Archive for October 2, 2026

NETGEAR Enterprise’s first APEX and APEX MSP partners give customers access to validated network expertise  

Posted in Commentary with tags on October 2, 2026 by itnerd

NETGEAR today announced that Thomas-Krenn.AG and Connectivity Warehouse have become the world’s first partners to achieve APEX and APEX MSP certification, respectively, through the NETGEAR DRIVE Partner Success Program. For their customers, these certifications mean one thing above all: the engineering, sales, and service delivery capabilities of the team managing or installing their NETGEAR network have been independently verified before they ever arrive on site. 

When a network problem stops a production line, delays patient care, or takes down a multi-site organization, customers need answers fast. Whether they get them depends on whether their partner has the right skills in the room. NETGEAR introduced the DRIVE Partner Success Program in November 2025 to give customers a clear way to identify that expertise. Rather than recognizing partners for what they purchase, the program certifies them for what they can do: the engineers they have trained, the customer deployments they have validated, and the service practices they have implemented. 

Connectivity Warehouse — first APEX MSP partner 

For businesses that rely on a managed service provider to keep their network running, it’s important that the partner they choose will remain accountable even if something goes wrong six months after installation. APEX MSP is the DRIVE program’s highest tier, requiring partners to qualify three certified post-sales engineers and pass a live virtual audit of their IT service management practices, in addition to the engineering and sales certifications required for APEX. Connectivity Warehouse, a Dallas, Texas-area networking solutions provider serving offices, healthcare facilities, warehouses, and multi-site organizations, is the first partner worldwide to meet that standard. Its customers now have independently verified assurance that the team managing their NETGEAR infrastructure has been evaluated on service delivery, not just product knowledge. 

Thomas-Krenn.AG — first APEX partner 

Customers who work with Thomas-Krenn.AG to build server and storage infrastructure have historically needed separate expertise for the network connecting those systems. APEX certification changes that. Thomas-Krenn.AG, which has manufactured custom server and storage systems at its facility in Germany since 2002, has now certified its engineers and sales staff on NETGEAR infrastructure, meeting every APEX requirement including validated customer success stories. The businesses it serves in the defense, industrial, data center, and public sectors can now work with a single team qualified to design, deploy, and support both the server platform and the NETGEAR switching infrastructure that connects it. 

Further information about the NETGEAR DRIVE Partner Success Program is available at www.netgear.com/drive 

Leave a comment »

ThreatLocker CEO on Cyber Awareness Month: 5 Ways Businesses Can Limit the Damage From One Bad Click

Posted in Commentary with tags on October 2, 2026 by itnerd

As Cybersecurity Awareness Month kicks off, Danny Jenkins, CEO of ThreatLocker,  says businesses should look beyond simply training employees to spot phishing emails and focus on building security controls that limit what an attacker can do when someone inevitably makes a mistake.

Danny has outlined five practical steps businesses can take to reduce their exposure:

1. Don’t let one bad click become a breach.

“We spend a lot of time telling employees not to click suspicious links, but the reality is that someone eventually will. Good security isn’t about expecting people to be perfect. It’s about putting controls in place so one mistake doesn’t give an attacker the keys to the entire organization.”

2. Make “default deny” the default.

“If an application or process doesn’t have a legitimate reason to run, why should it be allowed to run? A default-deny approach changes the equation from trying to identify everything that’s malicious to only allowing what the business has already decided it trusts.”

3. Give users and applications only the access they actually need.

“Least privilege is one of the simplest ways to limit the damage from a compromised account. If a user, application or service doesn’t need access to a particular resource to do its job, that access shouldn’t be there in the first place.”

4. Treat remote access as an attack path that needs to be controlled.

“Remote access is essential for modern businesses, but every remote connection is another potential path into the environment. Companies should be asking who can connect, what they can access, from which devices, and whether that access is still necessary.”

