Search: “Direct Connect”

ConnectWise patches critical ScreenConnect authentication failure after five days

ConnectWise patched ScreenConnect flaw CVE-2026-84869 five days after warning files could be transferred and executed via active sessions without authorization.

ConnectWise released ScreenConnect client version 26.6.5 and later to fix CVE-2026-84869, an authentication failure in ConnectWise Remote Access allowing unauthorized file transfer and execution through active remote sessions. The company warned customers on September 3 and advised admins to remove the TransferFiles permission from users with open sessions as an interim mitigation. The advisory does not state that exploitation has been observed.

CSO Online·updated Sep 14, 08:25 UTC · 2d ago·first Sep 11, 16:17 UTC · 4d agoVulnerability 3 sourcesCVE-2026-84869

CVE-2026-82583, CVE-2026-78224, CVE-2026-82578: NextGen Mirth Connect SQL injection and XXE

CISA advisory ICSMA-26-253-01 covers three NextGen Mirth Connect flaws, including SQL injection and XXE, with testing performed against version 4.5.2.

CISA has published ICS Medical Advisory ICSMA-26-253-01 covering three vulnerabilities in NextGen Mirth Connect, the open-source healthcare integration engine. The flaws include SQL injection and XML external entity (XXE) injection, tracked as CVE-2026-82583, CVE-2026-78224 and CVE-2026-82578, with testing performed against version 4.5.2. The findings were announced on the oss-security mailing list by researcher Abhinav Agarwal on September 11.

oss-security·Sep 11, 13:08 UTC · 4d agoVulnerability 2 sourcesCVE-2026-82583CVE-2026-78224CVE-2026-825781

AI is getting better at election facts, but voters shouldn’t rely on it

CyberScoop·Aug 5, 09:00 UTC · Aug 5, 2026Exploit / PoC in the wild

ConnectWise warns of new ScreenConnect flaw without patch

ConnectWise warns of an unpatched ScreenConnect flaw affecting file transfer in support sessions and shares interim mitigations for MSPs.

ConnectWise disclosed a new ScreenConnect Remote Access vulnerability affecting file transfer behavior in both cloud and on-premises deployments; no CVE ID or patch is available yet, with a fix planned later this week. The vendor published temporary mitigation steps that remove TransferFiles permissions from session groups across all roles. Shadowserver tracks nearly 6,000 internet-exposed ScreenConnect instances. Previous ScreenConnect flaws, including CVE-2024-1709, were exploited by ransomware gangs and North Korea's Kimsuky, and three ScreenConnect vulnerabilities are on CISA's actively exploited catalog.

BleepingComputer·Sep 7, 10:06 UTC · 9d agoVulnerabilityCVE-2024-1709CVE-2025-3935CVE-2026-35641

Global sinkhole operation ends Sality botnet’s 23-year run

Law enforcement, CrowdStrike, and Shadowserver sinkholed the 23-year-old Sality P2P botnet, cutting 15,000+ infected machines from its operator.

Sality, active since 2003 as a file-infecting virus with two P2P networks (versions 3 and 4), distributed credential thieves, spam, proxies, and DDoS payloads, and most recently delivered the EggJagger clipboard hijacker that swapped cryptocurrency wallet addresses for at least $150,000 in operator profit. A coordinated sinkhole operation replaced the botnet's super-peer list with defender-controlled sinkholes, and investigators in the US, Bulgaria, Hungary, and Romania seized payload domains. The Shadowserver Foundation is coordinating ISP and CERT notifications to infected device owners.

Help Net Security·Sep 2, 00:00 UTC · 14d agoMalware1

New Italian unicorn Exein rides the physical AI wave

Italian IoT-security startup Exein raised $270 million at a $1.7 billion valuation to build a security layer for physical AI and edge devices.

Rome-based Exein raised a $270 million round led by Headline at a $1.7 billion valuation, becoming Italy's new unicorn, with plans for M&A and US/APAC expansion. The company claims over 2 billion connected devices secured across aerospace, industrial automation, automotive, energy, healthcare, and semiconductors using its Photon kernel-level runtime protection. Exein is training a foundational model for physical AI security on machine telemetry, targeted for Q1 2027, and reports 400% year-on-year growth. The EU Cyber Resilience Act, whose reporting obligations began last week, is expected to further boost demand.

