30
Citrix UniconOS dual boot turns Windows endpoints into their own recovery device
Citrix released UniconOS dual boot in Release 7 2607, turning Windows endpoints into self-recovery devices after ransomware, failed updates or OS corruption.
Citrix announced dual boot in UniconOS Release 7 2607, which installs an isolated, hardened recovery environment alongside Windows in a separate partition protected by secure boot. If Windows is unavailable, users reboot into UniconOS and reconnect to applications via Citrix DaaS and SecurAccess with Chrome Enterprise. The capability is aimed at reducing reliance on spare hardware and central reimaging during ransomware or update failures, with automatic enrollment in UniconOS Management for fleet-wide boot policies.
25
Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot
Check Point revealed BTR Reforged, a technique weaponizing Microsoft Defender's built-in BTR.sys driver to delete security software at boot without exploiting any vulnerability.
Check Point Research disclosed BTR Reforged, a technique that abuses BTR.sys, a legitimately signed Windows Defender boot-time remediation driver, to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2 without exploiting a software flaw. The BTR_CLI proof-of-concept tool, presented at Black Hat USA 2026 and DEF CON 34, installs the driver via direct registry writes and executes deletions during the boot-time 'golden window' before Defender's user-mode services start, demonstrated by deleting the full Defender stack on a patched Windows 11 machine. Exploitation requires SeLoadDriverPrivilege; Microsoft confirmed it does not meet criteria for immediate servicing and no patch is planned. No evidence of real-world abuse was found, and related indicators of compromise via Sysmon events were published.
58
30
BleachBit 6.0.4 fixes secure wiping that skipped clusters on Windows
BleachBit 6.0.4 fixes Windows secure-wipe bugs that skipped fragmented-file clusters, adds HSTS tracker deletion, early macOS support, and broad hardening.
The open-source cleaner BleachBit released version 6.0.4, fixing Windows shredding bugs where fragmented files were wiped incompletely because noncontiguous clusters were skipped, leaving potentially sensitive data on disk. The release adds deletion of dynamic HSTS tracking data in six Chromium-based browsers and Zen, early macOS support including a Safari cleaner and full CLI, plus hardening such as absolute paths for ipconfig/taskkill, symlink and reparse-point handling, DTD-free XML parsing, and PATH/environment sanitization when running as root.
26
30
30
55
30
30
30
42
30
30
30
55
30
30
30
Metasploit Wrap Up: This One Goes to Sixteen!
Metasploit adds 16 modules including 10 exploits, five covering CISA KEV vulnerabilities in Cisco, SonicWall, PaperCut, JetBrains and Langflow.
Rapid7's weekly Metasploit update ships 16 new modules, 10 of them exploit modules, with five targeting CISA KEV entries. New exploits cover Cisco Secure Firewall Management Center auth bypass (CVE-2026-20079), a SonicWall SMA1000 SSRF-to-root RCE chain (CVE-2026-83548/CVE-2026-83549), JetBrains TeamCity deserialization RCE (CVE-2026-63077), PaperCut NG/MF chain (CVE-2026-81578/CVE-2026-82078), and Langflow authenticated RCE (CVE-2026-19295). The SonicWall and PaperCut chains were reported as actively exploited zero-days, and a new ESC8 relay module exploits CVE-2026-20929 against AD CS Web Enrollment.
48
30
30
30
30
30
30
30
Credentialed Pre-Port Discovery: Don't Probe the Host, Ask it
Rapid7's version 8.58 adds credentialed pre-port discovery, letting scan engines query hosts for listening TCP/UDP ports instead of network probing.
Rapid7 documents credentialed pre-port discovery, available from version 8.58 as an off-by-default per-template option under Asset Discovery. The scan engine authenticates with existing SSH, Scan Assistant, or Windows credentials and receives the host's authoritative list of listening TCP and UDP ports, skipping the network port scan. Hosts without matching credentials silently fall back to network port scanning. Trade-offs include reporting firewall-blocked ports the engine cannot reach, longer scans, and early termination findings caused by repeated connection failures.
20
55
30
30
30
30
Introducing automatic remediation policies with Cloudflare CASB
Cloudflare CASB now offers automatic remediation policies that revoke risky SaaS file shares or trigger webhooks within five minutes of detection.
