ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Source: CSO Online

40 stories in the last 30d

Sortlatesthotimportance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllIndustry 12Exploit / PoC 7Vulnerability 4Threat actor 4Tools 3Phishing & fraud 2Data breach 2Malware 2Advisory 2Research 1Policy & legal 1
SeverityAllcritical 5high 15medium 2low 0info 18source: CSO Online ✕

Critical Cisco Secure Email Gateway zero-day gives attackers root access

Actively exploited Cisco Secure Email Gateway zero-day CVE-2026-76461 lets crafted emails trigger SQL injection and root command execution; CISA added it to KEV.

Cisco released emergency patches for CVE-2026-76461, a critical SQL injection in Secure Email Gateway (physical and virtual) caused by insufficient validation in email parsing. Sending a crafted email with malicious SQL statements can yield arbitrary command execution with root privileges. Cisco was aware of active exploitation before the fixes, and CISA added the flaw to its KEV catalog; patched AsyncOS releases are 15.5.5-0141, 16.0.4-3021, and 16.5.0-780. Because successful exploits grant root, Cisco warns logs may be tampered with and advises checking external firewall/network logs and rebuilding virtual appliances with rotated credentials.

CSO Onlineupdated · 2h agofirst · 3h agoExploit / PoC in the wild 15 sourcesCVE-2026-76461CVE-2025-20393

Exposed Vite servers are being probed for AWS and Azure credentials

F5 honeypots logged 32,000+ probes against Vite file-access bypass CVE-2026-39364, hunting AWS and Azure credentials on exposed dev servers.

F5 Labs reported 32,000+ scan attempts (807 attack sessions) against exposed Vite servers in August, up from 1,732 attempts over the prior three months. Attackers exploited CVE-2026-39364 (CVSS 8.2), which bypasses Vite's server.fs.deny protection via parameters like ?raw and ?import&raw, affecting Vite 7.1.0 to before 7.3.2 and Vite 8 before 8.0.5. Scanners cycled wordlists for environment files, AWS keys, Azure tokens and IaC state files, also combining older Vite CVEs (2025-30208, 2025-31125, 2024-45811) and probing a Next.js middleware bypass. Only CVE-2025-31125 is currently in CISA's KEV catalog.

CSO Online · 8h agoExploit / PoC in the wildCVE-2026-39364CVE-2025-30208CVE-2025-31125+4 CVEs

Exaforce extends its AI security tool to monitor more than just Claude

Exaforce AI Security extends beyond Claude to monitor OpenAI, Gemini, and Copilot agents using existing SOC telemetry, no new endpoint agents.

Exaforce expanded its June Claude Compliance API integration into Exaforce AI Security, adding monitoring for OpenAI, Gemini, Microsoft Copilot, and OAuth-connected AI apps. The tool inventories AI agents by correlating EDR, cloud, SaaS, and model-provider logs without new gateways or endpoint agents, and can respond by revoking sessions, deactivating API keys, isolating devices, or killing agent processes via existing controls. Analysts note the agentless approach lowers friction but lacks runtime inspection and inline blocking offered by competitors such as Palo Alto Prisma AIRS, SentinelOne Prompt AI Agent Security, and CrowdStrike Falcon Guardian. A March 2026 Cloud Security Alliance survey found 68% of organizations cannot distinguish human from AI-agent activity and 74% report AI agents receive excessive access.

CSO Online · 10h agoTools

Attackers are weaponizing the gap between Chromium fixes and Chrome patches

Espionage actors use the BlueMoon exploit kit to chain Chrome V8 and Windows kernel zero-days via spear phishing, gaining full admin on unpatched endpoints.

Proofpoint, working with Google Threat Intelligence Group, Microsoft Threat Intelligence Center and Volexity, reports that the BlueMoon exploit kit chains V8 type confusion CVE-2026-85046, V8 sandbox escape CVE-2026-87491 and Windows kernel LPE CVE-2026-85880, all rated high severity. The V8 flaws were fixed in upstream Chromium source but had not yet reached Chrome stable releases, creating a patch gap that attackers reverse-engineered and weaponized. A China-aligned state-sponsored actor used the kit from August 28 against a small number of US NGOs, mining and commodity trading firms via rapport-building spear phishing, and within days several mostly China-linked espionage clusters adopted BlueMoon. The chain yields full Windows admin privileges from a single phishing click; defenders should patch Chrome and Windows, apply Proofpoint detections and hunt for leftover artifacts.

