ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Edge”

70 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 1232Industry 1096Malware 673Ransomware 574Exploit / PoC 536Policy & legal 474Data breach 306Threat actor 257AI tools & infra 201Phishing & fraud 189AI industry 106AI safety & security 78AI research 75Research 71
SeverityAllcritical 2746high 931medium 772low 1088info 503

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

SpecterOps released CDP-Enable-BOF, a Beacon Object File that enables Chrome DevTools Protocol in live Chrome or Edge processes on Windows for session hijacking.

SpecterOps released CDP-Enable-BOF, an x64 Beacon Object File that activates Chrome DevTools Protocol inside running chrome.exe or msedge.exe processes on Windows, exposing cookies, history, saved passwords, and authenticated sessions without administrator rights. It calls Chromium's StartRemoteDebuggingServer on the browser UI thread to stay reliable under CFG, TLS, and CET, and was tested on Chrome 147 and Edge 147. The technique builds on work by DeathFlamingo and Cedric Van Bockhaven; Google had hardened remote debugging in Chrome 136 after attackers used it to steal cookies post-App-Bound Encryption. Defenders can watch Sysmon Event IDs 8 and 10 for injection into browser processes.

The Hacker News · 22d agoResearch2

Enterprise Defenses Recovered at the Edge and Collapsed Inside

Picus Labs' Blue Report 2026 finds perimeter prevention at 69% but post-compromise prevention just 37%, with reconnaissance blocked only 10% of the time.

Picus Labs' Blue Report 2026, based on 434,000+ simulated attacks across client production environments in H1 2026, found perimeter prevention effectiveness rose from 62% to 69% while the Post-Compromise Prevention Rate was only 37%. Quiet techniques fared worst: reconnaissance was blocked 10% of the time, registry-based credential access less than 1%, and the alert score stayed at 14% despite logging at a four-year high of 58%. IOC-based prevention fell to 50% from 71% in 2024, and Mimikatz's LSASS path was blocked about 94% while alternative credential-read paths went nearly undetected.

The Hacker News · Aug 12, 2026Research

CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification

Researchers disclosed two DoS attacks exploiting CDNs' HTTP/3-to-HTTP/1.1 translation to amplify low-bandwidth requests up to 350x against origin servers.

Researchers named the two techniques HTTP/3 Bandwidth Amplification (HBA) and HTTP/3 Connection Amplification (HCA), exploiting the gap where CDNs speak HTTP/3 to browsers but only HTTP/1.1 to origins. All six tested CDNs (Alibaba, Baidu, Cloudflare, CloudFront, Fastly, Tencent) were susceptible to HBA, and five to HCA, with Cloudflare immune to HCA because it buffers full requests before opening backend connections. Attackers using under 5 Mbps forced over 100 Mbps at origins, and the 350x factor applies only to Alibaba, Baidu, and Tencent, which support the QPACK dynamic table. Testing identified 42,330 potentially vulnerable subdomains out of 151,685 hosted on the six providers across the Tranco Top 1M.

The Hacker News · 27d agoResearch

Linux Detection Engineering - Local Privilege Escalation

Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.

Elastic Security Labs describes how most Linux local privilege escalations share a common host flow — an unprivileged process launched from a writable path becoming root — and proposes layered detections combining general outcome-based rules with per-technique rules in Elastic Defend and Auditd. It tracks 13 recent LPE disclosures, seven of which share a copy-on-write/zero-copy bug class, including Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, DirtyClone, pedit COW, and RefluXFS. Qualys attributes RefluXFS to an LLM-assisted research effort with Anthropic using Claude Mythos Preview, and another bug is credited to an LLM-assisted workflow. Detection and endpoint rules are published in Elastic's detection-rules and protections-artifacts repositories.

Elastic Security Labs · 5d agoResearch

A First-Principles Evaluation of Graph-Based Network Intrusion Detection Systems

GIDS-Eval framework reveals evaluation gaps in graph-based network intrusion detection; two crafted edges fully evade three detector-dataset pairs.

Researchers introduce GIDS-Eval, a framework decomposing graph-based network intrusion detection systems into six interchangeable stages to enable controlled comparisons. Surveying nine GIDS and reimplementing five, they find two crafted edges achieve full evasion against three of eight detector-dataset pairs, snapshot windows alone cause a mean 38.3% relative swing in average precision, and none of 18 replayed detector-dataset pairs can alert as events arrive. Their encoder-free GIDS-Lite control ranks first by AP on two of four datasets at up to 575x lower runtime.

arXiv cs.CR · 6d agoResearch1

Event-Native Symbolic-Temporal Spike Encoding Framework for Heterogeneous Cyber Streams

An event-native spike encoding framework lets recurrent spiking neural networks run intrusion detection directly on heterogeneous packet and CAN bus streams.

The paper maps heterogeneous cyber events—categorical identifiers, local frequency context, and inter-event timing—directly into sparse spike-compatible inputs for spiking neural networks. This avoids flow aggregation and fixed windows that add buffering latency and obscure temporal structure in traditional IDS pipelines. Compact recurrent SNNs under edge-oriented neuromorphic hardware constraints achieve a hybrid anomaly metric of 0.987 on packet-level Network IDS and 0.980 on message-level CAN IDS.

arXiv cs.CR · 2d agoResearch

Harnessing LLMs for Automating BOLA Detection

Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.

Palo Alto Unit 42 details BOLABuster, a methodology combining large language models with heuristics to automate detection of broken object-level authorization (BOLA) flaws, which traditional fuzzing and static analysis struggle to find. The approach uses LLM reasoning to understand application logic, map endpoint dependency relationships, and generate and interpret test cases. It found CVE-2024-1313 in Grafana, CVE-2024-22278 in Harbor, and 15 CVEs in Easy!Appointments. The team is continuing to hunt for BOLAs in open-source and internal projects.