TechCrunch · Security·Sep 15, 12:19 UTC · 22h agoIndustry

Modified ScreenConnect Clients Used in Worm-Like Campaign

Huntress warns of worm-like attacks using modified ScreenConnect clients to spread VBScript payloads; ConnectWise issued an advisory.

Campaigns starting in late August use social engineering, including Quick Assist abuse, to install rogue ScreenConnect clients that spawn wscript.exe and deploy four VBScript files for reconnaissance, staging, and PowerShell execution. The attackers persist via User Run Keys, attempt UAC bypass, install UltraViewer, and propagate the VBScript chain to other connected ScreenConnect endpoints. ConnectWise published an advisory about a file transfer behavior issue affecting cloud and on-premises ScreenConnect, with a CVE identifier and fix expected within a week; it recommends disabling file transfer meanwhile.

SecurityWeek·Sep 7, 11:45 UTC · 8d agoExploit / PoC in the wild

Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories

Gen Digital found infostealers like Amatera and Remus stealing AI coding agent tokens, prompt histories, and MCP configs from infected Windows and macOS machines.

Gen Digital analysts observed Amatera and Remus detections among tens of thousands of protected Windows users over three months, with Amatera targeting Cline and Continue data and Remus targeting Claude, Cursor, and OpenCode. CallbackBeaver added Cursor and Claude to its collection scope with more than 5,000 samples in 30 days, while macOS-focused Djinn Stealer has been associated with Claude, Codex, Gemini, Cline, OpenCode, and Kilo. The stealers harvest access and refresh tokens, prompt histories, and MCP configuration files that can expose source control, ticketing, databases, cloud resources, and sensitive project context for follow-on fraud. Many stealers add targets via remotely managed rules, meaning this is an adaptation of existing infostealers rather than a new vulnerability in the AI tools themselves.

Cyber Security News·updated Sep 9, 14:23 UTC · 6d ago·first Sep 9, 11:41 UTC · 6d agoMalware in the wild 2 sources2

Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)

Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.

Microsoft patched a record 964 CVEs in its September 2026 Patch Tuesday release, with 101 rated critical and 824 rated important, making it the largest Patch Tuesday to date. The release includes fixes for two zero-days that were exploited in the wild, with CVE-2026-81963 and CVE-2026-85880 highlighted in the release. Affected products span Windows core components, Office, Exchange, .NET, Visual Studio, Active Directory services (including AD CS and AD FS) and numerous Azure services. Tenable notes the release surpasses July's as the biggest ever.

Tenable Blog·Sep 8, 18:07 UTC · 7d agoVulnerability in the wildCVE-2026-81963CVE-2026-858801

Attackers use rogue ScreenConnect clients to spread malware

Attackers deploy rogue ScreenConnect clients that spread VBScript malware to newly connected machines while ConnectWise patches a file-transfer flaw.

ConnectWise confirmed a file transfer flaw in ScreenConnect affecting both Cloud and On-Premise deployments, with a CVE identifier and official fix promised within the week; administrators can mitigate immediately by disabling TransferFiles (or TransferFilesInSession) in each role. Huntress documented incidents where social engineering installs rogue ScreenConnect clients that spawn Windows Script Host processes running four VBScript files (1.vbs-4.vbs), add a WindowsServiceHost registry Run key, and propagate to newly connected endpoints. Payloads enabled host profiling, persistence, additional ScreenConnect installs, tunneling, security-control changes, and cryptocurrency mining. ConnectWise has not confirmed a technical link between the flaw and this campaign.

Help Net Security·Sep 7, 00:00 UTC · 9d agoExploit / PoC in the wild

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.

Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.

Microsoft Security Blog·Sep 2, 22:51 UTC · 13d agoThreat actor in the wild

The Coding-Agent Trap: When a "Free" LLM Endpoint Is the Adversary, (Mon, Aug 31st)

A SANS honeypot caught a real coding-agent session routed to a rogue "free" LLM endpoint, exposing a Windows user's transcript and tool outputs.

A SANS analyst describes how an internet-exposed inference honeypot was discovered, relabeled with sought-after model names like DeepSeek, and enrolled in infrastructure serving "free" LLM backends. On 2026-08-30 an opencode terminal coding agent sent an 88-message, 224 KB transcript 210 times in 91 seconds via a China Unicom relay, exposing directory listings, tool outputs and read file portions. The analyst frames tool-enabled agents treating model endpoints as trusted control planes as a novel risk — a "rogue model endpoint" that could request tool executions on the user's machine.

