Search: “Progress”

96 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Industry 25 Threat actor 13 Research 10 Policy & legal 10 Advisory 9 Exploit / PoC 9 Phishing & fraud 7 Malware 5 Vulnerability 5 Tools 4 Ransomware 1 Data breach 1

SeverityAll critical 2 high 28 medium 16 low 0 info 53

Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released

TantoSec published a working exploit chaining a Telerik UI padding oracle to unauthenticated RCE; Progress patched the flaws in July.

TantoSec's Marcio Almeida released a full exploit chain and tooling for the RadAsyncUpload control in Telerik UI for ASP.NET AJAX, turning a padding oracle (CVE-2026-13182) into unauthenticated RCE via an unguarded type-resolution flaw (CVE-2026-13181, CVSS 8.1). Exploitation requires a rendered RadAsyncUpload handler and an explicit non-default encryption key, and took roughly 127,000 oracle requests (about an hour) in lab testing. Versions 2010.1.309 through 2026.2.519 are affected; Progress fixed the chain in 2026.2.708 on July 8, 2026, and no in-the-wild exploitation has been confirmed. A separate RCE chain in RadPersistenceManager and RadDockLayout (CVE-2026-13185, -13186, -13190) was also patched but has no public exploit.

The Hacker NewsSep 7, 11:20 UTC · 9d agoExploit / PoC CVE-2026-13181 CVE-2026-13182 CVE-2026-13183+5 CVEs1

Progress security advisory (AV26-915)

Canadian Cyber Centre advisory AV26-915 warns of a vulnerability in Progress Software Chef Automate prior to 4.13.520.

The Canadian Centre for Cyber Security issued advisory AV26-915 on September 11, 2026, flagging a vulnerability in Progress Software's Chef Automate for versions prior to 4.13.520. The advisory references Progress' Critical Security Bulletin from August 2026 and urges users and administrators to review the linked resources and apply available updates. No exploitation status, CVE identifiers, or technical details are provided.

Canadian Centre for Cyber SecuritySep 11, 19:04 UTC · 5d agoAdvisory

ZDI-26-646: Progress Software Kemp LoadMaster escape_quotes Uninitialized Memory Remote Code Execution Vulnerability

ZDI publishes ZDI-26-646 for CVE-2026-8037, an authenticated uninitialized-memory remote code execution flaw in Progress Kemp LoadMaster, rated CVSS 7.2.

Zero Day Initiative published advisory ZDI-26-646 describing an uninitialized memory flaw in Progress Software Kemp LoadMaster's escape_quotes function. Successful exploitation allows remote authenticated attackers to execute arbitrary code on affected installations. ZDI rated the issue CVSS 7.2 and assigned CVE-2026-8037.

ZDI Published AdvisoriesSep 9, 05:00 UTC · 8d agoAdvisory CVE-2026-8037

Progress Software security advisory (AV26-875)

Canada's Cyber Centre warns Progress Telerik UI for ASP.NET AJAX before 2026.3.812 is affected by path traversal and upload tampering flaws, urging updates.

The Canadian Centre for Cyber Security issued advisory AV26-875 on September 2, 2026, covering vulnerabilities in Progress Software Telerik UI for ASP.NET AJAX prior to version 2026.3.812. Two flaws are listed: CVE-2026-18672, a path traversal in the Telerik Web Forms RadImageEditor, and CVE-2026-19219, a DialogHandler UploadPaths tampering vulnerability. Administrators are encouraged to review the provided links and apply available updates.

Canadian Centre for Cyber SecuritySep 2, 15:33 UTC · 14d agoAdvisory CVE-2026-18672 CVE-2026-19219

Kids’ online safety bill faces dim prospects of passage this session despite progress

Kids Online Safety Act clears Senate committee but passage looks unlikely this session amid House-Senate deadlock over the duty-of-care provision.

