https://markcyber.ca/Daily briefs on active exploitation, advisories, detection engineering and AI security.en-cahttps://markcyber.ca/blog/ai-security-certification/https://markcyber.ca/blog/ai-security-certificationSun, 01 Nov 2026 00:00:00 GMTAn AI security certification guide: SecAI+, AAISM, GIAC GAIPS, AIGP and the coming ISC2 exam, sorted by job, prerequisites and how each one tests you.https://markcyber.ca/blog/owasp-llm-top-10-2026/https://markcyber.ca/blog/owasp-llm-top-10-2026Sat, 31 Oct 2026 00:00:00 GMTThe OWASP LLM Top 10 2026 reorders LLM security risks using 6,639 real incidents. The new order, why it moved, and the control that holds for each entry.https://markcyber.ca/blog/binance-hack-eip-7702/https://markcyber.ca/blog/binance-hack-eip-7702Fri, 30 Oct 2026 00:00:00 GMTThe Binance hack moved about $6.3 billion from hot wallets on at least ten chains with no known key leak. How the signer was turned, and what to check in yours.https://markcyber.ca/blog/nist-ai-risk-management-framework/https://markcyber.ca/blog/nist-ai-risk-management-frameworkFri, 30 Oct 2026 00:00:00 GMTThe NIST AI Risk Management Framework for security teams: the four functions, the GenAI profile, the pending revision and a profile-based way to apply it.https://markcyber.ca/blog/connectwise-breach-storm-0940-artex-ai-agents/https://markcyber.ca/blog/connectwise-breach-storm-0940-artex-ai-agentsThu, 29 Oct 2026 00:00:00 GMTThe ConnectWise breach let Storm-0940's ARTEX agents sign in to Microsoft 365 tenants as a backup app. Seven app IDs to disable, plus Sigma and KQL to hunt.https://markcyber.ca/blog/cve-2026-46300-fragnesia-linux-kernel-vulnerability/https://markcyber.ca/blog/cve-2026-46300-fragnesia-linux-kernel-vulnerabilityThu, 29 Oct 2026 00:00:00 GMTFragnesia (CVE-2026-46300), a Linux kernel flaw on CISA KEV, turned PHP2Shell into root on 25 firewalls. Patch, but collect memory evidence first.https://markcyber.ca/blog/cve-2026-48356-magento-vulnerability/https://markcyber.ca/blog/cve-2026-48356-magento-vulnerabilityWed, 28 Oct 2026 00:00:00 GMTThe PolyShell Magento vulnerability, CVE-2026-48356, is on KEV. The July patch stops new uploads but not the loaders already in your database. How to check.https://markcyber.ca/blog/traiga-texas-responsible-ai-governance-act/https://markcyber.ca/blog/traiga-texas-responsible-ai-governance-actTue, 27 Oct 2026 00:00:00 GMTThe Texas Responsible AI Governance Act (TRAIGA) is a narrow intent law. What it prohibits, who must disclose, the penalties, and the evidence to keep.https://markcyber.ca/blog/mcp-security/https://markcyber.ca/blog/mcp-securityMon, 26 Oct 2026 00:00:00 GMTMCP security explained: tool poisoning, rug pulls, token passthrough and exposed servers, with the controls that hold up after a server is approved.https://markcyber.ca/blog/data-poisoning/https://markcyber.ca/blog/data-poisoningFri, 23 Oct 2026 00:00:00 GMTData poisoning plants a few bad samples in training, fine-tuning or RAG data so a model misbehaves on cue. Where it gets in, and how to detect and prevent it.https://markcyber.ca/blog/cve-2026-109618-php-vulnerability/https://markcyber.ca/blog/cve-2026-109618-php-vulnerabilityThu, 22 Oct 2026 00:00:00 GMTPHP2Shell (CVE-2026-109618, CVE-2026-109619) is unauthenticated RCE in PHP itself. Patch to 8.5.12/8.4.27/8.3.36/8.2.35, and know why your scanner stays silent.https://markcyber.ca/blog/colorado-ai-act/https://markcyber.ca/blog/colorado-ai-actThu, 22 Oct 2026 00:00:00 GMTThe Colorado AI Act was repealed and replaced by SB 26-189. What deployers and developers must do by January 1, 2027, and the evidence the draft rules expect.https://markcyber.ca/blog/cve-2026-96652-plex-media-server-vulnerability/https://markcyber.ca/blog/cve-2026-96652-plex-media-server-vulnerabilityWed, 21 Oct 2026 00:00:00 GMTThe Plex vulnerability chain CVE-2026-96652 is exploited and on KEV. Build 1.43.3.10828 still looks patched but is not; get 10861, then hunt with Sigma.https://markcyber.ca/blog/detection-engineering/https://markcyber.ca/blog/detection-engineeringTue, 20 Oct 2026 00:00:00 GMTDetection engineering treats detections as tested, documented software. The lifecycle, detection as code, where to aim, and how to measure