CSO Onlineupdated · 12h agofirst · 4d agoExploit / PoC in the wild 20 sourcesCVE-2026-85046CVE-2026-87491CVE-2026-85880

AI is exposing a security structure built for yesterday’s threats

EY's Jeffrey Sallet argues AI-driven deepfakes and impersonation require integrating cybersecurity, physical security, HR and legal functions.

The opinion piece contends AI-powered impersonation, deepfakes and automated social engineering cross digital, physical and operational boundaries that siloed security programs cannot cover. It cites an EY survey of 250 corporate leaders where only 12% feel most prepared to detect a targeted physical attack, and describes transnational groups using deepfakes and stolen identities to bypass virtual HR hiring loops. The author urges unified cross-functional verification pipelines and shared threat intelligence between CISOs and chief security officers.

CSO Online · 14h agoIndustry

Threat actors are coming for your AI assets to operationalize their use of AI

Google GTIG reports espionage and crime groups stealing AI models, prompts, and API credentials, plus distillation campaigns and agentic AI attack automation.

Google Threat Intelligence Group's quarterly AI Threat Tracker reports adversaries stealing proprietary models, source code, prompts, and API credentials from government, healthcare, and media targets, including China-based UNC6508 compromising clouds to run unauthorized LLM workloads. Distillation campaigns against Google's models exceeded 100 million prompts launched via thousands of stolen account credentials through proxy networks. Mandiant also observed a financially motivated actor deploy an autonomous multi-agent framework that harvested thousands of third-party credentials in under 6 hours, and a 'Recon' framework on a live C2 server managing over 23,000 stolen credentials including cloud and AI API keys.

CSO Online · 14h agoThreat actor in the wild

A maximum severity GitLab flaw could turn your CI/CD server into an attacker’s treasure trove

GitLab patched maximum-severity CVE-2026-85706, an unauthenticated path traversal enabling arbitrary file reads; CISA added it to KEV amid observed in-the-wild probes.

CVE-2026-85706 is a CVSS 10.0 path traversal in GitLab's repository commits API caused by improper confinement and missing authentication enforcement, allowing arbitrary file reads in a single unauthenticated HTTP request. It affects GitLab CE and EE versions 18.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2, and was reported via GitLab's HackerOne bug bounty. CISA added the flaw to its Known Exploited Vulnerabilities catalog, and watchTowr Intel reports already observing in-the-wild probes; GitLab is used by roughly 50% of the Fortune 100 with over 50 million registered users. Defenders are advised to patch immediately, rotate any exposed secrets, and hunt logs for HTTP POST requests to /api/v4/projects/{id}/repository/commits/ URIs containing file.path parameters.

CSO Online · 22h agoExploit / PoC in the wild 17 sourcesCVE-2026-85706

What the 3M ChatGPT case reveals about AI governance

3M litigation shows ChatGPT prompts can become discoverable evidence, forcing enterprises to govern AI conversation records.

In the Watson Grinding explosion litigation, an engineering expert retained by 3M had used ChatGPT, and a surfaced prompt asked the system to 'show how 3M is 0% at fault'; after an off-record deposition demand, more than 350 pages of previously unproduced ChatGPT material were provided. The author argues AI interaction histories are becoming part of decision records and discovery material, a trend the American Bar Association has already examined. Enterprises are urged to manage retention, ownership, sharing, and deletion of AI conversation logs across tools like ChatGPT, Copilot, Claude, and Gemini.

CSO Online · 1d agoPolicy & legal

ConnectWise patches critical ScreenConnect authentication failure after five days

ConnectWise patched ScreenConnect flaw CVE-2026-84869 five days after warning files could be transferred and executed via active sessions without authorization.

ConnectWise released ScreenConnect client version 26.6.5 and later to fix CVE-2026-84869, an authentication failure in ConnectWise Remote Access allowing unauthorized file transfer and execution through active remote sessions. The company warned customers on September 3 and advised admins to remove the TransferFiles permission from users with open sessions as an interim mitigation. The advisory does not state that exploitation has been observed.

