ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “exploitability”

196 items

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 11383Exploit / PoC 7875Ransomware 5757Malware 4599Data breach 2530Threat actor 2007Policy & legal 1472Phishing & fraud 1322Industry 456Advisory 373AI safety & security 300Research 196Tools 74AI tools & infra 63
SeverityAllcritical 21529high 9004medium 5894low 1579info 512

Why The Vulnerability Backlog Is About To Get Worse

Recorded Future analysis says AI-driven vulnerability discovery and faster weaponization will grow the triage backlog while shrinking defenders' response windows.

Disclosed vulnerabilities rose from roughly 21,000 in 2021 to nearly 50,000 in 2025, while Recorded Future assessed only 446 as actively exploited in 2025. VulnCheck found nearly 29% of 2025 KEV entries were exploited on or before CVE publication. The authors argue AI-assisted discovery and automated exploit development will multiply credible reports, cut disclosure-to-exploit time toward minutes, and force re-evaluation of medium-severity flaws as exploit-chain components.

Recorded Future · 21d agoResearch

What Zero-Day Response Should Be in the Post-Mythos Era

Picus Security outlines a zero-day response playbook where defenders simulate exploit technique chains before public PoCs exist.

The article uses PaperCut NG/MF's August incident — exploitation in the wild before any patch, with the first emergency fix bypassed the same day and a third landing September 1 — as the template for AI-accelerated vulnerability response. It walks through a hypothetical CVE-2026-1001 (explicitly made up) to argue defenders should map CVEs to ATT&CK technique chains and simulate them against NGFW, WAF, EDR, endpoint hardening, and SIEM controls within minutes of disclosure. It notes disclosure-to-exploitation time has fallen from 21.5 days to hours.

BleepingComputer · 1d agoResearch in the wildCVE-2026-1001

Understanding Angler Exploit Kit

Unit 42 explains exploit kit fundamentals, describing how landing pages profile victims, deliver exploits, and install malware payloads on Windows hosts.

Unit 42 published a primer on exploit kit fundamentals, defining vulnerabilities, exploits, malware payloads, actors, and campaigns in EK-based attacks. It explains the infection chain: a landing page profiles the victim's Windows system for vulnerable applications such as Flash Player, Java, Silverlight, and Internet Explorer, then a matching exploit executes a downloader or final payload, often delivered encrypted with XOR or RC4. The post also describes the EK-as-a-Service business model, in which leading EKs are rented for a few thousand dollars per month while buyers supply campaign infrastructure.

Palo Alto Unit 42 · Aug 17, 2026Research1

$536 and 8 Hours: AI Learns to Attack a Different PLC

Forescout used Claude to port a WAGO PLC exploit for $536 in 8 hours, and an AI-generated payload later permanently bricked the test device.

Forescout researchers used Claude Code with Ghidra, terminal access, and physical hardware to port CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server, from a WAGO 750-852 PLC to the WAGO 750-831 without source code or debugger access. The final RCE development stage cost $535.74 in API fees over an 8-hour, 32-minute session (2.6k input and 1.3M output tokens) and required heavy researcher guidance. Claude produced working ICMP and UDP beacon exploits in 12 minutes after identifying that normal FTP command completion was overwriting its shellcode, fixed by omitting the CRLF terminator. A follow-up session extending the payloads toward a C2 implant wrote to flash-mapped memory and permanently bricked the PLC, underscoring the risks of autonomous agents operating against physical infrastructure.

Security Affairs · 14d agoResearchCVE-2021-318861

Researchers Use Claude to Port Pre-Auth RCE Exploit From One PLC Model to Another

Forescout used Anthropic's Claude to port a working pre-auth RCE exploit for CVE-2021-31886 between WAGO PLCs, executing ARM shellcode on live hardware.

Forescout Vedere Labs used Claude interactively to port an RCE exploit for CVE-2021-31886, a CVSS 9.8 stack buffer overflow in the Nucleus FTP server's USER command, from a WAGO 750-852 to a WAGO 750-831 PLC, running attacker-supplied ARM shellcode. The final RCE stage cost $535.74 in API usage over 8 hours 32 minutes, and a follow-up attempt to build a C2 implant permanently bricked the device. CERT@VDE lists many Nucleus V1-based WAGO models as vulnerable with no updates available; Siemens plans no Nucleus NET remediation. The work follows a joint NSA/CISA/FBI/DOE/EPA advisory warning of AI-generated exploitation scripts targeting internet-exposed Siemens S7 PLCs.

