ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “console”

41 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 483Malware 279Ransomware 240Industry 228Exploit / PoC 176Data breach 127Policy & legal 126Threat actor 81Phishing & fraud 71AI tools & infra 64Tools 41AI industry 29AI safety & security 20Research 17
SeverityAllcritical 772high 416medium 362low 277info 183

AWS Console Private Access can block sign-ins to personal accounts

AWS Console Private Access goes GA, letting internet-isolated VPCs reach the console fully over PrivateLink and blocking personal account sign-ins.

AWS Console Private Access became generally available on August 28, allowing the AWS Management Console, sign-in flows, static assets, and console-only APIs to run entirely over PrivateLink endpoints from VPCs with no internet connectivity. Deployment requires three interface endpoints per Region, correct Private DNS and security group settings, and uses aws:PrincipalOrgID policies plus sign-in resource control policies to deny authentication from unexpected networks, which blocks corporate-network users from signing into personal AWS accounts. IAM Identity Center sign-in and consoles for services without PrivateLink support still need internet access, and a misconfigured policy can lock out the whole organization, so AWS recommends an excluded break-glass role; CLI and SDK SigV4 requests bypass these policies and serve as a recovery path.

Help Net Security · 16d agoTools

ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Response

ANY.RUN integrates its interactive sandbox, IOC lookups, and STIX/TAXII threat feeds natively into SentinelOne for faster automated malware triage.

ANY.RUN and SentinelOne launched connectors that embed interactive sandbox analysis and threat intelligence into the SentinelOne console via Singularity Hyperautomation. Suspicious files and URLs from alerts are automatically submitted to the ANY.RUN sandbox, with behavioral verdicts and risk scores returned into alert notes. On-demand IOC lookups draw on sandbox history from 16,000 organizations and 700,000 analysts. A separate STIX/TAXII feed streams verified malicious IPs, domains, and URLs through the SentinelOne Marketplace TAXII Connect app.

ANY.RUN · 4h agoTools

Top 10 Best AWS Security Tools in 2026new

Editorial roundup ranking the ten best AWS security tools of 2026, from native GuardDuty and Security Hub to CNAPPs like Wiz and Prisma Cloud.

The article recommends enabling AWS-native services first: GuardDuty for threat detection, Security Hub for posture aggregation, the free IAM Access Analyzer, plus CloudTrail logging and Config rules. It then reviews third-party platforms including Wiz, Palo Alto Prisma Cloud, CrowdStrike Falcon Cloud Security, Trend Micro Cloud One, and Orca Security. It is an editorial vendor assessment with pricing described by model only, highlighting cross-account correlation and attack-path prioritization as third-party differentiators.

Cyber Security News · 53m agoTools

Top 10 Best Multi-Cloud Security Platforms in 2026new

An editorial roundup of the ten best multi-cloud security platforms for 2026, split between CNAPPs (Wiz, Prisma Cloud) and cloud-networking security (Aviatrix).

The article frames multi-cloud security as two markets: CNAPP platforms (Wiz, Prisma Cloud, CrowdStrike, Orca, Defender) securing what runs in clouds, and cloud-networking-security platforms (Aviatrix) securing how clouds connect. It ranks ten platforms including Palo Alto Prisma Cloud for breadth, Wiz for correlation, Check Point CloudGuard, Fortinet, Aviatrix, Microsoft Defender for Cloud, Trend Micro, and CrowdStrike. It flags the ~$32 billion Google–Wiz acquisition as raising cloud-neutrality questions buyers should address contractually.

Cyber Security News · 59m agoTools

Threat Matrix: Mapping threats across cloud web applications

Microsoft released a Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework mapping threats to cloud-hosted web apps and serverless platforms.

Microsoft introduced the cloud web applications threat matrix, which organizes attack techniques for cloud-hosted web apps and serverless platforms using MITRE ATT&CK tactics, from resource development through impact. The framework covers attack paths spanning application code, managed runtimes, workload identities, and deployment pipelines, cataloging techniques such as subdomain takeover, code injection in connected repositories, compromised registry images, exposed admin interfaces, and serverless trigger injection. It builds on Microsoft's earlier Kubernetes and storage services matrices to help defenders identify visibility gaps, prioritize hardening, and plan investigations in cloud-native environments.