CSO Onlineupdated · 1d agofirst · 4d agoVulnerability 3 sourcesCVE-2026-84869

How to level up from security pro to security leader

Career advice piece argues aspiring CISOs must pair technical depth with business fluency, communication, and cross-department influence.

The article offers guidance for security professionals moving into CISO and security leadership roles, drawing on interviews with CISOs at ExtraHop, BlueVoyant, Infosys, and others. It emphasizes translating technical risk into business priorities, building trust across departments, and understanding how the company makes money. An analysis of CISO job postings found employers value communication skills, regulatory knowledge, and business education over mastery of specific security platforms.

CSO Online · 1d agoIndustry

Why AI raises the stakes for exposure validation

Fal.Con 2026 commentary argues AI accelerates vulnerability discovery and exploitation, making evidence-based exposure validation essential for defender prioritization.

CSO Online reports on the exposure-validation theme at CrowdStrike's Fal.Con 2026 conference, where CEO George Kurtz described AI as the new cyber battlefield and emphasized AI red teaming and continuous security. The piece argues that as AI speeds up vulnerability discovery and exploitability analysis on both sides, teams must determine which exposures are actually exploitable in their environments—chained weaknesses, credential abuse, lateral movement, privilege escalation—rather than chasing theoretical risk. It points readers to Horizon3's conference perspective.

CSO Online · 4d agoIndustry

ShinyHunters claims Florida DMV breach, puts data on the clock

ShinyHunters claims it breached Florida DMV's DAVID database, stole 200,000+ driver records including SSNs, and set a September 11 extortion deadline.

The ShinyHunters extortion group claims it breached the Florida Department of Highway Safety and Motor Vehicles' DAVID driver and vehicle database and stole more than 200,000 records. As evidence it published a screenshot of a Jeffrey Epstein record showing address, Social Security number, date of birth, license number and registered vehicles, and set a September 11 deadline before publication. The group says it obtained access through a password-reset weakness, compromised employee accounts, and queried and downloaded driver records and images. The Florida DMV has not confirmed the claim; it follows a separate confirmed IDScan.net breach exposing over 153 million license scans that prompted an FBI investigation.

CSO Onlineupdated · 4d agofirst · 6d agoData breach in the wild 3 sources1

Attackers use passkey-themed scams to hijack Microsoft 365 accounts

Microsoft tracks ongoing M365 cloud intrusions since May using passkey-themed helpdesk vishing, AiTM phishing, and device-code abuse.

Microsoft Security Research has tracked active cloud intrusions since May in which attackers posing as IT helpdesk staff lured employees with fake passkey/MFA enrollment requests. Attacks used adversary-in-the-middle phishing pages, device-code authentication flows, and Teams messages from compromised accounts. Attackers registered their own MFA methods, enumerated tenants via Microsoft Graph, and accessed SharePoint, OneDrive, and Exchange Online data, throttling activity below 1000 files/emails per hour.

CSO Onlineupdated · 4d agofirst · 4d agoThreat actor in the wild 13 sources1

Update your firewall rules: Teams and Copilot are changing address

Microsoft is redirecting Microsoft 365 and Teams web users to new *.cloud.microsoft domains, requiring firewall and proxy rule updates by early October.

Starting September 2026, Microsoft is redirecting M365 web users to copilot.cloud.microsoft and Teams web users to teams.cloud.microsoft, announced via MessageCenter posts MC1465764 and MC1462915. All redirects should complete by early October 2026, with limited Teams exceptions possible until December 31, 2026. Microsoft advises reviewing client, proxy, firewall, and secure web gateway configurations, and suggests using TenantRestrictions to control personal Microsoft account access instead of blocking the new Copilot address.

CSO Online · 4d agoAdvisory

India’s STPI serves TerminalFix-style attack via fake Cloudflare check

India's STPI government website serves a spoofed Cloudflare verification page that preloads malicious commands into visitors' clipboards for execution in Windows Terminal, matching TerminalFix-style attacks.

A malicious external JavaScript on the ananta.stpi[.]in subdomain of India's Software Technology Parks of India displays a fake Cloudflare 'Verify you are human' prompt and silently writes a URL into the visitor's clipboard, instructing the user to paste and execute it in Windows Terminal. Researcher Vibhum Dubey reported the behavior to STPI and CERT-In; the script loads from the recently registered cdn[.]quickdelivr[.]com and assigns each visitor a unique session identifier. The malicious script remained embedded after the overlay briefly disappeared, and the destination URL was flagged as malicious by 17 VirusTotal engines. No attribution has been established, though the pattern matches Microsoft's TerminalFix, a variant of ClickFix.

