Search: “enterprise servers”

Apple reportedly building server packed with M-series Ultra chips for AI

Apple is reportedly developing an enterprise AI server with two or four future M8 Ultra chips, targeting a 2029 release.

According to The Information, Apple is working on an AI server built around its M-series Ultra chips, in configurations with two or four future M8 Ultra chips. The project, which reportedly received support from new CEO John Ternus, would be Apple's first server product in nearly two decades. Surging sales of Mac mini and Mac Studio to AI developers, including purchases by OpenAI and rentals by Anthropic via AWS, reportedly motivated the effort.

Ars Technica · AI·Sep 16, 22:02 UTC · 11h agoAI industry 3 sources

CVE-2026-50522: Microsoft SharePoint Server RCE Vulnerability

CVE-2026-50522 is an unauthenticated .NET deserialization RCE in SharePoint Server Subscription, 2019, and 2016; Microsoft patched it July 14, 2026.

CVE-2026-50522 (CWE-502) lets unauthenticated attackers send crafted serialized .NET payloads to network-accessible SharePoint endpoints, triggering gadget-chain deserialization and remote code execution under the privileged SharePoint service account. It affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016 Enterprise; Microsoft published the advisory on July 14, 2026. The EPSS score is 20.346%, but no public PoC exists and the flaw is not in CISA's KEV catalog at publication. Mitigations include applying Microsoft updates, rotating SharePoint machine keys, enabling AMSI, and restricting internet exposure.

Web discovery (articles for new exploits & KEV entries)·Sep 7, 19:42 UTC · 9d agoVulnerability 3 sourcesCVE-2026-505221

How MCP Servers Can Expose Enterprise Secrets

MCP servers holding AI agent credentials risk secret exposure via plaintext configs, credential sprawl, prompt injection, and over-permissioning; mitigations include centralization and least privilege.

The article examines how Model Context Protocol servers, which hold API keys, tokens, and service-account credentials for AI agents, can leak enterprise secrets. Documented exposure paths include plaintext credentials in config files, ungoverned credential sprawl, prompt injection, over-permissioning, and untrusted third-party servers. It cites CVE-2025-6514 in mcp-remote (400,000+ downloads), where a malicious server triggered OS command injection leading to remote code execution. Recommended mitigations include centralized secret stores, short-lived auto-rotated credentials, least privilege, and human approval for sensitive actions.

The Hacker News·Aug 17, 11:58 UTC · Aug 17, 2026AI safety & securityCVE-2025-6514

Pre-auth RCE in enterprise Java hits Bonita and OFBiz servers

Help Net Security·Aug 5, 00:00 UTC · Aug 5, 2026VulnerabilityCVE-2026-319861

Your enterprise AI footprint is about three times bigger than your model list

Help Net Security·Aug 5, 00:00 UTC · Aug 5, 2026AI safety & security

Windows BitLocker Flaw Lets Attackers Execute Code on Vulnerable Systems

Microsoft patched CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker allowing privileged local attackers to execute code; no exploitation reported.

Microsoft disclosed CVE-2026-69449 on September 8, 2026, an Important-severity heap-based buffer overflow (CWE-122) in Windows BitLocker with a CVSS 3.1 base score of 6.7. The attack vector is local (AV:L) with high privileges required, so exploitation needs privileged local access rather than remote access over the internet. Microsoft, as assigned CNA, has not reported public exploitation, and administrators are urged to inventory BitLocker-enabled systems and apply updates. Interim mitigations include least-privilege access, limiting administrative rights, and monitoring for unexpected elevated process activity.

GBHackers·Sep 9, 10:28 UTC · 7d agoVulnerabilityCVE-2026-694491

Windows BitLocker Vulnerability Allows Attackers to Execute Malicious Code Remotely

Microsoft patched CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker enabling code execution, affecting Windows 10/11 and Server 2012-2025 in September 2026 updates.

