Search: “Cylake”

12 Best CWPP Solutions Compared (2026): Features & Pricing

CWPP comparison favors Sysdig for container runtime depth, Prisma Cloud for workload breadth, and Aqua for cloud-native lifecycle security.

An editorial comparison of twelve CWPP solutions covers Trend Micro, Aqua, Prisma Cloud, Illumio, Microsoft Defender for Cloud, Fidelis, CrowdStrike and others, with pricing models and category notes. It names Sysdig (Falco lineage) the leader in Kubernetes/container runtime depth and Prisma Cloud the breadth benchmark across hosts, containers, and serverless. It flags Illumio as microsegmentation and Fidelis as NDR/XDR rather than classic CWPP.

GBHackers·updated 08:33 UTC · 3h ago·first Sep 15, 06:43 UTC · 2d agoIndustry 12 sources1

CVE-2026-85706: Critical GitLab Path Traversal Exploited in the Wild

CVE-2026-85706, a CVSS 10.0 unauthenticated path traversal in GitLab CE/EE, is actively exploited and was added to CISA's KEV catalog.

GitLab patched CVE-2026-85706, a critical path traversal (CWE-22) in the repository commits API scoring CVSSv3.1 10.0, allowing unauthenticated arbitrary file reads on affected self-managed servers under certain conditions. CISA added it to the KEV catalog on September 11, 2026, citing active exploitation, with a September 14 remediation deadline and BOD 26-04 forensic triage requirements. Fixed versions are 19.1.8, 19.2.6, and 19.3.2; the release also fixes 17 other vulnerabilities including CVE-2026-87719, a CVSS 9.9 insecure deserialization flaw in GitLab EE.

Rapid7 Blog·updated Sep 15, 00:52 UTC · 2d ago·first Sep 14, 10:02 UTC · 3d agoExploit / PoC in the wild 18 sourcesCVE-2026-85706CVE-2026-877192

Cylake Raises $245 Million Ahead of Cybersecurity Platform Beta

Cylake, an AI-native sovereign security startup founded by Palo Alto Networks' Nir Zuk, raised $245 million, taking total funding to $290 million.

Security startup Cylake raised $245 million via a convertible note with participation from Lightspeed Venture Partners, Picture Capital, and Redpoint Ventures, six months after a $45 million Greylock-led seed. Founded by Nir Zuk, Wilson Xu, and Ehud Shamir, the 40-plus-employee company is building an on-premises/private-cloud AI-native security platform for governments and highly regulated enterprises. A beta is expected by the end of 2026 with general availability in 2027.

SecurityWeek·Sep 8, 15:21 UTC · 8d agoIndustry

Exein Secures $270M at $1.7B Valuation for Physical AI Security

IoT security firm Exein raised $270 million at a $1.7 billion valuation to expand runtime protection and physical AI security agents.

Italy-based IoT security startup Exein announced a $270 million oversubscribed round led by Headline, bringing total funding above $600 million and valuing the company at $1.7 billion. Exein builds embedded and kernel-level runtime protection for IoT devices and is developing a proprietary foundation model for physical AI security powering autonomous defense agents. The funding will accelerate expansion, particularly into the US market.

SecurityWeek·Sep 15, 15:45 UTC · 1d agoIndustry

Top 10 Best Serverless Security Solutions in 2026

Buyer's guide ranks Palo Alto Prisma Cloud and Aqua top for serverless security; standalone serverless security has largely folded into CNAPP platforms.

A top-ten listicle evaluates serverless security tools across FaaS platforms like AWS Lambda, Azure Functions, and Google Cloud Functions. Prisma Cloud and Aqua lead platform coverage, Snyk owns code/dependency scanning, and Sysdig covers runtime behavior. The guide's main conclusion is that the standalone serverless security category has largely consolidated into CNAPP platforms.

