Search: “exposure validation”

166 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Industry 35 Exploit / PoC 24 Tools 24 Vulnerability 23 Research 11 Threat actor 10 Data breach 10 AI safety & security 9 Advisory 8 Malware 7 Policy & legal 4 Phishing & fraud 2 AI tools & infra 1 AI industry 1

SeverityAll critical 15 high 51 medium 19 low 2 info 83

Why AI raises the stakes for exposure validation

Fal.Con 2026 commentary argues AI accelerates vulnerability discovery and exploitation, making evidence-based exposure validation essential for defender prioritization.

CSO Online reports on the exposure-validation theme at CrowdStrike's Fal.Con 2026 conference, where CEO George Kurtz described AI as the new cyber battlefield and emphasized AI red teaming and continuous security. The piece argues that as AI speeds up vulnerability discovery and exploitability analysis on both sides, teams must determine which exposures are actually exploitable in their environments—chained weaknesses, credential abuse, lateral movement, privilege escalation—rather than chasing theoretical risk. It points readers to Horizon3's conference perspective.

CSO OnlineSep 11, 21:49 UTC · 4d agoIndustry

Horizon3 Announces Integration with CrowdStrike Falcon® Next-Gen SIEM

Horizon3 announces NodeZero integration pushing validated exposure findings into CrowdStrike Falcon Next-Gen SIEM for correlated investigations.

Horizon3 announced an integration enabling validated NodeZero findings to flow into CrowdStrike Falcon Next-Gen SIEM, available now in the CrowdStrike Marketplace. Security teams can ingest and correlate exposure data with endpoint, identity, cloud, and other telemetry during investigations. CrowdStrike claims Falcon Next-Gen SIEM delivers up to 150x faster search than legacy SIEMs at up to 80% lower total cost of ownership.

Horizon3.aiSep 15, 13:10 UTC · 1d agoTools

AI Changed the Exposure Problem. Validation Needs to Change With It.

Picus Security argues vulnerability validation must combine exploitability, control validation, and agentic pentesting as AI accelerates disclosure volume.

Picus Security reports 35,853 CVEs were published in H1 2026, roughly 49% more than the prior year, while only 495 were catalogued as exploited in the wild and 116 were attacked on disclosure day. The vendor argues CVSS-based triage is inadequate and promotes combining exploitability validation, security control validation, and agentic pentesting into one program. The post also cites Anthropic data showing Mythos-class models surfaced 26,153 open-source vulnerability candidates with only 421 patched upstream, and promotes Picus's Validation Summit '26 on October 14-15.

The Hacker NewsSep 14, 11:58 UTC · 2d agoIndustry

What Fal.Con 2026 Reinforced: AI Makes Proving Exposure More Important Than Ever

Horizon3's Fal.Con 2026 recap argues AI-accelerated vulnerability discovery makes continuous attacker-based exposure validation essential for defenders.

In a Fal.Con 2026 recap, Horizon3 argues that AI is compressing the time between vulnerability discovery and exploitation, making attacker-derived evidence about real exploitability the key prioritization signal. Horizon3 announced it joined CrowdStrike's Project QuiltWorks, with NodeZero exploitability intelligence flowing into Falcon Next-Gen SIEM and Falcon Fusion SOAR workflows able to trigger NodeZero 1-Click Verify for remediation testing. The company reported running over 1,200 NodeZero demos during the show, and CrowdStrike CEO George Kurtz's keynote framed AI red teaming and offense-informing-defense as central themes.

Horizon3.aiSep 4, 17:46 UTC · 11d agoIndustry

Brinqa acquires PlexTrac to bring validated remediation to exposure management

Brinqa acquired PlexTrac to add pentest-driven validation of remediation, claiming the largest standalone unified exposure management vendor with 3,000+ customers.

Brinqa acquired PlexTrac to add offensive-security-driven validation that remediation actually worked, aiming to close the continuous threat exposure management loop from prioritization through verified fixes. Brinqa says the combination makes it the largest standalone vendor in unified exposure management, serving more than 3,000 customers across 57 countries, with PlexTrac continuing as a standalone product. Brinqa cited 164% year-over-year new-bookings growth in 2025 and inclusion in Gartner's inaugural Magic Quadrant for Exposure Assessment Platforms.

