Search: “network-security”

28 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll AI tools & infra 1 Data breach 1 Exploit / PoC 1 Industry 1 Threat actor 1 Tools 1 Vulnerability 1

SeverityAll critical 2 high 0 medium 1 low 1 info 3

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

11 Best CSPM Tools Compared (2026): Features & Pricing

CSPM comparison ranks Wiz first for agentless attack-path analysis; notes Ermetic absorbed into Tenable and Lacework into Fortinet FortiCNAPP.

An editorial comparison of eleven CSPM tools ranks Wiz as the agentless attack-path momentum leader, Prisma Cloud as the breadth benchmark, and Orca as the agentless SideScanning pioneer. It highlights consolidation: Ermetic now powers Tenable Cloud Security and Lacework became Fortinet's FortiCNAPP. The guide recommends starting with free tiers from Defender for Cloud, Prowler, and native cloud tools before buying.

GBHackersSep 15, 06:37 UTC · 1d agoIndustry1

Edge infrastructure under siege: what two independent datasets reveal about who's exploiting your perimeter

Joint Tenable-SentinelOne analysis of 93 CVE-actor attribution pairs shows nation-state and criminal groups independently converge on the same edge infrastructure.

Tenable and SentinelOne jointly analyzed 93 CVE-actor attribution pairs covering exploitation of perimeter devices. The data shows state-sponsored and financially motivated actors independently target the same edge products from Ivanti, Fortinet, and Palo Alto Networks. The findings challenge the narrative that edge exploitation is exclusively a China-nexus nation-state problem, showing a broader shared attack surface.

Tenable BlogAug 26, 13:00 UTC · 21d agoThreat actor in the wild

Top 10 Best Multi-Cloud Security Platforms in 2026

An editorial roundup of the ten best multi-cloud security platforms for 2026, split between CNAPPs (Wiz, Prisma Cloud) and cloud-networking security (Aviatrix).

The article frames multi-cloud security as two markets: CNAPP platforms (Wiz, Prisma Cloud, CrowdStrike, Orca, Defender) securing what runs in clouds, and cloud-networking-security platforms (Aviatrix) securing how clouds connect. It ranks ten platforms including Palo Alto Prisma Cloud for breadth, Wiz for correlation, Check Point CloudGuard, Fortinet, Aviatrix, Microsoft Defender for Cloud, Trend Micro, and CrowdStrike. It flags the ~$32 billion Google–Wiz acquisition as raising cloud-neutrality questions buyers should address contractually.

Cyber Security News09:50 UTC · 4h agoTools

Bipartisan Senate bill aims to prepare energy sector for Q

Bipartisan Senate bill would direct FERC to factor quantum computing threats and post-quantum cryptography into US electric grid cybersecurity reliability standards.

The Quantum Grid Utility Assurance and Resilient Defense (Quantum-GUARD) Act, introduced by Senators Mike Rounds and Chris Coons, would require FERC to consider quantum computing threats when reviewing electric reliability standards and to explore post-quantum cryptography use in both IT and OT systems, plus a technical sandbox to study quantum impacts. It aligns with NIST's post-quantum algorithm work, and a June executive order moved the federal PQC migration deadline from 2035 to 2030. Industry experts noted the hard part is upgrading infrastructure such as SCADA communications and software update integrity ahead of those deadlines.

CyberScoopAug 24, 19:01 UTC · 22d agoPolicy & legal

Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems

Unit 42 built an ML-based detector for malicious traffic distribution systems, finding malicious TDS chains average longer redirections and more URLs than legitimate ones.

Traffic distribution systems redirect victims through chains of intermediate domains to hide final destinations, serving phishing, malvertising, and online gambling operations. Unit 42's topological analysis of redirection graphs found malicious TDS traffic uses longer chains (about 25% exceed four hops vs 10% benign), more URLs (median 126 vs 80), and fewer isolated subgraphs with higher connectivity. These features power an ML detector integrated into Advanced DNS Security and Advanced URL Filtering to identify and block malicious TDS infrastructure in customer traffic.

