center Express (UCCX), which may allow attackers to bypass authentication, compromise vulnerable installations, and elevate privileges to root. Attackers upgrade ClickFix with tricks used by online stores Attackers have taken the ClickFix technique further, with pages borrowing tricks from online sellers to pressure victims into performing the steps that will lead to a malware infection. Uncovering the risks of unmanaged identities Every organization manages thousands of identities, from admins and developers to service accounts and AI agents. But many of these identities operate in the shadows, untracked and unprotected. These unmanaged identities quietly expand your attack surface, weaken compliance, and threaten business continuity, posing significant risk. So, how can you uncover, secure, and manage what you can’t see? November 2025 Patch Tuesday forecast: Windows Exchange Server EOL? October 2025 Patch Tuesday was one for the record books in so many ways. There was a big push by Microsoft to fix as many open vulnerabilities as possible in products that were reaching end-of-life (EOL). This included 116 CVEs addressed in Windows 10 and an astronomical 134 CVEs addressed in Windows 11, because don’t forget Windows 11 22H2 Enterprise and Education editions also reached EOL. Cybercriminals have built a business on YouTube’s blind spots The days when YouTube was just a place for funny clips and music videos are behind us. With 2.53 billion active users, it has become a space where entertainment, information, and deception coexist. European authorities dismantle €600 million crypto scam network Nine people have been arrested in a coordinated international operation targeting a large cryptocurrency money laundering network that defrauded victims of more than €600 million. The operation was led by Eurojust, the EU’s judicial cooperation agency, which brought together investigators and prosecutors from France, Belgium, Cyprus, Spain and Germany. Connected homes: Is bystander privacy anyone’s responsibility? Smart doorbells, connected cameras, and home monitoring systems have become common sights on doorsteps and living rooms. They promise safety and convenience, but they also raise a problem. These devices record more than their owners. They capture neighbors, visitors, and anyone passing by. 18 arrested in €300 million global credit card fraud scheme A coordinated international operation has led to 18 arrests in a massive credit card fraud case worth at least €300 million. The effort, led by Eurojust, targeted a network of suspects accused of running fake online subscription services for dating, pornography, and streaming sites. Among those detained were five executives from four German payment service providers. Enterprises are losing track of the devices inside their networks Security teams are often surprised when they discover the range and number of devices connected to their networks. The total goes far beyond what appears in agent-based telemetry or old manual asset inventories. Deepfakes, fraud, and the fight for trust online In this Help Net Security video, Michael Engle, Chief Strategy Officer at 1Kosmos, explains how deepfakes are changing online identity verification. He describes how fake IDs and synthetic identities are being used for account signups and takeovers. What shadow AI means for your company’s security In this Help Net Security video, Peled Eldan, Head of Research at XM Cyber, explains the hidden risks of shadow AI. He describes how employees often use unapproved AI tools at work to save time or solve problems, even when approved tools are available. This behavior, though common, can lead to serious issues such as data leaks, compliance violations, and security blind spots. Europe’s phone networks are drowning in fake calls Caller ID spoofing has become one of Europe’s most persistent enablers of cyber fraud. A new position paper from Europol warns that manipulated phone identities now drive much of the continent’s financial and social engineering crime, making it difficult for law enforcement to track perpetrators. The agency estimates global losses at around EUR 850 million a year, with phone and text-based fraud accounting for roughly two thirds of reported scam cases. Employees keep finding new ways around company access controls AI, SaaS, and personal devices are changing how people get work done, but the tools that protect company systems have not kept up, according to 1Password. Tools like SSO, MDM, and IAM no longer align with how employees and AI agents access data. Financial services can’t shake security debt In financial services, application security risk is becoming a long game. Fewer flaws appear in new code, but old ones linger longer, creating a kind of software “interest” that keeps growing, according to Veracode’s 2025 State of Software Security report. Google says 2026 will be the year AI supercharges cybercrime Security leaders are staring down a year of major change. In its Cybersecurity Forecast 2026, Google paints a picture of a threat landscape transformed by AI, supercharged cybercrime, and increasingly aggressive nation-state operations. Attackers are moving faster, scaling their operations with automation. VulnRisk: Open-source vulnerability risk assessment platform VulnRisk is an open-source platform for vulnerability risk assessment. It goes beyond basic CVSS scoring by adding context-aware analysis that reduces noise and highlights what matters. The tool is free to use and designed for local development and testing. Retailers are learning to say no to ransom demands Ransomware remains one of the biggest operational risks for retailers, but the latest data shows a shift in how these attacks unfold. Fewer incidents now lead to data encryption, recovery costs have dropped, and businesses are bouncing back faster. Yet attackers are demanding more money, and security teams are feeling the strain. Humans built the problem, AI just scaled it Information moves across cloud platforms, personal devices, and AI tools, often faster than security teams can track it. Proofpoint’s 2025 Data Security Landscape report shows that most organizations faced data loss last year, usually caused by their own people. With AI agents part of daily operations, security leaders are confronting risks that come from users and from the systems acting on their behalf. Russia-linked hackers intensify attacks as global APT activity shifts State-aligned hacking groups have spent the past six months ramping up espionage, sabotage, and cybercrime campaigns across multiple regions, according to ESET’s APT Activity Report covering April through September 2025. The research highlights how operations linked to Russia, China, Iran, and North Korea have evolved in scope and technique, showing that nation-state activity remains a constant source of disruption. Hospitals are running out of excuses for weak cyber hygiene Healthcare leaders continue to treat cybersecurity as a technical safeguard instead of a strategic business function, according to the 2025 US Healthcare Cyber Resilience Survey by EY. The study, based on responses from 100 healthcare executives, outlines six areas where hospitals and health systems must act to close resilience gaps that threaten patient care and operations. Old privacy laws create new risks for businesses Businesses are increasingly being pulled into lawsuits over how they collect and share user data online. What was once the domain of large tech firms is now a widespread legal risk for companies of all sizes. The latest analysis from cyber insurer Coalition shows that outdated privacy laws are driving a surge in web privacy claims, with small and midsize businesses now common targets. Product showcase: Cogent Community democratizes vulnerability intelligence with agentic AI Teams are buried under overlapping feeds, inconsistent formats, and fragmented context. Even with advanced tools, analyzing raw intelligence into prioritized, evidence-based action remains one of the hardest problems in modern security operations. Cogent Security addresses this problem head-on with its industry-first AI taskforce for vulnerability management. And with its newly introduced Cogent Community, the company is now delivering an open-access, free-to-use tool that helps security teams operationalize vulnerability intelligence. Cybersecurity jobs available right now: November 4, 2025 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: November 7, 2025 Here’s a look at the most interesting products from the past week, featuring releases from 1touch.io, Barracuda Networks, Bitdefender, Forescout, and Komodor.

