ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Organization B”

25 stories in the last 7d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAdvisory 12Industry 4Malware 2AI safety & security 1Data breach 1Exploit / PoC 1Research 1Vulnerability 1AI policy 1AI research 1
SeverityAllcritical 1high 8medium 9low 0info 7

Siemens Mendix SAML

Siemens Mendix SAML module fails signature validation, allowing unauthenticated account hijacking in specific SSO configurations (CVE-2026-80465).

CISA republished Siemens advisory SSA-887643 for CVE-2026-80465 (CVSS 8.7) in the Mendix SAML module, affecting Mendix 10/11-compatible versions before 4.2.3 and Mendix 9.24-compatible versions before 3.6.27. The module improperly validates SAML response signatures (CWE-347), letting unauthenticated remote attackers hijack an account in specific SSO configurations. Mendix has released fixed versions and recommends updating.

CISA Advisories · 1d agoAdvisoryCVE-2026-80465

Siemens Teamcenter

Reflected XSS in Siemens Teamcenter /auth/ redirect flow lets unauthenticated attackers inject JavaScript into authenticated sessions (CVE-2026-58113).

CISA republished Siemens advisory SSA-157465 for CVE-2026-58113, a reflected cross-site scripting flaw (CVSS 6.1) in the /auth/ authentication redirect flow of Siemens Teamcenter V2412, V2506, V2512, and V2606. An unauthenticated attacker can craft a URL that injects arbitrary JavaScript into an authenticated user's browser, enabling data theft or actions within the victim's Teamcenter session. Fixed versions are available for all affected releases; Enzo Alvarez of Bishop Fox reported the vulnerability.

CISA Advisories · 1d agoAdvisoryCVE-2026-58113

Siemens Reyrolle 7SR5

CISA advisory covers 14 vulnerabilities, CVSS 9.8, in Siemens Reyrolle 7SR5 energy-sector protection relays before V2.70.

CISA advisory ICSA-26-258-05 covers 14 vulnerabilities in Siemens Reyrolle 7SR5 protection relays before V2.70, used in the energy sector worldwide, with aggregate CVSS v3 of 9.8. Flaws include Cesanta Mongoose web server issues (CVE-2024-42384 through CVE-2024-42392) and new bugs such as web-interface session-ID exposure enabling authentication bypass (CVE-2026-62645, CVSS 9.8), predictable session tokens (CVE-2026-62646, CVE-2026-62647), and pre-auth out-of-bounds writes (CVE-2026-62648). Siemens has released V2.70 and recommends updating to the latest version.

CISA Advisories · 1d agoAdvisoryCVE-2024-42384CVE-2024-42385CVE-2024-42386+11 CVEs

Schneider Electric SCADAPack x70 Products

CISA advisory: Schneider Electric SCADAPack x70 RTUs contain CVE-2026-81861, an insufficiently protected credentials flaw allowing unauthorized access to RTU configuration.

CISA advisory ICSA-26-258-04 discloses CVE-2026-81861 affecting all versions of Schneider Electric SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 remote terminal units. The CWE-522 insufficiently protected credentials vulnerability could expose authentication information and permit unauthorized access to RTU configuration through the Secure Lock functionality. The flaw carries a CVSS v3.1 base score of 6.5 (medium), and the products are deployed worldwide in critical manufacturing and energy sectors. Abhinav Agarwal reported the vulnerability to CISA.

CISA Advisories · 1d agoAdvisoryCVE-2026-81861

mySCADA myPRO Manager

CISA advisory reveals unauthenticated privileged API access and arbitrary SMS sending in mySCADA myPRO Manager <=2.1, CVSS 9.8.

CISA advisory ICSA-26-258-03 discloses two vulnerabilities in mySCADA myPRO Manager <=2.1 with aggregate CVSS v3 of 9.8. CVE-2026-73807 (CVSS 9.8) lets unauthenticated network attackers access privileged management functions via the command API, while CVE-2026-82567 exposes an unauthenticated HTTP endpoint that sends arbitrary SMS messages through a connected GSM modem. Deployments span critical manufacturing, energy, food and agriculture, transportation, and water and wastewater sectors. CISA states no known public exploitation has been reported at this time.

CISA Advisories · 1d agoAdvisoryCVE-2026-73807CVE-2026-82567

Digital Watchdog VMAX DVR and NVR Product Lineups

CISA advisory details six flaws, aggregate CVSS 9.6, giving attackers full control of Digital Watchdog VMAX DVR/NVR surveillance devices.

