redpanda

ShipSec Studio brings open-source workflow orchestration to security operations Security teams have long relied on a mix of shell scripts, cron jobs, and loosely connected tools to chain reconnaissance and vulnerability scanning work together. ShipSec Studio, an open-source security workflow automation platform from ShipSec AI, aims to replace that arrangement with a dedicated orchestration layer built specifically for security operations. What the platform does ShipSec Studio provides a visual, no-code workflow builder that lets operators connect security tools into automated pipelines without writing glue code. The builder compiles those visual graphs into an executable domain-specific language that a separate worker runtime then executes. The platform ships with native support for a set of commonly used security tools. On the reconnaissance side, it integrates Subfinder, DNSX, Naabu, and HTTPx for subdomain discovery and service enumeration. For vulnerability and secret detection work, it includes Nuclei and TruffleHog. Beyond tool execution, the platform includes several orchestration-level features that distinguish it from a straightforward task scheduler. Workflows support a human-in-the-loop pause mechanism that halts execution and waits for operator approval, form input, or manual validation before proceeding. Operators can also embed LLM nodes into workflows to run AI-assisted analysis on tool output, with support for MCP providers as a standardized integration layer. Native CRON scheduling handles recurring scans. A REST API exposes workflow triggering and monitoring for external integration. Architecture The platform separates concerns across three planes. A NestJS-based management plane handles workflow compilation, secrets management using AES-256-GCM encryption, and identity. An orchestration plane built on Temporal.io manages workflow state, concurrency, and persistent wait states, providing durability across failures and restarts. A stateless worker plane pulls tasks from Temporal and executes them inside ephemeral containers with per-run volume isolation. A real-time telemetry pipeline delivers terminal output, events, and logs over server-sent events. The infrastructure stack includes PostgreSQL, MinIO, Redis, Loki, and Redpanda for messaging. The frontend is built on React 19, ReactFlow for the visual canvas, and xterm.js for terminal rendering. MCP integration extends to a built-in library of servers. AWS CloudTrail, CloudWatch, and filesystem access ship out of the box. AI agents running within workflows can automatically discover and invoke MCP tools through a standardized discovery mechanism. Deployment Teams can run the platform entirely on their own infrastructure. A one-line installer handles dependency checks, Docker configuration, and service startup. The project also documents a self-hosted Docker path suited for teams with data residency requirements or air-gapped environments. Development documentation covers multi-instance setups that allow engineers to run parallel isolated environments on a single machine, each with its own database and Temporal namespace. ShipSec Studio is available for free on GitHub. Must read: 40 open-source tools redefining how security teams secure the stack Firmware scanning time, cost, and where teams run EMBA Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!

Week in review: Self-spreading npm malware hits developers, Cisco SD-WAN 0-day exploited since 2023 Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Identity verification systems are struggling with synthetic fraud Fake and expired IDs keep showing up in routine customer transactions, from alcohol purchases to credit card applications. The problem shows up most often in industries that depend on fast onboarding and remote transactions, where identity checks rely heavily on scanned documents and automated workflows. Enterprises are racing to secure agentic AI deployments AI assistants are tied into ticketing systems, source code repositories, chat platforms, and cloud dashboards across many enterprises. In some environments, these systems can open pull requests, query internal databases, book services, and trigger automated workflows with limited human involvement. The State of AI Security 2026 from Cisco places this level of access inside a growing pattern of AI-driven operations that connect directly to core business systems. The hidden security cost of treating labs like data centers In this Help Net Security interview, Rich Kellen, VP, CISO at IFF, explains why security teams should not treat OT labs like IT environments. He discusses how compromise can damage scientific integrity and create safety risks that backups cannot fix. AI is becoming part of everyday criminal workflows Underground forums include long threads about chatbots drafting phishing emails, generating code snippets, and coaching social engineering calls. A new study examined conversations captured between January 1, 2025 and July 31, 2025 across dozens of cybercrime forums to map how AI tools are entering day to day criminal operations. AI-driven DAST reduces manual setup and surfaces exploitable vulnerabilities In this Help Net Security interview, Joni Klippert, CEO at StackHawk, discusses what defines DAST coverage in 2026 and why scan completion does not equal security. She explains how AI-driven DAST testing automates attack surface discovery, supports business-logic testing in pre-production, and reduces the manual setup that has limited adoption. Klippert also describes how organizations can implement runtime testing without instrumenting production systems. Review: Digital Forensics, Investigation, and Response, 5th Edition Digital Forensics, Investigation, and Response, 5th Edition presents a structured survey of the digital forensics discipline. The book spans foundational principles, platform specific analysis, specialized branches, and incident response integration. Open-source security debt grows across commercial software Open source code sits inside nearly every commercial application, and development teams continue to add new dependencies. Black Duck’s 2026 Open Source Security and Risk Analysis Report data shows that nearly all audited codebases contain open source components, with average component counts rising sharply over the past year. The $19.5 million insider risk problem Routine employee activity across corporate systems carries an average annual cost of $19.5 million per organization. That figure comes from the 2026 Cost of Insider Risks Global Report, conducted by the Ponemon Institute and based on data from 354 organizations that experienced one or more material insider related incidents over the past year. Industrial networks continue to leak onto the internet Industrial operators continue to run remote access portals, building automation servers, and other operational technology services on public IP address ranges. Palo Alto Networks, Siemens, and Idaho National Laboratory describe the scope of that exposure in the Intelligence-Driven Active Defense Report 2026. DeVry University’s CISO on higher education cybersecurity risk In this Help Net Security interview, Fred Kwong, VP, CISO at DeVry University, outlines how the university balances academic openness with cyber risk. He describes how systems for students are separated from back end operations to limit exposure. Japanese chip-testing toolmaker Advantest suffers ransomware attack Japanese tech testing company Advantest has suffered a ransomware attack, the company confirmed last Thursday, after detecting unusual activity within its IT environment on February 15, 2026. Fake troubleshooting tip on ClawHub leads to infostealer infection A new malware delivery campaign has hit