Search: “model merging”

15 stories in the last 30d

Okta used frontier AI models GPT-5.5 Cyber and Mythos via OpenAI and Anthropic programs to scan millions of code lines for vulnerabilities.

Okta describes using frontier AI models, including GPT-5.5 Cyber Preview (TAC) and Mythos Preview, through OpenAI's Daybreak Cyber Partner Program and Anthropic's Project Glasswing to hunt vulnerabilities across its product codebase. The team built a custom Python orchestrator with strong isolation, vendor-agnostic model support, and four distinct scanning pipelines executed as isolated Codex or Claude Code sessions with progressive context loading to reduce context bloat. Human experts and AI agents worked both autonomously and in paired hunts, and Okta reports the best results when humans and agents taught each other.

Okta SecuritySep 8, 00:00 UTC · 9d agoResearch

Top 10 Best CNAPP (Cloud-Native Application Protection) Platforms in 2026

GBHackers ranks 10 CNAPP platforms for 2026, naming Wiz, Prisma Cloud, and Microsoft Defender for Cloud as category leaders.

The guide describes CNAPP as the umbrella combining CSPM, CWPP, CIEM, and DSPM, arguing that cross-pillar correlation of attack paths is the platform's core value. Wiz is ranked best for graph-based correlation, Prisma Cloud for the broadest module set, and Microsoft Defender for Cloud for Azure economics. It also cites Google's approximately $32 billion agreement to acquire Wiz, announced in March 2025, as buyer leverage and a reason to seek roadmap and neutrality protections in multi-year contracts.

Cyber Security NewsSep 11, 07:21 UTC · 6d agoIndustry1

11 Best CSPM Tools Compared (2026): Features & Pricing

CSPM comparison ranks Wiz first for agentless attack-path analysis; notes Ermetic absorbed into Tenable and Lacework into Fortinet FortiCNAPP.

An editorial comparison of eleven CSPM tools ranks Wiz as the agentless attack-path momentum leader, Prisma Cloud as the breadth benchmark, and Orca as the agentless SideScanning pioneer. It highlights consolidation: Ermetic now powers Tenable Cloud Security and Lacework became Fortinet's FortiCNAPP. The guide recommends starting with free tiers from Defender for Cloud, Prowler, and native cloud tools before buying.

GBHackersSep 15, 06:37 UTC · 2d agoIndustry1

Batten the Hatches: Cybersecurity with Military Mariners

Interviews with 20 U.S. Navy and Coast Guard mariners reveal informal, safety-oriented shipboard cyber risk models that may delay attribution and containment.

The study conducts semi-structured interviews with 20 military mariners from U.S. Navy and Coast Guard vessels to understand how service members recognize and respond to cyber risk aboard ships. Unique consequences of compromising military systems identified include weapon takeover and purposeful geopolitical escalation. Cybersecurity is organizationally abstract on ships, so mariners build cyber risk models from informal experience rather than formal instruction. A safety-oriented incident-response model creates resilience but may delay cyber attribution and containment.

arXiv cs.CRSep 11, 13:04 UTC · 6d agoResearch

Top 10 Best Cloud Workload Protection (CWPP) Solutions in 2026

Editorial scorecard ranks 2026 cloud workload protection platforms, placing Prisma Cloud first, Sysdig second, and CrowdStrike third on detection quality.

A research-based scorecard rates ten cloud workload protection (CWPP) platforms across runtime depth, container/Kubernetes support, coverage breadth, cloud context, and value. Palo Alto Prisma Cloud leads at 8.9, followed by Sysdig at 8.8 and CrowdStrike at 8.6, with Aqua Security tying CrowdStrike at 8.6. The piece argues agent-versus-agentless is a false choice, with leaders now pairing agentless visibility with eBPF-based runtime sensors. Scores are editorial assessments, not lab benchmarks.

