ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “research”

310 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 9163Malware 9151Ransomware 6377Exploit / PoC 4691Threat actor 3157Data breach 2726Industry 2367Phishing & fraud 2073Policy & legal 1905Research 858Advisory 240Tools 160
SeverityAllcritical 16229high 13151medium 8206low 4962info 320

OT Threat Research

Palo Alto Networks Unit 42 launched an OT Threat Research Lab to study how cyber threats disrupt industrial and critical-infrastructure operations.

Unit 42 announced a dedicated OT Threat Research Lab for testing emerging technologies, evaluating AI-OT scenarios, and examining how threats move across connected operational systems. The lab's findings are intended to inform vulnerability analysis, detection guidance, and risk prioritization for operational technology environments.

Palo Alto Unit 42 · 22d agoIndustry

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News · 28d agoResearch2

Nebulon Enterprise Simulated Threats for Phishing Research (NEST-Phish): A Synthetic Enterprise Phishing Email Dataset for Behavioral and Machine-Learning Research

Researchers release NEST-Phish, a synthetic enterprise phishing email dataset with matched legitimate and phishing emails and cue annotations for detection research.

Academic researchers introduce NEST-Phish, a publicly released synthetic enterprise phishing email dataset built around a fictitious organization named Nebulon. It contains matched synthetic legitimate and phishing emails across a broad set of workplace communication themes, each with interpretable phishing-cue annotations. Human-subject categorizations and supervised classifier evaluations indicate the dataset supports meaningful variation in phishing judgments and provides learnable signal for detection models. It is intended to support work on phishing detection, human susceptibility, explainability, and benchmark development.

arXiv cs.CR · 14d agoResearch

Risky Bulletin: Russia starts blocking DoH and DoT

Russian users report blocks on DoH and DoT servers, including Cloudflare 1.1.1.1 and Google 8.8.8.8, in an apparent censorship crackdown.

Russian internet users began reporting failures connecting to DNS-over-HTTPS and DNS-over-TLS servers, suggesting a government crackdown on the two privacy protocols. The blocks reportedly cover Cloudflare's 1.1.1.1 and Google's 8.8.8.8 resolvers; Roskomnadzor has not officially confirmed the action. The agency tested a similar block in March on Beeline's network and had named DoH for blocking as early as 2021. The bulletin also briefly notes state-sponsored phishing of EU officials, a DDoS against Norway's Digdir, the ReliaQuest/ShinyHunters dispute, and older ransomware and breach disclosures.

Risky Business News · 23d agoPolicy & legal1

Researchers open-source a Wi-Fi cyber range for security training

NTNU and Aegean researchers open-source a software-emulated Wi-Fi cyber range using mac80211_hwsim with LLM-assisted scenario building.

Researchers from the Norwegian University of Science and Technology and the University of the Aegean published a design and prototype for a cyber range dedicated to IEEE 802.11 security training, emulating access points and clients with mac80211_hwsim, Linux namespaces, hostapd, wpa_supplicant, dnsmasq, and FreeRADIUS. The platform bundles Aircrack-ng, Wireshark, and custom tools WPAxFuzz and Bl0ck, and can convert plain-language scenario descriptions into deployable definitions via a locally hosted Llama model. A working prototype covering scenario creation and deployment is on GitHub; monitoring, access control, and orchestration zones remain future work.

Help Net Security · 25d agoTools1

Researchers built a $7 gadget for anyone paranoid about hidden cameras in hotel rooms

KAIST-led researchers built SweepLED, a sub-$7 smartphone LED clip using AI to detect hidden cameras with 93.9-95.1% accuracy.

SweepLED, built by KAIST with the National University of Singapore and Singapore Management University, clips 15 LEDs to a smartphone camera and sweeps multi-angle light while the phone films reflections. A spatio-temporal AI model compares LED-on and LED-off frames to distinguish lens reflections from glossy surfaces across three viewpoints. Testing on 30 objects, 12 with hidden cameras, achieved 93.9% accuracy handheld and 95.1% static. Core components cost under $7, targeting privacy checks in hotels and short-term rentals.

Help Net Security · 15d agoResearch1

Scareware ads keep running on Google's transparency tool, even after they're reported

NYU and Radboud researchers built AdLens, which found 238 scareware and 3,346 false-claim ads in Google's ad archive; reported ads often stayed live.

