>"Pillar Security's research team, Eilon Cohen, Dan Lisichkin and Ariel Fogel, reproduced the bypasses over several months and published them today as a series they call the Week of Sandbox Escapes, one write-up a day."
>"reverse engineering process of a real-world hardware implant discovered inside of a Ledger Nano X cryptocurrency hardware wallet."
Splunk .conf in Denver Sept 2026: The core theme focuses on "Agentic AI"—the transition toward autonomous workflows in security, observability, and operations to manage increasing data complexity and digital risk.
**Sessions**
* **Powering the Rise of the Agentic Enterprise:** Transforming security/ops with scalable, trust-based AI workflows.
* **See Inside Your Agentic AI Applications:** Tracing Python agent interactions to detect hallucinations and tool failures.
* **The Future is Here: What’s New in Splunk Security:** Transitioning to an "Agentic SOC" via automated orchestration.
* **The Platform for Your Agentic Enterprise:** Unlocking cross-domain insights through unified data and AI.
* **What's New in Platform:** Using a unified data fabric for predictive, agentic operations.
* **5 ML Algorithms in Under 5 Lines of Code:** Reducing alert fatigue using simple SPL/MLTK implementations.
* **Accelerate Digital Resilience (Cisco & Splunk):** Maximizing ROI through integrated ecosystem use cases.
* **AI Troubleshooting and Remediation Agents:** Using AI SRE agents to accelerate root cause analysis.
* **Accelerate SmartStore Searches with VAST Data:** Reducing storage costs via InfiniteCache integration.
* **The Cisco & Splunk Partner Playbook:** Strategies for scaling business in the AI era.
* **Accelerating Your Journey to Agentic Observability:** Navigating 4 steps toward agent-driven monitoring.
* **A Compromised Account Alerting System:** Automating detection of suspicious user behavior.
* **Advanced Threat Detection (DSDL & RBA):** Using machine learning for behavioral risk scoring.
* **Advancing Security Operations with ESCU Innovations:** Leveraging new high-fidelity threat intelligence content.
* **Agentic Data Ingestion (Anthropic's Claude):** Automating Splunk Add-On development using GenAI.
* **Agentic Detection Posture Management:** Using AI to rapidly identify and close detection gaps.
* **Agentic Incident Command:** Deploying coordinated AI agent teams for full incident lifecycles.
* **Hands-on Agent Attack Analysis:** Building anomaly detections from raw agent telemetry.
* **Build Your Own SOC AI Agent (Workshop):** Hands-on guide to building custom agents with guardrails.
* **Triage and Response at Scale:** Using Triage and SOP Agents for automated incident response.
* **Agents Are Easy, Trust Is Hard:** Implementing governance in cohesive agentic operations via Cisco Data Fabric.
* **AI Assistant V2 Unlocked (Workshop):** Hands-on with Agent Mode and organizational knowledge integration.
**Sessions**
* **Powering the Rise of the Agentic Enterprise:** Transforming security/ops with scalable, trust-based AI workflows.
* **See Inside Your Agentic AI Applications:** Tracing Python agent interactions to detect hallucinations and tool failures.
* **The Future is Here: What’s New in Splunk Security:** Transitioning to an "Agentic SOC" via automated orchestration.
* **The Platform for Your Agentic Enterprise:** Unlocking cross-domain insights through unified data and AI.
* **What's New in Platform:** Using a unified data fabric for predictive, agentic operations.
* **5 ML Algorithms in Under 5 Lines of Code:** Reducing alert fatigue using simple SPL/MLTK implementations.
* **Accelerate Digital Resilience (Cisco & Splunk):** Maximizing ROI through integrated ecosystem use cases.
* **AI Troubleshooting and Remediation Agents:** Using AI SRE agents to accelerate root cause analysis.
* **Accelerate SmartStore Searches with VAST Data:** Reducing storage costs via InfiniteCache integration.
* **The Cisco & Splunk Partner Playbook:** Strategies for scaling business in the AI era.