Cyber Security NewsSep 11, 07:15 UTC · 6d agoIndustry1

1Password's AI patching benchmark is misleading

Trail of Bits reanalysis says 1Password's 26% AI clean-fix rate is misleading; 86% of eligible patches blocked exploits.

Trail of Bits critiques 1Password's FLAWED AI patching benchmark, arguing its 26% clean-fix headline mixes trials where agents were instructed to apply wrong fixes (22% of data) with trials that prohibited compiling or testing (36%). Restricting to reasonable conditions, 2,634 of 3,067 patches (86%) blocked the supplied exploit. Trail of Bits also reports 12.5% of 2,265 developer first fixes failed in its own 2024-2026 assessments, and released post-patch-validation and review-walkthrough agent skills.

Lobsters · securitySep 15, 20:03 UTC · 1d agoResearch1

The 12 Best Managed Firewall Services, Compared and Priced

GBHackers compares 12 managed firewall service providers, naming Fortinet best value and Secureworks best detection while flagging recent ownership changes.

The buyer's guide evaluates 12 managed firewall/MSSP providers across cost tiers, contract terms, and service models. Fortinet is rated best value, Secureworks best detection, NTT Data best global reach, and Cato Networks best for organizations wanting to stop owning firewalls. The article highlights that Secureworks was acquired by Sophos for roughly $859 million in February 2025, the Trustwave-Cybereason merger was terminated in March 2025, LevelBlue is the rebranded AT&T Cybersecurity business, and Comcast Business absorbed Masergy.

GBHackersSep 8, 10:20 UTC · 9d agoIndustry 2 sources

Atlas: Efficient Verifiable Semantic Search

Atlas delivers zero-knowledge proofs for HNSW semantic search, verifying RAG retrieval in under a second on SIFT1M and 2.0 seconds at 100M vectors.

Atlas lets a search provider prove that a query was answered correctly against a committed HNSW index without revealing the index, addressing provider deviations like truncation or bias. It combines offline preprocessing, a fixed-size-state restructuring of HNSW with a correctness proof, and timestep-tagged batching of per-step arguments. The system proves queries in under a second on SIFT1M and 2.0 seconds at 100 million vectors while preserving plaintext HNSW recall, and proven retrieval maintains end-to-end RAG answer quality at lower cost than prior verifiable retrieval systems.

arXiv cs.CRSep 10, 17:30 UTC · 6d agoResearch4

OpenAI Builds ‘Defense Factory’ Where AI Agents Continuously Find and Fix Vulnerabilities

OpenAI unveils a Defense Factory where AI agents continuously discover, validate, and fix vulnerabilities, integrating GitHub, Snyk, Semgrep, Tenable, and ServiceNow.

OpenAI introduced a Defense Factory, an agent-first cybersecurity operation that connects AI agents to developer and security tools via APIs, CLIs, and Model Context Protocol integrations including GitHub, GitLab, Snyk, Semgrep, Tenable, Jira, Linear, and ServiceNow. During an internal security sprint, over 250 people across more than 100 service areas closed 53 urgent or high-priority issues on day one, achieved a 90.6% accepted ownership-assignment rate, and Codex generated all remediation patches with only 0.53% rolled back. Agent-assisted deduplication flagged 37% of findings as duplicates, and runtime validation reproduced 19.5% of findings, cutting the false-positive rate to 0.81%. OpenAI argues defenders must exploit a temporary 'defender's window' using source-code access and frontier models before open-weight models enable autonomous offensive agent fleets.

Cyber Security NewsSep 10, 10:36 UTC · 7d agoTools

PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances

GreyNoise and Blackpoint tracked an AI-assisted actor using OpenAI Codex and DeepSeek agents to exploit PaperCut flaws across 440+ instances in 48 countries.

