42
Metasploit Wrap Up: Lot of summer shells and fit http profiles
Metasploit 6.5 ships 13 new modules including RCEs for SonicWall SMA1000, Ghost CMS, Joomla JCE and Langflow, plus a Linux kernel LPE.
Rapid7's Metasploit wrap-up covers the 6.5 release, which adds 13 new modules, including remote code execution exploits for WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard and a Pix-for-WooCommerce plugin. The Fragnesia Linux kernel local privilege escalation (CVE-2026-46300) also landed. The release introduces HTTP malleable profiles, MCP functionality, Linux multi-fetch payloads and improved Windows on ARM support.
32
30
Scytale expands vendor risk management with AI-powered TPRM tools
Scytale launched AI-powered third-party risk management in its Vendors module, automating vendor discovery, risk scoring, and continuous vendor posture monitoring.
Scytale added AI-driven TPRM capabilities to its Vendors module, combining automatic vendor discovery from SSO providers and integrations with AI enrichment and dynamic risk scoring. The platform now continuously monitors vendors for breaches, data exposures, and vulnerabilities via third-party intelligence APIs, with proactive email notifications and auto-generated audit-ready security reports. It integrates with cross-framework control mapping for SOC 2, ISO 27001, GDPR, HIPAA, and SOX ITGC. Scytale cites Verizon's 2026 DBIR, which found 48% of breaches involved a third party, up 60% year over year.
20
Recorded Future Launches Digital Risk Protection, Unifying Brand and Identity Monitoring
Recorded Future launched Digital Risk Protection, unifying brand and identity monitoring across five external threat surfaces in one workflow.
Recorded Future announced Digital Risk Protection, combining brand threat monitoring and identity exposure monitoring across five use cases: malicious site, impersonation, code repository, dark web brand, and identity exposure monitoring. The platform includes an AI Triage Agent that automates alert evaluation with explicit verdicts and context, expanding social media analysis, OCR, full Telegram coverage, and infostealer log ingestion. Gartner's 2026 Magic Quadrant folded digital risk protection into cyber threat intelligence technologies, and the launch cites $15.9 billion in 2025 US fraud/scam losses, up 28% year over year.
52
30
55
12 Best Enterprise Browsers Compared (2026): Features & Pricing
2026 comparison of twelve enterprise browsers ranks Island and Palo Alto Talon as purpose-built leaders, with Chrome Enterprise and Edge free or bundled.
Guide compares twelve enterprise browser options across three models: purpose-built secure browsers (Island, Talon, Surf), layered controls on existing browsers (Chrome Enterprise, Edge for Business, LayerX, Seraphic), and streamed/isolated browsers (Kasm). Island and Palo Alto's Prisma Access Browser lead the purpose-built category for BYOD and contractor DLP. It also notes Mammoth Cyber has ceased operations.
12
Permify: Open-source authorization as a service
Help Net Security profiles Permify, an open-source Zanzibar-style authorization service supporting RBAC, ABAC, and relationship-based rules with multi-tenant deployments.
Permify is an open-source authorization-as-a-service project modeled on Google Zanzibar that centralizes access-control decisions outside application code. It supports role-based, relationship-based, and attribute-based access rules, answers checks in tens of milliseconds via REST and gRPC, and runs from a single Docker command. It is a CNCF member and is freely available on GitHub.
15
Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)
A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.
Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.
14
Android 17 adds new protections against sneaky Wi-Fi tracking and web snooping
Android 17 adds Encrypted Client Hello, Local Network Protection, default Certificate Transparency and operator-controlled 2G disabling to counter Wi-Fi tracking and snooping.
Google announced network security changes in Android 17, led by broad support for Encrypted Client Hello (ECH), which encrypts domain names visible to network operators and eavesdroppers, paired with GREASE decoys where server support is uneven. Jigsaw testing across the top 10,000 domains and 740 ISPs in 202 countries found connection success and interference levels comparable to ordinary TLS. Android 17 also adds Local Network Protection requiring app permission to scan local devices, Certificate Transparency on by default to catch forged certificates, and operator-side 2G disabling to cut exposure to SMS blaster fake base stations. Apps targeting Android 17 get ECH by default via networking libraries such as OkHttp, WebView and HttpEngine.
52
Signal's new security feature checks if your encrypted chats were tampered with
Signal adds automatic key verification, a key-transparency system audited by Cloudflare and Trail of Bits that detects key-directory tampering in E2EE chats.
Signal launched automatic key verification, a key-transparency system that confirms a phone number or username remains bound to a consistent encryption key across Signal's key directory. Cloudflare and Trail of Bits independently audit the system, with cryptographic protection preventing auditors from seeing users' identifiers in plaintext. The feature mitigates key substitution by a compromised directory or privileged insider, though it currently requires the contact's phone number and users can fall back to manual Safety Number verification.
45
30
30
30
55
30
30
42
30
55
ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Response
ANY.RUN integrates its interactive sandbox, IOC lookups, and STIX/TAXII threat feeds natively into SentinelOne for faster automated malware triage.
ANY.RUN and SentinelOne launched connectors that embed interactive sandbox analysis and threat intelligence into the SentinelOne console via Singularity Hyperautomation. Suspicious files and URLs from alerts are automatically submitted to the ANY.RUN sandbox, with behavioral verdicts and risk scores returned into alert notes. On-demand IOC lookups draw on sandbox history from 16,000 organizations and 700,000 analysts. A separate STIX/TAXII feed streams verified malicious IPs, domains, and URLs through the SentinelOne Marketplace TAXII Connect app.
