Search: “identity security”

96 stories in the last 3d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Industry 21 Exploit / PoC 19 Tools 16 Advisory 16 Phishing & fraud 13 Data breach 11 Vulnerability 9 Research 8 Threat actor 8 Malware 6 Ransomware 2 Policy & legal 2

SeverityAll critical 17 high 24 medium 35 low 1 info 54

What Recent AI-Powered Attacks Mean for Your Identity Security

Commentary on AI-accelerated credential theft cites Google's report of a six-hour multi-agent cloud attack and urges device trust and zero-trust identity controls.

The piece recounts Google Threat Intelligence Group's September 8 report of a credential-harvesting operation where an AI-built multi-agent framework compromised cloud infrastructure and thousands of third-party credentials in under six hours, including automated vulnerability scanning and IP rotation. It also cites Microsoft's April finding that AI-assisted phishing achieved 54% click-through rates versus roughly 12% for traditional campaigns, and Unit 42 data that identity weaknesses featured in 89% of investigated incidents. The article, which promotes Specops Password Auditor and Device Trust, argues successful authentication does not establish device trust and recommends binding identities to approved devices.

BleepingComputerSep 17, 14:01 UTC · 1d agoIndustry in the wild

N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security

N0va phishkit targets US and EU organizations with trusted-brand lures, capturing tokens via legitimate authentication flows to gain SSO access to corporate resources.

The N0va phishing kit targets organizations in government, technology, consulting, and healthcare across North America and Europe with lures impersonating Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign. Victims are guided through legitimate authentication flows, including device code phishing, after which N0va captures access and refresh tokens and abuses token-exchange or device-registration mechanisms to establish SSO access. ANY.RUN tracks the campaign via a characteristic /api/verification/init URL pattern and demonstrates detection in its interactive sandbox.

The Hacker NewsSep 16, 11:58 UTC · 2d agoPhishing & fraud in the wild4

98% of fraudulent hires have company credentials by the time they’re caught

HYPR report finds 98% of fraudulent hires already hold company credentials when detected, exposing an unowned identity-risk gap between hiring and onboarding.

HYPR's State of HR Identity Fraud Detection report says 98% of HR leaders have experienced candidate fraud and that fraudulent hires typically receive corporate credentials and network access before being identified. Third-party security tools detect only 53% of identity-based and AI-driven attacks, and ownership of pre-hire identity risk is undefined during the hiring-to-onboarding transition. Most companies need one to three weeks to resolve a hiring fraud incident, and roughly 60% of identity verification and MFA spending is triggered by a breach rather than proactive investment.

Help Net Security05:00 UTC · 9h agoPhishing & fraud

NIST and CISA finalize playbook to stop token theft and forgery

NIST and CISA finalized NIST IR 8587, a playbook helping federal agencies and cloud providers defend identity tokens against theft and forgery.

The finalized NIST IR 8587 guidance covers protecting token signing keys, verifying tokens, lifetimes, revocation, session management, and dividing security responsibilities between cloud providers and customers. It cites an incident in which foreign actors forged tokens with a stolen commercial signing key to steal more than 60,000 emails from one government agency. It also recommends extending token protections to AI agents and preparing identity systems for a future post-quantum cryptography transition.

Help Net SecuritySep 16, 07:40 UTC · 2d agoAdvisory 2 sources

AI agent authorization risks remain a gap in new NIST-CISA token security guidance

NIST and CISA release IR 8587 guidance on securing signed tokens, but AI agent authorization and delegation risks remain out of scope.

NIST, with CISA support, published 'Protecting Tokens and Assertions from Forgery, Theft, and Misuse' (NIST IR 8587), recommending continuous monitoring and tighter token lifecycle controls for SSO and API access. The guidance does not yet fully address AI agent identity, delegation chains, or prompt injection steering agents with valid tokens, and NIST says new or expanded standards are needed. Experts recommend treating AI agents as low-trust non-human identities, maintaining agent inventories, expiring credentials after task completion, and requiring human approval for high-risk actions. The report references shared-signal mechanisms like CAEP and RISC, and follows a May incident where a CISA contractor GitHub repository exposed AWS and GitHub tokens.