Cyber Security News·Sep 15, 06:48 UTC · 2d agoIndustry

AIUC Raises $40 Million to Certify Enterprise AI Agents

AIUC raised $40 million in Series A funding led by Ribbit Capital to expand its AIUC-1 standard certifying enterprise AI agents against security risks.

AIUC's Series A, led by Ribbit Capital with participation from First Harmonic, brings the company's total funding to $55 million. Its AIUC-1 standard tests AI agents against roughly 5,000 adversarial scenarios covering jailbreaks, prompt injections, hallucinations, anomalous behavior, and data leaks, with quarterly audits. Certified agents include Cursor, ElevenLabs, Fin, Harvey, KPMG, Lovable, and UiPath; the funds will extend audits, standards, and insurance to frontier models.

SecurityWeek·updated Sep 16, 18:07 UTC · 17h ago·first Sep 16, 13:38 UTC · 22h agoAI industry 2 sources

Sandworm-Linked Cyclops Blink Returns With Network Scanning and Packet-Sniffing Capabilities

Sophos uncovers a 64-bit Cyclops Blink variant on hacked Cisco FMC appliances, adding internal network scanning and selective packet capture; linked to Sandworm.

Sophos CTU analyzed a new 64-bit x86-64 Cyclops Blink implant (timezone_check) deployed on Cisco Secure Firewall Management Center appliances compromised via CVE-2026-20079 authentication bypass and CVE-2026-20316 low-privileged login. The activity is assessed with high confidence as Russian-nexus, with a moderate-confidence link to Sandworm (IRON VIKING, also tracked as Seashell Blizzard). The implant runs a parent controller plus five worker modules, masquerades as [kworker/0:1], persists via SysV init scripts at /lib/tz/timezone_check, and beacons to hard-coded C2 89.34.96.56 over a custom TLS protocol on ports 43856 and 49172. New module 0x11 scans internal IPv4 networks for SSH, SMB, LDAP, VMware, HTTP/HTTPS and VPN services, while module 0x12 performs filtered packet capture that can expose cleartext credentials, cookies and tokens.

GBHackers·Sep 14, 09:27 UTC · 3d agoMalware in the wild 7 sourcesCVE-2026-20079CVE-2026-20316

From Infostealer Log to Marketplace Listing: A Technical Walkthrough of the Credential Theft Pipeline

Cyble walkthrough maps how infostealer logs move from endpoint infection through aggregation and enrichment to dark web credential marketplace sales.

Cyble breaks the credential theft pipeline into stages: infostealer execution harvesting browser credential stores, cookies, session tokens, crypto wallets, and FTP configurations; aggregation of stealer logs via C2 panels into bundled archives; parsing and enrichment against previously leaked datasets; and final listing on dark web marketplaces. Enrichment adds employer and role context that raises prices and enables credential stuffing across reused passwords. The report advises SOC teams to monitor stealer logs and marketplace chatter early rather than waiting for breach alerts.

Cyble·Sep 10, 10:45 UTC · 7d agoMalware1

Prisma Cloud Archives

Unit 42 archive page for Prisma Cloud product-category articles; contains no new research or announcements.

This Unit 42 archive page lists product-category posts about Prisma Cloud, Palo Alto Networks' cloud security platform for public clouds, SaaS applications and remote users. It contains no new research, incidents, or product announcements.

Palo Alto Unit 42·Aug 19, 12:04 UTC · 28d agoIndustry

cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access

Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.

cPanel issued an urgent advisory for a critical privilege escalation in LiteSpeed Web Server Enterprise versions before 6.3.7, allowing a low-privilege shared-hosting account to gain root-level server control and bypass tenant isolation controls including CloudLinux CageFS. Root access would let attackers access other hosted sites, steal databases and credentials, deploy phishing pages, and install backdoors. Administrators are urged to upgrade to 6.3.7 immediately via lsup.sh and to review privileged account activity, cron jobs, SSH keys, and system binaries; no CVE identifier was published.

