ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “radius”

15 items in the last 3d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllResearch 4Advisory 2Exploit / PoC 2Industry 2Threat actor 1Tools 1AI industry 1AI research 1Data breach 1
SeverityAllcritical 1high 3medium 3low 0info 8

Cisco Identity Services Engine RADIUS Denial of Service Vulnerability

Cisco patched a RADIUS flaw in Identity Services Engine letting unauthenticated remote attackers trigger denial of service on ISE nodes.

A vulnerability in the RADIUS feature of Cisco Identity Services Engine allows an unauthenticated remote attacker to cause a denial of service by sending crafted RADIUS requests directly to an affected device. The flaw stems from improper handling of certain RADIUS requests and can render ISE nodes unavailable. In single-node deployments, endpoints that have not yet authenticated would be unable to access the network until the node recovers. Cisco has released software updates addressing the issue.

Cisco Security Advisoriesupdated · 53m agofirst · 19h agoAdvisory 19 sources

Hackers Exploit FortiGate SSL-VPN Flaw to Breach Thai ISP and Deploy MeshCentral Backdoor

Threat actors exploited FortiOS SSL-VPN flaw CVE-2024-21762 to breach Thai ISP Triple T Broadband, gaining root-level persistence via MeshCentral agents.

Attackers exploited CVE-2024-21762, an out-of-bounds write enabling unauthenticated RCE in FortiOS SSL-VPN, against Triple T Broadband's FortiGate 60F at mail.3bb.co.th, launching a Node.js reverse shell via a ROP payload. Hunt.io uncovered the operation through an exposed staging directory at 92.63.180[.]133:8888 containing 298 files of exploits, credential-harvesting scripts, session cookies, and a device inventory. Post-compromise, the actors deployed MeshCentral agents (device group TH-3BB, C2 www.ayuthayatech.com) running as root, plus a hidden SUID backdoor at /usr/local/bin/.rc, and also targeted an internal Pentaho/Tomcat server with Ghostcat (CVE-2020-1938). A cleanup script removed logs, shell histories, and web shells while deliberately preserving the MeshCentral agent and SUID backdoor.

GBHackers · 2d agoExploit / PoC in the wild 3 sourcesCVE-2024-21762CVE-2020-1938

3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials

Hunt.io found an attacker holding root access inside Thai ISP 3BB via a MeshCentral backdoor, targeting subscriber RADIUS credential databases.

Hunt.io discovered an exposed attacker server on June 3, 2026 revealing an ongoing intrusion at 3BB, one of Thailand's largest broadband providers. The attacker maintained hidden MeshCentral agents reporting to www.ayuthayatech[.]com (device group TH-3BB) and held root on internal servers. Recovered scripts sprayed passwords over SSH against more than 55 internal machines, planted web shells, added SSH keys, searched for stored credentials, and targeted RADIUS subscriber credential databases, though exfiltration was not confirmed. The toolkit included a full exploit for FortiGate SSL-VPN flaw CVE-2024-21762 against mail.3bb.co[.]th, but the initial access vector is unestablished, and a cleanup script erased logs while preserving the backdoor.

The Hacker Newsupdated · 2d agofirst · 2d agoData breach in the wild 3 sourcesCVE-2024-217621

Hackers Exploit FortiGate SSL-VPN Vulnerability to Attack Broadband Provider

Exposed attacker staging server reveals intrusion of Thai broadband provider 3BB via actively exploited FortiGate SSL-VPN flaw CVE-2024-21762.

Hunt.io found an open directory on server 92.63.180[.]133 holding 298 files detailing an intrusion into Triple T Broadband's 3BB brand, starting from a FortiGate 60F SSL-VPN at mail.3bb.co[.]th:10443. The actor weaponized CVE-2024-21762 (CVSS 9.8, KEV-listed since February 2024) using heap spraying and a ROP chain to gain a reverse shell. Post-exploitation included MeshCentral root-level persistence via www.ayuthayatech[.]com, Dirty COW/PwnKit privilege escalation, credential harvesting, SSH spraying against 55+ internal addresses, and log-deleting cleanup scripts; a stolen OpenVPN certificate and key from Triple T's PKI may still be valid.

Cyber Security Newsupdated · 2d agofirst · 2d agoExploit / PoC in the wild 3 sourcesCVE-2024-217622

Tuskira Vector brings autonomous red teaming to attack surface validation

Tuskira launched Vector, an autonomous red teaming agent that validates exploitable external attack surface against deployed controls using a Security Data Fabric digital twin.