ClawHub, the official online repository for “skills” that augment the capabilities of the popular OpenClaw AI agent. Unlike previous ones, this campaign does not aim to trick users into downloading a bogus, malicious skill. Self-spreading npm malware targets developers in new supply chain attack Security researchers have uncovered another supply chain attack targeting developers: 19 typosquatting npm packages published on npmjs.com that steal credentials, infect projects, and propagate themselves across developer environments. CISA flags exploited FileZen command injection bug, patch now! (CVE-2026-25108) CISA has added CVE-2026-25108, an OS command injection vulnerability in Soliton Systems’ FileZen secure file transfer solution, to its Known Exploited Vulnerabilities (KEV) catalog. The vendor has confirmed active exploitation, stating it has received multiple reports of damage caused by attackers abusing the flaw. SolarWinds Serv-U hit by four critical RCE-level vulnerabilities SolarWinds has fixed four critical vulnerabilities in its popular Serv-U file transfer solution, which is used by businesses and organizations of all sizes. If exploited, the flaws may allow attackers to create a system admin user and/or execute code as a privileged account. Threat actor leveraged Cisco SD-WAN zero-day since 2023 (CVE-2026-20127) A “highly sophisticated” cyber threat actor has been exploiting a zero-day authentication bypass vulnerability (CVE-2026-20127) in Cisco Catalyst SD-WAN Controller (formerly vSmart) and Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage), Cisco has announced. Scattered Lapsus$ Hunters seeks women for vishing attacks The Scattered Lapsus$ Hunters (SLH) hacking collective has launched a recruitment push aimed specifically at women, offering cash payments for participating in voice-phishing (vishing) attacks. A few days ago, threat intelligence firm Dataminr detected posts on a public Telegram channel advertising roles for female callers willing to conduct social-engineering phone operations. IronCurtain: An open-source, safeguard layer for autonomous AI assistants Veteran security engineer Niels Provos is working on a new technical approach designed to stop autonomous AI agents from taking actions you haven’t specifically authorized. Why SOCs are moving toward autonomous security operations in 2026 The modern security operations center faces a crisis of scale that human effort cannot fix. With alert volumes exponentially growing and threat actors automating their attacks, organizations must pivot to autonomous SOC strategies. This shift to AI-driven defense is the only way to survive the operational realities of 2026. Binding Operational Directive 26-02 sets deadlines for edge device replacement In this Help Net Security video, Jen Sovada, General Manager, Public Sector at Claroty, explains CISA’s Binding Operational Directive 26-02 and what it means for federal agencies. The directive requires agencies to inventory, report, decommission, and replace unsupported edge devices such as firewalls, routers, switches, load balancers, and wireless access points. Police seize 100,000 stolen Facebook credentials in cybercrime raid Officers from Poland’s Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group that used phishing to seize Facebook accounts and extract BLIK payment codes from victims. Spanish police arrest suspected Anonymous members over DDoS attacks on government sites Spanish police (Guardia Civil) arrested four members of the hacktivist group Anonymous Fénix over DDoS attacks targeting ministries, political parties and public institutions. Police identified the organization’s leadership, including its administrator and moderator, who were arrested in May 2025 in Alcalá de Henares (Madrid) and Oviedo (Asturias). Security and complexity slow the next phase of enterprise AI agent adoption Enterprise AI agents are embedded in routine business processes, particularly inside engineering and IT operations. Many organizations report active production deployments, and agent development ranks high on strategic agendas. A new study from Docker, The State of Agentic AI Report, examines how enterprises are deploying agentic systems and the challenges emerging as deployments scale. Microsoft extends security patching for three Windows products at a price Support is ending for three Windows products released in 2016, with deadlines beginning in October 2026. Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB will reach end of support on October 13, 2026, followed by Windows Server 2016 on January 12, 2027. International operation dismantles fraud network, €400,000 seized A coordinated international operation supported by Eurojust dismantled a fraudulent call centre operating from three offices and targeting citizens throughout Europe. Authorities arrested 11 suspects and seized more than €400,000 in cash. Teenagers charged over public bike service breach that exposed 4.62 million records Two South Korean teenagers have been charged in connection with a cyberattack that compromised the personal data of 4.62 million users of Seoul’s public bike service, Ttareungyi. The compromised data included user IDs, mobile phone numbers, addresses, dates of birth, gender, and weight. Airline brands become launchpads for phishing, crypto fraud Airline brands sit at the center of peak travel booking cycles, loyalty programs, and high value transactions. Criminal groups continue to register thousands of lookalike domains tied to these brands, targeting travelers, employees, and business partners. Recent threat intelligence from BforeAI’s PreCrime Labs identifies sustained impersonation activity across the global commercial airline sector. Cyber valuations climb as capital concentrates, AI security expands Venture funding in cybersecurity continued to concentrate in large private rounds at the end of 2025, driving valuations higher across stages. Data from DataTribe shows total capital invested approached $150 billion for the year, with a disproportionate share flowing into fewer than 100 deals. Ex-L3Harris executive sentenced to 87 months for selling stolen cyber-exploit trade secrets Peter Williams, a former executive of Trenchant, L3Harris’ cyber division, has been sentenced to 87 months in prison by a federal judge in Washington, D.C., after pleading guilty to stealing and selling sensitive cyber-exploit trade secrets to a Russian broker. Anthropic’s Remote Control feature brings Claude Code to mobile devices Anthropic has introduced a new Claude Code feature called Remote Control, allowing developers to continue a local coding session from a phone, tablet, or any web browser. The feature is rolling out as a research preview to Max users. Samsung’s Galaxy S26 turns privacy into a visible and invisible feature The Samsung Galaxy S26 series is out, offering plenty of security features that protect personal data while providing users with transparency and control over how their information is used. The feature that grabbed the spotlight is the built-in Privacy Display on the Galaxy S26 Ultra model, designed to help keep on-screen activity out of view in public places. Telegram rises to top spot in job scam activity Encrypted messaging platforms are becoming a primary channel for Authorised Push Payment (APP) fraud, with Telegram representing a growing share of reported cases, according to the Revolut report. NATO greenlights iPhone and iPad for classified information handling Apple confirmed that the iPhone and iPad have been approved for use with classified information in NATO restricted environments. The devices will no longer require special software or settings to handle NATO restricted-level information. Microsoft taps ASUS and Dell for the Windows 365 