ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “protocol”

300 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllResearch 40Vulnerability 33Malware 33AI research 30AI safety & security 30Threat actor 28Exploit / PoC 28Advisory 19Data breach 10Industry 10Ransomware 10Tools 10Policy & legal 8AI tools & infra 8
SeverityAllcritical 16high 85medium 75low 4info 135

When AI Agents Go Rogue: Agent Session Smuggling Attack in A2A Systems

Unit 42 unveils agent session smuggling, where a rogue AI agent hides covert instructions in established Agent2Agent (A2A) protocol sessions to manipulate victim agents.

Palo Alto Networks Unit 42 discovered agent session smuggling, a new attack technique in which a malicious AI agent exploits an established cross-agent session under the Agent2Agent (A2A) protocol to send covert instructions hidden among benign client requests and server responses. The technique leverages the implicit trust agents place in collaborating agents and the stateful, multi-turn nature of A2A sessions; the researchers stress it affects any stateful protocol, not an A2A flaw. Unlike one-shot data-based attacks, a rogue agent can converse, adapt and build false trust over multiple interactions. Proposed mitigations include human-in-the-loop enforcement, cryptographically signed AgentCards for remote agent verification, and context-grounding to detect injected instructions.

Palo Alto Unit 42 · 29d agoAI safety & security2

Agent Harness vs Agent Framework vs MCP: Which Layer Owns the Loop, State, Tools, Permissions, and Recovery

Architecture explainer separates agent harnesses, frameworks, and MCP by which layer owns the loop, state, permissions, and recovery.

The article distinguishes agent harnesses (OpenAI Codex, Claude Agent SDK), which own the execution loop, sandbox, permission model, and recovery; frameworks (LangGraph, OpenAI Agents SDK, Microsoft Agent Framework), which supply composable primitives; and MCP, a stateless JSON-RPC wire protocol governed by the Linux Foundation's Agentic AI Foundation since December 2025. An ownership matrix maps the execution loop, state, tool transport, permissions, recovery, sandboxing, and multi-agent orchestration to each layer. The 2026-07-28 MCP specification made the protocol fully stateless, retiring the initialize handshake and session headers.

MarkTechPost · 1d agoAI research1

Closing the Loop: Bidirectional Fully Encrypted Protocols

Researchers show naively composing unidirectional fully encrypted protocols is detectable and construct provably secure bidirectional FEPs, validated in Rust.

The paper introduces formal security definitions for bidirectional fully encrypted protocols (BiFEPs), covering exact shaping, delivery, protocol-state integrity, private half-close, and cross-direction isolation. It shows trivially composing two unidirectional FEPs enables detection attacks via cross-direction dependencies like traffic imbalance and connection tear-down. The authors construct provably secure BiFEPs for datastream and datagram settings, validated with a Rust implementation; no surveyed deployed protocol provides the full set of properties.

arXiv cs.CR · 18h agoResearch

CrossLink: Breaking Location Privacy by Linking Device Identifiers Across Protocols

Researchers present CrossLink, a passive tracing algorithm linking temporary device identifiers across LTE, WiFi, and BLE, reconstructing full traces for 83% of simulated users.

Smartphones emit temporary identifiers simultaneously over LTE, WiFi, and BLE, and per-protocol randomization defenses implicitly assume their protections compose across protocols. CrossLink is an uncertainty-aware tracing algorithm that stitches device identifiers across time, space, and protocols even when the adversary is fully passive and rotations are unsynchronized. In large-scale mobility simulation it reconstructs full traces for 83% of users versus 22% for the best single-protocol baseline. It remains effective under partial sniffer coverage, including strategically placed sniffers near LTE handover regions, mobile sniffers, and limited high-coverage subregions.

arXiv cs.CR · 7d agoResearch

CVE-2026-67593: Apache Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion

CVE-2026-67593: remote attackers can delete ActiveMQ Artemis queues via pre-authentication Openwire protocol handling in affected versions.

