Search: “byod”

35 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 75 Industry 74 Ransomware 67 Data breach 62 Malware 54 Policy & legal 32 Exploit / PoC 19 Phishing & fraud 19 Threat actor 11 Tools 6 AI industry 3 AI research 3 AI tools & infra 3 AI safety & security 2

SeverityAll critical 199 high 73 medium 71 low 70 info 21

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

TP-Link Tapo Camera Flaw Lets Attackers Gain Admin Access Without Password

Two flaws in TP-Link Tapo C200 cameras allow network-adjacent admin access without a password (CVE-2026-15315) or DoS (CVE-2026-15316); fixed in V5_1.4.6.

OPSWAT Unit 515 researchers discovered CVE-2026-15315, an authentication bypass in the Tapo C200's local HTTPS management interface on port 443, where an alternative verification path accepts a replayed device-generated value, letting unauthenticated network-adjacent attackers establish admin sessions. CVE-2026-15316 causes a denial-of-service crash in the camera's HTTPS service via oversized encrypted Wi-Fi credential data during onboarding. TP-Link confirmed both issues after the April 16, 2026 report and released firmware V5_1.4.6 on August 18, 2026. OPSWAT says additional potentially critical findings remain under coordinated disclosure.

GBHackersupdated 13:27 UTC · 4h agofirst 12:33 UTC · 4h agoVulnerability 3 sources CVE-2026-15315 CVE-2026-15316

12 Best CASB Solutions Compared (2026): Features & Pricing

GBHackers' 2026 buyer's guide compares 12 CASB-capable vendors, arguing standalone CASB pricing has dissolved into per-user SSE subscriptions.

The article evaluates twelve CASB-capable platforms including Microsoft Defender for Cloud Apps, Palo Alto Networks' Prisma Access CASB, Netskope, iboss, Forcepoint ONE (Bitglass), Trend Micro Cloud App Security, and Skyhigh Security. It frames purchasing around SSE bundle economics, noting Defender for Cloud Apps ships inside Microsoft 365 E5 while Netskope, Zscaler, and Skyhigh price CASB into per-user SSE tiers. It also flags Saviynt, common on legacy roundups, as an IGA vendor rather than a true CASB.

GBHackersupdated 09:52 UTC · 7h agofirst 07:31 UTC · 9h agoIndustry 14 sources

New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing

DDRop uses a sub-$200 DDR5 interposer to drop memory writes, breaking Intel TDX and AMD SEV-SNP confidentiality guarantees.

Researchers at KU Leuven, ETH Zurich, Durham University, and Google will present DDRop at ACM CCS 2026, a first active interposer attack on DDR5 that silently drops memory writes so processors keep reading stale encrypted data, exploiting the missing freshness guarantee in Intel TDX, Intel Scalable SGX, and AMD SEV-SNP. On Intel TDX's default logical integrity mode it enabled reading victim VM memory, toggling debug mode, and forging remote attestation; AMD SEV-SNP was limited to copying pages between VMs. TDX's stronger cryptographic integrity blocks cross-VM attacks but likely not attestation forgery. The team will release board designs, firmware, and attack code on GitHub; no evidence of real-world use exists and no simple patch is available.

The Hacker Newsupdated Sep 15, 09:57 UTC · 1d agofirst Sep 14, 16:58 UTC · 2d agoResearch 2 sources

Chinese-Speaking Hackers Use Noodle RAT Backdoor to Spy on Windows and Linux Systems

Chinese-speaking actors use cross-platform Noodle RAT backdoor to maintain covert access to Windows and Linux systems across Asia-Pacific.

Noodle RAT (also ANGYREBEL/Nood RAT) has been active since at least mid-2016 and was long misidentified as Gh0st RAT or Rekoobe variants until Trend Micro and Cyberint classified it as a distinct multi-platform family. The Windows build (Win.NOODLERAT) is an in-memory modular shellcode backdoor delivered via MULTIDROP and MICROLOAD loaders, while the Linux build supports reverse shells, SOCKS tunneling, and cron persistence after web shell or public-facing service exploitation. It has appeared in intrusions in Thailand, India, Japan, Malaysia, and Taiwan and is linked to Iron Tiger, Calypso APT, Rocke, and Cloud Snooper campaigns spanning espionage and cybercrime. Recently discovered Linux builders 1.0.1 and 1.0.2 indicate the toolkit remains actively maintained.

