Search: “endpoint”

40 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 1997 Ransomware 1646 Malware 1332 Exploit / PoC 858 Industry 700 Data breach 601 Policy & legal 449 Threat actor 437 Phishing & fraud 230 AI tools & infra 140 AI safety & security 104 Tools 87 Research 55 Advisory 53

SeverityAll critical 3810 high 2303 medium 1559 low 715 info 410

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

12 Best Endpoint Privilege Management (EPM) Tools Compared (2026): Features & Pricing

A 2026 buyer's guide compares 12 endpoint privilege management tools, ranking CyberArk and BeyondTrust as enterprise leaders.

An editorial comparison evaluates 12 endpoint privilege management (EPM) tools on elevation control, manageability, and pricing model. The guide argues that standing local-admin rights fuel ransomware and lateral movement, making their removal a high-impact control that cyber insurers increasingly mandate. CyberArk and BeyondTrust are positioned as enterprise-depth leaders, with Delinea, Heimdal, and ManageEngine for the mid-market, and Admin By Request and CyberFOX AutoElevate for SMBs and MSPs. Pricing is generally per endpoint or per user, and the article is explicitly an assessment rather than a product release or incident report.

GBHackersupdated 09:52 UTC · 2h agofirst Sep 11, 07:04 UTC · 5d agoIndustry 13 sources

The Coding-Agent Trap: When a "Free" LLM Endpoint Is the Adversary, (Mon, Aug 31st)

A SANS honeypot caught a real coding-agent session routed to a rogue "free" LLM endpoint, exposing a Windows user's transcript and tool outputs.

A SANS analyst describes how an internet-exposed inference honeypot was discovered, relabeled with sought-after model names like DeepSeek, and enrolled in infrastructure serving "free" LLM backends. On 2026-08-30 an opencode terminal coding agent sent an 88-message, 224 KB transcript 210 times in 91 seconds via a China Unicom relay, exposing directory listings, tool outputs and read file portions. The analyst frames tool-enabled agents treating model endpoints as trusted control planes as a novel risk — a "rogue model endpoint" that could request tool executions on the user's machine.

SANS Internet Storm CenterAug 31, 20:00 UTC · 15d agoAI safety & security1

The 12 Best Endpoint Detection & Response (EDR) Solutions, Compared and Priced

An editorial scorecard ranks 12 EDR platforms, with CrowdStrike and SentinelOne tied at 8.6/10 and telemetry retention identified as the hidden cost driver.

An editorial comparison scores twelve EDR platforms on detection, response, analyst burden, pricing transparency, and coverage. CrowdStrike and SentinelOne tie at 8.6/10, with Microsoft Defender for Endpoint close behind at 8.5 and described as effectively free in Microsoft 365 E5 estates. The guide argues that telemetry retention, not per-endpoint price, drives real cost, with fully-priced quotes frequently diverging 2-3x from headline rates. Managed detection offerings, including Cynet's bundled 24/7 SOC, factor into the buyer-fit rankings.

GBHackersSep 9, 07:46 UTC · 7d agoIndustry 2 sources

Citrix UniconOS dual boot turns Windows endpoints into their own recovery device

Citrix released UniconOS dual boot in Release 7 2607, turning Windows endpoints into self-recovery devices after ransomware, failed updates or OS corruption.

Citrix announced dual boot in UniconOS Release 7 2607, which installs an isolated, hardened recovery environment alongside Windows in a separate partition protected by secure boot. If Windows is unavailable, users reboot into UniconOS and reconnect to applications via Citrix DaaS and SecurAccess with Chrome Enterprise. The capability is aimed at reducing reliance on spare hardware and central reimaging during ransomware or update failures, with automatic enrollment in UniconOS Management for fleet-wide boot policies.

Help Net SecurityAug 25, 00:00 UTC · 22d agoTools

The AI Supply Chain Has a Security Problem, and Much of It Is Sitting on the Open Internet

Researchers counted 36,769 publicly reachable self-hosted AI endpoints, only about 2% behind HTTP authentication, exposing Ollama, vLLM, and Flowise to abuse.