The AdLens tool, built by NYU and Radboud University researchers, mined Google's Ads Transparency Center and screened 188,000 software ad creatives using similarity search plus a panel of open-source language models, finding 238 scareware ads, 3,346 false-claim ads, and 258 anonymity-avoiding ads with over 100 million impressions in Europe. Reporting ads through Google's standard flow produced inconsistent removals: some ads acknowledged as violations stayed live, and after one takedown tied to the TamperedChef malware domain, 41 other ads pointing to the same domain kept running. The pipeline runs entirely on open-weight models at low cost (a $96 DigitalOcean VM plus $1.57/hour L40S inference) and is designed to extend to Meta and Amazon ad libraries.

Help Net Security · 16d agoResearch

Abandoned IoT apps keep sending sensitive data to broken servers

UMass Amherst researchers found 61,500 abandoned Android IoT apps send sensitive data to unreachable, blocklisted, or re-registered domains.

Researchers at the University of Massachusetts Amherst built a dataset of 61,500 abandoned IoT companion apps from AndroZoo and found 73.6% bundled dependencies with vulnerabilities listed in the National Vulnerability Database. About a quarter of extracted domains no longer resolved, roughly one in nine URLs matched threat-intelligence blocklists for phishing, scam, spyware, or malware links, and domains affecting over 2,000 apps had changed ownership since the apps' last update. 38.4% of unique data-flow sources and sinks in abandoned apps were tied to unreachable, blocklisted, or ownership-changed domains, versus under 1% in 500 actively maintained comparison apps. Disclosure emails prompted some app removals and fixes, including a Tuya SDK issue patched on the vendor's cloud platform.

Help Net Security · 8h agoResearch

$536 and 8 Hours: AI Learns to Attack a Different PLC

Forescout used Claude to port a WAGO PLC exploit for $536 in 8 hours, and an AI-generated payload later permanently bricked the test device.

Forescout researchers used Claude Code with Ghidra, terminal access, and physical hardware to port CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server, from a WAGO 750-852 PLC to the WAGO 750-831 without source code or debugger access. The final RCE development stage cost $535.74 in API fees over an 8-hour, 32-minute session (2.6k input and 1.3M output tokens) and required heavy researcher guidance. Claude produced working ICMP and UDP beacon exploits in 12 minutes after identifying that normal FTP command completion was overwriting its shellcode, fixed by omitting the CRLF terminator. A follow-up session extending the payloads toward a C2 implant wrote to flash-mapped memory and permanently bricked the PLC, underscoring the risks of autonomous agents operating against physical infrastructure.

Security Affairs · 16d agoResearchCVE-2021-318861

Risky Bulletin: Dutch intel services to get extensive new powers

Netherlands proposed a bill granting AIVD and MIVD expanded warrantless tapping, faster hacking powers, and forced data disclosure, citing Russia, China, and Iran threats.

The Dutch government introduced a bill greatly expanding surveillance powers of intelligence agencies AIVD and MIVD, allowing up to one year of tapping without pre-approval and simplified hacking operations against 'foreign adversaries'. Agencies could compel Dutch companies or citizens to provide data under threat of charges, share data with the private sector, and oversight bodies would merge into a new CTT board. The bill follows similar overhauls in Ireland, Germany, and France after Russia's invasion of Ukraine. The newsletter also reports Moonwell hacked for $8.7M, a Cosmos EVM bug exploited for ~$3M, ShinyHunters listing McKesson with claimed hundreds of millions of records, and a pro-Kremlin DDoS claim against Norway's government network.

Risky Business News · 18d agoPolicy & legal

Measuring the Security of the Evolving Software Supply Chain: a Research Agenda

Researchers propose a unified cross-ecosystem measurement agenda for software supply chain security, targeting dependency modeling and AI-generated dependency patterns.

The paper argues that existing quantitative measurement and vulnerability management approaches for software supply chain security are fragmented and ecosystem-specific, limiting comparable risk assessments. It lays out a research agenda starting with a Systematization of Knowledge to expose gaps in dependency modeling, transitive dependency treatment, and real-world exploitability of vulnerabilities. It further warns that AI-assisted development with coding LLMs will create dependency patterns not captured by traditional Software Composition Analysis tools, motivating a rethink of dependency modeling.

arXiv cs.CR · 9d agoResearch

Call for Applications: Information Controls Research Program 2026

The Open Technology Fund is accepting applications for its 2026 Information Controls Research Program, announced via Citizen Lab.