KOSA advanced out of the Senate Commerce Committee, but the chambers remain split on a duty-of-care provision requiring platforms to act with reasonable caution to prevent foreseeable harm, which House leadership opposes over First Amendment and negligence-lawsuit concerns. The Senate passed KOSA 91-3 last Congress before it died in the House, and the House passed its own version without the duty of care in June as part of a larger package, after stripping a state-law preemption provision. Observers say even Senate passage this year is a struggle given the short calendar, with a lame-duck window between November and January the more plausible path, and Majority Leader John Thune controlling whether a roll-call vote happens.

The RecordAug 24, 00:00 UTC · 24d agoPolicy & legal

Why Patch Automation Needs Brakes, Not Just an Accelerator

Action1's field CTO argues patch automation needs staged deployments and stop conditions, not just speed.

Gene Moody, Field CTO at Action1, writes on BleepingComputer that patch automation must pair acceleration with safeguards. He recommends staged deployment rings with predefined go/no-go criteria, keeping human judgment for domain controllers, databases, and ERP systems. The piece warns that automation without brakes can push a bad update to 10,000 endpoints as fast as a good one.

BleepingComputerSep 14, 14:01 UTC · 2d agoIndustry

Have it both ways: stay discoverable in search while disallowing AI training

Cloudflare launches Disallow AI Training setting letting sites block AI training via robots.txt while staying indexed in search; Apple, Google, and Microsoft honor it.

Cloudflare announced a 'Disallow AI Training' setting that publishes a no-training preference in robots.txt so sites can block AI training (including by mixed-use crawlers) without losing search indexing. Apple, Google, and Microsoft meet Cloudflare's new 'Accountable' designation, which requires training/summary opt-out mechanisms, URL-level training visibility, and assurance that opt-outs don't affect search rankings. Cloudflare cites that under 1% of its sites block search bots while 17% block AI training, and its Block settings now apply to mixed-use crawlers as well. Granular controls over how much content appears in AI summaries are planned for early next year.

Cloudflare BlogSep 15, 13:00 UTC · 1d agoTools

Building a Linux GPU Driver for the M4 Mac Mini in One Month

Two developers built a fully OpenGL ES 3.0 compliant Linux GPU driver for the M4 Mac Mini in one month via clean-room reverse engineering.

Niklas and the author reverse engineered Apple's AGX GPU firmware ABI and user-space components in about a month, a process that normally takes years, producing an OpenGL ES 3.0 conformant driver fast enough to run Minecraft at 200fps on an M4 Mac Mini. The work was done transparently using hypervisor traces without examining Apple binaries, following clean-room practices, and included a custom shader compiler, command stream builder, and a full Linux kernel driver for the firmware ABI. The A18 Pro firmware ABI proved significantly more complex than the M1's, with 1.5x as many structs and twice as many pointers. All experiments and provenance evidence were published in public agx-re repositories.

Hacker News · AISep 15, 19:30 UTC · 1d agoResearch HN 40↑ · 5 comments

Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries

China-linked Red Heron exploited Gitea RCE CVE-2026-60004 to compromise 13 organizations across six countries, stealing source code.

Acronis Threat Research Unit attributes a China-nexus actor tracked as Red Heron to rapid exploitation of Gitea RCE CVE-2026-60004, scanning 1,386 instances across seven countries plus 477 Taiwan-based systems, with confirmed compromises of 13 organizations in Canada, Argentina, Taiwan, the U.S., Qatar, and Sri Lanka. Within days of the July 2026 disclosure, the actor weaponized a public PoC into an automated Python framework registering accounts, exploiting servers, stealing repositories, and removing traces, then deployed the JITTERLY C++ Linux implant (30+ post-exploitation commands) and the undocumented SIXZUT LD_PRELOAD rootkit. In one Taiwanese environment the actor reached root-level access across a three-node Proxmox cluster, targeting defense, elections, energy, aerospace, telecom, government, and research sectors.

The Hacker Newsupdated Sep 15, 11:16 UTC · 1d agofirst Sep 14, 16:56 UTC · 2d agoThreat actor in the wild 3 sources CVE-2026-60004

Passkey-themed social engineering leads to identity and cloud compromise

Microsoft tracks ongoing cloud intrusions where passkey-themed helpdesk lures enable AiTM credential theft, MFA persistence, and SharePoint data theft.