A remote attacker can exploit pre-authentication handling of the Openwire protocol to result in queue deletion on affected Apache Artemis and ActiveMQ Artemis brokers. Affected components include artemis-openwire-protocol and artemis-jakarta-openwire-protocol in Apache Artemis 2.50.0 through 2.56.0, and artemis-openwire-protocol 1.0.0 through 2.44.0 plus artemis-jakarta-openwire-protocol 2.32.0 through 2.44.0 in ActiveMQ Artemis. Apache rates the issue important.

oss-security · 6d agoVulnerability 7 sourcesCVE-2026-675931

xHunt Campaign: New PowerShell Backdoor Blocked Through DNS Tunnel Detection

xHunt's new CASHY200 PowerShell backdoor used DNS tunneling for C2; DNS security blocked beaconing at a Kuwait organization in September 2019.

Unit 42 describes CASHY200, a new PowerShell-based backdoor tied to the xHunt campaign that communicates with its C2 server windows64x[.]com via DNS tunneling, parsing commands from DNS answers. In September 2019, a Kuwait-based organization's DNS security service blocked the beaconing minutes after detection, cutting off adversary access. Samples dating to May and June 2018 and open source collection suggest the tool was used against Kuwait government organizations from spring 2018 through 2019, with malicious Word documents observed installing CASHY200 payloads configured with C2 domains such as firewallsupports[.]com and winx64-microsoft[.]com. The tool's name derives from identifiers stored under the registry key HKCU\Software\Microsoft\Cashe and the command value 200.

Palo Alto Unit 42 · 29d agoThreat actor

OptiPrime: Optimizing Private Inference through Protocol-Hardware Co-design

OptiPrime co-designs HE-MPC protocols with hardware acceleration to remove network communication bottlenecks in private DNN inference, beating Cheetah by up to 5.7x.

OptiPrime is a protocol-hardware co-optimization framework for private deep neural network inference based on hybrid homomorphic encryption (HE) and multi-party computation (MPC). It introduces a novel HE protocol for convolutions that reduces the number of transmitted output ciphertexts, addressing the network bottleneck that limits gains from commercial HE accelerators. A lightweight compression system reduces weight plaintext memory traffic by 10x, while a specialized dataflow maximizes on-chip reuse of intermediate ciphertexts. Experiments show up to 5.7x speedup over the Cheetah baseline on CPUs and 4.2x with an accelerator.

arXiv cs.CR · 1d agoResearch

IntentFuzz: A Protocol-Aware Fuzzer for Automated Invariant Violation Detection in Intent-Based Cross-Chain Bridges

IntentFuzz protocol-aware fuzzer recovers bridge structure from unannotated Solidity and confirmed 22 invariant violations across 24 real-world deployments.

IntentFuzz formalizes a taxonomy separating invariant violations from settlement exposures in intent-based cross-chain bridges, then recovers a bridge's intent structure and deposit/fill function roles from unannotated Solidity source. It classified deposit and fill functions with 100% recall and 82% combined precision, and achieved 100% recall and precision on 23 planted-bug mutants. Across 24 real-world deployments it confirmed 17 genuine invariant violations with heuristic-only input generation, rising to 22 with its LLM-assisted tier, spanning eight vulnerable GitHub repositories with findings reproducible against public deployed bytecode.

arXiv cs.CR · 4d agoResearch1

From Specs to Apps: Verifying and Monitoring Models of Signal and WhatsApp

Researchers use the SpecMon runtime monitor to verify WhatsApp Web and Signal Desktop against formal Signal protocol models, finding undocumented libsignal fork differences.