GBHackersupdated 14:03 UTC · 3h agofirst 12:28 UTC · 4h agoMalware in the wild 2 sources

12 Best Enterprise Browsers Compared (2026): Features & Pricing

2026 comparison of twelve enterprise browsers ranks Island and Palo Alto Talon as purpose-built leaders, with Chrome Enterprise and Edge free or bundled.

Guide compares twelve enterprise browser options across three models: purpose-built secure browsers (Island, Talon, Surf), layered controls on existing browsers (Chrome Enterprise, Edge for Business, LayerX, Seraphic), and streamed/isolated browsers (Kasm). Island and Palo Alto's Prisma Access Browser lead the purpose-built category for BYOD and contractor DLP. It also notes Mammoth Cyber has ceased operations.

GBHackersSep 15, 06:32 UTC · 1d agoTools

How CHERIoT Provides Strong and Usable Isolation Without an MMU

ACM Queue paper explains how CHERIoT uses CHERI hardware capabilities to give microcontroller-class IoT devices memory and privilege isolation without an MMU.

The ACM Queue article (DOI 10.1145/3831361) describes CHERIoT, a RISC-V-derived platform that scales CHERI capability-based hardware down to small embedded and IoT microcontrollers. It provides strong, fine-grained isolation and memory safety without a memory management unit, aiming to make compartmentalization practical for low-cost devices. The piece emphasizes usability of the isolation model alongside its security guarantees.

Lobsters · securitySep 10, 14:59 UTC · 6d agoResearch

Top 10 Best Mobile Device Management (MDM) Solutions in 2026

A 2026 MDM buyer guide ranks ten solutions, recommending Microsoft Intune for Microsoft 365 estates and Jamf for Apple-only environments.

A 2026 buyer guide evaluates ten mobile device management solutions, leading with Microsoft Intune as the default for Microsoft 365 organizations and Jamf for Apple estates. It recommends choosing the enrolment model before selecting a vendor and clarifying BYOD visibility to prevent privacy disputes. Kandji, Mosyle, Omnissa Workspace ONE, ManageEngine, Scalefusion, and Hexnode are covered as alternatives. Guidance ties MDM to Zero Trust data access policies via Apple User Enrolment and Android work profiles.

Cyber Security NewsSep 9, 07:45 UTC · 7d agoIndustry

Retrospectively Reverse-Engineering Apple's Neural Engine

A developer reverse-engineers Apple's M1 Neural Engine architecture, mapping compute cores, MAC datapaths, and schedulers to explain the NPU's decline as transformers displaced CNN workloads.

A developer who previously maintained a reverse-engineered Linux driver for Apple's Neural Engine (ANE) published a retrospective deep dive mapping the M1 ANE's full internal architecture: compute, datapath, scheduler, memory, and execution model. The M1 ANE has 16 compute cores with 128 FP16 (or 256 INT8) MAC lanes each, totaling 2048 parallel MAC lanes, using 32-bit Q16.16 fixed-point accumulation with FP16 readout and an accumulator that saturates at 2^15. The author argues the ANE's dataflow was architected around the predictable reuse patterns of 2017-era CNN workloads (dating to the A11 Bionic), which autoregressive transformer decode broke, limiting its usefulness for general ML. With Apple's M5 folding ANE cores into GPU cores to tout LLM performance, the post frames this as the beginning of the end for the standalone NPU.

Hacker News · AISep 12, 07:54 UTC · 4d agoAI research HN 54↑ · 7 comments2

Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data

Threat actors use voice calls and Microsoft Graph API via BYOD devices to access Microsoft 365, then sell access to extortion groups like ShinyHunters.

Dark Reading reports that threat actors are exploiting BYOD scenarios and voice-based social engineering to gain access to Microsoft 365 environments and corporate data. The actors use Microsoft's Graph API to identify lucrative targets within compromised tenants. Access is then passed to extortion groups such as ShinyHunters, which is known for large-scale data theft and extortion campaigns. The source text is a brief summary, so victim counts and full scope are not specified.

Dark Readingupdated 14:54 UTC · 2h agofirst Sep 10, 20:36 UTC · 5d agoThreat actor in the wild 9 sources

Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)

A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.

Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.

SANS Internet Storm CenterSep 3, 02:02 UTC · 13d agoTools1

Top 10 Best Enterprise Browsers in 2026

2026 enterprise browser guide ranks Island first and notes Mammoth Cyber's wind-down plus corrections to standard vendor shortlists.