CSO Online · 4d agoPhishing & fraud in the wild1

Google’s Early Access is creating a blind spot for malicious apps

Bitdefender found thousands of Google Play Early Access apps with deceptive behavior, including ad-fraud-capable utilities requesting excessive permissions on Android devices.

Bitdefender Labs analyzed Google Play apps installed by its users and identified thousands of Early Access applications that appeared deceptive, including fake casino and reward games, misleading utilities, and apps using third-party trademarks, many promoted via social ads with AI deepfakes. Early Access apps cannot receive public reviews, removing a key warning signal users normally rely on. Some apps requested unusual permissions, such as a QR scanner seeking to replace the device launcher, which could enable hidden web views that click ads and potentially display fake login screens or capture two-factor codes. Bitdefender recommends Android Enterprise Work Profiles and notes Google Workspace admins can disable Early Access apps for their organization.

CSO Onlineupdated · 4d agofirst · 4d agoMalware 6 sources

MikroTik patches flaws currently being exploited to take over routers

MikroTik patches six RouterOS flaws, including the actively exploited MikroTrick SSH chain (CVE-2026-67276, CVE-2026-86060) enabling unauthenticated full router takeover.

MikroTik released patches in RouterOS 7.25 beta 3, 7.24.2, 7.23.4, and 6.49.21 for six vulnerabilities found by CERT Polska, affecting the SSH server/client, bandwidth-test service, X.509 handling, and WebFig. CVE-2026-67276, an RSA public-key validation flaw in the SSH server, lets an attacker who knows a username and key modulus authenticate as that user; CVE-2026-86060 then escalates privileges to root via special-character username handling. CERT Polska confirmed attackers are exploiting the chain to take full control of RouterOS devices with SSH exposed to the internet. Shadowserver Foundation scans show over 122,500 devices with internet-reachable SSH, concentrated in Brazil, the US, and Indonesia.

CSO Onlineupdated · 4d agofirst · 6d agoExploit / PoC in the wild 3 sourcesCVE-2026-67276CVE-2026-860602

How AI and cybersecurity are reshaping ServiceNow

Analysis argues ServiceNow's $7.75B Armis acquisition and AI-driven consumption pricing are reshaping its ITSM platform amid SaaS market anxiety.

CSO Online examines how AI agents, vibe-coding fears, and a reported 30% share price drop are pressuring ITSM leader ServiceNow, and how the company is pivoting toward consumption-based revenue and cybersecurity. The piece highlights ServiceNow's $7.75 billion cash acquisition of Armis, priced at roughly 23 times the vendor's $340 million annual revenue, as a strategic move to supercharge ITSM workflows with accurate device inventory and orchestration rather than to sell a standalone security product. Experts note this ends Armis's vendor-neutral position, introduces the CISO as a new buyer, and will likely lead to aggressive Armis bundling at contract renewals.

CSO Online · 4d agoIndustry

Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways

Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.

Sophos analyzed a second-stage Linux rootkit implant found in compromised F5 BIG-IP APM environments running Apache and PHP, linked to exploitation of CVE-2025-53521, an unauthenticated RCE. The implant hooks Apache's PHP-loading process and serves modified in-memory versions of three legitimate webtop PHP files (apm_css.php3, full_wt.php3, webtop_popup_css.php3), leaving on-disk files untouched so hashes and integrity checks pass. It also establishes access via an authenticated local UNIX socket that can provide an interactive /bin/bash session. Experts warn compromised APM appliances, which handle federated SSO and terminate TLS at enterprise perimeters, could enable SSO token theft and lateral movement to trusted downstream applications.

CSO Online · 5d agoMalware in the wild 4 sourcesCVE-2025-53521

The longitude problem: In the AI era, detection is won on facts, not guesses

Opinion piece argues defenders should beat AI-era attackers by carrying verified ground truth about approvers, domains, and vendors instead of relying on inference.