Microsoft Security Research is tracking active cloud-based intrusions, observed since May 2026, that begin with helpdesk impersonation calls and SMS lures urging urgent passkey, MFA, or SSO updates. The lures lead to adversary-in-the-middle phishing or device-code authentication flows that capture credentials and session tokens or grant actor access, after which the actors add authentication methods, conduct Microsoft Graph reconnaissance, and download SharePoint and OneDrive content via REST APIs. Phishing domains embed victim organization names as subdomains (e.g., contoso.add-passkey[.]com), are often registered with Nicenic, and go operational within hours. Microsoft advises revoking sessions and removing unauthorized authentication methods for confirmed compromises.

Microsoft Security BlogSep 9, 17:41 UTC · 7d agoThreat actor in the wild2

The 12 Best Managed XDR Services, Compared and Priced

A comparison of twelve managed XDR providers covering pricing models, telemetry breadth, and distinguishing genuine MXDR from rebranded MDR services.

The article compares twelve managed XDR providers including Bitdefender, CrowdStrike, Palo Alto Unit 42, Trend Micro, Fortinet, Secureworks Taegis, Stellar Cyber, Ontinue, and ReliaQuest, highlighting pricing models and telemetry breadth. It explains that genuine MXDR must actively monitor identity, cloud, and email telemetry rather than merely ingest it, and typically costs 30-60% more than endpoint-only MDR. It also notes Sophos completed its approximately $859 million acquisition of Secureworks in February 2025.

GBHackersSep 9, 08:07 UTC · 8d agoIndustry 3 sources2

Key Reasons Why Identity Fabric Matters in 2026

Identity sprawl and unowned machine identities leave enterprise access unobserved at runtime; identity fabrics aim to close the gap between policy intent and execution.

This sponsored explainer describes identity fabric as an architectural approach connecting identity providers, governance systems, applications, and infrastructure into one observable layer that compares designed access intent with runtime execution. It argues identity sprawl across SaaS, APIs, and cloud workloads, plus unmanaged non-human identities (service accounts, bots, workloads, API keys), leaves overprivileged, dormant, and unowned machine identities unmonitored. IdP-only monitoring misses application-layer attacks, and the piece advocates behavioral visibility and lifecycle governance for secrets and machine identities.

The Hacker NewsAug 28, 11:30 UTC · 19d agoIndustry

Adversary simulation: what you need to know

UK NCSC publishes guidance on adversary simulation, comparing full spectrum and assumed breach approaches across prerequisites, testing, and reporting phases.

NCSC guidance describes two adversary simulation approaches: full spectrum, starting outside the network with an end-to-end attack, and assumed breach, starting from an internal foothold. The preferred methodology spans three phases - prerequisites (scoping, passive reconnaissance, preparation), testing (active reconnaissance, initial access, internal phase, cleanup), and reporting. The document distinguishes adversary simulation from penetration testing and stresses customer-defined objectives and minimal information sharing.

NCSC UKupdated 09:09 UTC · 37m agofirst 08:29 UTC · 1h agoAdvisory 2 sources

25 Years of Mass Surveillance Is Enough

Bruce Schneier and Cindy Cohn argue post-9/11 mass surveillance expanded far beyond its counterterrorism justification and should be reevaluated for costs to rights.

An essay by Bruce Schneier and Cindy Cohn (originally in Lawfare) traces the post-9/11 shift from targeted surveillance to mass collection of telephone and internet metadata. It cites the Section 215 bulk phone records program, struck down in interpretation by the Second Circuit in 2015 and curtailed by the USA Freedom Act, and the NSA's Upstream program under Section 702 of the 2008 FISA Amendments Act, which ended content searches in 2017. The authors note mass surveillance now serves routine law enforcement and immigration actions, with FBI Director Kash Patel confirming purchases of Americans' data from brokers, and private systems like Flock license plate readers and venue facial recognition feeding government access.

Schneier on SecuritySep 15, 11:01 UTC · 1d agoPolicy & legal

AI Changed the Exposure Problem. Validation Needs to Change With It.