A Mysterium VPN study found 36,769 self-hosted AI endpoints reachable through internet scanning, with only 2.02% returning an HTTP authentication challenge. Open WebUI accounted for 18,529 reachable instances, Ollama for 6,935 fingerprinted hosts, and 5,223 agent-builder and workflow platforms were exposed, often holding API keys, database credentials, and other secrets. The report highlights LLMjacking risk from exposed Ollama APIs, a critical Flowise bug (CVE-2026-40933), leaked n8n tokens, and prior SentinelOne/Censys research finding roughly 175,000 exposed Ollama hosts in 130 countries.

Security AffairsSep 11, 17:27 UTC · 4d agoAI safety & security CVE-2026-409331

Endpoint Blind Spots: The 5 Places Ransomware Hides Before It Detonates

Cyble outlines five endpoint blind spots where ransomware operators stage access, steal credentials, and move laterally before detonating.

This educational write-up explains that ransomware usually has a long pre-execution phase during which attackers establish access, steal credentials, move laterally, and identify valuable systems. Cyble argues this activity often blends with legitimate administration, letting attackers evade endpoint detection. The piece lists five endpoint security blind spots defenders should monitor before encryption, extortion, or data theft begins.

CybleAug 21, 07:51 UTC · 26d agoResearch

A Deep Dive Into Attempted Exploitation of CVE-2023

Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.

Unit 42 observed large-scale automated scans attempting to exploit CVE-2023-33538 in end-of-life TP-Link TL-WR940N, TL-WR740N and TL-WR841N routers after CISA added the flaw to its KEV catalog in June 2025. HTTP GET requests inject commands via the ssid1 parameter at the /userRpm/WlanNetworkRpm endpoint to download and execute an arm7 ELF binary, a Mirai variant related to the Condi IoT botnet. Firmware emulation and reverse engineering showed the observed exploits are flawed and would fail, but the underlying vulnerability is real and successful exploitation requires authentication to the router's web interface. TP-Link confirmed the devices are end-of-life with no patches available and recommends replacing units and eliminating default credentials.

Palo Alto Unit 42Aug 19, 12:03 UTC · 27d agoExploit / PoC in the wildCVE-2023-335381

Top 10 Best Endpoint Privilege Management (EPM) Tools in 2026

A 2026 scorecard ranks ten endpoint privilege management tools, led by BeyondTrust, ThreatLocker and Delinea for elevation, coverage and policy depth.

The article ranks ten endpoint privilege management (EPM) tools using weighted criteria covering elevation workflow, platform coverage, policy depth, time-to-value and value. BeyondTrust scored highest overall (8.4) for cross-platform breadth, with ThreatLocker (8.2), Delinea (8.1) and Admin By Request (8.0) highlighted for allowlisting integration, cloud administration and deployment speed respectively. It also notes that Netwrix acquired CoSoSys in 2024, which affects bundling when shortlisting both EPM and device control.

Cyber Security NewsSep 10, 07:58 UTC · 6d agoIndustry

Exaforce extends its AI security tool to monitor more than just Claude

Exaforce AI Security extends beyond Claude to monitor OpenAI, Gemini, and Copilot agents using existing SOC telemetry, no new endpoint agents.

Exaforce expanded its June Claude Compliance API integration into Exaforce AI Security, adding monitoring for OpenAI, Gemini, Microsoft Copilot, and OAuth-connected AI apps. The tool inventories AI agents by correlating EDR, cloud, SaaS, and model-provider logs without new gateways or endpoint agents, and can respond by revoking sessions, deactivating API keys, isolating devices, or killing agent processes via existing controls. Analysts note the agentless approach lowers friction but lacks runtime inspection and inline blocking offered by competitors such as Palo Alto Prisma AIRS, SentinelOne Prompt AI Agent Security, and CrowdStrike Falcon Guardian. A March 2026 Cloud Security Alliance survey found 68% of organizations cannot distinguish human from AI-agent activity and 74% report AI agents receive excessive access.

CSO OnlineSep 15, 13:00 UTC · 22h agoTools

Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain

The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.

The Hunter's Ledger tracked an intrusion at one unnamed US organization as UTA-2026-024, staged from exposed server 193.233.202.17 with a Sliver beacon. Operators created a non-expiring Domain Admin account, enabled RDP with NLA disabled, dumped SAM, SYSTEM and SECURITY hives plus LSASS memory, and disabled eight endpoint protection services. A Node.js implant resolved its C2 server from an Ethereum smart contract that rotated domains five times in five months, while SYSTEM scheduled tasks with backdated dates and DNS allowlist manipulation provided persistence. The infrastructure ties to a confirmed ransomware incident, but no encryptor deployment was proven in this intrusion.

