ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “update controller”

99 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 3589Malware 2339Ransomware 1664Exploit / PoC 1315Data breach 667Policy & legal 611Threat actor 557Industry 506Phishing & fraud 333AI safety & security 129Advisory 125AI tools & infra 112Tools 99Research 65
SeverityAllcritical 5366high 3360medium 2256low 874info 388

WordPress Blocks High-Risk Plugin Releases With New AI-Powered Automated Security Review

WordPress.org now runs AI-powered automated security reviews on every plugin release, automatically blocking high-risk updates before distribution to millions of sites.

WordPress launched an automated security review that combines multiple AI models and Jetpack Scan during a six-hour cooldown to score each plugin release; updates above the blocking threshold are automatically held back from the WordPress.org update API. The change follows a July 28 incident where a backdoor added to a plugin with roughly 20,000 active installations was detected during cooldown and never delivered; the Plugins Team removed it 26 minutes after a Wordfence notification. Blocked developers receive an email with findings and are advised to publish a corrected version rather than await manual appeal.

GBHackersupdated · 4d agofirst · 5d agoTools 7 sources1

Product showcase: Doppler secures secrets for humans, pipelines, and AI agents

Doppler's secrets management platform centralizes credentials for engineers, CI/CD pipelines, MCP servers, and AI agents with runtime injection and dynamic secrets.

Doppler stores API keys, database URLs, tokens, and certificates in a single control plane and injects them at runtime, replacing .env files for human and machine identities including AI agents. It supports OIDC with short-lived identity tokens for Azure, AWS, and GCP, dynamic secrets scoped and time-boxed to single sessions, SCIM provisioning, 50+ integrations, and an MCP server that lets agents request configurations natively. Permissions are enforced at each layer so raw secrets stay out of logs, prompts, and model context, with versioning, rollback, SIEM log forwarding, and cloud or on-prem deployment.

Help Net Security · 8d agoTools

New infosec products of the month: August 2026

August 2026 roundup of security product releases from ServiceNow, Tanium, Snyk, F5, A10, Searchlight Cyber, Intezer, NETSCOUT, Tufin, and Abnormal AI.

Help Net Security's monthly product roundup covers roughly a dozen vendors. Highlights include Snyk's general availability of Evo Continuous Offensive Security with AI-powered pentesting and AI agent red teaming, Searchlight Cyber's PTEM platform combining exposure visibility with attacker intelligence, and A10 and F5 AI gateways to govern enterprise LLM and agent usage. Other updates include Abnormal AI email DLP and phishing training, NETSCOUT outbound DDoS mitigation for service providers, Intezer's native Workflows automation, and Tufin's AI-powered Segmentation Intelligence.

Help Net Security · 19d agoTools

Release Notes: Faster TI Investigations, Fresh Threat Research, and 650+ Threat Coverage Updates

ANY.RUN August release adds TI Lookup connections view, 81 behavior signatures, 16 YARA rules, 559 Suricata rules, and three new threat intelligence reports.

ANY.RUN released August product updates expanding its Threat Intelligence Lookup with a Connections block for pivoting between related observables (domains, IPs, URLs), JSON export for retrohunting and SIEM/NDR integration, and hidden whitelisted data by default. Detection coverage grew with 81 new behavior signatures, 16 YARA rules, and 559 Suricata rules covering malware execution, phishing, and C2 traffic. Three new Threat Intelligence Reports cover a US-focused RMM phishing campaign across 46 countries, the Mirage2FA phishing-as-a-service targeting Microsoft 365 (1,249 sandbox sessions, 9,332 potential compromise events), and a threat brief on OVERLORD RAT, CRPX0, and TRIBACK loader.

ANY.RUN · 13d agoTools1

New infosec products of the week: August 21, 2026

Weekly product roundup covering NETSCOUT outbound DDoS mitigation, F5 AI Gateway enhancements, Intezer Workflows, and Tufin TOS 5.3.

NETSCOUT extended Adaptive DDoS Protection to automatically mitigate outbound attack traffic for service providers. F5 enhanced its AI Gateway and integrated it into the F5 AI Security Platform for unified AI access governance. Intezer launched Workflows, native automation and response inside its platform without a separate SOAR, and Tufin released Orchestration Suite 5.3 with AI-powered Segmentation Intelligence for multi-vendor environments.

Help Net Security · 26d agoTools

Product showcase: ScamNet looks for warning signs in suspicious calls and shady links

Synaptrex's ScamNet app filters scam calls, messages and websites on Apple devices using on-device AI and reputation checks.

ScamNet: Anti-Scam Suite from Synaptrex Technologies is a free consumer app (with ScamNet+ subscription) for iPhone, iPad and Mac that blocks robocalls and spam via iOS Call Blocking & Identification, filters unknown senders with an offline detection engine, and provides a Safari extension that analyzes and blocks suspicious websites. A Check/Report tool accepts phone numbers, websites, crypto addresses, text, images and audio, and a Device Shield verifies passcode, OS updates and screen-recording status.

