Security Bulletin

The new capabilities address the challenge of AI agents inheriting access through existing vulnerabilities like hard-coded credentials and dormant accounts, allowing them to escalate privileges rapidly.

The Radware H1 2026 Global Threat Analysis Report indicates a significant shift in attack methods, with direct-path volumetric floods, particularly stateless UDP floods, now comprising 73% of mitigated packets.

Researchers at Aikido Security discovered four packages containing the Shai-Hulud worm, which had the same malicious payload hash as the original attack from May.

The system measures spending agent by agent across cloud, code, and endpoints, offering a more comprehensive view than gateway-centric tools.

The BlueMoon exploit kit targeted U.S. defense contractors, NGOs, and Southeast Asian government agencies.

The WeWorm tool exploits a zero-click remote code execution vulnerability in WeChat's voice-over-IP stack.

An analysis of Project Glasswing findings shows only a fraction have reached disclosure, and an even smaller number have been fixed.

AI-agent security doesn't end with authentication. Instead, that's only the beginning.

US agencies claim Chinese companies covertly extracted billions of tokens from OpenAI, Anthropic, Google Gemini, and SpaceX's Grok to reduce development costs.

Memory-resident malware targeting F5 BIG-IP appliances can evade file-based security defenses.

September 2026 Patch Tuesday set a record and teams must now shift to risk-based prioritization versus simply finding bugs.

"Workflow identity hijacking" can bypass standard security controls and hijack an organization's data by sending a basic request through an unauthenticated entry point.