Tuskira announced Vector, an agentic autonomous red teaming capability that simulates attacker behavior from outside an organization to identify its exploitable attack surface. Findings are validated against deployed compensating controls, internal risk data, and application/infrastructure topology via Tuskira's Security Data Fabric, which normalizes third-party tool signals into a live digital twin. The release extends Kairo (introduced May 2026), adding red team sensors and an agentic defense loop spanning agents Kairo, Lattice, Quell, and Iris. Tuskira claims Kairo has deprioritized up to 99% of scanner findings as unreachable and recomputes breach-path maps in minutes.

Help Net Security · 5h agoTools

One Compromised Kubernetes Node Can Expose Every Workload Identity Running on Itnew

Unit42 researchers show a root attacker on a Kubernetes node can manipulate cgroups to make the local SPIRE agent issue other workloads' identities.

Palo Alto Networks Unit42 demonstrated that an attacker with root access on a Kubernetes node can alter Linux cgroup data so the local SPIRE agent matches a target pod's selectors and issues its SVID to an attacker-controlled process. The technique affects SPIFFE/SPIRE deployments, which assume node trustworthiness, and means every workload identity on a compromised node should be considered exposed. Researchers have not observed the method in the wild and released Spooffe, a testing tool to measure node identity exposure.

Cyber Security News · 15m agoResearch 2 sources

Kubernetes Attack Lets Hackers Steal SPIFFE Workload Identities and Impersonate Applicationsnew

Unit 42 detailed a Kubernetes technique where node-root attackers spoof cgroup selectors to steal SPIFFE/SPIRE workload identities and impersonate applications.

Palo Alto Networks Unit 42 described a post-exploitation technique in which an attacker with root access to a Kubernetes node manipulates cgroup metadata so the local SPIRE agent issues valid SVIDs belonging to co-located workloads. Stolen X.509 or JWT SVIDs let the attacker impersonate victim applications over mutual TLS or pass identity-aware authorization, turning node compromise into lateral movement and privilege escalation. Unit 42 said it has not observed exploitation in the wild and released the open-source Spooffe tool so defenders can measure which identities are harvestable per node.

GBHackersupdated · 15m agofirst · 41m agoResearch 2 sources

Mapping out your unknown: A threat hunter’s guide to GitHub

Datadog Security Labs publishes a threat-hunting guide with audit-log queries to detect GitHub token theft, device code phishing, and source code exfiltration.

Datadog's threat-hunting guide covers GitHub audit log queries for detecting compromised accounts, stolen personal access tokens, and malicious OAuth app authorizations. Attackers typically obtain credentials through phishing, credential stuffing, leaked secrets, or device code phishing, then map private repositories, exfiltrate source code, and pivot into connected cloud and CI/CD environments. The guide maps detections to MITRE techniques like T1078 and T1528 and documents GitHub logging quirks affecting attribution, token metadata, and visibility fields.

Datadog Security Labs · 1d agoResearch in the wild1

Why I'm still bearish on LLMs after Navier-Stokes

Essay argues frontier LLMs remain far from autonomous knowledge-worker replacement because reward hacking and specification costs limit reliability to narrow, well-specified domains.

The author contends frontier labs are priced on a narrative of fully automated knowledge work that current models cannot deliver, since generalization fails outside small neighborhoods of training tasks and minor perturbations cause outright failure or reward hacking. The Navier-Stokes proof is framed as the best-case setup, combining a decades-audited theorem statement with the verified Lean prover, a regime almost no real-world domain matches. Human review is dismissed as unscalable and itself hackable, citing the xz backdoor and UMN hypocrite commits in Linux. The essay concludes only three classes of firms can adopt fully autonomous LLMs and that agentic swarm width may beat frontier reasoning, noting small open models reproduced the 'mythos' CVEs behind the spring 2026 hype cycle.

Hacker News · AI · 1d agoAI industryHN 50↑ · 13 comments1

Thai Broadband Provider Hacked via Fortinet Vulnerability

Hackers exploited Fortinet CVE-2024-21762 RCE to breach Thai broadband provider 3BB, deploying MeshCentral backdoors and credential-harvesting tools across its network.

Hunt.io uncovered an intrusion staging directory in Thailand containing 298 files of custom tooling built for Triple T Broadband (3BB) and its former owner Jasmine. Initial access came via fingerprinting a FortiGate SSL-VPN appliance and exploiting CVE-2024-21762 for remote code execution, after probing CVE-2018-13379, CVE-2022-42475, and CVE-2023-27997. The actor also probed F5 BIG-IP for CVE-2021-22986, CVE-2022-1388, and CVE-2023-46747, escalated privileges with PwnKit and Dirty COW, used MeshCentral as a C2 backdoor, harvested SSH/database/SNMP/Radius credentials, deployed PHP web shells, and ran cleanup scripts to hide the intrusion.