The paper applies SpecMon, a runtime monitoring tool, to check whether executions of WhatsApp Web and Signal Desktop conform to formal models of the Signal protocol. The authors instrument both applications and build Tamarin-compatible multiset-rewrite models, including the first model of WhatsApp Web's implementation and the most detailed model to date of Signal's original protocol. They verify authentication and secrecy properties for core Signal protocol components, show monitoring detects deliberately injected faults with low overhead, and identify previously undocumented behavioral differences between the original libsignal library and WhatsApp's fork.

arXiv cs.CR · 5d agoResearch

IBIB: A Protocol for Measuring Enterprise AI Systems by Serving Route, Not Model Identifier

IB2 protocol scores enterprise AI systems by serving route with reliability-inclusive scoring; serving-arm choice moved one score from 77.38 to 82.54.

The protocol has three parts: a gold-blind capability-binding preflight verifying a route can execute the evaluation contract, a reliability-inclusive first-pass scoring rule, and structurally score-blind adjudication. Its reference instantiation uses 128 locked tasks and 987 assertions over document, spreadsheet, chart, tool, and database work, released as procedure and schemas rather than an exposed corpus. Across eleven systems, two complete runs on identical weights later failed distinct binding-gate predicates, four of seven suites saturate within a six-system band driven by governed database work and multi-tab joins, and excluding failed responses from denominators changes the point ordering. Serving-arm choice shifted one declared revision and precision from 77.38 to 82.54, though arms differed in access mode, harness generation, and the tool-call parser.

arXiv cs.AI / cs.LG / cs.CL · 6d agoAI research1

Scores Alone Do Not Prove Discovery: The Discovery Certification Protocol for Auditing AI Research Agents

Researchers introduce the Discovery Certification Protocol, an auditable test framework that verifies whether AI research agents' claimed discoveries are genuine.

The Discovery Certification Protocol (DCP) converts AI research agents' discovery claims into executable recovery and feedback tests organized as gated audits. Controlled audits in SQLite optimization and virtual catalyst control produced zero recoveries in 96 episodes, with an upper bound of 0.0468. A deterministic, LLM-free verifier reproduces audit decisions from frozen evidence, giving AI research a common evidence language for outcomes, alternative routes, and feedback effects.

Hugging Face daily papers · 9d agoAI research

Understanding the Usability of Cryptographic Verification Tools

Survey of Tamarin and ProVerif users reveals usability barriers: debugging non-termination, model validation, and opaque proof failures hinder cryptographic protocol verification.

The paper presents an exploratory human-centered survey of researchers, graduate students, and practitioners with hands-on experience using Tamarin, ProVerif, and related cryptographic protocol verification tools. Findings reveal usability barriers across the verification workflow, including difficulties debugging non-termination and performance issues plus the lack of systematic methods for validating formal models against real protocols. When proofs fail without concrete attacks, users commonly simplify models, add helper lemmas, and revisit modeling abstractions. Participants called for actionable diagnostics, clearer explanations of results, visualization, and automation for recurring proof tasks.

arXiv cs.CR · 1d agoResearch

Scalable Composition of Byzantine Agreements under Reorder Attacks

Researchers present the first adversary model combining party corruption with channel reordering attacks, establishing tight security thresholds for composed Byzantine agreement protocols.

The paper presents the first adversary model combining party corruption with adversarial channel attacks that reorder messages across multiple Byzantine agreement executions. It proves impossibility results for authenticated BA under parallel composition when n ≤ 3t or n ≤ 2c + 2t + 1, with matching possibility results when n > max{3t, 2c + 2t + 1}. The authors provide general black-box compilers plus erasure-correcting-code variants that achieve constant multiplicative communication overhead for long messages.

arXiv cs.CR · 7d agoResearch

How an Emerging Industrial Protocol Family Could Put OT at Risk

New research shows unprotected Time-Sensitive Networking industrial protocols could let attackers disrupt or manipulate physical processes in OT environments.

Research covered by Dark Reading examines an emerging family of industrial protocols based on Time-Sensitive Networking (TSN) and finds that unprotected implementations could be attacked to disrupt or manipulate physical processes. The findings highlight growing OT risk as these protocols proliferate in industrial deployments; no confirmed exploitation is reported.

