Search: “routing”

The Router Within: Eliciting Native Skill Routing from a Frozen LLM

Gavel reads skill-routing signals from a frozen LLM's forward passes with two linear maps, beating retrieval pipelines by up to 21.9 points.

Gavel (Glance And Verdict) shows a frozen agent LLM already contains skill-routing signals in its forward passes, read out via two trained linear maps without loading skill text into context. A glance step scores the full library using mid-layer states and per-skill banks built in one forward pass; a verdict step fuses the model's own likelihood and yes/no judgment as a product of experts. Trained once, it transfers zero-shot to three public benchmarks and SkillTraj (372 simulated agent trajectories); on Qwen3-32B it beats progressive disclosure and retrieve-and-rerank pipelines adding 1.2B-16B external parameters by up to 13.4 points (21.9 mid-rollout).

arXiv cs.AI / cs.LG / cs.CL·Sep 14, 17:58 UTC · 1d agoAI research 2 sources

From Parameters to Answers: How LLMs Retrieve and Use Their Internal Knowledge

Interpretability study traces how Qwen, Llama, and Gemma route query information and internal knowledge across layers when answering questions.

Researchers used layerwise interventions on hidden states to separate query-routing signals from target knowledge in language models, testing Qwen, Llama, and Gemma on country-continent questions with varied answer types. A pair-conditioned request direction strengthens before interventions alter downstream knowledge, opening a causal window while answer-supporting content is still forming. Trajectories differ by model: Gemma shows a partially overlapping mid-layer routing profile, while Llama has no sustained routing-effect window under the same gates.

arXiv cs.AI / cs.LG / cs.CL·Sep 10, 17:39 UTC · 5d agoAI research1

Beyond Top-k Skill Retrieval: Diversity-Aware Skill Routing for LLM Agents

DSR reranks LLM agent skills with Determinantal Point Processes to favor complementary, non-redundant sets, improving multi-skill query coverage.

The paper proposes Diverse Skill Routing (DSR), a diversity-aware reranking framework for LLM agent skill routing that uses a Determinantal Point Process to balance query relevance and non-redundancy across large skill registries. DSR introduces a query-residual diversity kernel that penalizes redundant skill overlap while avoiding penalties arising only from shared query relevance. On the SkillRouter benchmark, DSR improves recall and full coverage over a strong pointwise reranking baseline, with the largest gains on multi-skill queries. The authors argue skill routing should be treated as complementary set selection, not just relevance ranking.

Hugging Face daily papers·Sep 4, 20:00 UTC · 11d agoAI research

Expert-Space Exploration in MoE Reinforcement Learning

ESRL explores MoE expert-routing space during RL post-training, improving Qwen3-30B-A3B Pass@1 by 3.2 points over GRPO without extra compute.

The paper shows perturbing expert routing increases rollout diversity similarly to higher decoding temperature, but naive perturbation degrades quality. ESRL anchors high-confidence experts, restricts stochastic routing to a plausible candidate pool, adapts perturbation strength via router entropy, and replays recorded expert paths during policy optimization. It achieves the best results across top-K, top-1, and shared-expert MoE backbones on math, science, and code tasks; on Qwen3-30B-A3B it improves average Pass@1 and Pass@8 over GRPO by 3.2 and 4.5 percentage points.

Hugging Face daily papers·updated Sep 11, 16:58 UTC · 4d ago·first Sep 10, 20:00 UTC · 5d agoAI research 2 sources

Security Incident – BGP Hijacking

Attackers BGP-hijacked Softaculous' Hetzner IP block for 33 hours, obtained valid TLS certificates, and delivered a malicious Virtualizor update to some servers.

Between August 28 and 30, 2026, AS62390 (NexonHost) announced 162.55.80.0/24 via transit AS6204 (Zet.net) without authorization, diverting traffic while retaining Hetzner's AS24940 on the AS path. The attacker obtained valid Let's Encrypt certificates for virtualizor.com domains because the CA's domain validation was also routed through the hijack, so affected connections showed no TLS warnings. A malicious Virtualizor update package reached a handful of installations; routing was fully restored, and reconstruction from RIPE RIS data showed all 368 collector peers carried the hijacked route at some point with roughly 28% time-weighted diversion.