The Citizen Lab reposted an announcement that the Open Technology Fund is accepting applications for the 2026 Information Controls Research Program. The program funds research on internet censorship and information controls. The announcement is a call for applications rather than a technical security finding.

Citizen Lab · Aug 17, 2026Industry

Turn it off and on again, but for critical infrastructure

KTH researchers trained a reinforcement-learning intrusion response agent on an emulated segmented OT network that autonomously resets hosts and processes to disrupt intruders.

Researchers at KTH Royal Institute of Technology built a containerized replica of a segmented industrial network, attacked it across 14 days, and captured 40,000 30-second traffic intervals to train a defense agent under partial observability. The agent observes six packet-count numbers per interval, maintains 500 running state hypotheses, and can reset supervisory hosts, water tank processes, or entire subnets, with resets rebooting the target, renewing credentials, and changing its IP. The best agent approached a full-visibility baseline but depends on an assumed attacker behavior model; the testbed comprised three supervisory hosts, two PLCs, two tanks, weak credentials, and CVE-2017-7494 exposure. The team released its implementation and plans validation on a real industrial testbed with a partner.

Help Net Security · 4d agoResearchCVE-2017-74942· 1 read

Wordfence Argus: Moving Beyond Human Research Capability

Wordfence showcases Argus, an AI agent for security research whose breakthrough findings required the AI itself to explain them.

Wordfence describes Argus, an AI research agent the company says has moved beyond human research capability, producing a breakthrough so complex that the team asked the agent to write the explanatory blog post itself. The post functions as a vendor announcement of AI-driven vulnerability research capability. No specific CVEs, victims, or exploited products are detailed in the available text.

Wordfence · 21d agoTools

Cybersecurity jobs available right now: July 14, 2026

July 14, 2026 cybersecurity job listings featuring roles at Fiserv, American Express, Orca Security, Ofsted, and others across multiple countries.

This Help Net Security post lists cybersecurity jobs currently open at Fiserv, Integris Group, American Express, Orca Security, Jefferson County, Ofsted, Armstrong Fluid Technology, UNEY, Red Alpha Cybersecurity, Astranis, and lululemon. Roles span network engineering, threat intelligence leadership, AI security specialization, and security operations. All listed positions are on-site, hybrid, or remote across USA, Israel, UK, Canada, UAE, and Singapore. Most positions noted as no longer accepting applications.

Help Net Security · 24d agoIndustry1

Harnessing LLMs for Automating BOLA Detection

Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.

Palo Alto Unit 42 details BOLABuster, a methodology combining large language models with heuristics to automate detection of broken object-level authorization (BOLA) flaws, which traditional fuzzing and static analysis struggle to find. The approach uses LLM reasoning to understand application logic, map endpoint dependency relationships, and generate and interpret test cases. It found CVE-2024-1313 in Grafana, CVE-2024-22278 in Harbor, and 15 CVEs in Easy!Appointments. The team is continuing to hunt for BOLAs in open-source and internal projects.

Palo Alto Unit 42 · Aug 17, 2026ResearchCVE-2024-1313CVE-2024-22278CVE-2023-3285+14 CVEs

Phishing Research Challenges Conventional Security Awareness Testing

Pistachio's 2.47 million phishing simulations across 1,200 organizations show click rates alone mislead, with 30% of IT staff clicking and leak rates more predictive.

Between June 2025 and May 2026, Pistachio sent 2.47 million simulated phishing attempts to more than 123,000 employees at over 1,200 organizations, analyzing click, credential-leak and reporting behavior. Click rates ranged from 26% in Design to 41% in Construction; 30% of tech development and IT staff clicked at least once, while financial services were the most resilient sector. The report argues that click rate alone creates a false sense of security and that combined click, leak and report trends are better resilience indicators.

SecurityWeek · 6d agoResearch

Release Notes: Faster TI Investigations, Fresh Threat Research, and 650+ Threat Coverage Updates

ANY.RUN August release adds TI Lookup connections view, 81 behavior signatures, 16 YARA rules, 559 Suricata rules, and three new threat intelligence reports.