CSO Online contributor Alan LeFort, CEO of StrongestLayer, uses the historical longitude problem to argue that AI-era detection should rely on carried facts—authoritative records of payment approvers, owned domains, and legitimate vendors—rather than probabilistic inference that both attackers and defenders can now perform with comparable reasoning models. He illustrates with a CFO wire-fraud example defeated by checking the approver of record and the reply-to domain against ground truth. The piece stresses that ground truth decays and must be continuously maintained, like chronometers kept wound on every ship.

CSO Online · 5d agoIndustry

Getting ahead of ‘harvest-now-decrypt-later’: Post-quantum cryptography planning

Opinion piece urges organizations to begin post-quantum cryptography migration now, citing harvest-now-decrypt-later risk and NIST deadlines.

CSO Online outlines why harvest-now-decrypt-later makes long-lived sensitive data a current risk even before quantum computers exist. It cites NIST IR 8547 timelines deprecating RSA-2048 and ECC P-256 by 2030 and removing them by 2035, finalized FIPS standards ML-KEM, ML-DSA, and SLH-DSA, upcoming FN-DSA (FIPS 206), NSA requirements for national security systems from 2027, and UK NCSC phased guidance through 2035. The author recommends cryptographic discovery, crypto-agility, and prioritizing long-confidentiality data and TLS endpoints.

CSO Online · 5d agoResearch

SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now the Leading Path into the Enterprise

SpyCloud's 2026 survey of 750 security leaders finds compromised non-human identities are the top enterprise entry point, yet only 36% monitor them.

SpyCloud's Identity Threat Report, based on a survey of 750 cybersecurity leaders at organizations with 500+ employees, found compromised non-human identities (31%) were nearly twice as likely as phishing (17%) to be the primary attacker entry point. 68% of organizations reported identity-based events averaging eight each, while 95% believe they have visibility into AI and NHI exposures but only 36% actually monitor them. The report also found 91% use AI tools with internal access but only 56% have formal governance, and introduces an Identity Threat Protection Maturity Model.

CSO Onlineupdated · 6d agofirst · 6d agoIndustry 3 sources

Post-quantum cryptography adoption and the national security implications

Opinion analysis argues quantum computing favors nation-state espionage, leaving lagging post-quantum adoption at critical infrastructure exposed to harvest-now-decrypt-later attacks.

A CSO Online opinion piece argues that the extreme cost and infrastructure requirements of quantum computers will concentrate cryptographically relevant quantum capability among nation-states and a few corporations, favoring espionage and economic espionage over criminal monetization. It highlights harvest-now-decrypt-later risk to long-lived secrets, expert warnings such as Filippo Valsorda's, and diverging CRQC timelines with Google suggesting possibly 2029. The piece predicts governments, banks, and targeted sectors will adopt PQC first while utilities, small hospitals, and local government lag, widening exploitable gaps in critical infrastructure reminiscent of Salt Typhoon-style access.

CSO Online · 6d agoIndustry

50% of CISOs see Mythos as a sign to exit the profession

Survey of 1,001 US and UK CISOs finds 50% consider leaving the profession amid AI-driven pressure, personal liability concerns and burnout.

A survey of 1,001 CISOs in the US and UK found 50% say Anthropic's Mythos and similar cyber-capable AI models have made them consider exiting the profession, while 60% say board pressure to adopt AI is outpacing their governance capability. Average CISO tenure is cited at 18 months, and 78% worry about personal liability for security incidents, up from 56% a year earlier. Executives from BlackBerry, Databricks and IDC discuss D&O insurance, agentic security operations and phased low-risk AI adoption as partial responses.

CSO Online · 6d agoIndustry

September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows

Microsoft's September 2026 Patch Tuesday ships 964 fixes including two exploited Windows zero-days (CVE-2026-85880, CVE-2026-81963) and a wormable DNS RCE.

Microsoft's September 2026 Patch Tuesday includes 964 Microsoft vulnerabilities requiring customer action, a record attributed to AI-assisted bug discovery, plus 174 third-party/open-source and 23 Chromium/Edge CVEs. Two zero-days are exploited in the wild: CVE-2026-85880, a Windows ALPC heap overflow enabling AppContainer sandbox escape and privilege escalation, and CVE-2026-81963, a Windows Update Stack escalation to SYSTEM. CVE-2026-69730, an unauthenticated Windows DNS RCE, is not yet exploited but Microsoft expects exploitation, and roughly 20 bugs could be wormable. Separately, SAP issued a critical CVSS 10.0 fix for the EPP component used in S/4HANA and NetWeaver.