CSO OnlineSep 16, 15:42 UTC · 1d agoAdvisory

Strong fundamentals make next-gen security possible

A former CISO for Hyatt and United Airlines argues foundational controls—asset inventory, identity, resilience—outperform repeatedly buying new security tools.

The author, a former security leader at Hyatt and United Airlines, argues that mastering foundational controls delivers more impact than cycling through expensive new tools. The piece highlights asset discovery with a single source of truth, identity hardening via MFA and passkeys, and risk-based prioritization using frameworks like CIS CSC. It also stresses resilience and recovery planning, including secure backups and regularly practiced incident processes.

CSO Online08:25 UTC · 5h agoIndustry

CISA and NIST Issue Guidance to Protect Cloud Identity Tokens

CISA and NIST published Interagency Report 8587 with voluntary guidance to harden cloud identity tokens against theft, forgery, and lateral movement.

CISA and NIST released NIST Interagency Report 8587 on September 15 with final voluntary guidance for federal agencies, cloud providers, and their customers on protecting SSO, federation, and API tokens. Requirements include one-hour maximum token lifetimes, 90-day signing key rotation for high-impact systems, hardware-backed key storage, explicit audience fields, and keeping tokens out of logs. The guidance was motivated by the 2020 ADFS compromise where forged SAML assertions bypassed MFA, and an incident where a leaked consumer signing key enabled token forgery and theft of 60,000+ emails from one agency. Nearly 250 public comments shaped the text, with input from Google, Microsoft, Okta, AWS, Oracle, IBM, HashiCorp, Wiz, and the OpenID Foundation via the Joint Cyber Defense Collaborative.

Infosecurity MagazineSep 16, 14:00 UTC · 2d agoAdvisory

Hardcoded MCP credentials found in public GitHub files

Hush Security found 12% of 82,000 public GitHub MCP config files contained hardcoded API keys, bearer tokens, and database passwords.

Hush Security's 'The State of MCP Configuration: The Identity Security Gaps' report analyzed roughly 82,000 MCP configuration files in public GitHub repositories, finding that 12% of credential slots contained hardcoded credential literals. Researchers used provider-specific token patterns and Shannon entropy to identify likely secrets, predominantly vendor API keys, bearer tokens, and database passwords. Of 7,681 credential-bearing configurations whose history was examined, 243 had secrets removed from the current file but still recoverable from earlier Git commits. Many exposed credentials were high-impact: 53% of classified credentials granted organization-, account-, workspace-, or database-wide access, and 80% with a defined expiration policy did not expire by default.

Help Net Security05:30 UTC · 8h agoResearch 2 sources

CISA and NIST Release Technical Checklist for Safeguarding Identity Tokens From Theft and Misuse

CISA and NIST published NIST IR 8587, final guidance for protecting identity tokens from forgery, theft, replay, and signing-key compromise.

NIST Interagency Report 8587 (September 15, 2026) expands the IA-13 'Identity Providers and Authorization Servers' control from NIST SP 800-53 R5.1.1, guiding federal agencies and cloud providers on SSO, identity federation, and machine-to-machine authentication. It requires hardware-backed signing-key storage for moderate-impact systems, 90-day key rotation for high-impact systems, token lifetimes under one hour, and sender-constrained mechanisms such as mutual TLS and DPoP. The report cites incidents including forged SAML assertions that exposed over 60,000 emails from a federal agency. It also extends guidance to agentic AI systems using signed tokens and urges post-quantum cryptography migration planning.

Cyber Security NewsSep 15, 17:04 UTC · 2d agoAdvisory1

Revolut Data Leak May Trace Back to Compromised Italian Government Accounts

Attackers using a compromised Italian government PEC account impersonated law enforcement to obtain data on ~680 Revolut customers.

Revolut confirmed its systems were not breached; fraudulent data requests came from a compromised PEC mailbox tied to the Prefecture of Reggio Calabria on the pec.interno.it domain. Per the Financial Times, roughly 680 customers had identity documents, addresses, banking information, verification selfies and cryptocurrency transaction histories exposed. Researcher Korra of Duel described a 'spray and pray' operation using hundreds of crypto transaction IDs and fraudulent European Investigation Orders. Threat actor IAmNotAVillain claims six months of access and 147 GB exfiltrated from Italian law-enforcement systems, though this remains unverified.