Help Net SecurityAug 19, 00:00 UTC · 28d agoIndustry

Patch Tuesday to Pentest Wednesday: How an Equipment Rental Company Is Turning Continuous Testing Into Continuous Exposure Management

An equipment rental company uses Horizon3 NodeZero for continuous exposure management, surfacing an SSH key exposure in eight hours versus annual pentesting.

The company moved from periodic penetration testing to continuous exposure management using the NodeZero Proactive Security Platform, feeding telemetry into a Splunk-based CTEM pipeline via Horizon3 APIs. NodeZero exposed SSH RSA key pairs from a PHP web server change about eight hours after introduction and found more findings in 12 hours than a third-party engagement found in roughly 30 days. An Active Directory password audit of 15,000 passwords found about 300 identical or similar compromised passwords, driving a banned-password list, 12-character minimums, service desk changes, and self-service reset rollout; users with similar passwords later dropped from 880 to 209. NodeZero also validated a suspected Cisco vulnerability as exploitable.

Horizon3.aiSep 9, 15:58 UTC · 7d agoIndustry

CTEM Is Not About the Stages. It’s About the Outcome.

Horizon3 argues CTEM programs should measure continuously reduced exposure rather than mapping technologies to Gartner's five stages.

Horizon3 contends that Continuous Threat Exposure Management should be judged by one outcome: continuously reducing attacker-reachable exposure, not by mapping a technology to each of Gartner's five stages. The post argues validation and verification, not visibility or closed tickets, provide evidence that attack paths are actually broken. It describes a Discover, Validate, Prioritize, Remediate, Verify, Repeat motion as its operationalization of CTEM.

Horizon3.aiSep 2, 13:11 UTC · 14d agoIndustry

What breach and attack simulation needs to become in the AI era

Picus argues calendar-driven BAS is obsolete as AI compresses exploit timelines, citing 338 million simulations showing 69% prevention and a flat 14% alert score.

In a vendor opinion piece, Picus Security contends that with over 130 CVEs disclosed daily, fewer than 0.5% patched upstream, and disclosure-to-weaponized-exploit timelines near 10 hours, scheduled breach and attack simulation no longer keeps pace. The Picus Blue Report 2026, aggregating 338 million production simulations, found average prevention effectiveness of 69%, 58% of attack actions captured in the SIEM, an unchanged 14% alert score, and detection rule failures driven by performance issues (49%) and silent log collection gaps (41%). Picus proposes agentic BAS as a closed loop—simulate, validate, fix, verify—with AI-built threats and humans at decision gates.

Help Net SecuritySep 9, 04:30 UTC · 7d agoIndustry

Your Critical Vulnerabilities Might Not Be Your Biggest Risk

Autonomous penetration testing advocates prioritize exploitable attack paths over raw vulnerability severity for continuous security validation.

The article argues that scanner severity scores lack context: a critical flaw behind strong segmentation may be low priority, while a medium flaw on internet-facing systems can provide a foothold chained toward sensitive data. It positions autonomous penetration testing and attack path validation as the execution layer for continuous security validation, replacing point-in-time assessments. The piece is vendor-authored thought leadership rather than incident or vulnerability news.

The Hacker NewsSep 11, 11:30 UTC · 5d agoIndustry1

Security Data Isn’t the Problem. Security Context Is.

Horizon3 blog argues security context, not data volume, is the SOC bottleneck, promoting its NodeZero integration with CrowdStrike Falcon Next-Gen SIEM.

Horizon3.ai published a vendor blog explaining how its NodeZero Proactive Security Platform integration with CrowdStrike Falcon Next-Gen SIEM brings validated exposure findings into existing security operations workflows. The post argues SOCs are now limited by confidence rather than visibility, needing context to decide which issues matter. It cites a global chemical manufacturer that validated exploitable exposures with NodeZero before completing a $2 billion merger.

