Fal.Con 2026 commentary argues AI accelerates vulnerability discovery and exploitation, making evidence-based exposure validation essential for defender prioritization.
CSO Online reports on the exposure-validation theme at CrowdStrike's Fal.Con 2026 conference, where CEO George Kurtz described AI as the new cyber battlefield and emphasized AI red teaming and continuous security. The piece argues that as AI speeds up vulnerability discovery and exploitability analysis on both sides, teams must determine which exposures are actually exploitable in their environments—chained weaknesses, credential abuse, lateral movement, privilege escalation—rather than chasing theoretical risk. It points readers to Horizon3's conference perspective.
Editorial scorecard ranks 2026 cloud workload protection platforms, placing Prisma Cloud first, Sysdig second, and CrowdStrike third on detection quality.
A research-based scorecard rates ten cloud workload protection (CWPP) platforms across runtime depth, container/Kubernetes support, coverage breadth, cloud context, and value. Palo Alto Prisma Cloud leads at 8.9, followed by Sysdig at 8.8 and CrowdStrike at 8.6, with Aqua Security tying CrowdStrike at 8.6. The piece argues agent-versus-agentless is a false choice, with leaders now pairing agentless visibility with eBPF-based runtime sensors. Scores are editorial assessments, not lab benchmarks.
Researcher Chaotic Eclipse released FalconFlank, a PoC zero-day privilege escalation exploit against CrowdStrike Falcon's Microsoft Office macro removal feature.
Security researcher Chaotic Eclipse (also known as Nightmare Eclipse) published FalconFlank, a proof-of-concept zero-day exploit for a privilege escalation flaw in CrowdStrike Falcon Sensor. It abuses the Microsoft Office file malicious macro removal remediation feature, which runs with high privileges, and works on fully updated Windows 11 25H2 and Windows Server 2025 with Falcon Phase 3 Optimal Protection. CrowdStrike says it is investigating and advises customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy. The same researcher recently released zero-day PoCs against Kaspersky Endpoint Security (HardBreacher) and Avast Antivirus (PrettyPrague), the latter dumping the SAM database for a SYSTEM shell.
CrowdStrike links previously unseen Slim Spider group to crypto custody secret theft at Brazilian financial institutions since March 2026.
CrowdStrike is tracking Slim Spider, a previously undocumented financially motivated group attacking Brazilian financial institutions since at least March 2026. The actor used custom Bash scripts to steal temporary cloud credentials, exfiltrated digital asset custody secrets, and used Foundry's cast tool to derive Ethereum wallet addresses, while deploying Go-based backdoor MikeDor and an implant impersonating Brazil's SPI instant payment infrastructure. Slim Spider also pivoted to Azure DevOps and Kubernetes clusters and used panels including NEXUS // Scanner, Painel de Emails Entra ID, and Painel Pix for reconnaissance and unauthorized Pix transfers. Separately, Google Threat Intelligence Group and Mandiant disclosed Breeze Comet (CL-CRI-1163), a Portuguese-speaking group since 2024 that breaches Brazilian payment infrastructure to run fraudulent Pix, Boleto, and STR transactions.
Google and Mandiant attribute vishing-based SaaS data extortion attacks to UNC6671, now operating under the Redact, Pink, Helix, and Falcon brands.
Google Threat Intelligence Group and Mandiant track extortion group UNC6671, which uses vishing calls impersonating IT help desks to lure employees to adversary-in-the-middle phishing pages that capture credentials, MFA tokens, and session tokens. The group then registers adversary-controlled MFA devices, pivots through identity providers into Microsoft 365, Okta, and other SaaS applications, and runs automated Python and PowerShell exfiltration scripts. UNC6671 has rotated through extortion brands including BlackFile, Redact, Pink, Helix, and Falcon, and Google tracked over $10.6 million in Bitcoin payments between January 7 and May 12, 2026, with initial demands exceeding $3 million. The actor has hit dozens of organizations in North America, Australia, and the UK, shifting toward high-value financial and legal firms in July 2026.
Horizon3's Fal.Con 2026 recap argues AI-accelerated vulnerability discovery makes continuous attacker-based exposure validation essential for defenders.