Palo Alto Unit 42Aug 17, 12:46 UTC · Aug 17, 2026Research

Cloud Delivered Security Services

Palo Alto Networks Unit 42 hosts a product archive page for its Cloud-Delivered Security Services subscription portfolio.

The page is a product category archive on the Unit 42 blog with no article text available. Cloud-Delivered Security Services is Palo Alto Networks' bundle of cloud-delivered network and threat prevention services. No research findings, incidents, or vulnerabilities are described.

Palo Alto Unit 42Sep 8, 14:27 UTC · 7d agoIndustry

Disruptive cyber activity highlights risk from internet-exposed systems and edge devices

NCSC links disruptive cyber activity to internet-exposed systems and edge devices, urging OT owners to fix avoidable vulnerabilities and improve resilience.

The UK's NCSC issued guidance following disruptive cyber activity that highlights the risk to internet-exposed systems and edge devices. It encourages owners of operational technology to remediate avoidable vulnerabilities and invest in long-term cyber resilience. The notice underscores that exposed edge devices remain a common entry point for attackers against OT environments.

NCSC UKAug 27, 12:00 UTC · 20d agoAdvisory in the wild

Researchers open-source a Wi-Fi cyber range for security training

NTNU and Aegean researchers open-source a software-emulated Wi-Fi cyber range using mac80211_hwsim with LLM-assisted scenario building.

Researchers from the Norwegian University of Science and Technology and the University of the Aegean published a design and prototype for a cyber range dedicated to IEEE 802.11 security training, emulating access points and clients with mac80211_hwsim, Linux namespaces, hostapd, wpa_supplicant, dnsmasq, and FreeRADIUS. The platform bundles Aircrack-ng, Wireshark, and custom tools WPAxFuzz and Bl0ck, and can convert plain-language scenario descriptions into deployable definitions via a locally hosted Llama model. A working prototype covering scenario creation and deployment is on GitHub; monitoring, access control, and orchestration zones remain future work.

Help Net SecurityAug 24, 04:21 UTC · 23d agoTools1

NIST Warns of Unique Security Risks in Multi-Cloud Environments

NIST catalogued 23 novel security challenges unique to multi-cloud environments and urged the community to develop solutions.

NIST published an analysis identifying 23 distinct security challenges that arise specifically in multi-cloud environments. The agency explicitly encouraged the cybersecurity community to work on solutions for these gaps. The publication reflects growing official concern that spanning multiple cloud providers creates risk patterns not covered by single-cloud security models.

Infosecurity MagazineAug 24, 15:30 UTC · 22d agoAdvisory

How an Emerging Industrial Protocol Family Could Put OT at Risk

New research shows unprotected Time-Sensitive Networking industrial protocols could let attackers disrupt or manipulate physical processes in OT environments.

Research covered by Dark Reading examines an emerging family of industrial protocols based on Time-Sensitive Networking (TSN) and finds that unprotected implementations could be attacked to disrupt or manipulate physical processes. The findings highlight growing OT risk as these protocols proliferate in industrial deployments; no confirmed exploitation is reported.

Dark ReadingAug 21, 20:24 UTC · 25d agoResearch

Cyberattack encrypts systems at Bavarian municipal utility

Hackers encrypted the central IT network of Bavarian utility Stadtwerke Landsberg, disrupting office systems but not electricity or water services.

Stadtwerke Landsberg said hackers encrypted its central IT network overnight on Sept. 1, prompting disconnection from the internet, crisis-team activation and external forensic support. Essential electricity and water services were unaffected, but staff availability was limited and customer data such as names, addresses and bank details may have been accessed. No ransomware group was named and no extortion demand was confirmed. The attack follows a similar late-June encryption incident at a North Rhine-Westphalia municipal utility, and the BSI consistently ranks ransomware among Germany's most serious cyber threats.

The RecordSep 8, 12:00 UTC · 8d agoRansomware in the wild

Lightweight Zero Trust via Automotive SDN

Researchers map automotive SDN with MACsec/MKA and CORECONF/YANG to NIST SP 800-207, satisfying five of seven Zero Trust tenets without added infrastructure.