The Hacker News · 14d agoResearchCVE-2021-318862

Linux Detection Engineering - Local Privilege Escalation

Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.

Elastic Security Labs describes how most Linux local privilege escalations share a common host flow — an unprivileged process launched from a writable path becoming root — and proposes layered detections combining general outcome-based rules with per-technique rules in Elastic Defend and Auditd. It tracks 13 recent LPE disclosures, seven of which share a copy-on-write/zero-copy bug class, including Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, DirtyClone, pedit COW, and RefluXFS. Qualys attributes RefluXFS to an LLM-assisted research effort with Anthropic using Claude Mythos Preview, and another bug is credited to an LLM-assisted workflow. Detection and endpoint rules are published in Elastic's detection-rules and protections-artifacts repositories.

Elastic Security Labs · 5d agoResearch

Understanding Angler Exploit Kit

Unit 42 examines Angler EK operations, including rapid zero-day adoption, fileless Bedep infections, and ransomware payloads like TeslaCrypt and CryptXXX.

Unit 42 published the second part of its Angler EK analysis, covering the kit's history since 2013, its SaaS rental model, and its focus on Flash, Internet Explorer, and Silverlight exploits. Angler integrated the CVE-2015-5119 Flash zero-day from the Hacking Team leak within hours and later added exploits for CVE-2015-2419 and CVE-2016-0034 roughly a month after Microsoft patched them. Campaigns use Angler to deliver ransomware such as CryptoWall, TeslaCrypt, and CryptXXX, plus banking trojans and stealers via EITest. Since August 2014, Angler has used fileless, in-memory execution, most often for Bedep, which later downloads CryptXXX and click-fraud malware.

Palo Alto Unit 42 · Aug 17, 2026Research in the wildCVE-2015-5119CVE-2015-2419CVE-2016-0034

Forgery of C2PA on a Pixel 10

Researcher forged a Google Pixel 10 C2PA content credential with genuine signatures, showing root-level attackers can fake photo provenance.

A Hacker Factor blog post demonstrates an AI-generated 'unicorn glitter milk' news photo carrying a valid, cryptographically signed C2PA manifest traceable to Google's Pixel camera certificate chain, passing validation in Adobe Inspect and the CAI Verify tool with a verified timestamp. The author, working with UMBC's PASAWG working group, reported to Google and C2PA in November 2025 that root access on a Pixel device could sign arbitrary images as camera captures; after 90 days without resolution, details were published. The finding undermines C2PA Assurance Level 2 claims made for Pixel 10 Content Credentials.

Lobsters · security · 4h agoResearch

VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities

Introduces VEX-Bench, 75 expert-labeled real-world cases testing whether LLM agents can assess supply chain vulnerability exploitability; frontier models reach about 80% F1.

VEX-Bench is the first benchmark evaluating LLM agents on assessing whether upstream dependency vulnerabilities are exploitable in downstream projects, with 75 real-world expert-labeled cases across Python, Java, and Go mined from GitHub. Nine models across three agent harnesses were evaluated; GPT-5.5 and Claude Opus 4.6 reach approximately 80% F1 on binary vulnerability-status classification, but only GPT-5.5 surpasses 70% macro-F1 on fine-grained justification classification. The gap highlights the difficulty of moving beyond binary exploitability calls to explaining exploitability reasons, unlike prior benchmarks targeting zero-day settings.

arXiv cs.CR · 8d agoResearch1

AI AppSec tools agree on just 5% of security findings

Contrast Security report finds 42 confirmed exploit attempts per application monthly and three AI scanners agreeing on only 5% of findings.