Microsoft disclosed CVE-2026-69449, a heap-based buffer overflow in Windows BitLocker rated Important, which could allow an authorized attacker to execute arbitrary code locally, with possible in-network exploitation via arbitrary endpoint calls. Microsoft rates exploitation as Less Likely and there was no public disclosure or in-the-wild exploitation at release. The flaw affects Windows 10 (1607-22H2), Windows 11 (23H2-26H1), and Windows Server 2012 through 2025, including Server Core. Fixes shipped in the September 2026 Patch Tuesday cumulative updates via platform-specific KBs such as KB5124012 and KB5122871.

Cyber Security News·Sep 9, 08:51 UTC · 8d agoVulnerabilityCVE-2026-694491

IBIB: A Protocol for Measuring Enterprise AI Systems by Serving Route, Not Model Identifier

IB2 protocol scores enterprise AI systems by serving route with reliability-inclusive scoring; serving-arm choice moved one score from 77.38 to 82.54.

The protocol has three parts: a gold-blind capability-binding preflight verifying a route can execute the evaluation contract, a reliability-inclusive first-pass scoring rule, and structurally score-blind adjudication. Its reference instantiation uses 128 locked tasks and 987 assertions over document, spreadsheet, chart, tool, and database work, released as procedure and schemas rather than an exposed corpus. Across eleven systems, two complete runs on identical weights later failed distinct binding-gate predicates, four of seven suites saturate within a six-system band driven by governed database work and multi-tab joins, and excluding failed responses from denominators changes the point ordering. Serving-arm choice shifted one declared revision and precision from 77.38 to 82.54, though arms differed in access mode, harness generation, and the tool-call parser.

arXiv cs.AI / cs.LG / cs.CL·Sep 9, 17:31 UTC · 7d agoAI research1

Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE

Rapid7 disclosed CVE-2026-55040, a SharePoint JWT validation bypass chaining into CVE-2026-63520 unauthenticated RCE, with research substantially AI-agent-assisted; patches released.

Rapid7 disclosed CVE-2026-55040 (CVSS 9.1), several JWT validation pipeline issues letting unauthenticated attackers impersonate chosen SharePoint users by SID or UPN, chained with CVE-2026-63520 (CVSS 8.1), an unsafe .NET type instantiation in Business Connectivity Services yielding RCE as the service account. An AI agent contributed significantly across 96 sessions and roughly 80,000 tool calls over 24 active days, though an expert had to steer it and it repeatedly overstepped its threat model. No exploitation of the bypass had been reported as of CISA's July 14 assessment. The RCE affects SharePoint Subscription Edition, 2019, and 2016, plus Project Server 2013 SP1 and Office Web Apps 2013 SP1; the July updates break the chain.

The Hacker News·Aug 11, 16:49 UTC · Aug 11, 2026VulnerabilityCVE-2026-55040CVE-2026-635201

Ping Identity introduces enterprise security for personal AI agents

Ping Identity launched Enterprise Personal Agent Access to discover, authenticate and control personal AI agents like Claude at runtime.

Ping Identity announced Enterprise Personal Agent Access, delivered through PingOne Privilege, to give enterprises visibility and control over personal AI agents such as Claude and Claude Code. The product discovers agents including shadow AI, associates each session with the user and device behind it, and enforces allow, deny, log, human-approval or revocation decisions on agent access at runtime. It enables secretless developer workflows so agents can commit code without long-lived credentials while keeping actions attributable to the agent. Ping cites Gravitee research that 48% of production AI agents run unsecured and says the product is available now and piloting with global enterprises.

Help Net Security·Sep 3, 06:25 UTC · 14d agoAI safety & security

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.

Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.

Microsoft Security Blog·Sep 2, 22:51 UTC · 14d agoThreat actor in the wild

12 Best Enterprise Browsers Compared (2026): Features & Pricing

2026 comparison of twelve enterprise browsers ranks Island and Palo Alto Talon as purpose-built leaders, with Chrome Enterprise and Edge free or bundled.

Guide compares twelve enterprise browser options across three models: purpose-built secure browsers (Island, Talon, Surf), layered controls on existing browsers (Chrome Enterprise, Edge for Business, LayerX, Seraphic), and streamed/isolated browsers (Kasm). Island and Palo Alto's Prisma Access Browser lead the purpose-built category for BYOD and contractor DLP. It also notes Mammoth Cyber has ceased operations.