Zonal in-vehicle networks ship Ethernet, MACsec, and TSN but treat the network itself as trusted, with no standardized runtime way to revoke access, rotate keys, or contain a compromised ECU. The paper first analyzes what Open Alliance TC17 v1.0 MACsec/MKA with pre-shared CAKs already provides against the seven NIST SP 800-207 Zero Trust tenets. It then adds CORECONF/YANG management per Open Alliance TC19, mapping the SDN Controller and Agents one-to-one onto NIST's PE, PA, and PEP, and instantiates a YANG-based network-access-control flow and key-management scheme. The result fully covers five of the seven tenets and partially covers two, without any ZTA-specific infrastructure.

arXiv cs.CRSep 9, 07:20 UTC · 7d agoResearch

Cisco Patches Nine Crosswork and Secure Workload Flaws, Five Scoring CVSS 10.0

Cisco patches nine Crosswork and Secure Workload flaws, five rated CVSS 10.0, found internally with no exploitation observed.

Cisco released fixes for four Crosswork platform vulnerabilities including CVE-2026-20030 SQL injection and CVE-2026-20357 missing authentication, both scoring CVSS 10.0, affecting Crosswork Release 7.2.1 and earlier. Five additional flaws in Secure Workload, including CVE-2026-20315 and CVE-2026-20317 at CVSS 10.0, affect SaaS and on-premises deployments up to releases 3.10 and 4.0. All issues were found through internal testing and are not known to be actively exploited. The patches follow a broader internal security review that recently addressed 12 Catalyst SD-WAN and IOS XE bugs.

The Hacker NewsAug 21, 10:03 UTC · 26d agoVulnerability CVE-2026-20030 CVE-2026-20357 CVE-2026-20358+7 CVEs

Advanced Dns Security

Palo Alto Networks Unit 42 hosts a product archive page for its Advanced DNS Security DNS-layer threat prevention service.

The page is a product category archive on the Unit 42 blog with no article text available. Advanced DNS Security is Palo Alto Networks' DNS-layer threat prevention offering. No research findings, incidents, or vulnerabilities are described.

Palo Alto Unit 42Sep 8, 14:27 UTC · 7d agoIndustry 6 sources

Cisco security advisory (AV26-876)

Canada's Cyber Centre relayed Cisco advisories covering a Nexus 9000 Silicon One RCE, IOS XR hardening, and denial-of-service flaws across IP phone lines.

The Canadian Centre for Cyber Security advisory AV26-876 lists Cisco vulnerabilities affecting IOS XR, Nexus 9000 Series switches, and several IP phone series. Included are a Nexus 9000 Silicon One remote code execution vulnerability, a September 2026 IOS XR security hardening release, and SIP software denial-of-service flaws in Desk Phone 9800, IP Phone 7800/8800, and Video Phone 8875. The Cyber Centre urges users and administrators to review the Cisco advisories and apply updates as they become available. No active exploitation is reported in the advisory.

Canadian Centre for Cyber SecuritySep 3, 13:13 UTC · 13d agoAdvisory

BlueSTAR: Tiered Agentic Architecture for Autonomous Cyber Defense

BlueSTAR is a tiered agentic LLM architecture for autonomous cyber defense, validated on live enterprise IT/OT cyber ranges against seven attack chains.

Researchers present BlueSTAR, a tiered agentic architecture for autonomous cyber defense in enterprise IT/OT networks that transforms high-volume security telemetry into compact indicators of compromise. It pairs deterministic containment for known threats with LLM reasoning for attacks requiring contextual and cross-cycle analysis, and introduces a resilience metric jointly weighing attacker reach, mission-critical impact, and defensive disruption. Evaluation on two live cyber ranges with seven attack chains based on real-world intrusion techniques covered credential theft, repeated compromise, concurrent attackers, and attacks on physical processes.

arXiv cs.CRSep 10, 17:36 UTC · 5d agoResearch

Cybersecurity in Power Grids: Standards and Research Challenges

Survey contrasts IT and OT security in smart grids, reviewing IEC 62351, IEC 62443, ISO 27001 standards and AI-driven detection trends.