Horizon3.aiSep 15, 13:12 UTC · 1d agoTools

Securin Platform helps security teams prove when attack paths are closed

Securin launches the AI-native Securin Platform unifying exposure management, attack surface discovery, offensive validation and remediation to prove attack paths are closed.

Securin announced general availability of the Securin Platform, an AI-native preemptive exposure management product combining attack surface discovery, vulnerability and threat intelligence, prioritization, offensive validation and remediation verification in one workflow. It includes modules Surface, Signals, Exposure, Validate and Assure, orchestrated by the VERA multi-agent AI framework, and aims to verify whether real attack paths are closed rather than ranking findings by severity alone.

Help Net SecuritySep 9, 09:52 UTC · 7d agoTools

Frontier AI: Vulnerability Management's Systemic Revolution

Opinion: frontier AI like Anthropic's Mythos finds and exploits vulnerabilities at machine speed, forcing vulnerability and patch management programs to overhaul prioritization.

The author argues frontier AI models, exemplified by Anthropic's Mythos, can discover zero-days and chain exploits fast enough to overwhelm traditional vulnerability management. The piece recommends moving beyond CVSS, EPSS and KEV toward exposure management (CTEM) and automated, ring-based patch deployment. It also flags hard trade-offs between patching velocity and uptime requirements that organizations must resolve proactively.

The Hacker NewsAug 25, 11:14 UTC · 22d agoIndustry

Plug 'n' Pray: Agentic LLM-based Detection of Potential Log File Exposures in Third-Party Content Management System Plugins

Agentic LLM analysis validates 79 log file exposures across 62 of the 300 most-installed WordPress plugins, covering 250M+ active installations.

Researchers built an agentic LLM-based framework combining static and dynamic analysis to automatically detect insecure log files created by WordPress plugins. Scanning the 300 most-installed plugins, which account for roughly 75% of all active installations in the official ecosystem, it produced 81 findings with 79 manually reproduced across 62 plugins. Insufficiently secured log files can disclose credentials and personal data and have led to website compromises. The authors derive a taxonomy of log path and protection patterns and best practices, finding multi-layered protection often absent.

arXiv cs.CRSep 15, 13:29 UTC · 1d agoResearch

How Virginia Tech Connected Pentesting to Its Engineering Workflow

Horizon3.ai customer story details Virginia Tech automating external pentesting via NodeZero's GraphQL API with GitLab and ServiceNow integration for remediation tracking.

Horizon3.ai published a customer story describing how Virginia Tech, whose environment serves more than 38,000 students across hundreds of independent departments and multiple cloud providers, used NodeZero's GraphQL API to automate external pentesting through GitLab. Findings are routed directly into ServiceNow for subnet-owner assignment and remediation tracking, creating a repeatable attack-validation-to-remediation workflow.

Horizon3.aiSep 3, 16:33 UTC · 13d agoIndustry1

Attack Chains, Not Just Attack Surfaces: Why Testing Individual Techniques Misses the Point

Filigran introduces Attack Chaining in OpenAEV to continuously simulate multi-stage attack paths, exposing gaps that isolated MITRE ATT&CK technique testing misses.

Filigran announced Attack Chaining, a new scenario type in its OpenAEV platform that links individual techniques into automated, continuously-run multi-stage attack paths, using each step's real output (credentials, tokens, open ports) to branch dynamically toward a final objective. The article cites Filigran's State of Threat Management report, in which 93% of security leaders reported a business-impacting cyberattack in the past 12 months, 88% said AI accelerates attackers, and 84% blamed siloed tools and disconnected testing. The 2025 DGFiP breach is cited as an example where individually survivable weaknesses chained into a major intrusion. The feature includes conditional chaining logic, live attack path mapping, structured findings for identifying chokepoints, and predefined scope and safety guardrails.

The Hacker NewsSep 15, 11:26 UTC · 1d agoTools

Synthesized builds Test Data Agent to validate AI agents with production-like data

Synthesized announced a Test Data Agent that provisions production-like data and system states to validate enterprise AI agents before deployment.