GBHackers·Sep 15, 06:32 UTC · 2d agoTools1

One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025

Reco tracks the City Forum campaign: one Contabo VPS has scraped Salesforce and ServiceNow guest portals across finance, telecom and public sector since March 2025.

Reco researchers identified infrastructure at 158.220.87.79, a Contabo VPS using Go's default net/http user agent, that has harvested records from Salesforce Experience Cloud and ServiceNow customer portals across telecom, financial services, enterprise software and public sector targets for over a year. The tool abuses over-privileged persistent guest users, enumerating Salesforce Aura sites (560,000+ events at one target), probing Lightning Web Runtime via the UI-API across API versions v56.0-v66.0, and hitting the poorly documented ServiceNow Service Portal search endpoint. No named victims or actor attribution yet, and activity is ongoing with rising volume. Defenders are advised to hunt the Go-http-client user agent and specific IP in Salesforce Event Monitoring logs and syslog_transaction on ServiceNow, then tighten guest sharing rules and Knowledge Base read criteria.

The Hacker News·Aug 18, 11:30 UTC · 29d agoThreat actor in the wild1

From assistance to execution: How enterprises put AI to work

OpenAI reports enterprise adoption patterns of agentic AI through ChatGPT and Codex, with frontier firms pulling ahead in deployment.

OpenAI published a report on how enterprises are moving from AI assistance to autonomous execution, focusing on agentic AI deployments. It highlights the use of ChatGPT and Codex in enterprise workflows and argues that frontier firms are pulling ahead of peers in AI adoption. The piece is adoption research and marketing rather than a security disclosure.

OpenAI News·Aug 12, 06:00 UTC · Aug 12, 2026AI industry1

Apple Rolls Out Massive Security Update Fixing 273 Vulnerabilities Across Its Devices

Apple's coordinated rollout patches 273 unique vulnerabilities across iOS 27, macOS Golden Gate 27, watchOS and Safari, including remote code execution flaws.

Apple shipped one of its largest coordinated security updates on September 14, 2026, fixing 273 unique CVEs across iOS 27, iPadOS 27, macOS Golden Gate 27, watchOS 27, tvOS 27, visionOS 27, Safari 27 and Xcode 27. Highlights include CVE-2026-65414, a Bluetooth out-of-bounds write enabling remote code execution, and CVE-2026-84607, an AVEVideoEncoder race condition granting kernel privileges to sandboxed apps. macOS Golden Gate 27 covers the broadest set with 210 CVEs, and Apple states none of the flaws were exploited in the wild.

Cyber Security News·Sep 15, 15:51 UTC · 1d agoVulnerabilityCVE-2026-65414CVE-2026-84607CVE-2026-64752+7 CVEs1

Top 5 AI Gateways for Enterprise (2026 Guide)

A 2026 buyer's guide ranks NeuralTrust TrustGate, Kong AI Gateway, and Cloudflare AI Gateway as top enterprise AI gateways for security and governance.

The guide evaluates enterprise AI gateways on security, governance, routing, observability, and agent ecosystem support. NeuralTrust TrustGate ranks first for identity-aware agent governance across models, MCP servers, tools, and agent-to-agent traffic, with SaaS, hybrid, and private deployment options. Kong AI Gateway is recommended for organizations with mature API infrastructure, while Cloudflare AI Gateway emphasizes caching, retries, model fallbacks, and prompt/response guardrails.

GBHackers·Sep 11, 16:29 UTC · 5d agoAI tools & infra

SMOKE#SCREEN Campaign Abuses ScreenConnect to Give Attackers Remote Control Access

Security Affairs·Aug 9, 11:05 UTC · Aug 9, 2026Threat actor1

How AI-native companies turn workflows into operating capability

OpenAI highlights Basis, Clay, and Exa Labs using AI agents for onboarding, account management, and developer integrations in enterprise workflows.