CSO Online · 6d agoVulnerability in the wildCVE-2026-85880CVE-2026-81963CVE-2026-69730+2 CVEs1

Cisco bundles fixes for multiple vulnerabilities, some critical, into one patch

Cisco patched seven IOS XR vulnerabilities, two rated CVSS 9.8, allowing unauthenticated remote code execution and root access on carrier routers; no exploitation observed.

Cisco released fixes for seven internally discovered vulnerabilities in IOS XR, its Linux-based network operating system for carrier-grade routers. Two flaws, CVE-2026-20274 and CVE-2026-20279, are rated CVSS 9.8 (critical) and involve lifetime resource control issues that can enable unauthenticated remote code execution with root access; the other five are rated 8.2-8.8 and cover buffer overflows, access control failures, and out-of-bounds access. All IOS XR releases including IOS XR7 are affected regardless of configuration, no workarounds exist, and remediation requires software maintenance upgrades (SMUs) or fixed releases 26.2.2/26.3.1. Cisco says the flaws are not known to be actively exploited, but experts urge immediate patching of internet-facing and core routing systems, citing parallels with Salt Typhoon tradecraft.

CSO Online · 6d agoVulnerabilityCVE-2026-20274CVE-2026-20279

CISA tells operators to harden Siemens S7 PLCs. Here’s how to do it without disrupting production

CISA, NSA, FBI and other agencies warn of active targeting of internet-exposed Siemens S7 PLCs and urge patching, exposure removal and hardening.

Joint advisory AA26-231A from the NSA, CISA, FBI, Department of Energy and EPA warns that actors are actively targeting Siemens S7 PLCs using internet scanning, AI-assisted scripts and libraries such as Snap7 and python-snap7 over S7comm on TCP port 102. The advisory covers S7-200 through S7-1500 series controllers and recommends patching, removing internet exposure, access controls, monitoring and disabling unneeded services. Siemens states no new S7 vulnerabilities are involved, only misconfigurations addressed in existing ProductCERT guidance SSB-104599. The article details how to apply each measure without breaking production dependencies such as remote I/O, HMI links and diagnostics.

CSO Online · 7d agoAdvisory in the wild

Mars Security Debuts Automated Threat Engine Processing Live Cyber Intelligence Into Validated Rules Within Minutes

Mars Security launches Real-Time Intel-Based Detection, converting threat intelligence advisories into validated, ATT&CK-mapped detection rules within minutes for SOCs.

Mars Security, an autonomous threat hunting and detection engineering platform founded by former offensive security operators, announced Real-Time Intel-Based Detection. The capability ingests advisories from sources like CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence, maps indicators to MITRE ATT&CK, and authors native query logic across connected infrastructure including CrowdStrike Falcon, Wiz, Splunk, Sysmon, identity providers, Snowflake, and Databricks. Every rule is backtested against 30 days of historical telemetry to quantify false positives before analyst approval and one-click deployment. The feature is free for existing customers and available via AWS Marketplace.

CSO Online · 7d agoTools1

Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests

Reflectiz launched a multi-agent AI penetration testing platform for websites, claiming up to 10x more coverage than conventional pentests.

Reflectiz, a continuous web exposure management vendor, launched a multi-agent penetration testing platform for websites under a new Offensive Hub. Four specialized agents crawl the site like a real user, fingerprint the stack, run attacks, and independently validate findings to remove false positives. The company claims up to 10x more coverage than conventional pentesting by starting from its pre-existing live model of each site. Findings integrate via REST API, CI/CD triggers and Slack, and the Atlas remediation agent guides fixes.

CSO Online · 7d agoTools

Adobe Commerce max-severity bug comes under active attack

Attackers are actively exploiting CVE-2026-75650 (CVSS 10.0), an unauthenticated RCE zero-day in Adobe Commerce/Magento, deploying a Rust backdoor on e-commerce servers.