* **Accelerating Your Journey to Agentic Observability:** Navigating 4 steps toward agent-driven monitoring.
* **A Compromised Account Alerting System:** Automating detection of suspicious user behavior.
* **Advanced Threat Detection (DSDL & RBA):** Using machine learning for behavioral risk scoring.
* **Advancing Security Operations with ESCU Innovations:** Leveraging new high-fidelity threat intelligence content.
* **Agentic Data Ingestion (Anthropic's Claude):** Automating Splunk Add-On development using GenAI.
* **Agentic Detection Posture Management:** Using AI to rapidly identify and close detection gaps.
* **Agentic Incident Command:** Deploying coordinated AI agent teams for full incident lifecycles.
* **Hands-on Agent Attack Analysis:** Building anomaly detections from raw agent telemetry.
* **Build Your Own SOC AI Agent (Workshop):** Hands-on guide to building custom agents with guardrails.
* **Triage and Response at Scale:** Using Triage and SOP Agents for automated incident response.
* **Agents Are Easy, Trust Is Hard:** Implementing governance in cohesive agentic operations via Cisco Data Fabric.
* **AI Assistant V2 Unlocked (Workshop):** Hands-on with Agent Mode and organizational knowledge integration.
Researchers from Dartmouth College and other institutions have developed a low-cost method to manage indoor Wi-Fi coverage using 3D-printed plastic shells wrapped in aluminum foil. This project, called WiPrint, uses software algorithms to simulate radio wave propagation based on specific floor plans, allowing users to redirect signals toward desired areas while minimizing leakage outside the home or into adjacent rooms.
* Increases signal strength by up to 6 decibels in targeted zones and reduces it by as much as 10 decibels in restricted areas.
* Provides a physical layer of privacy that complements digital encryption like WPA2 or WPA3.
* The complete setup is cost-effective, costing approximately $35 to build.
* Increases signal strength by up to 6 decibels in targeted zones and reduces it by as much as 10 decibels in restricted areas.
* Provides a physical layer of privacy that complements digital encryption like WPA2 or WPA3.
* The complete setup is cost-effective, costing approximately $35 to build.
The Kaseya 2026 SaaS Security Report highlights critical vulnerabilities in cloud environments. A major concern is the rise of unmanaged guest accounts which now outnumber licensed users, providing expanded attack surfaces for credential-based attacks. Furthermore, OAuth integrations allow third-party applications to maintain persistent access even after passwords are changed, while low MFA enforcement leaves many accounts vulnerable to phishing and theft. The report also notes that external file sharing creates long-term data exposure risks and attackers increasingly use trusted infrastructure like VPNs to hide their activities from detection.
* Proliferation of unmanaged guest accounts
* Persistent access through OAuth integrations
* Widespread lack of MFA enforcement in SaaS environments
* Ongoing data exposure via orphaned file-sharing links
* Difficulty detecting malicious logins using trusted IP addresses
* Proliferation of unmanaged guest accounts
* Persistent access through OAuth integrations
* Widespread lack of MFA enforcement in SaaS environments
* Ongoing data exposure via orphaned file-sharing links
* Difficulty detecting malicious logins using trusted IP addresses
A study by researchers at the Czech Technical University in Prague reveals that 99.23% of authenticated SSH sessions are non-interactive, involving automated clients that run a single command and disconnect. These sessions are primarily used for rapid reconnaissance, gathering system details like operating system version and uptime. While some scanners test for honeypots using mathematical or file-based checks, the study found no evidence of prompt-injection attacks against LLM-based honeypots.
- Automated scanners use single-command sessions for triage.
- LLM-based honeypots must be able to handle functional checks to remain effective.
- Automated scanners use single-command sessions for triage.
- LLM-based honeypots must be able to handle functional checks to remain effective.
