ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “developer productivity”

256 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllIndustry 60Exploit / PoC 40Threat actor 38Tools 26Vulnerability 26Policy & legal 21Malware 21Research 17Advisory 12Phishing & fraud 9Data breach 7Ransomware 3
SeverityAllcritical 29high 74medium 52low 2info 123

How Developers Prevent Production Risk at the Source

Wiz argues shift-left code-stage security cuts remediation costs and ships Wiz Code, WizOS, and WizCLI to catch flaws pre-deployment.

A Wiz blog post argues that fixing vulnerabilities at the code stage costs a fraction of production remediation, citing the node:20-slim base image which ships 14 known CVEs, three of them critical. It claims AI agents can now analyze open-source commits and generate working exploits in minutes, shrinking the window between a public fix and automated attacks. The post promotes WizOS near-zero-CVE base images, WizCLI and MCP-server checks inside developer and AI agent sessions, and Wiz Code scanning across pull requests, repositories, and pipelines covering SAST, SCA, secrets, and IaC misconfigurations.

Wiz Blog · 14d agoIndustry1

Give every teammate and agent the right level of access to your Workers

Cloudflare launches per-Worker granular access controls with four roles, enabling least-privilege access for teammates, AI agents, and CI/CD pipelines.

Cloudflare announced granular authorization for Workers, letting admins scope access to a single Worker instead of the whole account. Four new roles are available: Metadata Read-Only (observability without source code), Content Read-Only (read code without changes), Editor (deploy without delete), and Admin (full control of one Worker). Roles apply at Developer Platform, product, or resource level, can be attached to dashboard users or API tokens, and are available to all customers now, with plans to extend to D1, R2, and KV.

Cloudflare Blog · 1d agoTools

Cybersecurity jobs available right now: February 10, 2026

Help Net Security's roundup lists open cybersecurity roles at KPMG, Pentera, Google, Group-IB and others across multiple countries.

A job-board roundup featuring Cloud Security Engineer at KPMG (Israel), Cloud Security Researcher at Pentera (Israel), Cyber Defence Senior Analyst at Google (UK), and Cyber Investigation Specialist at Group-IB (UAE). Additional listings cover SOC operations, penetration testing, network architecture, OT/IT convergence and AI/ML security testing across Australia, Italy, the US, India, France, Ireland and the UAE. All listings are marked no longer accepting applications.

Help Net Security · 21d agoIndustry

Claude Mythos 5 is coming to Tenable One, powering the new “Adversary View”

Tenable will integrate Anthropic's Claude Mythos 5 into Tenable One, launching Adversary View to surface exploitable vulnerability chains from scan data.

Tenable announced it is bringing Anthropic's Claude Mythos 5 into the Tenable One Exposure Management Platform, extending its Project Glasswing research work with Anthropic. The first capability, Tenable One Adversary View, will use the model's adversarial reasoning over raw scanner evidence, plugin output, live connections and low-confidence signals to identify viable vulnerability chains and ranked defensive actions. Customers will act on results through Tenable Hexa AI. Availability details for Adversary View are expected in the coming weeks; no customer deployment exists yet.

Tenable Blog · 8d agoTools1

Cybersecurity jobs available right now: July 21, 2026

Help Net Security lists current cybersecurity openings at Stellantis, Lloyds Banking Group, Los Alamos National Laboratory, and other organizations across the US, UK, and Europe.

Help Net Security's July 21, 2026 roundup of cybersecurity job listings includes Application Security Analyst at Stellantis, CRISO at CRISO Trustyfy in the UAE, Head of Cyber Defence Centre at Lloyds Banking Group, and insider threat, compliance, and engineer roles across the US. Many listed positions are no longer accepting applications. The listing also promotes a guide on succeeding at cybersecurity job interviews.

Help Net Security · 13d agoIndustry

Production data in testing is still common, and Tricentis' CISO wants it gone

Tricentis CISO Erika Dean urges keeping production data out of test environments and describes red-teaming that caught a prompt injection gap.

In a Help Net Security interview, Tricentis CISO Erika Dean recommends keeping production data out of QA and testing environments, even in finance and healthcare, where weaker QA controls create risk. Her team red-teamed an agentic chatbot before launch, found a prompt injection gap, and held the release for a week until it was fixed. She says vendors who cannot explain data residency, retention, and model training use are disqualified regardless of product quality.