Contrast Security's AppSec Overflow 2026 report, drawing on telemetry from hundreds of thousands of production applications and APIs, found adversaries touch the average application every four minutes with 42 confirmed viable exploit attempts per application monthly, led by untrusted deserialization, path traversal, and method tampering. Legacy flaws Log4Shell and Spring4Shell remain widespread, mean time to exploit fell from over two years in 2018 to under three weeks for most 2025 exploited vulnerabilities, and average critical fix time is 92 days. Three AI scanners set on the same codebase agreed on only 5% of findings, and triaging a 2-million-line codebase scan cost roughly $128,000 versus $315 in API charges. Among exploited CVEs in the dataset, 82% of KEV-listed entries carried EPSS scores of 90% or higher, while CVE-2006-1547 and CVE-2023-38180 were confirmed exploited despite EPSS scores under 25%.

Help Net Security · 16d agoResearch in the wildCVE-2006-1547CVE-2023-381801

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News · 26d agoResearch2

8,539 Reasons To Rethink How Vulnerabilities Get Patched

Rapid7 counted 8,539 high and critical CVEs in Q2 2026, double last year, with PoC availability up 76%.

Rapid7's Q2 2026 Threat Landscape Report tallied 8,539 high- and critical-severity vulnerability disclosures, twice the number recorded in Q2 2025, with newly disclosed flaws having public proof-of-concept code up 76% year over year. Of newly exploited vulnerabilities, 62% were network-exploitable and required neither authentication nor user interaction. Fake CAPTCHA and ClickFix social engineering accounted for 31.8% of incident response cases, the United States recorded 881 listed ransomware victims, and APT28 exploited SOHO routers for DNS hijacking while Iranian groups targeted US industrial control and OT systems.

Help Net Security · 27d agoResearch

Attack Paths Into VMs in the Cloud

Unit 42 maps attack paths into AWS, Azure, and GCP VMs through intended features like startup scripts and SSH key pushes.

Palo Alto Unit 42 reviewed attack vectors against virtual machine services on AWS, Azure, and GCP, finding that 11% of internet-exposed cloud hosts carry Critical or High severity vulnerabilities. The attack paths rely on legitimate features such as EC2 User Data, VM custom data, EC2 Instance Connect, SSM Run Command, and serial consoles rather than vulnerabilities, and exploiting them requires attackers to first obtain control plane permissions. A compromised VM exposes not only its data but the workload identity and cloud permissions assigned to it, making identity compromise potentially more damaging than data theft. The firm places mitigation responsibility on cloud users and administrators.

Palo Alto Unit 42 · Aug 17, 2026Research1

Time Exploit Plummets Nday Flaws

Analysis shows time-to-exploit for n-day vulnerabilities has plummeted, shrinking defender patch windows as known flaws are exploited faster.

Infosecurity Magazine reports on analysis finding that the time between a vulnerability's disclosure and its exploitation in the wild has dropped sharply for n-day flaws. Faster exploitation compresses defenders' patching windows and raises the urgency of rapid patch deployment. The specific flaw families and metrics were not detailed in the available information.

Infosecurity Magazine · 28d agoResearch in the wild

1Password's AI patching benchmark is misleading

Trail of Bits reanalysis says 1Password's 26% AI clean-fix rate is misleading; 86% of eligible patches blocked exploits.

Trail of Bits critiques 1Password's FLAWED AI patching benchmark, arguing its 26% clean-fix headline mixes trials where agents were instructed to apply wrong fixes (22% of data) with trials that prohibited compiling or testing (36%). Restricting to reasonable conditions, 2,634 of 3,067 patches (86%) blocked the supplied exploit. Trail of Bits also reports 12.5% of 2,265 developer first fixes failed in its own 2024-2026 assessments, and released post-patch-validation and review-walkthrough agent skills.

Lobsters · security · 21h agoResearch

GPUThor: Amplifying Rowhammer Attacks via Non-Uniform Patterns to Exploit ECC-Protected GPUs

GPUThor uses non-uniform hammering to amplify Rowhammer on NVIDIA GPUs, achieving 500X-23,500X more bit flips and first exploits of ECC-protected GPUs.