The expiration of Microsoft’s 2011 Secure Boot certificates in 2026 presents potential challenges for Linux users on consumer hardware. While existing installations are unlikely to fail immediately when dates roll over, new distributions or updates may face boot issues unless firmware is updated with the newer 2023 keys. To maintain security and compatibility, users should update their system BIOS/UEFI via vendor tools or fwupd and verify readiness by testing current distribution ISOs on live USB sticks. Disabling Secure Boot entirely to avoid these hurdles is discouraged as it increases vulnerability to rootkits.
>"On many systems, you can use Linux's firmware update stack, fwupd, to handle this from within your distro. To take this step, run the following commands as the root user:"
>
>`fwupdmgr refresh && fwupdmgr get-updates && fwupdmgr update`
>"On many systems, you can use Linux's firmware update stack, fwupd, to handle this from within your distro. To take this step, run the following commands as the root user:"
>
>`fwupdmgr refresh && fwupdmgr get-updates && fwupdmgr update`
A new TechBrief from the Association for Computing Machinery's Technology Policy Council examines the rapid rise of agentic AI systems capable of planning and executing multi-step tasks autonomously. As adoption scales among enterprises and consumers, existing legal, regulatory, and technical frameworks are struggling to keep pace with these autonomous capabilities.
The report highlights several critical policy dimensions:
- Ambiguity in legal liability when an autonomous system causes harm without a clear accountable party.
- Serious security risks arising from the inability of models to distinguish between data and malicious commands.
- A lack of consumer transparency regarding agent permissions, authority, and recourse.
- Workforce disruption concerns where productivity claims have not been independently verified at scale.
The report highlights several critical policy dimensions:
- Ambiguity in legal liability when an autonomous system causes harm without a clear accountable party.
- Serious security risks arising from the inability of models to distinguish between data and malicious commands.
- A lack of consumer transparency regarding agent permissions, authority, and recourse.
- Workforce disruption concerns where productivity claims have not been independently verified at scale.
A researcher has discovered that an SDK embedded in free mobile and smart TV apps by Bright Data allows the company to use consumer devices as residential proxies. These devices relay web-scraping traffic, which is highly valued by the AI industry because it bypasses anti-bot defenses designed to block datacenter IPs. The research highlights how these connections can persist in the background, sometimes even bypassing VPNs on iOS devices.
Key points:
- Bright Data SDK turns consumer electronics into web-scraping exit nodes.
- Residential IP addresses are preferred by AI companies for data harvesting.
- Technical findings show a lack of authentication and potential bypasses of standard security tools/VPNs.
- Opt-in screens may underrepresent the actual bandwidth usage (up to 200GB per month).
- Mitigation involves blocking specific Bright Data domains at the router level using Pi-hole or NextDNS.
Key points:
- Bright Data SDK turns consumer electronics into web-scraping exit nodes.
- Residential IP addresses are preferred by AI companies for data harvesting.
- Technical findings show a lack of authentication and potential bypasses of standard security tools/VPNs.
- Opt-in screens may underrepresent the actual bandwidth usage (up to 200GB per month).
- Mitigation involves blocking specific Bright Data domains at the router level using Pi-hole or NextDNS.
Secluso is an open-source DIY home security camera system built around the Raspberry Pi Zero 2 W. It focuses on privacy by using true end-to-end encryption (E2EE) via Messaging Layer Security (MLS), ensuring that even untrusted relays cannot decrypt video feeds. The system features on-device AI for detecting humans, pets, and vehicles. To enhance security, the core software is written in Rust to prevent memory-related bugs and includes post-quantum encryption to protect data against future threats.
- Raspberry Pi Zero 2W based hardware architecture
- End-to-end encryption using MLS (RFC 9420)
- On-device AI for human, pet, and vehicle detection
- Memory-safe software core written in Rust
- Post-quantum encryption support
- Minimal Yocto-based Secluso OS
- Support for self-hosted relays or official beta services
- Raspberry Pi Zero 2W based hardware architecture
- End-to-end encryption using MLS (RFC 9420)
- On-device AI for human, pet, and vehicle detection
- Memory-safe software core written in Rust
- Post-quantum encryption support
- Minimal Yocto-based Secluso OS
- Support for self-hosted relays or official beta services
