Daily cybersecurity news: solutions, incidents, analytics, M&A and funding

Let's Encrypt will switch all subscribers to 64-day TLS certificates by default on February 10, 2027, a step toward 45-day certificates in 2028; the last 90-day certificates will expire around May 11, 2027. Staging starts issuing 64-day certificates on October 14 for testing. Clients that support ACME Renewal Info need no changes; scripts that renew a fixed number of days before expiry should renew at about two-thirds of the lifetime.

Anthropic launched the Anthropic Cyber Mission with two programs. OSS Scanner gives opt-in open source projects free periodic scans by its strongest models, with model-generated reports sent without human review and an expected true-positive rate above 90%. The Critical Infrastructure Defense Program brings Claude models, on-site engineers and threat research to OT security providers, starting with 11 partners including CrowdStrike, Dragos and Rockwell Automation.

Certificates that Windows uses to verify Windows Update servers expire on May 17 and June 19, 2027, and devices without the replacements will stop receiving all updates, Microsoft warns. Windows 11 25H2 needs no action; 24H2 and Windows Server 2025 need the September 2025 update or later, and most other supported versions the July 2026 update or later. WSUS-managed devices are not affected.

AWS released Strands Box in developer preview, an open source local sandbox for AI agents that combines operating-system isolation with rules written in its Dogwood policy language. Shell commands, Python code, MCP tool calls and network traffic all pass through policy checkpoints that share one event history, so a rule can, for example, block uploads after an agent reads customer data, or allow git push only once tests pass.

GitHub built a fine-tuned classifier with Microsoft Applied Sciences that extends push protection to unstructured secrets, such as database passwords with no recognizable format, by looking at surrounding code. GitHub says it checks a batch of candidates in under two milliseconds and could more than double the secrets blocked before they enter repository history. It's in private preview, expanding later in October to Secret Protection customers.

The PCI Security Standards Council published guidance on securing AI in payment environments. It recommends defining each AI system's purpose and access before deployment, limiting agents to the least access they need, keeping passwords and keys out of AI systems, and requiring explicit human approval for any action by an agent with access to cleartext cardholder data. The recommendations are advisory; existing PCI requirements still apply.

Attackers began targeting CVE-2026-102255, a maximum-severity (CVSS 10) pre-authentication server-side request forgery flaw in SonicWall SMA1000 remote access appliances, within days of its October 6 disclosure, Previdian and Defused report. The bug lets unauthenticated attackers make the appliance issue requests to internal functionality. Fixed versions are 12.4.3-03670 and 12.5.0-03082; there is no workaround.

Citrix disclosed CVE-2026-107406 (CVSS 9.5), a memory overflow in NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider that can lead to remote code execution or denial of service. Fixed versions are 14.1-73.46 and 13.1-64.29 (and the matching FIPS/NDcPP builds). Citrix says it isn't aware of unmitigated exploitation. It's the latest in a run of NetScaler flaws in recent weeks.

Attackers began probing CVE-2026-21589, the critical file-read flaw in Atlassian's Data Center products, on October 6, hours after watchTowr published an analysis showing it can expose plaintext Crowd credentials that let attackers make themselves Jira administrators. By October 12, Previdian's honeypots had logged 377 exploitation attempts from 57 IP addresses in 19 countries. Patching or cutting instances off from the internet is urgent.

The Justice Department and FBI seized seven domains used to run MicroScan and FishHub, intrusion tools that China-based Integrity Technology Group used in Flax Typhoon operations against US and foreign critical infrastructure, from a South Carolina power company to Taiwanese universities. Agencies from seven countries published a joint advisory, and CISA added five old flaws the group exploits to its Known Exploited Vulnerabilities catalog.

The State Department's Rewards for Justice program is offering up to $10 million for information on Zhang Yu, a director at Shanghai Firetech accused of hacking for China's Ministry of State Security. Prosecutors say he and Xu Zewei stole COVID-19 research from US universities in 2020 and then joined the 2021 Hafnium campaign against Microsoft Exchange servers. Xu was extradited from Italy in April; Zhang remains at large.