Lobsters · security·Sep 3, 02:07 UTC · 13d agoData breach

So you want to use OpenRouter?

Simon Willison highlights OpenRouter pitfalls: provider routing makes the same model endpoint behave inconsistently across backends.

Simon Willison discusses problems, raised by Mohamed Moustafa, with relying on OpenRouter's single API endpoint that automatically routes to the most cost-effective provider. Different backend providers run different serving software with different optimizations and settings, so requests to the same endpoint can behave in different ways. Some providers lack vision capability for vision models, and the reasoning effort option can be processed differently across providers.

Simon Willison·Sep 11, 22:49 UTC · 4d agoAI tools & infra

AdaptVPR: Route-Aware Hard Positive Generation for Robust Visual Place Recognition

AdaptVPR generates route-aware synthetic hard positives for visual place recognition, releasing the 160K-image AdaptCities dataset with R@1 gains up to 9.2% under domain shift.

AdaptVPR is a generative augmentation framework that creates same-place hard positives under illumination, weather, seasonal, and dynamic-occlusion shifts for robust visual place recognition training. A vision-language model parses scene attributes and estimates editability, while a rule-based scheduler routes generation through global appearance, local occlusion, or dual perturbation routes with geometric-consistency verification. The resulting AdaptCities dataset contains 160K verified synthetic hard positives, and experiments show R@1 gains up to 9.2% across VPR baselines and backbones. Code and data are publicly released on GitHub.

Hugging Face daily papers·Sep 2, 20:00 UTC · 13d agoAI research

Task-Directed Residual AddUNet:Perfect-Reconstruction Routing for Full-Rate Representations

Paper recasts additive U-Net skip structure as a perfect-reconstruction filter bank and adds full-rate residual routing for task-directed representations.

The work proves a constrained additive U-Net's survivor-skip structure is exactly equivalent to a critically sampled perfect-reconstruction filter bank, and removes complementary-subband restrictions via a full-rate formulation. A Residual Full-Rate PR architecture routes task-irrelevant or redundant structure away from the task pathway while guaranteeing exact reconstruction without invertible operators, a matched synthesis bank, or a learned decoder. On TIMIT, the front-end improves test PER from 28.60±2.09% to 25.76±0.41% with recognizer and training held fixed.

arXiv cs.AI / cs.LG / cs.CL·Sep 14, 16:50 UTC · 1d agoAI research

NASA AIT-GUI Flaws Could Let Unauthenticated Attackers Issue Spacecraft Commands

Researchers disclosed 9.4-CVSS flaws in NASA/JPL's AIT-GUI allowing unauthenticated attackers to issue arbitrary spacecraft commands via exposed command endpoints.

Cycode disclosed a flaw chain in AIT-GUI, the browser-based operator console for NASA/JPL's open-source AMMOS Instrument Toolkit, tracked as GHSA-p9r8-2q67-fp86 with CVSS 9.4, affecting versions 2.5.1 and earlier. The server binds to 0.0.0.0:8080, issues sessions without credential checks, and lets unauthenticated users issue spacecraft commands via POST /cmd and reach files outside intended directories via /script/run and /seq (CWE-306, CWE-352, CWE-22). Version 2.5.2 adds host binding and same-origin checks but does not add authentication, and a related missing-authentication flaw was published separately as CVE-2026-60112 with CVSS 9.3.

The Hacker News·Aug 20, 17:20 UTC · 26d agoVulnerabilityCVE-2026-601121

HoneyRoute: Honeypot-Model Routing for Adversarial LLM Serving

HoneyRoute detects malicious LLM serving requests and diverts them to a honeypot model, reaching F1 0.911 with 38 ms median added latency.