Dark Reading · 25d agoResearch

ZDI-26-701: Linux Kernel TLS Protocol Out-Of-Bounds Read Information Disclosure Vulnerability

ZDI discloses Linux Kernel TLS protocol out-of-bounds read (CVE-2026-64046) allowing high-privileged local attackers to disclose sensitive information, CVSS 6.7.

ZDI-26-701 covers an out-of-bounds read information disclosure vulnerability in the Linux Kernel TLS protocol implementation, tracked as CVE-2026-64046 with a CVSS rating of 6.7. Exploitation requires the attacker to already have the ability to execute high-privileged code on the target system. Impact is limited to disclosure of sensitive information from affected installations.

ZDI Published Advisories · 2d agoVulnerabilityCVE-2026-640461

From Protocols to Evidence: Bounded Claims for AI in Service of the Common Good

Paper proposes a rupture test and RISE AI architecture for evidence-bounded responsible-AI claims, framed via EU AI Act and NIST AI RMF.

The paper argues AI deployment intervenes in pre-existing institutional failures of responsiveness, belonging, care, and accountability, and must therefore evaluate both the system and the institutional rupture it enters. It reviews how the EU AI Act, NIST AI RMF, and ISO/IEC 42001 translate principles into protocols, and draws on Pope Leo XIV's Magnifica Humanitas to develop a rupture test linking institutional baselines to system evaluation. It distinguishes evidence-bounded deployment from measurement-bounded governance and introduces RISE AI, an architecture for bounded claims about Responsibility, Inclusivity, Safety, and Empowerment.

arXiv cs.AI / cs.LG / cs.CL · 5d agoAI policy

terms.txt: A Consent and Compensation Protocol for Agentic Web Access

terms.txt specifies a robots.txt-style protocol for per-path, per-purpose AI crawler consent and compensation, with enforcement adding 0.20-0.65 ms per request.

The paper documents that automated clients now make up most web requests, that training dominates Cloudflare-classified crawling, and that the largest AI platforms fetch thousands of pages per returned visitor while robots.txt cannot express identity, purpose, terms, or price. It specifies terms.txt plus an origin-enforced exchange using Web Bot Auth signatures, signed intent, delegation tokens, HTTP 402 negotiation, and signed receipts. A dependency-free implementation adds 0.20 to 0.65 ms per request on one vCPU.

arXiv cs.CR · 6d agoResearch

Towards Tackling Application Logic Flaws through Autonomous Formal-Logic Modeling and Automated Reasoning

LL-Verifier combines LLMs with logic model checking to automatically discover logic flaws, uncovering vulnerabilities in 27 IoT access-control protocols.

Researchers present LL-Verifier, a framework that uses LLMs to autonomously convert natural-language protocol descriptions and security goals into formal logic models in a new logic language built on Maude, then applies logic model checking for exhaustive verification. The framework targets application-logic flaws that are tied to business semantics and hard to scale with manual analysis. Evaluation on 27 access-control protocols of widely used IoT devices uncovered a range of sophisticated logic vulnerabilities with security and privacy implications.

arXiv cs.CR · 6d agoResearch1

CVE-2026-16028: Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection stream table

CVE-2026-16028: Protocol::HTTP2 Perl library before 1.14 lets closed streams linger in the connection table, enabling remote memory exhaustion.

Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion because closed streams are never removed from the connection stream table by stream_state. The flaw was disclosed on oss-security by Robert Rothenberg on September 7, 2026. Users should upgrade to Protocol-HTTP2 1.14 or later on CPAN.

oss-security · 8d agoVulnerabilityCVE-2026-16028

TuxBot v3: Inside an IoT Botnet Framework With LLM

Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.

Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.

Palo Alto Unit 42 · 27d agoMalware1

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.

Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.

