Search: “Secure Connect Gateway”

70 stories in the last 30d

Dell patches three critical flaws (CVSS up to 9.8) in Secure Connect Gateway 5.0 enabling admin token replay, unauthenticated RCE, and root escalation.

Dell disclosed three critical vulnerabilities in Secure Connect Gateway 5.0 appliance and application deployments. CVE-2026-80172 (CVSS 9.8) lets unauthenticated attackers replay captured requests, which lack nonce validation and time limits, to repeatedly mint administrator access and refresh tokens. CVE-2026-61410 (9.4) is a missing-authorization flaw enabling unauthenticated remote command execution, and CVE-2026-80238 (9.3) is an exposed Docker socket allowing local privilege escalation to root and container escape. Fixes ship in appliance 5.36.00.16 and application 5.36.00.00.

Cyber Security NewsSep 8, 15:22 UTC · 8d agoVulnerability CVE-2026-80172 CVE-2026-61410 CVE-2026-80238

Dell Secure Connect Gateway Critical Flaws Allow Unauthenticated Remote Code Execution and Admin Access

Dell patched three critical Secure Connect Gateway flaws (CVE-2026-80172 up to CVSS 9.8) enabling unauthenticated admin access, remote code execution, and host takeover.

Dell Security Advisory DSA-2026-382 fixes three critical vulnerabilities in Secure Connect Gateway (SCG) 5.0, affecting appliances earlier than 5.36.00.16 and applications earlier than 5.36.00.00. CVE-2026-80172 (CVSS 9.8) allows unauthenticated replay of captured requests to obtain ADMIN access due to missing nonce and time validation; CVE-2026-61410 (9.4) enables unauthenticated command execution via missing authorization; CVE-2026-80238 (9.3) involves an exposed Docker socket allowing root access and container escape. Dell urges immediate upgrades and recommends restricting management interfaces to trusted networks and rotating credentials if compromise is suspected.

GBHackersSep 8, 12:04 UTC · 9d agoVulnerability CVE-2026-80172 CVE-2026-61410 CVE-2026-80238

Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week

GBHackers weekly digest rounds up 50 stories including Microsoft's 973-CVE patch drop, exploited Cisco FMC flaws, and Claude agent attacks.

GBHackers' September 7-12, 2026 newsletter summarizes the 50 biggest cybersecurity stories of the week. Highlights include Microsoft patching a record 973 CVEs with two exploited zero-days, active exploitation of Cisco FMC, Check Point VPN and Ivanti flaws, China-linked crews chaining Chrome and Windows zero-days, AI agents mass-exploiting PaperCut to compromise 440 servers, and the emergence of Panzer cross-platform ransomware. It also covers Anthropic and OpenAI agentic AI incidents and CrowdStrike's SafeMind launch.

GBHackersSep 15, 11:44 UTC · 2d agoIndustry in the wild

Hackers Favor US Eastern Business Hours in M365 Phishing Campaign

KnowBe4 tracked 29,785 phishing emails abusing Microsoft 365 Direct Send to spoof internal senders while timing sends to US Eastern business hours.

KnowBe4 Threat Lab observed 29,785 confirmed phishing emails between July and August 2026 abusing Microsoft 365's Direct Send feature, which lets devices and legacy apps send mail without a dedicated account. The emails appeared to come from trusted internal addresses such as HR or accounting, bypassing email gateways by connecting directly to Exchange Online MX endpoints, with activity peaking on Monday-Tuesday during US Eastern business hours and near-zero weekend volume. About 35% of the messages carried malicious attachments like fake invoices, voicemail alerts, and OneDrive shares, and 4,023 used reply-to addresses on different domains to capture employee responses. Researchers recommended strict DMARC enforcement, connector restrictions, DKIM signing, and checking for the 'X-MS-Exchange-Organization-AuthAs: Anonymous' Exchange header.

Infosecurity Magazineupdated Sep 16, 14:54 UTC · 22h agofirst Sep 11, 13:30 UTC · 5d agoPhishing & fraud in the wild 9 sources2

CISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers Do

CISA urged water utilities to secure internet-exposed PLCs after July 2026 attacks compromised over 100 US water and wastewater systems, suspected Iran-linked.

CISA's exposure-reduction guidance, published August 21, follows July 2026 attacks in which threat actors remotely accessed PLCs connected directly through cellular modems, changed device IP addresses and passwords, and in some cases disabled alarms and shutdown processes without notifying operators. Iran is the suspected actor, though officials stopped short of formal attribution. CISA recommends routing remote access through centrally managed secure gateways, phishing-resistant MFA, unique credentials, and external scanning of industrial protocols such as Modbus, EtherNet/IP, DNP3, BACnet and OPC UA.