HoneyRoute is an inference-serving layer pairing a streaming router (a frozen 0.8B embedding backbone with per-domain MLP heads) with a dual-implementation honeypot and an analysis loop that converts trapped interactions into attacker fingerprints for router retraining. On a production trace plus a seven-domain attack corpus it matches 96% of a two-tier guard-LLM cascade's F1 at 1/385th of its latency with 0% evasion under 13 adversarial transformations. Diverting malicious traffic cuts production token consumption under GCG-suffix flooding by 97.8%, and loop training raises detection F1 to 0.933.

arXiv cs.CR·Sep 8, 06:26 UTC · 8d agoAI safety & security

How Does mHC Use Its Residual Streams? Selective Routing and Near-Identity Mixing

Analysis of DeepSeek-V4-Flash shows four-stream mHC residual blocks use only about two streams effectively, with late-layer mixing providing little benefit.

The study examines the four-stream residual pathway of DeepSeek-V4-Flash, finding typical attention or FFN sites effectively use about two streams and that residual mixing is modest, occurring primarily in early layers. Replacing late mixers with identity increases C4 perplexity by only 1.9% while replacing early mixers raises it by 41%. Retaining the three largest routing weights per token increases perplexity by at most 2.7%, showing the model uses only part of the flexibility afforded by the four-stream design.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 16:02 UTC · 11d agoAI research

Signed Rescue Routing: Harm-Aware Cascades for Efficient LLM Inference

Signed Rescue Routing improves LLM cascade efficiency by predicting when a larger model actually corrects a smaller one rather than uncertainty.

Signed Rescue Routing (SRR) is a budgeted cascade method that separately predicts rescues and regressions when escalating from a small to a large model, ranking requests by their signed difference. The authors prove this signed conditional gain is Bayes-optimal under a fixed escalation budget and add only a lightweight two-head router needing small-model output statistics at deployment. Evaluation with Qwen3-4B and Qwen3-8B on MMLU, HellaSwag, and ARC-Challenge shows better accuracy-compute tradeoffs than entropy routing and learned error predictors.

arXiv cs.AI / cs.LG / cs.CL·Sep 7, 17:31 UTC · 8d agoAI research

NeoHorse-1: Towards Recursive Self-Improvement via Agentic Post-Training with Routing Harness

NeoHorse-1 introduces agentic post-training with intelligent routing that lifts agent benchmark scores at 4B and 9B scales, prototyping recursive self-improvement.

NeoHorse-1 is a family of agent-native models trained through agentic post-training: routing-harness logs (predicted capability demand, service tier, interaction) become structurally validated training data organized into a three-stage SFT curriculum plus routing-guided on-policy distillation. Capability-guided allocation converts evaluation feedback into the next training mixture, closing an evaluation-selection-update loop. Post-training raises the macro-average from 58.94 to 64.87 at 4B and from 65.60 to 69.04 at 9B across eleven agent, tool-use, coding, and instruction-following benchmarks. The authors position it as a prototype of harness-mediated recursive self-improvement.

Hugging Face daily papers·Sep 7, 20:00 UTC · 8d agoAI research

The Coding-Agent Trap: When a "Free" LLM Endpoint Is the Adversary, (Mon, Aug 31st)

A SANS honeypot caught a real coding-agent session routed to a rogue "free" LLM endpoint, exposing a Windows user's transcript and tool outputs.

A SANS analyst describes how an internet-exposed inference honeypot was discovered, relabeled with sought-after model names like DeepSeek, and enrolled in infrastructure serving "free" LLM backends. On 2026-08-30 an opencode terminal coding agent sent an 88-message, 224 KB transcript 210 times in 91 seconds via a China Unicom relay, exposing directory listings, tool outputs and read file portions. The analyst frames tool-enabled agents treating model endpoints as trusted control planes as a novel risk — a "rogue model endpoint" that could request tool executions on the user's machine.

SANS Internet Storm Center·Aug 31, 20:00 UTC · 15d agoAI safety & security1

A rant about phishing: It's not the user's fault (and not DNS either)

Opinion piece argues multi-domain login redirects make legitimate flows indistinguishable from phishing, urging organizations to standardize on one recognizable root domain.

