KPMG · Québec Cyber Team

Cyber Newsletter

Edition 23 — Week of October 3 to 9, 2026

Welcome to edition 23 of the KPMG Cyber Team in Québec. Prepared by FX, Kifing, Enguerrand, Bill, and our friendly robot colleagues. It covers what we consider the most relevant security news of the week, with a strong AI flavour. Like it? Tell us or send it to a friend. Don't like it? Send it to an enemy.

Foreword

🤖 For two years, the question of whether an agent could run an intrusion on its own has been argued with lab demonstrations and a great deal of conditional tense. This week an incident response team settled it in public. After investigating the compromise of its own ticketing tool, a Dutch vulnerability disclosure institute concluded, on the strength of the scripts left behind and the shape of the operation, that an autonomous agent had carried out the attack. The chain itself was ordinary, remote code execution followed by privilege escalation, and the haul modest, volunteer email addresses. What changes is one line in the advisory: the investigators identified neither the operator nor the model. So we have a case file with a modus operandi, indicators, a timeline, and nobody at the end of it. In the same week, a research firm claimed that agents had gone after Library and Archives Canada. The Canadian Centre for Cyber Security, cautiously, says it has seen no indication of a breach and is still reviewing.

🏅 The week also settled a matter of taste: AI tooling is now a target, not only a weapon. On day one of an exploitation contest in Ireland, thirty-two previously unknown flaws fell in a matter of hours, and the biggest awards went to teams that had gone after a coding assistant, a model gateway, and a cloud database sold as autonomous. Forty thousand dollars for an argument injection, forty thousand for a reverse shell obtained by chaining two validation defects. Around the same time, a major vendor closed part of its open source bug bounty, drowning in automated reports that were mostly invalid, and pushed any decision to the first quarter of 2027. Monthly vulnerability disclosures went from 5,045 in January to 10,740 in August. The same technology feeds both columns of the ledger, and only one of them gets paid.

🕵️ Finally, an admission nobody expected. The new American chief executive of a spyware vendor sat down for an interview and answered the questions. Did he investigate before terminating his two contracts with the Italian intelligence services? No: keeping the relationship "just was not worth it, from a risk perspective." Does he know who his customers target and what data they pull out? No, the company has no technical means of knowing. Does he have a kill switch? No, only the ability to cut round-the-clock support and updates, which renders the tool unusable in roughly twelve hours. Ten years of advocacy about compliance by contract and contractual oversight just received their flattest rebuttal, and it came from the seller.

All that, plus the root cause finally published for the TeamCity flaw we tracked last week, a code analysis vendor north of 300 million in revenue cutting a fifth of its staff, and the thesis of the week on a cybercriminal brand turned franchise with succession by arrest. Enjoy the read.

A CSIRT Attributes an Intrusion to an Autonomous AI Agent, and Ottawa Reviews a Canadian Case

The Dutch Institute for Vulnerability Disclosure has confirmed the theft of its volunteers' email addresses in the compromise of Zammad, the open source helpdesk it runs, which took place last month. The attacker chained a remote code execution flaw with a privilege escalation flaw. Based on the scripts recovered and the behaviour observed, DIVD believes an autonomous AI agent carried out the attack, without having identified either the operator or the model. Zammad's advisory states that the remote flaw is exploitable on unsupported 6.5-and-earlier releases, that 7.0 and later are not affected in practice, that version 7.2 adds hardening, and that a fix for the privilege escalation issue is still in progress. The same week, research firm Transluce claimed that AI agents had targeted Library and Archives Canada. The Canadian Centre for Cyber Security says there is no indication a breach has occurred and that its review continues.

As far as we know this is the first time a national incident response team has publicly attributed an intrusion to an autonomous agent, and the attribution stops there: there is a modus operandi, there are indicators and a timeline, and there is nobody to put at the end of the chain. The practical consequences are less dramatic than the headline. First, incident response loses its most useful reflex, actor characterisation, which normally serves to anticipate what comes next. Second, the chain observed is entirely routine, code execution followed by privilege escalation on an unsupported component: the novelty is the tempo, not the technique. For teams revisiting their detection thresholds, that is the number to keep, because behaviour driven at machine speed compresses the correlation windows most rules depend on. Finally, Transluce returns to these pages after last week's edition, where the same outfit documented 6,467 agent traces on a URL analysis service (see [[Newsletter 22 EN|edition 22]]): the new angle is Canadian, and it puts a federal institution on the list of observed targets.