Tenable Blog · 7d agoVulnerability in the wildCVE-2026-81963CVE-2026-858801

HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures

A custom HVNC backdoor is targeting Latin American financial organizations via fake DocuSign and NFe tax-document lures, giving attackers hidden persistent remote access.

ANY.RUN researchers analyzed a multi-stage phishing campaign delivering a custom HVNC backdoor to banking and financial organizations in Latin America. The chain starts with fake DocuSign and NFe tax-document pages that serve per-visitor ZIP archives, followed by an LNK dropper, an NSIS loader, and a 64-bit backdoor masquerading as Windows Update Assistant. The implant provides hidden remote desktop control, keystroke monitoring, Firefox data theft, Startup-folder persistence, and EDR-aware behavior, communicating over TCP/27015.

ANY.RUN · 8d agoMalware in the wild

China's AI-Enabled APT Operations Are Getting Interesting

Bitdefender links seven RAT families, five previously undocumented, to China-nexus espionage actor SilkParasite using AI-assisted malware development against Central Asian governments.

A Bitdefender report attributes seven remote access tool families to a single actor dubbed SilkParasite, with medium confidence a China-nexus group targeting governments in Uzbekistan, Turkmenistan and Kazakhstan. The RATs are written in .NET, C++, Go and JavaScript, use C2 via Google Drive and protocols like HTTP, DNS and TCP, and employ modular plugin architectures with regular rotation of infrastructure, encryption material and persistence artifacts. Evidence of AI-assisted development includes leftover test functions, placeholder encryption keys, and GoginRAT and NomadRAT sharing a high-level architecture despite different languages, suggesting a specification implemented twice with AI. The newsletter also covers the US Operation Economic Outcast sanctioning six MOIS-linked Iranian hackers, including hands-on-keyboard operators who targeted US critical infrastructure.

Risky Business News · 20d agoThreat actor1

Your Shredded Visa Card May Still Work at the Checkout

UMass Amherst researchers demonstrated expired Visa contactless cards can complete real purchases via relay attacks exploiting Visa Kernel 3's unsigned expiry date handling.

University of Massachusetts Amherst researchers presented at USENIX Security 2026 that expired Visa contactless cards can be revived for real purchases through an NFC man-in-the-middle attack on Visa's Kernel 3. The attack alters the expiry date the terminal sees (tag 5F24) while leaving the Track 2 Equivalent Data (tag 57) sent to the issuing bank unchanged, and the card's cryptographic signature does not cover the expiry date. Two Android phones emulating card and terminal relayed transactions within Visa's 500-millisecond limit. Mastercard, American Express, and Discover kernels blocked the attack, while Visa Kernel 3 did not; researchers also modified the Consumer Device Cardholder Verification Method flag at five US banks, and attackers can also exploit Terminal Verification Results zero-filling. Visa was notified in May 2025 and December 2025; no CVE has been assigned.

Security Affairs · 25d agoResearch

Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild

Attackers actively exploit CVE-2025-32433, a CVSS 10.0 unauthenticated RCE in Erlang/OTP SSH, heavily targeting OT and critical infrastructure networks.

CVE-2025-32433 enables unauthenticated RCE in Erlang/OTP's SSH daemon via SSH connection protocol messages (codes >= 80) processed before authentication, affecting versions before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20. Unit 42 recorded a spike in exploitation between May 1-9, 2025, with 70% of detections on firewalls protecting OT networks, disproportionately affecting healthcare, agriculture, media and high technology. Observed payloads bind TCP-connected shells or launch Bash reverse shells to hosts like 146.103.40.203:6667, with randomized DNS lookups under dns.outbound.watchtowr.com indicating OAST-driven blind RCE validation.

Palo Alto Unit 42 · 29d agoExploit / PoC in the wildCVE-2025-32433

CausalArena: Benchmarking Causal Discovery in the Foundation Model Era

Researchers introduce CausalArena, a unified benchmark revealing that causal discovery rankings shift substantially across structural causal model families and protocols.