Cloud PC strategy Microsoft is adding two new Windows 365 Cloud PC devices, the ASUS NUC 16 for Windows 365 and the Dell Pro Desktop for Windows 365, expanding hardware options for its cloud-based desktop service. Both devices are scheduled for release in the third quarter of 2026, with distribution varying by region and model. Meta tightens grip on scam advertisers Meta is stepping up the fight against scams on its platforms by filing multiple lawsuits targeting companies and individuals in Brazil, China, and Vietnam who used deceptive tactics to run scam ads. The company said it has taken technical enforcement actions in these cases, including suspending payment methods used in the scams, disabling accounts linked to those operations, and blocking domains associated with scam sites. Coroot: Open-source observability and APM tool Coroot is an open-source observability and application performance monitoring tool. The core software, published in Go and accompanied by companion repositories such as coroot-node-agent, focuses on collecting telemetry data across systems. It uses extended Berkeley Packet Filter (eBPF) technology to gather metrics and trace inter-service communications without manual instrumentation of application code. Perplexity AI lands on Samsung’s next Galaxy lineup Samsung will add Perplexity to its upcoming Galaxy S26 devices as part of its Galaxy AI multi-agent ecosystem expansion. Users will be able to access Perplexity through quick-access controls, such as pressing and holding the side button, or by using the voice wake phrase “Hey, Plex.” WhatsApp is adding another lock to your account Meta has released WhatsApp Beta for Android 2.26.7.8 through the Google Play Beta Program. The update includes references to password-protected accounts, indicating plans to introduce an additional layer of protection beyond the app’s current authentication options. Windows 365 for Agents brings managed cloud PCs to autonomous workflows Microsoft’s Windows 365 for Agents is a cloud platform that gives AI agents secure access to cloud PCs. It lets builders run copilots, agents, and automated workflows in Windows environments without managing infrastructure. The platform includes security, policy controls, scalability, and visibility so agents can browse websites, process data, and complete tasks inside a managed cloud PC. Microsoft expands Sovereign Cloud security with governance, local productivity and AI Microsoft expands Microsoft Sovereign Cloud with new disconnected and AI capabilities that help organizations run critical infrastructure, productivity services and large AI models inside sovereign boundaries while keeping governance and operational continuity across connected and disconnected environments. Edge systems take the brunt of internet-wide exploitation attempts Internet-facing VPNs, routers, and remote access services absorbed sustained exploitation attempts throughout the second half of 2025, with nearly 3 billion malicious sessions recorded over 162 days. The concentration on edge infrastructure aligns with how attackers pursue initial access across the public internet. Microsoft adds domain libraries and Copilot integration to the quantum development kit The Microsoft Quantum Development Kit (QDK) is an open-source toolkit that runs on laptops and in common development environments. It includes code, simulators, libraries, and workflows that work with Visual Studio Code and GitHub Copilot. Integration with these tools gives developers features for writing, testing, debugging, and submitting quantum code. Apple blocks 18+ app downloads in select markets Apple has introduced expanded age assurance tools to help developers comply with regulations taking effect in Brazil, Australia, Singapore, Utah, and Louisiana. The updates, available in beta, expand the Declared Age Range API and related App Store systems. Reddit fined $19.5 million for failing to protect children’s personal data The UK’s Information Commissioner’s Office (ICO) has fined Reddit $19.5 million after finding that the company failed to use children’s personal information lawfully, exposing them to inappropriate and harmful content. Hottest cybersecurity open-source tools of the month: February 2026 This month’s roundup features exceptional open-source cybersecurity tools that are gaining attention for strengthening security across various environments. Wireshark 4.6.4 resolves dissector flaws, plugin compatibility issue Packet inspection remains a routine activity across enterprise networks, incident response workflows, and malware investigations. Continuous use places long-term stability and parsing accuracy at the center of daily operations. Wireshark version 4.6.4 addresses two vulnerabilities affecting protocol dissectors and resolves a plugin compatibility issue within the 4.6 release series. Fraudsters integrate ChatGPT into global scam campaigns AI models are being folded into fraud and influence operations that follow long standing tactics. A February 2026 update to OpenAI’s Disrupting Malicious Uses of Our Models report details how ChatGPT and related API access were used in romance scams, fake legal services, coordinated influence campaigns, and a state linked harassment effort. AWS Security Hub Extended brings enterprise security under one roof AWS Security Hub Extended is a plan within Security Hub that simplifies how customers procure, deploy, and integrate a full-stack enterprise security solution across endpoint, identity, email, network, data, browser, cloud, AI, and security operations. The CISO role keeps getting heavier Personal liability is becoming a routine part of the CISO job. In Splunk’s 2026 CISO Report, titled From Risk to Resilience in the AI Era, 78% of CISOs said they are concerned about their own liability for security incidents, up from 56% last year. The role carries personal exposure alongside operational accountability, and that shift is influencing how security leaders approach risk, documentation, and board communication. Android app uses Bluetooth signals to detect nearby smart glasses Smart glasses with built-in cameras are showing up in more public spaces, and a growing number of people want a way to know when one is nearby. An Android app called Nearby Glasses, developed by Yves Jeanrenaud, attempts to fill that gap by scanning Bluetooth Low Energy traffic for manufacturer identifiers associated with known smart glasses makers. Ransomware activity peaks outside business hours Intrusions continue to center on credential access and timed execution outside standard business hours. The Sophos Active Adversary Report 2026 analyzes 661 incident response and managed detection and response cases handled between November 1, 2024 and October 31, 2025, spanning organizations in 70 countries. Android 17 second beta expands privacy controls for contacts, SMS and local networks Google’s second beta of Android 17 continues updates to platform behavior and introduces new APIs focused on protecting sensitive data. Europol goes after The Com’s ransomware and extortion networks Law enforcement agencies across 28 countries have spent the past year building cases against a loosely organized collective known as The Com, a decentralized network of mostly teenagers and young adults linked to high-profile ransomware attacks, financial extortion, and the coercion of vulnerable children. Cybersecurity jobs available right now: February 24, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the month: February 2026 Here’s a look at the most interesting products from the past month, featuring releases from Aikido Security, Avast, Armis, Black Duck, Compliance Scorecard, Fingerprint, Gremlin, Impart Security, Portnox, Redpanda, Socure, SpecterOps, Veza, and Virtana.