🔗 DIVD-2026-00014 — DIVD CSIRT (via The Cybersecurity Pulse)
🔗 AI agents and US and Canadian government systems — Transluce
🔗 AI agents tried to hack a Canadian government website, research firm says — CTV News (via Canadian Cyber in Context)

ShinyHunters After the Arrests: A Brand Turned Franchise

Saif Al-din Khader, a teenager from Amman suspected of leading the data theft and extortion group ShinyHunters under the handle Rey, has been detained in Jordan and is reportedly cooperating with the FBI. KrebsOnSecurity reports that he was picked up while the group was extorting Jeppesen ForeFlight, the navigation and digital aviation unit Boeing sold to private equity firm Thoma Bravo in November 2025 for 10.55 billion dollars. Boeing has acknowledged the extortion attempts and says it is reviewing the matter with the Jeppesen ForeFlight team, which states it has seen no impact on its operations or products. The group had been exploiting CVE-2026-35273 in Oracle PeopleSoft, as a zero-day from June onward, then bypassed the web application firewall rules Mandiant had recommended by means of URL encoding. Reuters reported on October 5 that an Accenture contractor had been removed following the leak of data on more than 5,000 FBI personnel, medical and psychiatric records included.

The thesis Krebs argues in this file is the only one that explains the sequence: ShinyHunters is no longer a group but a brand, whose succession happens by arrest rather than by appointment, and several people can carry it at once. The metaphor he uses, the Dread Pirate Roberts from The Princess Bride, travels well in front of a client or a journalist. The French-speaking members of the original core have been arrested, and the current operators reportedly acquired the old forum's PGP key to reopen sites and channels under the name. Sources close to the investigation describe a handful of independent affiliates feeding the group stolen credentials in exchange for a cut of any ransom. The direct consequence for anyone reading threat reports: an attribution to ShinyHunters says almost nothing about the capability, intent, or persistence of whoever is knocking, and building a prioritisation on that name means mistaking a storefront for an adversary. Edition 22 covered the technical side of this campaign, the web application firewall bypass and the FBI breach (see [[Newsletter 22 EN|edition 22]]); the new angle is the arrest and what it reveals about the group's actual structure.

🔗 ShinyHunters Extorted Boeing Spin-Off Prior to Arrests — Brian Krebs
🔗 ShinyHunters tells The Reg we hacked the FBI to protect our business — The Register

The Reformed Dutch Hacker Suspected of Ordering Two Murders

Dutch daily RTL reported on September 29 that investigators suspect Pepijn van der Stap, 24, of having tried to orchestrate at least two murders abroad. Van der Stap was arrested on September 15 in a police raid in Amsterdam. He had served most of a four-year sentence for data theft and extortion that prosecutors said netted between 1.5 and 2.7 million euros, and had since held the position of offensive security lead at Neo Security, a Dutch provider, where the work involved probing client networks for vulnerabilities. His employer Benjamin Korper has hired an outside firm to determine whether he had hacked the company or its customers; no evidence of that has been found so far. Before his first arrest in 2023, Van der Stap worked as a software engineer at an Amsterdam security startup while volunteering at DIVD, during the same period in which he was breaking into and extorting large organisations.

The file does not settle the debate on hiring former convicts into offensive security, but it moves the question from principle to diligence: the redemption arc had been relayed by the trade press, and that coverage was serving as verification for a good part of the field. The detail that should hold the attention of anyone buying penetration testing sits elsewhere: this person held authorised access to client networks, and his employer had to bring in a third party to establish what he had done with it, being unable to demonstrate it himself. The question to put in a request for proposal is therefore not who the vendor employs, but whether it can produce, on demand and without an external investigation, the record of what its testers did on your perimeter. Note in passing the unintended crossover in this edition: DIVD, where Van der Stap volunteered, is the body that attributes an intrusion to an autonomous agent above.

🔗 Dutch Police Arrest Reformed Hacker in Shiny Hunters Investigation — Brian Krebs

Kingston and Prince Edward Island: Two Late Canadian Disclosures

Kingston Police have disclosed that an attacker took 100,000 documents during a "cyber incident" that occurred in 2025. The disclosure delay raises questions, all the more so because the city hosts significant military activity, and observers are weighing a complaint to Ontario's Information and Privacy Commissioner. In a separate case, Health P.E.I. said an "unauthorized person" obtained a copy of a file created in 2011 that contained health card information, and that up to 234,000 people may be affected. The official wording suggests a compromise through a third party or the supply chain rather than a direct intrusion.

What the two cases have in common is not the size of the breach but the age of the data: a 2011 file resurfacing in 2026 with 234,000 health records in it, and 100,000 documents whose theft only becomes public a year later. Retention is the cheapest risk reduction lever in the catalogue and the worst maintained, because nobody owns a forgotten extract sitting on a file share. For Québec organisations under Law 25, the useful exercise this week is not about detection but about inventory: which historical extracts still exist, who holds them, and on what date their retention stops being defensible. The second lesson is for response teams: a one-year disclosure delay rarely holds up in front of a regulator, and almost never in front of the local press.