Cyber Security NewsSep 8, 12:10 UTC · 7d agoThreat actor in the wild

NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

Researchers disclosed 9.4-CVSS flaws in NASA/JPL's AIT-GUI allowing unauthenticated attackers to issue arbitrary spacecraft commands via exposed command endpoints.

Cycode disclosed a flaw chain in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, tracked as GHSA-p9r8-2q67-fp86 with CVSS 9.4, affecting versions 2.5.1 and earlier. The server binds to 0.0.0.0:8080, issues sessions without credential checks, and lets unauthenticated users issue spacecraft commands via POST /cmd and reach files outside intended directories via /script/run and /seq (CWE-306, CWE-352, CWE-22). Version 2.5.2 adds host binding and same-origin checks but does not add authentication, and a related missing-authentication flaw was published separately as CVE-2026-60112 with CVSS 9.3.

The Hacker NewsAug 20, 17:20 UTC · 26d agoVulnerability CVE-2026-601121

Best Practices for Good Endpoint Hardening | Huntress

Huntress outlines endpoint hardening best practices, citing exposed RDP, RMM tool abuse, and ClickFix social engineering as common SMB intrusion paths.

Huntress published defensive guidance on endpoint hardening for small and mid-sized businesses, drawing on observations from its SOC. The post describes common intrusion vectors: internet-exposed RDP brute-forced by automated scanners, phishing emails delivering attacker-controlled remote monitoring and management (RMM) tools, with Huntress reporting a 277% spike in RMM abuse in 2025, and ClickFix attacks using fake CAPTCHA pages that trick users into running malicious commands. Recommended controls include scanning for exposed RDP, SSH, and VPN interfaces, removing unneeded local admin rights, enabling Windows Defender tamper protection, disabling SMBv1, and standardizing on one approved remote access tool, guided by CIS and NIST frameworks.

HuntressSep 10, 15:00 UTC · 5d agoAdvisory

When the Whole Company Adopts AI: What It Does to Your SOC

Analysis of 16.9 million SOC alerts finds AI-related alerts at 0.43%, growing 685% since February, with 94.1% noise and 0.02% real attacks.

A review of roughly 16.9 million SOC alerts found about 73,000 (0.43%) were AI-related, a share that grew 685% between February and June 2026. Of AI-related alerts, 94.1% were noise, 5.8% genuine risks, and 0.02% real attacks; 79.8% received benign verdicts, 81.7% were automatically suppressed, and only 5.4% reached a human analyst. The only confirmed attacks were phishing campaigns that weaponized AI brand names as lures, while developer coding agents spawning shells and reading credential stores routinely tripped detections written before AI agents existed.

The Hacker NewsSep 12, 10:24 UTC · 4d agoResearch1

Privilege escalation from IIS AppPool to NT Authority/SYSTEM

A write-up demonstrates privilege escalation from an IIS AppPool identity to NT AUTHORITY/SYSTEM via the AD CS RPC endpoint.

A technical write-up details a Windows privilege escalation path that moves an IIS application pool identity to NT AUTHORITY/SYSTEM by abusing the Active Directory Certificate Services RPC endpoint. The technique chains the restricted IIS AppPool service context with AD CS access to reach SYSTEM on the host. The post is relevant for defenders mapping privilege escalation paths on Windows web servers.

Lobsters · securityAug 31, 12:36 UTC · 15d agoResearch

AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key

Huntress research shows AD RMS SLC root key is unrotatable and never expires, so its compromise permanently exposes all RMS-protected documents.

Part 2 of Huntress's AD RMS series details server-side attacks: extracting the Server Licensor Certificate (SLC) private key and performing offline decryption of protected documents. The SLC key has no expiry or rotation mechanism, with a 255-year certificate validity (2002–2258), so whoever recovers it can decrypt every document the deployment ever protected, indefinitely. The author released SharpRMS, a unified tool combining the 2016 DisARMS client-side attacks with new server-side key extraction and decryption capabilities. The research frames the SLC as comparable to KRBTGT and the DPAPI domain backup key, though not equivalent to domain compromise.

HuntressSep 10, 04:00 UTC · 6d agoResearch

The 12 Best Unified Endpoint Management (UEM) Solutions, Compared and Priced

A buyer's guide compares 12 unified endpoint management platforms, recommending Microsoft Intune, Jamf and Omnissa for common scenarios.