Help Net Security · 22d agoIndustry

$1 Million Sandbox Challenge Uncovers Linux Kernel Flaws

Vercel's $1M sandbox challenge surfaced two Linux kernel networking defects—one leaking host kernel memory, one crashing hosts—with CVEs pending.

Vercel ran a two-week, $1 million sandbox escape challenge (Aug 18–Sep 1) on its Firecracker-based microVM sandbox, receiving 1,285 reports and committing ~$325k in payouts (1 Critical, 7 High, 15 Medium, 49 Low validated so far). No attacker accessed real customer data. The most important filing found two independent Linux kernel networking stack defects—one leaks host kernel memory, the other deterministically crashes the host—with wide implications for cloud providers isolating workloads via the same kernel layer. Fixes are under private review with CVEs pending; Vercel also plans to open-source its agentic report-triage agent built on the Eve framework running Kimi K3.

SecurityWeek · 1d agoVulnerability2

Major Cyber Threat Detection Vendors Shift from MITRE to UK Testing Program

SE Labs launched PIVOT, a six-month vendor detection testing program backed by CrowdStrike, Fortinet, Palo Alto Networks and Sophos, as major vendors exit MITRE evaluations.

SE Labs unveiled PIVOT on September 15, a six-month testing program in which its ethical hackers replicate nation-state and criminal attack chains against participating vendor products, with results due January 2027. Broadcom (Symantec/Carbon Black), CrowdStrike, Fortinet, Palo Alto Networks and Sophos have confirmed participation, and Gartner and Forrester analysts will verify the underlying evidence before publication. The launch follows declining participation in MITRE Engenuity ATT&CK Evaluations: Enterprise, which fell from 30 vendors in 2023 to 11 in 2025 after public withdrawals by Microsoft, SentinelOne and Palo Alto Networks.

Infosecurity Magazineupdated · 21h agofirst · 22h agoIndustry 14 sources

Hackers Use Fake LinkedIn Job Offers to Infect Developers With New Cross-Platform RATs

Iran-linked Mirage Kitten uses fake LinkedIn job challenges to deliver new cross-platform RATs NodeRabbit and PollCat to developers in fintech, aviation, and aerospace.

PolySwarm documented a campaign by Iran-linked Mirage Kitten (UNC1549) that uses fake recruiter personas and technical hiring challenges on LinkedIn to deliver the newly documented RATs NodeRabbit and PollCat, which run on Windows, Linux, and macOS. A challenge archive bundles a fake npm package (colorized_terminal 2.1.0) in node_modules that loads NodeRabbit, while a React-based challenge delivers PollCat with an attacker-controlled OTP screen. NodeRabbit persists through a malicious Visual Studio Code extension and Git post-merge/post-checkout hooks; PollCat persists via scheduled tasks, cron, and LaunchAgents. Victims were observed in fintech, aviation, and aerospace, with confirmed targets in Egypt, Ethiopia, and Afghanistan.

Cyber Security News · 7d agoMalware in the wild

WordPress Security Plugins: How to Choose the Right One

Sucuri's guide breaks WordPress security plugins into hardening, malware scanning, integrity monitoring, and filtering types, and explains how to evaluate and layer them.

The Sucuri guide explains that WordPress security plugins bundle five capabilities - hardening, malware detection, integrity monitoring, activity logging, and application-level filtering - and that plugins run only after WordPress loads, unlike server-level firewalls. It lists leading causes of compromise: outdated plugins and themes, weak or reused credentials, nulled premium software, insecure configuration, and shared-hosting cross-contamination. It concludes with evaluation criteria and a post-installation security checklist for owners without dedicated security teams.

Sucuri Blog · 12d agoIndustry

Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means

GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.

GitGuardian researchers found that a recent Shai-Hulud worm variant scans for credentials across 469 locations in developer environments, CI/CD tooling, cloud configurations, and AI tool configs, up from 189 paths in earlier variants. The worm reuses stolen credentials to pivot from developer workstations to source code, cloud infrastructure, and package publishing channels, turning credential theft into forward-propagating supply chain attacks. The analysis urges defenders to prioritize removing long-lived package publishing tokens in favor of short-lived OIDC-based trusted publishing, citing recent Docker and GitHub Actions improvements.

The Hacker News · 13d agoMalware in the wild1

AI will not fix a governance problem in your camera estate

Hikvision EMEA security director argues camera estates need governance, recovery controls, and secure-by-default settings rather than AI fixes.