Picus Security argues vulnerability validation must combine exploitability, control validation, and agentic pentesting as AI accelerates disclosure volume.

Picus Security reports 35,853 CVEs were published in H1 2026, roughly 49% more than the prior year, while only 495 were catalogued as exploited in the wild and 116 were attacked on disclosure day. The vendor argues CVSS-based triage is inadequate and promotes combining exploitability validation, security control validation, and agentic pentesting into one program. The post also cites Anthropic data showing Mythos-class models surfaced 26,153 open-source vulnerability candidates with only 421 patched upstream, and promotes Picus's Validation Summit '26 on October 14-15.

The Hacker NewsSep 14, 11:58 UTC · 2d agoIndustry

Turn it off and on again, but for critical infrastructure

KTH researchers trained a reinforcement-learning intrusion response agent on an emulated segmented OT network that autonomously resets hosts and processes to disrupt intruders.

Researchers at KTH Royal Institute of Technology built a containerized replica of a segmented industrial network, attacked it across 14 days, and captured 40,000 30-second traffic intervals to train a defense agent under partial observability. The agent observes six packet-count numbers per interval, maintains 500 running state hypotheses, and can reset supervisory hosts, water tank processes, or entire subnets, with resets rebooting the target, renewing credentials, and changing its IP. The best agent approached a full-visibility baseline but depends on an assumed attacker behavior model; the testbed comprised three supervisory hosts, two PLCs, two tanks, weak credentials, and CVE-2017-7494 exposure. The team released its implementation and plans validation on a real industrial testbed with a partner.

Help Net SecuritySep 14, 06:00 UTC · 3d agoResearch CVE-2017-74942· 1 read

Top 10 Best CNAPP (Cloud-Native Application Protection) Platforms in 2026

GBHackers ranks 10 CNAPP platforms for 2026, naming Wiz, Prisma Cloud, and Microsoft Defender for Cloud as category leaders.

The guide describes CNAPP as the umbrella combining CSPM, CWPP, CIEM, and DSPM, arguing that cross-pillar correlation of attack paths is the platform's core value. Wiz is ranked best for graph-based correlation, Prisma Cloud for the broadest module set, and Microsoft Defender for Cloud for Azure economics. It also cites Google's approximately $32 billion agreement to acquire Wiz, announced in March 2025, as buyer leverage and a reason to seek roadmap and neutrality protections in multi-year contracts.

Cyber Security NewsSep 11, 07:21 UTC · 6d agoIndustry1

Best Practices for Good Endpoint Hardening | Huntress

Huntress outlines endpoint hardening best practices, citing exposed RDP, RMM tool abuse, and ClickFix social engineering as common SMB intrusion paths.

Huntress published defensive guidance on endpoint hardening for small and mid-sized businesses, drawing on observations from its SOC. The post describes common intrusion vectors: internet-exposed RDP brute-forced by automated scanners, phishing emails delivering attacker-controlled remote monitoring and management (RMM) tools, with Huntress reporting a 277% spike in RMM abuse in 2025, and ClickFix attacks using fake CAPTCHA pages that trick users into running malicious commands. Recommended controls include scanning for exposed RDP, SSH, and VPN interfaces, removing unneeded local admin rights, enabling Windows Defender tamper protection, disabling SMBv1, and standardizing on one approved remote access tool, guided by CIS and NIST frameworks.

HuntressSep 10, 15:00 UTC · 6d agoAdvisory

PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.

A suspected Russian-speaking actor exploited the CVE-2026-81578 authentication bypass and CVE-2026-82078 RCE chain in PaperCut NG/MF, compromising at least 440 instances across 395 organizations in 48 countries, heavily targeting education in the US, UK, France, and elsewhere. The actor used hundreds of AI agents powered by OpenAI Codex and DeepSeek plus tools like Mimikatz, SharpHound, Certipy, Rubeus, and Impacket, reaching domain admin at 12 victims and full domain admin at a US high school within seven minutes. Post-exploitation included registry hive collection and Metasploit/Meterpreter payloads, with origin traced to IP 45.142.193.132.