Cyber Security News·Sep 15, 13:52 UTC · 1d agoVulnerability

'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink

Russia-linked Sandworm chains Cisco vulnerabilities to deploy an upgraded Cyclops Blink botnet variant the FBI disrupted in 2022.

Dark Reading reports that Sandworm, the notorious Russia-linked threat group, is chaining Cisco vulnerabilities to deploy an upgraded version of the Cyclops Blink botnet malware. The FBI previously disrupted the Cyclops Blink botnet in 2022. The activity signals renewed botnet infrastructure building by the group despite prior law-enforcement action.

Dark Reading·Sep 14, 21:37 UTC · 2d agoThreat actor in the wild

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

ReliaQuest details a bespoke JSP web shell that Clop deploys on hacked PTC Windchill and FlexPLM servers after exploiting CVE-2026-12569.

ReliaQuest analyzed a custom Java web shell planted on vulnerable PTC Windchill and FlexPLM servers following exploitation of CVE-2026-12569 (CVSS 9.3). The implant decrypts Windchill keystore credentials including the LDAP manager password, enumerates the file vault for engineering data, and loads attacker-supplied Java classes in memory for post-exploitation. Commands let operators read and delete files, exfiltrate results, and deliver follow-on payloads such as ransomware. Ransom-ISAC, eCrime.ch and Defused previously attributed the campaign to the Clop data-theft extortion group.

The Hacker News·Aug 19, 15:27 UTC · 28d agoThreat actor in the wildCVE-2026-12569

Cyclops Blink Evolves Into x86-64 Linux Implant With Packet Sniffing and Internal Network Scanning

Sophos uncovers a new x86-64 Cyclops Blink Linux implant with packet sniffing and internal network scanning on compromised Cisco FMC appliances.

Sophos identified a 64-bit Linux Cyclops Blink implant in August on compromised Cisco Firewall Management Center devices, persisting via SysV init scripts and masquerading as the process 'kworker01'. The modular malware runs five child processes for reconnaissance, file transfer, scanning, packet capture, and persistence, and beacons hourly over outbound TLS to hardcoded C2 89.34.96.56 on ports 43856 and 49172. The family was previously tied to Russian-linked Sandworm activity on WatchGuard appliances, though Sophos treats 2026 attribution cautiously. The packet-capture module applies configurable filters to retain credentials, cookies, and authentication tokens from raw Ethernet traffic.

Cyber Security News·Sep 14, 13:33 UTC · 2d agoMalware in the wild

Top 10 Best Cloud Infrastructure Entitlement Management (CIEM) Tools in 2026

2026 CIEM guide ranks Wiz, Prisma Cloud, Okta, Entra Permissions Management and specialists Sonrai, Britive, Tenable/Ermetic for cloud entitlement right-sizing.

Buyer's guide covers ten CIEM products across three market routes: CNAPP-bundled (Wiz, Prisma Cloud), identity-suite (Okta, CyberArk, SailPoint, Saviynt) and specialists (Sonrai, Britive, Tenable/Ermetic). It cites machine identities outnumbering humans 10:1 plus effective-permissions sprawl as core drivers, with JIT elevation as the fix. Notable consolidation includes Tenable acquiring Ermetic and Zscaler acquiring Canonic.

Cyber Security News·Sep 15, 06:30 UTC · 2d agoTools

Water sector example added to the NCSC’s Secure connectivity principles

NCSC UK adds a water sector example to its Secure Connectivity Principles, the first ICS community-authored content on its site.

The UK NCSC has added a water sector example to its Secure Connectivity Principles guidance. It is the first content authored by the Industrial Control System Community of Interest to appear on ncsc.gov.uk. The guidance helps ICS operators apply secure connectivity practices.

NCSC UK·Aug 11, 12:00 UTC · Aug 11, 2026Advisory

CVE-2026-82428: Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

Apache Storm stores shared dependency jars under predictable Maven-derived blob keys, allowing one tenant to substitute jars other tenants execute.