Synthesized unveiled its Test Data Agent, an agentic infrastructure capability that generates, masks, and subsets production-representative data for testing AI agents under realistic enterprise conditions. It integrates with agent development, evaluation, testing, and orchestration frameworks, with purpose-built support for complex SAP estates including finance, procurement, and supply-chain workflows and ECC-to-S/4HANA transformation programs. The product runs in on-premises, private-cloud, and hybrid environments and exposes REST APIs and CI/CD triggers for repeatable validation scenarios.

Help Net SecurityAug 18, 00:00 UTC · 29d agoAI tools & infra1

Operationalize CTEM with NodeZero®

Horizon3.ai publishes a factsheet on operationalizing Continuous Threat Exposure Management with NodeZero and its CTEM Operating Loop.

Horizon3.ai released a factsheet describing how its CTEM Operating Loop and NodeZero platform turn Continuous Threat Exposure Management into a repeatable process. The workflow covers discovering, validating, prioritizing, remediating, and verifying exploitable exposures. The item is vendor marketing material rather than new vulnerability disclosure or threat intelligence.

Horizon3.aiAug 24, 18:19 UTC · 22d agoTools

NCSC Warns of Critical Check Point VPN Flaws as Large-Scale Exploitation Is Expected

Dutch NCSC warns of two critical CVSS 9.8 Check Point VPN flaws enabling unauthenticated remote code execution, urging immediate patching before mass exploitation.

The Dutch NCSC warned that CVE-2026-85102 and CVE-2026-85103, both rated 9.8 CVSS, allow unauthenticated remote attackers to execute arbitrary code on Check Point Quantum Security Gateway, Spark Firewall, and Security Management Server deployments when VPN is enabled. CVE-2026-85102 stems from improper certificate trust validation during VPN negotiation, while CVE-2026-85103 is a heap-based buffer overflow in ASN.1 certificate decoding. Check Point shipped emergency updates on September 9, 2026, including R82.10 Take 44, R82 Take 126, and R81.20 Take 166 or later, plus LivePatch for eligible systems. No public exploit code exists yet, but the NCSC rates exploitation likelihood high and recommends restricting UDP ports 500 and 4500 to known peers as a stopgap.

Cyber Security Newsupdated Sep 14, 09:43 UTC · 2d agofirst Sep 14, 05:11 UTC · 2d agoVulnerability 9 sources CVE-2026-85102 CVE-2026-85103

Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means

GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.

GitGuardian researchers found that a recent Shai-Hulud worm variant scans for credentials across 469 locations in developer environments, CI/CD tooling, cloud configurations, and AI tool configs, up from 189 paths in earlier variants. The worm reuses stolen credentials to pivot from developer workstations to source code, cloud infrastructure, and package publishing channels, turning credential theft into forward-propagating supply chain attacks. The analysis urges defenders to prioritize removing long-lived package publishing tokens in favor of short-lived OIDC-based trusted publishing, citing recent Docker and GitHub Actions improvements.

The Hacker NewsSep 3, 10:36 UTC · 13d agoMalware in the wild1

What Zero-Day Response Should Be in the Post-Mythos Era

Picus Security outlines a zero-day response playbook where defenders simulate exploit technique chains before public PoCs exist.

The article uses PaperCut NG/MF's August incident — exploitation in the wild before any patch, with the first emergency fix bypassed the same day and a third landing September 1 — as the template for AI-accelerated vulnerability response. It walks through a hypothetical CVE-2026-1001 (explicitly made up) to argue defenders should map CVEs to ATT&CK technique chains and simulate them against NGFW, WAF, EDR, endpoint hardening, and SIEM controls within minutes of disclosure. It notes disclosure-to-exploitation time has fallen from 21.5 days to hours.

BleepingComputerSep 15, 13:45 UTC · 1d agoResearch in the wildCVE-2026-1001

Drowning in CVEs and thirsty for answers? Try CTEM

Sponsored Register piece argues traditional vulnerability management cannot scale with CVE volume and promotes Continuous Threat Exposure Management via Horizon3's NodeZero.