An OpenAI news post profiles AI-native companies Basis, Clay, and Exa Labs that use AI agents to improve onboarding, account management, and developer integrations. The piece positions these workflows as operating capability and draws lessons for enterprise leaders. It is promotional case-study content rather than product or research news.

OpenAI News·Sep 1, 17:00 UTC · 15d agoAI industry

Actively Exploited Oracle WebLogic Flaw Lets Unauthenticated Attackers Access Critical Data

CISA added actively exploited Oracle WebLogic flaw CVE-2026-21962 (CVSS 10.0) to its KEV catalog, letting unauthenticated attackers access or modify critical data.

CISA added CVE-2026-21962, a CVSS 10.0 improper access control flaw in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. Oracle shipped patches in January 2026, and GreyNoise, CloudSEK, and SOCRadar have since reported exploitation attempts, including a lone IP scanning multiple WebLogic, Ivanti, GNU InetUtils, and GLPI vulnerabilities. The flaw is also among several exploited by a China-linked actor delivering the SNOWLIGHT downloader to government and commercial infrastructure in more than 100 countries. Federal civilian agencies must apply fixes by August 27, 2026 under BOD 26-04.

The Hacker News·Aug 26, 05:07 UTC · 22d agoExploit / PoC in the wildCVE-2026-21962CVE-2020-14882CVE-2020-14883+2 CVEs1

Thousands of servers can be backdoored by exploiting buggy motherboard controllers

Ars Technica · Security·Aug 5, 22:35 UTC · Aug 5, 2026MalwareCVE-2013-4786

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

Rapid7 disclosed two chained N-able N-central flaws, CVE-2026-86206 and CVE-2026-86207, enabling unauthenticated admin account creation; patched in 2026.3 Hotfix 3.

Rapid7 researchers found CVE-2026-86206 (semicolon/Forwarded access-control bypass, CWE-791, CVSSv4 6.9) and CVE-2026-86207 (UserTwoFactorLogin authentication bypass, CWE-305, CVSSv4 7.7) in the latest N-able N-central. Chained, they let a remote unauthenticated attacker create an attacker-controlled System administrator account. The bugs stem from Envoy and Jetty disagreeing on the requested path and whether the client is local. N-able patched both in N-central 2026.3 Hotfix 3, following the earlier CVE-2026-18577 authentication bypass.

Rapid7 Blog·Sep 8, 11:01 UTC · 8d agoVulnerabilityCVE-2026-86206CVE-2026-86207CVE-2026-18577

Characterizing Network Centralization and Observability in the Remote MCP Ecosystem

A measurement study of 179 remote MCP servers finds heavy infrastructure concentration (HHI 0.736) and a security-observability tradeoff in platform OAuth.

The paper introduces a three-tier observability framework (catalog metadata, passive compliance signals, live vulnerability analysis) applied to a stratified sample of 179 remote Model Context Protocol (MCP) endpoints from two public registries. The Herfindahl-Hirschman Index over ASN distribution is 0.736, well above the 0.25 high-concentration threshold, and 95% of commercial PaaS-hosted servers enforce gateway-level OAuth 2.1 with PKCE. Authentication correlates strongly with hosting platform choice rather than operator configuration, creating a security-observability tradeoff that constrains automated scanning for tool-poisoning vectors without prior credentials.

arXiv cs.CR·Sep 16, 17:31 UTC · 16h agoAI safety & security

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.

Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.

Tenable Blog·Sep 8, 18:07 UTC · 8d agoVulnerability in the wildCVE-2026-81963CVE-2026-858801

An Empirical Security Analysis of Open-Source Software Used in Onboard Satellite Systems

Study of 126 onboard satellite OSS repositories finds 2,827 security findings, 72% medium severity or higher, dominated by memory safety and code quality weaknesses.