5. Reduce the attack surface before attackers find it.

“Security teams can’t protect what they don’t know they have. Unused applications, outdated software, unnecessary services and forgotten remote-access tools create opportunities for attackers. One of the most practical things a business can do is regularly remove what it no longer needs.”

Danny also recommends combining these technical controls with ongoing employee awareness training, strong identity security, network segmentation, software updates and monitoring. ThreatLocker’s Cybersecurity Awareness Month guide covers these and other practical measures for businesses and consumers.

Leave a comment »

Your WAF is a lovely front door. Such a shame the attackers found the side entrance 

Posted in Commentary with tags on October 2, 2026 by itnerd

The Abstract ASTRO team have been studying AI attack agents with Eyal Sela & Gambit Security and have found some interesting playbooks. They just blogged about this late yesterday evening.

One small yet interesting piece: a method for finding the real server behind your CDN. They check SPF records, the staging subdomain someone forgot to proxy (oops), and your favicon hash sitting in Shodan. Once they find your origin, they go straight to it and your WAF never gets a vote.

They’re tidy, too. Tools get shredded, logs get scrubbed, and timestamps get backdated before you’ve finished your coffee.

But the nice thing about robots is they’re lazy in very predictable ways. And their cleanup routine reads like a checklist of commands your web server should never run. Thanks for the detection list, guys!

It’s all written up: a script to find your own origin leaks before they do, plus managed detections that fire while the attacker is still on the box (not three days later in a log review).

Homework for this week: does your origin only accept 80/443 from your CDN’s ranges? If you’re not sure, the answer is probably no.

Leave a comment »

Automotive SBOM market projected to quadruple as security demands expand 

Posted in Commentary with tags on October 2, 2026 by itnerd

The global automotive Software Bill of Materials (SBOM) market is projected to grow from $440 million in 2026 to $1.8 billion by 2034, according to a new Fortune Business Insights report.

The market is projected to grow at a 19.3% CAGR from 2026 through 2034, driven by software-defined vehicles, cybersecurity regulations, complex software supply chains and lifecycle vulnerability management.

Electric vehicles are projected to be the fastest-growing propulsion segment at a 22.4% CAGR, while buses and coaches are projected to be the fastest-growing vehicle segment at 23.7%. Tier 2 and lower-tier suppliers are projected to grow at 22.0%, while professional and managed SBOM services and vulnerability correlation, VEX and remediation-management solutions are each projected to grow at 20.4%.

The U.S. market is estimated at $80 million in 2026, representing approximately 19% of global revenue, while China is estimated at $110 million, or approximately 24.8%. The report also points to manufacturers increasingly moving from periodic SBOMs toward continuously generated SBOMs integrated into development and DevSecOps workflows.

Matt Wyckhouse, Founder & CEO, Finite State:

“The interesting thing about the growth of the SBOM market is that the SBOM itself is becoming table stakes. The hard problem isn’t producing a list of components; it’s continuously determining what’s actually inside increasingly complex vehicle software, whether a newly disclosed vulnerability creates real risk, and how quickly manufacturers and suppliers can respond. In automotive, that requires going well beyond traditional SCA and analyzing the firmware and binaries that actually ship in the vehicle.”

SBOM is one of the best ways to ensure that you don’t get pwned. Everybody should insist of seeing one before engaging a service or buying a product. Cars are a good example seeing as third party products are inside cars these days. If that happens, companies will get on board quickly.

Leave a comment »

OpenAI Proves Again That It Cannot Be Trusted On A Pair Of Fronts

Posted in Commentary with tags on October 2, 2026 by itnerd

If you needed more of a reason to not trust OpenAI, here’s a couple to choose from. First there’s this:

OpenAI has fired three researchers for allegedly mishandling information, including work that involved an external organisation that analyses artificial intelligence (AI) models.

“Our investigation confirmed that these individuals mishandled sensitive information outside established company procedures, violating our policies and breaking the trust essential to our work,” a spokesperson told the BBC.

