Author: Gary Behan

A sponsored analysis published by BleepingComputer argues that AI pentesting is not a like-for-like replacement for human engagements, but that the comparison itself may be the wrong frame. Written by Daniel Thatcher, a security research engineer at Intruder, the piece draws on his twelve years of penetration testing experience to map out where the company’s agents outperform human testers, where they fall short, and where the distinction stops mattering. Intruder launched the capability in April 2026, alongside its existing vulnerability scanning and attack surface management platform. The product takes a white-box approach: agents work through the full source code of…

Microsoft has pushed WSL Containers to general availability, expanding the Windows Subsystem for Linux beyond distribution hosting into a full Linux container runtime that lives natively on Windows. The Windows Developer Blog confirmed the release on 29 September 2026, and the feature is accessible immediately by running wsl –update.The journey to this point began at Microsoft Build 2026, where WSL Containers were first introduced, according to the Windows Command Line blog on Microsoft DevBlogs. Going from preview to generally available in a single development cycle is a fairly brisk turnaround, and the GA release arrives with a noticeably longer feature…

Contributed content: this article was written by a third-party contributor and does not necessarily reflect the views of ITL. Editorial and Advertising Policy BMW has built its reputation around engines for generations. From naturally aspirated straight-sixes that became favourites among enthusiasts to modern turbocharged engines and today’s electrified powertrains, BMW engine technology has changed dramatically. For someone who simply enjoys driving a BMW, all the technical names can sometimes be confusing. VANOS, Valvetronic, TwinPower Turbo, direct injection, mild hybrid and eDrive can sound like a completely different language. But there is a fairly simple story behind it all. BMW has…

Two former members of the United States Air Force have been sentenced to a combined 189 months in federal prison for their roles in a Dover Air Force Base BEC scam operation that redirected millions of dollars from businesses across the country. Chijioke Timothy Odimegwu, 25, and Harafat Mogaji, 26, carried out the attacks while stationed at Dover Air Force Base in Delaware, according to court documents.The pair ran a multi-year scheme built around phishing and spoofed email addresses. They stole employee email credentials through spam and phishing campaigns, then used those credentials alongside spoofed addresses that mimicked legitimate business…

The DIVD AI agent breach that rattled the Dutch volunteer security research community has sharpened into focus: the attack exploited two critical zero-day vulnerabilities in The Register-confirmed open-source helpdesk and customer support ticketing system Zammad, and by 1 October the organisation had confirmed that data had been exfiltrated. An automated AI agent, described by the Dutch Institute for Vulnerability Disclosure (DIVD) as operating at ‘the speed of light and sloppy logic,’ carried out the post-exploitation work autonomously after seven years of uneventful operations for the nonprofit.DIVD is a nonprofit organisation of volunteer security researchers that scans the internet for systems…

A Vietnamese national has been charged in connection with a pig butchering crypto scam that prosecutors say funnelled more than $53 million through his cryptocurrency wallets, with a single victim losing $16 million to a fake investment platform called ‘Triangle’. The U.S. Attorney’s Office for the Western District of Missouri announced the charges on 25 September, according to KCTV5.Trung Nguyen Van, 37, entered the United States through the San Ysidro, California pedestrian border crossing from Mexico on 22 September. He was arrested two days later at Los Angeles International Airport before boarding a flight to Taiwan. He now faces two…

Kiteworks has lifted its emergency shutdown advisory and brought all hosted customer systems back online after completing a Kiteworks critical vulnerability patch and finding no evidence of compromise during the precautionary offline period. The company, which operates a Private Content Network (PCN) serving thousands of global corporations and government agencies, had urged customers worldwide on Saturday to take their servers offline following a warning from federal intelligence authorities about a potentially imminent cyberattack.By Monday, monitoring across the period had shown nothing untoward. ‘Continuous monitoring throughout the period showed no abnormal activity, and the company has no indication that any Kiteworks…

A Keio Corporation ransomware attack has taken down payment and reservation systems across several of the Japanese group’s businesses, with Keio Store locations among those left unable to process card or e-money transactions. The attack was confirmed by the company after a system failure in the early hours of Saturday, 26 September 2026.In a statement, Keio Corporation said: ‘In the early hours of September 26, 2026, we confirmed a ransomware attack on our group’s servers. We have reported the incident to the police and are conducting an investigation into the attack’s route and damage with the cooperation of external experts.’…

A threat actor tracked as Storm-3168 has been conducting JadePuffer Azure tenant attacks that map cloud environments, harvest credentials, and then erase core infrastructure at speed, in two observed incidents, the destructive phase lasted just seven minutes. The group operates a ransomware campaign that Dark Reading describes as the first documented large language model (LLM)-driven ransomware operation, according to identification work carried out by cloud security company Sysdig.How JadePuffer Azure Tenant Attacks UnfoldMicrosoft Security Research observed the two attacks in June, publishing its findings on 25 September 2026. In both cases, Storm-3168 used two compromised service principals belonging to the…

Bitget Bitcoin withdrawals have resumed following a suspension triggered by what the exchange says was a breach carried out by North Korean hackers, who transferred $387.5 million to attacker-controlled addresses in one of the largest crypto thefts on record. The platform says it has patched the exploited vulnerability and is working through a phased schedule to restore withdrawals across all supported assets.What happened and when withdrawals returnBitget suspended all withdrawals on Thursday after its security systems detected multiple unauthorised transfers from a limited number of crypto wallets. The company subsequently confirmed that attackers had stolen $351.6 million from its hot…