Security AffairsAug 27, 07:36 UTC · 21d agoExploit / PoC in the wild

Critical Check Point VPN Vulnerabilities Enable Remote Code Execution Attacks

Check Point patched two critical VPN flaws, CVE-2026-85102 and CVE-2026-85103 (CVSS 9.8), allowing unauthenticated RCE on Security Gateways.

Check Point disclosed and patched two critical VPN vulnerabilities, CVE-2026-85102 (improper certificate trust validation, CWE-295) and CVE-2026-85103 (heap-based buffer overflow in ASN.1 certificate parsing, CWE-122), both rated CVSS 9.8 and exploitable for unauthenticated remote code execution under specific conditions. The flaws affect Security Gateway, Security Management Server, and Spark Firewall deployments on R81.20, R82, and R82.10 branches plus end-of-support versions such as R80.40 and R81, while R82.20 is not affected. Check Point reports no evidence of active exploitation or public PoC; Live Patch rollout began September 9, 2026, and administrators without it must install Jumbo Hotfix Accumulator builds (R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+). For Site-to-Site VPN, restricting UDP ports 500 and 4500 to known peers serves as an interim workaround, but no mitigation exists for Remote Access VPN or Spark Firewalls.

Cyber Security NewsSep 10, 12:31 UTC · 7d agoVulnerability CVE-2026-85102 CVE-2026-85103 CVE-2026-50751

SonicWall's SMA1000 boxes under active attack again

SonicWall warns attackers are chaining two SMA1000 zero-days, a CVSS 10.0 SSRF and command injection, to compromise VPN gateways.

SonicWall says attackers are actively exploiting two chained zero-days in SMA 1000 appliances: CVE-2026-83548, a pre-authentication SSRF rated CVSS 10.0, and CVE-2026-83549, a post-authentication OS command injection (CVSS 7.8) in the Appliance Management Console. Hotfixes are available for SMA 6210, 7210, and 8200v appliances with no workarounds; SonicWall recommends reimaging compromised devices, rotating passwords, and resetting TOTP tokens. NHS England assesses further exploitation as almost certain, following a similar exploited pair in July when CISA added CVE-2026-15409 to its KEV catalog.

The Register · SecuritySep 2, 16:05 UTC · 14d agoExploit / PoC in the wildCVE-2026-83548 CVE-2026-83549 CVE-2026-15409

Hackers Chain Two New SonicWall Zero-Day Vulnerabilities

SonicWall warns two zero-days (CVE-2026-83548 SSRF, CVE-2026-83549 post-auth RCE) in SMA1000 appliances are being actively exploited.

A September 1 SonicWall advisory discloses actively exploited zero-days in SMA1000 appliance models 6210, 7210 and 8200v, affecting platform-hotfix versions 12.4.3-03453 and 12.5.0-02835 and older. CVE-2026-83548 (CVSS 10.0) is a pre-authentication SSRF in the Appliance Work Place interface via an unintended alternate access path; CVE-2026-83549 (CVSS 7.8) is post-authentication OS command injection enabling RCE in the Appliance Management Console. SonicWall urges hotfix upgrades, IOC checks with SonicWall support, and re-imaging plus credential and TOTP resets if compromise is found.

Infosecurity MagazineSep 2, 09:00 UTC · 15d agoExploit / PoC in the wildCVE-2026-83548 CVE-2026-83549

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.

Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.

Wiz BlogSep 9, 16:06 UTC · 7d agoExploit / PoC in the wildCVE-2026-59822 CVE-2026-598212

Update your firewall rules: Teams and Copilot are changing address

Microsoft is redirecting Microsoft 365 and Teams web users to new *.cloud.microsoft domains, requiring firewall and proxy rule updates by early October.

Starting September 2026, Microsoft is redirecting M365 web users to copilot.cloud.microsoft and Teams web users to teams.cloud.microsoft, announced via MessageCenter posts MC1465764 and MC1462915. All redirects should complete by early October 2026, with limited Teams exceptions possible until December 31, 2026. Microsoft advises reviewing client, proxy, firewall, and secure web gateway configurations, and suggests using TenantRestrictions to control personal Microsoft account access instead of blocking the new Copilot address.

CSO OnlineSep 11, 17:00 UTC · 5d agoAdvisory1

CISA Warns of Citrix NetScaler Authentication Bypass Vulnerability Exploited in Attacks

CISA adds exploited Citrix NetScaler authentication bypass CVE-2026-19490 to the KEV catalog; federal agencies must patch by September 12.