it.https://markcyber.ca/blog/cve-2026-102764-beyondtrust-remote-support-vulnerability/https://markcyber.ca/blog/cve-2026-102764-beyondtrust-remote-support-vulnerabilityMon, 19 Oct 2026 00:00:00 GMTBeyondTrust Remote Support vulnerability CVE-2026-102764 was a zero-day for ARMORY CASTLE since August. Patch BT26-05, preserve logs first, two Sigma rules.https://markcyber.ca/blog/iso-42001-certification/https://markcyber.ca/blog/iso-42001-certificationFri, 16 Oct 2026 00:00:00 GMTISO 42001 certification is a two-stage audit of your AI management system. What auditors test, how to verify a supplier's certificate, and its EU AI Act limits.https://markcyber.ca/blog/ai-soc/https://markcyber.ca/blog/ai-socThu, 15 Oct 2026 00:00:00 GMTAn AI SOC uses agents to triage and investigate alerts. What the research shows they get right, how they miss attacks, and what to test before you buy.https://markcyber.ca/blog/french-supermarket-cyber-attack-supply-chain/https://markcyber.ca/blog/french-supermarket-cyber-attack-supply-chainWed, 14 Oct 2026 00:00:00 GMTAttackers reached fridge controllers in about 700 French supermarkets through the contractors who run them. What the attack shows about supply chain risk.https://markcyber.ca/blog/ai-red-teaming/https://markcyber.ca/blog/ai-red-teamingWed, 14 Oct 2026 00:00:00 GMTAI red teaming for security teams: scope tests from impact, pick tools, measure over repeated attempts, and turn findings into fixes for LLM apps and agents.https://markcyber.ca/blog/cve-2026-105134-ahsaycbs-vulnerability/https://markcyber.ca/blog/cve-2026-105134-ahsaycbs-vulnerabilityTue, 13 Oct 2026 00:00:00 GMTAhsayCBS vulnerability CVE-2026-105134 is exploited for SYSTEM-level RCE. CVE records say 10.3.4 fixes it; it does not. Hotfix builds, Sigma, hunt window.https://markcyber.ca/blog/cve-2026-102255-sonicwall-sma1000-vulnerability/https://markcyber.ca/blog/cve-2026-102255-sonicwall-sma1000-vulnerabilityMon, 12 Oct 2026 00:00:00 GMTSonicWall SMA1000 vulnerability CVE-2026-102255 (CVSS 10) drew honeypot attacks days after the patch. September's fix build is affected. Builds, Sigma, hunt.https://markcyber.ca/blog/cve-2026-88779-citrix-netscaler-vulnerability-saml/https://markcyber.ca/blog/cve-2026-88779-citrix-netscaler-vulnerability-samlSun, 11 Oct 2026 00:00:00 GMTThe NetScaler build that fixed exploited CVE-2026-88779 is exposed to CVE-2026-107406 (CVSS 9.5) on SAML IdPs. One build table, a Sigma rule, a hunt list.https://markcyber.ca/blog/harvest-now-decrypt-later-post-quantum-cryptography/https://markcyber.ca/blog/harvest-now-decrypt-later-post-quantum-cryptographySun, 11 Oct 2026 00:00:00 GMTHarvest now, decrypt later makes the post-quantum deadline earlier than Q-Day. The dates the US, Canada and the UK have set, and what to migrate first.https://markcyber.ca/blog/vishing-quishing-ai-phishing/https://markcyber.ca/blog/vishing-quishing-ai-phishingTue, 06 Oct 2026 00:00:00 GMTVishing, quishing and AI phishing drove 2026 phishing trends: attackers log in from a phone call or a QR code. The data, and the controls that stop all three.https://markcyber.ca/blog/ai-psychosis-ai-addiction/https://markcyber.ca/blog/ai-psychosis-ai-addictionSun, 04 Oct 2026 00:00:00 GMTAI psychosis and AI addiction are the sharp end of chatbot harm. 2026 studies tie heavy use to loneliness. What teams deploying chatbots should change.https://markcyber.ca/blog/agentic-ai-security-risks/https://markcyber.ca/blog/agentic-ai-security-risksFri, 02 Oct 2026 00:00:00 GMTAgentic AI security risks in 2026 came from three directions: your own agents, other firms' agents routing around your controls, and attackers' agents.https://markcyber.ca/blog/n8n-vulnerability-ai-automation-security/https://markcyber.ca/blog/n8n-vulnerability-ai-automation-securityThu, 01 Oct 2026 00:00:00 GMTThe critical n8n vulnerabilities of 2026 in one version check, why the expression sandbox keeps breaking, a Sigma rule, and the design flaw no patch fixes.https://markcyber.ca/blog/ai-agent-identity-management/https://markcyber.ca/blog/ai-agent-identity-managementWed, 30 Sep 2026 00:00:00 GMTAI agent identity management: one identity per agent, user authority delegated via token exchange and ID-JAG, no static secrets, and evidence of what it did.https://markcyber.ca/blog/chatgpt-custom-gpt-clickfix-rat/https://markcyber.ca/blog/chatgpt-custom-gpt-clickfix-ratWed, 