New infosec products of the month: February 2026 Here’s a look at the most interesting products from the past month, featuring releases from Aikido Security, Avast, Armis, Black Duck, Compliance Scorecard, Fingerprint, Gremlin, Impart Security, Portnox, Redpanda, Socure, SpecterOps, Veza, and Virtana. Gremlin launches Disaster Recovery Testing for zone, region, and datacenter failovers Gremlin, the proactive reliability platform, launched Disaster Recovery Testing: a new product built to safely and efficiently test zone, region, and datacenter evacuations and failovers. These large-scale tests ensure businesses maintain digital resilience and business continuity when faced with cloud migrations, compliance concerns, and catastrophic events. Fingerprint enables enterprises to tell trusted AI agents apart from bots and scrapers Fingerprint has released Authorized AI Agent Detection, its new ecosystem of AI agents, including OpenAI, AWS AgentCore, Browserbase, Manus and Anchor Browser. The ecosystem enables enterprises to detect authorized agentic AI traffic with 100% certainty, allowing organizations to distinguish trusted, permissioned automation from malicious bots and scrapers. Socure unifies identity, fraud, and program integrity for government at scale Socure has released Socure for Government (SocureGov) RiskOS to help public sector organizations deliver simpler, faster, and more transparent digital identity verification and fraud prevention at scale. Avast brings deepfake scam detection to Windows PCs and mobile devices Avast announced the full international availability of Avast Scam Guardian and Scam Guardian Pro on mobile devices, alongside the launch of Avast Deepfake Guard on Windows PCs, a new AI-powered feature designed to proactively analyze and detect malicious audio in video content. Together, these launches expand the Avast scam protection ecosystem, extending coverage across mobile and PC to help protect people from scams across text messages, calls, and video platforms. Armis Centrix brings unified, AI-driven application security to the SDLC Armis has announced Armis Centrix for Application Security, which unifies application security across an organization’s software development lifecycle. The technology helps security teams secure code as a next-generation attack vector to fortify organizations’ defenses and protect against cyber threats. BloodHound Scentry helps organizations reduce identity risk and close attack paths SpecterOps has announced BloodHound Scentry, a new service designed to help customers accelerate their APM practice and reduce identity risk. BloodHound Scentry combines the power of BloodHound Enterprise with SpecterOps tradecraft experts and practitioners to provide customers with tailored guidance for attack path remediation, advanced analysis for emerging threats, and privilege zone design to protect critical assets. Portnox expands ZTNA with passwordless access for RDP, SSH, and enterprise consoles Portnox has unveiled a major expansion of its zero trust network access (ZTNA) solution, extending credential-free access beyond web and on-premises applications to include enterprise console-based applications. Black Duck expands Polaris platform with unified, automated security across all major SCMs Black Duck has announced the availability of a set of enhanced Black Duck Polaris Platform integrations across all major source code management (SCM) platforms, including GitHub, GitLab, Azure DevOps, and Bitbucket. The Polaris Platform is an integrated, software-as-a-service application security platform powered by the static application security testing, software composition analysis, and dynamic application security testing engines. Impart enables safe, in-app enforcement against AI-powered bots Impart Security has launched Programmable Bot Protection, a runtime approach to bot defense that brings detection and enforcement together within the application. Impart makes enforcement operational by enabling teams to see what would be blocked before turning it on. Compliance Scorecard v10 delivers context-driven AI for explainable compliance decisions Compliance Scorecard announced the release of v10, introducing governed, audit-ready AI designed to support defensible compliance decision-making for managed service providers (MSPs). Compliance Scorecard v10 applies AI only within a structured system of validated context and controls. The platform is built on a simple premise: AI can only be trusted in compliance if the required context already exists. As a result, v10 treats AI as a governed system of decision support, not a conversational interface. Virtana expands MCP Server to bring full-stack enterprise context to AI agents Virtana announced the latest version of its Model Context Protocol (MCP) Server, bringing full-stack enterprise visibility directly to AI agents and LLMs so machines can understand enterprise operations as complete systems rather than isolated signals. Redpanda brings identity, policy control, and data governance to AI agents Redpanda announced the availability of new core capabilities in the Redpanda Agentic Data Plane (ADP), including a centralized AI gateway, AI observability and evaluation via OpenTelemetry, AI agents, and unified authentication and authorization. Together, these features form a unified governance layer that allows enterprises to securely connect AI agents and Model Context Protocol (MCP) servers to live enterprise data with visibility and control. Aikido Infinite introduces continuous, self-remediating AI penetration testing Aikido Security has unveiled Aikido Infinite, a continuous AI penetration testing solution that autonomously validates and remediates vulnerabilities. Infinite reduces risk with every release by testing software changes as they move through deployment, confirming exploitability, and fixing vulnerabilities within the same workflow. Veza expands platform with AI Access Agents for enterprise identity governance Veza expanded its platform with Veza Access Agents, a set of purpose-built AI agents designed to automate complex identity and access governance tasks for enterprises. Veza also announced advancements to its AI Agent Security product, providing organizations with deeper visibility into agent risks and greater control over third-party AI agents, large language models (LLMs), AI apps, and AI infrastructure (MCP).