The Hacker Newsupdated Sep 11, 10:05 UTC · 5d agofirst Sep 10, 11:41 UTC · 6d agoThreat actor in the wild 6 sources CVE-2026-81578 CVE-2026-820781

Amasty patches dozens of Magento extensions, 2 critical

Amasty patched dozens of Magento/Adobe Commerce extensions, including two critical flaws allowing unauthenticated web shell upload and remote code execution.

Extension vendor Amasty released fixes for a large batch of Magento and Adobe Commerce modules, with critical unauthenticated file upload flaws in Advanced Product Reviews and Gift Card that allow attackers to plant web shells and take full control of stores. Dozens of additional high-, medium- and low-severity extensions were also patched. The vendor says the release affects almost every Magento and Adobe Commerce store. A related Order Attributes flaw was previously exploited heavily, with Sansec Shield blocking over 12,000 attempts against 25% of Magento stores in three days.

Sansec (Magento / e-commerce security)Sep 9, 15:27 UTC · 7d agoVulnerability

Proofpoint 2026 Voice of the CISO Report Finds Cyber Resilience Improving, While AI Expands the CISO Mandate

Proofpoint's 2026 survey of 1,600 CISOs finds improving cyber resilience, rising human risk, and expanding AI responsibilities without added resources.

Proofpoint released its 2026 Voice of the CISO report, a Censuswide-conducted survey of 1,600 CISOs across 16 countries fielded in May 2026. Expected material cyberattacks fell from 76% to 61% year over year and material data loss declined from 66% to 53%, but 79% of CISOs now identify human risk as their biggest vulnerability and GenAI security concerns jumped 18 points to 78%. The report also finds 79% of CISOs expect to manage AI-related risks without proportional resources, and 85% say boards are evaluating cyber risk through a commercial lens.

Proofpoint Threat InsightSep 9, 02:03 UTC · 8d agoIndustry

August 2026 CVE Landscape

Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.

Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.

Recorded FutureSep 8, 00:00 UTC · 9d agoVulnerability in the wildCVE-2025-62593 CVE-2026-72898 CVE-2026-9198+4 CVEs1

Hunting Vulnerabilities Using Frontier Models

Okta used frontier AI models GPT-5.5 Cyber and Mythos via OpenAI and Anthropic programs to scan millions of code lines for vulnerabilities.

Okta describes using frontier AI models, including GPT-5.5 Cyber Preview (TAC) and Mythos Preview, through OpenAI's Daybreak Cyber Partner Program and Anthropic's Project Glasswing to hunt vulnerabilities across its product codebase. The team built a custom Python orchestrator with strong isolation, vendor-agnostic model support, and four distinct scanning pipelines executed as isolated Codex or Claude Code sessions with progressive context loading to reduce context bloat. Human experts and AI agents worked both autonomously and in paired hunts, and Okta reports the best results when humans and agents taught each other.

Okta SecuritySep 8, 00:00 UTC · 9d agoResearch

Supply Chain Attacks in 2026: Why Threat Intelligence Is the Only Early Warning System That Works

Cyble argues supply chain attacks are a primary breach vector, citing Verizon DBIR third-party figures and CISA SBOM guidance to pitch its TPRM platform.

Cyble's vendor blog frames third-party compromise as a first-order breach risk, citing Verizon's 2026 DBIR finding that third parties were involved in 48% of breaches, up 60% year over year. It recounts the Cl0p campaigns against Progress MOVEit Transfer (CVE-2023-34362), which affected over 2,700 organizations and 93 million people, and Fortra GoAnywhere (CVE-2023-0669) with roughly 130 claimed victims. It also highlights CISA and NSA's 2026 Minimum Elements for a Software Bill of Materials covering open-source, AI, and SaaS components. The piece concludes by promoting Cyble's Third-Party Risk Management platform.

CybleSep 3, 08:21 UTC · 14d agoIndustry CVE-2023-34362 CVE-2023-0669

H1 2026 Malware Vulnerability Trends

Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.

Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.