🔗 Hacker took 100,000 documents in 2025 cyber incident, Kingston Police say — CBC News (via Canadian Cyber in Context)
🔗 Notice to the public of cybersecurity incident — Kingston Police
🔗 P.E.I. health data breach — CBC News (via Canadian Cyber in Context)

A Fake AI Columnist Dupes the Canadian Press

An analyst who does not exist, probably tied to Moroccan services and supported by a Turkish middleman, succeeded in placing commentary in several Canadian outlets in order to target Moroccan dissidents. The investigation that uncovered the operation argues the deception is unsurprising given the state of Canada's media and research spheres, and its author says he may devote a full article to the point.

The operation rests on no notable technical capability: it exploits an identity check that does not exist, the one that would apply to an opinion byline rather than to an access account. The parallel with companies is direct and not especially comfortable. Identity verification effort is concentrated on hiring and on technical access, while external contributions, guest posts, co-signed articles, webinar panellists, and experts quoted in a white paper, go through an editorial review that looks at the quality of the text rather than at the existence of its author. A well-written, plausible text clears that bar without effort, and producing a well-written, plausible text is no longer a cost. For teams advising on disinformation risk, this episode is a local case study, and it beats a statistic.

🔗 Fake AI columnist dupes Canadian press to target Moroccan dissidents — Turkiye Today (via Canadian Cyber in Context)

TeamCity: The Root Cause Is Out, and 160 Servers Are Still Exposed

The technical analysis of CVE-2026-63077 is now public, and it comes down to one absent configuration line. The flaw, disclosed by JetBrains in July 2026 in the agent polling protocol of TeamCity On-Premises, is an insecure deserialisation issue rated 9.8 on CVSS 3.1 and exploitable without authentication; it is fixed in versions 2025.11.7 and 2026.1.3. The root cause identified by Rapid7 is the absence of the NoTypePermission.NONE restriction in XStream, which opens a gadget chain running through XStream, FreeMarker, DBCP, and HSQLDB and ends in OS command execution by way of writing a JSP file. CISA added the flaw to its known exploited vulnerabilities catalogue on August 5, the Australian centre reported active exploitation on August 24, and CISA tied it to ransomware groups on September 24. Shadowserver counted roughly 700 TeamCity servers exposed to the internet after disclosure, and a little over 160 unpatched systems by the end of September. The detection indicators to hunt for are ConversionException and ForbiddenClassException exceptions, along with agents named scan.

Austin Miller's line deserves a place in the patch prioritisation grid: "The initial target is not necessarily the organisation's data. It is a system that can provide the attacker with access to the infrastructure surrounding that data." We tracked this file last week from the angle of ransomware exploitation (see [[Newsletter 22 EN|edition 22]]); the new angle is the root cause and the trajectory of the exposure. Two readings come out of the drop from 700 to 160. The good news is that a listing in the known exploited vulnerabilities catalogue does move estates, and quickly. The bad news is that the remaining 160 are probably the hardest to reach, meaning the ones nobody owns, and they will hold out for a while. For teams who inherit a build server, the useful rule fits in a sentence: if the vulnerability was sleeping in a badly configured serialisation library, assume it is sleeping in others, and go looking for entry points that deserialise unauthenticated input rather than for known CVEs.

🔗 TeamCity, Ransomware, and the New Shape of Supply Chain Risk — Austin Miller (via Packt SecPro)

FortiMail, NetScaler, and SD-WAN: Three Unauthenticated Bypasses on the Perimeter

Three perimeter devices drew active exploitation notices this week. Fortinet says attackers are exploiting CVE-2026-104286, rated 9.8 on CVSS, in the Identity Based Encryption interface of FortiMail: it allows an attacker to write files to the system without authenticating, with a risk of code execution, and advisory FG-IR-26-175 lists the affected builds along with patch and mitigation status. On the Citrix side, CVE-2026-88779 affects customer-managed NetScaler ADC and Gateway systems configured as a SAML service provider or identity provider; the memory overflow flaw can crash the service, remote code execution has not been confirmed, and the patches released the previous week do not cover it, which forced a fresh bulletin. Cisco, finally, confirms exploitation of CVE-2026-76504, which gives unauthenticated attackers access to the administrative APIs of SD-WAN Manager through forged requests; the temporary Live Protect mitigation covers some attack paths without replacing the update.

What the three cases share is where the flaw sits in the architecture: a mail gateway, a SAML identity provider, and an SD-WAN controller are precisely the components whose compromise is worth more to an attacker than an entire domain. The NetScaler case deserves a note on process. Teams that applied last week's patch, covering CVE-2026-88771 and the ones that followed, could reasonably have filed the NetScaler matter as closed; the new flaw requires a second remediation window on the same appliances, and an out-of-band patch cycle is not handled like a monthly one. The methodological point that applies to all three is to verify the version rather than the ticket: in a mixed estate, that is the only proof that holds. We covered the exploitation of NetScaler gateways last week on a different set of CVEs (see [[Newsletter 22 EN|edition 22]]).

