Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

October 2026 has been an unusually loud month for critical disclosures across the ecosystem. Along with PHP2Shell, GitLab also joined the party and shipped three critical RCEs in the same month: CVE-2026-90970 (CVSS 9.9) in the self-hosted AI Gateway on October 2, then CVE-2026-97229 (CVSS 10.0) on October 12, and CVE-2026-110264 (CVSS 10.0) on October 21. The last two are integer overflow bugs in the exact same regex compiler, shipped nine days apart.

A password manager for iPhone Duo helps you store and use unique passwords without having to remember each one. Keeper Password Manager brings passwords and passkeys together in an encrypted vault, with KeeperFill to help you sign in to websites and apps. Keeper’s iOS app is designed for iPhone Duo’s displays. When the device is open, you can browse vault folders and view record details side by side. When it’s closed, the app uses the outer display.

As adversaries broaden their operations across cloud environments, identities, SaaS applications, and AI systems, security teams need threat hunting that can keep up. Suspicious activity in one environment may be part of a larger intrusion spanning multiple domains, making it increasingly important to connect signals across the attack surface. To expand detection coverage across the widening attack surface, CrowdStrike Falcon Adversary OverWatch threat hunting has added two key capabilities.

Every organization has a different threat profile. Industry, geography, infrastructure, business operations, and the broader technology ecosystem all influence which adversaries and threats matter most. The challenge is putting threat intelligence to work at scale to identify the greatest threats to each business. The intelligence that security teams rely on is as varied as the threats they face.

AI agents don't just answer questions anymore. They open files, use credentials, run code, install software, and run models locally, all at machine speed. Every one of those actions happens on the operating system. This is where attacks land, and where CrowdStrike Falcon Guardian excels: on the endpoint, at runtime.

The shift from NIST SP 800-171 revision 2 to revision 3 includes a lot of changes, which we've already covered from a bird's-eye view over in this post. One of the biggest changes in Rev 3 is the introduction of ODPs, or Organization-Defined Parameters. These are very important for compliance with CMMC moving forward, but they're still something of a mystery to some security professionals, and are worth explaining. What are they, how do you define them, and how do you use them for compliance?

Short answer: GDPR names pseudonymization as a recommended safeguard, in Article 25 and Article 32, and Recital 28 says pseudonymization reduces risk for data subjects. Redaction deletes the value, so a redacted prompt breaks the model’s ability to reason. Tokenization replaces the value with a consistent token, so the model keeps working. Tokenization is a safeguard, not an exemption. A familiar pattern: a team writes a regex, strips emails from the prompts, and calls it done.

Recent events have once again highlighted the need to quickly answer the question, “Are we exposed?” We now face threats to businesses and governments from vulnerabilities and compromises in three fundamental components used in software development: Curl, PHP, and LiteLLM.

AI agents are moving into production fast. They read email, call tools, query databases, and trigger business processes, often chaining those steps in ways no single team designed. Building them has never been easier. Securing what happens after an agent is manipulated is the hard part. That is the gap Salt and AWS will tackle together on Tuesday, November 10, at 9:00 am PT (12:00 pm ET) in a live session: AWS + Salt: Build Fast, Stay Secure with Agentic AI. Save your seat →