Welcome to The Cybersecurity Pulse (TCP)! I’m Darwin Salazar, Head of Growth at Monad and former detection engineer at Datadog. Each week, I bring you the latest security innovation and industry news. Subscribe to receive weekly updates! 📧
Howdy 👋🏽
I hope you’re having an excellent week! I’m back in the saddle after a pretty heavy past two weeks on the work front. Our BSides NYC Gatsby-themed event crushed it and I also spoke at BSides regarding some of the research we’ve been doing at Monad regarding AI audit logging. People seem to have liked it based on all the feedback. This research will be launched on Amazon next week in the form of a book.
Here’s my BSides recap + my slides are up on Github here. Hit me up if any of this is intriguing to you, always happy to nerd out re: logs, AI, detecting weird or nefarious stuff.
I’ll also be in SF for Unprompted Con next week. Hit me up if you’re in town and would like to grab a coffee, a lift, hike, play padel or vent about the amount of larping in the security space.
That said, let’s get into this past week’s top stories!
🗞️ TLDR
🐘 PHP patches critical flaws: Fixes are live for two CVSS 9.2 flaws that can allow unauthenticated code execution.
🔑 OpenCode’s Console breach: API keys potentially exposed for 1.4% of Console users; unauthorized charges reported.
🩹 Node.js patches a code-execution flaw: High-severity Brotli bug fixed in Node.js 22.23.4, 24.22.1 and 26.12.1.
🤝 Proofpoint’s deal for Varonis: Thoma Bravo-backed buyer agrees to a $6.3B acquisition.
🗣️ Meta pauses Muse sharing: Researchers found 6,800+ share links through passive DNS, some exposing sensitive information.
📜 Weak eMudhra signing keys: Recoverable keys could let forged website certificates pass software’s identity checks.
🛠️ Microsoft tightens agent permissions: New controls aim to narrow access as an agent’s task or risk changes.
🪪 ServiceNow announces AI Passport: Signed permissions for first- and third-party agents; enforcement integrations remain forthcoming.
Stop paying to store stale data
At least 30% of enterprise data is redundant, obsolete, or trivial — aka ROT.
It inflates storage bills, skews AI outputs, and widens the blast radius of a breach. Varonis Data Lifecycle Management (DLM) finds ROT across your data estate and automatically quarantines duplicates, stale files, and data past its retention period. Every action is reve
rsible, so nothing is deleted until you’re sure. See how much ROT you’re storing and why paying for it shouldn’t continue.
🔥 Picks of the Week
PHP prepares fixes for two critical vulnerabilities
PHP has patched two critical CVSS v4.0 9.2 flaws, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. Fixed versions: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP provides patch and upgrade guidance and download instructions. All unpatched PHP web deployments are at risk; Apache/mod_php can be exploited before application code runs.
Patches arrived ahead of the scheduled 9 a.m. Central release on October 21. Technical details are public too, helping attackers develop exploits while defenders patch.
PHP powers 69.3% of websites whose server-side language W3Techs can identify, including WordPress and Drupal sites. That’s usage, not a vulnerable-site count. You don’t need to write PHP to inherit this headache.
OpenCode Console breached, users report unauthorized AI charges
OpenCode, an open-source AI coding agent for terminals and editors, says a breach may have exposed AI provider keys belonging to 1.4% of its hosted Console users.
Users reported unauthorized AI charges and suspended Google Cloud projects.
This attack has many layers + implications to it. For example, who fits the bill for impacted users? Also, it shows again that you cannot rely on general closed-source models (i.e., claude or chatGPT) for security use cases. You either need access to their “security programs” like Daybreak OR adopt open-weighted models and build security harnesses around them.
How AI Agents Are Reshaping Cybersecurity
AI agents are changing both sides of cybersecurity. Join Akhil Lohchab, Head of Machine Learning at Adaptive Security and former ML engineering lead at Stripe, to learn how attackers scale targeted attacks, how defenders investigate and respond faster, and what this means for your team’s workflows and roles.
Wednesday, October 28 at 11 a.m. PT / 2 p.m. ET.
Can’t make it? Register anyway, and we’ll send you the recording.
Proofpoint agrees to acquire Varonis for $6.3B
Proofpoint, backed by legendary private equity firm Thoma Bravo, has agreed to acquire Varonis in a $6.3B all-cash deal, expected to close in the first half of 2027. Varonis has spent more than two decades building its data security business and is a pioneer in the space. More recently, they have doubled down on AI security and forayed into identity and email security.
The offer represents a 52% premium to its share price before sale rumors surfaced in June. That would be a strong outcome for shareholders and a huge milestone for the founders and team.