Security Affairsupdated Sep 17, 13:57 UTC · 1d agofirst Sep 16, 13:09 UTC · 2d agoData breach in the wild 2 sources

Top 10 Best AWS Security Tools in 2026

Editorial roundup ranking the ten best AWS security tools of 2026, from native GuardDuty and Security Hub to CNAPPs like Wiz and Prisma Cloud.

The article recommends enabling AWS-native services first: GuardDuty for threat detection, Security Hub for posture aggregation, the free IAM Access Analyzer, plus CloudTrail logging and Config rules. It then reviews third-party platforms including Wiz, Palo Alto Prisma Cloud, CrowdStrike Falcon Cloud Security, Trend Micro Cloud One, and Orca Security. It is an editorial vendor assessment with pricing described by model only, highlighting cross-account correlation and attack-path prioritization as third-party differentiators.

Cyber Security NewsSep 16, 09:57 UTC · 2d agoTools

Top 10 Best Microsoft Azure Security Tools in 2026

An editorial roundup of the ten best Azure security tools in 2026 names Defender for Cloud the native floor, with Wiz, Orca, and Prisma Cloud leading third-party options.

The brief reviews ten Azure security tools, positioning Microsoft Defender for Cloud's free foundational tier and published per-resource plans as the rational starting point for every Azure estate. Wiz and Orca are shortlisted for agentless attack-path correlation, Prisma Cloud for multicloud breadth, CrowdStrike for runtime protection, and Tenable for CIEM depth with Entra permission analytics. The piece emphasizes Azure's tight identity-infrastructure coupling via Entra ID as both an operational advantage and its most critical risk surface. Scoring is editorial, not lab-tested, with pricing compared by model only.

Cyber Security NewsSep 17, 08:31 UTC · 1d agoIndustry1

Virtual Event Today: Attack Surface Management Summit

SecurityWeek's 2026 Attack Surface Management Summit runs today as a virtual event covering asset discovery, SBOMs, red teaming, and pen-testing.

SecurityWeek is hosting its fully virtual 2026 Attack Surface Management Summit from 11AM-3PM, focused on continuous asset discovery, prioritization, and risk reduction. Sessions cover proving exploitability, SBOM and AIBOM software supply chain risk with Dr. Allan Friedman, demos from Wiz and Horizon3's NodeZero, and the roles of red teaming, bug bounty, and penetration testing in enterprise defense.

SecurityWeekSep 16, 14:35 UTC · 1d agoIndustry

Top 10 Best Multi-Cloud Security Platforms in 2026

An editorial roundup of the ten best multi-cloud security platforms for 2026, split between CNAPPs (Wiz, Prisma Cloud) and cloud-networking security (Aviatrix).

The article frames multi-cloud security as two markets: CNAPP platforms (Wiz, Prisma Cloud, CrowdStrike, Orca, Defender) securing what runs in clouds, and cloud-networking-security platforms (Aviatrix) securing how clouds connect. It ranks ten platforms including Palo Alto Prisma Cloud for breadth, Wiz for correlation, Check Point CloudGuard, Fortinet, Aviatrix, Microsoft Defender for Cloud, Trend Micro, and CrowdStrike. It flags the ~$32 billion Google–Wiz acquisition as raising cloud-neutrality questions buyers should address contractually.

Cyber Security NewsSep 16, 09:50 UTC · 2d agoTools1

North Korean IT Workers Pay People to Sit Through Job Interviews While They Control the Computer

Silent Push found North Korean IT workers recruiting on-camera proxies for job interviews while remotely controlling the computer, defeating identity and location checks.

Silent Push researchers engaged the "Tec Guru" persona via Discord and Telegram and assessed with moderate-to-high confidence that the operator is a North Korean IT worker recruiting on-camera proxies in the US, Europe, and Latin America for a 35/65 revenue split. During Google Meet interviews, the proxy stays on camera while the real worker supplies answers via ChatGPT-generated prompts, real-time messaging, or remote-control tools such as AnyDesk and TeamViewer. Successfully placed workers can access source code, cloud tenants, and CI/CD systems, and payments create sanctions exposure; the US, Japan, South Korea, and eight other governments issued a joint identity-verification alert on July 31, 2026.