CISA advisory ICSA-26-258-01 discloses six vulnerabilities affecting all versions of Digital Watchdog VMAX A1 G4 DVRs, VMAX IP G4 NVRs, VMAX A1 PLUS, VA1G4, and VG4 recorders, with aggregate CVSS v3 of 9.6. Flaws include an authentication bypass leaking plaintext admin credentials (CVE-2026-68953), hard-coded credentials enabling root FTP access (CVE-2026-66890, CVE-2026-68950), root command execution (CVE-2026-68070), missing authorization on state-changing CGIs (CVE-2026-66887), and predictable session tokens (CVE-2026-66372). Successful exploitation grants full administrative control, live and recorded surveillance access, and a network pivot point. Products are deployed worldwide across commercial facilities, government, healthcare, and transportation sectors.

CISA Advisories · 1d agoAdvisoryCVE-2026-68953CVE-2026-66890CVE-2026-68070+3 CVEs

CareCam CM2507

CISA advisory: seven flaws in CareCam CM2507 IP cameras enable unauthenticated live video access, privileged ONVIF control, credential recovery, and code execution.

CISA advisory ICSA-26-258-08 discloses seven vulnerabilities in CareCam HMT.CM2507 IP cameras running firmware v251211.1507. Issues include missing authentication for network video streaming (CVE-2026-88259, CVSS 3.1 7.5), an empty password on a privileged ONVIF account (CVE-2026-84398), weak legacy hashing of the root password (CVE-2026-85497, CVSS 4.0 9.3 critical), and cleartext storage of Wi-Fi credentials (CVE-2026-81321). Physical-access flaws allow arbitrary code execution from scripts on removable media (CVE-2026-81305) and unauthenticated bootloader access (CVE-2026-85478). The cameras are deployed worldwide in commercial facilities.

CISA Advisories · 1d agoAdvisoryCVE-2026-88259CVE-2026-84398CVE-2026-84400+4 CVEs

Wärtsilä FOS-Onboard

CISA advisory: two hardcoded cryptographic key flaws in Wärtsilä FOS-Onboard 5.07.0923.01 (CVSS 9.0/9.1) could allow unauthorized updates, code execution, and credential theft.

CISA advisory ICSA-26-258-02 discloses CVE-2026-78225 (CVSS 3.1 9.0 critical), a hardcoded cryptographic server key in the deployer-ng Update Controller of Wärtsilä FOS-Onboard 5.07.0923.01. CVE-2026-81855 (CVSS 3.1 9.1 critical) is a hardcoded client authentication key in the robot testing framework component. Successful exploitation could let an attacker deliver unauthorized updates, execute code, or extract credentials to impersonate a privileged client. The product is deployed worldwide in transportation systems critical infrastructure; Cydome Security reported the flaws and CISA states no known public exploitation exists.

CISA Advisories · 1d agoAdvisoryCVE-2026-78225CVE-2026-81855

NextGen Healthcare Mirth Connect

CISA warns NextGen Healthcare Mirth Connect <=4.7.1 has SQL injection and XXE flaws enabling credential theft, file writes, and DoS.

CISA released advisory ICSMA-26-253-01 covering three vulnerabilities in NextGen Healthcare Mirth Connect versions 4.7.1 and earlier: SQL injection CVE-2026-82583 (CVSS 8.3), XXE CVE-2026-78224 (CVSS 8.2), and XXE CVE-2026-82578 (CVSS 7.5). Exploitation could expose stored credentials for connected systems, enable arbitrary file writes, and cause denial-of-service conditions. No public exploitation has been reported; the product is deployed worldwide in the Healthcare and Public Health sector.

CISA Advisoriesupdated · 5d agofirst · 6d agoAdvisory 2 sourcesCVE-2026-82583CVE-2026-78224CVE-2026-82578

Orthanc DICOM Server

CISA advisory flags CVE-2026-87020, an integer overflow in Orthanc DICOM Server <1.13.0 causing heap out-of-bounds write and denial of service when decoding crafted PNG/JPEG images.

CISA published ICSMA-26-253-02 for Orthanc DICOM Server versions below 1.13.0, used in healthcare environments worldwide. CVE-2026-87020 (CWE-190) is an integer overflow in pitch and buffer-size computation causing a heap out-of-bounds write when decoding attacker-supplied PNG or JPEG images. An authenticated remote attacker can crash the Orthanc process and cause denial of service; CVSS v3.1 is 8.1 HIGH. CISA states no known public exploitation targeting this flaw has been reported.