The author shows a real-world login flow that chains through numerous third-party domains (identity providers, cloud auth endpoints, OAuth APIs, 2FA pages), none on the company's own domain, so credentials and 2FA prompts are trivially impersonable. The piece argues URLs are inherently confusing because the security-relevant second-level domain sits mid-string, and that users trained to ignore URLs cannot distinguish legitimate pages from scams. It proposes RFC 2119-style requirements: single recognizable root domain, internal services on its subdomains, emailed or SMS links on that domain, and local redirects instead of third-party hosted pages.

Lobsters · security·Sep 10, 15:14 UTC · 5d agoPhishing & fraud

[AINews] 10% worse, 100x cheaper, 10000x faster: Why Simulation is taking over

Latent Space argues AI training pipeline stages—rewards, data, teachers, curricula, environments—are flipping from human-made to model-made simulation.

Latent Space's AINews essay traces how each component of AI training has turned synthetic since 2022: reward models (InstructGPT, RLAIF), synthetic pretraining data (Microsoft Phi, NVIDIA Nemotron-4 340B), model teachers (Alpaca, DeepSeek-R1 distillation), and self-generated curricula (Self-Rewarding Language Models, SPIN). In 2026 it highlights Karpathy's autoresearch loop—700 experiments yielding 20 kept improvements, cutting GPT-2 training time from 2.02 to 1.80 hours—and Z.ai's GLM-5.3 fully synthetic RL environment, judging, and verification stack. It frames these shifts as 'simulation': 10% worse but 100x cheaper and 10,000x faster than human equivalents.

Latent Space·Aug 22, 07:36 UTC · 25d agoAI industry

PACE: Perceived-Latency-Aware Cascading Service Routing and Filler Control for QoE-Efficient Retrieval-Augmented Dialogue Serving

PACE cuts perceived latency in retrieval-augmented dialogue serving via cascading routing and filler control, reaching 0.41s P95 under load.

PACE is a serving framework for retrieval-augmented dialogue that optimizes Perceived Time-to-First-Response (PTFR) under quality and cost constraints. It combines a load-adaptive cascading router, a joint path-filler controller, and volatility-aware cache admission, deployed on a humanoid-robot sales service. On 75k CarQA requests, the cascade halved pure-LLM P95 PTFR (0.29s vs 0.53s) and the adaptive controller reached 0.41s P95, 2.4x better than RAG at high load; filler calls dropped 94% and stale answers fell from 86% to 0%.

arXiv cs.AI / cs.LG / cs.CL·Sep 9, 16:02 UTC · 6d agoAI tools & infra

Discounted Claude access bought on the gray market may expose every prompt you send

Help Net Security·Aug 6, 00:00 UTC · Aug 6, 2026Phishing & fraud

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.

Rapid7 researchers found CVE-2026-86206 (semicolon/Forwarded access-control bypass, CWE-791, CVSSv4 6.9) and CVE-2026-86207 (UserTwoFactorLogin authentication bypass, CWE-305, CVSSv4 7.7) in the latest N-able N-central. Chained, they let a remote unauthenticated attacker create an attacker-controlled System administrator account. The bugs stem from Envoy and Jetty disagreeing on the requested path and whether the client is local. N-able patched both in N-central 2026.3 Hotfix 3, following the earlier CVE-2026-18577 authentication bypass.

Rapid7 Blog·Sep 8, 11:01 UTC · 7d agoVulnerabilityCVE-2026-86206CVE-2026-86207CVE-2026-18577

New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access

University of Toronto researchers present GPUThor, a Rowhammer attack that defeats ECC on NVIDIA RTX A4000-A6000 GDDR6 GPUs and achieves host root access.