CVE-2026-82428 affects Apache Storm Client (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0, rated important. Dependency artifacts uploaded with storm jar --artifacts were stored under blob keys derived only from the Maven coordinate, making keys identical and predictable for every cluster user. When a blob already existed, the uploader suppressed the collision, enabling a tenant to substitute dependency jars later executed by other tenants in cross-tenant attacks. Fixed in version 3.1.0.

oss-security·Sep 13, 14:23 UTC · 3d agoVulnerabilityCVE-2026-824281

Top 10 Best Cloud Workload Protection (CWPP) Solutions in 2026

Editorial scorecard ranks 2026 cloud workload protection platforms, placing Prisma Cloud first, Sysdig second, and CrowdStrike third on detection quality.

A research-based scorecard rates ten cloud workload protection (CWPP) platforms across runtime depth, container/Kubernetes support, coverage breadth, cloud context, and value. Palo Alto Prisma Cloud leads at 8.9, followed by Sysdig at 8.8 and CrowdStrike at 8.6, with Aqua Security tying CrowdStrike at 8.6. The piece argues agent-versus-agentless is a false choice, with leaders now pairing agentless visibility with eBPF-based runtime sensors. Scores are editorial assessments, not lab benchmarks.

Cyber Security News·Sep 11, 07:15 UTC · 6d agoIndustry1

FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications

Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.

Palo Alto Unit 42 analyzed new FrostyGoop/BUSTLEBERM samples, the ninth known ICS-centric malware, first used against a Ukrainian municipal energy company by sending Modbus TCP commands to ENCO control devices. The attack caused a two-day heating outage affecting over 600 apartment buildings during sub-zero temperatures. The Go-compiled malware accepts Modbus register operations and timing parameters via command-line arguments or a JSON configuration file, uses an obscure open-source Modbus library, and checks the Windows BeingDebugged flag to evade debuggers. Unit 42 telemetry recorded over 1 million Modbus TCP devices exposed to the internet between September and October 2024.

Palo Alto Unit 42·Aug 19, 12:04 UTC · 28d agoMalware in the wild

Shared Hosting at Risk: LiteSpeed Enterprise Bug Can Grant Root from a Single Tenant

Critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets a low-privilege shared-hosting tenant escape CageFS isolation and gain root; forced update urged.

cPanel warned that a critical privilege-escalation vulnerability in LiteSpeed Web Server Enterprise (fixed in 6.3.7) lets a malicious low-privilege website user bypass account isolation controls including CloudLinux CageFS and gain root on shared-hosting servers, enabling cross-tenant compromise. No CVE, severity rating, or technical details have been published, and it is unclear whether the flaw is being exploited. This is the third root-level LiteSpeed escape on cPanel servers since May, following CVE-2026-48172 and CVE-2026-54420, which were actively exploited and added to CISA's KEV catalog.

Security Affairs·Sep 15, 12:19 UTC · 1d agoVulnerability 2 sourcesCVE-2026-48172CVE-2026-544201

U.S. CISA adds Langflow, Apache Tomcat, and N-able N-central flaws to its Known Exploited Vulnerabilities catalog

Security Affairs·Aug 5, 15:25 UTC · Aug 5, 2026Exploit / PoC in the wildCVE-2026-9198CVE-2026-18556CVE-2026-34486

CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence

Apache Syncope's Neo4j persistence layer permits Cypher injection via certain FIQL search expressions, affecting versions through 3.0.16, 4.0.7, and 4.1.2.

CVE-2026-86460 is a moderate-severity Cypher injection in Apache Syncope's syncope-core-persistence-neo4j module, triggered when processing some FIQL search strings. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No exploitation is reported; upgrade to fixed releases is advised.

oss-security·Sep 14, 15:56 UTC · 2d agoVulnerabilityCVE-2026-864601

CISA Flags Langflow RCE, Tomcat, and N

The Hacker News·Aug 8, 05:44 UTC · Aug 8, 2026Vulnerability in the wildCVE-2026-9198CVE-2026-34486CVE-2026-18556+6 CVEs

12 Best CNAPP Platforms Compared (2026): Features & Pricing

Independent comparison of 12 CNAPP platforms finds identical estates draw quotes 2-3x apart; Microsoft Defender for Cloud is the only fully published per-resource option.