GBHackersSep 17, 12:51 UTC · 1d agoPhishing & fraud in the wild 2 sources

Windows 11 KB5124008 update breaks domain trust for some users

Microsoft is investigating Windows 11 KB5124008 breaking Active Directory domain trust, leaving some users unable to log in with valid credentials.

Administrators report the Windows 11 KB5124008 security update breaks the secure channel between domain-joined machines and Active Directory, causing login failures on Windows 11 25H2 systems after reboot. The failures are linked to the Machine Identity Isolation feature, which in enforcement mode moves machine account secrets into Credential Guard and removes the LSA copy; one admin saw 11 of roughly 256 devices affected. Workarounds include setting MachineIdentityIsolation to 0 and repairing the secure channel with Test-ComputerSecureChannel, though Microsoft has confirmed no root cause or official fix and warns disabling the feature can also break domain authentication.

BleepingComputerupdated Sep 17, 00:29 UTC · 1d agofirst Sep 16, 20:39 UTC · 1d agoVulnerability 2 sources1

12 Best Multi-Cloud Security Platforms Compared (2026): Features & Pricing

A buyer's guide compares pricing and features of 12 multi-cloud security platforms including Wiz, Prisma Cloud, FortiCNAPP, and Defender for Cloud.

The GBHackers roundup profiles 12 multi-cloud security platforms, including Wiz, Fortinet FortiCNAPP, Palo Alto Prisma Cloud, Sysdig, Microsoft Defender for Cloud, Uptycs, and Check Point CloudGuard. It focuses on cross-cloud billing parity, connector fees, ELA absorption, and negotiation tactics for procurement teams. The article notes Ermetic has consolidated into Tenable Cloud Security and that Google's acquisition of Wiz is finalized.

GBHackers08:13 UTC · 5h agoTools 10 sources

One Compromised Kubernetes Node Can Expose Every Workload Identity Running on It

Unit42 researchers show a root attacker on a Kubernetes node can manipulate cgroups to make the local SPIRE agent issue other workloads' identities.

Palo Alto Networks Unit42 demonstrated that an attacker with root access on a Kubernetes node can alter Linux cgroup data so the local SPIRE agent matches a target pod's selectors and issues its SVID to an attacker-controlled process. The technique affects SPIFFE/SPIRE deployments, which assume node trustworthiness, and means every workload identity on a compromised node should be considered exposed. Researchers have not observed the method in the wild and released Spooffe, a testing tool to measure node identity exposure.

Cyber Security NewsSep 17, 11:02 UTC · 1d agoResearch 2 sources

Microsoft shares workaround for Windows domain login issues

Microsoft confirms September 2026 Windows updates trigger domain trust failures via Machine Identity Isolation and shares a workaround for Windows 11 enterprises.

Microsoft confirmed the September 2026 security updates (KB5124008 for Windows 11 24H2/25H2, KB5124012 for 26H1) cause Windows to honor Machine Identity Isolation enforcement settings, breaking domain trust on systems not connected to Windows Server 2025 domain controllers. Admins report valid credentials failing with domain trust and credential errors. The workaround requires disabling Machine Identity Isolation via the same management method that enabled it (Intune, group policy, or registry) and resetting the secure channel with Test-ComputerSecureChannel. Microsoft previously shipped out-of-band fixes for Remote Desktop, Hyper-V, and USB audio issues from the same updates.

BleepingComputerupdated 12:16 UTC · 1h agofirst Sep 17, 08:24 UTC · 1d agoAdvisory 3 sources

Top 10 Best Google Cloud (GCP) Security Tools in 2026

An editorial scorecard ranks the top ten Google Cloud security tools for 2026, with Wiz, Sysdig, and Security Command Center leading on correlation, GKE runtime, and native depth.

The roundup evaluates ten GCP security tools across five weighted criteria including GCP-native depth, correlation, runtime protection, multicloud parity, and value. Google Security Command Center is positioned as the included native floor, while Wiz and Sysdig top the weighted scores at 4.50, followed by Prisma Cloud at 4.40. The piece notes Forseti is deprecated and that Lacework is now Fortinet's FortiCNAPP, and flags diligence around Google's acquisition of Wiz. It is an editorial assessment, not a lab test, with pricing compared by model only.

