September 15, 2023

Recent Ivanti Endpoint Manager Flaw Exploited in Attacks

Right now, there is probably an AI agent running on a laptop somewhere in your network. One section told the agent to add a server to its own configuration and install a package called function-color from npm. The file was AGENTS.md, a plain-text instructions file that a coding agent, such as OpenAI’s Codex, reads when it starts in a folder and follows as directions. The company caught the attempt on a real customer’s machine and stopped the agent before any code ran.

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program. Last month, Microsoft flagged it as potentially exploited in the wild in December 2025.

As a result, enterprises are beginning to shift toward integrated, unified, AI-powered platforms that consolidate endpoint management, security, and zero trust access to reduce complexity and strengthen endpoint resilience. For instance, “it’s over-permissioning and organizations having identity systems that are not set up for this modern world,” he said. A partner can use AIDR, for instance, to provide a customer with an assessment showing all of the ways their employees are using AI—something that many businesses are currently unaware of, he said. Partners will also find that https://payusainvest.com/the-us-authorities-demanded-that-twitter-report-on-the-protection-of-users-personal-data.html Falcon AIDR can provide the basis for delivering other types of solutions and services such as security assessments, Sentonas said.

Attackers Tampered with AOMEI Backupper’s Update Servers for Minutes to Deliver a Backdoor

The bulletin states the issue primarily impacts customers running the Australia platform release or customers on older releases who made certain configuration changes. While ServiceNow has not publicly disclosed technical details about the flaw, administrators discussing the incident on Reddit say the issue appears to be tied to a REST endpoint at ‘/api/now/related_list_edit/create’. Support case information has become an increasingly popular target for https://influencemarketingnews.com/maintaining-compliance-in-influencer-marketing/ threat actors, as tickets can contain credentials, API tokens, internal documentation, and authentication secrets shared during troubleshooting. The company says this security update changes the API endpoint configuration to limit access to authenticated users only.

• On October 22, CISA added the flaw to KEV, giving Federal Civilian Executive Branch (FCEB) agencies a three-week deadline to patch up or stop using the program altogether.
• “On June 5, 2026, ServiceNow applied a security update to hosted customer instances,” reads the support bulletin.
• While CISA’s directive is only mandatory for FCEB agencies, organizations in the private sector would do well to follow suit and patch up, since cybercriminals rarely make the distinction between the two.
• However BleepingComputer speculates the recent attacks on Asahi brewery and the Askul ecommerce retailer may have been done through the Motex flaw.
• The company says this security update changes the API endpoint configuration to limit access to authenticated users only.

September Patch Tuesday: 963 CVEs, 2 exploited flaws, 1 message

Endpoint Detection and Response (EDR) tools offer real-time monitoring, threat intelligence, and automated response capabilities, which are essential for modern cybersecurity operations. This evolution necessitates a departure from traditional perimeter-based security models toward comprehensive endpoint-centric protection strategies. The endpoint security paradigm has undergone a fundamental transformation as organizations contend with increasingly complex attack surfaces and sophisticated threat actors. This comprehensive analysis examines cutting-edge tools, provides technical implementation guidance, and establishes best practices for securing modern endpoint environments against evolving cyber threats. Organizations must navigate a complex terrain of EDR, XDR, and EPP solutions while implementing Zero Trust architectures and managing unprecedented endpoint diversity. BOD only applies to federal agencies, but all organizations are advised to review CISA’s KEV list and apply patches and mitigations for the vulnerabilities it describes.

The tool, called BigDiskBuster , has no patch, no CVE, and no Microsoft advisory. “The attack chain begins with a fake CAPTCHA page and culminates in the deployment of a fully-featured C2 agent,” Ontinue threat researcher Rhys Downing said in a technical report. The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex . CSuite Phishing Leads to Both Account and Endpoint Access CSuite attack chain exposed by ANY.RUN researchers CSuite starts with familiar business lures built around Adobe, DocuSign, Zoom, Google Meet, Dropbox, and Microsoft 365. Technology, manufacturing, government, and consulting organizations showed the highest exposure. Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content.

Apple issues urgent iOS patch as it navigates the spyware arms race

An endpoint policy could affect an application the business depends on. The agentic tool, codenamed MDASH, will open to enterprise customers in private preview in June. Early adopters can now test a new version of the Edge for Business browser with added agentic AI. The company has made public the mathematics behind its post-quantum encryption verification, setting a challenge to the entire industry to prove its own code is equally secure. Security experts urge organizations to review certificate dependencies beyond browsers as trust-store changes take effect. The new capabilities extend Endpoint Central’s coverage as a unified endpoint management and security platform with advanced detection, response, and secure access controls.

On October 22, CISA added the flaw to KEV, giving Federal Civilian Executive Branch (FCEB) agencies a three-week deadline to patch up or stop using the program altogether. At the time the patch was released, the vulnerability was already being exploited as a zero-day, Motex confirmed. AI enables behavioral-based detection that can identify suspicious activity even when no known malware signature exists, significantly improving detection speed and reducing false alerts compared to traditional antivirus approaches. Attackers frequently target smaller organizations precisely because they assume weaker defenses.

Vodafone Business and Lookout: A partnership built for the modern workplace

“Where possible, privileged identity management, or PIM, is worth exploring to grant admin rights on a just-in-time, time-bound basis, which reduces exposure from persistent global admin sessions.” Researchers from Halcyon said security teams should take additional measures to make sure they enforce privileged access. What is most concerning about some of the more recent attacks is the ability to gain administrative access https://e-beginner.net/why-is-data-backup-important/ to Microsoft Intune and thus bypass endpoint security triggers. They cited information from the Israeli National Cyber Directorate, which received multiple reports of hackers deleting data from servers and workstations. CISA confirmed that it consulted with Microsoft and Stryker before releasing the advisory and said both companies contributed to the guidance.

• Simplified subscription licensing and elastic cloud scale helps streamline deployment, while future endpoint and continuous threat exposure management (CTEM) architectural expansions will be incorporated into the FortiSOC experience.
• Built-in SOC best practices, shaped by Fortinet’s own global SOC operations, are embedded alongside AI/ML and FortiAI capabilities to accelerate analysis and response.
• With 7,000 employees across 65 countries, Trend Micro enables organizations to simplify and secure their connected world.
• Fortinet is also expanding FortiAI across FortiAnalyzer, FortiSIEM, FortiSOAR, and FortiSOC to move beyond interactive copilots toward agentic execution that connects telemetry, tools, and response actions across the SOC.
• The updates feature next-generation SecOps advancements, including expanded agentic AI capabilities, a preview of FortiSOC, managed services, and endpoint security enhancements delivered through FortiEndpoint.

State of Ad Fraud 2026: 52% of Schemes Use AI as Cloaking Loses Ground to iOS Exploits and Messenger Phishing

It affects the TeamViewer Full Client on Windows, Linux, and macOS, the Windows Portable edition, and the Android Remote Control app, in all versions before 15.83. A malicious or compromised host can exploit the flaw to crash the viewer’s TeamViewer and, depending on the platform, may also run code on the viewer’s computer. TeamViewer has fixed a flaw that lets the machine being controlled in a remote session attack the computer that connected to control it. The AI exposed hundreds of bugs in Mozilla’s web browser, raising hopes around defensive advantage, alongside fears of dual-use risk. Consultants see the problem eating away at valuable patch resources because of a lack of Microsoft update hygiene. A major change is coming to Windows that neither individual users nor IT admins can ignore.