Employees keep finding new ways around company access controls AI, SaaS, and personal devices are changing how people get work done, but the tools that protect company systems have not kept up, according to 1Password. Tools like SSO, MDM, and IAM no longer align with how employees and AI agents access data. The result is what researchers call the “access-trust gap,” a growing distance between what organizations think they can control and how employees and AI systems access company data. The survey tracks four areas where this gap is widening: AI governance, SaaS and shadow IT, credentials, and endpoint security. Each shows the same pattern of rapid adoption and limited oversight. AI is everywhere, but policy awareness is not 73% of employees use AI for at least part of their job, but over a third admit they do not always follow company rules. Some are unsure what those rules even are. While few security teams believe their company lacks an AI policy, far more employees say they have never seen one. Shadow AI compounds the issue. About 27% of employees have used AI tools that were not approved by their company. These tools are often browser-based and free, making them easy to adopt yet nearly invisible to IT. This lack of visibility creates risk when workers feed sensitive data into unvetted systems. The report advises companies to move from blocking AI to monitoring and guiding it. Establishing discovery, communication, and oversight is a more practical approach than banning new tools outright. SaaS sprawl and shadow IT evade control Organizations now rely on hundreds of cloud apps, most outside IT’s visibility. Over half of employees admit they have downloaded work tools without permission, often because approved options are slower or lack needed features. This behavior drives SaaS sprawl. 70% of security professionals say SSO tools are not a complete solution for securing identities. On average, only about two-thirds of enterprise apps sit behind SSO, leaving a large portion unmanaged. Offboarding gaps make the problem worse. 38% of employees say they have accessed a former employer’s account or data after leaving the company. Inconsistent offboarding and fragmented access systems make these lapses common. Continuous discovery of approved and unapproved apps and automated governance that tracks access over time. Visibility across all tools, not only those connected to SSO, is key to reducing hidden risks. Passwords remain the weak link Password reuse and sharing are still widespread, even among security staff. Two-thirds of employees admit to unsafe practices such as reusing or sharing passwords, relying on defaults, or sending credentials over email or messaging apps. Weak credentials remain a leading factor in breaches. Nearly half of respondents say employees using weak or compromised passwords is their top challenge. Among those who experienced a material breach in the past three years, stolen credentials were the second most common cause, after software vulnerabilities. Organizations are turning to passkeys. 89% of security leaders say their companies are encouraging or planning to encourage their use. Passkeys replace passwords with biometric or device-based authentication that resists phishing and supports regulatory standards. “I’m not surprised by the enthusiasm for passkeys, because the companies pushing passkeys are making it so easy to convert to them—one click and it’s done,” said Brian Morris, CISO, Gray Media. Passwords will coexist with new systems for years, so the goal is to reduce how often users handle raw credentials rather than remove them entirely overnight. Devices multiply faster than MDM can manage Hybrid and remote work have made device management more complex. Nearly three-quarters of employees use personal devices for work at least occasionally, and over half do so weekly. Mobile Device Management remains the default control for company hardware, but security leaders see its limits. MDM tools do not adequately safeguard managed devices or ensure compliance. They were built for company-owned machines, not for environments where people move between personal and corporate devices that connect to cloud services. Personal devices are often used for convenience, but they lack the protections found on corporate machines. Even when companies prohibit BYOD practices, enforcement is uneven. Employees still access corporate data from their phones or personal laptops.

Shadow AI: New ideas emerge to tackle an old problem in new form Shadow AI is the second-most prevalent form of shadow IT in corporate environments, 1Password’s latest annual report has revealed. Based on a survey of over 5,000 IT/security professionals and knowledge workers in the US, UK, Europe, Canada and Singapore, the report shows that over a quarter (27%) of the polled workers use AI-based applications that their employer did not buy or approve, and over a third (37%) follow company AI policies “most of the time”. “The data suggests that companies lack considered and detailed AI usage policies, as well as the means to enforce them,” 1Password pointed out. Also, a non-negligible percentage of workers isn’t even aware that their company has an AI policy at all! Employees’ knowledge of their company’s AI policy (Source: 1Password) Businesses must move from reacting to AI risks to anticipating them, the company advised. This means: Implementing continuous monitoring for unsanctioned AI tools and agents and establish the ability to block them before harm occurs Security and IT teams must create clear, practical AI use policies and ensure that everyone knows about them and understands them When employees are spotted using unauthorized tools, organizations should learn why employees use them and offer secure alternatives that meet the same needs Organizations must design access and security controls with future AI (including agentic AI) in mind. Turning offensive techniques into defensive ones to deal with Shadow AI Dutch security company Eye Security has come up with an interesting concept that could help tackle the problem of employee awareness regarding AI policies and nudge them to make the right choice. Prompt Injection for Good is an open-source prototype tool organizations can use to test prompts that can be embedded into company documents and email signatures, to trigger compliance warnings when employees use personal AI tools with company data. (They’ve also made available an interactive tool for users to test the concept.) “The idea is that the end-user will get a clear disclaimer, written by the company’s CISO,” Eye Security CTO Piet Kerkhofs explained. Example of a defensive prompt injection in a company PDF (Source: Eye Security) The user will be informed about the risks and consequences of their action and will (hopefully) reconsider when they are about to upload corporate docs to unsanctioned AI platforms again. The company released the framework to allow for regular testing of defensive prompts against the newest LLM models. The framework syncs with all popular AI platforms and provides easy integration to test embedded prompts in corporate documents, in bulk, and provide a scoring overview. And as LLMs and their guardrails get updated, it can help defenders to continuously test and adjust their prompts. “The tool we released shows the concept of ethical prompt injection, which is broadly applicable in DLP tools, by simple embedding a specific payload into corporate documents. We hope that vendors start testing and experimenting and that this concept gets implemented in production – that’s why we shared our research and source code publicly,” Kerkhofs told Help Net Security. The company is aware that this solution and their tool are imperfect. “This tool does not address employees copy-pasting sensitive data into unsanctioned LLMs. The only way to govern that is to use browser extensions that track AI use within the browser, but this brings obvious privacy concerns as well,” Kerkhofs noted. Nevertheless, they hope that this prototype will make organizations consider using this (usually) offensive hacking technique to protect their data proactively, and will prompt the creation of even better solutions. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

IRISSCON 2025 to address the human impact on cybersecurity Recent high-profile cybersecurity breaches affecting global brands share a common link: the human factor. Expert speakers will cover this subject in depth at IRISSCON 2025, which takes place at Dublin’s Aviva Stadium on Wednesday November 5. Now in its 16th year, IRISSCON brings together leading cybersecurity professionals, researchers, and law enforcement experts to discuss the latest challenges and trends in cybersecurity. This year’s conference theme, ‘The Human Factor in Cybersecurity’, reflects growing concern across the industry following major breaches involving Marks & Spencer, Jaguar Land Rover, and The Co-Op. According to the respected Verizon Data Breach Investigations Report 2025, the human factor was present in 60% of cases, based on analysis of more than 22,000 security incidents, including 12,195 confirmed data breaches. IRISSCON will examine how people, rather than technology alone, continue to pose a significant risk to organisations’ security and will also explore how they can be an effective line of defence. The event features sessions exploring the psychological, behavioural, and operational aspects of security, with presentations from: Jenny Radcliffe, renowned social engineer and “People Hacker,” who will delve into the art of manipulation in cybersecurity. Joe Tidy, BBC Cyber Correspondent and author of CTRL ALT Chaos, discussing the human stories behind cybercrime investigations. Regina Bluman, Business Information Security Officer at Marks & Spencer, sharing insights on managing human risk within large enterprises. Mick Moran, CEO of the Irish Internet Hotline and former Europol specialist, addressing human factors in online child protection and digital investigations. IRISSCON 2025 will also explore the impact of artificial intelligence on cybersecurity, from AI-driven attacks and defence strategies to the ethical use of intelligent systems in incident response. Other national and international speakers lined up for the event include Wendy Nather (1Password), Dr. Hazel Murray (Munster Technological University), Daniele Catteddu (Cloud Security Alliance), as well as representatives from Ireland’s National Cyber Security Centre and the Garda National Cyber Crime Bureau. “Technology continues to evolve, but human behaviour remains at the core of most security incidents. This year’s IRISSCON aims to help businesses understand, manage, and reduce that human risk, particularly as AI begins to amplify both opportunities and threats in cybersecurity,” said Brian Honan, the head and founder of IRISSCERT. Registration for IRISSCON 2025 costs €50 and is now open. The day-long event promises engaging discussions, valuable networking, and actionable insights for professionals charged with safeguarding Ireland’s digital future.