SANS Internet Storm Center·Aug 31, 20:00 UTC · 15d agoAI safety & security1

A rant about phishing: It's not the user's fault (and not DNS either)

Opinion piece argues multi-domain login redirects make legitimate flows indistinguishable from phishing, urging organizations to standardize on one recognizable root domain.

The author shows a real-world login flow that chains through numerous third-party domains (identity providers, cloud auth endpoints, OAuth APIs, 2FA pages), none on the company's own domain, so credentials and 2FA prompts are trivially impersonable. The piece argues URLs are inherently confusing because the security-relevant second-level domain sits mid-string, and that users trained to ignore URLs cannot distinguish legitimate pages from scams. It proposes RFC 2119-style requirements: single recognizable root domain, internal services on its subdomains, emailed or SMS links on that domain, and local redirects instead of third-party hosted pages.

Lobsters · security·Sep 10, 15:14 UTC · 5d agoPhishing & fraud

The AI Supply Chain Has a Security Problem, and Much of It Is Sitting on the Open Internet

Researchers counted 36,769 publicly reachable self-hosted AI endpoints, only about 2% behind HTTP authentication, exposing Ollama, vLLM, and Flowise to abuse.

A Mysterium VPN study found 36,769 self-hosted AI endpoints reachable through internet scanning, with only 2.02% returning an HTTP authentication challenge. Open WebUI accounted for 18,529 reachable instances, Ollama for 6,935 fingerprinted hosts, and 5,223 agent-builder and workflow platforms were exposed, often holding API keys, database credentials, and other secrets. The report highlights LLMjacking risk from exposed Ollama APIs, a critical Flowise bug (CVE-2026-40933), leaked n8n tokens, and prior SentinelOne/Censys research finding roughly 175,000 exposed Ollama hosts in 130 countries.

Security Affairs·Sep 11, 17:27 UTC · 4d agoAI safety & securityCVE-2026-409331

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.

Huntress identified multiple incidents in late August 2026 where social engineering led to rogue ScreenConnect remote access clients deployed on victim machines, which then spawned wscript.exe to run four VBScript payloads (1.vbs through 4.vbs) for profiling, telemetry collection, and persistence via a WindowsServiceHost Run key. Modified ScreenConnect clients propagated the VBScript chain to connected endpoints, creating worm-like spread. ConnectWise published an advisory on September 3, 2026, confirming an issue affecting file transfer behavior in both cloud and on-premises ScreenConnect deployments, with a CVE and fix expected within the week; partners were advised to review and disable TransferFiles permissions in the interim.

Huntress·Sep 3, 08:50 UTC · 13d agoExploit / PoC in the wild1

ChatGPT flaw lets attackers pull Gmail data across accounts via a hidden channel

Check Point found a ChatGPT flaw letting attackers read victims' Gmail and connected-app data via hidden cross-session instructions; OpenAI patched it.

Check Point Research discovered a covert cross-account command channel in ChatGPT's code execution environment, where containers meant to be isolated shared metadata through an internal service based on JFrog Artifactory. In a proof of concept, a victim's session was tricked into retrieving Gmail email data and relaying it to an attacker-controlled session during an ordinary-looking interaction, with reach extending to any connected apps the session was authorized for, including Google Drive, Microsoft Teams, and GitHub. OpenAI fixed the issue and decommissioned the internal service; the same shared infrastructure was also involved in the separately disclosed Hugging Face compromise, though via different techniques.

CSO Online·Sep 9, 11:48 UTC · 6d agoAI safety & security

Almost Half of Malware Samples Communicate Direct to IP

Unit 42 analysis of 4 million malware reports finds 45% of C2-active samples connect directly to hard-coded IPs, bypassing DNS defenses.