The ChatGPT-maker did not name the sacked workers, but at least two of them were involved in safety research at the firm.

Gee. That looks really sketchy. Like OpenAI has something to hide. Maybe I am being cynical here. But if you combine it with this disclosure, maybe not:

Artificial intelligence leader Open AI said a rogue agent accessed a second NSW government website in June, with authorities only now made aware.

The NSW Premier’s Office released a statement on Friday night revealing OpenAI had advised the government of a “misalignment” involving a rogue AI agent which had accessed public data on a NSW government web application.

“An OpenAI model accessed a National Parks and Wildlife Service web application containing historical information and data on fires in NSW,” a government statement read.

“It’s understood the incident occurred in June 2026 and was validated by Open AI and reported through to NSW government on 1 October 2026.”

The statement advised current investigations had not identified any unauthorised access to personal information.

This comes after this incident which is also in Australia where an OpenAI agent accessed an Australian website in a rogue manner. If you combine both of those incidents, this looks really sketchy to me. And what it says is that OpenAI cannot be trusted. They clearly don’t have their house in order and you have to question if it will ever get there.

UPDATE: Commentary has come in from the following sources:

Willy Leichter, CMO, PointGuard AI (https://www.linkedin.com/in/willyleichter)

“The Australian breaches point to failures in containment, not an inevitable consequence of AI. OpenAI and other frontier model builders, along with any organization deploying agents, need rigorous operating procedures, restricted access, strong guardrails and immediate kill switches. Testing is no excuse for unauthorized actions. Organizations that recklessly build or deploy agents should face direct legal accountability for resulting harm. Greater autonomy must come with greater responsibility.”

Seemant Sehgal, Founder & CEO, BreachLock (https://www.linkedin.com/in/s-sehgal)

“A second disclosure in a week from the same AI provider against the same government shifts the conversation from whether individual incidents will happen to whether the party deploying these agents can be meaningfully held accountable when they do.

“An AI agent cannot face consequences for its own actions. It cannot be fined, suspended, or named in a court filing, which means accountability has to live with the organization that built and deployed it, through clear ownership, documented authorization scope, and real notification obligations when something goes wrong. AI companies that build human accountability into their processes will be the ones governments and enterprises can actually work with.”

Jeremiah Fowler, Security Researcher, Black Hills Information Security (https://www.linkedin.com/in/fowler-jeremiah-26814ab9)

“With the tidal wave of recent incidents it is clear that we cannot treat AI guardrails as if they are the same thing as security controls. Prompting an AI agent not to access something is different from technically preventing access. We have entered a new world in terms of speed and scale. An autonomous agent could potentially make thousands of decisions and interact with multiple systems before human moderators can realize it has crossed the lines. I think in the very near future we will see individual countries pass regulations that hold AI developers accountable for the actions of their agents. Once this happens there will be legal and financial penalties that will force companies to add guardrails or a kill switch. Until that happens we are in a wild west scenario of an unregulated industry that is off to a difficult start keeping AI agents contained.

“In my opinion, any organization that deploys autonomous agents and has an ‘incident’ should be ready to provide the owners or administrators of affected networks and systems with full transparency of what happened and how it happened. This would include details on what the agent accessed, which credentials it used, what commands or requests it issued, what information it retrieved or modified, and why its controls permitted those actions.” 

Jacob Krell, Sr. Director: Security AI Solutions & Cybersecurity, Suzu Labs (https://www.linkedin.com/in/jacob-krell)

“The second New South Wales incident makes it harder to describe these events as isolated misfires. A pattern is emerging, agents take a broad hand to their objectives and reach for any system or data source that might help.

“That risk becomes harder to control when agents operate in swarms. One agent can find a route, another can test it and a third can use the result. Monitoring a single session will miss the larger operation unless it captures agent-to-agent messages, shared state and the combined objective.