The paper presents CausalArena, a unified and evolvable benchmark for causal discovery combining synthetic structural causal models, semantically grounded operational SCMs, formula-grounded scientific SCMs, and public real-world datasets. Experiments across classical, neural, and pretrained causal discovery foundation models show large ranking shifts between benchmark regimes. The authors identify pretraining-evaluation overlap and benchmark diversity as central evaluation challenges.

arXiv cs.AI / cs.LG / cs.CL · 5d agoAI research

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker News · 8d agoExploit / PoC in the wildCVE-2026-85046CVE-2026-86206CVE-2026-86207+7 CVEs

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

SpecterOps released CDP-Enable-BOF, a Beacon Object File that enables Chrome DevTools Protocol in live Chrome or Edge processes on Windows for session hijacking.

SpecterOps released CDP-Enable-BOF, an x64 Beacon Object File that activates Chrome DevTools Protocol inside running chrome.exe or msedge.exe processes on Windows, exposing cookies, history, saved passwords, and authenticated sessions without administrator rights. It calls Chromium's StartRemoteDebuggingServer on the browser UI thread to stay reliable under CFG, TLS, and CET, and was tested on Chrome 147 and Edge 147. The technique builds on work by DeathFlamingo and Cedric Van Bockhaven; Google had hardened remote debugging in Chrome 136 after attackers used it to steal cookies post-App-Bound Encryption. Defenders can watch Sysmon Event IDs 8 and 10 for injection into browser processes.

The Hacker News · 21d agoResearch2

Threat Brief: Maze Ransomware

Unit 42 issued a threat brief on Maze ransomware, noting an uptick across industries and exploitation of Pulse VPN and IE flaws for initial access.

Palo Alto Networks detected an uptick in Maze ransomware samples across finance, healthcare, government, and other sectors. Maze, a variant of ChaCha ransomware first seen in May 2019, is distributed via weaponized Word/Excel attachments and the Spelevo exploit kit leveraging CVE-2018-15982 and CVE-2018-4878, and has used CVE-2019-11510 (Pulse VPN) and CVE-2018-8174 (Internet Explorer). Operators establish a foothold, escalate privileges, move laterally, and exfiltrate files before encryption for extortion leverage.

Palo Alto Unit 42 · 29d agoRansomware in the wildCVE-2018-15982CVE-2018-4878CVE-2019-11510+1 CVEs

Almost Half of Malware Samples Communicate Direct to IP

Unit 42 analysis of 4 million malware reports finds 45% of C2-active samples connect directly to hard-coded IPs, bypassing DNS defenses.

Palo Alto Unit 42 analyzed over 4 million Advanced WildFire dynamic analysis reports and found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, accounting for 23.17% of all C2 connection attempts. The firm proposes zero trust IP (ZT-IP), an enforcement approach that verifies whether outbound destinations were ever sanctioned by a DNS response. ZT-IP analysis surfaced Phorpiex ransomware droppers fetching payloads directly from C2 IPs, a persistent data exfiltration campaign using an obfuscated \GET protocol, and Mozi P2P botnet payloads delivered to IoT devices without DNS. Only 1% of benign samples connected directly to untrusted IP addresses.

Palo Alto Unit 42 · 29d agoResearch

MarkSec: Capability-Aware Evaluation of Adversarial Attacks Against LLM Watermarks

MarkSec unifies evaluation of stealing, scrubbing, and spoofing attacks against LLM watermarks with quality-constrained success metrics under shared reporting protocols.

MarkSec is a framework unifying analysis of stealing, scrubbing, and spoofing attacks against LLM watermarks under shared detector calibration, metric definitions, and reporting protocols. It introduces a quality-constrained attack success metric that jointly assesses attack effectiveness and text quality. Experiments across representative watermark families, attacks, LLMs, and datasets show that attacks strongest by watermark removal alone can fall behind general rewriting when success requires acceptable text quality, and stealing-based scrubbers often underperform the best general-scrubbing baselines.

arXiv cs.CR · 1d agoResearch

Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution

China-linked UNC3569 actively exploited critical Sogou Input Method flaw CVE-2026-51990 for one-click system-level code execution, deploying the GrayRabbit backdoor.