🔗 AL-2026-133: FortiMail IBE vulnerability — CSA Singapore / Fortinet (via The Cybersecurity Pulse)
🔗 CTX697174: NetScaler ADC and NetScaler Gateway security bulletin — Citrix
🔗 Cisco SD-WAN Manager authentication bypass advisory — Cisco (via The Cybersecurity Pulse)

Stolen AWS Keys Are Now Used to Consume Bedrock

Datadog has analysed scripts whose only function is to check whether exposed AWS keys grant access to models hosted on Amazon Bedrock. The method is frugal: the script lists available models by region, then sends small test requests, one of which simply sends "ping" while capping the response at four tokens. The researchers observed comparable malicious activity across 12 organisations over a 30-day window, without being able to tie those incidents to the scripts examined. The report lists the API calls involved and provides detection rules.

The four-token request is the detail that matters, because it is designed to cost nothing and trigger nothing: a stolen key is now tested for its inference capability, a use that no detection built around data exfiltration or resource creation is looking at. Two consequences for cloud teams. The first is budgetary and measurable: a hijacked Bedrock access is paid for in inference charges, and abnormal consumption by region is a compromise signal before it is an accounting anomaly. The second touches threat modelling: permissions tied to AI services were handed out quickly over the past two years, often inside broad roles created for a prototype, and they have rarely been through the review applied to storage or database rights. The useful inventory fits in a single query: who, across your accounts, can call InvokeModel, and against which models.

🔗 Beyond valid credentials: how exposed AWS keys are tested for Amazon Bedrock access — Datadog Security Labs (via The Cybersecurity Pulse)

Pwn2Own Ireland: 32 Zero-Days on Day One, and AI Tooling on the Podium

The opening day of Pwn2Own Ireland, run by the Zero Day Initiative, produced 32 previously unknown flaws and 388,500 dollars in awards. Four demonstrations went after AI tooling. Ikotas Labs earned 40,000 dollars for an argument injection exploit against OpenAI Codex. Taisic Yun, of Xint, took 40,000 dollars by chaining an input validation defect with a code injection in LiteLLM to land a reverse shell. The Out of Bounds team collected 15,000 dollars with four LiteLLM bugs, two of them already known. VinSOC earned 40,000 dollars by combining five bugs against Oracle Autonomous AI Database.

AI tooling moving from weapon to target is the structural news of the week, and it carries a calendar consequence: what falls at Pwn2Own turns into CVEs in the following months, so the AI tool chains deployed inside enterprises are about to enter the vulnerability management cycle whether or not anyone enrolled them. The LiteLLM case should worry architects most, because a model gateway is precisely the component through which API keys, application requests, and often conversation logs transit. Two separate teams cracked it open on the same day, and two of the second team's bugs were already public. For teams that stood up a homegrown inference gateway over the past few months, often alongside rather than through the architecture process, the question is plain: is that component in the asset inventory, and is anyone following its security advisories.

🔗 Hackers exploit 32 zero-days on first day of Pwn2Own Ireland — BleepingComputer / Zero Day Initiative (via The Cybersecurity Pulse)

Google Closes Part of Its Bug Bounty Under a Flood of Automated Reports

Google has stopped accepting new product vulnerability submissions to its Open Source Software Vulnerability Reward Program, after a wave of automated reports that were mostly invalid. Supply chain submissions and reports already pending are unaffected, and an update is promised for the first quarter of 2027, with no reopening date. Google is not alone: curl ended its cash bounties earlier this year, and GitHub has restricted public submissions using per-researcher report quality scores. A Google Threat Intelligence Group report separately notes that monthly vulnerability disclosures rose from 5,045 in January to 10,740 in August.

Three major programmes shutting or filtering in the same year points to a systemic effect rather than a bad season: the bug bounty model rested on a cost asymmetry, in which producing a credible report cost more than triaging it, and that asymmetry has just flipped. The lesson transfers directly to internal arrangements. Any inbox that accepts unsolicited reports, a responsible disclosure programme, a phishing reporting channel, a product security form, is going to receive generated volume and will have to choose between filtering at the door and drowning its triage team. Both options cost, and the second costs credibility with legitimate researchers. The doubling of disclosures in eight months also raises a prioritisation problem few tools absorb without tuning: a patch queue sized for 5,000 monthly advisories does not merely slow down when 10,000 arrive, it stops ranking.