An editorial guide assesses ten enterprise browser options, ranking category creator Island first for last-mile DLP and BYOD controls, followed by Palo Alto's Talon browser as a Prisma Access/SASE surface and Google Chrome Enterprise Premium for DLP on already-deployed browsers. It corrects common lists, noting SlashNext is browser-adjacent phishing and BEC defense rather than a managed browser, and that Mammoth Cyber has wound down independent operations. Microsoft Edge for Business is positioned as effectively free policy depth for Microsoft 365 estates, with Menlo Security offering an isolation-plus-browser blend.

Cyber Security NewsSep 11, 07:07 UTC · 5d agoIndustry1

New hardware device can RAM into encrypted memory, expose your data

Researchers built a $200 DDR5 interposer that silently drops memory writes to break TDX, SGX, and SEV-SNP confidential VM integrity, requiring physical access.

Researchers from KU Leuven, ETH Zurich, Durham University, and Google demonstrated DDRop, a hardware interposer costing under $200 that corrupts DDR5 bus commands to silently drop writes to encrypted memory, enabling replay attacks on confidential VMs. Because scalable memory encryption lacks freshness checks, protected VMs keep computing on stale attacker-selected data; on an Intel TDX server the attack forces debug mode for plaintext memory reads or forges attestation reports, succeeding in under two minutes without crashing. Intel and AMD both called the attack out of scope for their cloud threat models, with no mitigation planned, and proposed cache line versioning appears still vulnerable. The full interposer design is being released as open-source hardware.

The Register · SecuritySep 14, 18:31 UTC · 1d agoResearch

Top 10 Best Cloud Access Security Broker (CASB) Solutions in 2026

2026 CASB guide ranks Netskope first for depth and Microsoft Defender for Cloud Apps for Microsoft estates, as standalone CASB fades into SSE.

Buyer's guide covers ten CASB products across four enforcement modes: API, forward proxy, reverse proxy and log-based discovery. Netskope leads on SaaS activity context depth, while Microsoft Defender for Cloud Apps wins on Microsoft 365 E5 estate economics. The guide argues standalone CASB purchases have largely disappeared into SSE platforms and increasingly overlap with SSPM.

Cyber Security NewsSep 15, 06:24 UTC · 1d agoTools

Top 10 Best Mobile Threat Defense (MTD) Solutions in 2026

Roundup of 2026 mobile threat defense tools recommends Zimperium and Lookout for targeted-attack detection and Defender for Endpoint for Microsoft shops.

This guide ranks ten mobile threat defense solutions, recommending Zimperium and Lookout for on-device detection against targeted users such as executives and journalists, and Microsoft Defender for Endpoint mobile for organizations already licensing Microsoft 365 E5. It explains that MDM enforces configuration while MTD detects attacks, and that mobile phishing now arrives via SMS, messaging apps and QR codes rather than email. It also highlights mercenary spyware and zero-click exploits as shifting requirements for high-risk users, referencing Apple's threat-notification program and Lockdown Mode.

Cyber Security NewsSep 9, 07:50 UTC · 7d agoIndustry

DeepZero: Open-source hunting for vulnerable Windows drivers

DeepZero, a new open-source engine, automates discovery of exploitable Windows kernel drivers for BYOVD attacks using Ghidra, Semgrep, and an LLM.

DeepZero is a free, open-source Python pipeline orchestrator that automates hunting for exploitable Windows kernel drivers relevant to BYOVD (bring your own vulnerable driver) attacks. Its seven-stage YAML pipeline parses PE headers, filters for kernel-mode drivers with IOCTL surfaces, excludes drivers listed on loldrivers.io, then runs headless Ghidra decompilation, Semgrep scanning, and an LLM-based exploitability assessment. The maintainer reports multiple verified vulnerabilities in the Snappy Driver Installer corpus, some still in the disclosure process, and notes findings involving plug-and-play-created device objects may need physical hardware to confirm.

Help Net Security05:30 UTC · 11h agoTools

Top 10 Best Unified Endpoint Management (UEM) Solutions in 2026

A 2026 buyer's guide ranks UEM platforms, recommending Intune for Microsoft 365 shops, Jamf for Apple estates, and SOTI for rugged devices.

The guide ranks ten unified endpoint management platforms for 2026, recommending Microsoft Intune for Microsoft 365 organizations, Jamf for Apple-heavy estates, and SOTI for rugged, kiosk, and industrial devices. It notes VMware Workspace ONE now operates as Omnissa after Broadcom divested the End-User Computing division, and that BlackBerry sold Cylance to Arctic Wolf in February 2025 while retaining BlackBerry UEM. The article provides a coverage checklist spanning Windows, macOS, iOS, Android, Linux, kiosks, legacy on-prem Windows, and wearables/IoT.

