Security researchers have published the first public proof-of-concept for CVE-2026-86950, an Apple CoreGraphics flaw Apple says may have been used in attacks against specific targeted individuals. The trigger is a malicious PDF with a crafted embedded font that crashes unpatched iPhones and Macs. The code causes a crash, not an execution error. Turning the memory corruption into a working
Microsoft has reminded customers that the Entra ID authentication system will get better protection against external script injection attacks starting next month. The company first revealed plans to secure Entra ID sign-ins from script injection attacks in a November 2025 announcement. According to a Monday message center update seen by BleepingComputer, Microsoft will begin enforcing additional Content Security Policy (CSP) defenses that will only allow scripts from trusted Microsoft content delivery network (CDN) domains during Entra ID sign-ins. The rollout should end by late October 2026, after which all users will be protected from various sign-in security risks, including cross-site scripting attacks in which malicious code is injected into websites to steal credentials. "Microsoft Entra ID will enhance sign-in security by enforcing a Content Security Policy blocking external script injection starting mid-October 2026," the company said. "This change helps protect users from threats such as cross-site scripting (XSS) by allowing only trusted Microsoft-hosted scripts to run during authentication and blocking unauthorized or externally injected code."
Pentagon personnel agency breach exposed data of 3 million people after attackers accessed a file-sharing server for about nine months. The U.S. Defense Manpower Data Center (DMDC), which maintains personnel records for the Department of Defense, is notifying people that their personal information was exposed in a data breach. According to the agency, unauthorized users accessed one of its file-sharing servers for roughly nine months. The breach affects 2.76 million living people and 294,000 deceased individuals, according to a Department of War official. DMDC held at least 60 million records in fiscal year 2024, covering military and civilian personnel, contractors, family members, retirees and veterans. “The Pentagon has confirmed that the breach affects 2.76 million “living individuals,” a category that potentially includes current and former defense personnel or their dependents, and 294,000 “deceased individuals,” a Defense Department official told CNN on Monday, three days after this story was published.” CNN states. The Defense Manpower Data Center (DMDC) has notified individuals that a security vulnerability exposed personal information stored on one of its file-sharing systems. The vulnerability was discovered on July 16, 2026, and the US office quickly patched the system and restored it. An investigation found that a small number of unauthorized users had accessed files between October 2025 and the discovery date. The files contained unencrypted personal information. “On July 16, 2026, a security vulnerability in a DMDC file sharing system was discovered, which allowed unauthorized users to access files. DMDC immediately updated the file sharing system to patch the vulnerability and the system was restored.” reads a data breach notification letter sent to impacted individuals. “Analysis identified that between October 2025 and the date of discovery, a small number of unauthorized users accessed files on a server containing unencrypted PII. The types of PII involved vary by individual; however, in your case, they include social security number (SSN) and at least one additional identifier such as name, date of birth, contact information, sex, race, and military personnel information (such as occupational specialty).” US Defense Manpower Data Center (DMDC) notice of data breach (Source Reddit) The data exposed varies by person, but in this case included Social Security numbers (SSNs) and at least one other identifier, such as name, date of birth, contact details, sex, race or military personnel information, including occupational specialty. After discovering the vulnerability, the Defense Manpower Data Center (DMDC) launched its privacy and cybersecurity incident response process in line with U.S. government policies and guidelines. The agency says it is assessing the affected system and taking steps to improve its security. DMDC is also offering 12 months of free credit monitoring through IDX, a company specializing in data breach and recovery services. Individuals affected by the breach are encouraged to contact IDX with any questions and enroll in the service. Enrollment is available through the dedicated IDX website using the enrollment code provided in the notification. The deadline to enroll is August 19, 2027. The credit monitoring is intended to help affected individuals identify potential misuse of their personal information following the breach. At this time, no known cybercrime group claimed responsibilty for the attack. DMDC says it launched privacy and cybersecurity incident response actions after finding the vulnerability. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, US Defense Manpower Data Center)
Identity governance helps control who should have access, but periodic reviews alone may not reveal attacks as they happen. tenfold Software explains how real-time identity telemetry can help security teams investigate suspicious activity before it escalates.
Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a cyberattack disclosed late last week. The company announced the incident on September 25, saying that a third party had accessed its systems at the beginning of the month. Times Car took action to block the unauthorized access on September 26. At the time, the company said it was investigating whether the attackers accessed members' personal information, but confirmed the data theft in an update earlier today. The company says that the intrusion affects 6.6 million current and former Times Car members, and also current and former members of the Times Business Service corporate account program. According to the update, exposed information includes the following data: The company said that passwords were stored in “a form that cannot be restored,” suggesting they were encrypted or hashed, although it did not provide additional details.