Rob Janssens, EMEA Cyber Security Director at Hikvision Europe, discusses securing surveillance camera estates whose lifecycles outlive their installers, leaving lost documentation and admin credentials. He advocates secure-by-default settings such as mandatory password activation, login-failure monitoring, IP filtering, and controlled SSH access, and argues customers should be able to recover control without the original integrator. He distinguishes secure-by-design from secure-by-default, recommends VPNs and network segmentation over disabling controls, and weighs European requirements like source code escrow and country-of-origin rules.

Help Net Security · 21d agoIndustry

AI made software development unrecognizable. Is cybersecurity next?

Opinion piece argues AI-driven shifts that transformed software development—agent-run SOCs, autonomous triage—will soon reshape cybersecurity operations and staffing.

A CSO Online analysis notes Google Cloud research found 90% of developers already use AI, while a March 2026 Federal Reserve paper found coder employment growth fell roughly 3% since ChatGPT's arrival. Gartner predicts 80% of organizations will run smaller, AI-augmented engineering teams by 2030. Security leaders from Contrast Security, Menlo Security and the Cloud Security Alliance expect agent-run SOCs, machine-speed containment and abundant vulnerability discovery, but caution that absorption capacity and autonomous production-environment validation remain bottlenecks.

CSO Online · 22h agoIndustry

OpenSSL 4.1.0 Alpha1 Released With DTLS 1.3 and Faster Post-Quantum Cryptography

OpenSSL 4.1.0 Alpha1 adds DTLS 1.3 support, ML-DSA and ML-KEM post-quantum optimizations, and GREASE TLS compatibility, intended for testing only.

The alpha preview of OpenSSL 4.1.0 implements RFC 9147 DTLS 1.3 for UDP-based applications and integrates DTLS into the SSL listener API. It accelerates ML-DSA signatures and ML-KEM encapsulation with AVX-512 and VAES optimizations on x86_64, and adds GREASE (RFC 8701), IKEv2 KDF support, and Elbrus2000 (e2k) targets. The release is intended for testing and development, not production, and removes Windows-on-Itanium and Windows CE build targets.

Cyber Security News · 6d agoTools

Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data

Gen Digital researchers report infostealer families Amatera, Remus and CallbackBeaver now harvest Claude, Cursor and Codex agent data, including tokens and MCP configs.

Gen Digital researchers found commodity infostealers extending their collection rules to local AI coding agent data from Claude, Cursor, Codex, Cline, Continue and OpenCode on Windows and macOS. Amatera targets Cline and Continue, Remus targets Claude, Cursor and OpenCode, and CallbackBeaver added Claude and Cursor with more than 5,000 samples observed in 30 days; Djinn Stealer hits Claude, Codex, Gemini, Cline, OpenCode and Kilo on macOS. Stolen data includes access and refresh tokens, prompt histories, conversation databases and MCP configurations holding API keys, potentially exposing connected source-control, cloud and ticketing systems. Remus is assessed as a Lumma Stealer variant using EtherHiding C2 resolution via Ethereum smart contracts.

GBHackers · 8d agoMalware in the wild1

Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline

ThreatFabric identifies Manic, an Android banking fraud and spyware platform targeting Ukraine with offline Bluetooth/Wi-Fi Direct mesh exfiltration and device takeover.

ThreatFabric's Mobile Threat Intelligence team identified Manic, an Android malware active in the wild since at least February 2026 that combines banking fraud with surveillance and device-control capabilities. It monitors 169 Android apps including Ukrainian banks, government and eID services, messaging apps, crypto exchanges, and 2FA tools, using the Accessibility service as a classified UI keylogger and WebRTC for live screen viewing and remote control. A distinctive store-and-forward relay exfiltrates AES-GCM-encrypted data through nearby infected devices over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, supporting chains of up to four hops when direct C2 is unavailable. A July update added stronger anti-analysis, in-memory DEX loading, lock-secret phishing to extract device PINs, and hiding from the app launcher.

Security Affairs · 27d agoMalware in the wild

Can your coding style predict whether your code is vulnerable?

University of Massachusetts Dartmouth researchers present VulStyle, a stylometry-based vulnerability detector that also exposes benchmark reliability problems.