GPUThor uses non-uniform hammering to bypass Target Row Refresh and overcome SECDED ECC on NVIDIA Ampere workstation GPUs with GDDR6 memory, inducing 72,000 to 377,552 bit flips per gigabyte across RTX A6000, A5000, A4500, and A4000 cards. Triple-bit silent data corruption enables host privilege escalation to root with the IOMMU enabled, reusing GPUBreach page-table corruption techniques, and double-bit DUEs allow escalation when the IOMMU is disabled during a ~10 ms lazy-service window. The attack cut end-to-end escalation time on the A6000 from 21.9 hours to 1.1 minutes. Reported to NVIDIA, Google, Microsoft, and AWS on April 29, 2026; findings were embargoed until August 25, 2026, and no CVE identifier was assigned.

The Hacker News·Sep 8, 16:03 UTC · 7d agoResearch1

Google’s new search redirects make links harder to check before you click

Google routes some search result links through encoded google.com/goto?url= redirects, breaking hover-to-verify link checks and raising scraping costs.

Google has started routing some search result links through opaque google.com/goto?url=... redirects using a custom Google-specific encoding, with the destination visible only via the redirect response's Location header. Google confirmed the rollout as an anti-abuse measure, most likely to make bulk extraction of destination URLs from search results more difficult and costly. Malwarebytes warns the change undermines the standard hover-before-clicking safety advice, while legitimate rank-tracking, SEO auditing, archival, and accessibility tools now face the same rate limits and costs as abusive scrapers.

Malwarebytes Labs·Sep 14, 14:17 UTC · 1d agoIndustry

China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs

China-nexus espionage group Fire Ant compromised Cisco IOS XR routers and TACACS servers to harvest credentials, capture traffic and suppress logs.

Sygnia investigated an intrusion in which Fire Ant expanded beyond VMware hypervisors to Cisco IOS XR routers, TACACS servers and Linux management hosts. The actor deployed purpose-built router implants that hid a GRE tunnel, filtered log messages, captured PCAPs uploaded to external FTP servers, and used TacTap to inject a library into tac_plus and steal TACACS credentials obfuscated with a single-byte XOR key of 0xEF. A Linux backdoor named BridgeAgent masqueraded as a Zabbix agent, persisted via a root systemd unit, disguised itself as /usr/bin/gnome-shell and received commands over TLS on port 443. The group also used Medusa and REPTILE rootkits, SSH backdoors and renamed binaries impersonating SentinelOne and Cybereason agents, while suppressing logs, disabling SELinux and rewriting login history. Sygnia assesses strong overlap with UNC3886 and published IoCs.

The Hacker News·Aug 31, 09:04 UTC · 16d agoThreat actor in the wild1

Trends in Web Threats: Old Web Skimmer Still Active Today

Unit 42 detected 577,000 landing URL incidents in Q1 2022, with an old web skimmer family still actively stealing payment card data.

Palo Alto Unit 42 detected 577,275 landing URL incidents (116,643 unique) and 2,043,862 malicious host URL incidents (180,370 unique) between January and March 2022. Web threat volumes declined after the November 2021 holiday peak, but an old web skimmer family remained active. Business and economy sites overtook personal sites as the most common apparently benign entry points. Most malicious domains geolocated to the United States, Germany, and Russia, though proxy servers and VPNs obscure true locations.

Palo Alto Unit 42·Aug 17, 13:05 UTC · 29d agoResearch

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.

Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.

Tenable Blog·Sep 8, 18:07 UTC · 7d agoVulnerability in the wildCVE-2026-81963CVE-2026-858801

Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point

Filigran introduces Attack Chaining in OpenAEV to continuously simulate multi-stage attack paths, exposing gaps that isolated MITRE ATT&CK technique testing misses.

Filigran announced Attack Chaining, a new scenario type in its OpenAEV platform that links individual techniques into automated, continuously-run multi-stage attack paths, using each step's real output (credentials, tokens, open ports) to branch dynamically toward a final objective. The article cites Filigran's State of Threat Management report, in which 93% of security leaders reported a business-impacting cyberattack in the past 12 months, 88% said AI accelerates attackers, and 84% blamed siloed tools and disconnected testing. The 2025 DGFiP breach is cited as an example where individually survivable weaknesses chained into a major intrusion. The feature includes conditional chaining logic, live attack path mapping, structured findings for identifying chokepoints, and predefined scope and safety guardrails.