Cyber Security NewsSep 9, 07:32 UTC · 7d agoIndustry

The 12 Best Mobile Threat Defense (MTD) Solutions, Compared and Priced

A comparison of 12 mobile threat defense vendors highlights Zimperium's on-device detection and notes Kaspersky's US exit and Wandera's Jamf absorption.

The buyer's guide compares 12 mobile threat defense (MTD) products, naming Zimperium best for fully on-device detection and Microsoft Defender for Endpoint as the best-value bundled option. It reminds readers that Kaspersky cannot legally be sold or updated in the US following a Commerce Department determination, and that Wandera was acquired by Jamf. Most MTD pricing is quote-based per device or per user.

GBHackersSep 10, 08:15 UTC · 6d agoIndustry 4 sources

Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways

Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.

Sophos analyzed a second-stage Linux rootkit implant found in compromised F5 BIG-IP APM environments running Apache and PHP, linked to exploitation of CVE-2025-53521, an unauthenticated RCE. The implant hooks Apache's PHP-loading process and serves modified in-memory versions of three legitimate webtop PHP files (apm_css.php3, full_wt.php3, webtop_popup_css.php3), leaving on-disk files untouched so hashes and integrity checks pass. It also establishes access via an authenticated local UNIX socket that can provide an interactive /bin/bash session. Experts warn compromised APM appliances, which handle federated SSO and terminate TLS at enterprise perimeters, could enable SSO token theft and lateral movement to trusted downstream applications.

CSO OnlineSep 10, 11:51 UTC · 6d agoMalware in the wildCVE-2025-53521

Three smart ways SMBs can improve cybersecurity

Opinion piece urges small and midsize businesses to adopt proactive prevention, threat detection, and 24/7 MDR or XDR services.

This opinion article argues SMBs face outsized cyber risk due to limited budgets, small IT teams, and reactive security postures. It recommends proactive prevention, a defined threat detection and response strategy, and managed detection and response (MDR) or extended detection and response (XDR) services. It cites ransomware costs up to $10,000 per device and an attack every 39 seconds as motivation for adopting vendor-operated 24/7 monitoring.

Help Net SecurityAug 27, 06:50 UTC · 20d agoIndustry

UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities

Cisco Talos identifies UAT-10147 deploying the SPECTRE implant with cross-platform C2, credential theft, and kernel-level EDR bypass.

Cisco Talos reports that the tracked threat actor UAT-10147 is deploying a newly identified implant named SPECTRE. SPECTRE supports cross-platform command-and-control, process injection, credential theft, and anti-analysis protections. It also includes a Linux rootkit and BYOVD (bring your own vulnerable driver) capability enabling kernel-level EDR bypass, marking an evolution in commodity intrusion tooling.

Cisco TalosAug 20, 10:00 UTC · 27d agoThreat actor in the wild

A Feature-Rich Embedded NIDS with eBPF/XDP: Detector and Architecture Trade-offs

eBPF/XDP-based NIDS with Isolation Forest reaches 0.965 live F1 on DDoS replay; gRPC microservices match monolithic accuracy within 2ms overhead.

The paper presents a DDoS-focused network intrusion detection system for transport networks built with Ericsson, combining a statistical baseline with an Isolation Forest trained on flow features from GoFlowMeter, an open-source Go implementation of CICFlowMeter, plus eBPF/XDP kernel-level traffic filtering. On a Raspberry Pi 5 testbed replaying CIC-DDoS2019 as real traffic, the Isolation Forest achieves 0.965 recall/F1 live in the monolithic variant, catching low-volume attack windows the baseline misses. gRPC microservices nearly match monolithic accuracy adding under 2ms per window, while the Kafka pipeline trails by roughly nine percentage points and adds about 27ms.

arXiv cs.CRSep 11, 09:00 UTC · 5d agoResearch

Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0 (1999)

Seminal 1999 USENIX study finds most novice users cannot correctly sign and encrypt email with PGP 5.0 in 90 minutes.

Whitten and Tygar's USENIX Security Symposium paper evaluates whether cryptography novices can use PGP 5.0 effectively, using cognitive walkthrough analysis and a laboratory user test. The majority of test participants failed to successfully sign and encrypt a message within 90 minutes, despite PGP 5.0 having a well-regarded graphical interface. The authors argue that security requires usability standards beyond those of general consumer software and propose domain-specific UI design principles for security. The paper is a foundational reference in usable security research.