Cyber Security NewsSep 17, 08:37 UTC · 1d agoIndustry1

America's Driver's License Breach Is a National Security Disaster

Dark web service Nexus sells 153 million US/Canadian driver's licenses linked to a breach of identity verifier IDScan.

Krebs on Security revealed a dark web service, Nexus, selling access to 153 million driver's licenses and 3 million travel documents from US and Canadian citizens, roughly 63 percent of all US licenses. Circumstantial evidence links the data to identity verification firm IDScan, which confirmed it is investigating a breach, and the FBI is probing the incident. Licenses belonging to senior US officials, including Pete Hegseth, an FBI assistant director, and Krebs's own contacts were verified as genuine. The exfiltration appears ongoing, with the database growing by nearly 400,000 licenses in a single day, and the data carries significant national security value for foreign intelligence services.

Hacker News · securitySep 15, 15:58 UTC · 2d agoData breach HN 26↑ · 4 comments3· 1 read

Top 10 Best Cloud Detection & Response (CDR) Solutions in 2026

Editorial scorecard ranks ten 2026 cloud detection and response platforms; Sysdig, Wiz, and CrowdStrike lead, with Wiz's Gem Security acquisition highlighted.

The editorial scorecard rates ten CDR platforms on real-time detection (30%), cloud telemetry depth, response automation, correlation, and value. Sysdig earns the best real-time detection score for its Falco- and eBPF-powered runtime telemetry, Wiz (8.7) folds acquired Gem Security's real-time CDR into its security graph, and CrowdStrike (8.7) leads response automation. Specialists Stream.Security, Skyhawk Security, Sweet Security, and the open-source Falco project are also assessed.

Cyber Security NewsSep 16, 07:41 UTC · 2d agoIndustry1

You don’t have to join the hack-back program to inherit its risk

A new US presidential memorandum creates a vetted private hack-back program, leaving participating vendors and their customers with untested legal liability and collateral risks.

The August 12 National Security Presidential Memorandum directs the National Coordination Center, run jointly by DOJ and DHS, to approve covert surveillance and disruptive Cyber Effects Operations by vetted private companies, with a forfeitable bond of at least $1 million required as a contract condition. The analysis argues the criminal shield rests on an untested reading of the CFAA exemption at 18 U.S.C. 1030(f), with no civil safe harbor, no state-law preemption and no foreign-law protection. Non-participating organizations can still inherit risk through shared infrastructure collateral damage, lack of customer disclosure, Lloyd's bulletin Y5381 state-backed attack exclusions, and threat-intelligence pipelines feeding offensive proposals.

CSO OnlineSep 16, 09:00 UTC · 2d agoPolicy & legal

CTEM Buyer’s Guide: How to Evaluate the Technologies That Turn Continuous Threat Exposure Management Into an Operating Model

Horizon3.ai published a buyer's guide for evaluating Continuous Threat Exposure Management (CTEM) technologies based on proven exploitability and measurable risk reduction.

Horizon3.ai released a buyer's guide for evaluating Continuous Threat Exposure Management (CTEM) solutions, translating Gartner's CTEM framework into a six-step operating loop: discover exposure, validate exploitability, prioritize, remediate, verify risk removal, and repeat. The guide advises buyers to assess tools on attacker evidence, attack-path context, and measurable risk reduction rather than raw findings or risk scores. It targets CISOs, security architects, and vulnerability management leaders.

Horizon3.aiSep 17, 19:10 UTC · 18h agoTools

From guidance to action: Security fundamentals that materially reduce risk

Microsoft expands Secure Now guidance, detailing AI-agent incidents, Storm-2945 CaptiveCrunch DNS hijacks, and Teams IT-support impersonation attack paths.

Microsoft's Security Exposure Management blog outlines three observed attack paths: OpenAI agents reaching production systems via shared Hugging Face infrastructure, Storm-2945 (Midnight Blizzard subcluster) redirecting hospitality network traffic into device-code phishing and fake updates in the CaptiveCrunch campaign, and attackers impersonating IT support over Teams to deploy MSI payloads via PowerShell and pivot through WinRM. Microsoft promotes Secure Now recommendations covering identity governance, agent isolation, phishing-resistant authentication, and Zero Trust controls.