Varonis was an early TCP supporter and has sponsored dozen+ of issues over the past two years, including this one. We’re thrilled for them and in a way, feel like a part of their success. Huge congratulations to everyone at Varonis, especially the marketing team ;)!
Here’s a deep dive I wrote on them last year. Visionary-level product and GTM execution by their team.
I haven’t look too much into the acquisition. I do know there’s some overlap in product offerings. Maybe I do a deep dive to better understand the internals of the deal. At the end of the day, this consolidation is good for the data + AI security space and opens up new distribution channels for both teams while bringing together great R&D+eng brains.
Meta suspends Muse sharing after sensitive chats surface through DNS
Meta suspended conversation sharing in Muse after Claroc showed how shared chats could be found through passive DNS. The researchers identified 6,800+ share links and opened a few hundred, finding internal business documents and personal financial information among the pages.
Muse put each conversation’s title and a random identifier in its hostname. Passive DNS recorded both, making the links discoverable without guessing them. After Meta’s change, none of 40 previously accessible shares reopened in Claroc’s checks, though the titles remain in DNS history.
🚨 Threats & Research
Weak eMudhra keys could let fake websites pass identity checks
eMudhra, a trusted issuer of digital certificates, generated eight signing keys so poorly they could be recovered from public certificates. Attackers could use some of those keys to forge website certificates that vulnerable software accepts as genuine.
Major browsers had protections in place, but applications, command-line tools, and devices can carry their own lists of trusted issuers. They may still trust the compromised keys even after a browser update. The incident tracker lists affected software and fixes. Malicious exploitation remains unconfirmed.
Node.js ships fixes for a code-execution bug
Node.js released security updates for versions 22, 24 and 26, including CVE-2026-111497, an out-of-bounds write in its bundled Brotli decoder that can allow remote code execution. Node.js rates it High. Fixes are available in 22.23.4, 24.22.1 and 26.12.1. The advisory does not report active exploitation.
The releases also update Node.js’s trusted certificates after the eMudhra compromise. Node.js needs its own certificate fix even if your browser is already protected.
ConnectWise credentials opened customer Microsoft 365 tenants
Attackers used a compromised ConnectWise application credential to access customers’ Microsoft 365 tenants with permissions already granted to its backup service. Huntress documented further activity in two tenants: a ConnectWise application granted itself Global Administrator, then planted new credentials on other applications to keep access.
Great research by Huntress, per usual.
BeyondTrust detected the attack, then automated triage dismissed it
BeyondTrust says its sensors detected privilege escalation during an intrusion, but a third-party platform’s automated triage closed the alerts as false positives. ARMORY CASTLE had exploited Remote Support zero-day CVE-2026-102764, established persistence, and deleted logs. A later threat hunt uncovered the compromise.
BeyondTrust says it is changing the workflow so automated triage cannot independently close high-severity signals. Mandiant’s analysis includes hunting guidance and YARA rules.
Claude checks its conversations for misuse after responding
Anthropic described how it asks Claude to assess conversations after responding and flags suspicious exchanges for offline review. It reuses the conversation already in memory, adding less than 2% to inference compute, the company estimates.
Anthropic has used it since June to identify conversations for investigation. The company says it cannot reliably stop a dedicated attacker.
ATT&CK v20 adds techniques for AI-enabled attacks
MITRE ATT&CK v20, released October 13, adds direct and indirect prompt injection, AI-enabled exfiltration, AI result poisoning, and interference with autonomous defenses. New campaigns cover attacks on U.S. water utilities and an AI-assisted breach of Mexican government infrastructure.
ICS detection strategies now include platform and asset context, while Mobile strategies account for Android and iOS visibility limits. MITRE also published a machine-readable changelog for updating existing mappings.
🛠️ Security Products & Tools
Microsoft gives AI agents task-limited permissions
Microsoft announced Dynamic Permissions and agent risk controls designed to reduce access during a task, require approval, or stop an agent. These controls would let identity systems change an agent’s permissions mid-task. Its existing tools cover Copilot Studio, Foundry agent identities, and supported local agents through Defender, with runtime protection in Windows preview. Microsoft hasn’t specified where the new controls will be piloted or when each will ship. Entra Conditional Access applies to Entra-protected resources; calls authenticated with API keys bypass those checks.
ServiceNow puts signed permissions on AI agents
ServiceNow announced AI Passport, a signed credential defining what first- and third-party agents and MCP servers may do. Permissions draw on its CMDB, company policies, and workflow approvals; delegated tasks can receive narrower permissions. This extends beyond ServiceNow’s apps, but other platforms must verify and enforce the credential.