The article compares 12 UEM solutions including Microsoft Intune, Omnissa Workspace ONE, Jamf, ManageEngine, Ivanti, SOTI and 42Gears, with pricing models and platform coverage. It flags ownership changes such as Workspace ONE becoming Omnissa, BlackBerry divesting Cylance to Arctic Wolf, and Citrix's status under Cloud Software Group. Guidance centers on checking existing Microsoft 365 licensing before purchasing, per-user versus per-device pricing, and combining platforms like Intune and Jamf for Apple estates.

GBHackersupdated Sep 10, 08:19 UTC · 6d agofirst Sep 10, 08:02 UTC · 6d agoIndustry 4 sources

Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004)

Attackers are actively exploiting critical Gitea RCE CVE-2026-60004 via the diffpatch endpoint, prompting CISA KEV addition and at least one cryptomining compromise.

CISA added CVE-2026-60004, a critical code injection flaw in Gitea's diffpatch endpoint, to its Known Exploited Vulnerabilities catalog after in-the-wild attacks. An attacker with repository write access, or an unauthenticated visitor on instances with open registration, can execute arbitrary shell commands as the Gitea OS user. A disclosed incident saw an automated scanner register an account and deploy a loader and cryptominer inside a Docker container within about 11 seconds, with no persistence mechanism found. Gitea patched the flaw in v1.27.1, and CISA ordered US federal civilian agencies to update by August 28, 2026.

Help Net SecurityAug 26, 00:00 UTC · 21d agoExploit / PoC in the wildCVE-2026-60004

Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories

Gen Digital found infostealers like Amatera and Remus stealing AI coding agent tokens, prompt histories, and MCP configs from infected Windows and macOS machines.

Gen Digital analysts observed Amatera and Remus detections among tens of thousands of protected Windows users over three months, with Amatera targeting Cline and Continue data and Remus targeting Claude, Cursor, and OpenCode. CallbackBeaver added Cursor and Claude to its collection scope with more than 5,000 samples in 30 days, while macOS-focused Djinn Stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo. The stealers harvest access and refresh tokens, prompt histories, and MCP configuration files that can expose source control, ticketing, databases, cloud resources, and sensitive project context for follow-on fraud. Many stealers add targets via remotely managed rules, meaning this is an adaptation of existing infostealers rather than a new vulnerability in the AI tools themselves.

Cyber Security NewsSep 9, 11:41 UTC · 7d agoMalware in the wild2

Fortra security advisory (AV26-906)

Canada's Cyber Centre advises that Fortra GoAnywhere MFT Endpoint versions prior to 7.10.2 are affected by a path traversal vulnerability.

The Canadian Centre for Cyber Security issued advisory AV26-906 noting that Fortra GoAnywhere MFT Endpoint versions prior to 7.10.2 are affected by a path traversal vulnerability. The advisory was published September 10, 2026, referencing Fortra's own security advisory. No exploitation details or CVE id are provided; administrators are urged to review the links and apply the 7.10.2 update.

Canadian Centre for Cyber SecuritySep 10, 12:38 UTC · 5d agoAdvisory

Cybersecurity jobs available right now: March 10, 2026

Help Net Security's roundup lists open cybersecurity roles at BioNTech, AIG, ServiceNow and others across Europe, the Middle East and Canada.

A job-board roundup of cybersecurity openings including Associate Director Application Security at BioNTech (Germany), CISO at AIG (Israel), Cloud Security Professional at ServiceNow (Italy), and SOC/GRC, analyst, engineer and data governance roles in the UK, UAE, India, Canada and France. Roles span application security, cloud security, SOC operations, compliance and OT environments. Most listings are marked no longer accepting applications.

Help Net SecurityAug 28, 09:06 UTC · 19d agoIndustry

Top 10 Best Unified Endpoint Management (UEM) Solutions in 2026

A 2026 buyer's guide ranks UEM platforms, recommending Intune for Microsoft 365 shops, Jamf for Apple estates, and SOTI for rugged devices.