“The controls need to sit outside the models, with real-time visibility across the swarm and automatic blocks on unauthorized systems. Accountability also has to cover the people and company that gave the agents those permissions.

“No personal information was accessed in this case. That is a fortunate outcome, not evidence of effective control. OpenAI has already had to discover and disclose unauthorized activity after the fact. The question now is how many more incidents are waiting in its logs.”

Leave a comment »

Nearly 20 million Minecraft player records are allegedly for sale

Posted in Commentary with tags on October 2, 2026 by itnerd

Created by Markus “Notch” Persson and developed by Mojang Studios, Minecraft has over 212 million monthly active players, and now the players’ data surfaced in an alleged 18 million breach

Two posts on underground cybercrime forums claim that Minecraft players’ data has been breached. One threat actor says 18 million user records are for sale, while another post cites a more modest 9 million records.

Cybernews researchers investigated the claims, and here is what was found:

  • Supposedly, different datasets appear to be the same 1,000 records.
  • The sample contains usernames, email addresses, and, in some cases, password hashes. 
  • The records also appear to have been collected from specific Minecraft servers, with only 3 unique servers appearing across the sample.
  • Information could be used for credential stuffing and social engineering scams, particularly if email addresses are paired with passwords victims have reused elsewhere.

The team found that email addresses in the sample appear in Have I Been Pwned and are referenced in multiple infostealer combo lists. This suggests that the data source may be infostealer malware.

For more information, read the article here:

https://cybernews.com/security/minecraft-players-data-breach

Leave a comment »

Researcher finds fake data could trigger Japan’s national emergency alert system

Posted in Commentary with tags on October 2, 2026 by itnerd

Japan’s nationwide J-Alert emergency warning system lacks encryption and a mechanism to authenticate the source of data transmitted via satellite, creating the potential for specially crafted fake data to trigger false emergency alerts, according to a Kyodo News report.

Yudai Kirishiki of Tokyo-based cybersecurity firm Unknown Technologies identified the issue after analyzing a J-Alert receiver previously used by a local government that was sold on the secondhand market. Testing found that the receiver could not distinguish fake information formatted like legitimate J-Alert data, demonstrating that a third party could potentially transmit a false warning.

J-Alert distributes urgent information about earthquakes, tsunamis, ballistic missile launches and other emergencies from government agencies via satellite to receivers operated by municipalities and other public organizations.

A source at Japan’s Ministry of Internal Affairs and Communications acknowledged the security issue, while an official said the government continues to work to ensure stable operation of the system.

ㅤLarry Pesce, VP of Services, Finite State:

“Two things in this J-Alert story jump out. First, the claim that satellite attacks “weren’t considered a real threat” in 2007. Brazilian pirates had been hijacking US Navy satellite transponders for decades by then, and Captain Midnight took over HBO’s satellite feed in 1986. Unauthenticated satellite traffic being spoofable was not a new idea.

“Second, and more important: the researcher got a decommissioned receiver off the secondhand market. Disposal instructions went out after the fact. Once an adversary has the hardware, “we can’t share details for security reasons” stops being a control. They can pull the firmware, reverse the protocol, and test spoofed alerts against the real parser until it works. This is supply chain and lifecycle risk in its plainest form: sensitive hardware will leave your control, so design as if it already has.

“The fix here isn’t exotic. Public alerts don’t need to be secret, they need to be signed. Receivers that verify the source would make a drone and a stolen receiver far less useful. For a system that can move an entire population, that should have been in the original design.

“Once a decommissioned receiver shows up for sale, the government’s decision not to share details ‘from a security standpoint’ stops meaning much. An attacker with the hardware in hand can extract the firmware, reverse engineer the protocol, and test fake alerts against the real thing until one works. Sensitive hardware will eventually leave your control, so you have to design as if it already has.”