Microsoft Security Blog · 6d agoTools

LastPass enhancements improve visibility, governance, and control

LastPass releases SaaS monitoring enhancements, Mobile Smart Scanner, and auto-enrolled dark web monitoring across its password management products.

LastPass announced enhancements to SaaS Monitoring and SaaS Protect in its Business Max offering, including Persistent Monitoring that keeps visibility active through the browser extension even when users are signed out, fully released as of July. It launched Mobile Smart Scanner to convert printed, handwritten, or screenshot passwords into vault credentials, and began phasing in automatic enrollment of all consumer accounts in dark web monitoring. The company also completed its transition to a Unified Admin Console, added company-wide onboarding links, and passed SOC 2 and ISO 27001/27701 audits with zero findings for the second consecutive year.

Help Net Security · 15d agoTools

Top 10 Best Container Security Tools in 2026

2026 roundup ranks Aqua, Sysdig, Prisma Cloud, Wiz, Snyk and CrowdStrike among the ten best container security tools across build-ship-run.

Buyer's guide compares ten container security products by lifecycle fit: Aqua leads full lifecycle, Sysdig leads runtime detection via Falco and eBPF, Wiz offers agentless graph visibility, Snyk covers developer-first shift-left. It notes Trivy and Falco as free production-grade open-source foundations. The guide argues standalone container security is increasingly absorbed into CNAPP platforms from Palo Alto, Wiz and CrowdStrike.

Cyber Security News · 1d agoTools1

Credentialed Pre-Port Discovery: Don't Probe the Host, Ask it

Rapid7's version 8.58 adds credentialed pre-port discovery, letting scan engines query hosts for listening TCP/UDP ports instead of network probing.

Rapid7 documents credentialed pre-port discovery, available from version 8.58 as an off-by-default per-template option under Asset Discovery. The scan engine authenticates with existing SSH, Scan Assistant, or Windows credentials and receives the host's authoritative list of listening TCP and UDP ports, skipping the network port scan. Hosts without matching credentials silently fall back to network port scanning. Trade-offs include reporting firewall-blocked ports the engine cannot reach, longer scans, and early termination findings caused by repeated connection failures.

Rapid7 Blog · 6d agoTools

Vali Cyber ZeroLock 5 brings MFA to the hypervisor command line

Vali Cyber released ZeroLock 5 adding CLI-MFA to protect VMware ESX and Linux hypervisors from insider threats and stolen credentials.

ZeroLock 5 introduces CLI-MFA, requiring time-based one-time passwords for file access, program execution, and network operations at the hypervisor command line on ESX and Linux hosts. The release targets ransomware and nation-state actor pivots to virtualization infrastructure, exemplified by ShinyHunters' shinysp1d3r RaaS platform that encrypts VMware ESX environments using stolen credentials and SSH keys. It adds remotely deployable collectors, reusable multi-site deployment blueprints, SIEM forwarding presets, and support for VCF and ESX 6.7+.

Help Net Security · 14d agoTools

RightCrowd Pass unifies mobile, physical, and biometric credentials

RightCrowd launched Pass, a credentialing platform unifying mobile, physical, and biometric access credentials, cutting credential revocation from 12.2 minutes to under 60 seconds.

RightCrowd announced Pass, a solution that issues and manages mobile, physical, and biometric access credentials from a single platform instead of fragmented badge programs. Mobile credentials are provisioned through a web-based API and can be suspended or revoked individually or in groups in under 60 seconds, versus an average 12.2 minutes for handling a lost or damaged physical badge. Each mobile credential is tied to a device via two-factor authentication, works with HID, Wavelynx, and LEGIC infrastructure, and counts toward LEED and BREEAM sustainability credits. The product is available now to new and existing customers and can be added to current RightCrowd SmartAccess deployments.