A suspected Russian-speaking actor exploited the CVE-2026-81578 authentication bypass and CVE-2026-82078 RCE chain in PaperCut NG/MF, compromising at least 440 instances across 395 organizations in 48 countries, heavily targeting education in the US, UK, France, and elsewhere. The actor used hundreds of AI agents powered by OpenAI Codex and DeepSeek plus tools like Mimikatz, SharpHound, Certipy, Rubeus, and Impacket, reaching domain admin at 12 victims and full domain admin at a US high school within seven minutes. Post-exploitation included registry hive collection and Metasploit/Meterpreter payloads, with origin traced to IP 45.142.193.132.

The Hacker NewsSep 10, 11:41 UTC · 7d agoThreat actor in the wildCVE-2026-81578 CVE-2026-820781

How Developers Prevent Production Risk at the Source

Wiz argues shift-left code-stage security cuts remediation costs and ships Wiz Code, WizOS, and WizCLI to catch flaws pre-deployment.

A Wiz blog post argues that fixing vulnerabilities at the code stage costs a fraction of production remediation, citing the node:20-slim base image which ships 14 known CVEs, three of them critical. It claims AI agents can now analyze open-source commits and generate working exploits in minutes, shrinking the window between a public fix and automated attacks. The post promotes WizOS near-zero-CVE base images, WizCLI and MCP-server checks inside developer and AI agent sessions, and Wiz Code scanning across pull requests, repositories, and pipelines covering SAST, SCA, secrets, and IaC misconfigurations.

Wiz BlogSep 3, 00:31 UTC · 14d agoIndustry1

VectraRAT Malware-as-a-Service Lets Hackers Bypass UAC and Hijack Windows Systems

New VectraRAT malware-as-a-service at $250/month combines RAT capabilities, credential theft, clipboard hijacking, and a UACME-based UAC bypass; 38 victims observed.

VectraRAT is a previously undocumented MaaS platform with a Go-based VectraHub Linux C2 server embedding a Vue3 operator panel and a C++ Windows implant, rented from $250/month and linked to the aliases Vectra and Nyxel. It communicates over TCP port 3308 via a proprietary MessagePack protocol, steals browser and file-based credentials, and abuses UACME method 41 with debug-object handle hijacking via winver.exe and computerdefaults.exe. SOCRadar identified 38 live victim sessions in one week, 48% on corporate Windows editions, with delivery via the Amadey loader and ClickFix pages impersonating TurboTax.

GBHackersupdated Sep 16, 14:36 UTC · 22h agofirst Sep 16, 13:11 UTC · 1d agoMalware in the wild 3 sources

12 Best Application Control & Allowlisting Tools Compared (2026): Features & Pricing

GBHackers compares twelve application allowlisting tools for 2026, naming ThreatLocker and Airlock Digital leaders and Microsoft WDAC the free native option.

GBHackers published an editorial comparison of twelve application control and allowlisting tools for 2026, assessing control depth, manageability, and pricing models. It ranks ThreatLocker and Airlock Digital as leading dedicated allowlisting options, positions Microsoft WDAC/AppLocker as the free native choice for Windows estates, and highlights CyberArk and BeyondTrust for coupling control with privilege management.

GBHackersSep 10, 08:24 UTC · 7d agoIndustry1

Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A)

CISA updated ICSA-26-169-07: CVE-2026-4827 (CVSS 8.3) insufficient entropy enables session hijacking across dozens of Schneider Electric grid products; fixes available.

CISA republished advisory ICSA-26-169-07 (Update A) for CVE-2026-4827, CWE-331 insufficient entropy in session management, scored CVSS 8.3. Affected lines include Easergy MiCOM relays and C5, EcoStruxure Power Automation (EPAS-GTW, EPAS-UI, iPMFLS), EcoStruxure Power Operation, PowerLogic P5/P7/T300/T500, and Saitel DP/T150 RTUs, with dozens of fixed versions listed. Successful exploitation could enable session hijacking and unauthorized operations on systems in energy, chemical, critical manufacturing, and water sectors. Fixes are available; no exploitation is reported.

CISA AdvisoriesSep 3, 12:00 UTC · 14d agoAdvisory CVE-2026-4827