Researchers performed an empirical security analysis of 126 public repositories of open-source software used in onboard satellite systems using SBOM generation, software composition analysis, static application security testing, infrastructure-as-code analysis, and secret scanning. After cleaning and deduplication the pipeline produced 2,827 findings, with medium-severity findings accounting for 49% and 72% classified medium or higher. A CWE-based taxonomy mapped all findings to eight weakness families, with Memory Safety and Code Quality dominating, followed by Input Validation and Injection. Project-developed code accounted for 81.4% of findings, though external dependency code remained relevant; findings do not establish mission-specific exploitability.

arXiv cs.CR·Sep 14, 11:54 UTC · 2d agoResearch1

A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months

Reco tracks City-Forum, an actor abusing Salesforce and ServiceNow guest-user access from one IP for 17 months to enumerate portal data.

Reco's City-Forum investigation found one IP address, tied to a dormant 2002 domain, anonymously enumerating Salesforce Experience Cloud and ServiceNow portals across telecoms, banks, enterprise software vendors, and public sector since at least March 2025. No vulnerability was exploited and no credentials were used; the actor abused over-permissioned guest users, including a previously undocumented ServiceNow portal search endpoint, with the busiest single target logging over 560,000 events. Audit logs show what was requested but not which records or fields were returned, so defenders must replay anonymous requests to assess exposure.

Help Net Security·Aug 12, 00:00 UTC · Aug 12, 2026Threat actor

50% of CISOs see Mythos as a sign to exit the profession

Survey of 1,001 US and UK CISOs finds 50% consider leaving the profession amid AI-driven pressure, personal liability concerns and burnout.

A survey of 1,001 CISOs in the US and UK found 50% say Anthropic's Mythos and similar cyber-capable AI models have made them consider exiting the profession, while 60% say board pressure to adopt AI is outpacing their governance capability. Average CISO tenure is cited at 18 months, and 78% worry about personal liability for security incidents, up from 56% a year earlier. Executives from BlackBerry, Databricks and IDC discuss D&O insurance, agentic security operations and phased low-risk AI adoption as partial responses.

CSO Online·Sep 9, 08:25 UTC · 8d agoIndustry

Enterprise Defenses Recovered at the Edge and Collapsed Inside

Picus Labs' Blue Report 2026 finds perimeter prevention at 69% but post-compromise prevention just 37%, with reconnaissance blocked only 10% of the time.

Picus Labs' Blue Report 2026, based on 434,000+ simulated attacks across client production environments in H1 2026, found perimeter prevention effectiveness rose from 62% to 69% while the Post-Compromise Prevention Rate was only 37%. Quiet techniques fared worst: reconnaissance was blocked 10% of the time, registry-based credential access less than 1%, and the alert score stayed at 14% despite logging at a four-year high of 58%. IOC-based prevention fell to 50% from 71% in 2024, and Mimikatz's LSASS path was blocked about 94% while alternative credential-read paths went nearly undetected.

The Hacker News·Aug 12, 11:41 UTC · Aug 12, 2026Research

Exaforce extends its AI security tool to monitor more than just Claude

Exaforce AI Security extends beyond Claude to monitor OpenAI, Gemini, and Copilot agents using existing SOC telemetry, no new endpoint agents.

Exaforce expanded its June Claude Compliance API integration into Exaforce AI Security, adding monitoring for OpenAI, Gemini, Microsoft Copilot, and OAuth-connected AI apps. The tool inventories AI agents by correlating EDR, cloud, SaaS, and model-provider logs without new gateways or endpoint agents, and can respond by revoking sessions, deactivating API keys, isolating devices, or killing agent processes via existing controls. Analysts note the agentless approach lowers friction but lacks runtime inspection and inline blocking offered by competitors such as Palo Alto Prisma AIRS, SentinelOne Prompt AI Agent Security, and CrowdStrike Falcon Guardian. A March 2026 Cloud Security Alliance survey found 68% of organizations cannot distinguish human from AI-agent activity and 74% report AI agents receive excessive access.

CSO Online·Sep 15, 13:00 UTC · 1d agoTools

Show HN: Self-hosted company OS, Claude Code and Codex agents in departments

OtoDock, a self-hosted company OS that organizes Claude Code and Codex AI agents into departments, was launched on GitHub via Show HN.