Infostealers are exposing corporate AI accounts, sessions and API keys, giving attackers access to sensitive data, compute and connected systems. SOCRadar analyzed stealer log data from the last 90 days and found 482 companies with exposed AI accounts and credentials. Of those, 295 appeared in active logs during that period, suggesting the exposure is recent rather than the result of historical cleanup. Together, these companies account for 5,434 stealer log records linked to 1,500 distinct corporate email addresses. The number that really stands out is the ChatGPT figure. A captured ChatGPT or OpenAI session appeared at 358 of the 482 companies, accounting for roughly 90% of all records in the study. Other platforms, including Zapier, Notion, Hugging Face, Replit, Lovable and ElevenLabs, were far behind. This doesn’t necessarily point to a security problem with OpenAI. It says more about how employees use AI at work. Many people simply signed up for ChatGPT with a work email and used it on a personal device, often outside company policies and without IT teams even knowing it was happening. Claude and Gemini barely appear in the data, and SOCRadar is explicit about what that means and what it doesn’t. The researchers read the absence as a shadow-AI signal, not evidence that those platforms are safer to steal from. Anthropic demonstrated that in late August when infostealer malware started hijacking Claude sessions to drain paid usage, forcing a company-wide sign-out, payment method removal, and fraud refunds. Users noticed on Reddit when their usage limits “refilled and then drained” overnight. Claude sessions are targeted the moment they exist in enough volume; there are just fewer of them in corporate environments today. A stolen AI login is categorically different from a stolen password, and the report makes a clear case for why the industry needs to treat it that way. “A stolen cookie is a live session. As Okta’s Jeremy Kirk put it, “session tokens and API keys are sought specifically by threat actors because it is often possible to replay those secrets and bypass credential-based authentication.”” reads the report published by SOCRadar. “Rotating the password alone leaves the intruder signed in.” That quote comes from Okta researcher Jeremy Kirk, cited in the report after Okta’s team pulled a 7 GB stealer dump off Telegram and found thousands of still-replayable tokens inside, including two dozen valid API keys for major AI providers. Rotating the password after a credential theft doesn’t help if the active session cookie is still valid. The attacker stays logged in regardless. The conversation history inside a compromised AI account creates a different kind of breach. Employees often paste source code, customer data, contracts and unreleased plans into AI prompts without thinking of it as data leaving the company. But once an attacker takes over the session, they can access that entire history without ever breaking into the company’s internal systems. The AI account has effectively become part of the company’s corporate memory, and the stolen session provides access to it. API keys add a financial risk on top of the data exposure. During July, August and September 2026, underground forums were openly offering Claude API keys, ChatGPT cookies from paid and Pro accounts, and Cursor sessions, in some cases with money-back guarantees. This fuels a type of abuse known as LLMjacking: attackers steal keys from notes, configuration files or workspace settings and use them to run AI workloads at the victim’s expense, or resell the access at a discount. The victim gets the bill. The attacker gets the computing power. “Keys copied into a notes app or a workspace settings page get lifted with everything else, then billed to the victim or resold. Underground vendors sell discounted access to Claude, Gemini and Cursor accounts and money-back guarantees.” states the report. Automation platforms make the exposure worse. A stolen Zapier session carries standing authorization into CRM systems, email, and file storage. An attacker with access can build a workflow that exfiltrates data on a schedule, from a trusted vendor IP address, without any further credential theft required. The sector breakdown is worth noting. Technology firms are the largest group at 144 companies and 40% of all records, which matters because those companies hold downstream client data too. But industrials, financial services, healthcare, retail, and energy all appear in force. Agent and automation exposure, the category that carries an employee’s authorization into other systems, concentrates specifically in healthcare, financial services, and technology, which are exactly the sectors least able to absorb that kind of lateral movement. All of this is happening while the AI industry debates frontier safety risks, autonomous agent swarms, and the pace of development. That conversation is real and worth having. This report is about something more immediate and considerably more actionable: You don’t need an autonomous swarm to lose your corporate memory. One employee, one unmanaged laptop, one saved ChatGPT password and a commodity infostealer, widely available in Telegram channels since 2022, can be enough. The controls recommended in the report are straightforward. Put AI platforms behind single sign-on, use short-lived sessions and rotate refresh tokens so stolen cookies expire quickly. Limit and regularly rotate API keys, and flag activity from unusual locations or outside normal working hours. If an employee shows up in a stealer log, treat it as an endpoint security incident, not simply a password reset. And find shadow AI accounts first: you can’t rotate credentials or secure accounts you don’t even know exist. Anthropic’s own response to the August incident is the template the report points to: the company didn’t just advise a password change, it invalidated sessions, removed payment methods attackers were abusing, and notified affected users that their machines were compromised. That last step is the difference between a data feed and an actual fire alarm. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, AI accounts)
Researchers found more than 16,000 misconfigured Supabase databases exposing readable tables with personally identifiable information, passwords, or authentication tokens. Based on the analysis of table schemas, researchers at cyber risk management company UpGuard believe that a very small set of the exposed information includes credit card data. Supabase is an open-source development platform built around PostgreSQL that provides developers with a range of backend services to build and launch apps and websites faster. The service has become increasingly popular among developers using artificial intelligence tools to build projects, with AI-assisted development accounting for more than 60% of newly created databases. UpGuard researchers analyzed a dataset of around 300,000 domains that showed signs of using Supabase and checked for a 'users' table. While some queries returned a page from the database, others hinted that the 'users' table did not exist, but a table with another name was accessible.