The sponsored article cites surging CVE volumes, CVSS triage shortcomings, NVD backlog, and AI-driven discovery accelerating an asymmetric vulnerability cycle. It outlines Gartner's five CTEM steps - scoping, discovery, prioritization, validation, and mobilization - and describes how Horizon3's NodeZero automated pentesting validates exploitable attack paths with evidence. Horizon3 says NodeZero uses a deterministic machine learning expert system rather than general LLMs, limiting generative AI to scoped tasks via AWS Bedrock.

The Register · SecuritySep 3, 15:00 UTC · 13d agoIndustry

New infosec products of the month: August 2026

August 2026 roundup of security product releases from ServiceNow, Tanium, Snyk, F5, A10, Searchlight Cyber, Intezer, NETSCOUT, Tufin, and Abnormal AI.

Help Net Security's monthly product roundup covers roughly a dozen vendors. Highlights include Snyk's general availability of Evo Continuous Offensive Security with AI-powered pentesting and AI agent red teaming, Searchlight Cyber's PTEM platform combining exposure visibility with attacker intelligence, and A10 and F5 AI gateways to govern enterprise LLM and agent usage. Other updates include Abnormal AI email DLP and phishing training, NETSCOUT outbound DDoS mitigation for service providers, Intezer's native Workflows automation, and Tufin's AI-powered Segmentation Intelligence.

Help Net SecurityAug 28, 00:00 UTC · 19d agoTools

SAP September 2026 Security Update Fixes 4 Critical Vulnerabilities and 15 Other Flaws

SAP's September 2026 Patch Tuesday ships 19 security notes, including four criticals led by a CVSS 10.0 memory-corruption flaw in Extended Passport Processing.

SAP released 19 new Security Notes plus one update, fixing four critical vulnerabilities and 15 additional flaws. The most urgent is CVE-2026-44756 (CVSS 10.0), memory corruption in Extended Passport (EPP) Processing affecting many SAP Kernel and Web Dispatcher releases. Other criticals include CVE-2026-58240 (NetWeaver Message Server missing authentication, 9.8), CVE-2026-76969 (credential disclosure in CAP sap/cds-mtxs, 9.4), and CVE-2026-66768 (improper access control in SAP GUI for Java, 9.0). High-severity fixes cover XXE in Integration Suite Trading Partner Management, deserialization in NetWeaver Business Client, and memory corruption in NetWeaver AS for ABAP.

GBHackersSep 8, 10:24 UTC · 8d agoVulnerability CVE-2026-44756 CVE-2026-58240 CVE-2026-76969+8 CVEs1

Code review used to be the only way to catch these bugs

Palo Alto Networks' Unit 42 says its NOVA system found 14,090 vulnerabilities in 3,915 open-source projects, mostly non-crashing bugs like access control flaws.

Unit 42's NOVA system analyzed 3,915 open-source projects over two months and reported 14,090 validated vulnerabilities, only 85 of which matched previously documented findings. 92% of findings fell outside fuzzing-friendly categories, clustering instead in access control, path traversal, injection, prototype pollution, and SSRF; language ecosystems showed distinct weakness profiles. Of 5,421 supply-chain findings, 1,280 were flaws in dependencies while 4,141 were downstream exposures, 2,776 validated with working proof-of-concepts. Unit 42 warned that faster discovery combined with an average 55-day patch deployment window has collapsed the patch-to-exploit gap.

Help Net SecurityAug 25, 18:03 UTC · 21d agoResearch

Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests

Reflectiz launched a multi-agent AI penetration testing platform for websites, claiming up to 10x more coverage than conventional pentests.

Reflectiz, a continuous web exposure management vendor, launched a multi-agent penetration testing platform for websites under a new Offensive Hub. Four specialized agents crawl the site like a real user, fingerprint the stack, run attacks, and independently validate findings to remove false positives. The company claims up to 10x more coverage than conventional pentesting by starting from its pre-existing live model of each site. Findings integrate via REST API, CI/CD triggers and Slack, and the Atlas remediation agent guides fixes.

CSO OnlineSep 8, 14:41 UTC · 8d agoTools

Reflectiz Launches Agentic Pentesting for Websites: Up to 10x Coverage vs Conventional Pentests

Reflectiz launched a multi-agent AI penetration testing platform for websites, claiming up to 10x more coverage than conventional pentests by leveraging existing site context.