GPUThor is a Rowhammer attack on NVIDIA GPUs that reverse-engineers memory-access coalescing behavior to enable non-uniform hammering patterns activating aggressor rows more intensely than decoy rows. By identifying refresh instances where in-DRAM mitigations apply, it constructs longer patterns that escape mitigation across refresh intervals. It yields 500X to 23,500X more bit flips than prior GPU Rowhammer attacks across NVIDIA A4000, A4500, A5000, and A6000 GPUs, and enables the first Rowhammer exploits on ECC-protected GPUs via uncorrectable double and triple bit flips, making denial-of-service and privilege-escalation attacks practical.

arXiv cs.CR · 1d agoResearch

The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

Unit 42 demonstrates that root access on a Kubernetes node lets attackers spoof SPIFFE/SPIRE attestation and harvest co-located workloads' SVIDs.

Palo Alto Networks Unit 42 describes post-exploitation techniques in which an attacker with root on a compromised Kubernetes node spoofs Linux cgroup metadata used by the SPIRE agent during workload attestation, tricking it into issuing a co-located workload's SPIFFE Verifiable Identity Document to an attacker-controlled process. The research shows the core trust assumption of machine-identity systems—that the node is trusted—collapses once root is obtained, exposing all cryptographic identities scoped to that node. Unit 42 released an open-source tool, Spooffe, for defenders to test identity exposure, and notes the technique has not been observed exploited in the wild.

Palo Alto Unit 42 · 6d agoResearch1

Exploits and vulnerabilities in Q2 2026

Kaspersky's Q2 2026 report tallies vulnerability, exploit, and C2 framework statistics, adding first-ever data on open-source AI framework flaws.

Kaspersky Securelist released its quarterly report on vulnerabilities, exploits, and C2 frameworks for Q2 2026. The report aggregates statistics on vulnerability disclosures and exploit activity for the quarter. For the first time, it also aggregates data on vulnerabilities in open-source AI agents and AI frameworks, extending coverage into the AI software supply chain.

Kaspersky Securelist · 21d agoResearch

Risky Bulletin: Expired cards can be used for new transactions

Researchers show expired Visa contactless cards can be revived via NFC man-in-the-middle relay to run fraudulent transactions; roundup also covers major breaches.

University of Massachusetts Amherst researchers built an NFC man-in-the-middle rig that updates a card's expiration date in transit and relays the modified payment to POS terminals, reviving expired contactless cards; Visa terminals and the backends of all five banks studied failed to catch the manipulation. The same roundup reports Iranian hackers shut down a small UK power plant for four days, Lazarus breached South Korea's Presidential Office as part of a campaign exceeding 100 victims, and French telecom SFR suffered a breach affecting over 2.1 million customers.

Risky Business News · 23d agoResearch1

Your Shredded Visa Card May Still Work at the Checkout

UMass Amherst researchers demonstrated expired Visa contactless cards can complete real purchases via relay attacks exploiting Visa Kernel 3's unsigned expiry date handling.

University of Massachusetts Amherst researchers presented at USENIX Security 2026 that expired Visa contactless cards can be revived for real purchases through an NFC man-in-the-middle attack on Visa's Kernel 3. The attack alters the expiry date the terminal sees (tag 5F24) while leaving the Track 2 Equivalent Data (tag 57) sent to the issuing bank unchanged, and the card's cryptographic signature does not cover the expiry date. Two Android phones emulating card and terminal relayed transactions within Visa's 500-millisecond limit. Mastercard, American Express, and Discover kernels blocked the attack, while Visa Kernel 3 did not; researchers also modified the Consumer Device Cardholder Verification Method flag at five US banks, and attackers can also exploit Terminal Verification Results zero-filling. Visa was notified in May 2025 and December 2025; no CVE has been assigned.

Security Affairs · 25d agoResearch

Risks in IoT Supply Chain

Unit 42 analyzes multilayer IoT supply chain risks across hardware, firmware, and software, citing counterfeit Cisco switches and OpenWrt attacks.

Unit 42 examines weaknesses in the IoT supply chain ecosystem across hardware, firmware, operation, and vulnerability layers, noting that 89% of IT decision-makers reported IoT device growth and IDC forecast 41.6 billion connected IoT devices by 2025. Examples include counterfeit Cisco Catalyst 2960-X switches with possible backdoor access (F-Secure, July 2020), a March 2020 OpenWrt flaw enabling malicious update impersonation, and threat actor interest in TeamViewer remote support software. The report stresses that untracked third-party components and missing device inventories make it hard to assess vulnerability impact across vendors.