Help Net Security · Aug 17, 2026Tools

Threat Matrix: Mapping threats across cloud web applications

Microsoft released a Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework mapping threats to cloud-hosted web apps and serverless platforms.

Microsoft introduced the cloud web applications threat matrix, which organizes attack techniques for cloud-hosted web apps and serverless platforms using MITRE ATT&CK tactics, from resource development through impact. The framework covers attack paths spanning application code, managed runtimes, workload identities, and deployment pipelines, cataloging techniques such as subdomain takeover, code injection in connected repositories, compromised registry images, exposed admin interfaces, and serverless trigger injection. It builds on Microsoft's earlier Kubernetes and storage services matrices to help defenders identify visibility gaps, prioritize hardening, and plan investigations in cloud-native environments.

Microsoft Security Blog · 6d agoTools

Give every teammate and agent the right level of access to your Workers

Cloudflare launches per-Worker granular access controls with four roles, enabling least-privilege access for teammates, AI agents, and CI/CD pipelines.

Cloudflare announced granular authorization for Workers, letting admins scope access to a single Worker instead of the whole account. Four new roles are available: Metadata Read-Only (observability without source code), Content Read-Only (read code without changes), Editor (deploy without delete), and Admin (full control of one Worker). Roles apply at Developer Platform, product, or resource level, can be attached to dashboard users or API tokens, and are available to all customers now, with plans to extend to D1, R2, and KV.

Cloudflare Blog · 22h agoTools

Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point

Filigran introduces Attack Chaining in OpenAEV to continuously simulate multi-stage attack paths, exposing gaps that isolated MITRE ATT&CK technique testing misses.

Filigran announced Attack Chaining, a new scenario type in its OpenAEV platform that links individual techniques into automated, continuously-run multi-stage attack paths, using each step's real output (credentials, tokens, open ports) to branch dynamically toward a final objective. The article cites Filigran's State of Threat Management report, in which 93% of security leaders reported a business-impacting cyberattack in the past 12 months, 88% said AI accelerates attackers, and 84% blamed siloed tools and disconnected testing. The 2025 DGFiP breach is cited as an example where individually survivable weaknesses chained into a major intrusion. The feature includes conditional chaining logic, live attack path mapping, structured findings for identifying chokepoints, and predefined scope and safety guardrails.

The Hacker News · 1d agoTools

Microsoft Defender's Own Driver Can Be Weaponized to Delete Security Software at Boot

Check Point revealed BTR Reforged, a technique weaponizing Microsoft Defender's built-in BTR.sys driver to delete security software at boot without exploiting any vulnerability.

Check Point Research disclosed BTR Reforged, a technique that abuses BTR.sys, a legitimately signed Windows Defender boot-time remediation driver, to perform arbitrary kernel-level file and registry operations on Windows 7 through Windows 11 25H2 without exploiting a software flaw. The BTR_CLI proof-of-concept tool, presented at Black Hat USA 2026 and DEF CON 34, installs the driver via direct registry writes and executes deletions during the boot-time 'golden window' before Defender's user-mode services start, demonstrated by deleting the full Defender stack on a patched Windows 11 machine. Exploitation requires SeLoadDriverPrivilege; Microsoft confirmed it does not meet criteria for immediate servicing and no patch is planned. No evidence of real-world abuse was found, and related indicators of compromise via Sysmon events were published.

The Hacker News · 25d agoToolsCVE-2021-240921

Superna 2.15 simplifies cyberstorage security and resilience operations

Superna released Cyberstorage platform v2.15 with redesigned ransomware investigation, guided incident closure and disaster recovery workflows.

Superna announced version 2.15 of its Cyberstorage platform, redesigning the user experience across security and resilience operations. The update adds centralized alarm management with severity and device filtering, consolidated threat investigation views showing affected data, snapshots, recovery status and impacted assets, and guided incident classification and closure workflows. It also refreshes Security Guard healthchecks, audit reporting, disaster recovery workflows and Enterprise AirGap isolation across the Data Security and Disaster Recovery editions.

Help Net Security · 13d agoTools

ConnectSecure helps MSPs automate Microsoft 365 security remediation

ConnectSecure launches Microsoft 365 Auto Remediation and AI-powered Training Assessments to help MSPs automate M365 security fixes and compliance training.

ConnectSecure's platform now automates remediation of supported Microsoft 365 security findings through conditional access policies, covering gaps such as missing MFA enforcement, legacy authentication and risky sign-ins. A new AI-assisted Training Assessments module generates, assigns and measures security assessments with configurable difficulty, pass thresholds and multilingual support. The previously announced Patch 360 patch management capability, including pilot-first validation, staged rollouts and rollback, is also now available.

Help Net Security · Aug 12, 2026Tools