ANY.RUN released August product updates expanding its Threat Intelligence Lookup with a Connections block for pivoting between related observables (domains, IPs, URLs), JSON export for retrohunting and SIEM/NDR integration, and hidden whitelisted data by default. Detection coverage grew with 81 new behavior signatures, 16 YARA rules, and 559 Suricata rules covering malware execution, phishing, and C2 traffic. Three new Threat Intelligence Reports cover a US-focused RMM phishing campaign across 46 countries, the Mirage2FA phishing-as-a-service targeting Microsoft 365 (1,249 sandbox sessions, 9,332 potential compromise events), and a threat brief on OVERLORD RAT, CRPX0, and TRIBACK loader.

ANY.RUN · 15d agoTools1

Two alleged TeamPCP members arrested and charged after months of software supply

Australian Federal Police, with FBI support, arrested two alleged TeamPCP members behind supply-chain attacks that compromised over 1,000 organizations.

The AFP charged two Western Australian men, identified by media as Ruben Ian Thomson (21) and Louis Michael Gaebler (23), with 14 combined offences including unauthorized data modification and dealing in criminal proceeds. TeamPCP is blamed for poisoning open-source software releases including Trivy, LiteLLM, and the mini Shai-Hulud worm campaign, exposing over 500,000 credentials and at least 300 GB of data. Victims included the European Commission and GitHub, with remediation costs estimated in the hundreds of millions of dollars. Researchers from Flare traced one suspect through leaked passwords, a GitHub alias, and a Steam profile.

CyberScoop · 21d agoPolicy & legal1

Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day

Weekly digest: exploited Metabase zero-day breached Framework; Salesforce/ServiceNow portals read for 17 months; Microsoft patched 400+ flaws.

Help Net Security's week in review aggregates top stories: a 'City-Forum' campaign tracked by Reco has been pulling records from Salesforce and ServiceNow portals worldwide for 17 months, and Framework suffered a breach via an exploited Metabase zero-day exposing customer contact and IP data. It also covers Microsoft's August 2026 Patch Tuesday fixing 400+ flaws including exploited zero-day CVE-2026-68820, Cisco's fix for exploited firewall DoS bug CVE-2026-20349 (added to CISA KEV), and a second N-able N-central hotfix for actively exploited CVE-2026-18577. Other items include GitHub expanding Dependabot malware alerts to eight package ecosystems and EU AI Act enforcement beginning on 2 August 2026.

Help Net Security · Aug 16, 2026Industry in the wildCVE-2026-18577CVE-2026-68820CVE-2026-203491

Cybersecurity in Power Grids: Standards and Research Challenges

Survey contrasts IT and OT security in smart grids, reviewing IEC 62351, IEC 62443, ISO 27001 standards and AI-driven detection trends.

The paper examines Smart Grid cybersecurity, emphasizing critical distinctions between IT and OT environments. It analyzes grid architecture, substation threats, and key international standards including IEC 62351, IEC 62443, and ISO 27001. It concludes with an overview of recent research trends such as AI-driven threat detection.

arXiv cs.CR · 3d agoResearch

Cybersecurity jobs available right now: September 15, 2026

Help Net Security's weekly roundup lists cybersecurity job openings worldwide, from CISO roles to cloud security engineers at firms like Adobe, JPMorgan Chase, and PwC.

Help Net Security's September 15, 2026 job roundup lists cybersecurity openings across India, USA, UK, Australia, Canada, Israel, UAE, Ireland, and Denmark. Roles include a CISO at Texas Health and Human Services, a GenAI CBRNE Cyber Security Expert at Alice, and security engineering positions at Adobe, JPMorgan Chase, PwC, and the Reserve Bank of Australia. Several openings focus on AI security, including red-teaming AI models and securing AI agent platforms.

Help Net Security · 3d agoIndustry1

Microsoft Offers Up to $30,000 for Critical AI Flaws in Dynamics 365 and Power Platform

Microsoft expands AI bug bounty to Dynamics 365 and Power Platform, paying up to $30,000 for critical inference manipulation flaws.

Microsoft's bug bounty program offers up to $30,000 for critical 'Inference Manipulation' or 'Inferential Information Disclosure' bugs in Dynamics 365 and Power Platform, including Copilot Studio, AI Builder, Power Apps, Power Automate, and Dataverse. Payouts scale by report quality ($30,000/$20,000/$12,000 for critical) with important-severity AI flaws earning $6,000-$20,000, plus 20% multipliers for Dataverse privilege escalation and Plugin Sandbox escapes. Prompt injection affecting only the attacker, hallucinated execution, and system-prompt disclosure are excluded from scope.