The paper examines Smart Grid cybersecurity, emphasizing critical distinctions between IT and OT environments. It analyzes grid architecture, substation threats, and key international standards including IEC 62351, IEC 62443, and ISO 27001. It concludes with an overview of recent research trends such as AI-driven threat detection.

arXiv cs.CRSep 15, 10:03 UTC · 1d agoResearch

Palo Alto Networks product-category page describing Next-Generation Firewall threat detection, including encrypted traffic; no standalone article.

The page is a product category listing for Palo Alto Networks Next-Generation Firewalls, stating the products detect known and unknown threats, including in encrypted traffic, using intelligence from many thousands of customer deployments. It contains no research findings, vulnerabilities, or incident details relevant to defenders.

Palo Alto Unit 42Aug 19, 12:05 UTC · 28d agoIndustry

Cisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting Vulnerability

Cisco fixed a stored cross-site scripting flaw in Industrial Ethernet 1000 series switches exploitable by authenticated remote users.

Insufficient validation of user-supplied input in the web-based management interface of Cisco Industrial Ethernet 1000 Series Switches allows stored XSS. An authenticated remote attacker can inject malicious code into specific interface pages and execute arbitrary script in another user's context. Exploitation requires valid credentials; Cisco has released software updates.

Cisco Security AdvisoriesAug 19, 16:00 UTC · 27d agoAdvisory

Help shape the future of resilient private 5G

The UK NCSC invites organizations to collaborate on developing secure, resilient and deployable private 5G network technologies.

The UK National Cyber Security Centre is seeking collaboration with organizations developing technologies and approaches for secure, resilient and deployable private 5G networks. The blog post is an open call to help shape future private 5G resilience.

NCSC UKAug 12, 12:00 UTC · Aug 12, 2026Advisory

Palo Alto Networks security advisory (AV26-905)

Canada's Cyber Centre relayed Palo Alto Networks advisories covering PAN-OS, Cloud NGFW, Prisma Access, and Prisma Browser vulnerabilities, including PAN-OS CVE-2026-0310 buffer overflow.

The Canadian Centre for Cyber Security issued advisory AV26-905, noting that as of September 10, 2026, multiple Palo Alto Networks products are affected by vulnerabilities. Affected products include Cloud NGFW on AWS and Azure, multiple PAN-OS versions, Prisma Access, and Prisma Browser prior to 151.26.5.170. The advisory references CVE-2026-0310, a PAN-OS buffer overflow via XML processing (PAN-SA-2026-0012), and the September 2026 Chromium monthly vulnerability update. Administrators are encouraged to review the vendor links and apply available updates.

Canadian Centre for Cyber SecuritySep 10, 12:10 UTC · 6d agoAdvisory 3 sources CVE-2026-0310

Almost Half of Malware Samples Communicate Direct to IP

Unit 42 analysis of 4 million malware reports finds 45% of C2-active samples connect directly to hard-coded IPs, bypassing DNS defenses.

Palo Alto Unit 42 analyzed over 4 million Advanced WildFire dynamic analysis reports and found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, accounting for 23.17% of all C2 connection attempts. The firm proposes zero trust IP (ZT-IP), an enforcement approach that verifies whether outbound destinations were ever sanctioned by a DNS response. ZT-IP analysis surfaced Phorpiex ransomware droppers fetching payloads directly from C2 IPs, a persistent data exfiltration campaign using an obfuscated \GET protocol, and Mozi P2P botnet payloads delivered to IoT devices without DNS. Only 1% of benign samples connected directly to untrusted IP addresses.

Palo Alto Unit 42Aug 17, 12:45 UTC · Aug 17, 2026Research

Self-Verifying Anomaly Detection using Explainable AI for Cybersecurity of DER Networks

ExCYDER framework self-verifies anomaly detection alerts for DER power grids using LightGBM and SHAP, reaching over 98% detection accuracy.