A vendor-independent buyer's guide compares twelve CNAPP platforms including Prisma Cloud, CrowdStrike Falcon Cloud Security, Wiz, Uptycs, Aqua, Zscaler, and Microsoft Defender for Cloud on pricing mechanics, procurement leverage, and capability-per-dollar. It finds quotes swing 2-3x on identical estates because vendors define 'workload' differently. Microsoft Defender for Cloud is highlighted as the only major with fully published per-resource rates.

GBHackers·Sep 15, 06:49 UTC · 2d agoIndustry1

Critical MapLibre GL JS Vulnerability Enables Zero-Click XSS Attacks

MapLibre GL JS 6.4.1 patches CVE-2026-85061, a critical zero-click XSS in DOM.sanitize() affecting versions 6.4.0 and earlier.

A critical cross-site scripting vulnerability, CVE-2026-85061 (GHSA-jrc7-96c5-q579), affects maplibre-gl versions 6.4.0 and earlier and is fixed in 6.4.1. The flaw stems from DOM.sanitize() iterating a live NamedNodeMap while deleting attributes, causing the sanitizer to skip adjacent dangerous event-handler attributes that later execute via innerHTML. GitHub rates the issue Critical with CVSS v3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, exploitable without user interaction when untrusted attribution strings are rendered. Organizations should upgrade to 6.4.1 or later, rebuild affected bundles, and sanitize attribution fields as an interim measure.

GBHackers·Sep 9, 11:34 UTC · 8d agoVulnerabilityCVE-2026-850611

Parallels Desktop Vulnerability Lets Non-Admin Mac Users Execute Code as Root

JFrog researchers disclosed CVE-2026-90894, a critical Parallels Desktop local privilege escalation letting non-admin Mac users execute code as root; fixed in 27.0.0.

JFrog researchers found that Parallels Desktop's privileged prl_disp_service daemon on macOS accepts unsigned local clients through a world-writable socket and allows argument injection into a tar command during appliance installation. Injecting the --use-compress-program option makes tar execute an attacker-controlled program as root, and a one-line proof of concept yielded a root shell without needing a running virtual machine. The flaw, dubbed ParaShells, was confirmed in Parallels Desktop 26.4.0 build 57513 on Apple Silicon and is fixed in version 27.0.0. No exploitation in the wild has been reported; administrators should inventory and upgrade affected installations and restrict local account access.

Cyber Security News·updated Sep 16, 13:14 UTC · 22h ago·first Sep 16, 09:24 UTC · 1d agoVulnerability 4 sourcesCVE-2026-90894

Electric and gas utility CenterPoint Energy warns of data breach after dark web post

CenterPoint Energy confirmed hackers stole customer personal data from an external-facing system after a dark web post claimed 7.5 million records.

Texas utility CenterPoint Energy filed an SEC 8-K disclosing that a dark web post claimed to sell data stolen from the company, and an investigation confirmed personal information was taken from an external-facing system. The criminal post claims about 7.5 million records including customer names, account information, last four Social Security digits and billing data. Electric and gas service was not impacted; the company serves 7 million customers across Indiana, Minnesota, Ohio and Texas, and previously disclosed a 2023 breach via a file-sharing platform.

The Record·Sep 15, 14:22 UTC · 1d agoData breach

Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects

GitLab urgently patched CVE-2026-19478 (CVSS 9.4), a critical unauthenticated GraphQL flaw allowing modification or deletion of public projects on self-managed instances.

