📝 Show notes
CyberAware Daily — 2026-09-27
- Weekly recap for Sunday 27 September 2026
- DarkWatch this week: 51,283 captures, 15,614 entities, 2,017 alerts, 14 active targets
- A new dark web leak site came online this week. We explain why that is usually less dramatic than it sounds
- Lunex Stealer: how malware abuses an AMD graphics driver to switch off security monitoring and steal browser credentials
- Oracle PeopleSoft: attackers bypassing web application firewalls to deploy web shells. Who is actually affected
- Zero Trust for AI agents: why visibility has to come before security
- Next week: a plain English explainer on web shells, and a practical guide to moving your passwords out of your browser
- This week's action: move your saved passwords into a proper password manager
More at https://cyberawareuk.co.uk
📄 Full transcript
It is Sunday, the 27th of September, and this is CyberAware UK.
I am Bully, and as always I am joined by Alex.
Today we are doing our weekly recap, so let us start with the numbers from Darkwatch.
That is right. This week Darkwatch captured 51,283 records,
and those mentions linked back to 15,614 different entities.
That is a lot of noise, but it is also a lot of signal.
Out of all of that, 2017 alerts were raised, and there are 14 active targets right now.
14 is a small number compared to the 51,000 captures, and that tells you something important.
What does it tell us?
It tells us that most of what flows through the dark web is recycled, copied, and reposted.
The genuinely fresh, genuinely dangerous stuff is a tiny slice of the pie.
That is why we do the triage, and that is why you do not need to panic about the big number.
And one of those fresh items Darkwatch flagged was a new leak site that came online this week.
We are not going to read the address out, obviously.
It is just described as an active dark web leak site,
and the top-level page was nothing more than a directory index.
Which is quite common in the early days of a leak site.
Someone stands up the infrastructure, then they either fill it with data or, more often, they never do.
A lot of these sites are advertising rather than evidence.
So what should a normal household take from a leak site being live?
Two things.
First, if you are not a customer of whatever company gets named, it does not change your Sunday.
Second, if you are, the company will contact you.
You do not need to go looking for the site, and you should never click a link to it that someone sends you.
Let us move on to the headlines themselves, because there were three that stood out this week.
The first one is a piece of malware called Lunex Steeler, and this is a bit more interesting than the usual.
It abuses an AMD graphics driver to switch off security monitoring on the machine.
That is worth unpacking, because the driver is a legitimate, signed piece of software.
It is supposed to be trusted.
So the malware is hiding inside something that is meant to be safe?
Essentially yes.
The bad code uses the driver to do things the operating system would normally block,
and once the security tools are blinded it goes after browser credentials.
Saved passwords, sessions, the lot.
Who is actually at risk here?
Is this something that hits a family laptop?
It is targeting Windows machines, and it usually arrives the same way most of these things do.
A crack, a pirated game, a fake installer, or a dodgy download from an advert.
If you are not doing that, your risk is low.
And the AMD driver bit sounds scary, but it is not AMD's fault, is it?
No, and that is an important point.
The driver is being misused.
There is no patch that fixes user behavior.
What fixes it is not downloading cracked software and keeping your browser passwords in a proper password manager,
not in the browser itself.
The second headline is about Oracle PeopleSoft.
Attackers are bypassing web application firewalls to exploit a floor and drop web shells.
That sounds technical, but the plain English version is this.
A web application firewall is a filter that sits in front of a website.
The researchers found a way around that filter for this particular product.
Who is affected?
Not my mum, presumably.
Correct.
This is enterprise software.
It affects organizations running Oracle PeopleSoft, typically larger employers, universities, and public bodies.
If you work somewhere that uses it, this is a conversation for your IT team, not your kitchen table.
The takeaway for a listener is probably just awareness if their employer mentions it.
Exactly.
If your employer or your university sends a note about PeopleSoft this week, read it.
That is the whole action.
The third headline is slightly different in tone, and it is about AI agents and zero visibility.
This one is more of a forward-looking piece.
It argues that as companies hand tasks to AI agents, nobody really knows what those agents are doing, or what they have access to.
And that is the same problem we have had with every wave of automation.
You cannot secure what you cannot see.
The article's point is that before you bolt on security for AI agents, you first have to fix the fact that you have no visibility at all.
Does that touch a normal household yet?
Not directly today, but it will.
Think about the smart assistants and the AI features being added to your email, your banking app, your shopping.
The permission model behind those is exactly what this article is about.
Keep an eye on it, no action needed today.
Let us do the week in numbers, then.
14 active targets, over 2,000 alerts, and a brand new leak site, with nothing on the front page.
And one more number that I think matters more than all of them.
51,000 captures, and the overwhelming majority were repeats.
That is the story of the week.
The dark web is noisy and repetitive, and the genuinely new threats are few.
What is coming next week?
We are going to do a proper explainer on what a web shell is and why companies care so much about them,
plus a practical piece on how to move your saved passwords out of your browser and into a password manager.
That one is genuinely useful for everybody listening.
And the takeaway for today.
It is the same one that fits almost every week.
Your saved passwords are the prize.
If a piece of software gets onto your machine, that is the first thing it goes for.
So this week, open your browser settings, look at how many passwords are sitting there,
and start moving them into a proper password manager.
One afternoon, and you have taken the main prize off the table.