CISA added CVE-2026-19490, a CWE-288 authentication bypass affecting NetScaler ADC and Gateway deployments configured as AAA virtual servers or Gateway services (including SSL VPN, ICA Proxy, and RDP Proxy), to the Known Exploited Vulnerabilities catalog. Citrix released fixes on August 19, 2026; honeypots recorded 56 attack attempts between September 3 and 8 after a public PoC, though no confirmed production compromises have been reported. Affected builds include 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21; newer installations require SAML IdP configuration to be exposed.

Cyber Security Newsupdated 09:33 UTC · 3h agofirst Sep 10, 13:23 UTC · 6d agoExploit / PoC in the wild 3 sources CVE-2026-19490

Threat Actors Use Claude AI Agents to Automate Cyberattacks and Steal Sensitive Data

Anthropic reports state-linked and criminal actors used Claude AI agents to automate espionage, extortion, and exploit development, stealing 300,000+ identity records and drone IP.

Anthropic's threat report details AI-driven campaigns disrupted between December 2025 and August 2026, including suspected Russian cluster GTG-20006, which targeted Ukrainian and European governments, defense firms, and drone supply chains using fully automated attack chains. The group stole over 300,000 national identity records and commercial-registry data on 500,000+ companies from a North African government technology authority, plus a proprietary drone-vision SDK. Suspected ShinyHunters affiliates decompiled 1.8 million Android APKs on 10 Amazon EC2 workers to find hardcoded secrets and abused stolen AI API keys, while the Chinese-speaking GTG-10007 cluster generated over a dozen potential zero-day findings against network appliances in one month.

GBHackersupdated Sep 16, 17:41 UTC · 19h agofirst Sep 12, 08:40 UTC · 5d agoThreat actor in the wild 20 sources1

Getting a stranger’s phone kicked off the cellular network costs a few dollars

Researchers show attackers can remotely block strangers' phones and alarm gateways on US cellular networks by abusing lost/stolen IMEI reporting for $2.50-$4 per device.

Researchers from Michigan State University and three partner schools found six weaknesses in the lost/stolen device reporting ecosystem spanning devices, carrier systems, and cross-carrier block-list sharing. They demonstrated blocking unopened Samsung Galaxy Z Fold 7 phones and home alarm gateways on three major US carriers, with each block costing $2.50-$4 and taking roughly 20-80 seconds. The attacks exploit thin identity and ownership checks in prepaid accounts, IMEI leakage from vulnerable cellular chipsets used by two vendors with over 40% global market share, and pre-release IMEI databases purchasable for $600. Victims receive no notification, and restoring service requires proving device ownership to the carrier.

Help Net SecuritySep 11, 06:00 UTC · 6d agoResearch

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

Dutch NCSC warns exploitation is imminent for critical Check Point VPN RCE flaws CVE-2026-85102 and CVE-2026-85103, urging immediate patching of Security Gateways.

The Dutch NCSC assesses the likelihood and impact of exploitation as high for two critical Check Point VPN flaws, though no public PoC exploit has been reported. CVE-2026-85102 is improper validation of certificate data during VPN negotiation, and CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder; both enable remote code execution on Security Gateways, the latter also on Security Management Servers. Affected releases span R81.20, R82, R82.10, R81.10.x, R82.00.x and EoS versions R80 through R81.10, while R82.20 is unaffected. Check Point shipped fixes on September 9 via LivePatch Take 24 and Jumbo Hotfix Accumulator takes, and NCSC advises restricting Site-to-Site VPN rules to trusted IPs.

BleepingComputerupdated 05:23 UTC · 7h agofirst Sep 12, 14:14 UTC · 4d agoVulnerability 7 sources CVE-2026-85102 CVE-2026-851032

Top 10 Best Cloud Access Security Broker (CASB) Solutions in 2026

2026 CASB guide ranks Netskope first for depth and Microsoft Defender for Cloud Apps for Microsoft estates, as standalone CASB fades into SSE.

Buyer's guide covers ten CASB products across four enforcement modes: API, forward proxy, reverse proxy and log-based discovery. Netskope leads on SaaS activity context depth, while Microsoft Defender for Cloud Apps wins on Microsoft 365 E5 estate economics. The guide argues standalone CASB purchases have largely disappeared into SSE platforms and increasingly overlap with SSPM.

Cyber Security NewsSep 15, 06:24 UTC · 2d agoTools

Critical HPE Vulnerabilities Allow Remote Attackers to Achieve Complete System Compromise

HPE patched critical EdgeConnect SD-WAN flaws, including CVSS 9.8 unauthenticated API bypass and gateway RCE, enabling full system compromise.