Week in review: Firmware-level Android backdoor found on tablets, Dell zero-day exploited since 2024 Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Security at AI speed: The new CISO reality The CISO role has changed significantly over the past decade, but according to John White, EMEA Field CISO, Torq, the most disruptive shift is accountability driven by agentic AI. In this Help Net Security interview, White explains how security leaders must design and govern hybrid workforces where humans and AI agents operate side by side, making decisions and acting at scale. He notes that automation is moving beyond simple task execution into real-time insight and response. REMnux v8 brings AI integration to the Linux malware analysis toolkit REMnux, a specialized Linux distribution for malware analysis, has released version 8 with a rebuilt platform based on Ubuntu 24.04 and a new capability aimed at connecting AI agents directly to its toolset. Your encrypted data is already being stolen Quantum computing is often treated as a distant, theoretical cybersecurity issue. According to Ronit Ghose, Global Head, Future of Finance of Citi Institute, that mindset is already putting financial institutions at risk. The biggest misconception, he says, is that quantum threats begin on a single future Q-day, when quantum machines suddenly crack encryption. In reality, adversaries can harvest encrypted data today and decrypt it later, creating long-term exposure for banks handling sensitive identity and transaction data. SecureClaw: Dual stack open-source security plugin and skill for OpenClaw SecureClaw is an open-source project that adds security auditing and rule-based controls to OpenClaw agent environments. The tool is published by Adversa AI and is designed to work with OpenClaw and related agents such as Moltbot and Clawdbot. Everyone uses open source, but patching still moves too slowly Enterprise security teams rely on open source across infrastructure, development pipelines, and production applications, even when they do not track it as a separate category of technology. Open source has become a default building block in many environments, and the operational risks now look like standard enterprise security problems: patch delays, version sprawl, and aging platforms that stay online longer than planned. The defense industrial base is a prime target for cyber disruption Cyber threats against the defense industrial base (DIB) are intensifying, with adversaries shifting from traditional espionage toward operations designed to disrupt production capacity and compromise supply chains. In this Help Net Security interview, Luke McNamara, Deputy Chief Analyst, Google Threat Intelligence Group, explains how attackers target the broader defense ecosystem and why identity has become the new security boundary. One stolen credential is all it takes to compromise everything Attackers often gain access through routine workflows like email logins, browser sessions, and SaaS integrations. A single stolen credential can give them a quick path to move across systems when access permissions are broad and visibility is fragmented. That pattern appears across more than 750 incident response engagements covered in Unit 42’s Global Incident Response Report 2026. The CISO view of fraud risk across the retail payment ecosystem In this Help Net Security interview, Paul Suarez, VP and CISO at Casey’s, explains how his team manages patching and upgrades for fuel payment systems with long hardware lifecycles. He also discusses risks tied to QR code payments and outlines why loyalty abuse can be hard to spot. Suarez shares how Casey’s monitors payment systems across stores, corporate networks, and third-party processors. Google patches Chrome vulnerability with in-the-wild exploit (CVE-2026-2441) Google released a security update for Chrome to address a high-severity zero‑day vulnerability (CVE-2026-2441) on Friday. CVE-2026-2441 is a use-after-free bug in the CSS processing component of Google Chrome, which allows a remote attacker “to execute arbitrary code inside a sandbox via a crafted HTML page.” OpenClaw creator Peter Steinberger joins OpenAI Peter Steinberger, the Austrian software developer who vibe coded the popular OpenClaw autonomous AI agent, has joined OpenAI. The reason why Steinberger chose OpenAI to achieve this goal is, professedly, his lack of interest in building a company and his wish to “change the world” – and do it quickly. Firmware-level Android backdoor found on tablets from multiple manufacturers A new Android backdoor embedded directly in device firmware can quietly take control of apps and harvest data, Kaspersky researchers found. The malware, named Keenadu, was discovered during an investigation into earlier Android threats and appears to have been inserted during the firmware build process, not after devices reached users.  Design weaknesses in major password managers enable vault attacks, researchers say Can cloud-based password managers that claim “zero-knowledge encryption” keep users’ passwords safe even if their encrypted-vault servers are compromised? Researchers at ETH Zurich and Università della Svizzera italiana set out to answer that question, and the answer is (unfortunately) no. Notepad++ secures update channel in wake of supply chain compromise Notepad++, the popular text and source code editor for Windows whose update mechanism was hijacked last year, has been updated to prevent similar attacks in the future. The hijacking of the update mechanism was confirmed earlier this month by Notepad++ maintainer Don Ho. Scammers exploit trust in Atlassian Jira to target organizations Threat actors have leveraged legitimate email notification feature of Atlassian Jira to deliver localized scam emails at scale. From late December 2025 through late January 2026, victims were targeted with spam emails from legitimate-looking Atlassian Jira Cloud addresses. China-linked hackers exploited Dell zero-day since 2024 (CVE-2026-22769) A suspected China-linked cyberespionage group has been covertly exploiting a critical zero-day flaw (CVE-2026-22769) in Dell’s RecoverPoint for Virtual Machines software since at least mid-2024, according to new research from Google’s threat intelligence team and Mandiant. The attackers deployed stealthy backdoors (BRICKSTORM and GRIMBOLT), a webshell (SLAYSTYLE) and maintained long-term access inside targeted networks. Bug in widely used VoIP phones allows stealthy network footholds, call interception (CVE-2026-2329) A critical security vulnerability (CVE-2026-2329) in Grandstream VoIP phones could let hackers remotely take full control of the devices and even intercept calls, Rapid7 researchers discovered. Data on 1.2 million French bank accounts accessed in registry breach In late January 2026, a malicious intruder accessed France’s national bank account registry, FICOBA, enabling them to view information tied to 1.2 million accounts, the Ministry of the Economy and Finance disclosed on Wednesday. TV5 Monde reported that the perpetrator (or perpetrators) obtained login credentials belonging to a civil cervant authorized to use the database and then used those credentials to explore its contents. Microsoft reveals critical Windows Admin Center vulnerability (CVE-2026-26119) Microsoft has disclosed a privilege-escalation vulnerability in Windows Admin Center (WAC), a browser-based platform