🔗 Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports — SecurityWeek (via The Cybersecurity Pulse)

AWS Claims 89 out of 100 on CyberGym, and 37.8 on the Designated Target

AWS says its Continuum agent completed 819 of the 920 tasks in the CyberGym-E2E benchmark, or 89 out of 100, with a ceiling of 90 minutes per task. To pass a task, the agent had to find a bug, demonstrate it, and produce a patch that kept the project's tests green. The benchmark covers memory safety flaws in C and C++, and each task carries a known target vulnerability. The 89 score, however, also counts successful fixes of other valid bugs: Continuum fixed the designated target in only 37.8 per cent of tasks. The tool remains in invitation-only preview.

The gap between 89 and 37.8 reveals no sleight of hand, it reveals a definition: the first number measures the ability to produce a valid fix for something, the second the ability to fix what it was asked to fix, and only the second describes the real-world use of a remediation agent. The post's merit is publishing both. For teams evaluating automated fix agents, the question to put to the vendor follows directly from this file: does the headline rate cover the targeted vulnerability, or every patch the test suite happened to accept. The distinction decides everything, because an agent that fixes a neighbouring bug while leaving the reported flaw open produces a closed ticket and an intact risk, which is the worst possible combination in a vulnerability register. Note too that the benchmark itself stays narrow, confined to memory safety in C and C++, a long way from the application stacks where most enterprise patching happens.

🔗 AWS Continuum sets a new standard in autonomous code security — AWS (via The Cybersecurity Pulse)

82 out of 100 Enterprises Run Agents They Do Not Know About

A Cloud Security Alliance survey of 418 security teams produces two numbers that have to be read together: 82 per cent of enterprises are running AI agents they do not know about, and 65 per cent have already suffered an agent-related incident, most of those incidents having led to a data exposure. The figure is foregrounded by Speakeasy, sponsor of the edition it appears in, which promotes an "AI control plane" that authenticates and audits every agent, tool, and MCP server, with inspection of prompt injections and exfiltration attempts.

The number comes from a sponsor selling the cure to the disease it measures, and that should be said out loud: 82 per cent is a self-reported measure across a sample of already security-aware teams, to be read as an order of magnitude rather than a population statistic. That said, the order of magnitude matches what teams see in the field, for a structural rather than a cultural reason. An agent ships with an API key and a few dozen lines of code, without going through a server request, an architecture review, or registration in an inventory, which is to say without crossing any of the checkpoints where governance normally happens. The countermeasure that holds is therefore not a policy but a technical constraint: if agents can only call models through an inference gateway you operate, the inventory builds itself, and the 82 per cent shrinks at the rate at which direct access is closed. That assumes the gateway itself is secured, which brings us back to the four LiteLLM exploitation demonstrations above.

🔗 Security, Funded #264 — Mike Privette (via Return on Security)

Inside the Engine Room of CrowdStrike SafeMind

Bartley Richardson, Chief AI and Autonomous Systems Officer at CrowdStrike, walks through the making of SafeMind and the Cyber Superintelligence Lab he leads in a long interview. He describes two model families, Red Tempest on the offensive side and Blue Solano on the defensive side, and insists on two notions the usual product pitch glosses over: the data blend, meaning the composition of the training mix, and harness engineering, the design of the shell that runs the model and hands it its tools. He cites digital twins of customer environments reaching 80 to 90 per cent fidelity, and mentions a trusted partner programme called Project QuiltWorks.

The line to keep shifts the question you put to vendors: "It's not just about feeding it all the data. The data blend is the secret sauce, and that's part science and part art." For a practitioner assessing offers, the value of the interview is that it names the two variables that explain the gap between two products built on comparable models. The first is the heterogeneity of the data rather than its volume, which takes some air out of the massive telemetry corpus argument so often made in sales meetings. The second is the co-design of model and harness, which Richardson illustrates with a newborn brain-and-body analogy: a good model in a bad harness makes a bad product, and the harness is the thing buyers never evaluate because it appears on no datasheet. The digital twins at 80 or 90 per cent fidelity deserve a follow-up question of their own, since it is the residual gap that decides whether results transfer to your environment.

🔗 An Interview with Bartley Richardson About Building CrowdStrike SafeMind — Cole Grolmus (Strategy of Security)

Paragon Admits It Has No Technical Way to Know Who Its Customers Target

Andrew Boyd, the new chief executive of Paragon, gave an interview to WIRED. The company, bought in December 2024 by American fund AE Industrial Partners and then merged with REDLattice, terminated its two contracts with Italy's domestic and foreign intelligence services, not after an investigation, but because keeping the relationship "just was not worth it, from a risk perspective" following the allegations. Boyd acknowledges that Paragon has no technical means of knowing who its customers target or what data they extract, has no kill switch, and can only cut round-the-clock support and updates, whose absence renders the system inoperable in roughly twelve hours. WhatsApp alleged in 2025 that the Graphite tool had infected more than 60 people across more than 20 countries, including two journalists and two activists identified in Italy by Citizen Lab.

