ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Organization

MITRE

2 mentions in 7 days · 7 in 30 days · 7 total · first seen · last

Search everything

Timeline

The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment

Rapid7 analyzes how fraud marketplaces are fragmenting into specialized shops after larger marketplaces were dismantled, aided by new MITRE F3 framework

Rapid7 reports a shift from large known fraud marketplaces to a fragmented environment of smaller specialized storefronts such as Xleet, Blackpass, Infodig, and Styx, operating across dark web channels, Telegram, and P2P options. These Fraud-as-a-Service shops sell stolen accounts, PII, synthetic identity generation, infrastructure, and money laundering support, supporting schemes like business email compromise. MITRE's Fraud Fighting Framework (F3), introduced in early 2026, aims to help security teams prioritize monitoring of fraud TTPs, particularly account takeover techniques. Fraud damages are anticipated to approach hundreds of billions of USD.

Rapid7 Blog · 4d agoPhishing & fraud

Learning Intrusion Response Strategies for OT Systems

Researchers model OT intrusion response as a POMDP and train PPO-based automated response strategies effective against MITRE attacks in an emulated OT system.

The paper formalizes automated intrusion response for OT systems as a partially observable Markov decision process, with partial observability modeled from traffic measurements. Learning-based solution methods built on PPO are developed and evaluated on an emulated OT system. The resulting response strategies proved effective against several types of MITRE attacks for the studied use case.

arXiv cs.CR · 6d agoResearch2

Evidence-Grounded Retrieval for Investigation Hunt Lead Generation from CTI Reports

AHLERT generates environment-aware threat hunting leads from CTI reports using ATT&CK-seeded knowledge graph retrieval, roughly doubling F1 over flat-RAG baselines.

The paper introduces AHLERT, a system that converts Cyber Threat Intelligence reports into structured, investigable hunt leads via hybrid dense retrieval with multi-hop traversal over an MITRE ATT&CK-seeded knowledge graph and ontology-grounded RAG constrained to the defender's assets. It is LLM-agnostic and evaluated on public CTI reports for well-known APTs across proprietary and open-weight models. Hybrid evidence retrieval with ontology grounding raises mean F1 from 0.44 to 0.85, and AHLERT attains the highest effectiveness score (~86.95%) versus off-the-shelf LLMs.

arXiv cs.CR · 7d agoResearch

Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code

Malicious .git core.fsmonitor configs let attacker code run in AI coding agents like Claude Code and Codex; four of eight flaws remain unpatched.

Manifold Security disclosed eight flaws across seven command-line AI coding agents where a repository's Git core.fsmonitor configuration causes agent-spawned commands to execute attacker code outside the sandbox and without approval prompts. Fixes shipped for goose (CVE-2026-72718, CVSS 4.0 score 7.0), Claude Code on one path, and Cursor, while Hermes Agent, Qwen Code, Grok Build, and a second Claude Code path were still unpatched as of September 1. OpenAI issued three CVEs for the same class in Codex, including CVE-2026-19592, and prior related bugs include CVE-2021-43891 in Visual Studio Code and CVE-2022-24346 in JetBrains IDEs. Exploitation requires the repository to arrive with its .git directory intact, such as via archives, shared drives, or USB sticks rather than an ordinary clone.

The Hacker News · 13d agoVulnerabilityCVE-2026-19592CVE-2026-72718CVE-2026-71963+3 CVEs1

CISA review makes the case for eliminating vulnerability classes

CISA's FY2024-2025 vulnerability review urges eliminating recurring vulnerability classes, finding 41.5% of 2025 KEV entries map to persistent 'stubborn weaknesses'.

CISA's Vulnerability Review for fiscal years 2024 and 2025 found most compromises stemmed from opportunistic exploitation of known, exposed vulnerabilities rather than nation-state zero-days or advanced tradecraft. The review found 41.5% of 2025 KEV catalog entries map to 'stubborn weaknesses' - injection flaws, improper input validation, memory-safety failures, path traversal and broken access control - recurring on the CWE Top 25 since 2019. CISA advocates Secure by Design practices, vulnerability class elimination, and buyer-driven 'Secure by Demand' contract requirements, while warning that AI-enabled vulnerability discovery will soon accelerate exploitation.

Help Net Security · 14d agoPolicy & legal

What 90 days and a small budget can buy in AI agent security

Versa Field CISO details hidden costs of self-hosting open-weight models and a 90-day AI agent security plan of inventory, blast-radius reduction and testing.