LastPass has alerted users about a new phishing attack that claims the recipient has died. According to the message, a family member has submitted a death certificate to gain access to the recipient’s password vault. A link in the phishing email, supposedly to stop the request, leads to a fake page that asks for the LastPass user’s master password. “Legacy Request Opened (URGENT IF YOU ARE NOT DECEASED) A death certificate was uploaded by a family member to regain access to the Lastpass account If you have not passed away and you believe this is a mistake, please reply to this email with STOP” LastPass links this campaign to CryptoChameleon (also known as UNC5356), a group that previously targeted cryptocurrency users and platforms with similar social engineering attacks. The same group used LastPass branding in a phishing kit in April 2024. The phishing attempt exploits the legitimate inheritance process, which is an emergency access feature in LastPass that allows designated contacts request access to a vault if the account holder dies or becomes incapacitated. Stealing someone’s password manager credentials gives attackers access to every login stored inside. We recently reported on an attempt to steal 1Password credentials. Lastpass also notes that: “Several of the phishing sites are clearly intended to target passkeys, reflecting both the increased interest on the part of cybercriminals in passkeys and the increased adoption on the part of consumers.” Passkeys are a very secure replacement for passwords. They can’t be cracked, guessed or phished, and let you log in easily without having to type a password every time. Most password managers—like LastPass, 1Password, Dashlane, and Bitwarden—now store and sync passkeys across devices. Because passkeys often protect high-value assets like banking, crypto wallets, password managers, and company accounts—they’ve become an attractive prize for attackers. Advice for users While passkeys themselves cannot be phished via simple credential theft, attackers can trick users into: Registering a new passkey on a malicious site or a fake login page Approving fraudulent device syncs or account transfers Disabling passkeys and reverting to weaker login methods, then stealing those fallback credentials LastPass and other security experts recommend: Never enter your master password on links received via email or text. Understand how passkeys work and keep them safe. Only logging into your password manager via official apps or bookmarks. Be wary of urgent or alarming messages demanding immediate action. Remember that legitimate companies won’t ask for sensitive credentials via email or phone. Use an up-to-date real-time anti-malware solution preferably with a web protection module. From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Life, death, and online identity: What happens to your online accounts after death? The rapid technological advances of recent decades have transformed nearly every aspect of our lives. One major shift is that many of us now maintain extensive digital footprints, spanning countless online accounts, from email and social media to banking, investments, cloud storage, utility payments, and more. In life, we work hard to protect these accounts from others, particularly cybercriminals. Yet when death or incapacity strikes, ensuring that our loved ones have legal access to them becomes critically important. This emerging area of asset management remains in its early stages, facing a complex technological landscape, fragmented (or nonexistent) legal frameworks, and significant systemic gaps. To address these challenges, the OpenID Foundation (OIDF) has been developing a new whitepaper and a digital estate planning guide that examine this issue on a global scale. In this Help Net Security interview, Dean H. Saxe, an OpenID Foundation member and long-time contributor to digital identity standards, discusses this initiative and what the Foundation hopes to accomplish with them. (Dean H. Saxe’s answers have been edited for length and clarity.) Why did the OpenID Foundation decide to focus on the problem of what happens to digital assets after death, and why do you think this issue has been neglected for so long? I became interested in this idea in 2010, when a close friend of mine passed away unexpectedly at a young age, leaving behind his wife and two young children. We both worked in security and his data was difficult for his family to obtain after his passing. At the time, I considered how we could implement a dead man’s switch that would activate after a specified period of account inactivity. This could be used, for example, to release account credentials to a chosen loved one. However, the penetration of credential managers was very low at the time, so the idea was put on the back burner for years. In 2022, I was in Berlin for the European Identity & Cloud (EIC) Conference. The FIDO Alliance had just announced synced passkeys, a significant development that highlighted both a challenge and an opportunity. The challenge was that digital credentials, such as passkeys, would not allow an individual to write down their credentials, creating more barriers to accessing the digital estate of an individual after death. The opportunity, however, was the increased use of credential managers that would occur as passkeys became commonplace for most users. I shared my ideas with a select group of identity standards architects, including Vittorio Bertocci, a friend and mentor. They all agreed. Unfortunately, Vittorio got sick and passed away on October 7, 2023. In the following weeks I talked to members of the identity community at the Authenticate Conference and the Internet Identity Workshop. Each of these conversations helped move forward the ideas that eventually became the Death and the Digital Estate Community Group (DADE CG). The group was chartered in September 2024 and began to meet regularly in November 2024. As regards to why this issue has been neglected for so long, I cannot say for sure. However, many of my friends and colleagues are uncomfortable talking about death and thinking of their own mortality. I, too, am uncomfortable with the topic! I think that’s a natural barrier that has prevented us from making headway until now. What kind of problems do businesses encounter and what kinds of risks do companies face when employees or customers pass away without a clear digital estate plan? I first encountered this problem a while back in a previous role when a customer services team member came to me with the questions: “What do we do with the account and digital assets of a customer who has passed away? How do we verify they have died?” At the time, there weren’t any runbooks for how to handle the death of a customer. Once again, because many people are uncomfortable discussing death, we had not planned for it. In my own experience working with various organizations, it’s clear that we fail to consider what to do when our customers or users pass away or become incapacitated. And until we pave a clear path for organizations to follow, it is unlikely that we’ll see broad adoption of mechanisms for managing death and the disposition of users’ digital assets. I see two clear problems for companies today: First, how do you prove that a customer has died? Second, how do you ensure that the customer’s digital assets are handled in accordance with their wishes? In the first case, proving the death of a user will depend on the jurisdiction in which they died, so unique processes will have to be created depending on the jurisdiction. This is incredibly difficult and time consuming to manage on a worldwide basis. In the second, there is no clear pathway to establish who is responsible for the decedent’s digital assets and how they wish to have them handled. (Though Kudos to Apple, Google, Facebook, and other organizations that have established mechanisms that individuals can configure to establish a mechanism for their chosen legacy managers to handle their accounts in accordance with their wishes.) But we still lack a universal set of mechanisms that operate within the context of law and culture to manage a digital estate. Should some accounts be inheritable (e.g., accounts where you pay for games, books, etc., or accounts storing digital art and other creative digital works)? That is, should the contents be inheritable? I’m not a lawyer, so I don’t