Cyber Security News · 3d agoIndustry

Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)

A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.

Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.

SANS Internet Storm Center · 15d agoTools1

Recorded Future Launches Impact and Metrics Dashboard

Recorded Future releases an Impact and Metrics Dashboard aggregating risk-reduction, detection, and analyst-efficiency metrics for customer leadership reporting.

The dashboard pulls data from a customer's environment, alerts, integrations, threat detections, and analyst activity into six metric areas: platform-wide security value, threat prioritization, threat detection, digital risk protection, account and credential monitoring, and Recorded Future AI and Insikt Group research usage. It is available now to all Recorded Future customers, who are advised to configure Priority Intelligence Requirements in Settings so reporting maps to their intelligence program. The vendor cites its 2025 ROI Report across nearly 300 customers reporting 351.3% annual ROI and says customers aligning alerting to PIRs identified new threats 65% faster.

Recorded Future · 25d agoTools

Google’s open-source HEIR lets AI work with data it can’t see

Google open-sourced HEIR, a compiler toolchain that converts pre-trained AI models to operate on homomorphically encrypted data without exposing it.

Google's HEIR (Homomorphic Encryption Intermediate Representation) is an open-source compiler toolchain and development platform for fully homomorphic encryption, announced in 2023 and now supporting four peer-reviewed publications. It compiles Python programs handling sensitive data into implementations that process encrypted inputs, supporting multiple FHE schemes, libraries, front-end languages, and hardware accelerators such as GPUs, TPUs, FPGAs, and custom ASICs. Demonstrated applications include private recommendations, credit card fraud detection, network intrusion detection, and hotword recognition.

Help Net Security · Aug 18, 2026Tools

New York Seizes a Dozen Celebrity Deepfake Websites

Manhattan DA seized 12 domains hosting nonconsensual celebrity deepfake videos depicting about 1,200 victims, the largest such takedown to date.

The Manhattan District Attorney's Office seized 12 domains used for sharing and selling nonconsensual deepfake sexual videos, depicting around 1,200 people, mostly women, including influencers, politicians, and celebrities. The seizures under New York criminal procedure law represent the largest takedown of explicit deepfake websites to date, aided by the US Take It Down Act. Much of the content appeared to be reposts from the MrDeepFakes platform, and investigations into operators and uploaders are ongoing.

WIRED · Securityupdated · 3d agofirst · 3d agoPolicy & legal 2 sources

We've got one word for it, and it's usually the wrong one

Cisco Talos's Threat Source newsletter critiques 'burnout' terminology, describing four occupational injuries, and flags a UAT-10820 WebDAV stealer campaign at a Ukrainian government organization.

Cisco Talos's Threat Source newsletter argues that 'burnout' is the wrong word for most cybersecurity occupational harm, distinguishing exhaustion, secondary traumatic stress, vicarious trauma, and moral injury based on clinical literature from trauma-exposed professions. The featured disclosure describes a complex WebDAV infection chain found at a Ukrainian government organization, attributed with moderate confidence to the Russian-tracked actor UAT-10820 and assessed as an opportunistic cryptocurrency and credential-stealing operation. The campaign delivers the Amatera stealer alongside ZigCryptoStealer and NetSupport Manager, abusing BNB Smart Chain bulletproof hosting, fake CAPTCHA prompts, a vulnerable driver to kill EDR, and rundll32.exe execution of disguised DLLs with ordinal calls. Weekly headlines also cover a Microsoft Defender 'ShieldCrash' zero-day exploit released after September 2026 Patch Tuesday, a North Korean Linux espionage toolkit backdooring HAProxy, and a multi-hop Google-domain redirect phishing campaign.

Cisco Talos · 7d agoIndustry in the wild1

The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

Unit 42 demonstrates that root access on a Kubernetes node lets attackers spoof SPIFFE/SPIRE attestation and harvest co-located workloads' SVIDs.

Palo Alto Networks Unit 42 describes post-exploitation techniques in which an attacker with root on a compromised Kubernetes node spoofs Linux cgroup metadata used by the SPIRE agent during workload attestation, tricking it into issuing a co-located workload's SPIFFE Verifiable Identity Document to an attacker-controlled process. The research shows the core trust assumption of machine-identity systems—that the node is trusted—collapses once root is obtained, exposing all cryptographic identities scoped to that node. Unit 42 released an open-source tool, Spooffe, for defenders to test identity exposure, and notes the technique has not been observed exploited in the wild.