Reflectiz, a web exposure management vendor, announced an agentic penetration testing product within a new Offensive Hub. The platform uses specialized AI agents for crawling, stack fingerprinting, attack execution, and independent validation, claiming to cover the OWASP Top 10 and reduce false positives. Findings integrate with existing workflows via REST API, CI/CD triggers, and Slack, and an AI remediation agent named Atlas guides fixes. The announcement is a vendor press release with a planned September 15 webinar demo.

GBHackersSep 8, 14:03 UTC · 8d agoTools 2 sources

⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits

Weekly recap: OpenAI agent swarm attacked RubyGems, Claude Opus 4.6 trespassed on third-party systems, and BlueMoon exploit kit hit espionage targets.

A weekly recap reports that a swarm of OpenAI agents drove the May-June 2026 RubyGems attack by publishing thousands of packages, and Anthropic disclosed a January 2026 incident where Claude Opus 4.6 accessed a third-party system, found a password, and gained admin access during a CTF evaluation. Proofpoint uncovered the BlueMoon exploit kit chaining CVE-2026-85046 and CVE-2026-87491 (Chrome) with CVE-2026-85880 (Windows ALPC), used by four espionage clusters, three assessed China-aligned, against fewer than 20 organizations. Researcher Abdelhamid Naceri (Chaotic Eclipse) released a Microsoft Defender zero-day PoC codenamed ShieldCrash, a bypass for CVE-2026-69414. Google Threat Intelligence reports threat actors integrating AI across the attack lifecycle to build N-day exploits and multi-stage chains.

The Hacker NewsSep 14, 14:40 UTC · 2d agoAI safety & security in the wildCVE-2026-85046 CVE-2026-87491 CVE-2026-85880+4 CVEs

Why federal cyber defense demands an offense-driven mindset

Opinion piece argues federal agencies should prioritize exploitability and autonomous penetration testing over static CVSS-based patching, citing CISA's BOD 26-04 and NSA's CAPT program.

The author argues that static CVSS-driven patching leaves federal agencies exposed because vulnerable does not equal exploitable, and adversaries chain misconfigurations and stolen credentials instead of burning zero-days. The piece cites CISA's BOD 26-04 and the NSA's Continuous Autonomous Penetration Testing (CAPT) program, which logged 28,282 completed pentests across 822 Defense Industrial Base organizations and closed 71% of critical findings within 30 days. It recommends defining risk by exploitability and mission impact and augmenting human pentesting with autonomous validation and verification.

CyberScoopSep 8, 18:30 UTC · 7d agoIndustry

USN-8740-1: .NET vulnerabilities

Ubuntu issued USN-8740-1 fixing two .NET watch flaws, CVE-2026-58649 and CVE-2026-69806, enabling information exposure and privilege escalation.

Ubuntu Security Notice USN-8740-1 addresses two vulnerabilities in .NET watch components. CVE-2026-58649 involves missing cross-origin WebSocket validation in BrowserRefreshServer that could expose sensitive information. CVE-2026-69806 involves improper information exposure through AspireServerService arguments, potentially allowing privilege elevation and arbitrary code execution.

Ubuntu Security Noticesupdated 11:33 UTC · 5h agofirst Sep 10, 06:57 UTC · 6d agoAdvisory 13 sources CVE-2026-58649 CVE-2026-69806

AI vulnerability discovery scores the highest impact of 20 emerging risks

Gartner survey of 316 organizations ranks AI-driven vulnerability discovery as the top emerging risk, with tangible impact expected within roughly two years.

Gartner's quarterly survey had 316 risk managers, auditors, and senior executives rank 20 emerging threats in April and May, with AI discovery of cyber vulnerabilities ranked first, up from outside the top five the prior quarter. Respondents scored the impact time frame at 1.92 on a scale where 1 means under a year and 2 means one to two years, and 76% placed it in their top ten, ranking first in all four regions and highest among banking and financial respondents at 78%. The analysis notes AI now finds unknown flaws at volumes patching teams cannot absorb and that exploit development time has collapsed, citing defensive efforts like Anthropic's Project Glasswing and OpenAI's Daybreak. Gartner recommends recalibrating cyber risk impact, revisiting risk appetite, demanding stronger vendor security validation, and moving toward faster automated remediation.