Gen Threat Labs reports that China-linked threat actor UNC3569, possibly tied to contractor i-SOON, exploited critical CVE-2026-51990 in Tencent's Sogou Input Method, a Windows IME used by hundreds of millions, via crafted sgbiz URLs. The chain combines unvalidated command-line argument injection, unrestricted URL navigation, and an un-sandboxed Chromium 80 engine missing roughly six years of security patches. The exploit gives system-level code execution and was used to deploy the GrayRabbit backdoor, which provides a reverse shell, plugin loading, file upload to C2, and system info collection, and has appeared in UNC3569 intrusions since at least 2021. Tencent patched the issue in version 16.3.0.3498 via automatic update, but the outdated Chromium configuration reportedly remained unchanged as of September 10.

SecurityWeek · 1d agoExploit / PoC in the wild 2 sourcesCVE-2026-519901· 1 read

Maverick: Private and Verifiable LLM Inference Made Practical via Matrix-Vector Multiplication Delegation

Maverick protocol delivers private and verifiable LLM inference via matrix-vector multiplication delegation, achieving up to 45x throughput gains over local inference on Qwen3-4B.

Maverick introduces an information-theoretically sound protocol for delegating matrix-vector multiplication with transparent preprocessing, efficient batch verification, and virtually no server overhead, combined with LPN-based pseudorandom masking for input privacy. It addresses privacy and correctness concerns when users delegate open-weight LLM inference to third-party providers. An end-to-end prototype evaluated on Qwen3-4B achieved throughput gains over local inference of up to 45x with precomputed privacy masks and 44x for verification-only workloads, with a CPU server using up to 128 threads.

arXiv cs.CR · 6d agoResearch1

GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI

GTIG's Q2 2026 tracker shows adversaries adopting agentic AI workflows, including credential harvesting in under six hours and supply chain attacks by UNC6780.

Google Threat Intelligence Group's Q2 2026 report documents adversaries moving from basic prompting to agentic AI workflows and automation, including a cloud compromise followed by agent-enabled mass credential harvesting executed in under six hours. It tracks financially motivated actor UNC6780 (TeamPCP) conducting large-scale open source supply chain compromises across PyPI, npm, and Docker Hub since March 2026, deploying credential stealers. The report also highlights growing targeting of proprietary AI models, source code, prompts, and API credentials, plus LLMJacking practices where adversaries steal developer credentials or hijack cloud infrastructure to run unauthorized AI workloads.

Google Threat Intelligence · 7d agoThreat actor in the wild

Authorities Turn Sality's P2P Network Against Itself, Cutting Off New Malware Payloads

US and European authorities with CrowdStrike dismantled the two-decade-old Sality P2P botnet using peer-list manipulation, blocking payload delivery to infected hosts.

The US Department of Justice announced a coordinated takedown of the Sality peer-to-peer botnet, executed August 31, 2026 by authorities from the US, Bulgaria, Hungary, and Romania with CrowdStrike and the Shadowserver Foundation. Sality, active since 2003, infects Windows executables and delivers payloads including the EggJagger crypto clipper, which stole at least $150,000, and was used for DDoS campaigns. The operation abused the botnet's peer-list maintenance cycle to insert sinkhole nodes and isolate both super peers and NAT-hidden infections, cutting off URL and payload distribution to more than 15,000 infected machines across two P2P networks.

The Hacker News · 14d agoMalware

Risky Bulletin: Russia starts blocking DoH and DoT

Russian users report blocks on DoH and DoT servers, including Cloudflare 1.1.1.1 and Google 8.8.8.8, in an apparent censorship crackdown.