In a Help Net Security interview, Prasad Tharippala, Field CISO at Versa, argues running open-weight models in-house improves control but shifts hardening, patching, access control, monitoring and incident response onto the buyer, with underestimated costs in GPU infrastructure, licensing review, EU AI Act compliance and scarce AI/ML security skills. On red-teaming AI agents, he recommends testing prompt injection, indirect injection, excessive permissions, data leakage, memory and RAG poisoning, malicious tool outputs, cross-agent trust abuse and infrastructure attack paths, mapped to OWASP agentic guidance and MITRE ATLAS. He highlights the handoff between chained agents as a major risk zone and stresses exercising human approval, shutdown and rollback controls under test conditions. For teams with 90 days and small budgets, he ranks inventory, blast radius reduction and ongoing testing as the priority order.

Help Net Security · 18d agoAI safety & security

The AI Malware Maturity Gap

Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.

Recorded Future proposes AIM3, a five-level model defining AI malware from LLM-translated to LLM-embedded, spanning experimentation to fully autonomous agentic campaigns. Public examples remain early-stage: PROMPTFLUX uses Google Gemini to rewrite its VBScript dropper (Level 1), while Lamehug/PROMPTSTEAL, attributed to APT28, invokes the HuggingFace API to generate reconnaissance commands (Level 3). The authors argue most current AI malware augments existing tradecraft rather than enabling one-click autonomous attacks.

Recorded Future · 20d agoResearch

Related CVEs

  • CVE-2026-719638.6<1%
    Command injection RCE in Hermes Agent via malicious .git/config
    Hermes Agent versions 0.18.2 through 0.21.0 contain an OS command injection flaw (CWE-78) in which the agent's git operations honor the core.fsmonitor setting in a repository's .git/config, letting that setting specify an attacker-controlled command. The attack is triggered when a user opens a crafted repository and sends any message, at which point the agent runs a git status index refresh that executes the injected command in the user's process context. A successful attacker gains arbitrary OS command execution with access to the user's full environment, including configured AI provider API keys, which can be exfiltrated. Anyone running an affected Hermes Agent version who opens untrusted or attacker-supplied repositories is exposed; the attack requires user interaction but no privileges or authentication on the target. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is currently known, and EPSS estimates roughly a 0.9% probability of exploitation within 30 days.
    · Hermes Agent 0.18.2 through 0.21.0 (fixed in commit f6234d0)
  • CVE-2022-243467.8<1%
    In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible.
    In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible.
    · jetbrains intellij idea—
  • CVE-2021-438917.813%
    Visual Studio Code Remote Code Execution Vulnerability
    Visual Studio Code Remote Code Execution Vulnerability
    · microsoft visual studio code—
  • CVE-2026-556077.7<1%
    Claude Code is an agentic coding tool.
    Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such as .zshenv), leading to code execution outside of seatbelt sandbox restrictions. Reliably exploiting this required the user to clone a malicious repository containing prompt injection content and run…
    · anthropic claude code—
  • CVE-2026-195927.3<1%
    Unsandboxed attacker code execution in OpenAI Codex via malicious Git core.fsmonitor
    OpenAI Codex CLI and Codex Desktop automatically collect Git repository metadata without disabling the repository-local core.fsmonitor setting, so Git can execute the filesystem-monitor helper named in a repository's .git/config while Codex gathers that metadata. The flaw is triggered when a user opens or works in a repository prepared by an attacker and delivered with its .git/config intact, such as a copied folder or archive, because an ordinary Git clone does not preserve the source repository's local config. The attacker-supplied helper runs outside Codex's command sandbox and without any user-approval prompt, giving the attacker code execution with the user's privileges, including the ability to read, modify, or delete the user's files and access other resources available to that account. Anyone running Codex CLI on Windows, macOS, or Linux or Codex Desktop on Windows or macOS who opens untrusted repositories is exposed, and related reporting indicates the same malicious .git/config pattern also affects other AI coding agents such as Claude and Cursor, although this CVE is scoped to Codex. No exploitation is currently known: there is no public proof-of-concept, EPSS is a low 0.1%, the issue is not in CISA KEV, and it was disclosed through Pwn2Own as ZDI-26-650.
    · OpenAI Codex CLI (Windows, macOS, and Linux) · OpenAI Codex Desktop (Windows and macOS)large
  • CVE-2026-727187.0<1%
    goose is general-purpose AI agent that runs on your machine.
    goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose `.git/config` sets [`core] fsmonitor = ` causes Git to execute that command on the host during the index refresh performed by `git diff HEAD`. The command runs before goose contacts a model and without a submitted prompt, model call, tool approval, or trust prompt. The context-gathering Git process is not sandboxed and is outside goose's…
    —

Appears with

malware Infostealer 1malware Lamehug 1malware Malterminal 1malware PROMPTFLUX 1ai model Gemini 1organization CERT-UA 1organization CISA 1organization Help Net Security 1organization Nous Research 1organization OWASP 1organization Verizon 1organization Versa 1organization xAI 1product AHLERT 1product Blackpass 1threat actor APT28 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.