Nearly 400,000 DC Medicaid and Healthcare Alliance beneficiaries may have had personal data exposed through reports published on a public website. The District of Columbia Department of Health Care Finance is notifying nearly 400,000 Medicaid and DC Healthcare Alliance beneficiaries that their personal information may have been exposed. The incident affects people who enrolled between 2023 and 2026. A cyberattack did not cause the breach. DHCF reported the breach to the US Department of Health and Human Services, stating that 399,086 people were affected. In July, DHCF discovered that two reports published on its website contained hidden personal information that could be accessed by unauthorized individuals. The exposed data included Medicaid IDs and other beneficiary information. “On July 21, 2026, DHCF learned that two reports on DHCF’s website contained hidden personal information that could be accessed by people who did not have permission to view it. These reports were intended to display only summary information about groups of people, such as enrollment counts and other statistics, and did not show anyone’s personal details on the screen.” reads the incident notice published by DHCF. “However, underlying personal information that supported these reports may have been reachable by unauthorized users between 2023 and July 2026.” DHCF removed the affected reports after discovering the issue, launched a review and began strengthening its internal processes. Exposed data may have included Medicaid IDs, dates of birth, provider names, race, gender, ward and ethnicity, but not names, Social Security numbers or financial information. DHCF said the risk of misuse is lower because the exposed information did not include Social Security numbers or financial account details. “Because the information that could have been reached did not include Social Security numbers or financial account information, it is less likely that the information connected to you, your child, or your family member will be used in the wrong way,” reads the data breach otification letter. The agency said it has no evidence the exposed data was accessed or misused, but urged victims to remain alert for identity theft and fraud. DHCF removed the reports, launched an internal investigation and conducted system checks after discovering the exposure. “DHCF has no reason to believe anyone looked at or used any of this information in the wrong way, but it is always advisable to remain vigilant against the potential for identity theft and fraud and to monitor your accounts and credit reports for any suspicious activity.” states DC Healthcare Alliance. Under U.S. law, impacted users can get one free credit report each year from Equifax, Experian and TransUnion. They can check their reports regularly for suspicious activity or signs of identity theft. They can request them through AnnualCreditReport.com or by phone. Users can also stagger requests to check one report every four months. Users can also place a free one-year fraud alert on their credit file. It asks lenders to verify your identity before opening new accounts or changing existing ones. Contacting any one of the three credit bureaus will automatically notify the other two. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, data breach)
A former U.S. Army soldier has been sentenced to 70 months in prison for hacking and extorting at least 10 U.S. technology and telecommunications companies between April 2023 and December 2024. 21-year-old Cameron John Wagenius (also known online as 'kiberphant0m' and 'cyb3rph4nt0m' ) was arrested in Texas in December 2024. He pleaded guilty in February 2025 to hacking AT&T and Verizon after being charged on two counts of unlawfully transferring confidential phone records, and in July 2025 to multiple counts of aggravated identity theft, conspiracy to commit wire fraud, and extortion related to computer fraud. According to court documents, while on active duty with the U.S. Army, Wagenius and his accomplices stole login credentials for the victim's networks using the SSH Brute hacking tool he helped develop. They also used Telegram to transfer stolen credentials and plan their attacks.
What is IAM for AI agents? AI agents authenticate, invoke tools, and act across enterprise systems with delegated authority. IAM for AI Agents is the identity-control architecture that governs those actors. This guide covers the limits of conventional provisioning, the components that matter, how to evaluate framework choices, and what runtime evidence proves an agent behaved as intended.
Confirm this action.
Leaving now will discard your changes.