The Hacker News·Sep 15, 11:26 UTC · 22h agoTools

BigBear phishing crew nets thousands of Microsoft 365 credentials

CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.

CloudSEC researchers got inside the admin panel of BigBear 2.0, an Evilginx2-based phishing-as-a-service operation run by someone known as 'General Boss'. The panel contained 5,137 records tied to 461 organizations: 1,032 plaintext passwords and 4,148 session cookies, with 474 complete MFA-bypassed authentications. The adversary-in-the-middle proxy captures Microsoft 365 session cookies that can be replayed to access email, Teams, SharePoint, and OneDrive, potentially pivoting into Entra ID and federated SaaS. The operation was still active, used custom JavaScript to disable FIDO2/WebAuthn on phishing pages, and routed logins through a residential proxy pool spanning 69 countries.

The Register · Security·Sep 8, 13:26 UTC · 7d agoPhishing & fraud in the wild1

Procedural Graphs: Self-Evolving Execution Structures for LLM Agents

Researchers introduce Procedural Graphs, self-evolving (procedure, relation, procedure) structures guiding LLM agent tool use and planning.

Procedural Graphs organize procedural knowledge into (procedure, relation, procedure) triplets to guide LLM agent actions, addressing drift such as lost objectives, out-of-order tool calls, and repeated unproductive steps. At each decision step the framework localizes the active node and a guidance model translates the surrounding subgraph into step-level situational guidance. An LLM refiner edits graph topology by contrasting failed with successful trajectories, and across datasets, task types and LLMs the approach outperforms memory-based baselines and matches or surpasses hand-designed graphs.

arXiv cs.AI / cs.LG / cs.CL·Sep 8, 17:59 UTC · 7d agoAI research1

Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories

Gen Digital found infostealers like Amatera and Remus stealing AI coding agent tokens, prompt histories, and MCP configs from infected Windows and macOS machines.

Gen Digital analysts observed Amatera and Remus detections among tens of thousands of protected Windows users over three months, with Amatera targeting Cline and Continue data and Remus targeting Claude, Cursor, and OpenCode. CallbackBeaver added Cursor and Claude to its collection scope with more than 5,000 samples in 30 days, while macOS-focused Djinn Stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo. The stealers harvest access and refresh tokens, prompt histories, and MCP configuration files that can expose source control, ticketing, databases, cloud resources, and sensitive project context for follow-on fraud. Many stealers add targets via remotely managed rules, meaning this is an adaptation of existing infostealers rather than a new vulnerability in the AI tools themselves.

Cyber Security News·updated Sep 9, 14:23 UTC · 6d ago·first Sep 9, 11:41 UTC · 6d agoMalware in the wild 2 sources2

Saving Jet Fuel

Tutorial optimizes flight paths to cut jet fuel costs using open-source Scikit-decide planning framework and OpenAP aircraft performance models.

A technical walkthrough demonstrates wind-aware flight path optimization using Scikit-decide, an open-source framework for reinforcement learning and automated planning, paired with OpenAP fuel-consumption models built by Dr. Junzi Sun at TU Delft and NOAA wind data. A Boeing 787-9 flying EWR to FCO can require roughly $68K in fuel, and adjusted routing could save thousands. The post uses Python 3.12, DuckDB with spatial extensions, and QGIS for map rendering.

Hacker News · AI·Sep 15, 23:17 UTC · 10h agoAI tools & infraHN 45↑ · 19 comments

Top 10 Best Enterprise Browsers in 2026

2026 enterprise browser guide ranks Island first and notes Mammoth Cyber's wind-down plus corrections to standard vendor shortlists.