In a Fal.Con 2026 recap, Horizon3 argues that AI is compressing the time between vulnerability discovery and exploitation, making attacker-derived evidence about real exploitability the key prioritization signal. Horizon3 announced it joined CrowdStrike's Project QuiltWorks, with NodeZero exploitability intelligence flowing into Falcon Next-Gen SIEM and Falcon Fusion SOAR workflows able to trigger NodeZero 1-Click Verify for remediation testing. The company reported running over 1,200 NodeZero demos during the show, and CrowdStrike CEO George Kurtz's keynote framed AI red teaming and offense-informing-defense as central themes.
Elastic compares SIEM data egress cost, latency, and fidelity across CrowdStrike, Microsoft, Google, and Splunk, arguing vendors engineer lock-in.
Elastic Security Labs published an opinion piece comparing how major SIEM and security vendors handle data egress, based on each vendor's public documentation as of September 2026. It rates CrowdStrike Falcon Data Replicator and Palo Alto Networks XSIAM Event Forwarding as restricted (paid add-ons with batch delays), Microsoft as partially open, Splunk as open, and Elastic as open with no export license. The piece argues frictionless ingestion paired with licensed or delayed egress is an intentional lock-in business model, and cites CrowdStrike's 2026 Global Threat Report eCrime breakout time of 29 minutes to argue real-time telemetry access is now essential.
US and European authorities, with CrowdStrike and Shadowserver, disrupted the 20-year-old Sality peer-to-peer botnet, severing 15,000+ infected machines from operators.
US and European authorities disrupted the Sality botnet, active since at least 2003, in an operation involving the DOJ, CrowdStrike, the Shadowserver Foundation and agencies in Bulgaria, Hungary and Romania. Researchers reverse-engineered the botnet's peer-to-peer architecture and injected false data into infected machines' 'super peer' lists, cutting more than 15,000 systems off from their operators. For the past eight years Sality primarily distributed EggJagger, malware that replaces clipboard cryptocurrency addresses and is estimated to have netted the operator at least $150,000. No arrests were announced, and CrowdStrike assesses the operator works from Russia's Bashkortostan region.
Law enforcement, CrowdStrike, and Shadowserver sinkholed the 23-year-old Sality P2P botnet, cutting 15,000+ infected machines from its operator.
Sality, active since 2003 as a file-infecting virus with two P2P networks (versions 3 and 4), distributed credential thieves, spam, proxies, and DDoS payloads, and most recently delivered the EggJagger clipboard hijacker that swapped cryptocurrency wallet addresses for at least $150,000 in operator profit. A coordinated sinkhole operation replaced the botnet's super-peer list with defender-controlled sinkholes, and investigators in the US, Bulgaria, Hungary, and Romania seized payload domains. The Shadowserver Foundation is coordinating ISP and CERT notifications to infected device owners.
Law enforcement and CrowdStrike disrupted the 23-year-old Sality P2P botnet, isolating 15,000+ infected machines and seizing linked domains.
International law enforcement, working with CrowdStrike and the Shadowserver Foundation, executed a peer-to-peer sinkhole operation against Sality, a botnet active since 2003 that delivered malware to more than 15,000 machines worldwide. Sality's primary payload for eight years was EggJagger, a clipboard hijacker that swaps copied bitcoin and ethereum wallet addresses with attacker-controlled ones, yielding at least $150,000 in stolen cryptocurrency. The US Justice Department, FBI, and DoD Office of Inspector General's Defense Criminal Investigative Service seized Sality-linked domains, with parallel action in Bulgaria, Hungary, and Romania. The Shadowserver Foundation is coordinating with ISPs and CSIRTs to identify infections and notify victims.
GreyNoise expanded its CrowdStrike Falcon integration with Next-Gen SIEM dashboards, correlation rules, and Charlotte Agentic SOAR playbooks.
GreyNoise announced an expanded integration with the CrowdStrike Falcon platform, adding purpose-built content for Falcon Next-Gen SIEM and Charlotte Agentic SOAR. The integration includes a dedicated SIEM dashboard, correlation rules that detect allowed inbound traffic from malicious infrastructure, and SOAR playbooks that inject GreyNoise threat context into automated response workflows.
