Making sure the checks get printed

Cisco Talos' latest Threat Source newsletter opens with a personal essay from new contributor Pierre Cadieux about balancing patching with operational risk, tying into Cybersecurity Awareness Month. The main research item, from Talos' CAIRN project, reveals that malware authors are increasingly inserting natural-language text into their code specifically to mislead AI-assisted malware analysis — a technique Talos now categorizes as "A3: AI-Analysis Evasion." Tracked over 18 months, these tricks range from basic comments telling an AI to disregard a file to sophisticated "template spraying" aimed at specific large language models; Talos found such prompt injections sway an AI's verdict in the attacker's favor roughly 35% of the time, and some A3 families, like MANTLEMAZE, combine this with vulnerable-driver abuse to kill EDR at the kernel level. The issue is significant because any text pulled from a malware sample must be treated strictly as evidence rather than as a trusted instruction within automated detection pipelines, and defenders can use the presence of imperative language aimed at analysis tools as a reliable red flag. The roundup also covers other news, including new Citrix NetScaler zero-day reports (CVE-2026-88779), a breach exposing 8 million Danish citizens' records, Google pausing parts of its open-source bug bounty program, Warlock ransomware hitting Spanish and Portuguese organizations, and the US Senate passing a healthcare cybersecurity bill following the Change Healthcare breach.