30 Sep 2026 00:00:00 GMTA fake Plus 5.6 Custom GPT on chatgpt.com sent ad clicks to a ClickFix page that installs a RAT. Why RunMRU rules miss it, and two Sigma rules that catch it.https://markcyber.ca/blog/ai-coding-agents-leaked-screenshots-github/https://markcyber.ca/blog/ai-coding-agents-leaked-screenshots-githubWed, 30 Sep 2026 00:00:00 GMTAI coding agents put private PR screenshots from 300+ organizations in public repos under personal GitHub accounts. An exposure sweep, Sigma rule and controls.https://markcyber.ca/blog/will-ai-kill-humans/https://markcyber.ca/blog/will-ai-kill-humansTue, 29 Sep 2026 00:00:00 GMTAI already kills humans, as one link in chains people build. The record of AI deaths runs from a 2018 self-driving crash to a 2026 drone strike.https://markcyber.ca/blog/ai-agent-governance-ciso/https://markcyber.ca/blog/ai-agent-governance-cisoMon, 28 Sep 2026 00:00:00 GMTWhen the board asks about AI usage, the 2026 answer is AI agent governance. Why the risk moved from prompts to permissions, and what a CISO should commit to.https://markcyber.ca/blog/gemini-3-8-flash-cyber/https://markcyber.ca/blog/gemini-3-8-flash-cyberSun, 27 Sep 2026 00:00:00 GMTGemini 3.8 Flash Cyber is Google's gated vulnerability-hunting model. Fairwind access requirements, what its benchmarks measure, what it changes for defenders.https://markcyber.ca/blog/shadow-ai-governance/https://markcyber.ca/blog/shadow-ai-governanceSun, 27 Sep 2026 00:00:00 GMTShadow AI now appears in 43 percent of AI-related security incidents and adds $670,000 to breach costs. How to discover it and govern it without a blocking war.https://markcyber.ca/blog/offensive-agentic-ai/https://markcyber.ca/blog/offensive-agentic-aiSat, 26 Sep 2026 00:00:00 GMTOffensive AI has moved from lab result to documented campaigns, with agents running most of a state espionage operation. What is proven, how defenders respond.https://markcyber.ca/blog/deepfake-social-engineering/https://markcyber.ca/blog/deepfake-social-engineeringSat, 26 Sep 2026 00:00:00 GMTDeepfake social engineering targets payments, account recovery and hiring. Real incidents from Arup to Ferrari, and the verification controls that stop them.https://markcyber.ca/blog/do-we-still-need-ueba/https://markcyber.ca/blog/do-we-still-need-uebaFri, 25 Sep 2026 00:00:00 GMTStandalone UEBA is disappearing as a product, but the identity detection gap it covers is not. How to decide what to consolidate, keep or cut at renewal.https://markcyber.ca/blog/ueba-detection-engineering/https://markcyber.ca/blog/ueba-detection-engineeringFri, 25 Sep 2026 00:00:00 GMTDoes UEBA add value on top of detection rules? Where behavioral baselines catch what rules cannot express, where they fail, and the KQL to use them well.https://markcyber.ca/blog/non-human-identity-management/https://markcyber.ca/blog/non-human-identity-managementFri, 25 Sep 2026 00:00:00 GMTHow to inventory, own, monitor and audit service accounts, service principals and workload identities, with KQL queries for Entra ID estates.https://markcyber.ca/blog/prompt-injection-defense/https://markcyber.ca/blog/prompt-injection-defenseFri, 25 Sep 2026 00:00:00 GMTHow prompt injection works, why filters alone fail, and the detection queries, controls and tests that actually reduce risk in LLM applications and agents.https://markcyber.ca/blog/how-safe-are-your-ai-policies/https://markcyber.ca/blog/how-safe-are-your-ai-policiesThu, 24 Sep 2026 00:00:00 GMT2026 breach data says AI policies are failing as controls. Five tests that show whether yours actually reduces risk, and what to fix first.https://markcyber.ca/blog/cve-2026-93616-check-point-management-vpn-exploited/https://markcyber.ca/blog/cve-2026-93616-check-point-management-vpn-exploitedThu, 24 Sep 2026 00:00:00 GMTTwo exploited 9.8s: a management server zero-day live since July, and gateway VPN RCE hitting Spark customers. Versions, stopgaps, and hunting queries.https://markcyber.ca/blog/cve-2026-94127-f5-big-ip-apm-oauth-rce/https://markcyber.ca/blog/cve-2026-94127-f5-big-ip-apm-oauth-rceThu, 24 Sep 2026 00:00:00 GMTUnauthenticated RCE in BIG-IP APM OAuth authorization servers is being exploited. Affected versions, the iRule stopgap, and failure-burst detections.