Welcome to The Cybersecurity Pulse (TCP)! I’m Darwin Salazar, Head of Growth at Monad and former detection engineer at Datadog. Each week, I bring you the latest security innovation and industry news. Subscribe to receive weekly updates! 📧
Howdy 👋🏽 - I hope you’re having an excellent week! Lots happening over the past several days with Splunk’s annual conference, nasty vulns in widely used software, and AI frontier labs giving the rest of the world whiplash (hint: it’s all theater. It always is).
On the personal front, my girlfriend and I have recently been consumed by Dan Brown’s The Secret of Secrets. We’ve read 330+ pages in 3 days. It’s a twisty thriller with a strong hacker component. Highly recommend!
Also, I will be speaking at BSides NYC on October 17th and we may or may not be hosting something special with friends the night before. If you have to start making arrangements to be there, now is a good time. More details to come!
Cool, let’s get into it!
Break the cold storage log blocker
Over 87% of security logs end up in cold storage. During a live investigation, the cost of log visibility adds up quickly.
Scanner’s latest guide breaks down how three approaches have failed to solve the SIEM cost problem. Inside: a framework plus a head-to-head benchmark on query cost and speed at 1TB scale, showing a 750x cost difference between approaches.
🗞️ TL;DR
🎭 AI leaders talk slowdown: Amodei, Altman and Musk say yes to slowing AI dev to focus on safety; Zuckerberg says ‘grow up’; Kurtz and Arora argue security can’t wait.
🧾 Stolen keys fund attacks: Anthropic says criminals reused victims’ API keys to carry out more intrusions. Great intel report btw.
🖨️ PaperCut’s AI attack swarm: GreyNoise traced 400+ compromised print-management instances; attackers reached domain admin at 12 organizations.
🦾 Exein’s $270M device bet: Embedded security company raises new equity to expand into robots, vehicles, and autonomous machines.
📱 Microsoft fake passkey rollout attacks: Helpdesk impersonators use setup lures to steal sessions or trick users into authorizing access.
📬 Cisco’s email-to-root bug: Cisco confirms attackers are exploiting a CVSS 9.8 gateway flaw through crafted emails.
🏠 Splunk brings AI home: On-prem AI, expanded federated search, SOC agents, and visibility into what those agents cost.
⚒️ Picks of the Week
AI slowdown theater: Zuck pushes back, security weighs in
Anthropic’s Dario Amodei wants frontier AI development to slow enough for safety work to catch up. Sam Altman backed pacing and promised independent evaluators with employee-like access at OpenAI. Elon Musk joined in: “Dario is right.” Those endorsements don’t amount to an implemented slowdown.
Mark Zuckerberg pretty much clapped back at the aforementioned names. He said: labs can slow down on their own. He says Meta held back Muse for several months to work on safety and security, without waiting for competitors to do the same.
The security CEOs had plenty to say:
George Kurtz, CrowdStrike: Attackers already have AI. Whatever happens with new models, security teams need to stop the attacks happening now.
Nikesh Arora, Palo Alto Networks: Thinks the slowdown push could help labs limit their legal risk. Meanwhile, they’re still making it hard for security companies to get API access.
My read: this could push more spending toward independent testing, agent permissions, and runtime controls. It also gives security vendors another opening to sell AI products. Kurtz and Arora have a commercial stake here, too.
Outside scrutiny is welcome. I’d like to see what finding actually delays a release, and whether independent security tools get the access they need to intervene. Otherwise, there’s plenty of room for slowdown theater while defenders deal with the models already in circulation.
Attackers are stealing AI keys to pay for more hacking
Anthropic’s September threat report describes criminals stealing customers’ AI API keys and using them to carry out more intrusions. One stolen key stayed in use for roughly three weeks. So the victim gets compromised and helps foot the bill for what comes next. Lovely.
My friend, Stephen Garcia, has been beating the drum on this risk for a year+ and now, we’re seeing behind the curtains on how large scale of an operation it can be.