widely used by IT administrators and infrastructure teams to manage Windows clients, servers, clusters, Hyper-V hosts and virtual machines, as well as Active Directory-joined systems. Criminals create business website to sell RAT disguised as RMM tool A RAT masquerading as legitimate remote monitoring and management (RMM) software is being sold to cybercriminals as a service, Proofpoint researchers recently discovered. The fake RMM tool, called TrustConnect, was being marketed via an LLM-created website parked on trustconnectsoftware[.]com, supposedly belonging to “TrustConnect Software PTY LTD”. LockBit 5.0 ransomware expands its reach across Windows, Linux, and ESXi The Acronis Threat Research Unit (TRU) has identified a new and significantly enhanced version of the LockBit ransomware, LockBit 5.0, currently being deployed in active campaigns. The latest variant demonstrates expanded cross-platform capabilities, enabling attackers to target Windows, Linux, and VMware ESXi systems within a single coordinated attack. Don’t panic over CISA’s KEV list, use it smarter In this Help Net Security video, Tod Beardsley, VP of Security Research at runZero, explains what CISA’s Known Exploited Vulnerabilities (KEV) Catalog is and how security teams should use it. He shares his perspective as a former section chief for KEV at CISA and breaks down common misunderstandings about what the list represents. Cybersecurity in cross-border logistics operations In this Help Net Security video, Dieter Van Putte, CTO at Landmark Global, discusses how cybersecurity has become a core part of global supply chain operations. He explains that logistics is now also about data moving between carriers, customs authorities, warehouses, brokers, and customers. That constant flow increases risk and expands the attack surface. In GitHub’s advisory pipeline, some advisories move faster than others GitHub Security Advisories are used to distribute vulnerability information in open-source projects and security tools. A new study finds that only a portion of those advisories ever pass through GitHub’s formal review process. Android 17 beta brings privacy, security, and performance changes Google has released the first beta of Android 17, giving developers an early view of changes to core app behavior, platform tooling, performance, media handling, and connectivity. The company plans to move quickly from this beta toward the Platform Stability milestone, targeted for March, where final APIs and behavior definitions for apps will be delivered. UK sets course for stricter AI chatbot regulation The UK government has announced immediate action to force AI chatbot providers to comply with laws requiring online platforms to protect children from illegal and harmful content. Providers that fail to meet these duties will face legal consequences. Microsoft equips CISOs and AI risk leaders with a new security tool Microsoft released Security Dashboard for AI in public preview for enterprise environments. The dashboard aggregates posture and real-time risk signals from Microsoft Defender, Microsoft Entra, and Microsoft Purview into a single view within security tools. Phobos ransomware affiliate arrested in Poland Officers from Poland’s Central Bureau for Combating Cybercrime (CBZC) detained a 47-year-old man suspected of creating, acquiring, and sharing computer programs used to unlawfully obtain information stored in computer systems. He faces a potential prison sentence of up to five years. Pressure builds on Grok AI, Ireland launches investigation The Irish Data Protection Commission (DPC) opened an investigation into X over concerns that its Grok AI chatbot was used to generate sexualized deepfakes. The investigation focuses on the apparent creation and publication of potentially harmful, non-consensual intimate or sexualised images on X using generative AI tools linked to the platform’s Grok LLM. Claude Sonnet 4.6 launches with improved coding and expanded developer tools Anthropic released Claude Sonnet 4.6, marking its second major AI launch in less than two weeks. According to Anthropic, Sonnet 4.6 delivers improved coding skills to more users. Tasks that once required an Opus-class model, including economically valuable office work, are handled by Sonnet 4.6. The model also brings improvements in computer use capabilities compared to earlier Sonnet versions. Attackers keep finding the same gaps in security programs Attackers keep getting in, often through the same predictable weak spots: identity systems, third-party access, and poorly secured perimeter devices. A new threat report from Barracuda based on Managed XDR telemetry from 2025 shows that many successful incidents still start with basic access and configuration failures, not advanced malware. Microsoft signals breakthrough in data storage that can last for generations Microsoft announced progress on Project Silica, its research initiative focused on developing durable, long-term quartz glass-based data storage technology. Rising global data volumes increase the need for storage that can last for generations. Researchers believe this technology could preserve information for up to 10,000 years. UK sounds alarm on rising cyber risks to businesses The UK government launched a national campaign urging businesses to strengthen basic cyber defenses. The initiative follows new figures highlighting the scale of the threat. Serious cyber incidents cost businesses an average of £195,000, with about half of small firms experiencing one in the past 12 months, officials say. Open-source benchmark EVMbench tests how well AI agents handle smart contract exploits EVMbench is a new open-source benchmark designed to test AI agents on practical smart contract security tasks. The benchmark was developed by OpenAI and Paradigm, and it focuses on real-world vulnerability patterns drawn from audited codebases and contest reports. Adidas investigates alleged data breach affecting 815,000 records Adidas confirmed it is investigating a possible data breach involving one of its third-party customer service providers. The company stated that there is no indication its IT infrastructure, e-commerce platforms, or consumer data were impacted by the incident. Poland restricts Chinese-made cars at protected military sites Poland’s military leadership has decided that cars manufactured in the People’s Republic of China will no longer cross the gates of sensitive military bases. The decision follows a risk analysis focused on the growing integration of digital systems in cars and the potential for uncontrolled acquisition and use of data by those systems. 