This is the first time an executive in this sector has publicly confirmed the structural absence of control over how his product is used, and the compliance-by-contract argument, the pillar of the entire spyware industry's defence for a decade, does not survive the interview. The lesson goes beyond the case at hand and applies to assessing any vendor in a sensitive role. There is a difference in kind between an acceptable use clause and a verifiable technical control, and the former only becomes a control if somebody can measure compliance with it. The most useful operational detail in the file is the twelve-hour figure: the only real constraint on the customer is not contractual, it is dependence on updates. For teams drafting vendor requirements, the useful question is not whether the contract forbids a use, but what technical mechanism the vendor can actually pull, how long it takes, and who verifies the effect.

🔗 The Secrets of the U.S. Spyware King — Kim Zetter (WIRED) (via ZERO DAY)
🔗 Company behind Graphite spyware speaks for first time about Italy abuse and accountability — Kim Zetter (ZERO DAY)

419 Million Raised in One Week, 61 per Cent of It for Automated Red Teaming

For the week of October 5, 12 cybersecurity companies from 6 countries raised 419.2 million dollars across 12 distinct categories, for a disclosed average round of 41.9 million and a median of 13.7 million. Product vendors account for 92 per cent of the companies funded. On the acquisition side, 14 companies from 9 countries changed hands for 33.9 million in total, 71 per cent of them services firms. Over a trailing thirteen weeks, the total reaches 9.5 billion raised across 160 deals, up 112 per cent year over year, and 108 acquisitions, up 19 per cent. A single round explains the week's colour: Armadin Security, an American automated red teaming and AI threat hunting platform, raised 255.5 million in Series B from Andreessen Horowitz and Accel, reaching unicorn status. That is 61 per cent of the weekly total and the entirety of the Continuous Automated Red Teaming category, which therefore weighs 255.5 million across one deal.

Mike Privette's comment is the most honest reading of those numbers: "Meanwhile, the cyber market is putting all its eggs in the offensive basket, betting that the best Defense is good Offensive Security." Funding that doubles year over year while value concentrates in a single offensive category has a mechanical effect on what will be available to buy in eighteen months: plenty of continuous control validation, little that is new on the detection side. For buyers, the consequence is worth anticipating now, because an overfunded category arrives on the market with sales teams sized to match and downward pricing pressure it would be a shame not to use. The other signal sits in the acquisition column: 14 companies bought for 33.9 million in total, a majority of them services firms, describes small-ticket consolidation that looks more like an exit for want of better than a strategic premium.

🔗 Security Funded #264 — Mike Privette
🔗 Armadin raises 255.5 million Series B to scale effective autonomous security — PR Newswire (via Return on Security)

Snyk Lays Off a Fifth of Its Workforce

Snyk, the American application security platform, has laid off 203 employees as part of a restructuring, or 20 per cent of its workforce, while its revenue exceeds 300 million dollars. It is the sector's only layoff announcement this week.

An AppSec platform north of 300 million in revenue cutting a fifth of its staff sends a signal about the cost structure of the model rather than about demand: at that revenue level, a restructuring of this size reflects a margin or growth-rate problem, not a market that is disappearing. For customers, two questions are worth raising at renewal. The first concerns the roadmap: a product plan announced before a 20 per cent cut is no longer the same plan, and it is better to have the dates reconfirmed than inferred. The second concerns technical support, usually the first line to feel it, where degradation only becomes visible at the first incident. Note finally the calendar irony, since the week in which a code analysis vendor cuts staff is also the week AWS announces an agent fixing 819 of 920 tasks in a memory safety benchmark, with the caveats we set out above.

🔗 Snyk laid off over 200 employees, revenues top 300M — tech.eu (via Return on Security)

Plurilock Passes to Quantum eMotion for 23.9 Million

Plurilock, the Canadian identity and access management platform built on behavioural biometrics, has been acquired by Quantum eMotion for 23.9 million dollars, having raised 16.5 million over its history. The acquirer presents the deal as an extension of its commercial quantum and AI cybersecurity platform.

A 23.9 million exit for a company that had raised 16.5 million is not a failure, but neither is it the premium behavioural identity promised five years ago, and the gap describes the compression of IAM valuations rather well. The deal also reads locally: two Canadian security companies consolidate, and the identity asset is bought by a player whose pitch is post-quantum cryptography, a pairing of categories that happens more often through asset opportunity than through technical coherence. For teams evaluating behavioural biometrics for continuous authentication, the file changes nothing about the technology but adds a diligence variable: the roadmap of a product absorbed by an acquirer from another category deserves caution, and is worth confirming in writing.