Two other details stood out:
Suspected ShinyHunters affiliates used Claude to understand unfamiliar environments, build collection tools, and steal downstream customer data.
A Russian espionage actor built workflows that modified and rebuilt malware when security products detected it.
These are selected cases observed from December through August, not a measure of how common AI-assisted attacks are. Anthropic says its own systems weren’t compromised by the key-stealing actor.
This is the part of the slowdown debate that AI lab leaders miss and security folks are railing about. Existing models already help 10x attack speed + amplification.
AI keys are gold and should be guarded as such.
Also, this is a badass report and should be required reading for anyone in our industry: https://www.anthropic.com/threat-intelligence-report-september-2026
Exein raises $270M to protect the computers inside machines
Exein raised $270M in new equity led by Headline for security software embedded in connected devices, robots, vehicles, and other machines.
Its Analyzer inspects firmware and software dependencies before a device ships. Its Runtime monitors behavior inside the operating system and uses kernel-level controls designed to block malicious execution. The protection lives on the device, where a compromise can change what a machine physically does.
IoT/OT security is experiencing a resurgence in importance. If we’re gonna do this physical AI autonomous thing from b2c to b2b to public services, then it should be secure or at least the illusion that it is, should exist. Great to see companies in this space getting the proper funding!
PaperCut’s print servers became an AI-assisted route to domain admin
PaperCut makes software for managing printing, copying, and scanning. Its NG and MF servers often connect to Active Directory and hold privileges that reach well beyond the printer.
GreyNoise traced an operator using hundreds of AI agents to compromise at least 440 PaperCut instances across 395 identified organizations in 48 countries. The campaign exploited CVE-2026-81578 and CVE-2026-82078.
Details worth double clicking:
The setup: OpenAI’s Codex tooling running a DeepSeek model.
The preparation: A test lab with PaperCut and Active Directory before the operator went after victims.
The result: Confirmed domain-admin access at 12 organizations. Agents also hit targets on the operator’s exclusion list; GreyNoise couldn’t establish why.
AI-driven attacks in legacy environments. Proof. Not good.
Fake passkey setup opens the door to Microsoft 365
Microsoft is tracking intrusions that start with fake helpdesk calls and texts about passkey, MFA, or SSO setup. Employees receive links on personal phones, sometimes leaving investigators with very little endpoint telemetry.
The sequence is pretty straightforward:
Get in: AiTM phishing or device-code authorization. Passkey setup is the pretext; the cryptography isn’t being broken.
Stay in: Register an attacker-controlled authentication method, then enumerate the tenant through Microsoft Graph.
Collect: SharePoint, OneDrive, and Exchange data, generally below 1,000 files or emails an hour, continuing for hours or days.
Rolling out passkeys still leaves decisions about enrollment, alternate authentication flows, and how employees verify a helpdesk request. Those details are doing a lot of work here. For detection teams, an unusual sign-in followed by a new authentication method and Graph reconnaissance is a better place to look than waiting for a giant download spike.
🔬Threats & Research
DDRop makes protected memory accept stale data
DDRop let researchers read protected VM data and fake the proof that a VM was trustworthy, defeating protections in Intel TDX’s default integrity mode.
Attackers need physical access and privileged host control. A small circuit board inserted between the server and its DDR5 memory blocks selected writes. The processor then accepts old encrypted data without realizing it should have changed.
The cool factor on this hack is greater than the actual impact on customers. Poking holes in confidential computing, something hailed as “super secure”, is a significant development.
Cisco’s email gateway can be compromised by an email
Cisco confirmed exploitation of CVE-2026-76461, CVSS 9.8, which lets an unauthenticated attacker run commands as root by sending a crafted email. Nobody has to open it. Secure Email Cloud customers were affected too; Cisco says it upgraded all cloud appliances. On-prem customers need the fixed software, with no workaround available.
The gateway gets compromised doing its ordinary job: processing hostile email. Cisco recommends checking external logs because a root attacker can erase local evidence.
No bueno.