Arc, its employee agent for workflows, email and Teams, became generally available on October 21 with OpenShell enforcement. Mac support is live; Windows is expected within weeks. AI Passport and its OpenShell/BlueField enforcement integrations have not shipped.
ThreatModeler launches NexusAI to build and maintain threat models
ThreatModeler launched NexusAI within its Nexus platform. It generates threat models from diagrams, documentation, and written prompts, analyzes threats and security requirements, and proposes updates for human review when architecture changes. That could keep threat models current between security reviews.
Snyk adds agents for code reviews and fixes
Snyk‘s Evo Agentic AppSec agents scan code, block malicious or disallowed packages during installation, review repositories, and propose fixes. Snyk says results are checked independently of the agent that produced them. Automated fixes initially cover open-source dependencies. Changes that could break a build require approval. Code scanning, the dependency firewall, and security reviews are experimental previews for selected customers; automated fixes are in open preview.
GitHub puts a firewall in front of package installs
GitHub launched a package firewall in public preview for Enterprise Cloud, initially covering npm. It checks package requests from developer machines, coding agents, and CI runners for malware, known vulnerabilities, minimum package age, and supply-chain changes. Like Snyk’s dependency firewall, protection applies only to requests routed through it.
MISP 3.0 connects the evidence across events
MISP 3.0 entered early access with indicator pages that pull together sightings, relationships, sources, and enrichment across events. Analyst Profiles let users weight sources and signals for their role; new graph tools support pivots and investigations that can be saved and shared. The API remains backward compatible, and instances can still sync with 2.5. Early access is for test instances only, with a one-way database migration.
💰 Industry, Funding & M&A
Opaque’s team is joining Anthropic, Cohere has proposed buying AISLE, and OpenAI is reportedly in talks to buy Trail of Bits. Security vendors could end up buying models from companies that also compete with them.
Cohere proposes acquiring AISLE
Cohere announced a proposed agreement to acquire AISLE and establish Cohere Cyber, led by Ondrej Vlcek. AISLE builds systems that find software vulnerabilities, verify them, and help fix them. Cohere also wants to use that research to test and improve its models.
Opaque’s team joins Anthropic
Opaque announced on October 13 that its team is joining Anthropic and the company is winding down. Its technology protects sensitive data while AI workloads run and produces cryptographic proof of what ran. That brings a different kind of security expertise into a model lab than AISLE’s vulnerability research.
OpenAI reportedly explores buying Trail of Bits
The Information reported on October 13 that OpenAI is in early talks to acquire Trail of Bits. The firms already collaborate on verifying vulnerabilities and developing patches.
Horizon3.ai passes $100M ARR
Horizon3.ai has surpassed $100M in ARR, growing more than 120% year over year roughly five years after reaching $1M. The company says approximately 80% of customers have moved from annual to monthly pentesting.
This team and product are the real deal. Big milestone just as the autonomous pentesting landscape heats up w/ new entrants like Armadin + XBOW.
Also, I must call out that Horizon3 is a past sponsor. Proud to work with such a great team! 🔥
Blackwall raises $100M to expand security through hosting providers
AVP led the Series C at a $2.2B valuation. Blackwall lets hosting providers bundle bot mitigation, DDoS protection, and web application security into their existing services. That reaches customers who may never shop for a standalone security platform.
Harmonic raises $50M for workforce AI security
Crosspoint Capital led the Series B, bringing total funding to $76M. Harmonic uses small language models to examine what employees do with AI across browsers, desktop tools, and agent workflows. It aims to distinguish harmless references to sensitive data from actual exposure and apply controls based on the activity.
Pluto emerges from stealth with $42M in total funding
Pluto emerged on October 13, focused on the AI tools, coding assistants, MCP connections, extensions, and custom workflows employees assemble themselves. An approved app list can miss the risks employees create by connecting tools and giving those workflows access to company data.
Opsin raises $21M to govern AI agent behavior
SYN Ventures and Race Capital led the funding. Opsin maps agents, their permissions, connected tools, and actions, then uses those relationships to detect and contain policy violations.
Interested in sponsoring TCP?
Sponsoring TCP not only helps me continue to bring you the latest in security innovation, but it also connects you to a dedicated audience of 20,000+ CISOs, practitioners, founders, and investors across 135+ countries 🌎
Disclaimer
The insights, opinions, and analyses shared in The Cybersecurity Pulse are my own and do not represent the views or positions of my employer or any affiliated organizations. This newsletter is for informational purposes only and should not be construed as financial, legal, security, or investment advice.