OpenAI, Anthropic, Google, Microsoft, AWS and 100+ organizations sign open letter urging a 'global surge' in AI-powered cyber defenses.
More than 100 companies including OpenAI, Anthropic, Google, Microsoft, AWS, Capital One, Mastercard, CrowdStrike, Palo Alto Networks and Proofpoint signed an open letter published Thursday calling for accelerated cybersecurity defenses as AI capabilities advance. The letter argues a shrinking 'defenders' window' exists to fix accumulated weaknesses such as excessive permissions, misconfigurations and unpatched legacy systems before AI-enabled attacks grow more widespread. It asks governments to coordinate cross-border defense and fund protection of critical infrastructure, and asks frontier AI labs to provide model access, funding and support. It references a June US executive order creating the Gold Eagle AI threat-sharing clearinghouse.
Unit 42 details active exploitation of Exchange SSRF flaws CVE-2022-41080/CVE-2022-41082 via the OWASSRF method, deploying the SilverArrow PowerShell backdoor.
Unit 42 documents OWASSRF, an exploit chain combining CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution on Microsoft Exchange via Outlook Web Access, bypassing Microsoft's ProxyNotShell mitigations. Active exploitation was observed in late November and early December 2022, affecting at least eight organizations. Attackers authenticated to Exchange, then executed a PowerShell backdoor tracked as SilverArrow to create admin accounts, install AnyDesk, tunnel RDP via PuTTY Link, and dump LSASS memory for credential theft. Exploitation is isolated rather than mass-scale because authentication is required.
Microsoft's August 2026 Patch Tuesday fixes 400+ vulnerabilities, including an actively exploited Windows zero-day (CVE-2026-68820) used by North Korean attackers.
Microsoft's August 2026 Patch Tuesday fixes over 400 vulnerabilities, including CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver exploited in the wild by North Korean actors deploying a kernel-mode rootkit in Operation Dream Job. Critical unauthenticated remote code execution flaws in Microsoft QUIC (CVE-2026-62815) and Windows DNS (CVE-2026-62878) were also patched, alongside a SharePoint RCE chain combining CVE-2026-63520 with CVE-2026-55040. Researcher Nightmare-Eclipse released ShieldBreak, a PoC bypassing the July RoguePlanet Microsoft Defender patch (CVE-2026-50656), confirmed working by Will Dormann on Windows 11.
Security researchers hired three suspected North Korean IT workers at a fake DeFi startup, documenting forged IDs, AI-edited images and post-hire system access.
Researchers from BCA LTD, NorthScan and ANY.RUN built a fake DeFi protocol called Ballena Azul and hired three suspected Famous Chollima operatives through a real recruiting pipeline. The hires submitted inconsistent or AI-processed identity documents, including a driver's license whose metadata showed Google Gemini processing and a SynthID watermark. On day one the workers profiled their assigned VMs, checked their egress country, and one installed Chrome Remote Desktop and logged into GitHub. The findings were presented at DEF CON 34 and align with a July 31 joint government alert on DPRK IT worker schemes.
Authentication Bypass in Microsoft SharePoint Server
Microsoft SharePoint Server is affected by a weak authentication vulnerability (CWE-1390) that allows an unauthorized attacker to bypass a security feature over a network. Per the CVSS vector, exploitation requires no privileges and no user interaction with low attack complexity, so any unauthenticated attacker with network access to a vulnerable server can trigger it remotely. Impact to confidentiality and integrity is rated high (CVSS 9.1, critical), meaning the bypass effectively grants the attacker access that authentication should have prevented, with no direct availability impact. All organizations running on-premises Microsoft SharePoint Server are potentially affected; the source data does not specify affected version ranges or fixed builds, so defenders should consult Microsoft's advisory for those details. The flaw is under active exploitation: a public proof-of-concept is available on GitHub, attackers began exploiting it after the PoC went public, and CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-18 (EPSS ~40%, 99th percentile; ransomware association unknown).