Cisco’s firewall manager helps prepare a Qilin deployment
Cisco Talos also found three intrusion clusters exploiting Firewall Management Center, including Cyclops Blink espionage and Qilin ransomware. CVE-2026-20079, CVSS 10.0, allows unauthenticated root access; CVE-2026-20316 exposes static credentials that can support further escalation.
Not the best week for Cisco and customers, but, it happens.
GitLab’s file-read flaw puts deployment secrets within reach
GitLab patched CVE-2026-85706, CVSS 10.0, an unauthenticated file-read flaw in its repository commits API under certain conditions. It entered KEV September 11, and watchTowr observed probes after disclosure.
Artifactory’s anonymous user turns out to be an administrator
Wiz caught attackers chaining CVE-2026-42018 and CVE-2026-42016 to obtain an anonymous-user token and elevate it to admin. It also confirmed exploitation of the separate CVE-2026-82329 authentication bypass.
Attackers planted persistent admin accounts, malicious Groovy plugins, and Rust backdoors. The useful wrinkle: the elevated token can still show up as token:anonymous. That’s an easy name to underestimate on the system distributing your software. Check the token permissions.
Iranian spyware follows targets onto personal devices
The NCSC, FBI, and AIVD detailed CHOSEN BRICK, spyware targeting dissidents, activists, and journalists. Attackers build trust over messaging apps, then send fake software or even MRI results. The Windows malware uses Telegram bots for command and control and can steal messages, capture screens, and record audio.
When corporate controls get in the way, operators ask the target to open the file on a personal device. If your team protects people facing targeted surveillance, those people need somewhere to take a suspicious file that arrived outside work, too.
📦 Security Product Releases
Splunk .conf26: on-prem AI, more SOC agents, and less data shuffling?
Splunk brought plenty of agent talk to .conf26. Here are the key updates from the con so far:
AI in your own environment: Cisco AI POD for Splunk and self-managed AI Assistant are available now, including for air-gapped deployments. Agent Launchpad, for building custom agents, follows later this year.
More SOC automation: Announced skills cover detection engineering, hunting, investigation, response, and governance, with approvals and auditability in the workflow.
Query data where it sits: Federated Search is expanding to AWS CloudWatch Lake and Databricks. MCP-enabled catalog discovery helps analysts and agents find datasets.
See what agents are doing: Agent Observability now extends into Observability Cloud and Cisco Cloud Control. Tokenomics adds visibility into coding-agent usage and spend.
Prioritize exposure: Expanded Exposure Analytics adds asset coverage, historical changes, and business context. Feature-level GA dates weren’t specified for every announced addition.
Not much of a surprise in any of these releases. Great to see Splunk continuing to keep up with the times. Many thought Cisco would slow their innovation down, but Splunk is still the one to beat in the SIEM space!
Zscaler’s new AI SOC connects investigations to containment
Zscaler launched Agentic SOC, now available globally. It combines Zscaler and third-party telemetry with AI agents for triage, investigation, and response, using models from Anthropic and OpenAI. Zscaler and Red Canary experts provide threat hunting and support.
DigiCert gives AI agents an identity you can revoke
DigiCert made AI Trust Manager generally available, combining agent discovery with signed identities, ownership, scoped permissions, and revocation. Its AI Passport lets another organization verify an agent without sharing the same identity provider.
This gets at a practical problem: you need to know which agent is acting, who owns it, and how to cut off its authority. Familiar identity controls, applied to a new kind of user. A verified identity still doesn’t tell you whether the agent’s next decision will be sensible, though.
Wiz investigations now follow you into Google SecOps
Wiz expanded its Google Security Operations integration with Blue Agent investigation findings and two-way synchronization of case status, severity, and comments. The available content pack includes rules, dashboards, queries, playbooks, and response policies.
Analysts can review Wiz’s cloud investigation inside Google SecOps and keep the case moving across both tools. That’s a useful step beyond dumping another alert into the SIEM and calling it an integration. Less duplicate investigation and case maintenance would be a pretty welcome outcome.