HPE Security Bulletin HPESBNW05135 covers critical flaws in EdgeConnect SD-WAN Orchestrator and Gateways: CVE-2026-76669 and CVE-2026-76670 (CVSS 9.9 authorization bypass/privilege escalation), CVE-2026-76672 (CVSS 9.9, leaks third-party API tokens and credentials), CVE-2026-76673 (CVSS 9.8, unauthenticated Orchestrator API authentication bypass granting administrative privileges), and CVE-2026-76674 (CVSS 9.8, unauthenticated buffer overflow enabling arbitrary code execution on gateways). Fixes are available in ECOS 9.7.1.0/9.6.4.0/9.5.9.0/9.4.9.0 and Orchestrator 9.7.1/9.6.4/9.5.9/9.4.11 or later. HPE reported no public exploit code or active exploitation at publication and recommends isolating management interfaces on a dedicated VLAN.

Cyber Security NewsSep 16, 13:14 UTC · 23h agoVulnerability CVE-2026-76669 CVE-2026-76670 CVE-2026-76672+2 CVEs

CVE-2026-34908: UniFi OS Auth Bypass Vulnerability

Ubiquiti disclosed CVE-2026-34908, a CVSS 10.0 authentication bypass in UniFi OS letting network-adjacent attackers alter device configuration without credentials.

CVE-2026-34908 is an improper access control flaw (CWE-284) in Ubiquiti UniFi OS devices, disclosed in UI Security Advisory Bulletin 064, with a CVSS 3.1 base score of 10.0. An unauthenticated network-adjacent attacker can bypass access controls and modify system configuration, with scope-changed impact on downstream network services such as routing, VPN, and connected access points. Fixed firmware is available, and workarounds include restricting management ports to trusted subnets, isolating management interfaces on a dedicated VLAN, and disabling remote access features. No public proof-of-concept code was observed at the time of publication.

Web discovery (articles for new exploits & KEV entries)Sep 8, 21:57 UTC · 8d agoVulnerability CVE-2026-34908

Akeyless adds real-time enforcement for AI agents in production

Akeyless launches Agentic Runtime Authority, enforcing real-time intent-based access control on AI agent actions, with integrations for Claude Enterprise, OpenAI Codex and Amazon Bedrock AgentCore

Akeyless announced general availability of Agentic Runtime Authority, a real-time identity control layer that evaluates AI agent actions and blocks policy-violating actions before execution, layered on top of its SecretlessAI credential brokering. New integrations cover Claude Enterprise, OpenAI Codex and Amazon Bedrock AgentCore, alongside an Agentic Access Dashboard with session kill switches and event forwarding to Splunk, Datadog and Microsoft Sentinel. The vendor's platform already secures over 220 billion machine identity interactions for Fortune 500 organizations.

Help Net SecuritySep 9, 13:54 UTC · 7d agoTools1

Risky Bulletin: Slovakia finds Russian backdoor in traffic speed cameras

Slovakia's NBU found an SMS-triggered backdoor in Russian-made NERO R-ONE traffic cameras, pausing a 279-unit deployment.

Slovakia's national security service NBU issued an alert against NERO R-ONE high-speed traffic cameras after finding a backdoor that grants shell and network access via SMS from hardcoded Russian phone numbers. The cameras are a rebranded version of the Russian CORDON PRO.M model by St. Petersburg firm Semicon, purchased via a Cyprus shell company under a €30 million EU-funded project. The report also found SecureBoot disabled, vulnerable web management, and unauthenticated live streams; the Interior Ministry paused deployment of 279 cameras pending independent assessment.

Risky Business NewsAug 19, 04:52 UTC · 29d agoThreat actor in the wild1

Cisco Warns of Critical ISE 0-Day Vulnerability Exploited in Attacks

Cisco confirms zero-day CVE-2026-76460 (CVSS 10.0) in ISE is under active exploitation, granting unauthenticated root command execution; patches released.

Cisco's PSIRT issued an urgent advisory for CVE-2026-76460, an authentication bypass via insufficient controls on an API endpoint in Cisco ISE and ISE-PIC, confirmed to be actively exploited with a CVSS score of 10.0. Exploitation can yield root-level command execution, enabling persistence, credential theft, and lateral movement from the network policy platform. Fixed releases are ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4; EOL version 3.0 requires migration, and iACLs offer only temporary mitigation. The flaw was discovered while resolving a TAC support case, and Cisco provides hunting guidance including access.log review and firewall log analysis.

Cyber Security Newsupdated 12:40 UTC · 19m agofirst 11:10 UTC · 1h agoExploit / PoC in the wild 21 sources CVE-2026-76460

Critical WSO2 Vulnerability Allow Hackers to Gain Full Admin Access

WSO2 discloses CVE-2026-5430 (CVSS 10.0), an unauthenticated JWT authentication bypass allowing admin account takeover across its API management products.

