Print Infrastructure Is the Biggest Zero Trust Gap CIOs Haven’t Closed, Survey Finds

financialpost.com Oct 8, 2026

Print Infrastructure Is the Biggest Zero Trust Gap CIOs Haven’t Closed, Survey Finds

Curated by Shubham · TechCapsules · Oct 8, 2026

AI-summarised brief · reviewed before publication

Vasion’s latest research, released in St. George, Utah, shows that document and print workflows remain the weakest link in enterprise Zero Trust strategies. The survey of chief information officers and senior IT leaders found 54 percent consider the risk to these workflows “known and accepted,” yet only 16 percent have actually incorporated printing devices into a Zero Trust architecture. Respondents cited legacy hardware, fragmented management tools and limited visibility as barriers to securing print infrastructure. The study also highlighted that most organizations continue to rely on traditional perimeter defenses, leaving printers and multifunction devices exposed to credential theft and data leakage. Vasion warns that the unchecked gap could undermine broader cybersecurity investments. Without remediation, attackers can pivot from printers to network assets.

💡 Why It Matters

· Overlooked printers give hackers a foothold that can quickly expand into a full‑scale network breach.

Capsules Cybersecurity

Read full article on financialpost.com

Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google…

Attackers compromised the .gh, .sl, and .as country‑code top‑level domains, issuing unauthorized HTTPS certificates for several Google and YouTube names. Google’s systems were untouched, but the hijacked domains could allow attackers to impersonate Google sites and intercept encrypted traffic. Chrome immediately blocked the rogue certificates via CRLSets, and Google worked with Let's Encrypt, ZeroSSL, and other CAs to revoke the 12 certificates logged between September 22 and 27. The incident also exposed other global brands, though specifics remain undisclosed.

💡 The breach shows how DNS hijacks can undermine even the most secure sites, revealing that certificate authorities can be tricked into issuing valid keys for compromised domains. It underscores the need for stricter DNS and CAA controls to prevent future exploitation.

thehackernews.com · Oct 7

100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealer

CERT‑UA uncovered over 100 compromised sites that inject malicious JavaScript to deliver LunexStealer, a data‑stealing malware. The attacks, linked to threat cluster UAC‑0277, use forged Cloudflare verification pages to prompt users to run a command that downloads an MSI package via ClickFix. The malware installs a browser extension, LUNARAXE, and a native messaging host, NAIVEMESS, enabling file system access and remote command execution. CERT‑UA recommends restricting MSI execution, blocking vulnerable drivers, and limiting browser extensions.

💡 The campaign demonstrates how attackers blend social engineering with blockchain‑based command retrieval, expanding the attack surface for credential theft and remote control.

amny.com · Oct 7

Data privacy and cybersecurity in the age of AI: Attorney Jean-Marc Appolon…

Attorney Jean‑Marc Appolon, a privacy and cybersecurity specialist at Labaton Keller Sucharow LLP, is leading efforts to safeguard New Yorkers’ personal data amid rising AI‑driven threats. He conducts external audits of corporate data‑handling practices, testing whether publicly stated privacy policies match actual behavior and ensuring compliance with city, state and federal regulations. When violations are uncovered, Appolon initiates litigation to hold companies accountable for illegal or improper use of personally identifying information. He emphasizes the shift from traditional voyeurism to sophisticated internet stalking and mass data exploitation for profit. By combining technical scrutiny with legal action, Appolon aims to reinforce the “wall” protecting residents from data breaches and unauthorized surveillance in an increasingly digital landscape.

💡 Appolon’s proactive legal strategy confronts the expanding scope of AI‑enabled data abuse, forcing companies to align practices with evolving privacy standards before harm reaches consumers.

thehackernews.com · Oct 7

Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and…

Linux backdoors targeting telecom and network appliances in South Korea and Taiwan disguise their traffic as email security tools SpamSniper and ShareTech to evade detection. Rapid7 identified new BPFDoor variants that mimic SpamSniper’s PID file and rotate through ten Linux daemon names, while a separate implant, AVERAT, is delivered via an ELF dropper that encrypts itself with a key derived from “ShareTech.” The malware uses BPF to trigger on HTTPS POST requests, TinyShell for command execution, and SMTP for C2, demonstrating adaptive evasion tactics.

💡 The attackers’ use of legitimate product names and standard telecom protocols shows a sophisticated strategy to bypass both signature‑based and behavioral defenses, raising the threat level for critical infrastructure operators in the region.

tomsguide.com · Oct 6

AI scams are getting scary realistic — 4 red flags to watch…

AI‑generated scams are becoming indistinguishable from legitimate communications, prompting a surge in fraud losses. The FBI reports Americans lost $893 million to AI‑driven scams in 2025, and experts warn the figure could rise as deep‑fake voice, text and image tools improve. Scammers exploit urgency (“RIGHT NOW”), impersonate courts, government agencies or loved ones, and craft emails that mimic official account alerts. Victims are urged to verify requests through trusted channels, such as calling the courthouse directly or using known contact numbers, rather than responding to the unsolicited message. The article outlines four red flags—pressuring urgency, false authority claims, realistic account‑related emails, and deceptive personalization—to help consumers spot and avoid these increasingly sophisticated attacks.

💡 As AI lowers the barrier to produce convincing fraud, everyday users face a heightened risk of losing money and personal data, turning what was once a niche crime into a mainstream threat.

helpnetsecurity.com · Oct 6

Cybersecurity jobs available right now: October 6, 2026

Help Net Security published a roundup of open cybersecurity positions on October 6, 2026, highlighting nine roles across government, corporate and regulatory bodies in the United States, Canada and Ireland. The list includes an Associate Identity and Access Management Engineer in New York City supporting Microsoft Entra ID, a Computer Network Defense Analyst at the NSA protecting national‑security systems, and a Cybersecurity Engagement & Policy Specialist for Ireland’s Commission for Communications Regulation who will shape policy and run stakeholder workshops. Corporate openings feature a Cybersecurity Engineer at Reyes Holdings, a Cybersecurity Technology Architect IV at Astreya focused on AI‑driven architectures, and a Cyber Security Developer at BMO (now closed). Postings cover senior analyst, engineering and policy positions, all requiring on‑site or hybrid work arrangements.

💡 The breadth of roles underscores a tightening talent gap as governments and enterprises race to embed advanced security and AI controls across critical infrastructure.