VulStyle combines stylometric features with syntax-tree structure and source tokens, pre-trained on about 4.9 million functions across seven programming languages and fine-tuned on five vulnerability detection datasets. It beat token-only detectors on some benchmarks but its F1 drops sharply on DiverseVul, which the authors link to noisy labels inflating reported performance across popular datasets. The authors argue style-aware detection should be harder to evade but did not test this empirically, and they note that uniform LLM-generated code may strip away the individual developer style the model depends on.

Help Net Security · 24d agoResearch1

G7 Urges Fast-Track on Quantum-Safe Cybersecurity Rules

G7 cybersecurity agencies led by France's ANSSI urged accelerated transition to post-quantum cryptography, prioritizing critical systems and phased, risk-based migration.

Under France's 2026 G7 Presidency, ANSSI, chairing the G7 Cybersecurity Working Group, published a September 3 call to action urging governments and organizations to begin quantum-safe (PQC) transitions now, reframing the quantum threat as near-term. The document, signed by the national cyber agencies of all G7 members and supported by the EU Commission and ENISA, outlines five priorities including national PQC strategies, R&D, public-private partnerships, and integrating PQC into cybersecurity requirements. It recommends cryptographic inventories, dependency mapping, prioritizing the most critical systems, and buying PQC-integrated products during normal renewal cycles. ANSSI will stop vetting non-quantum-safe products in 2027, with PQC mandatory in some security product procurement by 2030.

Infosecurity Magazine · 12d agoPolicy & legal

TuxBot v3: Inside an IoT Botnet Framework With LLM

Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.

Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.

Palo Alto Unit 42 · 28d agoMalware1

Hackers Use Autonomous AI Agents to Harvest Thousands of Credentials in Under 6 Hours

Google Cloud documents a financially motivated actor using autonomous AI agents on a compromised cloud tenant to harvest 23,800+ credentials in under six hours.

Google Cloud reports that an attacker compromised a victim's cloud environment and deployed a multi-agent framework driven by preconfigured Markdown playbooks to autonomously handle vulnerability scanning, credential collection, error troubleshooting, and IP rotation. An exposed command-and-control server hosted the 'Recon' framework with a live dashboard managing over 23,800 harvested secrets, including cloud and AI-service API keys. The report also ties DUSTMAKER to UNC6780/TeamPCP, targeting AI development tools and CI/CD systems via trojanized MCP packages such as tiktoken_mcp. Google has disabled linked assets and updated protections after the actors' operational security failures.

Cyber Security News · 1d agoThreat actor in the wild

BlackHatSect0r Hackers Disable AI Safety Controls to Automate Credential Theft and Cyberattacksnew

French-speaking crew BlackHatSect0r disabled AI agent safety controls to automate scanning, credential harvesting, and vishing, exposing 16,834 stolen credentials.

Socradar researchers analyzed the exposed infrastructure of a French-speaking crew called BlackHatSect0r && DXQRTXX, which ran a Nous Research Hermes agent on a DeepSeek model with safety controls removed via HERMES_DISABLE_SAFETY=1. A custom Go-based C2 platform, DXSCAN, was exposed on port 8080 with over 200 secret-detection patterns, a vault of 16,834 harvested credentials, and scanning activity queuing 2.75 million domains and reaching more than 726,000 hosts. The kit also held a database of roughly 450,000 French telecom subscriber records used to prepare vishing lures impersonating Société Générale, plus JWT-forging tooling for a cryptocurrency exchange. Most confirmed compromises relied on exposed secrets and cloud misconfiguration rather than novel exploits; the one cited vulnerability, CVE-2026-42530, is an NGINX HTTP/3 QPACK use-after-free fixed in version 1.31.2.

GBHackers · 11m agoThreat actor in the wild 2 sourcesCVE-2026-42530

ANY.RUN & SentinelOne: One Workspace, Instant Context for Rapid Response

ANY.RUN integrates its interactive sandbox, IOC lookups, and STIX/TAXII threat feeds natively into SentinelOne for faster automated malware triage.

ANY.RUN and SentinelOne launched connectors that embed interactive sandbox analysis and threat intelligence into the SentinelOne console via Singularity Hyperautomation. Suspicious files and URLs from alerts are automatically submitted to the ANY.RUN sandbox, with behavioral verdicts and risk scores returned into alert notes. On-demand IOC lookups draw on sandbox history from 16,000 organizations and 700,000 analysts. A separate STIX/TAXII feed streams verified malicious IPs, domains, and URLs through the SentinelOne Marketplace TAXII Connect app.