Russian internet users began reporting failures connecting to DNS-over-HTTPS and DNS-over-TLS servers, suggesting a government crackdown on the two privacy protocols. The blocks reportedly cover Cloudflare's 1.1.1.1 and Google's 8.8.8.8 resolvers; Roskomnadzor has not officially confirmed the action. The agency tested a similar block in March on Beeline's network and had named DoH for blocking as early as 2021. The bulletin also briefly notes state-sponsored phishing of EU officials, a DDoS against Norway's Digdir, the ReliaQuest/ShinyHunters dispute, and older ransomware and breach disclosures.

Risky Business News · 21d agoPolicy & legal1

Risky Bulletin: Expired cards can be used for new transactions

Researchers show expired Visa contactless cards can be revived via NFC man-in-the-middle relay to run fraudulent transactions; roundup also covers major breaches.

University of Massachusetts Amherst researchers built an NFC man-in-the-middle rig that updates a card's expiration date in transit and relays the modified payment to POS terminals, reviving expired contactless cards; Visa terminals and the backends of all five banks studied failed to catch the manipulation. The same roundup reports Iranian hackers shut down a small UK power plant for four days, Lazarus breached South Korea's Presidential Office as part of a campaign exceeding 100 victims, and French telecom SFR suffered a breach affecting over 2.1 million customers.

Risky Business News · 23d agoResearch1

RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families

Unit 42 names RANCOR, a previously unidentified espionage group targeting Southeast Asian political entities with newly discovered PLAINTEE and DDKONG malware families.

Unit 42 tracks a previously unidentified group it dubs RANCOR conducting highly targeted espionage attacks in Singapore and Cambodia using two custom malware families, DDKONG and PLAINTEE. Attacks appear to have begun with spear phishing, with decoy political news documents hosted on legitimate sites including a Cambodian government website and Facebook. Infrastructure links to IP 89.46.222[.]97 and KHRAT-associated domains such as facebook-apps[.]com, and the activity is grouped into two clusters tied together by PLAINTEE usage and similar targeting.

Palo Alto Unit 42 · 29d agoThreat actor1

Sam Altman calls for pacing AI development but promises rapid progress will continue

Sam Altman urges paced AI development with pre-training safety protocols as OpenAI, Anthropic, and Google discuss independent self-regulation oversight.

Sam Altman called for a uniform nationwide safety framework for advanced AI while insisting progress will remain rapid, saying pacing is not stopping. OpenAI now sets explicit safety protocols before training runs that could yield major capability jumps, and Altman hopes other companies propose their own approaches. Dario Amodei, Demis Hassabis, Satya Nadella, and Elon Musk also backed better-controlled AI development. The Information reports OpenAI, Anthropic, and Google have discussed self-regulation through an independent oversight body, while smaller players like Cohere warn of cartel dynamics.

The Decoder · 2d agoAI industry

Security through obscurity is dead, and AI delivered the fatal blow

AI agents are killing security through obscurity, accelerating vulnerability discovery and patch-gap exploitation, experts warn, with OT/ICS systems most at risk.

An opinion/analysis piece arguing AI has made security through obscurity obsolete, citing record vulnerability disclosure volumes after Microsoft's Patch Tuesday addressed 974 CVEs. FBI Cyber Division assistant director Brett Leatherman said latest AI models found significant vulnerabilities in open source libraries running on most web servers. The article cites at least four espionage crews (most suspected China-linked) exploiting Chromium's patch-gap window with a rapid exploit kit, and a five-agency advisory on AI-generated exploitation scripts breaching internet-exposed Siemens S7 Series PLCs at water, manufacturing, and energy facilities. Experts including John Hultquist, Chris Inglis, and Katie Moussouris warn AI erodes the expertise barrier protecting obscure OT/ICS systems while defensive AI patching lags, with studies showing AI-generated patches fail more than half the time.

The Register · Security · 2d agoIndustry