CISA Advisories · 6d agoAdvisoryCVE-2026-87020

AVEVA Pipeline Integrity Monitor

CISA advisory details four flaws in AVEVA Pipeline Integrity Monitor <=2025_SP1_P1, allowing information disclosure, weak-hash admin elevation, and cross-site scripting.

CISA published ICSA-26-253-01 covering AVEVA Pipeline Integrity Monitor versions <=2025_SP1_P1_build_7.1.9580.8513. CVE-2026-81821 (hard-coded cryptographic key, CWE-321) lets a user with read access decrypt PIMBoards project files, and CVE-2026-81822 (CWE-327) allows brute-forcing weak password hashes to elevate to PIMBoards administrator; both score 8.4 HIGH (CVSS v3.1). CVE-2026-81823 (CWE-862) permits unauthenticated read operations, and CVE-2026-81824 (CWE-79) enables arbitrary JavaScript execution via socially engineered links. CISA reports no known public exploitation and recommends limiting network exposure of control system devices.

CISA Advisories · 6d agoAdvisoryCVE-2026-81821CVE-2026-81822CVE-2026-81823+1 CVEs

ST Engineering iDirect iQ-Series Terminals (Update A)

CISA advisory details four flaws in ST Engineering iDirect iQ-Series VSAT terminals <=4.5.2.1, enabling device data theft, CSRF-driven reboots, and local privilege escalation.

CISA's Update A to ICSA-26-183-01 covers ST Engineering iDirect iQ-Series, 3315-Series and 9-Series terminals at firmware <=4.5.2.1, deployed across communications, defense, energy and transportation. CVE-2026-38059 exposes unauthenticated /api/identity and /api/ endpoints leaking serial number, DID, TPK, MAC address and firmware version, potentially enabling terminal impersonation; CVE-2026-38057 is a CSRF flaw letting an attacker force terminal reboots and satellite link loss via /api/reboot. CVE-2026-38056 enables local privilege escalation using the factory-configured technician account (CVSS 3.1 8.8, CVSS 4.0 9.4), and CVE-2026-38058 exposes crackable MD5-crypt root password hashes. All four flaws were reported to CISA by Ahmed Alqahtani of Aramco.

CISA Advisories · 6d agoAdvisoryCVE-2026-38059CVE-2026-38057CVE-2026-38056+1 CVEs

The EPA Is Planning to Scrap Public Review Rules for Data Center Pollution

The EPA plans to eliminate mandatory public review of air-pollution permits for AI data centers and their power plants, reducing community input.

The EPA proposes scrapping a federal requirement that states notify the public and accept comments before approving air-pollution permits for industrial facilities, including AI data centers and their power plants. A related proposal would let developers begin construction before permits are approved. Nearly 200 advocacy groups and more than a dozen states oppose the changes; critics cite health risks, rising utility bills, housing displacement, and disproportionate impacts on Black communities in the rural South, while the EPA argues the changes speed permitting. The proposal is expected to be finalized within the next year.

Hacker News · security · 5d agoAI policyHN 33↑ · 6 comments1

Due to concerns about malicious applications, GPT2 will not be released (2019)

OpenAI's landmark 2019 GPT-2 post withheld the full 1.5B-parameter model over misuse concerns, releasing only a smaller variant and paper.

OpenAI announced GPT-2, a 1.5-billion-parameter transformer language model trained on 8 million web pages (40GB of text), achieving state-of-the-art zero-shot results including 70.70% on Winograd Schema and 63.24% on LAMBADA. Citing concerns about malicious applications such as scalable synthetic disinformation, OpenAI declined to release the trained model and instead published a smaller model and a technical paper as a 'responsible disclosure' experiment. The post, resurfaced on Hacker News in 2026, also documents failure modes like repetition and world-modeling errors, and discusses policy implications of controllable text generation.

Hacker News · AI · 3d agoAI safety & securityHN 44↑ · 19 comments

First Agentic AI Data Breach Reported to Spanish Regulator

Spain's AEPD reported the first data breach executed by an AI agent, which autonomously chained login, vulnerability discovery, and personal data modification.

Spain's Data Protection Agency (AEPD) published details of the first breach notification in which an AI agent executed the attack, achieving a successful login, searching for vulnerabilities, and modifying personal data and accessing invoices. The agency called the agent's autonomous chaining of attack phases a qualitative change and urged updated risk analysis, faster incident response, and stronger credential protection. Investigation is ongoing; commentators cite possible causes including a guardrail jailbreak, an escaped test model, or an unauthorized LLM-based penetration test.