feel like this is an area I can weigh in upon. However, if these assets are inheritable, there must be a pathway to enable this inheritance which may, or may not, exist today. How is AI, and especially tools that generate content or simulate people’s voices and likenesses, making this issue more complex? This seems to me a completely novel problem – who has the “rights” to this “material”, and are companies already misusing the access they have to photos, videos and audio recordings? We’re in the early days of understanding how AI impacts death. There are tools that allow individuals to create AI avatars of themselves for their friends and family to “speak” with after death. This is behavior that the individual will have consented to. On the other hand, there are AI avatars created without the knowledge or consent of the deceased. In one famous case, a murdered man’s sister created an AI deepfake of her brother which was played in court during the sentencing phase for the person who murdered him. The images were of the deceased man, but the words he “spoke” were those of his sister. Is this right? Is this wrong? I can only speak for myself to say that this makes me incredibly uncomfortable. The current draft of the paper says that “digital estate planning will not be viable at scale until the technical stack supports delegation that is verifiable, revocable, interoperable, and usable by the average person with or without legal representation. Service providers, such as social media sites, cloud services, and online crypto wallets, require digital estate services to manage their users’ legacy managers.” Can you see this happening without regulations? What’s the incentive for service providers? Today, we lack the tools (protocols) and the regulations to enable digital estate management at scale. Law and regulation can force a change in behavior by large providers. However, lacking effective protocols to establish a mechanism to identify the decedent’s chosen individuals who will manage their digital estate, every service will have to design their own path. This creates an exceptional burden on individuals planning their digital estate, and on individuals who manage the digital estates of the deceased. For example, some services require the use of impersonation – logging in as the user with their credentials – to close their digital accounts. But impersonation can be abused. There have been many instances of deceased individuals “posting” new content on social media accounts after their death. The incentive for service providers to resolve these gaps is unclear to me. While I hope that they are incentivized by being good citizens of the world, this is unlikely to create the change we need. If laws don’t catch up quickly, do you think people will start treating their digital assets like “contraband”, e.g., secretly sharing passwords or creating shadow archives to bypass companies? Sharing of credentials is already happening and, in many cases, is a recommended practice due to a lack of other mechanisms for managing digital assets. What are the most important aspects that need to be addressed correctly to achieve satisfactory digital estate “handover”? I encourage you to review the planning guide we released for public comment alongside the white paper. However, to answer the question, I encourage individuals to document their digital estate: list every online account including social media, financial, insurance, healthcare, email, cloud file storage, etc., along with the username for the account. Ideally, all this information along with the user’s credentials (e.g. passwords, passkeys, and OTPs) are stored in a suitable credential manager, such as 1Password, BitWarden, or Dashlane. The data should include specific instructions, where relevant, regarding your wishes for handling of the data after you have passed away. For example, you may wish to have your Facebook account memorialized while your blog should be maintained for five years before being shut down and removed from the internet. The data is yours – take care to be explicit how you’d like it to be handled after your death. The individual should store the necessary data to unlock the credential manager in a secure place that can be accessed after their death. Depending on their circumstances, this may mean leaving the data with their lawyer or other estate planning professional. If the data is provided to a loved one, there is a risk of abuse of the trust they have placed in this individual. Finally, work with a lawyer familiar with estate planning and digital assets to ensure that your digital estate is properly represented in your estate documents, along with your specific wishes for each account and the data contained within the account. You’ve been involved in this project for a while. Were there any comments that surprised you? And were there aspects you hadn’t considered before starting the project? Absolutely! Early in the DADE work a member of the community group expressed discomfort with the word death. In their culture, it is considered impolite to use such terms. As an American growing up culturally Jewish, my view of death and related practices were influenced by what I observed in my own life. My co-author, Mike Kiser, did a masterful job of documenting some of the different belief systems and practices around the world that impact how individuals talk about, think about, and manage death. I’m glad to have a partner like Mike to help expand our understanding of the cultural and religious practices around death and dying to inform our work. If we are to be successful in developing protocols for managing digital estates, the protocols must be flexible enough to account for the different practices and laws found around the world. I look forward to learning more as we continue this work to ensure that all humans worldwide can manage their digital estates in a way that is culturally and religiously appropriate. What do you hope this white paper and guide will change, in terms of public awareness and industry standards? When we set out to write this paper, we wanted to influence the large technology and social media platforms, politicians, regulators, estate planners, and others who can help change the status quo. Further, we hoped to influence standards development organizations, such as the OpenID Foundation and the Internet Engineering Task Force (IETF), and their members. As standards developers in the realm of identity, we have an obligation to the people we serve to consider identity from birth to death and beyond, to ensure every human receives the respect they deserve in life and in death. Additionally, we wrote the planning guide to help individuals plan for their own digital estate. By giving people the tools to help describe, document, and manage their digital estates proactively, we can raise more awareness and provide tools to help protect individuals at one of the most vulnerable moments of their lives. The comment period for the paper and guide ends on Friday, October 24th. Instructions for how to send in comments can be found here. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

For blind people, staying safe online means working around the tools designed to help Blind and low-vision users face the same password challenges as everyone else, but the tools meant to make security easier often end up getting in the way. A study from the CISPA Helmholtz Center for Information Security and DePaul University found that poor accessibility in password managers can lead people to risky habits such as reusing passwords. Researchers spoke with blind and low-vision participants who manage passwords for both personal and work accounts. Everyone in the study used some kind of password manager, with some relying on built-in options like Apple Keychain or Chrome’s password tool, and others choosing standalone apps such as KeePass or 1Password. Partial accessibility limits use For people with visual impairments, the ability to navigate a program determines whether it can be used safely at all. Many password managers offered only partial compatibility with screen readers. Certain actions worked properly, while others were difficult or impossible to complete. Basic storage and autofill functions usually worked and reduced typing mistakes. More complex features, such as generating random passwords or issuing breach alerts, often failed to interact