ANY.RUN · 1d agoTools

Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

Five critical flaws (CVSS 9.8–10.0) in WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP enable WordPress admin takeover and RCE.

Wordfence and Patchstack disclosed five critical flaws in WordPress plugins and themes: WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. The issues include unauthenticated authentication bypass (CVE-2026-76581), arbitrary file write leading to RCE (CVE-2026-18431), administrator account takeover via password-reset URL exposure (CVE-2026-19632), privilege escalation (CVE-2026-19598), and PHP object injection to RCE (CVE-2026-82222, CVSS 10.0). Patchstack says the GiveWP flaw chains an unsafe unserialize helper, attacker-controlled donation data, and a gadget chain in shipped code.

The Hacker News · 18d agoVulnerabilityCVE-2026-76581CVE-2026-18431CVE-2026-19632+2 CVEs

Risks in IoT Supply Chain

Unit 42 analyzes multilayer IoT supply chain risks across hardware, firmware, and software, citing counterfeit Cisco switches and OpenWrt attacks.

Unit 42 examines weaknesses in the IoT supply chain ecosystem across hardware, firmware, operation, and vulnerability layers, noting that 89% of IT decision-makers reported IoT device growth and IDC forecast 41.6 billion connected IoT devices by 2025. Examples include counterfeit Cisco Catalyst 2960-X switches with possible backdoor access (F-Secure, July 2020), a March 2020 OpenWrt flaw enabling malicious update impersonation, and threat actor interest in TeamViewer remote support software. The report stresses that untracked third-party components and missing device inventories make it hard to assess vulnerability impact across vendors.

Palo Alto Unit 42 · 28d agoResearch

August 2026 CVE Landscape

Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.

Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.

Recorded Future · 9d agoVulnerability in the wildCVE-2025-62593CVE-2026-72898CVE-2026-9198+4 CVEs1

GentleKiller targets more than 400 security processes across 48 products

ESET details the Gentlemen ransomware gang's in-house GentleKiller EDR-killer framework targeting over 400 security processes across 48 products, supplied to affiliates.

ESET analyzed the Gentlemen ransomware gang's in-house GentleKiller EDR-killer framework, confirmed through an internal data leak from May 2026. The framework has at least eight variants impersonating legitimate security products and abusing vulnerable or malicious kernel drivers, targeting more than 400 process names across 48 security products. Gentlemen emerged in late 2025, became one of the five most active ransomware gangs in Q1 2026, offers affiliates a 90% ransom share, and practices double extortion using Go-based and C-based ESXi encryptors. The suite also reuses outside tools including HexKiller, ThrottleBlood, and HavocKiller, unified by a shared evasion layer that mimics well-known security vendors.

Help Net Security · 24d agoRansomware in the wild

Severity Is Not a Strategy: What CISA BOD 26-04 Means for the Future of Federal Software Security

CISA's BOD 26-04 replaces severity-based federal patching with risk-based remediation deadlines of 3, 14, or 60 days.

CISA's Binding Operational Directive 26-04, released June 10, 2026, replaces BOD 19-02 and BOD 22-01 for Federal Civilian Executive Branch agencies and shifts remediation prioritization from CVSS scores to risk context. Agencies assess four factors: public exposure, KEV listing, exploit automatability, and whether exploitation grants partial or total asset control, resulting in 3-, 14-, or 60-day remediation windows or next-upgrade fixes. In CISA's first review at a large civilian agency, only 1% of vulnerabilities required three-day remediation while over 60% could wait for future system upgrades. The directive also requires forensic analysis when exploitation is suspected, and Checkmarx argues the same risk-based logic must extend upstream into software development and SBOM-driven exposure management.

Checkmarx · 7d agoPolicy & legal

Cybersecurity jobs available right now: May 19, 2026

Help Net Security's roundup lists cybersecurity openings across many countries, including CISO, threat intelligence, OT security, and AI security expert roles.

The roundup lists cybersecurity vacancies including CISO, SOC analyst, threat intelligence analyst, security engineer, OT security manager, and principal AI security expert positions. Employers include DataFence, Aldermore Bank, GDIT, Netcraft, Sonar, Sylvamo, MED-EL, and Crisis24 across the US, UK, India, Ireland, Australia, Austria, Canada, Germany, and the UAE. Nearly all listings were marked as no longer accepting applications at publication.