The guide ranks ten unified endpoint management platforms for 2026, recommending Microsoft Intune for Microsoft 365 organizations, Jamf for Apple-heavy estates, and SOTI for rugged, kiosk, and industrial devices. It notes VMware Workspace ONE now operates as Omnissa after Broadcom divested the End-User Computing division, and that BlackBerry sold Cylance to Arctic Wolf in February 2025 while retaining BlackBerry UEM. The article provides a coverage checklist spanning Windows, macOS, iOS, Android, Linux, kiosks, legacy on-prem Windows, and wearables/IoT.

Cyber Security NewsSep 9, 07:32 UTC · 7d agoIndustry

CISA Warns of Chromium Type Confusion 0-Day Vulnerability Actively Exploited in Attacks

CISA added the actively exploited Chromium V8 type confusion zero-day CVE-2026-85046 to its KEV catalog, urging patching of Chrome, Edge, and Opera.

CISA added CVE-2026-85046, a V8 type confusion flaw (CWE-843) in Chromium-based browsers, to its Known Exploited Vulnerabilities catalog. A remote attacker can trigger arbitrary code execution inside the browser sandbox via a specially crafted HTML page. Google Chrome is directly affected, and Microsoft Edge, Opera, and other Chromium-based browsers may also be impacted depending on their V8 version. Google has released a Stable channel Chrome update, and CISA directs mitigations under Binding Operational Directive 26-04.

Cyber Security NewsSep 8, 16:25 UTC · 7d agoExploit / PoC in the wildCVE-2026-85046

Top 10 Best Endpoint Encryption Software in 2026

A 2026 roundup of ten endpoint encryption products argues the engines are solved and buyers should choose management layers like Intune, Sophos, or Trellix.

The guide ranks ten endpoint encryption options, arguing BitLocker and FileVault have won the engine war so the real purchase decision is the management layer for compliance proof, key escrow, and cross-platform policy. Microsoft BitLocker with Intune is named the baseline for Windows estates, with Sophos, ESET, Trend Micro, Check Point, Trellix, and others covering mixed or regulated fleets. It also warns that TrueCrypt-lineage freeware is unmaintained and that Kaspersky cannot be sold to US customers.

Cyber Security NewsSep 10, 08:15 UTC · 6d agoIndustry

Top 10 Best Enterprise Browsers in 2026

2026 enterprise browser guide ranks Island first and notes Mammoth Cyber's wind-down plus corrections to standard vendor shortlists.

An editorial guide assesses ten enterprise browser options, ranking category creator Island first for last-mile DLP and BYOD controls, followed by Palo Alto's Talon browser as a Prisma Access/SASE surface and Google Chrome Enterprise Premium for DLP on already-deployed browsers. It corrects common lists, noting SlashNext is browser-adjacent phishing and BEC defense rather than a managed browser, and that Mammoth Cyber has wound down independent operations. Microsoft Edge for Business is positioned as effectively free policy depth for Microsoft 365 estates, with Menlo Security offering an isolation-plus-browser blend.

Cyber Security NewsSep 11, 07:07 UTC · 5d agoIndustry1

The 12 Best Antivirus (Endpoint Protection) Software for Business, Compared and Priced

GBHackers compares 12 business antivirus products on detection, EDR depth, pricing, and platform coverage, ranking CrowdStrike and Bitdefender joint top at 8.8.

The roundup scores 12 enterprise endpoint protection vendors across detection, EDR depth, management, pricing transparency, and platform coverage. CrowdStrike and Bitdefender tie at 8.8, with Microsoft Defender for Endpoint scoring 8.5 and noted as effectively free for Microsoft 365 E5 licensees. The piece also flags that Kaspersky cannot legally be sold in the US and that Panda and Webroot now sit under WatchGuard and OpenText respectively.

GBHackersSep 8, 10:24 UTC · 8d agoIndustry 2 sources1

Horizon3 Announces Integration with CrowdStrike Falcon® Next-Gen SIEM

Horizon3 announces NodeZero integration pushing validated exposure findings into CrowdStrike Falcon Next-Gen SIEM for correlated investigations.

Horizon3 announced an integration enabling validated NodeZero findings to flow into CrowdStrike Falcon Next-Gen SIEM, available now in the CrowdStrike Marketplace. Security teams can ingest and correlate exposure data with endpoint, identity, cloud, and other telemetry during investigations. CrowdStrike claims Falcon Next-Gen SIEM delivers up to 150x faster search than legacy SIEMs at up to 80% lower total cost of ownership.