Help Net Security · 21d agoTools

Product showcase: GitGuardian Honeytoken catches credential theft as it happens

GitGuardian now deploys honeytoken decoy AWS credentials across developer fleets via MDM, generating high-fidelity alerts when infostealers test stolen credentials.

GitGuardian extended its honeytoken platform so decoy AWS credentials can deploy fleet-wide to developer laptops through existing MDM tooling, with deleted decoys automatically replaced at the next sync. When a harvester tests a decoy, the platform logs the API call in the controlling AWS account and raises an incident naming the source machine and file, routed via email, Slack, Teams, ServiceNow, or webhooks. The capability responds to infostealers such as Shai-Hulud that scan entire filesystems and validate stolen credentials within seconds. GitGuardian is building decoys for Kubernetes and package registry credentials using random, structure-free identifiers that resist detection.

Help Net Security · 6d agoTools

Proofpoint SOC Analyst Agent Uses OpenAI Cyber Models

Proofpoint launched its SOC Analyst Agent in private preview, using OpenAI Daybreak models to automate security investigations with human-controlled remediation, GA expected end of Q3 2026.

The SOC Analyst Agent uses OpenAI Daybreak cyber models to enable natural-language investigations across Proofpoint alerts, logs, DLP events and user risk signals, and to automate recurring threat hunts, data security investigations and escalation reporting. It is currently in private preview with general availability expected by the end of Q3 2026, and it does not independently make account changes or take remediation actions. Proofpoint joined the OpenAI Daybreak Defense Network in June 2026 and is exploring additional uses for the models in threat research, data security and AI security workflows.

Proofpoint Threat Insight · 7d agoTools

Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)

A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.

Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.

SANS Internet Storm Center · 13d agoTools1

Android 17 adds new protections against sneaky Wi-Fi tracking and web snooping

Android 17 adds Encrypted Client Hello, Local Network Protection, default Certificate Transparency and operator-controlled 2G disabling to counter Wi-Fi tracking and snooping.

Google announced network security changes in Android 17, led by broad support for Encrypted Client Hello (ECH), which encrypts domain names visible to network operators and eavesdroppers, paired with GREASE decoys where server support is uneven. Jigsaw testing across the top 10,000 domains and 740 ISPs in 202 countries found connection success and interference levels comparable to ordinary TLS. Android 17 also adds Local Network Protection requiring app permission to scan local devices, Certificate Transparency on by default to catch forged certificates, and operator-side 2G disabling to cut exposure to SMS blaster fake base stations. Apps targeting Android 17 get ECH by default via networking libraries such as OkHttp, WebView and HttpEngine.

Help Net Security · 19d agoTools

AWS makes it easier to spot firewall rules that have gone quiet

AWS Network Firewall added rule hit counts for stateful rules, letting teams identify unused rules and validate control effectiveness at no added cost.

AWS Network Firewall's rule hit count capability gives security teams visibility into which stateful firewall rules are matching traffic, helping identify unused or redundant rules and validate controls for compliance frameworks like PCI DSS 4.0 and DORA. The feature covers stateful rules in custom and managed rule groups, is enabled by default at no additional Network Firewall cost, and is available in all supported Regions except UAE and Bahrain. Data is surfaced in the Network Firewall dashboard's Top Rule Hits view and can be queried via CloudWatch Logs Insights or Amazon Athena.

Help Net Security · 23d agoTools

Wazuh and AI For Enhanced SOC Workflows

Wazuh details AI-powered SOC workflows via its AI Analyst, self-hosted Llama 3 via Ollama, and Claude 3.5 Haiku integrations.

Wazuh outlines how AI can augment SOC analysts handling high alert volumes. The Wazuh AI Analyst on Wazuh Cloud uses Amazon Bedrock and Anthropic Claude to generate scheduled security posture reports. Self-hosted options include Llama 3 with Ollama, FAISS, and LangChain for privacy-sensitive threat hunting, plus an OpenSearch Assistant integration with Claude 3.5 Haiku. This is a vendor-contributed piece describing product capabilities rather than an incident or vulnerability.

The Hacker News · 25d agoTools