Four things stood out to me in the security news this September:

• Does AI pose an existential risk? The news has been filled with calls for regulation and slowing development. Is this a legitimate concern or hyperbole?
• Passkey pressure. Passwords and traditional MFA are reaching the end of the road, and users are being pushed toward newer authentication standards.
• Security at the edge. The devices and systems we trust to lock the front door are increasingly becoming targets themselves.
• Is surveillance becoming visible enough for people to care? With the constant drumbeat of data breaches and privacy concerns, Flock cameras may have finally struck a nerve.

Here’s what happened, why it matters and what to do.

1. Is AI an existential threat?

September headlines were filled with discussion about the possible existential risks of AI, with one Anthropic whistleblower claiming there is a 10% chance AI could kill off humanity, while President Donald Trump has dismissed the risks as a hoax.

Two of the most frequently discussed concerns are Recursive Self-Improvement and Alignment.

With Recursive Self-Improvement, the concern is that AI systems could eventually become capable of improving themselves at a rate humans cannot understand or control.

Alignment is the challenge of ensuring that increasingly capable AI systems act consistently with human values and intended outcomes rather than taking actions we did not anticipate or becoming tools for misuse.

A good discussion of these risks can be found here and here.

This month’s news was also filled with examples of unpredictable or destructive AI activity, including:

• Attacking government websites LINK
• Deleting code LINK
• Unauthorized disclosure of data LINK
• Taking over Wiki sites LINK

What do I need to do?
Stay educated and focus on the risks you can control. Within your organization, do you know where AI is being used and what access those systems have? Do you have a way to quickly disable AI tools, revoke their access, or otherwise contain them as part of your Incident Response plan?

2. Passkey pressure

It may feel like you are suddenly being prompted to set up new authentication methods by Amazon, Microsoft, and other services. There is a major push to move users away from weaker authentication methods such as passwords and SMS text messages toward more secure standards such as passkeys.

• On September 1, 2026, passkeys became the default in Microsoft 365, and users enabled for SMS or voice began receiving prompts to register a passkey.
• On February 1, 2027, Microsoft-provided SMS and voice MFA authentication is scheduled to end for standard users. Users with no other MFA method will be required to register another authentication method at sign-in.
• Organizations should not assume they can simply continue using SMS indefinitely.
• Without a password manager or another passkey synchronization method, users may have difficulty accessing accounts from multiple devices.
• Amazon and other platforms are taking similar steps by encouraging users to adopt passkeys.
• While passkeys represent a significant security improvement over passwords, they are not without challenges. They introduce an entirely new authentication workflow for many people and can still become part of social engineering attacks.

What do I need to do?
Organizations need to start preparing users for this transition. If you use Microsoft 365, this may directly affect employees who still rely on SMS text messages for MFA.

Password managers can also help staff securely manage and synchronize passkeys across authorized devices.

3. Security at the edge

There is an alarming trend with the systems we put at the front door increasingly becoming the way attackers get in.

This month, vulnerabilities or attacks affected Citrix NetScaler, WatchGuard firewalls, Check Point firewalls, Kiteworks, D-Link devices, MikroTik routers, and a PeopleSoft environment where attackers were able to circumvent a Web Application Firewall.

• ShinyHunters reportedly stole FBI employee data as well as information involving other U.S. government employees. If federal agencies with significant security resources can be compromised, private businesses should not assume their own defenses are sufficient.
• CrowdStrike and Microsoft Defender, software designed to protect endpoints, have themselves disclosed vulnerabilities that could potentially be used as attack vectors.
• Kiteworks, a secure file storage and sharing platform, advised all customers to take affected systems offline while it addressed a critical security vulnerability.
• Citrix NetScaler, described as a modern application delivery and security platform, became a major target for attackers. The incident also raised questions about the risks associated with legacy code embedded within modern infrastructure.

What do I need to do?
If you use any affected software or systems, verify that they are fully patched.

If your organization uses NetScaler and was exposed to the affected vulnerabilities, should assume you’ve been compromised and initiate your IR plans.

An effective defense-in-depth security strategy includes multiple layers of protection. That becomes particularly important when the systems designed to protect us become attack vectors themselves.

Understanding what data you have, where it resides, and what risk it poses is equally important. Controls such as conditional access, segmentation, monitoring, and strong identity protections can limit the impact even when another security layer fails. The FBI could have benefited from this approach.

4. Surveillance and privacy

Most of us have seen news surrounding Flock cameras and concerns about privacy and potential abuse.

For years, many consumers have been willing to trade some privacy for the convenience of free or inexpensive services. The debate over Flock cameras appears to have struck a different nerve, perhaps because it’s about an American symbol of freedom and privacy, the automobile!

Other privacy stories this month included:

• LG smart TVs reportedly logging audio while the screen was off and collecting information about devices on the local network. LINK
• A Pentagon data breach involving military personnel and raising national security concerns. LINK
• “We Hacked the FBI”: hackers claiming to have data involving FBI employees. LINK
• Florida confirming a DMV database breach involving a stolen police account. LINK
• IDScan confirming a breach involving 153 million driver’s-license records. LINK
• Eight other high-profile breaches involving medical and personal data, as well as two Massachusetts towns. LINK

Patching This Month
Notable disclosures this month included critical patches affecting TeamViewer, OpenSSL, CrowdStrike, HP, Apple, Google Chrome, and Microsoft, with Microsoft alone addressing more than 900 vulnerabilities, including two zero-days.

The fundamental work of keeping systems patched and secure continues to get harder.

Organizations need automated patching wherever possible, visibility into systems that fall behind, and a process for quickly prioritizing vulnerabilities that pose the greatest risk.

What do I need to do? For clients using our security and management tools, supported computers should already be receiving updates. Users should install updates promptly and avoid postponing or dismissing update prompts.

Updates can also be manually installed using the resources below:

• Apple: https://support.apple.com/en-us/108382
• Microsoft Windows: https://support.microsoft.com/en-us/windows/update-windows-3c5ae7fc-9fb6-9af1-1984-b5e0412c556a
• Google Chrome: https://support.google.com/chrome/answer/95414
• TeamViewer: https://www.teamviewer.com/en-us/resources/trust-center/security-bulletins/tv-2026-1010/
• HP Aruba: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05134en_us&docLocale=en_US
• CrowdStrike: Requires support credentials https://supportportal.crowdstrike.com/s/login/?ec=302&startURL=%2Fs%2Farticle%2FTech-Alert-FalconFlank-Research

Quick Tip: Want to know all the connections your computer is making? Sniffnet is a tool for Windows and Little Snitch is a tool for Macs, to see all those connections.

Full sourcing: September Security Alert Sources