Horizon3.aiSep 15, 13:10 UTC · 22h agoTools

Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)

Rapid7 published technical analysis of CVE-2026-63520, a remote code execution vulnerability in Microsoft SharePoint.

Rapid7 released an analysis covering CVE-2026-63520, a remote code execution flaw affecting Microsoft SharePoint. SharePoint is widely deployed in enterprise environments, making exposed, unpatched servers a likely target for exploitation. Defenders should consult the Rapid7 write-up for exposure checks and patch guidance. The available text does not confirm active exploitation at this time.

Rapid7 BlogAug 24, 16:18 UTC · 22d agoVulnerability CVE-2026-635201

New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

Nozomi details KATARU, an IoT botnet that brute-forces Telnet, exploits public Linux kernel flaws for root access, and launches multi-protocol DDoS attacks.

KATARU, discovered after honeypot Telnet brute-force activity from a Vietnamese IP, downloads an ARM payload (vlxx.arm) and attempts privilege escalation by editing /etc/passwd or exploiting CVE-2026-46300 (Fragnesia), CVE-2026-43284 (Dirty Frag), and CVE-2026-31431 (Copy Fail). It combines Mirai-style TCP, UDP, ICMP, HTTP, QUIC and DNS floods with application attacks against Minecraft, FiveM, OpenVPN and WireGuard. The malware uses X25519 and ChaCha20-Poly1305 encrypted C2, unusually broad persistence across systemd, cron, init frameworks, and Android hooks, plus anti-debugging and decoy traffic to hinder analysis. Implementers copied x86 shellcode into the ARM binary and reused an RFC 7748 test-vector key, indicating low-quality but rapidly evolving commodity development.

GBHackersupdated Sep 11, 14:17 UTC · 4d agofirst Sep 11, 09:07 UTC · 5d agoMalware in the wild 2 sources CVE-2026-46300 CVE-2026-43284 CVE-2026-31431

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

CISA added four critical actively exploited flaws to KEV: macOS Screen Sharing, SharePoint, VMware vCenter, and Microsoft IKE, with APT and ransomware use.

CISA added CVE-2026-65400 (macOS Screen Sharing, CVSS 9.8), CVE-2026-55040 (SharePoint, CVSS 9.1), CVE-2026-59310 (VMware vCenter, CVSS 9.8) and CVE-2026-33824 (Microsoft IKE Service Extensions, CVSS 9.8) to the KEV catalog. The macOS flaw was abused to deliver a Monero miner, while the vCenter bug was exploited by a suspected China-nexus APT to install reverse_ssh backdoors and Babuk-derived ransomware across 361 victim IPs in 47 countries. Unit 42 linked CVE-2026-33824 to a Chinese-speaking actor running an AI-enabled campaign using DeepSeek. FCEB agencies must patch by August 21, 2026 under BOD 26-04.

The Hacker NewsAug 19, 15:26 UTC · 27d agoExploit / PoC in the wildCVE-2026-65400 CVE-2026-55040 CVE-2026-59310+1 CVEs

Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data

CISA added actively exploited Oracle WebLogic flaw CVE-2026-21962 (CVSS 10.0) to its KEV catalog, letting unauthenticated attackers access or modify critical data.

CISA added CVE-2026-21962, a CVSS 10.0 improper access control flaw in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. Oracle shipped patches in January 2026, and GreyNoise, CloudSEK, and SOCRadar have since reported exploitation attempts, including a lone IP scanning multiple WebLogic, Ivanti, GNU InetUtils, and GLPI vulnerabilities. The flaw is also among several exploited by a China-linked actor delivering the SNOWLIGHT downloader to government and commercial infrastructure in more than 100 countries. Federal civilian agencies must apply fixes by August 27, 2026 under BOD 26-04.

The Hacker NewsAug 26, 05:07 UTC · 21d agoExploit / PoC in the wildCVE-2026-21962 CVE-2020-14882 CVE-2020-14883+2 CVEs1

SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation

CISA adds actively exploited SharePoint RCE CVE-2026-45659 (CVSS 8.8) to KEV; an August 11 update confirms ransomware groups are exploiting the flaw.