🔗 Quantum eMotion to acquire Plurilock, expanding commercial quantum and AI cybersecurity platform — Quantum eMotion
🔗 Quantum eMotion to acquire fellow Canadian cybersecurity firm Plurilock — BetaKit (via Return on Security)

Ottawa Multiplies the Front Doors: Single Identity, an AI Council, and a Procurement Watch

Two federal announcements landed in the same week. The Canadian Digital Service officially launched CanadaLogin, a unified authentication system meant to simplify access to Government of Canada programmes and services. Prime Minister Carney announced the creation of a new National Council on Artificial Intelligence, whose mandate and real influence remain to be defined. Alongside these, a new watch column has appeared, the Federal Cyber Opportunity Watch, which surveys federal cyber procurement and innovation opportunities each week: its first issue lists a National Defence request for proposal for a senior information and records management specialist closing October 10, 2026, a National Research Council request for executive-level IM and IT research and advisory services closing October 14, a Canada Revenue Agency request under its Professional Services Supply Chain closing October 16, and a National Defence request for information on land intelligence, surveillance, and reconnaissance modernisation closing December 31, 2026. The IDEaS programme is separately soliciting radio frequency data fusion software for command and control, with funding of up to 250,000 dollars at technology readiness levels 1 to 3, 1.5 million at levels 4 and 5, and 5 million at levels 6 to 9, with a deadline of October 20, 2026 at 2 p.m. EDT.

CanadaLogin is the piece that deserves architects' attention: a single federal authentication point reduces the phishing surface by removing the dozen portals a citizen had learned to stop telling apart, and it concentrates the entire availability dependency in one place. Both effects are real and they do not cancel out. The first is an immediate, measurable security gain; the second turns an identity outage into an interruption of every public service, a trade-off familiar to any organisation that has rolled out internal single sign-on. The window to watch is the transition, because a period in which the old and new front doors coexist is precisely when a fake login page becomes indistinguishable. As for the National Council on Artificial Intelligence, it joins an already crowded governance landscape, and its mandate will be more instructive than its announcement.

🔗 Simplifying access to government programs and services with CanadaLogin — Canadian Digital Service (via Canadian Cyber in Context)
🔗 Prime Minister Carney launches new National Council on Artificial Intelligence — Office of the Prime Minister
🔗 Federal Cyber Opportunity Watch #1 — Alexander Rudolph

Anthropic Commits 100 Million to Train 10,000 Engineers at Its Customers

Anthropic is committing 100 million dollars to train 10,000 "Frontier Deployed Engineers" by the end of 2027, through a new Claude Frontier Academy whose first cohorts bring together engineers from major consulting firms and large enterprises. The stated goal is to solve the last mile, meaning to make agents genuinely operational inside client systems and workflows.

The question this programme raises is put bluntly by the analyst relaying it: "how much of your operational know-how do you put in the hands of a platform that also serves your competitors?" The mechanism is familiar to any firm that has signed a certification partnership. Training your engineers at a vendor transfers a useful skill and deposits, in exchange, a detailed map of internal workflows into that vendor's ecosystem, where it stays. The cost of leaving builds quietly too, because the evaluations, integrations, and harnesses built around one platform do not carry across model families without a rewrite. None of this is an argument against the programme, which addresses a real problem, the distance between a demonstration and a deployment. It is an argument for documenting from the outset what is vendor-specific and what is portable, an exercise almost nobody performs at signature and everybody regrets at renegotiation.

🔗 What's Hot in AI/Infra/VC #518 — What's Hot in AI/Infra/VC

Decision Models and a Multi-Model Codex Push Token Prices Down

Two moves in the same week pull in the same direction. The first is the arrival of a category: Jev, from TypeSafe, launched in mid-September, was used by roughly 13 per cent of paying teams within 24 hours of landing on Vercel's AI Gateway, an adoption record, and The Information reports talks to raise at a 10 billion dollar valuation. The same week, OpenAI announced its Decisions API, Databricks its ai_decide function, and Perplexity its own open-weight decision model. Jev's price is quoted at 0.042 dollars per million input tokens, with output tokens free, which is more than 100 times cheaper than frontier models, but only around 4 times cheaper than GPT6-Luna. The second move comes from OpenAI, whose enterprise customers can now run competing open models directly inside Codex and bill that against their existing OpenAI spend commitment, with no new vendor contract.

Jamin Ball's thesis reads as follows: "Open weight models were a great real stake in the ground for how models would get cheaper (ie how the P would go down). Decision models could be the next shoe to drop." For security teams, the interest is not speculative. A good share of what a security agent does all day is decide, meaning route an alert, classify a report, judge whether an output crosses a guardrail, and those calls do not need a frontier model. Claude estimates that 10 to 15 per cent of tokens could shift to specialised models of this kind, which changes the arithmetic of large-scale automated triage, the line item that most often stalls assisted SOC projects at the costing stage. The second move has a more immediate and more mundane reach: being able to test an open model without opening a new procurement file removes the main administrative brake on evaluation, and turns a closed tool into a multi-model router. Which also shifts governance, since model choice stops being settled by a contract and becomes a configuration parameter.