25
UltraViolet Cyber Equinox measures detection coverage against MITRE frameworks
UltraViolet Cyber launches Equinox, an AI-automated platform mapping SIEM and EDR detection coverage against MITRE ATT&CK and ATLAS frameworks.
UltraViolet Cyber announced Equinox, a detection engineering platform from its TIDE team that maps existing detections and log sources against MITRE ATT&CK and MITRE ATLAS. It performs coverage analysis in under 30 minutes and recommends vendor or custom detections to fill gaps, with engineers reviewing and backtesting each recommendation. In one customer trial, mapped technique coverage rose from 59 of 222 techniques (26.6%) to 136 of 222 (61.3%) without increasing alert volume.
25
Introducing automatic remediation policies with Cloudflare CASB
Cloudflare CASB now offers automatic remediation policies that revoke risky SaaS file shares or trigger webhooks within five minutes of detection.
Cloudflare introduced automatic remediation policies for its CASB product, letting security teams define event-driven logic that revokes risky file shares, dispatches custom webhooks, or forwards findings to SOAR platforms without manual intervention. Native remediation actions currently support Microsoft and Google Workspace file and folder findings, with a target of completing remediation within five minutes of detection. The engine is built on the Cloudflare developer platform, using Cloudflare Queues, Workers and Workflows for durable execution with automatic retries and rate-limit backoff.
30
Cyble Introduces Major Upgrade to its Executive Monitoring Module
Cyble upgraded Executive Monitoring in Cyble Vision, unifying impersonation, exposure, and mention findings with AI scoring and multi-channel alerting.
Cyble released a major upgrade to Executive Monitoring within its Cyble Vision platform, consolidating Mentions, Impersonations, Exposures, and a new Surface Mentions source (blog and news coverage) into a single findings stream. The release adds AI-generated verdicts and recommendations, per-executive Risk and Reputation scoring for board reporting, and richer onboarding with aliases, reference images, and addresses to cut same-name false positives. Alerting now supports data residency, bulk import, delivery via email, WhatsApp, and SMS, an Access API, and branded executive PDF reports; the upgrade is live with no customer action required.
15
Hillingar - MirageOS Unikernels on NixOS
A technical write-up details Hillingar, enabling reproducible Nix-based builds and NixOS deployment of MirageOS OCaml unikernels such as authoritative DNS servers.
This blog post (published December 2022, updated February 2025) describes Hillingar, work from the author's master's thesis enabling reproducible builds and deployments of MirageOS OCaml unikernels using Nix and a custom NixOS module, demonstrated with an authoritative DNS server. MirageOS unikernels embed application and low-level OS code in a single kernel, allowing dead-code elimination that reduces attack surface and improves efficiency. The post covers challenges such as solving opam dependency version constraints when linking a single dependency set.
25
Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models
Cloudflare launches invitation-only Vulnerability Discovery and Remediation within Managed Defense, using OpenAI Daybreak models and WAF context to prioritize and patch vulnerabilities.
Cloudflare announced early access to Vulnerability Discovery and Remediation, an invitation-only service within Cloudflare Managed Defense. The service uses OpenAI Daybreak models, including GPT-5.6 Cyber, via the Daybreak Defense Network to hunt and validate vulnerabilities in customer-authorized codebases across Workers and proxied applications. Findings are prioritized using production traffic, WAF rule, and security event context, and proposed patches and WAF mitigations are automatically checked before customer review.
50
RightCrowd Pass unifies mobile, physical, and biometric credentials
RightCrowd launched Pass, a credentialing platform unifying mobile, physical, and biometric access credentials, cutting credential revocation from 12.2 minutes to under 60 seconds.
RightCrowd announced Pass, a solution that issues and manages mobile, physical, and biometric access credentials from a single platform instead of fragmented badge programs. Mobile credentials are provisioned through a web-based API and can be suspended or revoked individually or in groups in under 60 seconds, versus an average 12.2 minutes for handling a lost or damaged physical badge. Each mobile credential is tied to a device via two-factor authentication, works with HID, Wavelynx, and LEGIC infrastructure, and counts toward LEED and BREEAM sustainability credits. The product is available now to new and existing customers and can be added to current RightCrowd SmartAccess deployments.
20
New TCG guidance gives buyers a way to test PQC-ready TPM claims
Trusted Computing Group published PTP 1.07-based requirements defining PQC-ready and PQC-upgradable TPM designations to guide buyers assessing quantum-safe hardware.
The Trusted Computing Group published requirements establishing PTP 1.07, based on TPM 2.0 Library Specification Version 1.85, as the baseline for a 'TCG PQC-ready TPM', and defined a second designation, 'TCG PQC-upgradable TPM', for chips that can be upgraded to that support. The guidance lets buyers request vendor evidence that TPMs meet end-to-end post-quantum requirements for identities, attestation, and hardware-anchored trust rather than single-algorithm compliance. TCG also announced plans to extend its certification programs to certify TPMs meeting PTP 1.07, noting that 90% of businesses still lack a formal PQC roadmap.
20
CBTS brings continuous penetration testing to enterprise security
CBTS launched Penetration Testing as a Service built on Horizon3.ai's NodeZero, combining autonomous pentesting with expert review for continuous validation.
CBTS announced PTaaS, a service that runs recurring autonomous penetration tests powered by Horizon3.ai's NodeZero across cloud, SaaS, identity, and AI environments, with CBTS experts reviewing findings for exploitability and remediation guidance. The service supports daily-to-quarterly cadences and aims to support Continuous Threat Exposure Management (CTEM) programs. It cites Verizon's 2026 DBIR finding that re-exploitation likelihood drops roughly 30 days after last observed exploitation.
27
55
55
30
30
30
30
30
30
55
55