CVE-2026-45659 is a deserialization of untrusted data RCE in Microsoft SharePoint Server affecting Subscription Edition, 2019, and 2016, patched by Microsoft in May 2026. An authenticated attacker with at least Site Member permissions can execute code remotely over the network. CISA added the flaw to its KEV catalog on July 2 with a July 4 deadline for federal agencies, and on August 11 confirmed ransomware groups are exploiting it. Microsoft separately described Storm-2603 (Warlock ransomware) and an unrelated actor co-existing in one network, with initial access likely via the Gladinet Triofox flaw CVE-2025-11371 (CVSS 9.1).

The Hacker NewsAug 12, 13:46 UTC · Aug 12, 2026Exploit / PoC in the wildCVE-2026-45659 CVE-2025-113711

Authorization Architectures for Tool-Using AI Agents

Review paper proposes an authorization reference architecture for tool-using AI agents, identifying runtime enforcement and delegation bounds as unresolved gaps.

This review examines authorization models for tool-using AI agents that invoke APIs, databases, browsers, and protocols like MCP, arguing every consequential agent action must be traceable to a human principal, bounded by delegation, and contestable. It introduces a principal hierarchy spanning human user, operator/deployer, orchestrator agent, sub-agent, and tool endpoint, and analyzes five layers including credential lifecycle, delegation propagation, runtime enforcement, prompt injection as authorization bypass, and auditability. Drawing on 89 primary sources from 2023-2026, it proposes seven structural requirements, a four-layer reference architecture, and three deployable configurations.

arXiv cs.CRSep 14, 17:21 UTC · 1d agoAI safety & security

Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)

Rapid7's analysis of SharePoint auth bypass CVE-2026-55040 includes a PoC for unauthenticated admin-level operations.

Rapid7 and Microsoft disclosed CVE-2026-55040, an authentication bypass in Microsoft SharePoint, on July 14, 2026. The flaw stems from multiple issues in SharePoint's JWT token validation pipeline, allowing a remote unauthenticated attacker to bypass authentication and perform operations as a site user or administrator. Rapid7 has now published a technical analysis and a proof-of-concept script, based on SharePoint Server Subscription Edition.

Rapid7 BlogAug 11, 13:00 UTC · Aug 11, 2026Vulnerability CVE-2026-550401

Water sector passes, government sector fails attempts to spot and halt simulated CISA attack

CISA red teamers compromised both a government and a water organization; water defenders detected and contained the simulated attack, government defenders did not.

CISA's red team gained initial access, elevated domain privileges, and lateral movement into sensitive business systems and cloud resources at an unnamed government organization, whose SOC ignored low- and medium-severity EDR alerts buried under thousands of false positives. A water organization's SOC quarantined phishing-compromised workstations within 2, 10, and 20 minutes, and later detected and isolated intrusions reaching the OT DMZ bastion host. Both organizations underestimated cloud risk, lacked Microsoft Conditional Access for workload identities, and had no process to revoke compromised access and refresh tokens. This is one of CISA's rare public red-team reports since 2023.

CyberScoopAug 25, 17:11 UTC · 21d agoAdvisory1

Detecting cloud ransomware in Azure with Tenable One’s cloud detection and response capabilities

Tenable details ransomware group Storm-0501's Azure tenant-hijacking tactics and how its cloud detection and response identifies them.

Tenable's blog describes how cybercrime group Storm-0501 conducts cloud-first ransomware campaigns against Azure environments. The group has shifted from endpoint encryption to total hijacking of cloud tenants and systematically neutralizes resource locks, immutability policies, and backups. Tenable outlines its One Cloud Exposure detections, using AI-powered threat stories and precision alerts, to expose these TTPs early.

Tenable BlogAug 17, 15:15 UTC · 29d agoThreat actor in the wild

15 Minutes Saved Per Alert: How a Lean German Manufacturer Protects 10,000 Endpoints with ANY.RUN

A five-person security team at a German manufacturer protecting 10,000 endpoints cut triage time by 15 minutes per alert after adopting ANY.RUN's cloud sandbox.

Philipp Z., Security Lead at a leading German manufacturer, described how a five-person team protects 10,000 endpoints and users using ANY.RUN's Interactive Sandbox in a private cloud. The firm previously relied on a single air-gapped forensic laptop running Flare VM, which caused 5-10 minute setup delays, single-user bottlenecks, and selective triage. The switch reportedly saved roughly 15 minutes per alert and reduced forced wiping and reimaging of user machines. ANY.RUN data cited in the piece puts manufacturing security workloads 22% above other major industries.