GitLab released an out-of-band critical patch on August 17, 2026 fixing CVE-2026-19478 (CVSS 9.4), a flaw that under certain conditions lets unauthenticated attackers remotely modify or delete public projects and user data via a GraphQL directive in Community and Enterprise Editions. Fixes are available in GitLab 19.2.4, 19.1.6, 19.0.8, and 18.11.11; GitLab.com and GitLab Dedicated are already patched, so only self-managed installations need to act. The release also fixes CVE-2026-19650 (CVSS 7.1), a cross-site request forgery flaw in GraphQL multiplex query handling requiring user interaction. No exploitation or public exploit code has been observed as of August 18, 2026.

The Hacker News·Aug 17, 21:03 UTC · Aug 17, 2026VulnerabilityCVE-2026-19478CVE-2026-196501

MapLibre Vulnerability Exposes 2.7M Users to Zero-Click Attacks

Critical XSS CVE-2026-85061 in MapLibre GL JS enables zero-click attacks on an estimated 2.7 million users; fixed in maplibre-gl 6.4.1.

A flaw in MapLibre GL JS's DOM.sanitize() iterates a live NamedNodeMap while removing attributes, skipping malicious attributes placed adjacent to removed ones, letting event handlers like onload and ontoggle survive and execute via innerHTML in the attribution control. Tracked as CVE-2026-85061 and GHSA-jrc7-96c5-q579, the flaw affects maplibre-gl versions 6.4.0 and earlier, is rated critical under CVSS v3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), and requires no user interaction, privileges, or authentication. Exploitation could enable session theft, unauthorized actions, phishing redirects, or map content manipulation; the patch in 6.4.1 snapshots attributes with Array.from before iterating.

Cyber Security News·Sep 9, 14:05 UTC · 7d agoVulnerabilityCVE-2026-85061

Top 10 Best Container Security Tools in 2026

2026 roundup ranks Aqua, Sysdig, Prisma Cloud, Wiz, Snyk and CrowdStrike among the ten best container security tools across build-ship-run.

Buyer's guide compares ten container security products by lifecycle fit: Aqua leads full lifecycle, Sysdig leads runtime detection via Falco and eBPF, Wiz offers agentless graph visibility, Snyk covers developer-first shift-left. It notes Trivy and Falco as free production-grade open-source foundations. The guide argues standalone container security is increasingly absorbed into CNAPP platforms from Palo Alto, Wiz and CrowdStrike.

Cyber Security News·Sep 15, 06:36 UTC · 2d agoTools1

CISA confirms hackers targeted over 100 US water systems during July

CISA says hackers targeted over 100 US water systems in July amid suspected Iran-backed attacks on critical water infrastructure.

CISA confirmed that hackers targeted more than 100 US water systems during July. The federal agency's warning comes amid a wave of suspected Iran-backed cyberattacks against critical water infrastructure across the United States. The available text does not specify intrusion methods, compromised utilities by name, or data impact.

TechCrunch · Security·Aug 26, 14:31 UTC · 21d agoThreat actor in the wild

CenterPoint Energy confirms customer data stolen in cyberattack

CenterPoint Energy confirms attackers stole customer personal data, with a threat actor leaking 7.49 million records scraped from an unprotected API.

CenterPoint Energy, a utility serving about 7 million metered customers across Indiana, Minnesota, Ohio, and Texas, confirmed in an SEC filing that an unauthorized third party obtained customer personal information via an external-facing system. A threat actor using the alias "4d722e4d656f77" leaked 7.49 million records containing names, phone numbers, service and billing addresses, account numbers, billing amounts, and partial Social Security numbers. The actor claims the data was exfiltrated by iterating through millions of IDs on CenterPoint's public API, which lacked rate limiting and WAF protections. Electric and gas services were not impacted, but multiple federal class-action lawsuits have already been filed.

BleepingComputer·updated Sep 16, 15:32 UTC · 20h ago·first Sep 15, 16:40 UTC · 1d agoData breach 5 sources