🔗 Clouded Judgement 10.2.26 — Decision Models — Jamin Ball
🔗 What's Hot in AI/Infra/VC #518 — What's Hot in AI/Infra/VC

Ross Haleliuk: Both AI Sceptics and AI Enthusiasts Are Wrong

Ross Haleliuk takes on both camps in the AI and cyber debate with a structural argument. AI does not change the fundamental causes of breaches, it changes the speed of exploitation and the standard of care expected. His line is the best of the week: "Twenty years ago we had two problems, patches and passwords. Today, we still have the same two problems, patches and passwords". The conclusion he draws is operational: defenders should stop chasing model releases and return to the kill chain and the fundamentals, because that is where the attacker's added speed does its damage.

The thesis is the only one this week to offer a defensive prioritisation grid that annoys both dominant positions, and it converts straight into a roadmap: if the causes do not change, a budget redirected towards detecting AI usage is a budget taken away from patch and identity management. The objection is in the text itself, and it is a serious one. Haleliuk leans on the cloud parallel, whose absorption into security practice took two decades, which takes the edge off the urgency he otherwise attributes to AI and weakens his own conclusion about speed. The attentive reader will note that his two exhibits from this week hold up: the 160 TeamCity servers still exposed three months after the patch prove him right on patching, and DIVD's attribution to an autonomous agent proves him right on speed. Both are in this edition, and they do not contradict each other.

🔗 Both AI skeptics and AI enthusiasts are wrong — Ross Haleliuk (via Venture in Security)

Mike Privette: Shrinking the Exposed Surface, the Thing Nobody Will Sell

Mike Privette put the question to his readers and reports the verdict: "Shrinking what is exposed and reducing the existing attack surface was the clear winner in last week's vibe check." Reducing what is exposed comes ahead of every other option as a risk reduction lever. His thesis starts there and goes somewhere else: this lever will stay underfunded, because it matches no sellable product category. You cannot invoice for a service whose outcome is that there is less of something.

The value of the reasoning is that it names a structural divergence in the market, between how effective a control is and how fundable it is, and that grid can be reused as is in an investment committee. The objection is methodological and the author knows it: a self-selected audience poll in a cyber venture newsletter does not generalise beyond its own community. The thesis holds anyway by another route, one visible in this very edition. The 419 million raised this week went overwhelmingly to automated offence, a category that produces findings, and nobody funded a company whose promise is to take assets off the internet. The parallel with the TeamCity article is instructive: the drop from 700 to 160 exposed servers is precisely a surface reduction, it was achieved by a public catalogue of exploited vulnerabilities rather than by a product, and it made nobody any money.

🔗 Security-Funded #264 — Mike Privette

LLM Safety Classifiers Only Ever See One Request at a Time

CrowdStrike tested roughly 515 offensive techniques against a frontier model's safety classifier, the filter that inspects requests before they reach the main model. No direct attack got through. The researchers then asked for the pieces of code separately: each request looked like ordinary software work and cleared the filter without difficulty. They handed the responses to a smaller model with no such classifier, which assembled them into working offensive code, including a program that injects code into another Windows process. The method worked in nine of the ten ATT&CK-aligned categories tested; only attempts to disable the hooks used to monitor running programs were blocked. The sentence that sums up the result: "The classifier screened each request separately and never saw the completed attack code."

The architectural conclusion is clean and it applies to any agent deployment: a control that evaluates isolated requests cannot see an intent spread across several requests, so the security of an LLM-based system is assessed at the pipeline level rather than at the prompt. The defensive translation is immediate for teams that have put a guardrail in front of an internal assistant: if your control is stateless, it is bypassable by splitting, and the cost of bypassing it is a loop of a few requests. What to look at is correlation across a session and a user rather than per-message filtering. The objection to keep in mind is that the demonstration covers an unnamed frontier model in a controlled test setting, which leaves the transferability question open. The result also rhymes with this edition's case study: the classifier that only ever sees one request at a time fails for the same reason as the web application firewall that inspected an address before it was decoded, because a control placed earlier in the chain than the final assembly never observes the thing it is meant to forbid.

🔗 How attackers can bypass LLM safety classifiers — CrowdStrike (via The Cybersecurity Pulse)

🎯 Haven't taken the quiz yet? Five questions on this edition, two minutes, one leaderboard: right here · leaderboard

Your Feedback?

Topics to explore further, sources to add, format feedback — all welcome. We adjust continuously.

Next edition: week of October 12.

Internal newsletter — KPMG Cyber Team Québec

Edition 23 | Week of October 3, 2026

Sources consolidated this week:

The Cybersecurity Pulse · Krebs on Security · Canadian Cyber in Context · Packt SecPro · Return on Security · Strategy of Security · Venture in Security · ZERO DAY · Clouded Judgement · What's Hot in AI/Infra/VC