Cloudflare introduced automatic remediation policies for its CASB product, letting security teams define event-driven logic that revokes risky file shares, dispatches custom webhooks, or forwards findings to SOAR platforms without manual intervention. Native remediation actions currently support Microsoft and Google Workspace file and folder findings, with a target of completing remediation within five minutes of detection. The engine is built on the Cloudflare developer platform, using Cloudflare Queues, Workers and Workflows for durable execution with automatic retries and rate-limit backoff.
30
OpenSSL’s new alpha build speeds up post-quantum crypto
OpenSSL 4.1.0 alpha1 adds DTLS 1.3 support and speeds up ML-DSA and ML-KEM post-quantum operations across several architectures.
The OpenSSL project released the first alpha of OpenSSL 4.1.0, months before general availability. The build adds DTLS 1.3 (RFC 9147) to secure UDP-based traffic such as VPNs, video calls and IoT, and includes optimized ML-DSA and ML-KEM operations for ppc64le, s390x and x86_64 plus AVX-512 acceleration for SHAKE hashing and AES-CBC decryption. Breaking changes include a new Net::Curl::Easy dependency for tsget, dropped Windows-on-Itanium and Windows CE support, and replacement of the no-ecdsa/no-ecdh Configure options with no-ec. It also adds GREASE support (RFC 8701), a DTLS mode for the SSL listener API, IKEv2 KDF support, and initial Elbrus2000 processor architecture support.
40
This Key Will Self-Destruct: An Open Standard for Revocable API Keys
SecurityWeek opinion piece proposes ORKS, an open standard adding issuer prefixes, discovery files, and unauthenticated revocation endpoints to make leaked API keys quickly revocable.
The article argues that plain API keys leak frequently yet lack any standardized revocation mechanism, unlike OAuth tokens which gained RFC 7009 revocation in 2013, and that GitHub's Secret Scanning Partner Program solves this only in a proprietary, invite-only way. The author proposes ORKS (Open Revocable Key Standard), with a draft spec on GitHub, built on four parts: keys embedding their issuer domain in a fixed prefix format, a discoverable /.well-known/api-key-config JSON file, unauthenticated revocation by possession of the full key, and declared constraints such as IP allowlists, expiry, scopes, and mTLS. An optional quarantine mode inspired by Toyota's andon cord restricts a reported key to read-only and throttled operation for a default 24-hour window before automatic revocation. The piece frames AI agents as making this urgent, since agents hold many credentials, can exfiltrate them via prompt injection, and can leak secrets into logs at machine speed.
30
Mars Security Debuts Automated Threat Engine Processing Live Cyber Intelligence Into Validated Rules Within Minutes
Mars Security launches Real-Time Intel-Based Detection, converting threat intelligence advisories into validated, ATT&CK-mapped detection rules within minutes for SOCs.
Mars Security, an autonomous threat hunting and detection engineering platform founded by former offensive security operators, announced Real-Time Intel-Based Detection. The capability ingests advisories from sources like CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence, maps indicators to MITRE ATT&CK, and authors native query logic across connected infrastructure including CrowdStrike Falcon, Wiz, Splunk, Sysmon, identity providers, Snowflake, and Databricks. Every rule is backtested against 30 days of historical telemetry to quantify false positives before analyst approval and one-click deployment. The feature is free for existing customers and available via AWS Marketplace.
22
Release Notes: Faster TI Investigations, Fresh Threat Research, and 650+ Threat Coverage Updates
ANY.RUN August release adds TI Lookup connections view, 81 behavior signatures, 16 YARA rules, 559 Suricata rules, and three new threat intelligence reports.
ANY.RUN released August product updates expanding its Threat Intelligence Lookup with a Connections block for pivoting between related observables (domains, IPs, URLs), JSON export for retrohunting and SIEM/NDR integration, and hidden whitelisted data by default. Detection coverage grew with 81 new behavior signatures, 16 YARA rules, and 559 Suricata rules covering malware execution, phishing, and C2 traffic. Three new Threat Intelligence Reports cover a US-focused RMM phishing campaign across 46 countries, the Mirage2FA phishing-as-a-service targeting Microsoft 365 (1,249 sandbox sessions, 9,332 potential compromise events), and a threat brief on OVERLORD RAT, CRPX0, and TRIBACK loader.
28
42
30