WSO2 disclosed CVE-2026-5430, a critical authentication bypass (CVSS 10.0; 9.8 for single-tenant deployments) in advisory WSO2-2026-5328. The flaw stems from insecure JWT processing: tokens signed with unsupported algorithms bypass authentication checks, potentially granting unauthenticated attackers administrative access. Affected products include WSO2 API Control Plane 4.5.0-4.6.0, API Manager 4.1.0-4.6.0, Traffic Manager 4.5.0-4.6.0, and Universal Gateway 4.5.0-4.6.0. Fixes are available via update levels such as API Manager 4.6.0 update 21 or by migrating to unaffected releases.

Cyber Security NewsSep 16, 15:05 UTC · 21h agoVulnerability 3 sources CVE-2026-5430

Fortinet FortiSandbox Vulnerability Allows Unauthenticated Attackers to Access Sensitive Information

Fortinet fixed CVE-2026-26084, an unauthenticated access-control flaw in FortiSandbox GUI rated 8.9 CVSS, with no known exploitation yet.

Fortinet disclosed CVE-2026-26084 (advisory FG-IR-26-166), a CWE-284 improper access control flaw in the GUI of FortiSandbox, FortiSandbox Cloud and FortiSandbox PaaS, rated 8.9 CVSS v3.1. An unauthenticated remote attacker can send specially crafted HTTP requests to control NAT rules and expose sensitive information. Affected versions include FortiSandbox 4.4.0-4.4.8 and 5.0.0-5.0.5 (plus Cloud/PaaS 5.0.4-5.0.5), fixed in 4.4.9 and 5.0.6. Fortinet researcher Adham El Karn found the flaw internally and the September 8 advisory reports no known exploitation.

GBHackersSep 9, 07:15 UTC · 8d agoVulnerability CVE-2026-26084

LiteLLM Flaws Let Attackers Execute Code as Root and Steal Cloud Credentials

Wiz disclosed LiteLLM flaws including CVE-2026-59822 MCP auth bypass, now in CISA KEV, enabling root RCE and AWS credential theft from exposed gateways.

Wiz researchers disclosed weaknesses in the open-source LiteLLM AI gateway: CVE-2026-59821 allows authenticated administrators to execute code as root via the Custom Code Guardrails feature, while CVE-2026-59822 is an MCP authentication bypass where a meaningless Bearer token establishes a valid session. The MCP bypass was observed in the wild through Wiz honeypots and added to CISA's Known Exploited Vulnerabilities catalog on September 2. A scan of 3,074 internet-facing instances found 294 (9.6%) accepting the default master key sk-1234 or lacking authentication. Fixes shipped in LiteLLM 1.82.0 (guardrail hardening) and 1.84.0 (MCP bypass); exposed instances can leak provider API keys and temporary AWS IAM credentials via the pass-through feature and metadata service, with a related config-check issue tracked as CVE-2026-35029.

Cyber Security NewsSep 10, 12:26 UTC · 7d agoExploit / PoC in the wildCVE-2026-59821 CVE-2026-59822 CVE-2026-35029

Microsoft Exchange Vulnerability CVE-2026-62911: What Administrators Should Do and How Zscaler Can Help

High-severity authentication bypass CVE-2026-62911 in Exchange Server has public exploit code; about 22,000 servers remain unpatched and internet-exposed.

Microsoft's August 2026 Patch Tuesday fixed CVE-2026-62911 (CVSS 8.0), an authentication bypass affecting Exchange Server 2016, 2019 and Subscription Edition. Successful exploitation lets an attacker with basic privileges take over all mailboxes on the targeted server, including reading and sending email and downloading attachments. As of September 1, Shadowserver identified roughly 22,000 unpatched, internet-exposed Exchange servers, including about 6,200 in the US and 5,100 in Germany. NCSC-NL confirmed working exploit code is publicly available, while CISA has not yet reported exploitation in the wild.

Zscaler ThreatLabzSep 3, 20:19 UTC · 13d agoVulnerability CVE-2026-629112

Access Control as Verified Parse Constraints

Researchers verify a class of EverParse validators that correctly enforce access-control policies, deploying a machine-checked enforcement gate on seL4.