Help Net Security · 19d agoIndustry

Cybersecurity jobs available right now: March 10, 2026

Help Net Security's roundup lists open cybersecurity roles at BioNTech, AIG, ServiceNow and others across Europe, the Middle East and Canada.

A job-board roundup of cybersecurity openings including Associate Director Application Security at BioNTech (Germany), CISO at AIG (Israel), Cloud Security Professional at ServiceNow (Italy), and SOC/GRC, analyst, engineer and data governance roles in the UK, UAE, India, Canada and France. Roles span application security, cloud security, SOC operations, compliance and OT environments. Most listings are marked no longer accepting applications.

Help Net Security · 19d agoIndustry

Globalgig expands managed security portfolio to protect enterprise AI

Globalgig adds managed AI security services covering posture management, access control, runtime protection and 24/7 AI threat monitoring built on Palo Alto Networks.

MSSP Globalgig expanded its managed security portfolio with enterprise AI protection spanning AI Security Posture Management, AI Access Security, AI Runtime Security, and AI Security Operations. The offering cites the 2026 Cost of a Data Breach Report finding that shadow AI was involved in 43% of breaches this year and 92% of AI-related breach victims lacked adequate AI access controls. Services are built on Palo Alto Networks technology, with Orchestra Insight supplying network context.

Help Net Security · 1d agoIndustry

How to secure hybrid meeting rooms without sacrificing user experience

Sponsored Barco piece, citing IDC data, says security is now the top videoconferencing purchase criterion as NIS2 and Cyber Resilience Act compliance pressures mount.

The sponsored article cites IDC research showing security (31%) now outranks price (26%) and quality (25%) as the top videoconferencing purchase criterion. It highlights concerns like malware propagation (47%), missed patches (39%), and risky user behavior (37%), and references NIS2, the Cyber Resilience Act, the Radio Equipment Delegated Act, and ISO/IEC 27001. Barco ClickShare marketing director Yannic Laleeuwe argues security is now a prerequisite for market access and resilience, but warns that usability tradeoffs drive risky workarounds.

The Register · Security · 8d agoIndustry

Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.

State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.

Help Net Security · 3d agoExploit / PoC in the wildCVE-2026-20079CVE-2026-20316CVE-2026-862182· 1 read

Product showcase: GitGuardian Honeytoken catches credential theft as it happens

GitGuardian now deploys honeytoken decoy AWS credentials across developer fleets via MDM, generating high-fidelity alerts when infostealers test stolen credentials.

GitGuardian extended its honeytoken platform so decoy AWS credentials can deploy fleet-wide to developer laptops through existing MDM tooling, with deleted decoys automatically replaced at the next sync. When a harvester tests a decoy, the platform logs the API call in the controlling AWS account and raises an incident naming the source machine and file, routed via email, Slack, Teams, ServiceNow, or webhooks. The capability responds to infostealers such as Shai-Hulud that scan entire filesystems and validate stolen credentials within seconds. GitGuardian is building decoys for Kubernetes and package registry credentials using random, structure-free identifiers that resist detection.

Help Net Security · 7d agoTools

Sequoia doubles down on Cymphony as AI agents create new enterprise security risks

Cymphony emerges with $30M from Sequoia and SMBC to give security teams unified visibility into AI agent and non-human identities.

Cymphony, a New York- and Tel Aviv-based startup, raised a $25 million Series A co-led by Sequoia and SMBC Fin Atlas Beyond Fund, valuing it above $100 million. Its platform builds a "workforce graph" unifying identity, data, and activity signals for employees, AI agents, and other non-human identities. The company says it found roughly 85,000 files exposed to AI tools at one US public company and reached seven-figure ARR in its first year of sales with customers including KKR and Syngenta. Sequoia previously led its undisclosed seed round, betting on Israeli Talpiot program alumni founders.

TechCrunch · Security · 7d agoIndustry

Top 10 Best Device Control & USB Security Tools in 2026

A 2026 scorecard ranks ten USB and device control tools, placing Safetica, Ivanti DeviceLock and DriveLock at the top.

The article compares ten device control and USB security tools using a weighted scorecard covering control granularity, platform coverage, DLP integration, operability and value. Safetica, Ivanti DeviceLock and DriveLock rank highest, with notes on cross-platform depth, Windows granularity and European compliance fit. The piece highlights ownership changes, including CoSoSys joining Netwrix and Digital Guardian joining Fortra, and stresses device control as part of Zero Trust and DLP strategies.