Recorded FutureSep 3, 00:00 UTC · 14d agoThreat actor in the wild1

The Collective Cyber Defense letter wrote your next vendor questionnaire

Op-ed argues the 200-company Collective Cyber Defense letter's three endorsed metrics should become standard vendor procurement questions.

More than 200 companies including Microsoft, Google, AWS, CrowdStrike, Anthropic and Okta signed an August 27 open letter calling for faster cyber defenses against AI-enabled attacks. The letter endorses three measurable metrics: coverage, containment speed, and verified remediation. The author turns those into five concrete procurement questions buyers should pose at vendor renewals, while noting the letter contains no deadlines, dollar figures or measurable targets.

CyberScoopSep 1, 10:00 UTC · 15d agoIndustry

IAM Compliance Requirements and Best Practices

A guide maps IAM compliance requirements across SOX, PCI DSS, HIPAA, ISO 27001 and NIST 800-53, urging verified enforcement over documented policies.

The guide argues IAM compliance requires demonstrating that access controls are enforced at runtime, not merely documented, highlighting gaps between policy intent and application-layer execution. It maps recurring requirements across SOX ITGCs, PCI DSS v4.0, HIPAA, ISO/IEC 27001:2022, NIST SP 800-53 and GDPR, covering least privilege, separation of duties, access certification and audit trails. It recommends continuous, evidence-backed verification and application-layer telemetry instead of relying on identity provider logs or quarterly access reviews.

The Hacker NewsAug 28, 09:06 UTC · 20d agoIndustry

The AI Malware Maturity Gap

Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.

Recorded Future proposes AIM3, a five-level model defining AI malware from LLM-translated to LLM-embedded, spanning experimentation to fully autonomous agentic campaigns. Public examples remain early-stage: PROMPTFLUX uses Google Gemini to rewrite its VBScript dropper (Level 1), while Lamehug/PROMPTSTEAL, attributed to APT28, invokes the HuggingFace API to generate reconnaissance commands (Level 3). The authors argue most current AI malware augments existing tradecraft rather than enabling one-click autonomous attacks.

Recorded FutureAug 26, 00:00 UTC · 22d agoResearch

Top 10 Best Microsoft Azure Security Tools in 2026

An editorial roundup of the ten best Azure security tools in 2026 names Defender for Cloud the native floor, with Wiz, Orca, and Prisma Cloud leading third-party options.

The brief reviews ten Azure security tools, positioning Microsoft Defender for Cloud's free foundational tier and published per-resource plans as the rational starting point for every Azure estate. Wiz and Orca are shortlisted for agentless attack-path correlation, Prisma Cloud for multicloud breadth, CrowdStrike for runtime protection, and Tenable for CIEM depth with Entra permission analytics. The piece emphasizes Azure's tight identity-infrastructure coupling via Entra ID as both an operational advantage and its most critical risk surface. Scoring is editorial, not lab-tested, with pricing compared by model only.

Cyber Security News08:31 UTC · 1h agoIndustry

Echo: Learning-based Matching Decompilation using Trusted Back Translation

Researchers introduce Echo, a matching decompiler using trusted back-translation that roughly doubles exact-match rates and outperforms GPT-5.6 and Codex on Mirai.

Echo performs matching decompilation by using compilation as trusted feedback for iterative search: a domain-specific model generates candidate code and compilation configurations, which are recompiled, compared at assembly level, and repaired via rule-based rewriting, neural refinement, and reasoning-based refinement. On function-level benchmarks, Echo produces 2.43x more exact matches than the strongest baseline and the highest structural similarity to ground truth. On the Mirai malware binary, it matches 2.75x and 7.4x as many functions as GPT-5.6 and Codex, respectively.

arXiv cs.CRSep 16, 14:14 UTC · 19h agoResearch

NightEagle targets Russian companies

Kaspersky links NightEagle (APT-Q-95) attacks on Russian firms to compromised VPN credentials, a GhostContainer Exchange backdoor, RDP tunneling, BlueKeep exploitation, and DCSync.