with assistive software. Randomly created passwords could not be read aloud, and warning messages appeared as unlabeled pop-ups. When individuals could not verify or understand what a feature was doing, they avoided it. This gap in practical accessibility meant that tools built to strengthen security became tools of convenience. People used them for ease, not for protection. Inaccessible tools lead to risky workarounds When password software was hard to use, participants came up with their own ways to stay organized and independent. These personal systems gave them control but also created new risks. Several reused passwords or followed simple patterns, such as adding short sequences to meet length rules. Others kept passwords in braille notes, text files, or spreadsheets that worked better with assistive tools. Some made braille password lists to keep their credentials accessible and as a backup during outages. This method worked well for reading and storing passwords independently, but it had drawbacks. Braille can wear down over time, and even a single damaged dot can change a password. These lists also had to be recreated often. While braille notes might seem private because sighted people can’t read them, they offer limited protection if someone targets the list directly. This kind of security through obscurity can give users a false sense of safety. Replacing characters with their braille number codes can also feel more secure than it really is, since the pattern is easy to break once known. Frequent software updates added to the frustration. Buttons lost labels, shortcuts stopped working, and programs that once felt reliable became unpredictable. To avoid being locked out, participants delayed updates or kept backup copies of their passwords elsewhere. Biometrics provide a reliable alternative Not all findings were discouraging. Many participants preferred biometric authentication, such as fingerprints or facial recognition. These methods reduced the need to handle long strings of characters and worked consistently with assistive technologies. Fingerprint sensors, in particular, provided a reliable and accessible way to authenticate without depending on fragile software interfaces. Biometrics offered both security and independence. Users could verify their identity without needing to see a screen or type a complex password. The researchers suggest that biometric authentication should be the default for accessible systems, as it aligns well with the needs of blind and low-vision users. They also propose making password generators produce readable passphrases instead of random symbols. Screen readers can pronounce words clearly, helping users understand and recall them. This approach would combine strong password practices with accessibility and autonomy. Lear more: Review: Passwork 7.0, self-hosted password manager for business People know password reuse is risky but keep doing it anyway

It’s easy to think your defenses are solid — until you realize attackers have been inside them the whole time. The latest incidents show that long-term, silent breaches are becoming the norm. The best defense now isn’t just patching fast, but watching smarter and staying alert for what you don’t expect. Here’s a quick look at this week’s top threats, new tactics, and security stories shaping the landscape. ⚡ Threat of the Week F5 Exposed to Nation-State Breach — F5 disclosed that unidentified threat actors broke into its systems and stole files containing some of BIG-IP's source code and information related to undisclosed vulnerabilities in the product. The company said it learned of the incident on August 9, 2025, although it's believed that the attackers were in its network for at least 12 months. The attackers are said to have used a malware family called BRICKSTORM, which is attributed to a China-nexus espionage group dubbed UNC5221. GreyNoise said it observed elevated scanning activity targeting BIG-IP in three waves on September 23, October 14, and October 15, 2025, but emphasized the anomalies may not necessarily relate to the hack. Censys said it identified over 680,000 F5 BIG-IP load balancers and application gateways visible on the public internet, with the majority of hosts located in the U.S., followed by Germany, France, Japan, and China. Not all identified systems are necessarily vulnerable, but each represents a publicly accessible interface that should be inventoried, access-restricted, and patched proactively as a precautionary measure. "Edge infrastructure and security vendors remain prime targets for long-term, often state-linked threat actors," John Fokker, vice president of threat intelligence strategy at Trellix, said. "Over the years, we have seen nation-state interest in exploiting vulnerabilities in edge devices, recognizing their strategic position in global networks. Incidents like these remind us that strengthening collective resilience requires not only hardened technology but also open collaboration and intelligence sharing across the security community." Zero Trust + AI: Thrive in the AI Era and Empower Your Workforce It’s no surprise, hackers are using AI in creative ways to compromise users and breach organizations. Zscaler Zero Trust + AI helps defeat ransomware and AI-power attacks today by enabling you to detect and block advanced threats, and discover and classify sensitive data everywhere. Learn more about Zscaler Zero Trust + AI ➝ 🔔 Top News N. Korea Uses EtherHiding to Hide Malware Inside Blockchain Smart Contracts — North Korean threat actors have been observed leveraging the EtherHiding technique to distribute malware and enable cryptocurrency theft, marking the first time a state-sponsored hacking group has embraced the method. The activity has been attributed to a cluster tracked as UNC5342 (aka Famous Chollima). The attack wave is part of a long-running campaign codenamed Contagious Interview, wherein the attackers approach potential targets on LinkedIn by posing as recruiters or hiring managers, and trick them into running malicious code under the pretext of a job assessment after shifting the conversation to Telegram or Discord. In the latest attack waves observed since February 2025, the threat actors use a JavaScript downloader that interacts with a malicious BSC smart contract to download JADESNOW, which subsequently queries the transaction history associated with an Ethereum address to fetch the JavaScript version of InvisibleFerret. LinkPro Linux Rootkit Spotted in the Wild — An investigation into the compromise of an Amazon Web Services (AWS)-hosted infrastructure led to the discovery of a new GNU/Linux rootkit dubbed LinkPro. The backdoor features functionalities relying on the installation of two extended Berkeley Packet Filter (eBPF) modules to conceal itself and to be remotely activated upon receiving a magic packet - a TCP SYN packet with a specific window size (54321) that signals the rootkit to await further instructions within a one-hour window, allowing it to evade traditional security defenses. The commands supported by LinkPro include executing /bin/bash in a pseudo-terminal, running a shell command, enumerating files and directories, performing file operations, downloading files, and setting up a SOCKS5 proxy tunnel. It's currently not known who is behind the attack, but it's suspected that the threat actors are financially motivated. Zero Disco Campaign Targets Cisco Devices with Rootkits — A new campaign has exploited a recently disclosed security flaw impacting Cisco IOS Software and IOS XE Software to deploy Linux rootkits on older, unprotected systems. The activity, codenamed Operation Zero Disco by Trend Micro, involves the weaponization of CVE-2025-20352 (CVSS score: 7.7), a stack overflow vulnerability in the Simple Network Management Protocol (SNMP) subsystem that could allow an authenticated, remote attacker to execute arbitrary code by sending crafted SNMP packets to a susceptible device. The operation primarily impacted Cisco 9400, 9300, and legacy 3750G series devices, Trend Micro said. The intrusions have not been attributed to any known threat actor or group. Pixnapping Attack Leads to Data Theft on Android Devices — Android devices from Google and Samsung have been found vulnerable to a side-channel attack that could be exploited to covertly steal two-factor authentication (2FA) codes, Google Maps timelines, and other sensitive data