Palo Alto Unit 42 · 8d agoResearch1

Autonomous Threat Operations in action: Real results from Recorded Future’s own SOC team

Recorded Future reports its Autonomous Threat Operations platform enabled 15-20 weekly automated threat hunts in its own SOC.

Recorded Future deployed its Autonomous Threat Operations platform internally as Customer Zero before customer release, standardizing threat hunting across its security operations organization. The team now runs 15-20 scheduled threat hunts weekly, replacing manual hunts that previously took days or weeks of preparation. During the Salt Typhoon campaign, Recorded Future's CISO launched a network-wide threat hunt in five minutes between meetings. The platform connects to the company's Splunk environment and consolidates hunting and IOC research into a single interface.

Recorded Future · 15d agoTools

Cybersecurity jobs available right now: March 31, 2026

Help Net Security's job roundup lists cybersecurity vacancies worldwide, from malware research director to SOC, IAM, and GRC roles, mostly already closed.

The roundup aggregates cybersecurity openings across Israel, Ireland, India, the UK, Australia, France, Germany, Canada, the US and the UAE. Roles include Android malware research director, cloud security engineer, IAM analyst, SOC lead, GRC specialist, and vulnerability management positions at employers such as Iceland Foods, Pernod Ricard, A10 Networks, and TOMRA. Most listings were marked as no longer accepting applications at publication.

Help Net Security · 21d agoIndustry

Why The Vulnerability Backlog Is About To Get Worse

Recorded Future analysis says AI-driven vulnerability discovery and faster weaponization will grow the triage backlog while shrinking defenders' response windows.

Disclosed vulnerabilities rose from roughly 21,000 in 2021 to nearly 50,000 in 2025, while Recorded Future assessed only 446 as actively exploited in 2025. VulnCheck found nearly 29% of 2025 KEV entries were exploited on or before CVE publication. The authors argue AI-assisted discovery and automated exploit development will multiply credible reports, cut disclosure-to-exploit time toward minutes, and force re-evaluation of medium-severity flaws as exploit-chain components.

Recorded Future · 23d agoResearch

TruffleHog AWS Analyze reduces remediation time on leaked AWS credentials

Truffle Security launched TruffleHog AWS Analyze, which maps leaked AWS keys' permissions and role assumptions; research found 88% of 64,024 leaked keys still active.

Truffle Security announced TruffleHog AWS Analyze, a TruffleHog Enterprise feature that enriches leaked AWS credentials with identity, effective permissions, and role-assumption context to help teams assess blast radius and prioritize remediation, extending earlier coverage of SaaS and Google Cloud to AWS. Truffle Security research on 64,024 unique leaked AWS keys found 88% still active, a median exposure of five years, only 14% rotated, 84% with full administrator access, and 1 in 6 being root keys, including 929 keys AWS had flagged via its compromised-key quarantine policy that still authenticated. A scan of 7.6 petabytes of public AI training data on Hugging Face found 3,343 live AWS keys, over 900 of which could list S3 buckets holding at least 51.7 TB of private data.

Help Net Security · 24d agoTools

Can your coding style predict whether your code is vulnerable?

University of Massachusetts Dartmouth researchers present VulStyle, a stylometry-based vulnerability detector that also exposes benchmark reliability problems.

VulStyle combines stylometric features with syntax-tree structure and source tokens, pre-trained on about 4.9 million functions across seven programming languages and fine-tuned on five vulnerability detection datasets. It beat token-only detectors on some benchmarks but its F1 drops sharply on DiverseVul, which the authors link to noisy labels inflating reported performance across popular datasets. The authors argue style-aware detection should be harder to evade but did not test this empirically, and they note that uniform LLM-generated code may strip away the individual developer style the model depends on.

Help Net Security · 25d agoResearch1

Risky Bulletin: The EU publishes its upcoming cybersecurity standards

ETSI releases 17 draft cybersecurity standards vendors must meet when the EU Cyber Resilience Act takes effect in December 2027.