An editorial guide assesses ten enterprise browser options, ranking category creator Island first for last-mile DLP and BYOD controls, followed by Palo Alto's Talon browser as a Prisma Access/SASE surface and Google Chrome Enterprise Premium for DLP on already-deployed browsers. It corrects common lists, noting SlashNext is browser-adjacent phishing and BEC defense rather than a managed browser, and that Mammoth Cyber has wound down independent operations. Microsoft Edge for Business is positioned as effectively free policy depth for Microsoft 365 estates, with Menlo Security offering an isolation-plus-browser blend.

Cyber Security News·Sep 11, 07:07 UTC · 5d agoIndustry1

BGP Role model: tracking the adoption of RFC 9234

Cloudflare measured RFC 9234 adoption, finding BGP Role deployment growing but two Tier 1 networks unexpectedly stripping the Only to Customer attribute.

Cloudflare analyzed adoption of RFC 9234, which introduces BGP Roles and the Only to Customer (OTC) attribute allowing routers to reject route leaks on their own. The measurement study assessed who has deployed the mechanism in the global routing table. It found two Tier 1 networks unexpectedly stripping OTC attributes, which could undermine leak protection.

Cloudflare Blog·Aug 18, 15:21 UTC · 28d agoResearch

ENISA: Frontier AI Is Changing the Speed of Cyberattacks. Europe Needs to Catch Up

ENISA warns frontier AI compresses attack lifecycles to minutes, with exploits possible within 15 minutes of disclosure and median 72-minute breach-to-exfiltration times.

ENISA's July 2026 paper 'ENISA's view on Cybersecurity in the Frontier AI Era' argues AI-assisted attackers may weaponize vulnerabilities within 15 minutes of disclosure and achieve initial-access-to-data-exfiltration in a median 72 minutes, creating a 'negative time-to-exploit' problem. The report cites one organisation whose CVE volume rose from roughly 80 in Q1 2025 to almost 500 in Q1 2026, then about 500 reports per day when frontier-AI tools were used. ENISA recommends machine-speed defence under 'Cybersecurity as Code', EPSS and VEX-based prioritisation, AI-assisted incident response with human oversight, and an assume-breached architecture.

Security Affairs·Sep 14, 20:35 UTC · 1d agoAdvisory

Trends in Web Threats in CY Q2 2022: Malicious JavaScript Downloaders Are Evolving

Unit 42 detected 751,000 landing URL incidents in Q2 2022 and documented malicious JavaScript downloaders evolving to evade detection.

Unit 42 detected 751,331 landing URL incidents (253,644 unique) and 1,744,629 malicious host URL incidents (256,844 unique) from April through June 2022. Total landing URL incidents rose compared with Q1 2022, and unique host URL incidents grew 42%, indicating attackers deploying more variants. The report includes a case study of a JavaScript downloader campaign demonstrating new evasion techniques. Personal sites, blogs, and business sites were the top apparently benign entry points.

Palo Alto Unit 42·Aug 17, 13:05 UTC · 29d agoResearch

Viral AI assistant Instinct now has its own email address

AI assistant Instinct, valued at $2.5 billion, is giving every agent its own email address to autonomously create accounts and complete tasks.

Instinct, the AI assistant founded by Noah Shinn and valued at $2.5 billion, now provisions dedicated email addresses so the agent can sign up for services, contact businesses, and manage accounts autonomously. Users can also forward emails such as order confirmations so Instinct can handle tasks like product returns and join group threads to track decisions. The feature follows recent partnerships with 1Password for logins and Stripe for payments, plus a new location-sharing capability.

TechCrunch · AI·Sep 9, 15:13 UTC · 6d agoAI industry

Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems

Unit 42 built an ML-based detector for malicious traffic distribution systems, finding malicious TDS chains average longer redirections and more URLs than legitimate ones.

Traffic distribution systems redirect victims through chains of intermediate domains to hide final destinations, serving phishing, malvertising, and online gambling operations. Unit 42's topological analysis of redirection graphs found malicious TDS traffic uses longer chains (about 25% exceed four hops vs 10% benign), more URLs (median 126 vs 80), and fewer isolated subgraphs with higher connectivity. These features power an ML detector integrated into Advanced DNS Security and Advanced URL Filtering to identify and block malicious TDS infrastructure in customer traffic.