Kaspersky's Global Emergency Response Team investigated NightEagle (APT-Q-95) incidents over the past year, finding the group—active since at least 2023 and formerly focused on Asia—now targeting Russian businesses. Attackers used compromised VPN credentials and deployed the GhostContainer .NET backdoor on Microsoft Exchange servers, built from Neo-reGeorg, a CVE-2020-0688 exploit, and ysoserial's GhostWebShell, injected in memory via VIEWSTATE manipulation with AMSI bypass. For lateral movement they combined Microsoft dev tunnels with rdp2tcp over RDP, exploited BlueKeep (CVE-2019-0708) to create local admin accounts, and performed DCSync replication against Active Directory.

Kaspersky Securelistupdated 07:55 UTC · 1h agofirst Sep 16, 10:00 UTC · 23h agoThreat actor in the wild 5 sources CVE-2020-0688 CVE-2019-07081

Major Cyber Threat Detection Vendors Shift from MITRE to UK Testing Program

SE Labs launched PIVOT, a six-month vendor detection testing program backed by CrowdStrike, Fortinet, Palo Alto Networks and Sophos, as major vendors exit MITRE evaluations.

SE Labs unveiled PIVOT on September 15, a six-month testing program in which its ethical hackers replicate nation-state and criminal attack chains against participating vendor products, with results due January 2027. Broadcom (Symantec/Carbon Black), CrowdStrike, Fortinet, Palo Alto Networks and Sophos have confirmed participation, and Gartner and Forrester analysts will verify the underlying evidence before publication. The launch follows declining participation in MITRE Engenuity ATT&CK Evaluations: Enterprise, which fell from 30 vendors in 2023 to 11 in 2025 after public withdrawals by Microsoft, SentinelOne and Palo Alto Networks.

Infosecurity Magazineupdated 08:33 UTC · 1h agofirst Sep 16, 09:00 UTC · 1d agoIndustry 12 sources

Top 10 Best Cloud Detection & Response (CDR) Solutions in 2026

Editorial scorecard ranks ten 2026 cloud detection and response platforms; Sysdig, Wiz, and CrowdStrike lead, with Wiz's Gem Security acquisition highlighted.

The editorial scorecard rates ten CDR platforms on real-time detection (30%), cloud telemetry depth, response automation, correlation, and value. Sysdig earns the best real-time detection score for its Falco- and eBPF-powered runtime telemetry, Wiz (8.7) folds acquired Gem Security's real-time CDR into its security graph, and CrowdStrike (8.7) leads response automation. Specialists Stream.Security, Skyhawk Security, Sweet Security, and the open-source Falco project are also assessed.

Cyber Security NewsSep 16, 07:41 UTC · 1d agoIndustry1

Mapping out your unknown: A threat hunter’s guide to GitHub

Datadog Security Labs publishes a threat-hunting guide with audit-log queries to detect GitHub token theft, device code phishing, and source code exfiltration.

Datadog's threat-hunting guide covers GitHub audit log queries for detecting compromised accounts, stolen personal access tokens, and malicious OAuth app authorizations. Attackers typically obtain credentials through phishing, credential stuffing, leaked secrets, or device code phishing, then map private repositories, exfiltrate source code, and pivot into connected cloud and CI/CD environments. The guide maps detections to MITRE techniques like T1078 and T1528 and documents GitHub logging quirks affecting attribution, token metadata, and visibility fields.

Datadog Security LabsSep 16, 00:00 UTC · 1d agoResearch in the wild1

Schneider Electric SCADAPack x70 Products

CISA advisory: Schneider Electric SCADAPack x70 RTUs contain CVE-2026-81861, an insufficiently protected credentials flaw allowing unauthorized access to RTU configuration.

CISA advisory ICSA-26-258-04 discloses CVE-2026-81861 affecting all versions of Schneider Electric SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 remote terminal units. The CWE-522 insufficiently protected credentials vulnerability could expose authentication information and permit unauthorized access to RTU configuration through the Secure Lock functionality. The flaw carries a CVSS v3.1 base score of 6.5 (medium), and the products are deployed worldwide in critical manufacturing and energy sectors. Abhinav Agarwal reported the vulnerability to CISA.