without the users' knowledge pixel-by-pixel. The attack has been codenamed Pixnapping. Google is tracking the issue under the CVE identifier CVE-2025-48561 (CVSS score: 5.5). Patches for the vulnerability were issued by the tech giant as part of its September 2025 Android Security Bulletin, with additional fixes forthcoming in December. Chinese Threat Actors Exploited ArcGIS Server as Backdoor — Threat actors with ties to China have been attributed to a novel campaign that compromised an ArcGIS system and turned it into a backdoor for more than a year. The activity is the handiwork of a Chinese state-sponsored hacking group called Flax Typhoon, which is also tracked as Ethereal Panda and RedJuliett. "The group cleverly modified a geo-mapping application's Java server object extension (SOE) into a functioning web shell," ReliaQuest said. "By gating access with a hardcoded key for exclusive control and embedding it in system backups, they achieved deep, long-term persistence that could survive a full system recovery." The attack chain involved the threat actors targeting a public-facing ArcGIS server that was linked to a private, internal ArcGIS server by compromising a portal administrator account to deploy a malicious SOE, thereby allowing them to blend in with normal traffic and maintain access for extended periods. The attackers then instructed the public-facing server to create a hidden directory to serve as the group's "private workspace." They also blocked access to other attackers and admins with a hard-coded key. The findings demonstrate Flax Typhoon's consistent modus operandi of quietly turning an organization's own tools against itself rather than using sophisticated malware or exploits. ️🔥 Trending CVEs Hackers move fast. They often exploit new vulnerabilities within hours, turning a single missed patch into a major breach. One unpatched CVE can be all it takes for a full compromise. Below are this week’s most critical vulnerabilities gaining attention across the industry. Review them, prioritize your fixes, and close the gap before attackers take advantage. This week’s list includes — CVE-2025-24990, CVE-2025-59230 (Microsoft Windows), CVE-2025-47827 (IGEL OS before 11), CVE-2023-42770, CVE-2023-40151 (Red Lion Sixnet RTUs), CVE-2025-2611 (ICTBroadcast), CVE-2025-55315 (Microsoft ASP.NET Core), CVE-2025-11577 (Clevo UEFI firmware), CVE-2025-37729 (Elastic Cloud Enterprise), CVE-2025-9713, CVE-2025-11622 (Ivanti Endpoint Manager), CVE-2025-48983, CVE-2025-48984 (Veeam), CVE-2025-11756 (Google Chrome), CVE-2025-49201 (Fortinet FortiPAM and FortiSwitch Manager), CVE-2025-58325 (Fortinet FortiOS CLI), CVE-2025-49553 (Adobe Connect collaboration suite), CVE-2025-9217 (Slider Revolution plugin), CVE-2025-10230 (Samba), CVE-2025-54539 (Apache ActiveMQ), CVE-2025-41703, CVE-2025-41704, CVE-2025-41706, CVE-2025-41707 (Phoenix Contact QUINT4), and CVE-2025-11492, CVE-2025-11493 (ConnectWise Automate). 📰 Around the Cyber World Microsoft Unveils New Security Improvements — Microsoft revealed that "parts of the kernel in Windows 11 have been rewritten in Rust, which helps mitigate against memory corruption vulnerabilities like buffer overflows and helps reduce attack surfaces." The company also noted that it's taking steps to secure AI-powered agentic experiences on the operating system by ensuring that they operate with limited permissions and only obtain access to resources users' explicitly provide permission to. In addition, Microsoft said agents that integrate with Windows must be cryptographically signed by a trusted source so that they can be revoked if found to be malicious. Each AI agent will also run under its own dedicated agent account that's distinct from the user account on the device. "This facilitates agent-specific policy application that can be different from the rules applied to other accounts like those for human users," it said. SEO Campaign Uses Fake Ivanti Installers to Steal Credentials — A new attack campaign has leveraged SEO poisoning to lure users into downloading a malicious version of the Ivanti Pulse Secure VPN client. The activity targets users searching for legitimate software on search engines like Bing, redirecting them to attacker-controlled lookalike websites (ivanti-pulsesecure[.]com or ivanti-secure-access[.]org). The goal of this attack is to steal VPN credentials from the victim's machine, enabling further compromise. "The malicious installer, a signed MSI file, contains a credential-stealing DLL designed to locate, parse, and exfiltrate VPN connection details," Zscaler said. "The malware specifically targets the connectionstore.dat file to steal saved VPN server URIs, which it combines with hardcoded credentials for exfiltration. Data is sent to a command-and-control (C2) server hosted on Microsoft Azure infrastructure." Qilin's Ties with BPH Providers Exposed — Cybersecurity researchers from Resecurity examined Qilin ransomware group's "close affiliation" with underground bulletproof hosting (BPH) operators, finding that the e-crime actor has not only relied on Cat Technologies Co. Limited. (which, in turn, is hosted on an IP address tied to Aeza Group) for hosting its data leak site, but also advertised services like BEARHOST Servers (aka Underground) on its WikiLeaksV2 site, where the group publishes content about their activities. BEARHOST has been operational since 2016, offering its services for anywhere from $95 to $500. While BEARHOST abruptly announced the stoppage of its service on December 28, 2024, it is assessed that the threat actors have taken the BPH service into private mode, catering only to trusted and vetted underground actors. On May 8, 2025, it resurfaced as Voodoo Servers, only for the operators to terminate the service again towards the end of the month, citing political reasons. "The actors decided to disappear through an 'exit scam' scenario, keeping the underground audience completely clueless," Resecurity said. "Notably, the legal entities behind the service continue their operations." Notably, Cat Technologies Co. Limited. also shares links to shadowy entities like Red Bytes LLC, Hostway, Starcrecium Limited, and Chang Way Technologies Co. Limited, the last of which has been associated with extensive malware activity, hosting command-and-control (C2) servers of Amadey, StealC, and Cobalt Strike used by cybercriminals. Another entity of note is Next Limited, which shares the same Hong Kong address as Chang Way Technologies Co. Limited and has been attributed to malicious activity in connection with Proton66. U.S. Judge Bars NSO Group from Targeting WhatsApp — A U.S. judge barred NSO Group from targeting WhatsApp users and cut the punitive damages verdict awarded to Meta by a jury in May 2025 to $4 million, because the court did not have enough evidence to determine that NSO Group's behavior was "particularly egregious." The permanent injunction handed out by U.S. District Judge Phyllis Hamilton means that the Israeli vendor cannot use WhatsApp as a way to infect targets' devices. As a refresher, Meta sued the NSO Group in 2019 over the use of Pegasus spyware by exploiting a then-zero-day flaw in the messaging app to spy on 1,400 people from 20 countries, including journalists and human rights activists. It was fined close to $168 million earlier this May. The proposed injunction requires NSO Group to delete and destroy computer code related to Meta's platforms, and she concluded that the provision is "necessary to prevent future violations, especially given the undetectable nature of defendants' technology." Google's Privacy Sandbox Initiative is Officially Dead — In 2019, Google launched an initiative called Privacy Sandbox to come up with privacy-enhancing alternatives to replace third-party cookies on the web. However, with the company abandoning its plans to deprecate third-party tracking cookies, the project appears to be winding down. To that end, the tech giant said it's retiring the following Privacy Sandbox technologies citing low levels of adoption: Attribution Reporting API (Chrome and Android), IP Protection, On-Device Personalization, Private Aggregation (including Shared Storage), Protected Audience (Chrome and Android), Protected App Signals, Related Website Sets (including requestStorageAccessFor and Related Website Partition), SelectURL, SDK Runtime and Topics (Chrome and Android). In a statement shared with Adweek, the