Server-Side Request Forgery in Microsoft Exchange Server (ProxyNotShell)
CVE-2022-41040 is a server-side request forgery (SSRF, CWE-918) vulnerability in Microsoft Exchange Server, publicly tracked under the name "ProxyNotShell" together with CVE-2022-41082. It is triggered when an attacker sends crafted HTTP requests to exposed Exchange web endpoints (such as Autodiscover), causing the server to issue attacker-influenced requests to itself. On its own the SSRF coerces authenticated server-side requests, but when chained with the CVE-2022-41082 remote code execution flaw it gives the attacker code execution on the Exchange server, typically followed by web shells, data access, and — in observed campaigns — ransomware deployment. Organizations running on-premises Microsoft Exchange Server are affected; the source data lists only Microsoft Exchange Server and does not specify affected version ranges, and hosted Exchange Online is a separate product not listed here. The vulnerability is being actively exploited in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-09-30 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days; no public PoC is listed.
· Microsoft Exchange Server KEV ransomware PoC mass
Microsoft Exchange Server Privilege Escalation Exploited in Ransomware Campaigns
CVE-2022-41080 is an elevation-of-privilege flaw in Microsoft Exchange Server that stems from improper handling of requests to the server's Autodiscover component, allowing an attacker with any valid authenticated mailbox account to escalate privileges on the server. It is triggered by sending crafted authenticated HTTP requests to the Autodiscover endpoint, and it lets attackers bypass the URL-rewrite mitigations defenders had deployed against the earlier ProxyNotShell SSRF. When chained with the related PowerShell remote-code-execution bug CVE-2022-41082, privilege escalation becomes full remote code execution on the Exchange server. Any organization running on-premises Exchange Server with the Autodiscover component reachable — especially internet-exposed OWA/Autodiscover endpoints — is affected. The flaw is actively exploited: it was added to CISA's KEV catalog on 2023-01-10, is known to be used by ransomware operators, and has been tied to the Play ransomware gang, including the attack that took Rackspace's hosted Exchange environment offline.
Authenticated RCE in Microsoft Exchange Server (ProxyNotShell)
CVE-2022-41082, dubbed "ProxyNotShell," is an authenticated remote code execution vulnerability in Microsoft Exchange Server; the associated CWE-502 indicates deserialization of untrusted data. It is exploited in a chain with CVE-2022-41040, a server-side request forgery in Exchange that lets an unauthenticated attacker reach the vulnerable endpoint via crafted web requests and trigger the remote code execution. Successful exploitation gives an attacker the ability to run code on the Exchange server, and CISA notes known ransomware use. Any organization running an on-premises Microsoft Exchange Server deployment is potentially affected, with the specific version ranges per Microsoft's advisory. The flaw is actively exploited in the wild: it was added to CISA KEV on 2022-09-30 with ransomware use known, and EPSS assigns a 100% probability of exploitation within 30 days, even though no public proof-of-concept is known.
· Microsoft Exchange Server KEV ransomware PoC mass
Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
CVE-2026-68820 is a use-after-free (CWE-416) in the Windows Ancillary Function Driver for WinSock (afd.sys), the kernel component that handles Winsock socket operations. A local, authenticated attacker can trigger the memory corruption through crafted socket activity, and the high attack-complexity score (AV:L/AC:H/PR:L) indicates exploitation requires a specific, likely race-sensitive sequence of operations. Successful exploitation elevates privileges to SYSTEM, giving the attacker full control of the host, and public reporting describes deployment of a backdoor after privilege escalation. Virtually every Windows 10, Windows 11, and Windows Server (2012-2022) installation ships this driver, so the affected population is essentially the entire supported Windows installed base. The flaw is being exploited in the wild: CISA added it to the KEV on 2026-08-11, Microsoft fixed it in the August 2026 Patch Tuesday release, and reporting ties active exploitation to North Korea's Lazarus group, who paired the zero-day with fake job-offer lures.
· Microsoft Windows Ancillary Function Driver for WinSock (afd.sys) as shipped with the Windows versions listed below · Microsoft Windows 10 1607, 1809, 21H2, 22H2 KEVmass
Use-after-free RCE in Microsoft MsQuic via crafted network packets
A use-after-free (CWE-416) in Microsoft's QUIC implementation (MsQuic) allows an unauthenticated remote attacker to execute code on an affected host. The flaw arises because creating and removing new network paths in response to incoming packets can invalidate a pointer that is subsequently used. An attacker needs only to send a specially crafted packet to a service speaking QUIC, with no authentication or user interaction required; the maximum CVSS 4.0 score of 10 (critical) reflects full system-compromise potential. Any deployment of the MsQuic library is affected, including services built on Microsoft's in-box QUIC support (e.g., HTTP/3 and SMB over QUIC) and applications consuming the public NuGet package, though exact affected version ranges are not specified in the available data. Exploitation has not been observed: there is no public proof-of-concept, the issue is not in CISA's KEV, and EPSS puts the 30-day exploitation probability at about 1 percent, but a fix ('Guard path promotion', commit e0f55b5) is already available.