Palo Alto Unit 42·Aug 17, 12:46 UTC · 29d agoResearch

Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE

Check Point patched two 9.8-rated VPN certificate flaws, CVE-2026-85102 and CVE-2026-85103, enabling unauthenticated remote code execution; no exploitation observed yet.

Check Point disclosed and began patching two critical (CVSS 9.8) vulnerabilities in VPN certificate handling on September 9: CVE-2026-85102, a certificate trust validation failure in VPN negotiation on Security Gateways, and CVE-2026-85103, a heap-based buffer overflow in ASN.1 decoding affecting Quantum Security Gateways and Security Management Server. Affected branches include R81.20, R82, and R82.10 Jumbo Hotfix levels; fixes ship via Live Patch or the latest Jumbo Hotfix. The company found both internally and reports no evidence of exploitation; the Canadian Centre for Cyber Security also published an advisory listing Spark firewalls.

The Hacker News·updated Sep 14, 09:43 UTC · 2d ago·first Sep 10, 11:45 UTC · 5d agoVulnerability 9 sourcesCVE-2026-85102CVE-2026-85103CVE-2026-50751+1 CVEs

Attackers Use Multi-Hop Google Redirects for Phishing Campaign

Threat actors chain multiple legitimate Google service redirects to evade detection and deliver credential harvesting or ScreenConnect remote access tooling.

Threat actors are abusing multiple legitimate Google services to build multi-hop redirect chains that obscure the final destination and bypass reputation-based filtering. The campaign culminates in credential harvesting pages or silent installation of the ScreenConnect remote access tool. Defenders should watch for links that traverse trusted Google domains before landing on malicious endpoints.

Dark Reading·Sep 8, 21:03 UTC · 7d agoPhishing & fraud in the wild

RegionFed: Federated Learning for Personalized Query Understanding in Heterogeneous Retail Environments

RegionFed is a gradient-level federated learning framework enabling personalized retail query understanding while matching centralized accuracy with differential privacy.

RegionFed is an architecture-robust federated learning framework for personalized query understanding that operates at the gradient level, using the l2 conflict between regional and global gradients to diagnose heterogeneity and control personalization. Existing parameter-level personalized FL methods collapse on transformers, falling below 10% accuracy on T5, while RegionFed deploys unchanged on T5-Small, T5-3B, RoBERTa, and CNNs. RegionFed-Meta achieves 92.27% across Amazon ESCI, Amazon Reviews, and LEAF-FEMNIST, within 0.23 percentage points of the centralized upper bound, with epsilon-approx-0.60 differential privacy.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 17:50 UTC · 11d agoAI research1

How Fragile Is Safety Alignment at Frontier Scale? A Single-Direction Attack on a 320B MoE

Researchers show directional ablation breaks refusal in GLM-5.3-Flash, a 320B-parameter MoE, cutting refusal by 41–89 points across seven benchmarks.

The study extends directional ablation, a white-box attack that removes an aligned LLM's refusal behavior, from dense models up to ~70B parameters to GLM-5.3-Flash, a 320B-parameter mixture-of-experts model with 288 routed experts, four-wide hyper-connection residual, and block-FP8 quantization. Editing attention, dense, and routed-expert writers jointly removes 0.776 of refusal, with 74% of the effect existing only under the joint intervention; the conventional module-name-based recipe reaches only 0.066 and fails silently on MoE architectures. The attack yields 41–89 percentage-point reductions in refusal across seven harmful benchmarks with no detected capability change, and a category-concentrated refusal residue survives all edits at ranks 1 to 12.

arXiv cs.CR·Sep 9, 06:48 UTC · 7d agoAI safety & security

British ‘Com’ member who abused more than 100 girls worldwide jailed for two years

The Record·Aug 10, 13:54 UTC · Aug 10, 2026Ransomware