company said it will continue to work to improve privacy across Chrome, Android, and the web, but not under the Privacy Sandbox branding. Russia Blocks Foreign SIM Cards — Russia said it's taking steps to temporarily block mobile internet for foreign SIM cards, citing national security reasons. The new rule imposes a mandatory 24-hour mobile internet blackout for anyone entering Russia with a foreign SIM card. Flaw in CORS headers in Web Browsers Disclosed — The CERT Coordination Center (CERT/CC) disclosed details of a vulnerability in cross-origin resource sharing (CORS) headers in Chromium, Google Chrome, Microsoft Edge, Safari, and Firefox that enables the CORS policy to be manipulated. This can be combined with DNS rebinding techniques to issue arbitrary requests to services listening on arbitrary ports, regardless of the CORS policy in place by the target. "An attacker can use a malicious site to execute a JavaScript payload that periodically sends CORS headers in order to ask the server if the cross-origin request is safe and allowed," CERT/CC explained. "Naturally, the attacker-controlled hostname will respond with permissive CORS headers that will circumvent the CORS policy. The attacker then performs a DNS rebinding attack so that the hostname is assigned the IP address of the target service. After the DNS responds with the changed IP address, the new target inherits the relaxed CORS policy, allowing an attacker to potentially exfiltrate data from the target." Mozilla is tracking the vulnerability as CVE-2025-8036. Phishing Campaigns Use Microsoft's Logo for Tech Support Scams — Threat actors are exploiting Microsoft's Name and branding in phishing emails to lure users into fraudulent tech support scams. The messages contain links that, when clicked, take the victims to a fake CAPTCHA challenge, after which they are redirected to a phishing landing page to unleash the next stage of the attack. "After passing the captcha verification, the victim is suddenly visually overloaded with several pop-ups that appear to be Microsoft security alerts," Cofense said. "Their browser is manipulated to appear locked, and they lose the ability to locate or control their mouse, which adds to the feeling that the system is compromised. This involuntary loss of control creates a faux ransomware experience, leading the user to believe their computer is locked and to take immediate action to remedy the infection." From there, users are instructed to call a number to reach Windows Support, at which they are connected to a bogus technician to take the attack forward. "The threat actor could exploit further by asking the user to provide account credentials or persuade the user to install remote desktop tools, allowing full access to their system," the company said. Taxpayers, Drivers Targeted in Refund and Road Toll Smishing Scams — A smishing campaign has leveraged at least 850 newly-registered domain names in September and early October to target people living in the U.S., the U.K., and elsewhere with phishing links that use tax refunds, road toll charges, or failed package deliveries as a lure. The websites, designed to be loaded only when launched from a mobile device, claim to provide information about their tax refund status or obtain a subsidy of up to £300 to help offset winter fuel costs (note: this is a real U.K. government initiative), only to prompt them to provide personal details such as name, home address, telephone number and email address, as well as payment card information. The entered data is exfiltrated to the attackers over the WebSocket protocol. Some of the scam websites have also been found to target Canadian, German, and Spanish residents and visitors, per Netcraft. Meta's New Collage Feature May Use Photos in Phone's Camera Roll — Meta is officially rolling out a new opt-in feature to Facebook users in the U.S. and Canada to suggest the best photos and videos from users' camera roll and create collages and edits. "With your permission and the help of AI, our new feature enables Facebook to automatically surface hidden gems – those memorable moments that get lost among screenshots, receipts, and random snaps – and edit them to save or share," the company said. The feature was first tested back in late June 2025. The social media company emphasized that the suggestions are private and that it does not use media obtained from users' devices via the camera roll to train its models, unless users opt to edit the media with their AI tools or publish those suggestions to Facebook. Users who wish to opt out of the feature can do so by navigating Settings and Privacy > Settings > Preferences > Camera Roll Sharing Suggestions. Fake Homebrew, TradingView, LogMeIn Sites Serve Stealer Malware Targeting Macs — Threat actors are employing social engineering tactics to trick users into visiting fake websites impersonating trusted platforms like as Homebrew, TradingView, and LogMeIn, where they are instructed to copy and run a malicious command on the Terminal app as part of ClickFix-style attacks, resulting in the deployment of stealer malware such as Atomic Stealer and Odyssey Stealer. "More than 85 phishing domains were identified, connected through shared SSL certificates, payload servers, and reused infrastructure," Hunt.io said. "The findings suggest a coordinated and ongoing campaign in which operators continuously adapt their infrastructure and tactics to maintain persistence and evade detection within the macOS ecosystem." It's suspected that users are driven to these websites via sponsored ads on search engines like Bing and Google. Dutch Data Protection Watchdog Fines Experian $3.2 Million for Privacy Violations — The Dutch Data Protection Authority (DPA) imposed a fine of €2.7 million ($3.2 million) on Experian Netherlands for collecting data in contravention of the E.U. General Data Protection Regulation (GDPR). The DPA said the consumer credit reporting company gathered information on people from both public and non-public sources and failed to make it clear why the collection of certain data was necessary. In addition to the penalty, Experian is expected to delete the database of personal data by the end of the year. The company has also ceased its operations in the country. "Until January 1, 2025, Experian provided credit assessments about individuals to its clients," the DPA said. "To do this, the company collected data such as negative payment behavior, outstanding debts, or bankruptcies. The AP found that Experian violated the law by unlawfully using personal data." Threat Actors Send Fake Password Manager Breach Alerts — Bad actors are sending phishing alerts claiming that their password manager accounts for 1Password and Lastpass have been compromised in order to trick users into providing their passwords and hijack their accounts. In response to the attack, LastPass said it has not been hacked and that it's an attempt on the part of the attackers to generate a false sense of urgency. In some cases spotted by Bleeping Computer, the activity has also been found to urge recipients to install a more secure version of the password manager, resulting in the deployment of a legitimate remote access software called Syncro. The software vendor has since moved to shut down the malicious accounts to prevent further installs. SocGholish MaaS Detailed — LevelBlue has published an analysis of a threat activity cluster known as SocGholish (aka FakeUpdates), which is known to be active since 2017, leveraging fake web browser update prompts on compromised websites as a lure to distribute malware. Victims are typically routed through Traffic Distribution Systems (TDS) like Keitaro and Parrot TDS to filter users based on specific factors such as geography, browser type, or system configuration, ensuring that only the intended targets are exposed to the payload. It's offered under a malware-as-a-service (MaaS) by a financially motivated cybercrime group called TA569. SocGholish stands out for its ability to turn legitimate websites into large-scale distribution platforms for malware. Acting as an initial access broker (IAB), its operations profit from follow-on compromises by other actors. "Once executed, its payloads range from loaders and stealers to ransomware, allowing for extensive follow-up exploitation," LevelBlue said. "This combination of broad reach, simple delivery mechanisms, and flexible use by multiple groups makes SocGholish a persistent and dangerous threat across industries and regions." One of its primary users is Evil Corp, with the malware also used to deliver RansomHub in early 2025. 