Sansec identified active exploitation of a CVSS 10.0 zero-day (CVE-2026-75650) in Adobe Commerce and Magento Open Source versions 2.4.4 through 2.4.9, dubbed StyleSmuggler. The attack abuses crafted style properties in Magento template processing to execute PHP while rendering a 'Payment Transaction Failed Reminder' email, then launches a Rust backdoor connecting to C2 at 99.84.67.186 disguised as NTP traffic. Exploitation began September 4, 2026; Adobe released emergency hotfix VULN-393411, but Sansec also observed a second attacker deploying a PHP web shell in the product-image cache.

CSO Online · 7d agoExploit / PoC in the wildCVE-2026-75650

BigBear 2.0 phishing campaign hijacks Microsoft 365 sessions after MFA

CloudSEK uncovered BigBear 2.0, a PhaaS operation that captured 4,148 Microsoft 365 session cookies, hijacking authenticated sessions after MFA via AiTM proxy.

CloudSEK infiltrated the BigBear 2.0 phishing-as-a-service panel in June, finding 5,137 credential records tied to 461 organizations in over 40 countries, including 4,148 captured session cookies and 474 completed post-MFA logins. The operation, built on Evilginx2, uses an attacker-controlled reverse proxy to steal authenticated session cookies and residential proxies to defeat location-based Conditional Access checks, while custom code disables FIDO2/WebAuthn on phishing pages. At least five affiliates operated 42 VPS nodes, with IT services and managed service providers the most targeted sector.

CSO Online · 7d agoPhishing & fraud in the wild1

Back-to-back N-able bugs send admins on a patching spree

CVE-2026-86218, a CVSS 10.0 pre-auth RCE in N-able N-central, is being exploited in the wild; Hotfix 4 mitigates it immediately.

N-able disclosed CVE-2026-86218 on September 6, a pre-authentication remote code execution flaw with CVSS 10.0 in its N-central RMM platform, and both N-able and Huntress report it is being exploited in the wild. It follows Huntress's disclosure of an exploit chain combining CVE-2026-86206 and CVE-2026-86207 that bypasses access controls to create unauthorized administrative accounts, investigated after a September 4 compromise of a fully patched customer environment. N-able has applied mitigations to all hosted N-central instances; on-premises customers must upgrade to Hotfix 4 (build 2026.3.1.14) immediately.

CSO Online · 8d agoExploit / PoC in the wildCVE-2026-86218CVE-2026-86206CVE-2026-86207+2 CVEs

New CISO appointments 2026

Companies including Mistral AI, Trellix, Marriott, and ANZ appointed new CISOs in July-September 2026 amid high security-leadership turnover.

CSO Online's rolling column tracks senior security appointments, noting many companies are hiring a CSO/CISO for the first time. Notable moves include Thomas Coudray leaving Ledger to become Mistral AI's CISO, David Soto joining Trellix from Amazon, and Daniel Dubowski becoming Marriott International's SVP and CISO. Other appointments span ANZ, Gigamon, Axonius, Tricentis, Remitly, Allied Universal, and the State of California.

CSO Online · 8d agoIndustry

What do CISOs need to rest easy about future AI risks?

IANS survey of 113 CISOs finds optimism about managing future AI security risks hinges more on organizational readiness and leadership support than current controls.

An IANS AI Security Survey of 113 CISOs fielded in April and May found 41% optimistic and 38% pessimistic about their organization's ability to manage AI security risks over the next 24 months. Six organizational signals—leadership understanding of AI risk, defined governance ownership, security team effectiveness with AI tools, CISO ownership of the AI-security budget, sustainable workloads, and staffing—separate confident CISOs from pessimistic ones. Interviewed analysts cautioned that these readiness signals measure self-assessed confidence rather than actual security, and recommended hands-on AI use by security teams plus governance of third-party models.

CSO Online · 8d agoIndustry

FBI investigates breach of 153 million driving license records at IDscan.net

Scans of 153 million driver's licenses, traced to IDscan.net and including Pete Hegseth and Brian Krebs, were offered for sale on the dark web.

Digital scans of 153 million driver's licenses appeared for sale by a user on the Russian cybercrime forum Exploit, alongside over 10 million ID cards, 3 million travel documents, and 579,000 medical cards sold through a site called Nexus. KrebsOnSecurity traced the leak to identity verification provider IDscan.net, whose customers include car rental company Hertz, and victims reportedly include US Defense Secretary Pete Hegseth. The FBI has opened an official inquiry into the source of the images, and IDscan.net has not issued an official statement.