Palo Alto Unit 42 · 28d agoResearch

Securing the unpatchable in an age of AI-driven vulnerabilities

Cisco Talos argues AI-driven vulnerability discovery leaves unpatchable OT systems exposed, recommending virtual patching via NGFW/IPS and micro-segmentation.

AI-assisted code analysis is uncovering vulnerabilities faster than organizations can patch, leaving certified or end-of-life OT systems with unmitigated known flaws. Talos recommends virtual patching with next-generation firewalls and IPS, micro-segmentation using VLANs and ACLs, and building visibility-based inventories of legacy systems. The article cites WannaCry's impact on the NHS and 2023 exploitation of end-of-life software in government systems, and warns that air gaps and data diodes are routinely circumvented by operational shortcuts.

Cisco Talos · 7h agoResearch

New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access

University of Toronto researchers present GPUThor, a Rowhammer attack that defeats ECC on NVIDIA RTX A4000-A6000 GDDR6 GPUs and achieves host root access.

GPUThor uses non-uniform hammering to bypass Target Row Refresh and overcome SECDED ECC on NVIDIA Ampere workstation GPUs with GDDR6 memory, inducing 72,000 to 377,552 bit flips per gigabyte across RTX A6000, A5000, A4500, and A4000 cards. Triple-bit silent data corruption enables host privilege escalation to root with the IOMMU enabled, reusing GPUBreach page-table corruption techniques, and double-bit DUEs allow escalation when the IOMMU is disabled during a ~10 ms lazy-service window. The attack cut end-to-end escalation time on the A6000 from 21.9 hours to 1.1 minutes. Reported to NVIDIA, Google, Microsoft, and AWS on April 29, 2026; findings were embargoed until August 25, 2026, and no CVE identifier was assigned.

The Hacker News · 8d agoResearch1

Almost Half of Malware Samples Communicate Direct to IP

Unit 42 analysis of 4 million malware reports finds 45% of C2-active samples connect directly to hard-coded IPs, bypassing DNS defenses.

Palo Alto Unit 42 analyzed over 4 million Advanced WildFire dynamic analysis reports and found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, accounting for 23.17% of all C2 connection attempts. The firm proposes zero trust IP (ZT-IP), an enforcement approach that verifies whether outbound destinations were ever sanctioned by a DNS response. ZT-IP analysis surfaced Phorpiex ransomware droppers fetching payloads directly from C2 IPs, a persistent data exfiltration campaign using an obfuscated \GET protocol, and Mozi P2P botnet payloads delivered to IoT devices without DNS. Only 1% of benign samples connected directly to untrusted IP addresses.

Palo Alto Unit 42 · Aug 17, 2026Research

Introducing Unit 42’s Attribution Framework

Unit 42 releases its Attribution Framework, a systematic method using Diamond Model and Admiralty scores to attribute activity clusters to named threat actors.

Palo Alto Networks' Unit 42 introduced a structured framework for threat actor attribution built on the Diamond Model of Intrusion Analysis and Admiralty reliability/credibility scoring. The framework tracks activity at three levels: activity clusters (named CL-STA, CL-CRI, CL-UNK, or CL-MIX), temporary threat groups, and named threat actors using the constellation naming schema. Analysts score evidence across TTPs, tooling, malware code, OPSEC, infrastructure, timelines, and victimology to decide when to merge or elevate clusters, avoiding premature group naming.

Palo Alto Unit 42 · Aug 17, 2026Research

DDRop Attack Forces Intel TDX Confidential VMs Into Debug Mode and Exposes Memory

KU Leuven and ETH Zurich researchers released DDRop PoC hardware that forces Intel TDX confidential VMs into debug mode and exposes plaintext memory.

Researchers from KU Leuven, ETH Zurich, Google, and Durham University published proof-of-concept code, hardware designs, and firmware for DDRop, a DDR5 interposer that injects parity errors to drop selected cache-line writebacks. Because Intel TDX, Intel Scalable SGX, and AMD SEV-SNP lack per-line cryptographic freshness, processors decrypt and accept stale DRAM contents as current state. The PoC flips a victim's ATTRIBUTES.DEBUG flag to enable TDX debug mode, then copies victim memory in plaintext and can forge attestation reports. Affected environments include Intel 5th- and 6th-generation Xeon Scalable with TDX; Intel says the attack falls outside its cloud-computing threat model.