Palo Alto Unit 42 · Aug 17, 2026ResearchCVE-2024-1313CVE-2024-22278CVE-2023-3285+14 CVEs

338 Million Attack Simulations Reveal The State Of Enterprise Defense

Picus Labs' Blue Report 2026, from 338 million attack simulations, finds defenses strong at the perimeter but blocking only 37% of post-compromise actions.

Picus Labs' fourth annual Blue Report analyzed over 338 million attack simulations from production environments in H1 2026. Average prevention effectiveness rose from 62% to 69%, but only 37% of attacker actions were blocked after compromise, with reconnaissance and credential theft largely missed. IOC-based malware download prevention fell to 50% from 71% in 2024, and Mimikatz credential dumping from LSASS memory was blocked 94% of the time versus 17% from other memory locations and 3% from registry.

Help Net Security · Aug 12, 2026Research

GraphProfiler: Source-Linked Sensitive Attribute Inference via Personal Knowledge Graphs

GraphProfiler links LLM attribute inferences to source posts via personal knowledge graphs, enabling targeted redaction of privacy-leaking content.

GraphProfiler represents a user's post history as a source-linked personal knowledge graph where nodes and edges trace back to originating posts, making LLM-based attribute inference auditable. It reaches 86.7% attack success rate on the eight-attribute SynthPAI benchmark and 84.6% on PANDORA, within two points of strong text-only baselines, while citing supporting evidence for over 98% of predictions. Ablation experiments show removing cited posts reduces attack success substantially more than removing random posts, supporting targeted privacy mitigation.

arXiv cs.CR · 5d agoResearch1

FST Pay: Deterministic Safety-Gated Architecture for Youth Digital Payments

FST Pay proposes a deterministic safety-gated architecture for teen digital payments, pairing invariant authorization checks with decoupled post-settlement AI explanations.

Researchers propose FST Pay, a formal architecture for adolescent digital payments on rails like UPI that applies six deterministic invariant checks (spending limits, guardian co-sign policies, amount thresholds, merchant category codes, temporal intervals, hardware integrity) to classify transactions as ALLOW, REVIEW, or BLOCK. High-risk transactions trigger an asynchronous guardian co-sign workflow. Generative AI is restricted to post-settlement natural-language insights and holds no mutation privileges over the ledger, avoiding non-determinism on the real-time authorization path.

arXiv cs.CR · 6d agoResearch

SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now the Leading Path into the Enterprise

SpyCloud survey of 750 security leaders finds compromised non-human identities are the top enterprise entry point, yet only 36% monitor them.

The 2026 Identity Threat Report surveyed 750 cybersecurity leaders at organizations with 500+ employees across North America and Europe. Compromised non-human identities (31%) were the most cited primary attacker entry point, nearly double phishing (17%), while only 36% of organizations monitor AI agents, service accounts and API keys. 68% of respondents reported identity-based events, averaging eight each, and 91% use AI tools but only 56% have formal governance over their privileges.

GBHackers · 7d agoResearch 2 sources

ResidualAuth: What Authorization State Must Language Agents Preserve under Revocable Delegation?

Formalizes residual authorization state language agents must preserve under revocable delegation; token-budget summaries mostly fail while hard gates stop unauthorized effects.

The paper shows two authorization histories with identical current permissions can require opposite decisions after the same direct-edge revocation, formalizing the needed information as residual authorization state. Exponentially many future-distinct states can share one transitive closure, with exact or tight asymptotic bounds on the state an exact monitor requires. Across four open-weight models, fixed 256-token summaries solved at most 2 of 16 paired episodes while authenticated current-query reads solved 15-16 of 16. A hard effect gate reduced eight observed unauthorized effects to zero without changing preceding attempts.

arXiv cs.CR · 8d agoResearch

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News · 26d agoResearch2

8,539 Reasons To Rethink How Vulnerabilities Get Patched

Rapid7 counted 8,539 high and critical CVEs in Q2 2026, double last year, with PoC availability up 76%.

Rapid7's Q2 2026 Threat Landscape Report tallied 8,539 high- and critical-severity vulnerability disclosures, twice the number recorded in Q2 2025, with newly disclosed flaws having public proof-of-concept code up 76% year over year. Of newly exploited vulnerabilities, 62% were network-exploitable and required neither authentication nor user interaction. Fake CAPTCHA and ClickFix social engineering accounted for 31.8% of incident response cases, the United States recorded 881 listed ransomware victims, and APT28 exploited SOHO routers for DNS hijacking while Iranian groups targeted US industrial control and OT systems.

Help Net Security · 27d agoResearch

Almost Half of Malware Samples Communicate Direct to IP

Unit 42 analysis of 4 million malware reports finds 45% of C2-active samples connect directly to hard-coded IPs, bypassing DNS defenses.

Palo Alto Unit 42 analyzed over 4 million Advanced WildFire dynamic analysis reports and found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, accounting for 23.17% of all C2 connection attempts. The firm proposes zero trust IP (ZT-IP), an enforcement approach that verifies whether outbound destinations were ever sanctioned by a DNS response. ZT-IP analysis surfaced Phorpiex ransomware droppers fetching payloads directly from C2 IPs, a persistent data exfiltration campaign using an obfuscated \GET protocol, and Mozi P2P botnet payloads delivered to IoT devices without DNS. Only 1% of benign samples connected directly to untrusted IP addresses.

Palo Alto Unit 42 · Aug 17, 2026Research