“Re authentication: public emergency alerts don’t need to be secret, they need to be trustworthy. A receiver that can’t verify who sent a message will believe anyone with a transmitter. Digital signatures are a well-understood fix. Leaving them out of a system that can move an entire population was a design choice, not a technical limitation.

“The problem isn’t that J-Alert is unencrypted. It’s that it can’t tell the government’s warning from anyone else’s.”

Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“A satellite link delivers data. It does not prove who sent it. If a receiver validates only the packet format, an attacker can impersonate the system from the ground.

“Japan’s J-Alert system exposes that gap. Kyodo reported that data sent through its satellite channel is unencrypted, and the receiver has no way to verify its source. Yudai Kirishiki of Unknown Technologies tested a receiver formerly used by a local government and found no electronic signature checks. The receiver accepted J-Alert-formatted data transmitted from an elevated location, such as a drone.

“Brazil had its own emergency-alert failure in June, when credentials tied to two Pará Civil Defense agents were used to send false alerts through the national platform to areas those accounts were not authorized to reach.

ㅤJapan and the rest of the world needs to figure this out. Unencrypted communications in 2026 are bad and need to be killed off quickly. Because this is a horrible place to be in.

Leave a comment »

NIST finds 5G devices remain vulnerable to fake base station attacks 

Posted in Commentary with tags on October 2, 2026 by itnerd

A new NIST report found that attackers can use inexpensive, off-the-shelf hardware and software to impersonate legitimate cellular infrastructure and exploit vulnerabilities in 5G communications.

False or rogue base stations mimic legitimate carrier equipment and attempt to trick nearby devices into connecting to them. NIST tested six simulated attack scenarios and found that while 5G security improvements have reduced risks including privacy breaches and location tracking, devices remain susceptible to denial-of-service attacks that can degrade or disrupt cellular service.

NIST said the attacks can exploit vulnerabilities that occur before a device has authenticated with the network. The agency identified areas where standards and device-configurable protections could be improved and is accepting public comments on the findings through October 30.

ㅤJacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs:

“Denial-of-service is the attack where a locked door is still a failure. An attacker does not need to get inside. They only need to stand in the doorway and stop everyone else from getting through. That is why these attacks are so hard to prevent, normal security and recovery rules can become the thing that keeps legitimate users out.

“That is what NIST found in its new 5G report. The false base station acted like a fake cell tower with a stronger signal, so phones chose it over the legitimate network. 5G authentication worked like the lock, the rogue tower could not complete a fake registration or access protected information. It could still reject or ignore the phone’s connection attempts, leaving the handset stuck retrying the wrong tower. In one test, that cycle lasted about 12 minutes.

“Monitoring is how operators see someone blocking the doorway. Repeated connection failures, one cell suddenly overpowering its neighbors, and many devices repeating the same failed process can distinguish an active attack from an ordinary outage. The lesson applies well beyond cellular networks. Encryption protects data after a connection exists. Monitoring tells defenders when the connection itself is being deliberately prevented.”

ㅤ

John Strand, Owner, Black Hills Information Security, Inc.:

“Cell phone infrastructure attacks have long fascinated me and a number of people at Black Hills Information Security. This isn’t mainstream security research. It’s not like EDR or Apache, where tons of organizations have access to the software and can test it. Setting up femtocells and intercepting cellular communications usually takes very specialized equipment, sometimes available only to government or law enforcement agencies.

“None of this is new. We’ve seen versions of these techniques in Mr. Robot and Silicon Valley, and a lot of them are actually viable. But testing can run into FCC restrictions, which means many security testing firms don’t touch this area. That leaves a real question. How thoroughly are these vulnerabilities being validated, and do we get a chance to address the full attack surface?

“These are the kinds of forbidden technologies I find fascinating from a security perspective. I relish any chance we get to test them.”

ㅤTesting technologies such as 5G are great as it really focuses attention on them. Addressing any vulnerabilities found in these technologies is a different matter entirely.

Leave a comment »