GBHackers · 1d agoResearch

Hunting Vulnerabilities Using Frontier Models

Okta used frontier AI models GPT-5.5 Cyber and Mythos via OpenAI and Anthropic programs to scan millions of code lines for vulnerabilities.

Okta describes using frontier AI models, including GPT-5.5 Cyber Preview (TAC) and Mythos Preview, through OpenAI's Daybreak Cyber Partner Program and Anthropic's Project Glasswing to hunt vulnerabilities across its product codebase. The team built a custom Python orchestrator with strong isolation, vendor-agnostic model support, and four distinct scanning pipelines executed as isolated Codex or Claude Code sessions with progressive context loading to reduce context bloat. Human experts and AI agents worked both autonomously and in paired hunts, and Okta reports the best results when humans and agents taught each other.

Okta Security · 8d agoResearch

1-15 August 2026 Cyber Attacks Timeline

Hackmageddon logged 108 confirmed cyber incidents for August 1-15, 2026, led by malware and public-facing application exploits.

Hackmageddon recorded 108 confirmed incidents between August 1-15, 2026, with cybercrime accounting for 90 of them (83.3%). Malware was the dominant vector with 26 incidents (24.1%), and exploitation of public-facing applications (MITRE ATT&CK T1190) was the leading initial access vector in 36 classified incidents. Cyber espionage motivated 15 incidents, and Public Administration was the most-targeted sector with 25 of 139 sector mentions.

Hackmageddon · 14d agoResearch 2 sources

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

SpecterOps released CDP-Enable-BOF, a Beacon Object File that enables Chrome DevTools Protocol in live Chrome or Edge processes on Windows for session hijacking.

SpecterOps released CDP-Enable-BOF, an x64 Beacon Object File that activates Chrome DevTools Protocol inside running chrome.exe or msedge.exe processes on Windows, exposing cookies, history, saved passwords, and authenticated sessions without administrator rights. It calls Chromium's StartRemoteDebuggingServer on the browser UI thread to stay reliable under CFG, TLS, and CET, and was tested on Chrome 147 and Edge 147. The technique builds on work by DeathFlamingo and Cedric Van Bockhaven; Google had hardened remote debugging in Chrome 136 after attackers used it to steal cookies post-App-Bound Encryption. Defenders can watch Sysmon Event IDs 8 and 10 for injection into browser processes.

The Hacker News · 22d agoResearch2

CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification

Researchers disclosed two DoS attacks exploiting CDNs' HTTP/3-to-HTTP/1.1 translation to amplify low-bandwidth requests up to 350x against origin servers.

Researchers named the two techniques HTTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA), exploiting the gap where CDNs speak HTTP/3 to browsers but only HTTP/1.1 to origins. All six tested CDNs (Alibaba, Baidu, Cloudflare, CloudFront, Fastly, Tencent) were susceptible to HBA, and five to HCA, with Cloudflare immune to HCA because it buffers full requests before opening backend connections. Attackers using under 5 Mbps forced over 100 Mbps at origins, and the 350x factor applies only to Alibaba, Baidu, and Tencent, which support the QPACK dynamic table. Testing identified 42,330 potentially vulnerable subdomains out of 151,685 hosted on the six providers across the Tranco Top 1M.

The Hacker News · 27d agoResearch

338 Million Attack Simulations Reveal The State Of Enterprise Defense

Picus Labs' Blue Report 2026, from 338 million attack simulations, finds defenses strong at the perimeter but blocking only 37% of post-compromise actions.

Picus Labs' fourth annual Blue Report analyzed over 338 million attack simulations from production environments in H1 2026. Average prevention effectiveness rose from 62% to 69%, but only 37% of attacker actions were blocked after compromise, with reconnaissance and credential theft largely missed. IOC-based malware download prevention fell to 50% from 71% in 2024, and Mimikatz credential dumping from LSASS memory was blocked 94% of the time versus 17% from other memory locations and 3% from registry.

Help Net Security · Aug 12, 2026Research