Microsoft Security BlogSep 17, 17:00 UTC · 21h agoAdvisory1

Most Fraudulent Hires Receive Credentials Before Detection

HYPR report finds 42% of fraudulent hires pass screening and receive corporate credentials, averaging 5.73 days of unmonitored network access before detection.

A HYPR study of 500 US HR executives found 42% of fraudulent candidates pass pre-hire screening and get hired, with only 3% detected on their hire day and 20% remaining undetected up to three weeks. This gives fraudulent hires an average of 5.73 days of unmonitored corporate network access, and 98% of surveyed executives said they had experienced candidate fraud firsthand. The report follows a September 9 CISA update to its Insider Threat Mitigation Guide warning that malicious actors use AI tools to obtain remote IT jobs, a tactic long used by North Korean actors for data theft and extortion.

Infosecurity MagazineSep 15, 15:15 UTC · 2d agoPhishing & fraud

Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks

Cisco warns CVE-2026-76460 (CVSS 10.0), an unauthenticated ISE auth bypass leading to root command execution, is under active exploitation and was added to CISA's KEV.

Cisco warned that CVE-2026-76460 (CVSS 10.0), an insufficient-authentication flaw in an Identity Services Engine (ISE) API endpoint, is being actively exploited by unauthenticated remote attackers and can yield root-privilege command execution on ISE and ISE-PIC regardless of configuration. Fixes shipped across ISE 3.1 through 3.5 patch branches; Cisco advised reviewing access.log for unexpected usernames (e.g., "dummyuser"), re-imaging affected nodes, and using iACLs, since no workarounds exist. CISA added the flaw to its KEV catalog on September 16, 2026, requiring FCEB agencies to patch by September 19. Cisco simultaneously issued 77 new CVEs, 41 affecting ISE and 28 affecting Secure Firewall products, days after confirming active exploitation of CVE-2026-76461 in Secure Email Gateway.

The Hacker NewsSep 17, 06:39 UTC · 1d agoExploit / PoC in the wildCVE-2026-76460 CVE-2026-76461 CVE-2026-20176+27 CVEs2

Spain reports first alleged AI-powered data theft attack

Spain's data protection agency received a report of an AI agent autonomously exploiting flaws, logging in, altering personal data, and reading invoices.

The Spanish Data Protection Agency (AEPD) was notified of an incident in which an AI agent powered by a known LLM reportedly searched for vulnerabilities, gained access to systems, modified personal data, and accessed financial documents. AEPD has not yet investigated or verified the report but says it shows AI-related data breaches are no longer theoretical. The agency urged defenders to revise incident-response procedures, strengthen credential and identity security, and explicitly account for machine-speed AI-assisted attacks.

BleepingComputerSep 16, 17:26 UTC · 1d agoData breach in the wild 2 sources1

Tuskira Vector brings autonomous red teaming to attack surface validation

Tuskira launched Vector, an autonomous red teaming agent that validates exploitable external attack surface against deployed controls using a Security Data Fabric digital twin.

Tuskira announced Vector, an agentic autonomous red teaming capability that simulates attacker behavior from outside an organization to identify its exploitable attack surface. Findings are validated against deployed compensating controls, internal risk data, and application/infrastructure topology via Tuskira's Security Data Fabric, which normalizes third-party tool signals into a live digital twin. The release extends Kairo (introduced May 2026), adding red team sensors and an agentic defense loop spanning agents Kairo, Lattice, Quell, and Iris. Tuskira claims Kairo has deprioritized up to 99% of scanner findings as unreachable and recomputes breach-path maps in minutes.

Help Net SecuritySep 17, 06:01 UTC · 1d agoTools

Cisco Fixes Dozens of Flaws Across FMC, ISE and Nexus Dashboard

Cisco patches dozens of critical flaws in FMC, ISE and Nexus Dashboard, including ISE bugs and an authentication bypass already exploited in the wild.

Cisco released patches for dozens of critical-severity CVEs in Secure Firewall Management Center, Identity Services Engine and Nexus Dashboard. ISE updates cover 20 CVEs including 12 critical ones; three publicly disclosed flaws (CVE-2026-20282, CVE-2026-20283, CVE-2026-20284) enable SQL injection, data tampering and command execution but require administrative access. FMC patches fix 18 CVEs, eight critical, several shared with ASA and FTD, where CVE-2026-20079 and CVE-2026-20316 have been exploited since August. Cisco also warned of a critical-severity ISE authentication bypass exploited in the wild as a zero-day.