Lobsters · securitySep 9, 06:47 UTC · 7d agoResearch

TPMSpy: Validation of Measured Boot Systems by Low-Level Tracing of TPM Usage

Researchers present TPMSpy, a platform-agnostic method validating TPM Measured Boot via low-level tracing, finding inconsistent Linux systemd measurements that break remote attestation and LUKS decryption.

An arXiv paper (2609.05011) introduces TPMSpy, a method that analyzes virtualized system–TPM interactions to independently reconstruct and validate TPM Event Logs without relying on the quoting mechanism, applicable to open and closed systems and demonstrated on Linux and Windows. A longitudinal analysis of Linux systems running systemd versions 245–258 (2020–2025) found wide divergence in Measured Boot usage, undocumented behavioral changes, and no common usage pattern. The authors report inconsistent measurement of user-space systemd services, which prevents reliable remote attestation and LUKS disk decryption on affected systems.

arXiv cs.CRSep 4, 11:23 UTC · 12d agoResearch

[remote] D-Link DNS_340L - OS Command Injection

An OS command injection exploit was published for the D-Link DNS-340L NAS, a flaw relevant to exposed network storage devices.

Exploit-DB published exploit #52643 for the D-Link DNS-340L network-attached storage device. The vulnerability is an OS command injection, which could allow arbitrary command execution on affected devices. The disclosure text does not report exploitation in the wild.

Exploit-DBAug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC

Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit

Sophos analyzed a Linux rootkit on F5 BIG-IP APM devices that injects a fileless PHP web shell, likely after CVE-2025-53521 exploitation.

Sophos analyzed a Linux rootkit targeting F5 BIG-IP APM environments, also tracked by ESET as PoisonedRefresh, which hijacks Apache's apr_dso_load module loader to inject a fileless PHP web shell into memory. The implant intercepts __libc_start_main, hides strings with RC4, creates a password-protected local UNIX socket backdoor for interactive Bash access, and persists across BIG-IP upgrade images while modifying SELinux configuration. It is likely a second-stage payload following exploitation of CVE-2025-53521, a critical RCE flaw F5 reclassified from a DoS issue in March. The ShadowServer Foundation tracked 795 F5 BIG-IP APM endpoints exposed online.

BleepingComputerSep 8, 20:08 UTC · 7d agoMalware in the wildCVE-2025-53521

[dos] Nmap 7.99 - Extension Header Integer Underflow

A proof-of-concept denial-of-service exploit for Nmap 7.99 leverages an integer underflow in extension header parsing to crash the scanner.

Exploit-DB lists a denial-of-service proof of concept targeting Nmap version 7.99. The flaw is an integer underflow when handling extension headers, which can crash the scanner. No exploitation in the wild or patch details are mentioned in the listing.

Exploit-DBAug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC1

15 TP-Link Omada vulnerabilities let attackers hijack routers and intercept camera traffic

Help Net SecurityAug 5, 00:00 UTC · Aug 5, 2026Vulnerability CVE-2025-7850

MacOS 27 - First Boot, (Tue, Sep 15th)

SANS ISC documents the expected network traffic macOS 27 'Golden Gate' generates on first boot to help defenders baseline their networks.

Johannes Ullrich of SANS Internet Storm Center captured roughly 300 packets from a macOS 27 'Golden Gate' system before user login, covering DHCP, IPv6 duplicate address discovery, DNS, and TCP behavior. macOS 27 resolves hostnames like albert.apple.com (device activation, certificate-pinned), push messaging hosts, and ipv4only.arpa for NAT64 networks. The OS still uses a TCP window scale of 6, ECN, and random timestamps, with only four TCP connections observed during boot. The analysis provides a reference baseline for security teams monitoring Apple endpoints.

SANS Internet Storm CenterSep 15, 15:23 UTC · 1d agoResearch

A Deep Dive Into Attempted Exploitation of CVE-2023

Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.

Unit 42 observed large-scale automated scans attempting to exploit CVE-2023-33538 in end-of-life TP-Link TL-WR940N, TL-WR740N and TL-WR841N routers after CISA added the flaw to its KEV catalog in June 2025. HTTP GET requests inject commands via the ssid1 parameter at the /userRpm/WlanNetworkRpm endpoint to download and execute an arm7 ELF binary, a Mirai variant related to the Condi IoT botnet. Firmware emulation and reverse engineering showed the observed exploits are flawed and would fail, but the underlying vulnerability is real and successful exploitation requires authentication to the router's web interface. TP-Link confirmed the devices are end-of-life with no patches available and recommends replacing units and eliminating default credentials.