CISA AdvisoriesSep 15, 12:00 UTC · 1d agoAdvisory CVE-2026-81861

Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds

Attacker exploited unauthenticated marimo WebSocket RCE CVE-2026-39987 to steal AWS credentials and SSH into a bastion host in eight seconds.

Sysdig Threat Research Team documented a real intrusion exploiting CVE-2026-39987 in marimo (versions up to 0.20.4, fixed in 0.23.0), where the unauthenticated /terminal/ws WebSocket endpoint exposed an interactive shell. Within eight seconds the attacker pulled AWS credentials from Redis, extracted an SSH private key from AWS Secrets Manager via Boto3, and authenticated to a bastion host; over nine hours the operator ran 850+ commands using a staged custom Python toolkit. Blocked EC2 Instance Connect attempts (SendSSHPublicKey to placeholder instance i-0000000000000000) provide a high-confidence detection signal.

GBHackersupdated Sep 15, 11:52 UTC · 1d agofirst Sep 15, 09:58 UTC · 1d agoExploit / PoC in the wild 4 sources CVE-2026-399873· 1 read

AI is exposing a security structure built for yesterday’s threats

EY's Jeffrey Sallet argues AI-driven deepfakes and impersonation require integrating cybersecurity, physical security, HR and legal functions.

The opinion piece contends AI-powered impersonation, deepfakes and automated social engineering cross digital, physical and operational boundaries that siloed security programs cannot cover. It cites an EY survey of 250 corporate leaders where only 12% feel most prepared to detect a targeted physical attack, and describes transnational groups using deepfakes and stolen identities to bypass virtual HR hiring loops. The author urges unified cross-functional verification pipelines and shared threat intelligence between CISOs and chief security officers.

CSO OnlineSep 15, 09:00 UTC · 2d agoIndustry

Top 10 Best Kubernetes Security Tools in 2026

Top 10 Kubernetes security tools roundup highlights Sysdig and Aqua as specialists plus strong free options Kubescape, Calico, and Falco.

A buying guide ranks ten Kubernetes security tools across admission control, network policy, runtime detection, and posture management. Sysdig leads runtime depth, Aqua leads full lifecycle, Red Hat ACS owns OpenShift estates, and Wiz offers agentless graph correlation. The guide notes this category has cloud security's strongest open-source floor with Kubescape, Calico, and Falco.

Cyber Security NewsSep 15, 06:41 UTC · 2d agoIndustry1

Top 10 Best Cloud Infrastructure Entitlement Management (CIEM) Tools in 2026

2026 CIEM guide ranks Wiz, Prisma Cloud, Okta, Entra Permissions Management and specialists Sonrai, Britive, Tenable/Ermetic for cloud entitlement right-sizing.

Buyer's guide covers ten CIEM products across three market routes: CNAPP-bundled (Wiz, Prisma Cloud), identity-suite (Okta, CyberArk, SailPoint, Saviynt) and specialists (Sonrai, Britive, Tenable/Ermetic). It cites machine identities outnumbering humans 10:1 plus effective-permissions sprawl as core drivers, with JIT elevation as the fix. Notable consolidation includes Tenable acquiring Ermetic and Zscaler acquiring Canonic.

Cyber Security NewsSep 15, 06:30 UTC · 2d agoTools

Homebrew 7.0.0 is out, here’s what changed for security

Homebrew 7.0.0 closes eight security advisories, including a High sudo execution bug fixed in 6.0.12, and ships brew vulns vulnerability scanning.

Homebrew 7.0.0 closes eight security advisories rated one High, two Moderate, and five Low. The High flaw let unsigned cask removal metadata execute commands with sudo (fixed in 6.0.12), while the 7.0.0 Moderate closes a LaunchServices escape that let a malicious cask execute code outside the macOS install sandbox. The release ships brew vulns, which checks installed formulae against OSV.dev, extends build attestation verification to third-party tap bottles, and replaces Bubblewrap with Landlock sandboxing on Linux.

Help Net SecuritySep 15, 00:47 UTC · 2d agoVulnerability