SecurityWeek · 12h agoData breach in the wild 2 sources1· 1 read

Palo Alto PAN-OS Vulnerability Enables Arbitrary Code Execution as Root User

Palo Alto Networks patched CVE-2026-0310, an unauthenticated XML-processing buffer overflow in PAN-OS allowing root code execution on PA-Series firewalls.

Palo Alto Networks disclosed CVE-2026-0310, an out-of-bounds write (CWE-787) in PAN-OS XML processing with a CVSS-B base score of 9.2 and CVSS-BT of 7.2. An unauthenticated attacker with network access to a vulnerable management or dataplane interface can send crafted XML to execute arbitrary code as root on PA-Series appliances. On VM-Series the impact is limited to denial-of-service, while Prisma Access and Cloud NGFW require authentication and carry lower risk. Fixed releases include 12.2.3, 12.1.10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10; no workaround exists beyond restricting management interface access.

Cyber Security Newsupdated · 6d agofirst · 6d agoVulnerability 3 sourcesCVE-2026-0310

Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories

Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.

Microsoft's September 2026 Patch Tuesday fixed 973 vulnerabilities, including two zero-days under active exploitation: CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack), both elevation-of-privilege bugs. SOCRadar reported active exploitation of CVE-2025-25249 (CVSS 9.8) in FortiOS CAPWAP, deploying a Node.js RAT called PivotC2 that exfiltrates Exchange mailboxes to Wasabi cloud storage; 178 devices were compromised out of 30,000 scanned IPs, attributed to a Russian-speaking financially motivated group. Palo Alto disclosed CVE-2026-0310, a 9.2-rated buffer overflow enabling root code execution on PA-Series firewalls, and Fortinet disclosed CVE-2026-84393, a ZTNA certificate validation MITM flaw. Cyera also revealed CVE-2026-6471 ('PostGREShell'), a 12-year-old PostgreSQL logical-decoding flaw allowing code execution via REPLICATION-privileged accounts.

Cyber Security News · 3d agoExploit / PoC in the wildCVE-2026-85880CVE-2026-81963CVE-2025-25249+3 CVEs3

Virtual Event Today: Attack Surface Management Summit

SecurityWeek's 2026 Attack Surface Management Summit runs today as a virtual event covering asset discovery, SBOMs, red teaming, and pen-testing.

SecurityWeek is hosting its fully virtual 2026 Attack Surface Management Summit from 11AM-3PM, focused on continuous asset discovery, prioritization, and risk reduction. Sessions cover proving exploitability, SBOM and AIBOM software supply chain risk with Dr. Allan Friedman, demos from Wiz and Horizon3's NodeZero, and the roles of red teaming, bug bounty, and penetration testing in enterprise defense.

SecurityWeek · 14h agoIndustry

KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension

Elastic tracks KREMLIN banking malware that used fake Brazilian bank JavaScript lures to deploy malicious Chrome and Edge extensions on 1,515 systems.

Elastic researchers tracked the KREMLIN banking malware operation across seven campaigns over 15 months, infecting 1,515 systems, 98.75% of them in Brazil. Portuguese-language lures posing as bank records and invoices deploy a hostile 'AVSync' extension into Chrome and Edge profiles that harvests passwords, session cookies, keystrokes and screenshots. Loaders check for sandboxes, create scheduled tasks and fetch fresh infrastructure from an Ethereum smart contract; a network canary takeover temporarily disrupted infections.

Cyber Security Newsupdated · 10h agofirst · 21h agoMalware in the wild 3 sources

Cybersecurity M&A Roundup: 33 Deals Announced in August 2026

SecurityWeek tallied 33 cybersecurity M&A deals announced in August 2026, headlined by Visa's $2.4B BioCatch buy and Munich Re's $575M At-Bay acquisition.

Thirty-three cybersecurity M&A deals were announced in August 2026. The largest include Visa acquiring fraud-detection firm BioCatch for $2.4 billion in cash and Munich Re buying cyber insurtech At-Bay for $575 million through its HSB unit. Fortinet acquired AI security company Virtue AI, Palo Alto Networks bought agentic workflow platform Console, Cribl acquired AI-native SOC startup Radiant Security, and Deel bought deepfake-detection firm Clarity for a reported $40-50 million. Brinqa, Datavault AI, Echo, and Kiteworks also announced acquisitions.