651 arrested, $4.3 million recovered in African cybercrime sweep Operation Red Card 2.0, supported by INTERPOL and involving law enforcement agencies from 16 African countries, led to 651 arrests and the recovery of more than $4.3 million from online scams. Running from 8 December 2025 to 30 January 2026, the operation targeted networks behind high-yield investment fraud, mobile money scams and fraudulent loan applications that caused more than $45 million in losses. Man gets five years for aiding North Korean IT employment scam Ukrainian national Oleksandr Didenko, 29, was sentenced in U.S. District Court to 5 years in prison for an identity theft scheme that enabled North Korean workers to secure fraudulent employment. Ex-Google engineers charged with orchestrating high-tech secrets extraction A federal grand jury has indicted three Silicon Valley engineers on charges in a scheme to steal trade secrets from Google and other leading technology companies. MOS: Open-source modular OS for servers and homelabs A growing number of homelab builders and small server operators are testing an open source operating system that combines basic server management, storage control, and container services under a web interface. MOS is a free modular OS built on a Devuan base that provides a web UI and API for system monitoring, storage pooling, container orchestration, and virtualization. Apple privacy labels often don’t match what Chinese smart home apps do Smart home devices in many homes collect audio, video, and location data. The apps that control those devices often focus on the account owner, even when the technology also captures guests, neighbors, and other people who never agreed to be monitored. New research examined whether Chinese smart home apps provide privacy protections for these bystanders. Vim 9.2 adds scripting updates, diff improvements, and experimental Wayland support Vim 9.2 adds a range of incremental changes focused on scripting, usability, and cross-platform support. The update includes improvements to completion behavior, expanded Vim9 language features, and new options for diff mode. ChatGPT gets new security feature to fight prompt injection attacks OpenAI has introduced Lockdown Mode and Elevated Risk labels in ChatGPT to help users and organizations reduce the risk of prompt injection attacks and other advanced security threats, particularly when using features that interact with external systems. OT teams are losing the time advantage against industrial threat actors In many industrial environments, internet-facing gateways, remote access appliances, and boundary systems sit close enough to production networks that attackers can move from IT intrusion to operational disruption with limited resistance. Dragos’ 2026 OT/ICS Year in Review describes a threat landscape where adversaries are spending more time learning how physical processes work and less time treating OT access as a passive foothold. AWS coding agents gain new plugin support across development tools AI coding assistants have become a routine part of many development workflows, helping engineers write, test, and deploy code from IDEs or command line interfaces. One recent change in this ecosystem makes it possible for those agents to interact with AWS in a broader set of ways by adding a library of plugins that give agents specific AWS knowledge and actions. Microsoft Defender update lets SOC teams manage, vet response tools Microsoft introduced library management in Microsoft Defender to help security analysts working with live response manage scripts and tools they use to triage, investigate and remediate threats. The library management interface allows analysts to organize their investigation tools and manage everything without waiting for an active session. Consumers feel less judged by AI debt collectors Debt collection agencies are starting to use automated voice systems and AI-driven messaging to handle consumer calls. These systems help scale outreach, reduce call center staffing demands, and offer 24/7 service. A new study covering 11 European countries found that this shift changes how consumers emotionally experience debt collection, especially around stigma and empathy. Men sentenced to 8 years in $1.3 million computer intrusion and tax fraud scheme Matthew A. Akande, a Nigerian national, was sentenced by a U.S. District Court to eight years in prison, followed by three years of supervised release, for his role in a scheme to break into Massachusetts tax preparation firms’ computer networks and file fraudulent tax returns. The operation generated over $1.3 million in fraudulent tax refunds. Public mobile networks are being weaponized for combat drone operations On June 1, 2025, Ukraine launched drone strikes on five Russian airfields, damaging or destroying aircraft. More than 100 explosive drones used mobile networks to transmit data, receive instructions, and send images. Enea researchers analyzed the growing use of mobile-connected drones in conflict and the implications for national infrastructure. PromptSpy: First Android malware to use generative AI in its execution flow ESET researchers have discovered PromptSpy, the first known Android malware to abuse generative AI as part of its execution flow in order to achieve persistence. This marks the first time generative AI has been deployed in this way. Uptime Kuma: Open-source monitoring tool Service availability monitoring remains a daily operational requirement across IT teams, SaaS providers, and internal infrastructure groups. Many environments rely on automated checks and alerting to track outages, latency issues, and service degradation across web applications and network endpoints. Uptime Kuma is an open-source uptime monitoring project that supports this type of operational monitoring through a self-hosted deployment model. Quantum security is turning into a supply chain problem Supplier onboarding, invoice processing, and procurement platforms run on encrypted data flows that were built for long-term trust. In many organizations, that trust still depends on cryptographic standards like RSA and elliptic curve cryptography (ECC), even as security teams begin planning for a post-quantum world. A recent apexanalytix research report argues that supply chain leaders are already operating inside a quantum risk window, even though large-scale quantum computing remains years away. LINK“>Google cleans house, bans 80,000 developer accounts from the Play Store Google prevented more than 1.75 million policy-violating apps from being published on Google Play and banned over 80,000 developer accounts that attempted to publish harmful apps in 2025. Developer verification, mandatory pre-review checks, and testing requirements in the Google Play ecosystem have reduced entry points for bad actors. LLMs change their answers based on who’s asking AI chatbots may deliver unequal answers depending on who is asking the question. A new study from the MIT Center for Constructive Communication finds that LLMs provide less accurate information, increase refusal rates, and sometimes adopt a different tone when users appear less educated, less fluent in English, or from particular countries. Applying green energy tax policies to improve cybersecurity For years, governments have focused only on the stick of compliance when they could leverage the carrot of tax incentives. Theoretically, compliance fines and penalties should act as a deterrent that improves accountability and reduces data breaches. However, many vendors often assume compliance risk rather than securing data effectively. The era of the Digital Parasite: Why stealth has replaced ransomware For years, ransomware encryption signaled a breach. When systems locked up, defenders knew an attack had occurred. Data from Picus Security’s Red Report 2026 shows attackers shifting their strategy from disruption to persistence. Cybersecurity jobs available right now: February 17, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: February 20, 2026 Here’s a look at the most interesting products from the past week, featuring releases from Compliance Scorecard, Impart Security, Redpanda, and Virtana.

