Week in review: Refrigeration cyberattacks hit European retailers again, Patch Tuesday forecast
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: The first ten lines of a command policy for AI coding agents In this Help Net Security interview, Vinay Thakker, CTO of KloudStax, explains how to set identity, credentials, and network limits for AI agents.
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: The first ten lines of a command policy for AI coding agents In this Help Net Security interview, Vinay Thakker, CTO of KloudStax, explains how to set identity, credentials, and network limits for AI agents.
He argues that agents should run under their own identity, with the person’s identity attached when acting on someone’s behalf.
Google disrupts XCPE botnet, bans the company behind it Google shut down the servers behind XCPE, a backdoor hidden in the firmware of Android TV set-top boxes.
Fireperf: Open-source network testing tool for firewalls and routers The IPFire project has released fireperf, an open-source measurement tool that opens connections at a fixed rate and reports what the device in the middle did with each one.
AI coding agents are installing MCP servers that will never be patched When a developer tells an AI coding agent to set up a GitHub MCP, the agent has to pick a package.
It is free software aimed at administrators, developers and testers who evaluate firewalls, routers and other systems that keep a state for every connection.
What human hackers still do better than AI, according to HackerOne’s CEO AI can find vulnerabilities in minutes, but people still hold the edge in judging what a flaw means for a business.
A banking malware sample led researchers to an Android bug that can loop-crash phones Bitdefender Labs researchers built an Android app that contains no executable code and requests no permissions, and installing it leaves a Pixel 10 in a crash loop that can take a factory reset to clear.
Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up Sweet Security helps teams identify exposed services at runtime, and its Virtual Patching blocks the system call the demonstrated exploit uses to launch a shell, buying time to deploy permanent fixes.
What AI-generated malware looks like under the microscope In this Help Net Security interview, Lindsay Kaye, VP of Threat Intelligence at HUMAN Security, talks about what AI-generated malware looks like on the bench.
In her team’s analysis, about 6 in 10 vulnerabilities matched to certified products, smartcards aside, were disclosed after the certification date.
CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) CISA added two new Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti updated an earlier security advisory with details about the flaws.
New research from Glow Labs documents sessions where it picked one out of an archived repository that will never be patched again.
Chainalysis breached using offensive agentic techniques Blockchain analytics firm Chainalysis has suffered a cybersecurity incident that led to a data breach.
What happened
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: The first ten lines of a command policy for AI coding agents In this Help Net Security interview, Vinay Thakker, CTO of KloudStax, explains how to set identity, credentials, and network limits for AI agents.
He argues that agents should run under their own identity, with the person’s identity attached when acting on someone’s behalf.
Google disrupts XCPE botnet, bans the company behind it Google shut down the servers behind XCPE, a backdoor hidden in the firmware of Android TV set-top boxes.
What changed
Fireperf: Open-source network testing tool for firewalls and routers The IPFire project has released fireperf, an open-source measurement tool that opens connections at a fixed rate and reports what the device in the middle did with each one.
AI coding agents are installing MCP servers that will never be patched When a developer tells an AI coding agent to set up a GitHub MCP, the agent has to pick a package.
Who is affected
It is free software aimed at administrators, developers and testers who evaluate firewalls, routers and other systems that keep a state for every connection.
What human hackers still do better than AI, according to HackerOne’s CEO AI can find vulnerabilities in minutes, but people still hold the edge in judging what a flaw means for a business.
Why it matters
A banking malware sample led researchers to an Android bug that can loop-crash phones Bitdefender Labs researchers built an Android app that contains no executable code and requests no permissions, and installing it leaves a Pixel 10 in a crash loop that can take a factory reset to clear.
Product showcase: Sweet Virtual Patching stops HTTP2Shell while fixes catch up Sweet Security helps teams identify exposed services at runtime, and its Virtual Patching blocks the system call the demonstrated exploit uses to launch a shell, buying time to deploy permanent fixes.
Technical details
What AI-generated malware looks like under the microscope In this Help Net Security interview, Lindsay Kaye, VP of Threat Intelligence at HUMAN Security, talks about what AI-generated malware looks like on the bench.
In her team’s analysis, about 6 in 10 vulnerabilities matched to certified products, smartcards aside, were disclosed after the certification date.
CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) CISA added two new Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti updated an earlier security advisory with details about the flaws.
Response
New research from Glow Labs documents sessions where it picked one out of an archived repository that will never be patched again.
Chainalysis breached using offensive agentic techniques Blockchain analytics firm Chainalysis has suffered a cybersecurity incident that led to a data breach.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.