· Microsoft MsQuic (Microsoft QUIC library; distributed via NuGet) · Microsoft Services and applications using MsQuic (e.g., HTTP/3, SMB over QUIC, .NET System.Net.Quic)mass
Unauthenticated RCE in Microsoft SharePoint Server
CVE-2026-63520 is an improper input validation flaw (CWE-20) in Microsoft Office SharePoint, affecting on-premises SharePoint Server deployments. A remote, unauthenticated attacker can trigger the flaw by sending improperly validated input to the SharePoint service over the network; the high attack complexity (AC:H) indicates exploitation depends on specific conditions, but no privileges or user interaction are required. Successful exploitation results in arbitrary code execution on the server, with high impact to confidentiality, integrity, and availability — effectively full compromise of the SharePoint host. Organizations running self-hosted SharePoint Server are in scope; SharePoint Online/Microsoft 365 is not listed in the affected products. The issue is patched as of Microsoft's Patch Tuesday (headlines mark it FIXED), with Rapid7 analysis and a researcher-disclosed exploit chain available, but there is no public PoC, no CISA KEV listing, and no confirmed in-the-wild exploitation; EPSS puts exploitation probability at 2.9% (86th percentile).
· Microsoft SharePoint Server (Office SharePoint, on-premises)mass
Local Privilege Escalation via Link Following in Windows User Profile Service
CVE-2026-62832 is a local privilege escalation flaw (CWE-59, improper link resolution, or 'link following') in the Windows User Profile Service. An attacker who already holds a limited local account on an affected machine can cause the service to follow a symbolic link or junction before it validates file access, so the service performs file operations with elevated rights. Successful exploitation grants elevated privileges on the local system — typically up to administrator/SYSTEM level — with no user interaction required. Affected platforms include Windows 10 21H2 and 22H2, Windows 11 23H2 through 26H1, and Windows Server 2022 and 2025, which together span essentially the entire supported Windows estate. As of this analysis there is no public proof-of-concept, no CISA KEV listing, and no confirmed in-the-wild exploitation of this specific flaw; EPSS estimates a 3.3% (88th percentile) chance of exploitation within 30 days, although Microsoft's August 2026 Patch Tuesday fixed 400+ vulnerabilities and a separate zero-day (CVE-2026-68820) is under active attack.
· microsoft Windows 10 21H2 · microsoft Windows 10 22H2mass
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".
Local Tampering via Link-Following Flaw in Windows 11 26H1 Container Isolation Driver
CVE-2026-72971 is a link-following flaw (CWE-59) in the Windows Container Isolation FS Filter Driver (unionfs.sys) on Windows 11 26H1: the driver performs file access without fully verifying that the path is not redirected through a symbolic link or junction. A local attacker who already holds low-privilege access (CVSS AV:L/PR:L, no user interaction required) can plant a malicious link at a location the driver processes, causing it to follow the link and act on an attacker-chosen target. The attacker gains tampering capability, which the CVSS scores as High integrity impact with no confidentiality or availability impact, meaning they can modify or overwrite files their account could not normally change. Any Windows 11 26H1 system is in scope per the CVE data, with the highest practical risk on shared or multi-user hosts and machines using container isolation features where unionfs.sys is active. No active exploitation is known: the CVE is not in CISA KEV, no public proof-of-concept exists, and EPSS puts 30-day exploitation probability at about 0.5%; the related news shows Microsoft's August 2026 Patch Tuesday shipped 400+ fixes, and defenders should confirm their devices received the unionfs.sys patch.
· microsoft Windows 11 26H1 (Container Isolation FS Filter Driver, unionfs.sys)mass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.