Palo Alto Unit 42 analyzed over 4 million Advanced WildFire dynamic analysis reports and found that 45.32% of malware samples with C2 activity made at least one direct-to-IP connection, accounting for 23.17% of all C2 connection attempts. The firm proposes zero trust IP (ZT-IP), an enforcement approach that verifies whether outbound destinations were ever sanctioned by a DNS response. ZT-IP analysis surfaced Phorpiex ransomware droppers fetching payloads directly from C2 IPs, a persistent data exfiltration campaign using an obfuscated \GET protocol, and Mozi P2P botnet payloads delivered to IoT devices without DNS. Only 1% of benign samples connected directly to untrusted IP addresses.

Palo Alto Unit 42·Aug 17, 12:45 UTC · 29d agoResearch

Meta Failed to Catch Hundreds of AI Child Abuse Ads. Some Included Images of Real Kids

Meta's AI ad-detection failed to catch 350+ CSAM video ads on Facebook, Instagram, and Threads, some depicting images of real children.

The Tech Transparency Project found over 250 additional ads containing child sexual abuse material on Meta platforms since August, on top of ~53 previously removed, exceeding 350 total since late last year. Some ads used images of real children, including a European royal family minor and teen influencers, morphed into graphic sexual videos via AI face-swapping. Ads linked to nudification apps from Chinese developers and reached over 29,000 EU accounts plus thousands in the US, UK, Australia, and India.

WIRED · Security·Sep 8, 12:00 UTC · 7d agoAI safety & security

Advanced Dns Security

Palo Alto Networks Unit 42 hosts a product archive page for its Advanced DNS Security DNS-layer threat prevention service.

The page is a product category archive on the Unit 42 blog with no article text available. Advanced DNS Security is Palo Alto Networks' DNS-layer threat prevention offering. No research findings, incidents, or vulnerabilities are described.

Palo Alto Unit 42·Sep 8, 14:27 UTC · 7d agoIndustry 6 sources

GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE

A CVSS 9.8 SQL injection zero-day in GeoServer's PostGIS datastore enables RCE and drew active exploitation; fixes shipped in versions 3.0.1, 2.28.5, 2.27.6.

A SQL injection flaw in GeoServer's jsonArrayContains function within the GeoTools PostGIS datastore (GHSA-mqjf-5f49-2fjh, CVSS 9.8) was disclosed August 12, 2026, and saw hundreds of exploitation attempts within hours per watchTowr. An attacker-controlled value is interpolated into a PostgreSQL jsonb_path_exists() expression without escaping; with superuser or pg_execute_server_program privileges it escalates to OS command execution via WFS 1.0. GeoServer released versions 3.0.1, 2.28.5, and 2.27.6, and the flaw is a regression of CVE-2023-25158. GeoServer has a history of mass exploitation, including CVE-2024-36401 used for botnets and proxies.

The Hacker News·Aug 17, 17:05 UTC · 29d agoExploit / PoC in the wildCVE-2024-36401CVE-2023-25158CVE-2023-251571

Attackers Use Multi-Hop Google Redirects for Phishing Campaign

Threat actors chain multiple legitimate Google service redirects to evade detection and deliver credential harvesting or ScreenConnect remote access tooling.

Threat actors are abusing multiple legitimate Google services to build multi-hop redirect chains that obscure the final destination and bypass reputation-based filtering. The campaign culminates in credential harvesting pages or silent installation of the ScreenConnect remote access tool. Defenders should watch for links that traverse trusted Google domains before landing on malicious endpoints.

Dark Reading·Sep 8, 21:03 UTC · 7d agoPhishing & fraud in the wild

NSA, CISA, FBI, DOE, and EPA Warn of Active AI

Five US agencies warn of active AI-assisted attacks on internet-exposed Siemens S7 PLCs across critical infrastructure, using disguised snap7 scripts for pre-positioning reconnaissance.

NSA, CISA, FBI, DOE, and EPA issued joint advisory CISA AA26-231A warning of an active hacking campaign against Siemens S7-series PLCs, from S7-200 through S7-1500 F-series, across US critical infrastructure. Threat actors use internet scanning services such as Censys and ZoomEye to locate exposed controllers, then perform read operations over S7comm on TCP port 102 using the legitimate snap7.dll and python-snap7 libraries, disguising AI-generated exploitation scripts as monitoring tools. The agencies assess the activity as pre-positioning ahead of possible process disruption, equipment damage, or safety incidents in Energy, Water, Critical Manufacturing, Chemical, Food and Agriculture, and Commercial Facilities sectors.