SecurityWeekSep 17, 12:17 UTC · 1d agoVulnerability in the wild 2 sources CVE-2026-20282 CVE-2026-20283 CVE-2026-20284+3 CVEs1

Cisco warns of max severity ISE zero-day exploited in attacks

Cisco patched CVE-2026-76460, a maximum-severity authentication bypass in Identity Services Engine actively exploited in attacks; CISA added it to KEV with a three-day federal deadline.

CVE-2026-76460 is a maximum-severity authentication bypass in an API endpoint of Cisco Identity Services Engine (ISE) and ISE-PIC, exploitable regardless of configuration, allowing attackers to access the web-based management interface. Cisco PSIRT confirmed active exploitation; no workarounds exist, and fixed releases are available for ISE 3.1 through 3.5, with re-imaging of suspect nodes recommended. CISA added the flaw to its Known Exploited Vulnerabilities Catalog and ordered federal agencies to patch within three days. Cisco also patched CVE-2026-76423 and five other critical ISE flaws (CVE-2026-20176, CVE-2026-20211, CVE-2026-20307, CVE-2026-20284) that are not yet flagged as exploited.

BleepingComputerSep 17, 07:20 UTC · 1d agoExploit / PoC in the wildCVE-2026-76460 CVE-2026-76423 CVE-2026-20176+4 CVEs1· 1 read

Critical pgAdmin Authentication Bypass Lets Attackers Login as Administrator Without Credentials

pgAdmin 4 versions 6.2-9.17 contain critical auth bypass CVE-2026-86863 (CVSS 9.8) letting unauthenticated attackers impersonate administrators; fixed in 9.18.

A critical authentication bypass (CVE-2026-86863, CVSS 3.1 score 9.8) affects pgAdmin 4 versions 6.2 through 9.17 when Webserver authentication is enabled in AUTHENTICATION_SOURCES. The WebserverAuthentication.get_user() function falls back to client-controlled HTTP headers such as X-Forwarded-User when the WEBSERVER_REMOTE_USER environment variable is absent, allowing unauthenticated remote attackers to log in as any user, including administrators, without a password or MFA. Successful attackers could view, alter, or delete PostgreSQL database objects and data accessible through the hijacked privileged session. Version 9.18 fixes the issue by trusting only genuine CGI/WSGI environment variables by default and requiring explicit options like WEBSERVER_REMOTE_USER_FROM_HEADER with trusted proxies for header-based identity.

GBHackers09:31 UTC · 4h agoVulnerability CVE-2026-86863

BambooToken Malware Uses MQTT to Control Windows and Linux Systems

Lumen uncovers BambooToken, a stealthy multi-platform malware using MQTT C2 and Tendyron DLL sideloading to compromise Asian and South American organizations.

Lumen Black Lotus Labs disclosed BambooToken, a previously undocumented malware family active since at least February 2023 that controls Windows and (since December 2025) Linux hosts via the MQTT protocol for C2. The malware sideloads a rogue OnKeyToken_KEB.dll via Tendyron's OnKey PKI token software, gathers host details, and uses a WMI-based plugin to enumerate installed antivirus products and exfiltrate them to C2 domains proxied through Cloudflare. A dozen compromised entities were detected across Asia and South America, and DLL sideloading plus SoftEther VPN usage suggests a China nexus.

The Hacker NewsSep 15, 15:23 UTC · 2d agoMalware in the wild 2 sources

BambooToken: The Malware That Speaks MQTT to Stay Under the Radar

Lumen's Black Lotus Labs uncovered BambooToken, a Windows and Linux malware family using MQTT broker-based C2 and DLL sideloading across Asia since February 2023.

Lumen Black Lotus Labs identified BambooToken, a multiplatform malware family that exchanges commands through MQTT brokers so infected hosts never contact the C2 server directly, active from at least February 2023 through July 2026. The Windows variant sideloads via Tendyron's OnKey hardware-token software used in Chinese banking and government, or impersonates Kingsoft Office, without either vendor's signing certificate being compromised; a Linux build appeared by December 2025 with shell, file transfer, and system information commands. Victims include MikroTik and DrayTek routers in Singapore, Cambodia, and Vietnam reached after internet-wide SNMP scanning, and Lumen cannot attribute the family to any known actor.