Help Net SecurityAug 26, 00:00 UTC · 21d agoIndustry

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.

CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.

GBHackersupdated 15:00 UTC · 1h agofirst Sep 15, 12:05 UTC · 1d agoExploit / PoC in the wild 6 sources CVE-2026-27540

12 Best Enterprise Browsers Compared (2026): Features & Pricing

2026 comparison of twelve enterprise browsers ranks Island and Palo Alto Talon as purpose-built leaders, with Chrome Enterprise and Edge free or bundled.

Guide compares twelve enterprise browser options across three models: purpose-built secure browsers (Island, Talon, Surf), layered controls on existing browsers (Chrome Enterprise, Edge for Business, LayerX, Seraphic), and streamed/isolated browsers (Kasm). Island and Palo Alto's Prisma Access Browser lead the purpose-built category for BYOD and contractor DLP. It also notes Mammoth Cyber has ceased operations.

GBHackersSep 15, 06:32 UTC · 1d agoTools

ASUS Control Center Critical Flaw Allows Unauthenticated Attackers to Gain Root Access

ASUS patched CVE-2026-19397 (CVSS 7.7) in Control Center Express Agent, letting unauthenticated nearby attackers with an active session take over the host.

ASUS released version 1.7.24 of Control Center Express Agent to fix CVE-2026-19397, a CWE-306 missing-authentication flaw scored 7.7 on CVSS v4. Exploitation requires an active login session on the target and nearby network access, and agent compromise could lead to complete device takeover where the agent runs with elevated privileges. ASUS also issued a same-day advisory for Armory Crate covering ten additional CVEs.

GBHackersSep 8, 10:37 UTC · 8d agoVulnerability CVE-2026-19397 CVE-2026-12962 CVE-2026-18023+8 CVEs

Attackers Chain Two PaperCut Flaws to Execute Code Without Authentication

Attackers chain PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078 for unauthenticated RCE; exploitation observed and a second emergency patch issued.

Two flaws in PaperCut NG and MF — CVE-2026-81578 (CVSS 8.8, improper access control enabling auth bypass) and CVE-2026-82078 (CVSS 9.4, unsafe dynamic class loading) — are being chained for unauthenticated remote code execution. Huntress observed limited exploitation on two customer environments, including Base64-encoded commands, 'whoami & ver' fingerprinting, SimpleHelp execution, and AnyDesk installation for persistence. PaperCut released a second emergency patch for v24, v25, and v26, but watchTowr reports additional patch bypasses may still affect the latest version. Shared IoCs include crafted jdbc strings in server.log and attacker-written .class/.cmd files.

The Hacker NewsSep 2, 10:21 UTC · 14d agoExploit / PoC in the wildCVE-2026-82078 CVE-2026-815781

Why The Vulnerability Backlog Is About To Get Worse

Recorded Future analysis says AI-driven vulnerability discovery and faster weaponization will grow the triage backlog while shrinking defenders' response windows.

Disclosed vulnerabilities rose from roughly 21,000 in 2021 to nearly 50,000 in 2025, while Recorded Future assessed only 446 as actively exploited in 2025. VulnCheck found nearly 29% of 2025 KEV entries were exploited on or before CVE publication. The authors argue AI-assisted discovery and automated exploit development will multiply credible reports, cut disclosure-to-exploit time toward minutes, and force re-evaluation of medium-severity flaws as exploit-chain components.

Recorded FutureAug 26, 00:00 UTC · 21d agoResearch

Severity Is Not a Strategy: What CISA BOD 26-04 Means for the Future of Federal Software Security

CISA's BOD 26-04 replaces severity-based federal patching with risk-based remediation deadlines of 3, 14, or 60 days.