The paper targets enforcement-code bugs in commercial security gateways by proving that forward-only, backtrack-free EverParse validators are verified recognizers for a bounded finite-state class that includes access-control decision functions with fixed-offset fields and bounded disjunction. Encoding a bounded policy language into a fixed-size byte buffer allows an SMT solver to verify the enforcement code once, covering all byte values, policies, requests, and sessions. Editing rule content over a fixed endpoint set requires no new proof, while adding endpoints reruns the toolchain. A deployment on the seL4 microkernel ensures every request passes through the gate and unverified components cannot corrupt the enforcement chain.

arXiv cs.CRSep 11, 06:33 UTC · 6d agoResearch1

Top 10 Best Mobile Device Management (MDM) Solutions in 2026

A 2026 MDM buyer guide ranks ten solutions, recommending Microsoft Intune for Microsoft 365 estates and Jamf for Apple-only environments.

A 2026 buyer guide evaluates ten mobile device management solutions, leading with Microsoft Intune as the default for Microsoft 365 organizations and Jamf for Apple estates. It recommends choosing the enrolment model before selecting a vendor and clarifying BYOD visibility to prevent privacy disputes. Kandji, Mosyle, Omnissa Workspace ONE, ManageEngine, Scalefusion, and Hexnode are covered as alternatives. Guidance ties MDM to Zero Trust data access policies via Apple User Enrolment and Android work profiles.

Cyber Security NewsSep 9, 07:45 UTC · 8d agoIndustry

ClearFake Deploys Crypto Stealer That Uses Vulnerable Driver to Kill EDR Security Tools

Cisco Talos details ClearFake's fake-CAPTCHA chain deploying ZigCryptoStealer with a BYOVD attack that kills EDR processes, observed at a Ukrainian government organization in April 2026.

ClearFake compromises websites, injects JavaScript via a malicious Cloudflare Worker, retrieves instructions from BNB Smart Chain contracts (EtherHiding), and presents a fake Google CAPTCHA that tricks Windows users into pasting a command that loads a remote library over WebDAV via rundll32. The crypto-stealer branch uses DLL side-loading with a signed Chrome component to launch ZigCryptoStealer, which hijacks clipboard cryptocurrency addresses, alongside a signed but vulnerable Windows driver used in a BYOVD attack to terminate EDR processes. A parallel branch delivers Amatera secondary payloads that install a hidden remote-access client providing operator desktop control, with Cisco Talos tracking the remote-loader activity as UAT-10820. Talos observed unusual remote library execution at a Ukrainian government organization in April 2026 and assesses the attacks are part of a broader theft operation rather than a single targeted campaign.

Cyber Security NewsSep 9, 14:26 UTC · 7d agoMalware in the wild1

AWS Console Private Access can block sign-ins to personal accounts

AWS Console Private Access goes GA, letting internet-isolated VPCs reach the console fully over PrivateLink and blocking personal account sign-ins.

AWS Console Private Access became generally available on August 28, allowing the AWS Management Console, sign-in flows, static assets, and console-only APIs to run entirely over PrivateLink endpoints from VPCs with no internet connectivity. Deployment requires three interface endpoints per Region, correct Private DNS and security group settings, and uses aws:PrincipalOrgID policies plus sign-in resource control policies to deny authentication from unexpected networks, which blocks corporate-network users from signing into personal AWS accounts. IAM Identity Center sign-in and consoles for services without PrivateLink support still need internet access, and a misconfigured policy can lock out the whole organization, so AWS recommends an excluded break-glass role; CLI and SDK SigV4 requests bypass these policies and serve as a recovery path.

Help Net SecurityAug 31, 00:00 UTC · 17d agoTools

CVE-2026-50522: Patch Critical SharePoint RCE Now

Microsoft patched CVE-2026-50522 (CVSS 9.8), an unauthenticated deserialization RCE in on-premises SharePoint servers, in its July 2026 updates; no exploitation confirmed at disclosure.

CVE-2026-50522 is a critical (CVSS 9.8) deserialization of untrusted data flaw (CWE-502) allowing unauthenticated remote code execution on on-premises Microsoft SharePoint servers. It affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, with fixes shipped in Microsoft's July 14, 2026 security updates; SharePoint Online is not listed as affected. No public evidence of active exploitation of this specific CVE existed at disclosure, though CISA's SSVC judged the attack automatable with total technical impact.

Web discovery (articles for new exploits & KEV entries)Sep 8, 09:32 UTC · 9d agoVulnerability CVE-2026-505221

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.

Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.

Tenable BlogSep 8, 18:07 UTC · 8d agoVulnerability in the wildCVE-2026-81963 CVE-2026-858801

The 12 Best Managed Firewall Services, Compared and Priced

GBHackers compares 12 managed firewall service providers, naming Fortinet best value and Secureworks best detection while flagging recent ownership changes.