Huntress says attackers have been exploiting two unpatched vulnerabilities in AhsayCBS, a backup management console popular with MSPs, since October 7: CVE-2026-105133 bypasses authentication and CVE-2026-105134 gives remote code execution as SYSTEM. Attackers dropped JSP webshells and XMRig miners disguised as Microsoft Edge. All versions through 10.3.4 are affected; until a patch ships, restrict the management interface to trusted IPs or VPN.

Northwestern University researchers tested AI coding agents on 112 real security bugs and found that benchmarks grading patches only on whether the proof-of-concept still crashes overstate quality. Claude Opus 4.7 stopped the crash in 90.2% of cases but passed the maintainers' own tests for the fix only 60.7% of the time; a third of its crash-stopping patches failed them. Agents also found answers via web search and git history.

Internet intelligence firm Modat identified 8,547 internet-exposed systems it could confirm belong to wind farms and solar parks in 35 countries across the EU, EFTA and EU candidate states, some of them management interfaces for single turbines or whole wind farms. Modat says the real number is higher and has notified affected parties through national CERTs.

In Yubico and Okta's 2026 Global State of Authentication survey of 1,890 technology and security professionals in nine countries, 43% said they sign in to work with a username and password, even though most rate passkeys as more secure. 52% were issued a password on their first day, 44% said their organization suffered an AI-driven attack in the past year, and 91% want a human approval step before AI agents take critical actions.

Forescout's analysis of more than 2.5 million devices in over 50 healthcare networks found that only 6% of connected medical devices and 16% of operational technology devices run SSH software that supports post-quantum cryptography, against 50% of IT devices. It also found more than 5,500 internet-exposed healthcare systems, mostly medical record and imaging platforms, of which only 31% support TLS 1.3.

A JumpCloud survey of 250 IT leaders in the US and UK found that more than half of organizations use AI agents that can change systems, permissions or files, yet only 41% of those have fully brought agents under the same identity and access policies as human users. 72% report a considerable gap between what AI may access and what they can prove it accessed, and 92% had at least one AI-related incident or exposure in the past year.

Palo Alto Networks' 2026 State of Critical Infrastructure Cybersecurity survey of more than 1,600 security leaders across 11 countries finds that 68% lack complete, real-time visibility of the assets on their OT networks, largely because of legacy systems. 42% name legacy OT equipment that can't be patched as their single biggest cybersecurity risk, and organizations juggle seven security tools on average.

Rein Security raised a $25 million Series A co-led by Glilot Capital and Sienna Venture Capital, with Corner Ventures participating, bringing total funding to $35 million. Rein watches what AI agents do in production, holds each to its role and blocks harmful actions before they run. It reports 8x revenue growth since its January 2026 launch.

Amsterdam-based Hadrian raised $40 million in a round co-led by Forgepoint Capital International and SmartFin, with existing investors HV Capital, Motive Partners, Picus Capital and Oetker Ventures participating, bringing total funding to $65 million. Hadrian combines continuous mapping of a company's external attack surface (Atlas) with on-demand AI-driven penetration testing (Nova). The money funds expansion across EMEA and the US.

doxx.net, founded by Prolexic founder Barrett Lyon, raised a $38 million Series A led by Andreessen Horowitz. It also opened the public beta of its Agentic Defined Networking platform: private, serverless networks for people and AI agents, with DNS-level blocking of malicious destinations. Andreessen Horowitz partner Joel De La Garza joins the board.

Osavul, a Luxembourg-based hybrid risk-intelligence startup that grew out of work during Russia's invasion of Ukraine, raised an €8.5 million Series A led by 33N Ventures with participation from Balnord, G+D Ventures, and 42CAP, bringing its total funding to about €12 million. The company's AI platform flags hostile intent across cyber, physical, and information domains for government, defense, and critical-infrastructure customers in more than 10 countries.

Kevin Mandia's Armadin raised a $255.5 million Series B at a valuation above $2.5 billion, co-led by Andreessen Horowitz and Accel, seven months after launching with $189.9 million in combined seed and Series A funding — $445 million in total. The startup replaces periodic human-led penetration testing with always-on autonomous agent swarms that chain vulnerabilities together to simulate attacks before real adversaries can.

Agentic-security startup Reco raised $55 million, including a strategic investment from AT&T Ventures and new investors Forestay and Quadrille Capital, bringing its total funding to $140 million. Reco gives security teams visibility into which AI agents are active across their environment, what identities and permissions they use, and what data and systems they can reach.