Cyber Security News · 6d agoIndustry

Windows Remote Desktop Client Vulnerability Allows Attackers to Execute Remote Code

Microsoft patched CVE-2026-69485, an 8.8 CVSS RCE flaw in the Windows Remote Desktop Client affecting Windows 10/11 and Server 2016-2025.

Microsoft's September 2026 updates fix CVE-2026-69485, an Important-rated remote code execution vulnerability (CVSS 3.1: 8.8, temporal 7.7) in the Windows Remote Desktop Client caused by use of an uninitialized resource. An authenticated attacker with low privileges could send a specially crafted network request to execute code on an affected server, with no user interaction required. Microsoft says the flaw was not publicly disclosed before patching and rates exploitation as 'Less Likely' with no evidence of active exploitation. Affected products span Windows Server 2016, 2019, 2022 and 2025 and Windows 10 (1607-22H2) and Windows 11 (23H2-26H1), with fixes delivered via KBs including KB5123099, KB5122876 and KB5122882.

Cyber Security News · 7d agoVulnerabilityCVE-2026-694851

Why The Vulnerability Backlog Is About To Get Worse

Recorded Future analysis says AI-driven vulnerability discovery and faster weaponization will grow the triage backlog while shrinking defenders' response windows.

Disclosed vulnerabilities rose from roughly 21,000 in 2021 to nearly 50,000 in 2025, while Recorded Future assessed only 446 as actively exploited in 2025. VulnCheck found nearly 29% of 2025 KEV entries were exploited on or before CVE publication. The authors argue AI-assisted discovery and automated exploit development will multiply credible reports, cut disclosure-to-exploit time toward minutes, and force re-evaluation of medium-severity flaws as exploit-chain components.

Recorded Future · 22d agoResearch

Pyramid Solutions NetStaX EtherNet/IP Stack

CISA flags critical CVE-2026-78012 (CVSS 9.8) stack buffer overflow in Pyramid Solutions NetStaX EtherNet/IP stacks below v5.6.1, risking crashes or remote attack vectors.

CISA republished Pyramid Solutions' advisory for CVE-2026-78012, a CWE-121 stack-based buffer overflow in the NetStaX EtherNet/IP stack versions prior to 5.6.1, scored CVSS 9.8. Large Class 3 explicit-message requests can exceed the application-side receive buffer without generating a CIP error, potentially causing memory corruption, device crashes, or a silent remote attack vector. All eight adapter and scanner DLL/development kit variants, including CIP Security editions, are affected across critical manufacturing, energy, water, and chemical sectors. No public exploitation has been reported.

CISA Advisories · 13d agoAdvisoryCVE-2026-78012

Twitch extension with 30K installs exposes users’ OAuth tokens

Twitch extension with 30,000+ installs exfiltrates users' OAuth session tokens to Russian-run JeetBot proxy servers.

Socket analysis shows the "Twitch Enhanced Viewer | JeetBot" browser extension, with over 30,000 installs on the official Chrome and Firefox stores, captures the Twitch web client's authorization header and extracts the user's OAuth token. The token is appended as an auth= URL parameter to video playlist requests routed through JeetBot proxy servers, landing in cleartext request logs retrievable by the Russian-language bot service vendor; ten hardcoded Russian-language channels are exempted. Earlier versions used more explicit token exfiltration, and the extension remained live in both stores at publication. Socket recommends removing the extension, disconnecting all Twitch sessions, and re-authenticating.

BleepingComputer · 2d agoMalware in the wild

The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment

Rapid7 analyzes how fraud marketplaces are fragmenting into specialized shops after larger marketplaces were dismantled, aided by new MITRE F3 framework

Rapid7 reports a shift from large known fraud marketplaces to a fragmented environment of smaller specialized storefronts such as Xleet, Blackpass, Infodig, and Styx, operating across dark web channels, Telegram, and P2P options. These Fraud-as-a-Service shops sell stolen accounts, PII, synthetic identity generation, infrastructure, and money laundering support, supporting schemes like business email compromise. MITRE's Fraud Fighting Framework (F3), introduced in early 2026, aims to help security teams prioritize monitoring of fraud TTPs, particularly account takeover techniques. Fraud damages are anticipated to approach hundreds of billions of USD.

Rapid7 Blog · 5d agoPhishing & fraud