OtoDock is a self-hosted 'company OS' shared on GitHub through a Show HN post, presenting Claude Code and Codex AI agents organized into department-style teams. The Hacker News feed entry shows the post reached 20 points with 5 comments; no further technical details are provided in the available text.

Hacker News · security·Sep 9, 17:57 UTC · 7d agoAI tools & infraHN 20↑ · 5 comments1

Cloud and SaaS Environments Now Top Targets for Attackers

Infosecurity Magazine·Aug 4, 11:30 UTC · Aug 4, 2026Ransomware

Top 10 Best Enterprise Browsers in 2026

2026 enterprise browser guide ranks Island first and notes Mammoth Cyber's wind-down plus corrections to standard vendor shortlists.

An editorial guide assesses ten enterprise browser options, ranking category creator Island first for last-mile DLP and BYOD controls, followed by Palo Alto's Talon browser as a Prisma Access/SASE surface and Google Chrome Enterprise Premium for DLP on already-deployed browsers. It corrects common lists, noting SlashNext is browser-adjacent phishing and BEC defense rather than a managed browser, and that Mammoth Cyber has wound down independent operations. Microsoft Edge for Business is positioned as effectively free policy depth for Microsoft 365 estates, with Menlo Security offering an isolation-plus-browser blend.

Cyber Security News·Sep 11, 07:07 UTC · 6d agoIndustry1

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

Dutch NCSC warns exploitation is imminent for critical Check Point VPN RCE flaws CVE-2026-85102 and CVE-2026-85103, urging immediate patching of Security Gateways.

The Dutch NCSC assesses the likelihood and impact of exploitation as high for two critical Check Point VPN flaws, though no public PoC exploit has been reported. CVE-2026-85102 is improper validation of certificate data during VPN negotiation, and CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder; both enable remote code execution on Security Gateways, the latter also on Security Management Servers. Affected releases span R81.20, R82, R82.10, R81.10.x, R82.00.x and EoS versions R80 through R81.10, while R82.20 is unaffected. Check Point shipped fixes on September 9 via LivePatch Take 24 and Jumbo Hotfix Accumulator takes, and NCSC advises restricting Site-to-Site VPN rules to trusted IPs.

BleepingComputer·updated 05:23 UTC · 4h ago·first Sep 12, 14:14 UTC · 4d agoVulnerability 9 sourcesCVE-2026-85102CVE-2026-851032

Cortex Cloud Archives

Palo Alto Networks publishes a product category page for Cortex Cloud, an AI and automation platform for cloud and SOC workflows.

This item is a product category archive page for Palo Alto Networks' Cortex Cloud, describing it as an AI and automation-driven platform spanning code to cloud to SOC. The page contains no new research, incident, or product release details beyond marketing language about prioritizing risks and accelerating remediation.

Palo Alto Unit 42·Aug 20, 19:01 UTC · 27d agoIndustry

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

Red Hat patched critical Keycloak flaw CVE-2026-18963 (CVSS 9.1) allowing unauthenticated attackers to take over any account, including administrative ones.

Keycloak and Red Hat patched CVE-2026-18963, a CVSS 9.1 flaw (CWE-640) caused by improper state validation in the reset-credentials flow, letting an unauthenticated remote attacker force a password reset without the emailed action token and achieve full account takeover, including admin accounts. Upstream Keycloak 26.7.2 and Red Hat Build of Keycloak 26.4.15/26.6.6 contain fixes; four RHSA errata were issued August 18, 2026. No evidence of exploitation or public exploits exists as of August 24, 2026; mitigation is disabling the Forgot Password feature in all realms.

The Hacker News·Aug 24, 11:56 UTC · 23d agoVulnerabilityCVE-2026-18963CVE-2026-15571

UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit

Cisco Talos exposes UAT-10147, a Chinese-speaking group using AI tools to automate intrusions, deploy SPECTRE, BadIIS, and rootkits against web servers worldwide.