The paper presents ExCYDER, an explainable AI anomaly detection framework for Distributed Energy Resource networks that combines LightGBM with SHAP to validate whether each model decision aligns with its feature-attribution evidence. On a realistic DNP3 dataset it achieved over 98% detection accuracy, 14.5 ms SHAP latency per alert, and confidence deviation within 5%. The self-verifying mechanism distinguishes coherent from inconsistent alerts, improving interpretability and auditability for DER-focused security operations centers.

arXiv cs.CRSep 11, 00:19 UTC · 5d agoResearch

Learn How to Build Security Operations Ready for AI

Wiz sponsors a webinar on building AI-ready security operations, focusing on attack-path visibility, exposure prioritization, and faster detection-to-remediation workflows.

A contributed piece promotes next week's Wiz webinar, How to Build AI Threat Readiness Across Your Security Operations, featuring a Wiz expert. The session covers using unified security context to separate urgent exposures from noise, understand attack paths across cloud, code, identities, SaaS, and AI services, and connect validated risks to remediation owners.

The Hacker NewsAug 27, 11:56 UTC · 20d agoIndustry

Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication

CERT Polska warns attackers exploit internet-exposed MikroTik SSH for unauthenticated full admin control; attacks observed since at least September 2.

CERT Polska warned on September 5 that attackers exploit MikroTik routers with internet-reachable SSH to gain full administrative control without authentication, calling the two-flaw combination 'MikroTrick'. Successful attacks date to at least September 2; no victim count or attacker identity was disclosed. MikroTik shipped fixed RouterOS releases: 6.49.21, 7.23.4 (with 7.23.5 fixing an IPv6 DHCP regression), 7.24.2, and 7.25beta3. CERT recommends immediate updates, checking for unauthorized configuration changes, and restricting SSH, WWW/WWW-SSL, and bandwidth-test services on unpatched devices.

The Hacker NewsSep 6, 09:32 UTC · 10d agoExploit / PoC in the wild

Conformal Prediction for Offensive Security

Researchers apply conformal prediction to offensive security, presenting initial findings on privacy-attacking machine learning and network traffic analysis.

The paper observes that conformal prediction (CP), introduced over 25 years ago, has been used mainly defensively in cybersecurity and rarely for offensive purposes. The authors present initial findings applying CP in two offensive areas: attacks on privacy-preserving machine learning and network traffic analysis. The work aims to close a gap in the offensive security literature rather than report an incident.

arXiv cs.CRSep 4, 14:07 UTC · 12d agoResearch

Five Eyes Guidance Improve Edge

Five Eyes intelligence agencies issued joint guidance aimed at improving security of edge network devices.

Based on the headline, Five Eyes cyber agencies released guidance recommending organizations improve the security posture of edge devices such as routers and remote-access appliances. No article text is available, so specific recommendations are unavailable.

Infosecurity MagazineAug 19, 00:00 UTC · 28d agoAdvisory

Automating Attack Graph Construction for Agentic Pentesting. Towards Neuro-Symbolic Vulnerability Hunting

Semi-automated pipeline converts Trivy, Semgrep, Nmap output into MulVAL attack graphs for agentic pentesting, 53.7% mean vulnerability coverage in CyBench.

The paper presents a semi-automated pipeline that parses Trivy, Semgrep, and Nmap findings into MulVAL predicates and uses an LLM-assisted process to build domain-specific Datalog rules linking scanner evidence to attack techniques. MulVAL/XSB then performs symbolic inference to generate structured, auditable attack paths for agentic pentesting. Evaluated on 54 web CTF tasks from CyBench, every task produced at least one goal-reaching graph with 53.7% mean ground-truth vulnerability coverage, 51.9% full coverage, and an 83.9% noise-path rate. Median end-to-end runtime was 24.9 seconds, making the pipeline runtime-practical for agentic workflows.

arXiv cs.CRSep 14, 13:13 UTC · 2d agoResearch