Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Appknox MCP agent connects your AI coding agent to your Appknox scan results and KnoxIQ analysis. Your agent triages findings by exploitability, fixes the code in your repo and verifies each fix with a re-scan, inside Claude Code, Cursor, GitHub Copilot, Codex or Windsurf. Your AI coding agent already writes features, refactors code and fixes bugs. It can't see your security findings. So when a scan flags a vulnerability in your mobile app, the fix still starts by hand.

Researchers at Fortra are tracking a surge in phishing attacks targeting bank accounts via remote monitoring and management (RMM) tools. “Hybrid phishing-to-RMM campaigns have emerged as a potent method to target North American financial institutions, with a focused interest in business commercial banking accounts,” Fortra says.

The third quarter of 2026 saw the highest number of ransomware attacks to date, with 2,627 total attacks, according to a new report from Comparitech.

Insights from Attempted Intelligence, Episode 2, hosted by Matt Duren, SVP of AI and data, KnowBe4 and Harlan Parrott, VP of AI innovation, KnowBe4. AI data centers are one of the most debated topics in the world right now. Some people worry about the energy and water it takes to run them. Others see the foundation for the next wave of AI advances. Both camps have a point. On episode two of the Attempted Intelligence podcast, Matt and Harlan each picked a side and debated it.

On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to close two critical remote code execution flaws in the PHP runtime. Both are rated CVSS v4.0 9.2. Together they go by the name “PHP2Shell.” The flaws sit in PHP itself, not in any application built on it. A secure codebase running on an affected PHP build is still exposed. That makes this an inventory problem first and a patching problem second.

On October 21, 2026, a malicious release of litellm, the Python library and proxy for calling LLM provider APIs, was published to PyPI as version 1.107.0. All seven compiled wheels carried three extra files that install straight into the root of site-packages: a.pth hook that runs a credential stealer every time Python starts, and a sitecustomize.py that starts a background loader built to fetch and run remote Python code every hour. The package has had more than 92 million downloads over the past month.

The rise of AI tools in the workplace has put Shadow AI firmly on the cybersecurity agenda. Employees are increasingly adopting AI services without IT or security approval, potentially creating security, privacy, and compliance risks. But focusing on Shadow AI alone misses the bigger issue. The real question is not just which AI tools employees use, but whether organizations understand what is happening across their entire SaaS environment.

Developer laptops hold about 150 secrets each, and roughly 28% of secret incidents happen outside code repositories. Learn what credential layer security is and the six controls that protect every surface where credentials live.

The PHP security team has announced an emergency security release for Wednesday, October 21, 2026 at 14:00 UTC. It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619. Both bugs are described as remote code execution issues, meaning an attacker could get their own commands running on a vulnerable server. The route to disclosure was messy.

Today, SentinelOne named LevelBlue its global exclusive delivery partner for Wayfinder, SentinelOne’s suite of AI-powered managed security and threat detection services. LevelBlue will deliver Wayfinder managed detection and response (MDR), threat hunting, incident readiness and response (IRR), and SentinelOne’s professional services for organizations around the world. It’s a milestone for our teams, and it reflects something we believe deeply about security in the AI era.