Security AffairsSep 16, 20:20 UTC · 1d agoMalware in the wild1

German Manufacturer Shrinks Security Alert Response While Protecting 10,000 Endpoints

Vendor case study: a German manufacturer's five-person SOC cut alert triage time using ANY.RUN's cloud sandbox across 10,000 endpoints.

ANY.RUN published a case study in which a five-person security team at an unnamed German manufacturer replaced an air-gapped forensic laptop with its cloud-managed interactive sandbox, protecting roughly 10,000 endpoints and 10,000 users. The vendor claims a median 15 minutes saved per alert, 20-40 daily tasks processed, a 2.5-minute alert-to-isolation target, and a 95% agreement rate between analyst and sandbox verdicts; all figures are vendor-supplied with the customer identity withheld. The writeup also describes detonating a multi-stage phishing chain from a PDF link to a password-protected ZIP to malware execution.

Cyber Security Newsupdated Sep 17, 08:15 UTC · 1d agofirst Sep 16, 15:12 UTC · 1d agoIndustry 3 sources

Rubrik MCP gives AI agents controlled access to security intelligence

Rubrik launched MCP support exposing Rubrik Security Cloud APIs to enterprise AI agents with RBAC, configurable permissions, and OWASP MCP Top 10 guardrails.

Rubrik announced Rubrik MCP (Model Context Protocol), giving organizations' AI agents a secure, programmable path to Rubrik's data, identity, and application intelligence via the Rubrik Security Cloud API schema. Teams can save multi-step recovery or compliance workflows as reusable, deterministic tools, with role-based access control parity and OWASP MCP Top 10 aligned guardrails. Rubrik engineered its agent architecture with Anthropic's teams for multi-step reasoning in incident response, and says Rubrik AI is now trusted by one-third of its global customers.

Help Net SecuritySep 16, 10:41 UTC · 2d agoTools1

A heap overflow and SSO misconfiguration to compromise OpenAI internal repos

Hacktron researchers chained a libheif heap overflow in Discourse with an OpenAI SSO flaw to take over employee ChatGPT/Codex accounts and access internal repositories.

On July 25, 2026, Hacktron researchers chained a heap buffer overflow in libheif 1.19.7/1.19.8 (missing Debian security backports, upstream fix never assigned a CVE), reached through Discourse image uploads processed by ImageMagick, to gain remote code execution on community.openai.com. Combined with an SSO identity misconfiguration in the 'Sign in with OpenAI' flow, they took over employees' ChatGPT/Codex accounts with connected GitHub, Slack, and email access, and proved it by opening PR #1186742 in OpenAI's internal openai/openai monorepo. They reported the issues for coordinated patching, received a $6,500 bounty from OpenAI, and Debian shipped fixed libheif packages on August 8, 2026. The team used Claude Opus 4.8 and Claude Opus 5 to locate the missing backport and autonomously develop working x86-64/ARM64 exploits.

Hacker News · securityupdated 13:30 UTC · 34m agofirst 02:47 UTC · 11h agoResearch in the wild 9 sources HN 334↑ · 128 comments1

Apache Syncope Vulnerabilities Allow Attackers to Execute Malicious Code and Bypass Controls

Apache Syncope fixed three flaws enabling SQL injection, Groovy sandbox escape, and JWT token theft to impersonate higher-privileged users.

Apache Syncope, an open-source identity management and access governance platform, disclosed CVE-2026-82232, a stacked-query SQL injection in the Task search sort parameter; CVE-2026-77147, a Groovy sandbox escape via malicious Command classes; and CVE-2026-73178, retrieval of signed JWT access tokens via REST enabling impersonation of more privileged users. All three flaws require administrator-level entitlements to exploit and affect Syncope 3.0, 4.0, and 4.1 releases. Fixes shipped in versions 4.0.8 and 4.1.3, with researchers Alon Galili and n0mi1k credited.

Cyber Security NewsSep 16, 13:21 UTC · 2d agoVulnerability 3 sources CVE-2026-82232 CVE-2026-77147 CVE-2026-731782