🎥 Cybersecurity Webinars The Practical Framework to Govern AI Agents Without Slowing Innovation → AI is changing everything fast — but for most security teams, it still feels like a fight just to keep up. The goal isn’t to slow innovation with more controls; it’s to make those controls work for the business. By building security into AI from the start, you can turn what used to be a bottleneck into a real accelerator for growth and trust. The Future of AI in GRC: Turning Risk Into a Compliance Advantage - AI is changing how companies manage risk and compliance — fast. It brings big opportunities but also new challenges. This webinar shows you how to use AI safely and effectively in GRC, avoid common mistakes, and turn complex rules into a real business advantage. Workflow Clarity: How to Blend AI and Human Effort for Real Results - Too many teams are rushing to “add AI” without a plan — and ending up with messy, unreliable workflows. Join us to learn a clearer approach: how to use AI thoughtfully, simplify automation, and build systems that scale securely. 🔧 Cybersecurity Tools Beelzebub - It turns honeypot deployment into a powerful, low-code experience. It uses AI to simulate real systems, helping security teams detect attacks, track emerging threats, and share insights through a global threat intelligence network. NetworkHound - It maps your Active Directory network from the inside out. It discovers every device — domain-joined or shadow-IT — validates SMB and web services, and builds a full BloodHound-compatible graph so you can see and secure your environment clearly. Disclaimer: These tools are for educational and research use only. They haven’t been fully security-tested and could pose risks if used incorrectly. Review the code before trying them, test only in safe environments, and follow all ethical, legal, and organizational rules. 🔒 Tip of the Week Most Cloud Breaches Aren’t Hacks — They’re Misconfigurations. Here’s How to Fix Them — Cloud storage buckets like AWS S3, Azure Blob, and Google Cloud Storage make data sharing easy — but one wrong setting can expose everything. Most data leaks happen not because of hacking, but because someone left a public bucket, skipped encryption, or used a test bucket that never got locked down. Cloud platforms give you flexibility, not guaranteed safety, so you need to check and control access yourself. Misconfigurations usually happen when permissions are too broad, encryption is disabled, or visibility is lost across multiple clouds. Doing manual checks doesn’t scale — especially if you manage data in AWS, Azure, and GCP. The fix is using tools that automatically find, report, and even fix unsafe settings before they cause damage. ScoutSuite is a strong starting point for cross-cloud visibility. It scans AWS, Azure, and GCP for open buckets, weak IAM roles, and missing encryption, then creates an easy-to-read HTML report. Prowler goes deeper into AWS, checking S3 settings against CIS and AWS benchmarks to catch bad ACLs or unencrypted buckets. For ongoing control, Cloud Custodian lets you write simple policies that automatically enforce rules — for example, forcing all new buckets to use encryption. And CloudQuery can turn your cloud setup into a searchable database, so you can monitor changes, track compliance, and visualize risks in one place. The best approach is to combine them: run ScoutSuite or Prowler weekly to find issues, and let Cloud Custodian handle automatic fixes. Even a few hours spent setting these up can stop the kind of data leaks that make headlines. Always assume every bucket is public until proven otherwise — and secure it like it is. Conclusion The truth is, no tool or patch will ever make us fully secure. What matters most is awareness — knowing what’s normal, what’s changing, and how attackers think. Every alert, log, or minor anomaly is a clue. Keep connecting those dots before someone else does.

A threat actor with ties to the Democratic People's Republic of Korea (aka North Korea) has been observed leveraging the EtherHiding technique to distribute malware and enable cryptocurrency theft, marking the first time a state-sponsored hacking group has embraced the method. The activity has been attributed by Google Threat Intelligence Group (GTIG) to a threat cluster it tracks as UNC5342, which is also known as CL-STA-0240 (Palo Alto Networks Unit 42), DeceptiveDevelopment (ESET), DEV#POPPER (Securonix), Famous Chollima (CrowdStrike), Gwisin Gang (DTEX), Tenacious Pungsan (Datadog), and Void Dokkaebi (Trend Micro). The attack wave is part of a long-running campaign codenamed Contagious Interview, wherein the attackers approach potential targets on LinkedIn by posing as recruiters or hiring managers, and trick them into running malicious code under the pretext of a job assessment after shifting the conversation to Telegram or Discord. The end goal of these efforts is to gain unauthorized access to developers' machines, steal sensitive data, and siphon cryptocurrency assets – consistent with North Korea's twin pursuit of cyber espionage and financial gain. Google said it has observed UNC5342 incorporating EtherHiding – a stealthy approach that involves embedding nefarious code within a smart contract on a public blockchain like BNB Smart Chain (BSC) or Ethereum – since February 2025. In doing so, the attack turns the blockchain into a decentralized dead drop resolver that's resilient to takedown efforts. Besides resilience, EtherHiding also abuses the pseudonymous nature of blockchain transactions to make it harder to trace who has deployed the smart contract. Complicating matters further, the technique is also flexible in that it allows the attacker who is in control of the smart contract to update the malicious payload at any time (albeit costing an average of $1.37 in gas fees), thereby opening the door to a wide spectrum of threats. "This development signals an escalation in the threat landscape, as nation-state threat actors are now utilizing new techniques to distribute malware that is resistant to law enforcement take-downs and can be easily modified for new campaigns," Robert Wallace, consulting leader at Mandiant, Google Cloud, said in a statement shared with The Hacker News. The infection chain triggered following the social engineering attack is a multi-stage process that's capable of targeting Windows, macOS, and Linux systems with three different malware families - An initial downloader that manifests in the form of npm packages BeaverTail, a JavaScript stealer that's responsible for exfiltrating sensitive information, such as cryptocurrency wallets, browser extension data, and credentials JADESNOW, a JavaScript downloader that interacts with Ethereum to fetch InvisibleFerret InvisibleFerret, a JavaScript variant of the Python backdoor deployed against high-value targets to allow remote control of the compromised host, as well as long-term data theft by targeting MetaMask and Phantom wallets and credentials from password managers like 1Password In a nutshell, the attack coaxes the victim to run code that executes the initial JavaScript downloader that interacts with a malicious BSC smart contract to download JADESNOW, which subsequently queries the transaction history associated with an Ethereum address to fetch the third-stage payload, in this case the JavaScript version of InvisibleFerret. The malware also attempts to install a portable Python interpreter to execute an additional credential stealer component stored at a different Ethereum address. The findings are significant because of the threat actor's use of multiple blockchains for EtherHiding activity. Wallace told The Hacker News that they have not observed DPRK actors distribute fake installers (such as those for video conferencing software like FreeConference as has happened in the past) in conjunction with utilizing smart contracts as a stager for malicious code. "EtherHiding represents a shift toward next-generation bulletproof hosting, where the inherent features of blockchain technology are repurposed for malicious ends," Google said. "This technique underscores the continuous evolution of cyber threats as attackers adapt and leverage new technologies to their advantage."