New infosec products of the week: February 20, 2026 Here’s a look at the most interesting products from the past week, featuring releases from Compliance Scorecard, Impart Security, Redpanda, and Virtana. Impart enables safe, in-app enforcement against AI-powered bots Impart Security has launched Programmable Bot Protection, a runtime approach to bot defense that brings detection and enforcement together within the application. Impart makes enforcement operational by enabling teams to see what would be blocked before turning it on. Compliance Scorecard v10 delivers context-driven AI for explainable compliance decisions Compliance Scorecard announced the release of v10, introducing governed, audit-ready AI designed to support defensible compliance decision-making for managed service providers (MSPs). Compliance Scorecard v10 applies AI only within a structured system of validated context and controls. The platform is built on a simple premise: AI can only be trusted in compliance if the required context already exists. As a result, v10 treats AI as a governed system of decision support, not a conversational interface. Virtana expands MCP Server to bring full-stack enterprise context to AI agents Virtana announced the latest version of its Model Context Protocol (MCP) Server, bringing full-stack enterprise visibility directly to AI agents and LLMs so machines can understand enterprise operations as complete systems rather than isolated signals. Redpanda brings identity, policy control, and data governance to AI agents Redpanda announced the availability of new core capabilities in the Redpanda Agentic Data Plane (ADP), including a centralized AI gateway, AI observability and evaluation via OpenTelemetry, AI agents, and unified authentication and authorization. Together, these features form a unified governance layer that allows enterprises to securely connect AI agents and Model Context Protocol (MCP) servers to live enterprise data with visibility and control.

Redpanda brings identity, policy control, and data governance to AI agents Redpanda announced the availability of new core capabilities in the Redpanda Agentic Data Plane (ADP), including a centralized AI gateway, AI observability and evaluation via OpenTelemetry, AI agents, and unified authentication and authorization. Together, these features form a unified governance layer that allows enterprises to securely connect AI agents and Model Context Protocol (MCP) servers to live enterprise data with visibility and control. As organizations move from AI experimentation to production, the challenge has shifted from building agents to governing them. “This is why the enterprise agentic AI market is struggling while consumer AI flourishes,” said Tyler Akidau, CTO of Redpanda. “Building an agent is remarkably easy. Running one safely in a company, with access to sensitive systems and data, remains genuinely hard. Redpanda is focused on bringing control to the connectivity layer – rather than configuring access policies individually at each data source, enterprises need a central point through which all agent interactions flow: an agentic data plane.” “AI agents don’t fail because models are bad; they fail because systems lack control,” said Alex Gallego, founder and CEO of Redpanda. “With Redpanda Agentic Data Plane, we’re giving enterprises a practical way to operate agentic systems safely, with identity, policy enforcement, and observability built in from day one.” Available Redpanda ADP capabilities First introduced in October, Redpanda’s ADP exists to make AI agents trustworthy at scale. Acting as both a governance layer and a control plane, it governs how agents authenticate, access data, and take action while recording intent, inputs, and outputs for complete auditability. With AI Gateway, open agent interoperability, unified identity, and full observability, enterprises gain the controls needed to safely run agents on live data without sacrificing speed or visibility. “Redpanda addresses the right requirements with this release, as our research shows a strong need for both strong AI governance and real-time data inputs,” says Kevin Petrie, VP Research and Head of Data Management Practice of BARC. “AI adopters feel overwhelmed with the complex task of meeting these requirements while safely integrating powerful GenAI models into their business processes. Redpanda’s approach will help make data and AI leaders’ lives easier.” AI Gateway Redpanda AI Gateway provides a unified access layer between applications, AI models, and MCP services. It centralizes routing, policy enforcement, cost controls, and observability across all AI traffic. Enterprises can define token budgets, set spending limits, and optimize usage through deferred tool loading, bringing operational discipline to complex agent workflows. The AI Gateway also serves as a central point to aggregate and govern MCP servers, with an admin-controlled registry of approved servers and YAML-based configuration for rapid deployment. AI agents Redpanda ADP is designed to work with any AI agent framework. Enterprises can run and govern agents built on their existing frameworks, as well as use Redpanda’s built-in AI agents when they want a fully-managed option. All agents, whether hosted by Redpanda or external, interact with data and tools through open standards like the A2A protocol, and integrate with ADP’s unified authentication, authorization, and observability services. Agents can also be triggered through Redpanda Connect pipelines, enabling real-time, event-driven and human-in-the-loop workflows. Unified authentication and authorization All components of the Redpanda Agentic Data Plane are secured through OIDC-based identity and fine-grained authorization policies. Every request, whether from a user, service account, or agent, is authenticated and governed, eliminating long-lived credentials and reducing the risk of uncontrolled agent access. End-to-end observability and evaluation Redpanda ADP emits full-fidelity metrics, traces, logs, and transcripts using the OpenTelemetry Protocol (OTLP). Enterprises can inspect agent behavior directly in the Redpanda console or export traces to external observability platforms, enabling debugging, compliance, and post-incident analysis. The Redpanda Agentic Data Plane is built on a low-latency streaming foundation, enabling real-time data access, continuous context updates, and event-driven agent execution. With more than 300 connectors available through Redpanda Connect, enterprises can expose data from databases, SaaS platforms, data streams, and data lakes without moving data or breaking existing architectures.