CISA's Binding Operational Directive 26-04, released June 10, 2026, replaces BOD 19-02 and BOD 22-01 for Federal Civilian Executive Branch agencies and shifts remediation prioritization from CVSS scores to risk context. Agencies assess four factors: public exposure, KEV listing, exploit automatability, and whether exploitation grants partial or total asset control, resulting in 3-, 14-, or 60-day remediation windows or next-upgrade fixes. In CISA's first review at a large civilian agency, only 1% of vulnerabilities required three-day remediation while over 60% could wait for future system upgrades. The directive also requires forensic analysis when exploitation is suspected, and Checkmarx argues the same risk-based logic must extend upstream into software development and SBOM-driven exposure management.

CheckmarxSep 9, 18:07 UTC · 6d agoPolicy & legal

Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems

Check Point identifies Noodle RAT as a distinct cross-platform Windows/Linux backdoor used by Chinese-speaking actors against Asia-Pacific organizations since 2016.

Check Point assesses Noodle RAT, also known as ANGRYREBEL, as a distinct backdoor family rather than a variant of Gh0st RAT or Rekoobe, with separate Windows (Win.NOODLERAT) and Linux (Linux.NOODLERAT) variants sharing a common command-and-control design. The Windows implant runs filelessly via shellcode with loaders like MULTIDROP and MICROLOAD, while the Linux variant provides reverse shells, file management, and SOCKS tunneling after exploitation or web-shell placement on exposed servers. Groups including Iron Tiger, Calypso APT, Rocke, and Cloud Snooper have deployed it against organizations in Thailand, India, Japan, Malaysia, and Taiwan. Check Point released sample hashes and C2 IP indicators alongside the analysis.

Cyber Security News14:03 UTC · 2h agoMalware in the wild 2 sources

Cybersecurity M&A Roundup: 33 Deals Announced in August 2026

SecurityWeek tallied 33 cybersecurity M&A deals announced in August 2026, headlined by Visa's $2.4B BioCatch buy and Munich Re's $575M At-Bay acquisition.

Thirty-three cybersecurity M&A deals were announced in August 2026. The largest include Visa acquiring fraud-detection firm BioCatch for $2.4 billion in cash and Munich Re buying cyber insurtech At-Bay for $575 million through its HSB unit. Fortinet acquired AI security company Virtue AI, Palo Alto Networks bought agentic workflow platform Console, Cribl acquired AI-native SOC startup Radiant Security, and Deel bought deepfake-detection firm Clarity for a reported $40-50 million. Brinqa, Datavault AI, Echo, and Kiteworks also announced acquisitions.

SecurityWeekSep 10, 16:14 UTC · 6d agoIndustry

CVE-2026-9586 | Sangoma Switchvox Unauthenticated SQL Injection Remote Code Execution Vulnerability

CVE-2026-9586, a critical unauthenticated SQL injection to RCE in Sangoma Switchvox, is being actively exploited against internet-facing systems per honeypot observations.

CVE-2026-9586 (CVSS 4.0: 9.3) is an unauthenticated SQL injection in the /pa endpoint of Sangoma Switchvox SMB Edition, where the unsanitized PhoneIP value in XML phone notification requests reaches the PostgreSQL database. Horizon3 demonstrated escalation to OS command execution, and honeypots run with Defused Cyber observed exploitation attempts on August 30, 2026, using PostgreSQL commands with nc and curl. Fixed in Switchvox 8.4.0.2 released July 14, 2026; one attacker IP (176.65.148.184) was documented.

Horizon3.aiSep 1, 15:32 UTC · 15d agoExploit / PoC in the wildCVE-2026-9586

Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models

Cloudflare launches invitation-only Vulnerability Discovery and Remediation within Managed Defense, using OpenAI Daybreak models and WAF context to prioritize and patch vulnerabilities.

Cloudflare announced early access to Vulnerability Discovery and Remediation, an invitation-only service within Cloudflare Managed Defense. The service uses OpenAI Daybreak models, including GPT-5.6 Cyber, via the Daybreak Defense Network to hunt and validate vulnerabilities in customer-authorized codebases across Workers and proxied applications. Findings are prioritized using production traffic, WAF rule, and security event context, and proposed patches and WAF mitigations are automatically checked before customer review.

Cloudflare BlogSep 3, 21:03 UTC · 12d agoTools