Search: “Zero Day Clock”

11 stories in the last 30d

Contrast Security report finds 42 confirmed exploit attempts per application monthly and three AI scanners agreeing on only 5% of findings.

Contrast Security's AppSec Overflow 2026 report, drawing on telemetry from hundreds of thousands of production applications and APIs, found adversaries touch the average application every four minutes with 42 confirmed viable exploit attempts per application monthly, led by untrusted deserialization, path traversal, and method tampering. Legacy flaws Log4Shell and Spring4Shell remain widespread, mean time to exploit fell from over two years in 2018 to under three weeks for most 2025 exploited vulnerabilities, and average critical fix time is 92 days. Three AI scanners set on the same codebase agreed on only 5% of findings, and triaging a 2-million-line codebase scan cost roughly $128,000 versus $315 in API charges. Among exploited CVEs in the dataset, 82% of KEV-listed entries carried EPSS scores of 90% or higher, while CVE-2006-1547 and CVE-2023-38180 were confirmed exploited despite EPSS scores under 25%.

Help Net SecurityAug 31, 00:00 UTC · 17d agoResearch in the wildCVE-2006-1547 CVE-2023-381801

AI lets small actors run state-level hacking campaigns, Anthropic report finds

Anthropic's threat report finds AI let a Russian-aligned espionage campaign, a Chinese student-run exploit foundry and ShinyHunters operators run state-grade operations.

Anthropic's report covering December 2025 to August 2026 details a Russian-aligned espionage campaign by actor 'JackPoterz' — matching Midnight Blizzard behaviors — against more than 20 government and defense organizations across Ukraine and Europe, with AI agents autonomously rebuilding Windows implants to evade detections. Chinese undergraduates ran an automated vulnerability-research foundry using Claude agent swarms, yielding more than a dozen potential zero-days in one month. ShinyHunters-affiliated operators used AI to dump over 2,100 Azure access tokens across 40 corporate tenants in 34 hours. Seven Chinese labs including Alibaba, DeepSeek, Moonshot AI, Xiaomi and Zhipu distilled Claude outputs; Alibaba peaked at nearly 3 million exchanges per day from more than 3,500 fraudulent accounts to train its Qwen systems.

CyberScoopupdated Sep 16, 13:01 UTC · 14h agofirst Sep 10, 19:45 UTC · 6d agoThreat actor in the wild 18 sources2· 1 read

How Developers Prevent Production Risk at the Source

Wiz argues shift-left code-stage security cuts remediation costs and ships Wiz Code, WizOS, and WizCLI to catch flaws pre-deployment.

A Wiz blog post argues that fixing vulnerabilities at the code stage costs a fraction of production remediation, citing the node:20-slim base image which ships 14 known CVEs, three of them critical. It claims AI agents can now analyze open-source commits and generate working exploits in minutes, shrinking the window between a public fix and automated attacks. The post promotes WizOS near-zero-CVE base images, WizCLI and MCP-server checks inside developer and AI agent sessions, and Wiz Code scanning across pull requests, repositories, and pipelines covering SAST, SCA, secrets, and IaC misconfigurations.

Wiz BlogSep 3, 00:31 UTC · 14d agoIndustry1

Why federal cyber defense demands an offense-driven mindset

Opinion piece argues federal agencies should prioritize exploitability and autonomous penetration testing over static CVSS-based patching, citing CISA's BOD 26-04 and NSA's CAPT program.

The author argues that static CVSS-driven patching leaves federal agencies exposed because vulnerable does not equal exploitable, and adversaries chain misconfigurations and stolen credentials instead of burning zero-days. The piece cites CISA's BOD 26-04 and the NSA's Continuous Autonomous Penetration Testing (CAPT) program, which logged 28,282 completed pentests across 822 Defense Industrial Base organizations and closed 71% of critical findings within 30 days. It recommends defining risk by exploitability and mission impact and augmenting human pentesting with autonomous validation and verification.

CyberScoopSep 8, 18:30 UTC · 8d agoIndustry

The 12 Best Managed Firewall Services, Compared and Priced

GBHackers compares 12 managed firewall service providers, naming Fortinet best value and Secureworks best detection while flagging recent ownership changes.

The buyer's guide evaluates 12 managed firewall/MSSP providers across cost tiers, contract terms, and service models. Fortinet is rated best value, Secureworks best detection, NTT Data best global reach, and Cato Networks best for organizations wanting to stop owning firewalls. The article highlights that Secureworks was acquired by Sophos for roughly $859 million in February 2025, the Trustwave-Cybereason merger was terminated in March 2025, LevelBlue is the rebranded AT&T Cybersecurity business, and Comcast Business absorbed Masergy.

GBHackersSep 8, 10:20 UTC · 8d agoIndustry 2 sources

Training a 3.8B LLM to 0.384 CORE for $998 – Hugo Vergnes

Independent developer Hugo Vergnes trained a 3.8B-parameter Llama-style model to 0.384 CORE on 65B tokens for $998 in 43 hours on rented B200s.

