🕵️ RESEARCH & DEEP DIVES
Microsoft rolls out Windows 11 KB5124010 preview update with 46 changes and fixes
Microsoft released the KB5124010 September 2026 non-security preview update for Windows 11 24H2 and 25H2 with 46 changes and fixes.- Applies to Windows 11 24H2 and 25H2 devices, upgrading them to builds 26100.9550 and 26200.9550 respectively
- Non-security preview update containing 46 changes: Emoji 17.0 support, Copilot key remapping to Right Ctrl or Context Menu, an 'Open apps maximized' accessibility setting, and a WinRE recovery remote management plug-in
- Fixes Bluetooth issues including a radio toggle showing on while off and 0x139 crashes while streaming Bluetooth audio, plus improved mic compatibility with Bluetooth Classic and LE Audio accessories
- Also adds slideshow wallpapers across multiple desktops, new precision touchpad gestures, OneDrive Camera roll backup in Settings, and a fix for File History backup failures after the September 2026 security updates
- Removes the PC-to-PC Migration tool and is the final preview update for Windows 11 24H2, which reaches end of support in October 2026
Island Raises $400 Million Series F at $6.4 Billion Valuation
Enterprise browser maker Island raised $400 million in a Series F round led by Evolution Equity Partners, valuing the company at $6.4 billion.- Island, an enterprise security firm founded in 2020, has now raised more than $1 billion in total funding.
- The $400 million Series F was led by Evolution Equity Partners, bringing the valuation to $6.4 billion.
- Island's platform is an agentic control plane governing human and automated workflows across endpoints, software, and networks.
- The platform uses an endpoint-outward SASE architecture delivering ZTNA, device posture assessment, and inline DLP without traditional VPNs.
- For AI usage, it provides guardrails separating proprietary data from external language models and mitigating prompt injection risks.
NIST drafts SP 800-82 Rev 4 OT security guide; CISA/FBI warn on ICS integrator risk
NIST has released a draft update to its OT security guide for public comment, while CISA and the FBI issued a fact sheet urging caution with third-party ICS integrators.- NIST's draft Special Publication 800-82 Revision 4, Guide to Operational Technology Security, is open for public comments until November 30, 2026
- The revision adds coverage of building automation, water and wastewater, food and agriculture, freight rail, maritime vessels, and IIoT/cloud convergence, and is organized around NIST Cybersecurity Framework 2.0
- The guide expands OT security control guidance including asset management, network monitoring, and zero trust principles for system management functions
- CISA and the FBI's fact sheet targets critical infrastructure owners and operators working with third-party ICS integrators, urging least-privilege access
- FBI analysis detailed a March-April 2025 intrusion at a US industrial automation firm where foreign actors staged nine archives containing 800 network schematics, device configurations, and customer details
Begin at the End: How to Enable Agentic Remediation
SecurityWeek published an opinion piece arguing that agentic AI should automate the final, manual step of exposure management.- Applies to security teams using continuous threat exposure management (CTEM) frameworks, whose final 'mobilization' step remains a manual, ticket-driven process.
- The article argues automation has matured in discovery, prioritization, and validation, but remediation is where agentic AI offers the most opportunity.
- It proposes 'Shift Zero' — embedding autonomous remediation into operations to eliminate vulnerability backlogs rather than manage growing findings queues.
- It distinguishes human-in-the-loop (agent stages fixes, human approves) from human-on-the-loop (agent acts within scope, human supervises via dashboards), suggesting risk-score-based division of work.
🕵️ RESEARCH & DEEP DIVES • AI-Powered Campaign Targets Hundreds of Online Retailers (5) — SecurityWeek
🕵️ RESEARCH & DEEP DIVES • Secrets Sprawl Is an Identity Problem That AI Just Made Impossible to Ignore (5) — The Hacker News
🕵️ RESEARCH & DEEP DIVES • 17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360 (5) — The Hacker News
🕵️ RESEARCH & DEEP DIVES • Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler P... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • Authentication bypass vulnerability in the password authentication mechanism ... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • O2OA Cipher Connection CipherConnectionAction.java list information disclosur... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network MonitorP... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • Visual Composer Website Builder through 45.16.0 - Unauthenticated Local File Inclu... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • Kirki – Freeform Page Builder, Website Builder & Customizer through 6.2.0 - Unauth... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • WP Multilang – Translation and Multilingual Plugin through 2.4.31 - Authenticated ... (5) — CVE ThreatInt
🕵️ RESEARCH & DEEP DIVES • AvisLoader Windows Malware That Learned to Survive Even After Its Servers Are Taken Down (5) — Cyber Security News
🕵️ RESEARCH & DEEP DIVES • Microsoft Rebuilds the SOC with AI Agents, SIEM Integration and Machine-Speed Defense (5) — Cyber Security News
🕵️ RESEARCH & DEEP DIVES • Special shout-out to area shitbag Ben Halpern (ben@forem.com) and his team of arseholes who published fake AI-generated... (5) — @zackwhittaker@mastodon.social
🕵️ RESEARCH & DEEP DIVES • Getting root on OnePlus 15 from an untrusted app, via an audio debug service and a vendor HAL (5) — r/netsec
🔓 CVEs & KEV
CVE-2026-94243 — Apache Software Foundation Apache Sling Security Bundle — CVSS 7.3 — Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin eviden...
CVE-2026-94251 — Apache Software Foundation Apache Sling Security Bundle — CVSS 6.5 — Apache Sling Security Bundle: ContentDispositionFilter mediates only one addr...
CVE-2026-96443 — Apache Software Foundation Apache Doris — CVSS 6.5 — Apache Doris: JDBC driver URL validation bypass leads to remote code executio...
CVE-2026-91928 — Apache Software Foundation Apache Sling XSS — CVSS 6.1 — Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and fai...
CVE-2026-91852 — Apache Software Foundation Apache Sling XSS — CVSS 6.1 — Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImplI...
CVE-2026-91999 — Apache Software Foundation Apache Sling XSS — CVSS 6.1 — Apache Sling XSS: Improper escaping in the XSS Webconsole pluginImproper neut...
CVE-2026-92001 — Apache Software Foundation Apache Sling XSS — CVSS 6.1 — Apache Sling XSS: Missing parser resource limitsImproper restriction of recur...
CVE-2026-73192 — Apache Software Foundation Apache Sling XSS — CVSS 6.1 — Apache Sling XSS: XSS possible through XSSAPI.getValidHref()An improper neutr...