SecurityWeek · 6d agoIndustry

In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review

SecurityWeek weekly roundup covers exploited WordPress Super Forms flaw CVE-2026-14894, a $10M bounty on an Iranian cyber official, InjectEave attacks, and more.

SecurityWeek's weekly roundup aggregates short items across the threat landscape, including Microsoft's report of invisible Unicode tag characters used in financial phishing lures at up to 2.37 million messages per day, and active exploitation of critical WordPress Super Forms plugin flaw CVE-2026-14894 to deploy PHP webshells. Policy items include a $10 million US bounty for IRGC-CEC Cyber Operations Command lead Amir Yaryab, a 16-month prison sentence for ex-AT&T employee Kenneth Carter over SIM swaps with nearly $600,000 in intended losses, and the US arraignment of Russian Sergei Anatolyevich Filimonov over credential harvesting. Technical items include InjectEave electromagnetic side-channel attacks tested on 11 devices, an FBI warning on OAuth consent phishing, and VulnCheck's finding that only 202 of 26,153 Anthropic Project Glasswing findings were fixed.

SecurityWeek · 5d agoIndustry in the wildCVE-2026-148942

SloppyRAT: A New Tool For Ransomware Attacks

Zscaler details SloppyRAT, a new DLL backdoor delivered via ClickFix lures that stages CastleLoader and CastleRAT ahead of ransomware attacks.

Zscaler ThreatLabz analyzed SloppyRAT, a DLL-based backdoor distributed via ClickFix lures that abuses finger.exe over TCP port 79 to download a batch script. The malware copies curl.exe to download IronPython 3.4.2 from GitHub and executes zlib-compressed Base64-encoded Python to deploy CastleLoader and CastleRAT, then reflectively loads SloppyRAT in memory. It hinders analysis using XOR stack-string obfuscation, a modified affine cipher with modulus 127, and 13 runtime-decrypted code blocks, while communicating with C2 over a reverse SOCKS channel.

Zscaler ThreatLabzupdated · 5d agofirst · 6d agoMalware in the wild 3 sources

Kiteworks Acquires Bonfy.AI to Fill the AI Gap in Data Governance

Kiteworks acquired AI data-security firm Bonfy.AI, reportedly for tens of millions of dollars, to add inline AI-era data governance.

Kiteworks announced the acquisition of Bonfy.AI, an AI-native content-security platform that classifies sensitive data in real time as it moves across email, file sharing, SaaS apps, and AI agents. The deal, estimated by CTech at tens of millions of dollars, will extend Kiteworks' Data Control Plane with inline runtime policy enforcement for both human and AI-agent workflows. This is Kiteworks' eighth acquisition in five years; Bonfy was founded in early 2024, raised a $9.5 million seed round, and emerged from stealth in June 2025.

SecurityWeek · 5d agoIndustry 2 sources

The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

Unit 42 demonstrates that root access on a Kubernetes node lets attackers spoof SPIFFE/SPIRE attestation and harvest co-located workloads' SVIDs.

Palo Alto Networks Unit 42 describes post-exploitation techniques in which an attacker with root on a compromised Kubernetes node spoofs Linux cgroup metadata used by the SPIRE agent during workload attestation, tricking it into issuing a co-located workload's SPIFFE Verifiable Identity Document to an attacker-controlled process. The research shows the core trust assumption of machine-identity systems—that the node is trusted—collapses once root is obtained, exposing all cryptographic identities scoped to that node. Unit 42 released an open-source tool, Spooffe, for defenders to test identity exposure, and notes the technique has not been observed exploited in the wild.

Palo Alto Unit 42 · 6d agoResearch1

Unsolved Problem by Fields Medalist Breached by Two High School Students

Two high school students used Claude Opus 5 and GPT-5.6 Sol to help solve an open Lorentzian polynomials problem, posting a 75-page arXiv proof.

Aayush Bathija and Prince Rohatgi of Oak Park High School, mentored by UCLA postdoc Daniel Soskin, published the 75-page paper 'Bounded Ratios for Lorentzian Polynomials' (arXiv 2609.05341), solving an open problem in Fields Medalist June Huh's Lorentzian polynomial theory. The main structural theorem extends bounded coefficient-ratio characterization from quadratic to arbitrary-degree polynomials via discrete convexity conditions. The students used Claude Opus 5 and GPT-5.6 Sol for exploration and proof ideas but independently verified all arguments; the result follows an open letter from 25 Fields Medalists voicing concerns about AI's impact on mathematical rigor.

Hacker News · security · 2d agoAI researchHN 22↑ · 19 comments