Security concerns are reaching some unexpected places. |
Today, I'm watching a major hosting breach, banks pushing back against AI agents, and privacy questions surrounding delivery robots. - Ken Missed a newsletter? Read past issues here. |
|
|
|
Here’s what you need to know: |
|
|
|
Zeabur Breach Exposes 321K Accounts |
Zeabur’s second breach in two months exposed 321,810 accounts and 3.2 million records. Attackers also gained root access to 101 Google Cloud servers and installed unauthorized SSH keys on 50 of them. |
My Take: Rotating stolen credentials isn't enough when attackers have established persistent access through unauthorized SSH keys.
Revoke exposed credentials, audit connected services, and rebuild compromised servers before migration. |
Morgan Stanley, JPMorgan Block AI Agents |
Major U.S. banks are restricting third-party AI agents from accessing customer accounts. The move follows concerns that customers sharing banking credentials with AI tools could expose sensitive financial data or enable unauthorized transactions. My Take: The challenge for banks is ensuring AI agents operate within approved permissions, especially when they have the ability to move money. Limit AI agent permissions and test whether agents can bypass access restrictions or initiate unauthorized transactions. |
Meta Ordered to Pay $25B Over Privacy Failures |
A New Mexico judge ordered Meta to pay $25 billion after a jury found that Facebook misled users about privacy and third-party data access. The case stems partly from the Cambridge Analytica scandal, though Meta disputes the ruling and plans to appeal. My Take: This case reinforces that security leaders need to ensure their privacy promises match their organization's actual practices. Audit third-party data access and test whether privacy settings actually restrict how personal information is collected or shared. |
|
|
|
Chicago Delivery Robots Spark Privacy Fight |
Chicago lawsuits accuse Coco Robotics and Serve Robotics of collecting biometric data without consent, which both companies deny. The cases question whether robot navigation data qualifies as protected biometric information under Illinois law. |
My Take: My concern is that data collected for robot navigation could create additional privacy risks if retained or shared beyond its intended purpose.
Organizations should audit autonomous systems’ data collection, limit retention, and ensure compliance with biometric privacy laws. |
Claude Finds 493 Flaws in Open-Source Software |
Anthropic's Claude found 493 security issues across 25 open-source projects, including vulnerabilities that silently disabled protections for years. The findings also prompted OpenSSH developers to reduce code accessible before authentication. My Take: What stands out to me is how long some of these flaws went undetected. Review configurations and test whether authentication controls enforce their intended restrictions. |
|
|
|
Could Infostealers Bypass Your MFA? |
Infostealer malware steals credentials and session tokens, enabling account hijacking and potential MFA bypass. |
How to protect against infostealers: |
- Deploy EDR/XDR tools to detect infostealer activity and identify suspicious attempts to access stored credentials.
-
Use phishing-resistant MFA and managed password managers to reduce credential theft risks.
- Monitor for compromised credentials using threat intelligence and immediately revoke exposed sessions to protect against account hijacking.
|
Measure how quickly you can identify infostealer infections and invalidate stolen sessions before attackers reuse them. |
|
|
|
Security Tools You Can Use |
-
Protect your business from threats — get 30% off Bitdefender’s powerful cloud and on-premise protection today.
-
Build hands-on AI security skills for less — save 30% on TryHackMe with code TECHADVICE30.
-
Not sure where to start with AI? The Neuron Academy recommends courses based on what you want to accomplish.
|
|
|
|
Would you trust an AI agent with your money? |
|
|
|
Yesterday's Pulse Check Results |
Website Security Check: How layered are your defenses? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