ANY.RUNSep 9, 07:47 UTC · 7d agoIndustry

220 million traveler records exposed in Vietnam-linked APIS leak

Vietnam-linked APIS Elasticsearch leak exposed 220 million passenger and crew records with passport numbers and flight details spanning 2017 to 2026.

Kinryū Labs discovered an exposed Elasticsearch cluster named 'pax-info' holding 210,318,069 passenger records and 10,465,631 crew records (roughly 107 GB across 29 indices) hosted in Viettel-assigned IP space in Hanoi. The database, apparently operated by a Vietnamese organization, was reachable via a chain of two misconfigurations: a cloud-based path that bypassed an HTTP 401 block and acceptance of default credentials. Exposed data included names, dates of birth, nationalities, passport numbers, and detailed flight information for travelers of many nationalities from January 2017 to April 2026. Access was remediated on June 8 after Kinryū Labs notified Vietnamese authorities, airlines, and CERTs, with Singapore Airlines' security team helping coordinate the response; it remains unknown whether any data was copied by malicious actors.

BleepingComputerSep 8, 07:35 UTC · 8d agoData breach1

Attackers exploit critical SharePoint flaw after PoC goes public (CVE-2026-55040)

Attackers use Rapid7's public PoC to exploit CVE-2026-55040, a critical SharePoint authentication bypass patched in July 2026.

Rapid7 researcher Stephen Fewer published technical analysis and PoC exploit code for CVE-2026-55040, an authentication bypass in SharePoint caused by flaws in the JWT token validation pipeline. Threat intelligence firm Defused observed attackers using the PoC against SharePoint honeypots, though Microsoft has not yet confirmed in-the-wild exploitation. Chained with CVE-2026-63520, the flaw can yield unauthenticated remote code execution, per NHS England Digital. CISA is urging administrators to harden SharePoint deployments by limiting direct internet exposure and using Layer 7 reverse proxies.

Help Net SecurityAug 13, 00:00 UTC · Aug 13, 2026Exploit / PoC in the wildCVE-2026-55040 CVE-2026-63520

New Phishing Campaign Abuses Windows Mshta.exe to Steal Credentials and Secrets

Fortra researchers track an active phishing campaign targeting Spanish speakers that abuses mshta.exe to run HTA payloads for reconnaissance and credential theft.

Fortra's FIRE team says a phishing campaign active since June 2026 targets Spanish-speaking users with invoice ('Facturación') and judicial ('Aviso Judicial') lures, many sent via libero.it/italiaonline.it infrastructure with SCL:-1 markings to bypass anti-spam. Clicking embedded links delivers an HTA launcher executed via mshta.exe, which hides its window off-screen, builds dynamic C2 URLs, and performs reconnaissance using WMI, PowerShell, and environment-variable inspection. A second-stage JavaScript dropper uses HTML smuggling to reconstruct a Base64-encoded ZIP in the browser, delivering a 7-Zip self-extracting executable disguised as a Firefox installer; staged design allows later delivery of credential stealers or ransomware. Defenders are urged to block archivogratuito[.]online and shortener domains goo[.]su, abrir[.]link, and abre[.]ai, and to restrict mshta.exe execution via AppLocker or ASR rules.

GBHackersSep 12, 06:16 UTC · 4d agoPhishing & fraud in the wild1

Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

Attackers exploit SharePoint authentication bypass CVE-2026-55040 (CVSS 9.1) after Rapid7's PoC release, with 12 exploitation attempts recorded since July 19, 2026.

Microsoft patched CVE-2026-55040 in its July 2026 Patch Tuesday; the 9.1-severity flaw chains four weaknesses in SharePoint's JWT token validation pipeline, letting unauthenticated attackers forge valid JWTs and impersonate any SharePoint site user or administrator. Threat actors began exploiting the bug after Rapid7 released a Python PoC that forges tokens and enumerates domain users by SID. KEVIntel telemetry shows 12 exploitation attempts since July 19, 2026, eight of them on August 12-13 following the PoC release, originating from eight IPs across Hong Kong, Japan, the Netherlands, Taiwan, and the U.S. This is the fifth SharePoint vulnerability exploited this year, alongside CVE-2026-45659, CVE-2026-56164, CVE-2026-58644, and CVE-2026-50522.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Exploit / PoC in the wildCVE-2026-55040 CVE-2026-45659 CVE-2026-56164+2 CVEs