SecurityWeek · 1d agoThreat actor in the wildCVE-2018-13379CVE-2022-42475CVE-2023-27997+4 CVEs

12 Best CWPP Solutions Compared (2026): Features & Pricing

Editorial comparison ranks twelve CWPP vendors, with Sysdig leading K8s runtime depth, Prisma Cloud workload breadth, and Wiz agentless speed.

A 2026 buyer's guide compares twelve cloud workload protection platforms across features and pricing models. Sysdig is rated deepest for container/Kubernetes runtime via its Falco lineage, Prisma Cloud broadest across hosts, containers, and serverless, Aqua strongest on cloud-native lifecycle, and Wiz/CrowdStrike lead agentless speed and platform correlation. Category notes flag Illumio as microsegmentation and Fidelis as NDR/XDR rather than classic CWPP.

GBHackersupdated · 2h agofirst · 2d agoIndustry 12 sources

12 Best CWPP Solutions Compared (2026): Features & Pricing

CWPP comparison favors Sysdig for container runtime depth, Prisma Cloud for workload breadth, and Aqua for cloud-native lifecycle security.

An editorial comparison of twelve CWPP solutions covers Trend Micro, Aqua, Prisma Cloud, Illumio, Microsoft Defender for Cloud, Fidelis, CrowdStrike and others, with pricing models and category notes. It names Sysdig (Falco lineage) the leader in Kubernetes/container runtime depth and Prisma Cloud the breadth benchmark across hosts, containers, and serverless. It flags Illumio as microsegmentation and Fidelis as NDR/XDR rather than classic CWPP.

GBHackersupdated · 2h agofirst · 2d agoIndustry 12 sources1

Sakana AI Researchers Introduce PC-ALM, a Layer-Local Alternative to Backpropagation That Trains 1000-Layer Networks

Sakana AI's PC-ALM adds per-layer Lagrange multipliers to predictive coding, matching backprop on networks up to 1000 layers with layer-local updates.

Sakana AI researchers propose Augmented Lagrangian Predictive Coding (PC-ALM), a training method that keeps every update layer-local while recovering backprop-aligned credit signals. The team proves multipliers converge to exact backprop adjoints in linear networks and trains 1000-layer residual MLPs on MNIST within about 2 points of backprop accuracy. PC-ALM matched backprop across a width/depth grid from 8 to 128 on MNIST and Fashion-MNIST where standard predictive coding failed in deep, narrow networks, and improved over PC on ResNet-18 with CIFAR-10 and Tiny ImageNet. An MIT-licensed JAX reference implementation reproduces the results on CPU.

MarkTechPost · 2d agoAI research2

ENISA: Frontier AI Is Changing the Speed of Cyberattacks. Europe Needs to Catch Up

ENISA warns frontier AI compresses attack lifecycles to minutes, with exploits possible within 15 minutes of disclosure and median 72-minute breach-to-exfiltration times.

ENISA's July 2026 paper 'ENISA's view on Cybersecurity in the Frontier AI Era' argues AI-assisted attackers may weaponize vulnerabilities within 15 minutes of disclosure and achieve initial-access-to-data-exfiltration in a median 72 minutes, creating a 'negative time-to-exploit' problem. The report cites one organisation whose CVE volume rose from roughly 80 in Q1 2025 to almost 500 in Q1 2026, then about 500 reports per day when frontier-AI tools were used. ENISA recommends machine-speed defence under 'Cybersecurity as Code', EPSS and VEX-based prioritisation, AI-assisted incident response with human oversight, and an assume-breached architecture.

Security Affairs · 2d agoAdvisory

How Attackers Abuse VSS, and How Huntress Detects It

Huntress details how attackers abuse Windows Volume Shadow Copies for ransomware recovery sabotage and NTDS.dit credential theft, plus detection logic.

Huntress explains that attackers abuse VSS in three ways: deleting shadow copies to inhibit recovery before ransomware detonation, creating shadow copies to extract the NTDS.dit Active Directory database for offline credential theft, and manipulating shadow copy configuration. Because backup agents and RMM tools routinely create and delete shadow copies, raw events are too noisy to alert on alone. Huntress detections instead correlate VSS activity with lateral movement and credential harvesting over a time window, such as an observed sequence of PsExec spawning SYSTEM shells on a domain controller, vssadmin create shadow, a blocked deletion attempt, and DNS reconnaissance against another host.

Huntress · 2d agoResearch