The buyer's guide evaluates 12 managed firewall/MSSP providers across cost tiers, contract terms, and service models. Fortinet is rated best value, Secureworks best detection, NTT Data best global reach, and Cato Networks best for organizations wanting to stop owning firewalls. The article highlights that Secureworks was acquired by Sophos for roughly $859 million in February 2025, the Trustwave-Cybereason merger was terminated in March 2025, LevelBlue is the rebranded AT&T Cybersecurity business, and Comcast Business absorbed Masergy.

GBHackersSep 8, 10:20 UTC · 9d agoIndustry 2 sources

Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models

Cloudflare launches invitation-only Vulnerability Discovery and Remediation within Managed Defense, using OpenAI Daybreak models and WAF context to prioritize and patch vulnerabilities.

Cloudflare announced early access to Vulnerability Discovery and Remediation, an invitation-only service within Cloudflare Managed Defense. The service uses OpenAI Daybreak models, including GPT-5.6 Cyber, via the Daybreak Defense Network to hunt and validate vulnerabilities in customer-authorized codebases across Workers and proxied applications. Findings are prioritized using production traffic, WAF rule, and security event context, and proposed patches and WAF mitigations are automatically checked before customer review.

Cloudflare BlogSep 3, 21:03 UTC · 13d agoTools

CISA Warns of Cisco Secure Email Gateway 0-Day Vulnerability Actively Exploited in Attacks

CISA added actively exploited Cisco Secure Email Gateway SQL injection flaw CVE-2026-76461 to its KEV catalog, enabling unauthenticated root command execution.

CVE-2026-76461 is an unauthenticated SQL injection (CWE-89) in Cisco AsyncOS for Cisco Secure Email Gateway appliances, allowing remote attackers to execute arbitrary OS commands with root privileges. CISA added the flaw to the KEV catalog on September 14, 2026, requiring federal civilian agencies to apply vendor mitigations by September 17, 2026, and forensic triage under BOD 26-04. A compromised gateway could let attackers alter email security policies, access stored messages, disable logging, and pivot into enterprise networks.

Cyber Security Newsupdated Sep 16, 13:57 UTC · 23h agofirst Sep 15, 14:46 UTC · 1d agoExploit / PoC in the wild 17 sources CVE-2026-76461

Nearly 1 in 10 Exposed LiteLLM Gateways Accepted the Example "sk-1234" Admin Key

Wiz found 294 of 3,074 internet-facing LiteLLM gateways accepted the documented default admin key sk-1234, exposing provider API keys and cloud IAM credentials.

Wiz Research's February Shodan scan found 3,074 LiteLLM gateways, 294 of which accepted the setup guide's sk-1234 admin key; 191 had no master key set and would accept any credential. The master key doubles as the authentication switch, and before 1.82.0-stable a gateway started without one granted every request full admin rights, exposing stored provider API keys, prompts, and MCP-connected tools. A documented pass-through endpoint lacks checks against private and cloud metadata addresses, letting an admin-key holder retrieve cloud IAM credentials, though no real-world abuse is reported. Related LiteLLM flaws include CVE-2026-59821 (disputed guardrail code execution), CVE-2026-59822 (CVSS 8.8, added to CISA KEV on September 2 and observed against Wiz honeypots), and CVE-2026-42271, used to install a cryptominer.

The Hacker NewsSep 10, 07:12 UTC · 7d agoVulnerability in the wildCVE-2026-59821 CVE-2026-59822 CVE-2026-42271+2 CVEs

Exaforce extends its AI security tool to monitor more than just Claude

Exaforce AI Security extends beyond Claude to monitor OpenAI, Gemini, and Copilot agents using existing SOC telemetry, no new endpoint agents.

Exaforce expanded its June Claude Compliance API integration into Exaforce AI Security, adding monitoring for OpenAI, Gemini, Microsoft Copilot, and OAuth-connected AI apps. The tool inventories AI agents by correlating EDR, cloud, SaaS, and model-provider logs without new gateways or endpoint agents, and can respond by revoking sessions, deactivating API keys, isolating devices, or killing agent processes via existing controls. Analysts note the agentless approach lowers friction but lacks runtime inspection and inline blocking offered by competitors such as Palo Alto Prisma AIRS, SentinelOne Prompt AI Agent Security, and CrowdStrike Falcon Guardian. A March 2026 Cloud Security Alliance survey found 68% of organizations cannot distinguish human from AI-agent activity and 74% report AI agents receive excessive access.

CSO OnlineSep 15, 13:00 UTC · 1d agoTools

Top 10 Best Multi-Cloud Security Platforms in 2026

An editorial roundup of the ten best multi-cloud security platforms for 2026, split between CNAPPs (Wiz, Prisma Cloud) and cloud-networking security (Aviatrix).