Palo Alto Unit 42Aug 19, 12:03 UTC · 28d agoExploit / PoC in the wildCVE-2023-335381

USN-8731-1: MiniUPnPd vulnerability

Ubuntu issued USN-8731-1 fixing a MiniUPnPd integer underflow allowing remote DoS or information disclosure via malformed SOAPAction headers.

Ubuntu released USN-8731-1 to address an integer underflow vulnerability in MiniUPnPd's SOAPAction header parsing. A remote attacker could send a malformed SOAPAction header containing a single quote to trigger a denial of service or information disclosure. MiniUPnPd is a lightweight UPnP daemon widely deployed on routers and gateways.

Ubuntu Security NoticesSep 7, 09:30 UTC · 9d agoAdvisory1

[Control Systems] National Instruments security advisory (AV26-914)

Canada's Cyber Centre relayed a National Instruments advisory covering improper access control and cleartext sensitive-information flaws in NI SystemLink and SystemLink Server.

Advisory AV26-914, dated September 11, 2026, notes that NI SystemLink and SystemLink Server prior to or equal to 2026 Q3 Patch 1 are affected by improper access controls and storage of sensitive information in cleartext. The Canadian Centre for Cyber Security urges users and administrators to review the vendor's links and apply available security updates.

Canadian Centre for Cyber SecuritySep 11, 15:56 UTC · 5d agoAdvisory2

Researchers open-source a Wi-Fi cyber range for security training

NTNU and Aegean researchers open-source a software-emulated Wi-Fi cyber range using mac80211_hwsim with LLM-assisted scenario building.

Researchers from the Norwegian University of Science and Technology and the University of the Aegean published a design and prototype for a cyber range dedicated to IEEE 802.11 security training, emulating access points and clients with mac80211_hwsim, Linux namespaces, hostapd, wpa_supplicant, dnsmasq, and FreeRADIUS. The platform bundles Aircrack-ng, Wireshark, and custom tools WPAxFuzz and Bl0ck, and can convert plain-language scenario descriptions into deployable definitions via a locally hosted Llama model. A working prototype covering scenario creation and deployment is on GitHub; monitoring, access control, and orchestration zones remain future work.

Help Net SecurityAug 24, 04:21 UTC · 23d agoTools1

Risks in IoT Supply Chain

Unit 42 analyzes multilayer IoT supply chain risks across hardware, firmware, and software, citing counterfeit Cisco switches and OpenWrt attacks.

Unit 42 examines weaknesses in the IoT supply chain ecosystem across hardware, firmware, operation, and vulnerability layers, noting that 89% of IT decision-makers reported IoT device growth and IDC forecast 41.6 billion connected IoT devices by 2025. Examples include counterfeit Cisco Catalyst 2960-X switches with possible backdoor access (F-Secure, July 2020), a March 2020 OpenWrt flaw enabling malicious update impersonation, and threat actor interest in TeamViewer remote support software. The report stresses that untracked third-party components and missing device inventories make it hard to assess vulnerability impact across vendors.

Palo Alto Unit 42Aug 19, 12:05 UTC · 28d agoResearch

Attackers plant remote access tools on compromised PaperCut servers

Attackers chained two PaperCut NG/MF zero-days for unauthenticated access, installing SimpleHelp and AnyDesk remote access tools on compromised servers.

An ongoing campaign exploits chained zero-days CVE-2026-81578 (improper access control) and CVE-2026-82078 (unsafe dynamic class loading) in internet-facing PaperCut NG and MF Application Servers, enabling authentication bypass and arbitrary Java bytecode execution. Post-compromise activity includes user and domain enumeration, payload download from sendit.sh, and silent installation of SimpleHelp and AnyDesk for redundant remote access; Defused observed CVE-2026-81578/CVE-2026-82078 exploit activity in honeypots since August 29, including data theft via Derby database dumps. Emergency patches were released August 28 and August 30, but 47% of roughly 2,500 PaperCut installs tracked by Huntress run v23 or older, for which no patch is available.

Help Net SecuritySep 2, 08:12 UTC · 14d agoExploit / PoC in the wildCVE-2026-81578 CVE-2026-820781