Hugo Vergnes trained little-lm, a 3.848B-parameter decoder-only LLM, on 65.3B tokens in 43 hours for $998 using rented NVIDIA B200s, scoring 0.384 on the CORE benchmark and beating nanochat d32 (0.310) at similar cost. The Llama-style architecture uses RMSNorm, RoPE, GQA with 24 query and 8 KV heads, relu-squared MLPs, QK-norm, and ResFormer-style value embeddings that account for 19% of parameters. Key wins included the Muon optimizer for matrix parameters, a trapezoidal learning-rate schedule with linear cooldown, FP8 training plus vocabulary padding for roughly 33% throughput gains, and the ClimMix dataset over FineWeb-Edu. The project, inspired by Karpathy's nanochat, was built as a config-driven YAML framework for small LLM training.

Hacker News · securitySep 10, 02:04 UTC · 7d agoAI research HN 28↑ · 2 comments1

The 12 Best Endpoint Detection & Response (EDR) Solutions, Compared and Priced

An editorial scorecard ranks 12 EDR platforms, with CrowdStrike and SentinelOne tied at 8.6/10 and telemetry retention identified as the hidden cost driver.

An editorial comparison scores twelve EDR platforms on detection, response, analyst burden, pricing transparency, and coverage. CrowdStrike and SentinelOne tie at 8.6/10, with Microsoft Defender for Endpoint close behind at 8.5 and described as effectively free in Microsoft 365 E5 estates. The guide argues that telemetry retention, not per-endpoint price, drives real cost, with fully-priced quotes frequently diverging 2-3x from headline rates. Managed detection offerings, including Cynet's bundled 24/7 SOC, factor into the buyer-fit rankings.

GBHackersSep 9, 07:46 UTC · 7d agoIndustry 2 sources

What Zero-Day Response Should Be in the Post-Mythos Era

Picus Security outlines a zero-day response playbook where defenders simulate exploit technique chains before public PoCs exist.

The article uses PaperCut NG/MF's August incident — exploitation in the wild before any patch, with the first emergency fix bypassed the same day and a third landing September 1 — as the template for AI-accelerated vulnerability response. It walks through a hypothetical CVE-2026-1001 (explicitly made up) to argue defenders should map CVEs to ATT&CK technique chains and simulate them against NGFW, WAF, EDR, endpoint hardening, and SIEM controls within minutes of disclosure. It notes disclosure-to-exploitation time has fallen from 21.5 days to hours.

BleepingComputerSep 15, 13:45 UTC · 1d agoResearch in the wildCVE-2026-1001

I've factored the RSA keys of a Certificate Authority from the 90s

Security researcher factored two 512-bit RSA root CA keys from defunct 1990s certificate authority E-Certify using CADO-NFS on a desktop in roughly 30 hours each.

A researcher extracted legacy root certificates from archived Netscape and Internet Explorer installers, identifying two 512-bit RSA roots shipped with Netscape 4.51 in 1999 by the defunct Canadian CA E-Certify. Using CADO-NFS on a Ryzen 9 5950X desktop, the keys were factored in 32 and 29 hours respectively, allowing private key reconstruction. The work comes shortly after RSA-260 (862-bit) was factored, the largest known factorization to date. The researcher also built a legacy TLS server and published keys and tools on GitHub.

Hacker News · securitySep 8, 01:16 UTC · 9d agoResearch HN 411↑ · 86 comments

Getting ahead of ‘harvest-now-decrypt-later’: Post-quantum cryptography planning

Opinion piece urges organizations to begin post-quantum cryptography migration now, citing harvest-now-decrypt-later risk and NIST deadlines.

CSO Online outlines why harvest-now-decrypt-later makes long-lived sensitive data a current risk even before quantum computers exist. It cites NIST IR 8547 timelines deprecating RSA-2048 and ECC P-256 by 2030 and removing them by 2035, finalized FIPS standards ML-KEM, ML-DSA, and SLH-DSA, upcoming FN-DSA (FIPS 206), NSA requirements for national security systems from 2027, and UK NCSC phased guidance through 2035. The author recommends cryptographic discovery, crypto-agility, and prioritizing long-confidentiality data and TLS endpoints.

CSO OnlineSep 10, 09:00 UTC · 6d agoResearch

[AINews] Poolside gets $12B reverse-execuhire to NVIDIA; founders stay for $1B, employees go for $6B, Infraco scaling to 7GW neocloud

NVIDIA struck a $12B deal with AI coding startup Poolside, licensing its Model Factory and hiring 109 of its technical employees.

NVIDIA spent roughly $12B in an unusual reverse-execuhire of Poolside, licensing the company's Model Factory while hiring 109 of its ~115 technical staff; founders retain a $1B stake and employees receive about $6B. Poolside had raced to raise $2B to fund a 40,000 GB300 cluster after missing a six-week funding window, and founders argue frontier-scale training now requires an order of magnitude more compute plus contracted data center space. An infrastructure arm spun out in January 2026 is scaling toward 7GW as a neocloud. The newsletter also recaps OpenAI and Anthropic agent-platform releases.

Latent SpaceAug 21, 05:45 UTC · 26d agoAI industry