Cisco Talos detailed UAT-10147, a Chinese-speaking cybercrime group conducting SEO fraud and data theft against Windows and Linux web servers in education, media, technology, and gaming sectors, with most victims in Brazil, Bolivia, China, Canada, and Vietnam. The actor exploits publicly disclosed vulnerabilities for initial access, including Zimbra (CVE-2022-27925) and Alibaba Nacos (CVE-2021-29441), and abuses Linux LPE flaws like CVE-2022-0847 and CVE-2021-3156 for root. Its toolset includes AI-assisted frameworks DeepAudit and PentestGPT, plus implants such as SPECTRE, BadIIS, Quasar RAT, Gh0stCringe, and Noodle RAT. An exposed directory contained a target list of roughly 170,000 URLs, with the US, India, UK, Germany, and Netherlands as top destinations.

The Hacker News·Aug 27, 18:33 UTC · 20d agoThreat actor in the wildCVE-2022-0995CVE-2021-3156CVE-2015-5287+8 CVEs

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business News·Sep 7, 03:42 UTC · 10d agoPhishing & fraud in the wild1

MasterControl Seventeen Every Time

Governed enterprise analytics study shows deterministic policy execution matched 110/110 answer-and-evidence contracts while runtime agent planning matched none.

The paper studies a governed approach where a language model interprets the question while deterministic policy selects and runs a pre-approved analytical program returning results and evidence. Across 440 runs, three 8B models generated SQL and selected tools at runtime, while Qwen3-8B only interpreted intent and policy executed the approved program. None of 330 runtime-planning episodes satisfied the full answer-and-evidence contract, whereas the policy-executed analyzer matched 110 of 110. The authors note this is configuration-specific and expressiveness is preserved via relational operations, aggregation, comparison, windows, ranking, and similarity with replayable results.

Hugging Face daily papers·Sep 1, 20:00 UTC · 15d agoAI research

Top 10 Best Google Cloud (GCP) Security Tools in 2026

An editorial scorecard ranks the top ten Google Cloud security tools for 2026, with Wiz, Sysdig, and Security Command Center leading on correlation, GKE runtime, and native depth.

The roundup evaluates ten GCP security tools across five weighted criteria including GCP-native depth, correlation, runtime protection, multicloud parity, and value. Google Security Command Center is positioned as the included native floor, while Wiz and Sysdig top the weighted scores at 4.50, followed by Prisma Cloud at 4.40. The piece notes Forseti is deprecated and that Lacework is now Fortinet's FortiCNAPP, and flags diligence around Google's acquisition of Wiz. It is an editorial assessment, not a lab test, with pricing compared by model only.

Cyber Security News·08:37 UTC · 58m agoIndustry

AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance

Huntress maps AD RMS architecture and recon paths, setting up an offline key-extraction attack against its unrotatable 255-year root key.

Huntress's multi-part research examines Active Directory Rights Management Services, Microsoft's enterprise DRM role that still ships in Windows Server 2025 despite migration guidance favoring Azure Information Protection. Part 1 covers the trust model and how an ordinary domain account can locate RMS clusters and read rights-policy templates. Part 2 will detail four independent paths for extracting the Server Licensor Certificate (SLC) private key via service-group membership and the configuration database, enabling fully offline decryption of protected documents. The SLC certificate is valid from 2002 to 2258 and has no key-rotation mechanism, so a stolen key decrypts protected content indefinitely.

Huntress·Sep 8, 04:00 UTC · 9d agoResearch1

Cybersecurity jobs available right now: April 14, 2026

Help Net Security lists active cybersecurity job openings at employers including MANTECH, Honeywell, SMBC Group and SBS Transit across multiple countries.

The roundup aggregates cybersecurity vacancies spanning application security, GRC consulting, cyber threat intelligence, digital forensics, SOC analysis and OT security. Openings were posted in India, the United Kingdom, Italy, the USA, Singapore, France, Germany, Ireland and the UAE. Most roles were no longer accepting applications at publication. Named employers include Honeywell, MANTECH, TENEX.AI, Oxford Nanopore Technologies, SMBC Group, SBS Transit and VINCI Energies.

Help Net Security·Aug 26, 09:40 UTC · 21d agoIndustry2