CSO Online · 11d agoData breach1

The democratization of cyber warfare — and what it means for CISOs

CSO Online argues AI is democratizing cyber warfare, citing Taiwan's first largely autonomous AI-driven attack that hit 85 government accounts.

CSO Online argues AI is accelerating the democratization of cyber warfare by collapsing cost and skill barriers, with effects already reaching the private sector. It cites the August disclosure of the first largely autonomous AI-enabled attack on Taiwan government infrastructure, where up to eight agents operating simultaneously compromised at least 85 government accounts and exfiltrated more than 2,500 personnel records before expanding to the nuclear safety agency and energy companies. The piece places this in a historical arc from crossbows to cheap drones and cites Kane Gamble's 2015 solo social-engineering compromise of senior US intelligence officials as evidence that low-resource attackers were already viable.

CSO Online · 11d agoIndustry

Decade-old PostgreSQL flaw turns backup account into a backdoor

Cyera disclosed CVE-2026-6471, a decade-old PostgreSQL flaw letting REPLICATION-attribute accounts achieve RCE and superuser compromise, patched August 13.

Cyera Research's 'PostGREShell' flaw exists in PostgreSQL's logical replication output plugin loading, where the replication code path never called the library-path security check, allowing path traversal or UNC paths to load arbitrary code. A low-privilege backup account can achieve code execution on Windows, Linux, and macOS, then escalate to superuser with persistent backdoor access. CVE-2026-6471 affects versions back to PostgreSQL 9.4 (2014) and was patched in releases 18.6, 17.11, 16.15, 15.19, and 14.24 on August 13. CVSS is 7.2, and no exploitation of this specific CVE has been confirmed, though VirusTotal hunting found 114 malicious PostgreSQL plugins.

CSO Online · 12d agoVulnerabilityCVE-2026-6471

Counterfeit installers turn routine software downloads into enterprise breaches

Microsoft warns of a multi-sector campaign using counterfeit download sites for Edge, Kaspersky and Razer to deliver trojanized installers with persistent implants.

Microsoft Defender Experts tracked a campaign breaching organizations in healthcare, manufacturing, gaming, technology, logistics, government, and education via spoofed vendor download pages, often using .com.cn and .hl.cn domains. Installers keep the same filename while their hash changes on every download, indicating server-side payload generation that defeats file-based detection. The chain abuses msiexec.exe and scheduled tasks for persistence, adds Defender exclusions, deletes shadow copies, and disables Windows Update, with some hands-on-keyboard activity. The activity is consistent with the publicly reported Silver Fox (Yinhu) campaign, though Microsoft has not attributed it to a nation-state actor.

CSO Online · 12d agoThreat actor in the wild1

AI agents help compress ransomware intrusion to under 10 hours, raising stakes for CISOs

Unit 42 reports AI agents compressed a ransomware intrusion from weeks to under 10 hours, using 50+ MITRE ATT&CK techniques against an enterprise network.

Palo Alto Networks Unit 42 investigated a ransomware incident where AI agents moved through an enterprise network in under 10 hours, work that would have taken human operators roughly two weeks. The attacker entered via a public-facing API endpoint, used automated reconnaissance to map microservices, searched source-code repositories for credentials, and accessed a secrets-management system. They hijacked enterprise code workflows to exfiltrate cloud access keys, attempted Terraform backdoors (blocked by branch protections), and used stolen credentials to access the victim's own AI services as attack infrastructure. Over 50 MITRE ATT&CK techniques were observed; the actor confirmed using frontier AI models and agentic frameworks during negotiations.

CSO Online · 12d agoThreat actor in the wild

Stop playing with the CISO role. Fix cybersecurity leadership

Op-ed argues the CISO role is overloaded and advocates elevating a business-first Chief Security Officer above it.

The author contends that business-alignment failures in cybersecurity are structural rather than communication problems, with CISOs expected to act simultaneously as technologists, strategists, risk executives, and board advisers. The piece proposes a distinct Chief Security Officer role focused on enterprise protection, business continuity, and cross-functional decision authority, with the CISO retaining technical cybersecurity responsibility and potentially reporting to the CSO. It argues this model would give executive ownership of business protection while preserving technical depth.

CSO Online · 12d agoIndustry