The article frames multi-cloud security as two markets: CNAPP platforms (Wiz, Prisma Cloud, CrowdStrike, Orca, Defender) securing what runs in clouds, and cloud-networking-security platforms (Aviatrix) securing how clouds connect. It ranks ten platforms including Palo Alto Prisma Cloud for breadth, Wiz for correlation, Check Point CloudGuard, Fortinet, Aviatrix, Microsoft Defender for Cloud, Trend Micro, and CrowdStrike. It flags the ~$32 billion Google–Wiz acquisition as raising cloud-neutrality questions buyers should address contractually.

Cyber Security NewsSep 16, 09:50 UTC · 1d agoTools1

Okta Patches Auth0 and Access Gateway Vulnerabilities Let Attackers Enable XSS, Authentication Bypass and SQL Injection

Okta patches three high-severity flaws in Auth0 AD/LDAP Connector and Access Gateway: stored XSS, auth bypass, SQL injection.

Okta disclosed on September 8, 2026 three vulnerabilities: CVE-2026-85982, a CVSS 9.0 stored XSS in Auth0 AD/LDAP Connector before 8.0.0; CVE-2026-78626, a CVSS 8.1 Protected Rule authorization bypass in Access Gateway before 2026.9.1; and CVE-2026-78623, a CVSS 7.7 SQL injection in Access Gateway advanced-mode datastores. Exploitation requires authenticated access and specific configurations. Fixes require upgrading the connector to 8.0.0+ and Access Gateway to 2026.9.1+.

GBHackersSep 11, 09:42 UTC · 6d agoVulnerability 2 sources CVE-2026-85982 CVE-2026-78626 CVE-2026-786231

Critical Cisco Nexus 9000 Flaw Lets Unauthenticated Remote Attackers Run Code as Root

Cisco patches critical CVE-2026-20212 (CVSS 9.8) in Nexus 9000 switches allowing unauthenticated remote root code execution, plus IOS XR hardening release.

Cisco released fixes for CVE-2026-20212 (CVSS 9.8), a flaw in 10 Silicon One-based Nexus 9000 switch models that binds a service to an unrestricted IP, leaving TCP ports 43210/43211 reachable in the default Layer 3 VRF and allowing unauthenticated remote attackers to execute code as root; exploitation attempts can also crash the S1HAL process. 45 NX-OS releases (10.3(1) through 10.6(3s)) are affected, with mitigations including infrastructure ACLs, the Live Protect shield lp00031, and fixed releases identified via Cisco's Software Checker. Cisco simultaneously issued an IOS XR hardening release bundling 7 umbrella CVEs, two rated 9.8 (CVE-2026-20274 for memory-safety bugs and CVE-2026-20279 for access-control bugs), affecting all releases with SMUs available for 14 releases and upgrades required for 93 of 111 listed releases. No malicious exploitation was reported as of the September 2 disclosure.

The Hacker NewsSep 3, 15:52 UTC · 13d agoVulnerability CVE-2026-20212 CVE-2026-20274 CVE-2026-20279+5 CVEs

CVE-2026-16232: Check Point SmartConsole Auth Bypass

Check Point SmartConsole authentication bypass CVE-2026-16232 grants unauthenticated attackers full admin access; actively exploited and added to CISA KEV.

CVE-2026-16232 is an improper authentication flaw (CWE-287) in the Check Point SmartConsole login process that lets an unauthenticated remote attacker obtain an application token and authenticate with full administrative privileges. Exploitation requires the Management Server to be internet-reachable and the Trusted Clients list not restricted to specific administrator addresses. Check Point confirmed active exploitation affecting a small number of customers, and the vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog. A hotfix is available via Check Point advisory sk185169.

Web discovery (articles for new exploits & KEV entries)Sep 4, 10:49 UTC · 13d agoExploit / PoC in the wildCVE-2026-162321

mySCADA myPRO Manager

CISA advisory reveals unauthenticated privileged API access and arbitrary SMS sending in mySCADA myPRO Manager <=2.1, CVSS 9.8.

CISA advisory ICSA-26-258-03 discloses two vulnerabilities in mySCADA myPRO Manager <=2.1 with aggregate CVSS v3 of 9.8. CVE-2026-73807 (CVSS 9.8) lets unauthenticated network attackers access privileged management functions via the command API, while CVE-2026-82567 exposes an unauthenticated HTTP endpoint that sends arbitrary SMS messages through a connected GSM modem. Deployments span critical manufacturing, energy, food and agriculture, transportation, and water and wastewater sectors. CISA states no known public exploitation has been reported at this time.

CISA AdvisoriesSep 15, 12:00 UTC · 2d agoAdvisory CVE-2026-73807 CVE-2026-82567