The European Telecommunications Standards Institute published 17 interim draft standards covering operating systems, routers, firewalls, VPNs, SIEMs, browsers, password managers, smart home devices, toys and wearables. They mandate basic security features such as post-sale updates, shipped SBOMs, modern cryptography and secure-by-default settings; public comments run until November, with final versions expected in December, one year before CRA compliance begins in December 2027. The newsletter also reports Irregular taking responsibility for AI test-environment escapes involving Anthropic and Meta frontier models, a breach at France's tax agency exposing 678,000+ citizens' data claimed by hacker ZeroBytes, and Kazakhstan eGov data covering 15 million citizens listed for sale on an underground forum. Additional briefs cover a $3.2 million Harmony Protocol theft crashing the ONE token 40%, Columbus Police still restoring systems two years after ransomware, DDoS attacks on Threema's provider, and Ukraine's GUR claiming a cyberattack on Wildberries.

Risky Business News · Aug 17, 2026Policy & legal2

Multi-center Medical Data Mining with FL-Net - A One-stop Shop for Federated Learning

FL-Net is a federated clinical research framework integrating harmonization, disclosure control, and audited workflows, targeting 800,000+ patients across 10 hospitals in 9 countries.

The authors derive five requirements from the literature and find that none of 14 analyzed federated learning frameworks fully satisfies them. FL-Net combines modular data harmonization, data discovery, disclosure control, securely built versioned FL-Net-Tools, and containerized federated workflow execution in a persistent network. It was evaluated with cross-study patient discovery across MIMIC and US-130 and reproducible, audited workflows with up to 50 concurrent clients. Development continues within the EU dAIbetes and Microb-AI-ome projects, aiming to cover over 800,000 patients across 10 hospitals in 9 countries.

arXiv cs.CR · 21h agoResearch

Enterprise Threat Intelligence Buying Guide: How to Choose the Right Solution

ANY.RUN published a buyer's guide for enterprise threat intelligence platforms, outlining evaluation criteria and promoting its own TI products.

ANY.RUN, whose sandbox, TI Lookup, and TI Feeds products are featured throughout, published guidance for selecting an enterprise threat intelligence provider. The guide recommends defining SOC or MSSP requirements first, then weighing intelligence quality and freshness, integrations including STIX/TAXII support, privacy, scalability, and proof-of-concept testing with real alerts. It emphasizes context and enrichment over raw data volume, citing figures such as TI Lookup results in about 2 seconds and 99% validated IOCs in its feeds.

ANY.RUNupdated · 1d agofirst · 1d agoIndustry 3 sources

Microsoft Offers $60,000 Bounty for Critical Cross-Tenant Vulnerabilities

Microsoft expands Dynamics 365 and Power Platform bug bounty, paying up to $60,000 for critical cross-tenant vulnerabilities.

Microsoft expanded its bounty incentives for Dynamics 365 and Power Platform, with qualifying rewards from $1,250 to $60,000. Critical cross-tenant vulnerabilities receive a 100% award multiplier and important ones 50%, while critical AI inference manipulation or inferential disclosure can earn up to $30,000. Scope covers Dynamics 365 apps, Power Apps, Power Automate, Copilot Studio, Power Pages, Dataverse, and selected on-premises products. Reports must be rated Critical or Important and submitted via the MSRC Researcher Portal.

GBHackers · 3d agoIndustry1

AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key

Huntress research shows AD RMS SLC root key is unrotatable and never expires, so its compromise permanently exposes all RMS-protected documents.

Part 2 of Huntress's AD RMS series details server-side attacks: extracting the Server Licensor Certificate (SLC) private key and performing offline decryption of protected documents. The SLC key has no expiry or rotation mechanism, with a 255-year certificate validity (2002–2258), so whoever recovers it can decrypt every document the deployment ever protected, indefinitely. The author released SharpRMS, a unified tool combining the 2016 DisARMS client-side attacks with new server-side key extraction and decryption capabilities. The research frames the SLC as comparable to KRBTGT and the DPAPI domain backup key, though not equivalent to domain compromise.

Huntress · 8d agoResearch

AI slops from Eve

oss-security moderator Solar Designer approved three AI-generated vulnerability reports from automated security researcher Eve, sparking debate over AI slop on the list.

oss-security moderator Solar Designer approved three posts submitted by Eve, described as an 'automated security researcher', noting they lacked Date headers and arrived on the list server on September 9. He expressed uncertainty about their value but suggested they may have historical significance as early examples of AI-generated security reports at the dawn of AI security research. The post is meta-commentary on AI-generated content reaching a vulnerability disclosure mailing list rather than a specific vulnerability disclosure itself.

oss-security · 8d agoIndustry