The EU’s product-security reporting clock is already running
The Cyber Resilience Act’s reporting obligations kicked in September 11. Covered manufacturers must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability or severe product-security incident, followed by notification within 72 hours. ENISA’s reporting platform is live.
Most other requirements start in December 2027, which makes this deadline easy to mentally file under “later.” It’s already here. Whoever owns product-security reporting needs a working escalation path now.
🤝 Funding & M&A
Harvey buys Guardrails AI, bringing agent security into legal AI
Harvey, the legal AI company, acquired Guardrails AI, a security company. Terms weren’t disclosed.
There’s real security work here. Guardrails’ open-source framework checks for PII leakage, jailbreaks, and policy violations. It also tackles reliability problems such as hallucinations. Its Snowglobe product simulates users to find ways agents can fail before they go into production.
That’s relevant to agents working across legal documents, client matters, and firm knowledge. A convincing answer can still leak confidential information or send a workflow off course. Harvey gets people and technology for testing those failures as part of building the product.
An interesting buyer for an AI security and reliability company. More vertical AI vendors may decide this work is important enough to own. Neither announcement spells out future support commitments for the open-source project.
Fortaegis raises $50M to build security into the chip
Fortaegis raised a $50M Series A led by returning investor Serendipity Capital. The Dutch company builds security into computing hardware, using physical properties of silicon to establish device trust across its hardware and software.
The money will scale production and deployment of its programmable chips and fund development of custom chips. Alongside Exein, it’s another sizeable bet on protecting the machines themselves. The work here reaches all the way down to the silicon, well before an endpoint agent gets installed.
SecureSky buys Soveren to follow the sensitive data
SecureSky acquired Soveren, adding data security to its exposure management and MDR platform. Soveren combines scans of stored data with eBPF monitoring of sensitive data moving between applications and services. The deal has closed; terms weren’t disclosed.
The useful connection is between an exposure finding and the data a compromised system could actually leak. SecureSky is buying the ability to show both, including data moving through an application that a storage scan might miss.
AIUC raises $40M to test agents and help insure their mistakes
AIUC, the Artificial Intelligence Underwriting Company, raised a $40M Series A led by Ribbit Capital. It combines agent testing and certification with insurance underwriting infrastructure.
Its AIUC-1 standard covers risks including prompt injection, data leakage, hallucinations, and unauthorized actions. Evaluations examine both the agent’s behavior and the controls around it. That evidence can help insurers price coverage; ElevenLabs already uses certification-backed insurance for its voice agents.
The new funding will help extend the approach to frontier models, connecting it directly to this week’s audit debate. Someone has to test the safety claims, and someone has to work out who pays when a system fails.
Good wedge, raise and timing by AIUC.
Interested in sponsoring TCP?
Sponsoring TCP not only helps me continue to bring you the latest in security innovation, but it also connects you to a dedicated audience of 20,000+ CISOs, practitioners, founders, and investors across 135+ countries 🌎
Disclaimer
The insights, opinions, and analyses shared in The Cybersecurity Pulse are my own and do not represent the views or positions of my employer or any affiliated organizations. This newsletter is for informational purposes only and should not be construed as financial, legal, security, or investment advice.
GreyNoise just gave the PaperCut chain (CVE-2026-82078/81578) a scale I didn't see coming when I wrote it up three weeks ago at Huntress's two confirmed environments. AI-orchestrated actors, Codex tooling running a DeepSeek model, are now at 440 instances across 395 orgs, domain admin at twelve. That's automation outpacing patching, not just detection. What's the actual patch rate on the ~1,000 exposed instances now?
Three weeks live on a stolen key is the number that matters more than the attack tooling. That's not a failure to catch the theft, it's a failure to ever check whether the key's usage pattern still matches the account it belongs to. I've been writing about the same gap at What Breaks, a valid, correctly scoped credential passes every access check by design, so the catch has to be behavioral, not authorization based. Three weeks says most environments still aren't running that check.