Security Affairs·Aug 20, 17:36 UTC · 26d agoExploit / PoC in the wild

Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

Huntress says rogue ScreenConnect clients spread a four-stage VBScript chain delivering backdoors, privilege-escalation tools, or an XMRig miner to newly connected hosts.

Huntress identified three unrelated August 2026 incidents using a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund form to install rogue ScreenConnect clients. Each client repeatedly spawned wscript.exe to run 1.vbs through 4.vbs, which profiled the host, enumerated installed security products, and downloaded stage-specific payloads from Dropbox. Depending on detected state, payloads included a user-level ScreenConnect backdoor, UAC-bypass privilege escalation tooling, or tunneling utilities with an XMRig cryptocurrency miner. Infected clients re-infected newly connected hosts, creating worm-like propagation, and ConnectWise issued an advisory about affected file transfer behavior in ScreenConnect.

The Hacker News·Sep 7, 11:36 UTC · 8d agoMalware in the wild

Security Incident – BGP Hijacking

Attackers BGP-hijacked Softaculous' Hetzner IP block for 33 hours, obtained valid TLS certificates, and delivered a malicious Virtualizor update to some servers.

Between August 28 and 30, 2026, AS62390 (NexonHost) announced 162.55.80.0/24 via transit AS6204 (Zet.net) without authorization, diverting traffic while retaining Hetzner's AS24940 on the AS path. The attacker obtained valid Let's Encrypt certificates for virtualizor.com domains because the CA's domain validation was also routed through the hijack, so affected connections showed no TLS warnings. A malicious Virtualizor update package reached a handful of installations; routing was fully restored, and reconstruction from RIPE RIS data showed all 368 collector peers carried the hijacked route at some point with roughly 28% time-weighted diversion.

Lobsters · security·Sep 3, 02:07 UTC · 13d agoData breach

[remote] D-Link DNS_340L - OS Command Injection

An OS command injection exploit was published for the D-Link DNS-340L NAS, a flaw relevant to exposed network storage devices.

Exploit-DB published exploit #52643 for the D-Link DNS-340L network-attached storage device. The vulnerability is an OS command injection, which could allow arbitrary command execution on affected devices. The disclosure text does not report exploitation in the wild.

Exploit-DB·Aug 17, 00:00 UTC · Aug 17, 2026Exploit / PoC

U.S. Offers $10 Million Reward for Iranian IRGC Cyber Chief Linked to Critical Infrastructure Attacks

The U.S. State Department offered up to $10 million for information on Amir Yaryab, an IRGC cyber chief linked to critical infrastructure attacks.

The U.S. State Department's Rewards for Justice program offers up to $10 million for information identifying or locating Amir Yaryab, who allegedly oversees the Cyber Operations Command of Iran's IRGC Cyber-Electronic Command (IRGC-CEC). Officials tie him to units called Shahid Hemmat and Shahid Shushtari conducting cyber and information campaigns against defense, telecommunications, energy, and finance sectors across the US, Europe, and the Middle East, and to groups including CyberAv3ngers and Dadeh Afzar Arman. CyberAv3ngers compromised at least 75 Unitronics Vision Series PLCs, including 34 in US water and wastewater facilities, between November 2023 and January 2024.

Cyber Security News·Sep 8, 09:14 UTC · 8d agoPolicy & legal

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

Kaspersky details Iranian Cavern Manticore's expanded C2 framework using DNS and Google Apps Script, plus APT42's TAMECAT spyware in nuclear-sector phishing.

Kaspersky reported new components in the Cavern (Cav3rn) C2 framework, used by Iranian MOIS-affiliated Cavern Manticore (with overlaps to MuddyWater and OilRig's Lyceum) against Israeli entities, monitored since December 2025. The new GoogleService.dll module performs DNS A-record queries to choose between direct HTTPS and a Google Apps Script relay per transaction, with the DNS infrastructure able to rotate the Google deployment ID; Kaspersky also found an inter-component broker (rnp.dll) and linked the framework's plugin-based pivot to late April 2026. Separately, Group-IB and Kaspersky detailed HOLLOWGRAPH, a .NET NativeAOT DLL first seen in the wild June 7, 2026, that uses Microsoft 365 calendar events via the Graph API as two-way dead drops dated May 13, 2050, with DNS tunneling refreshing Entra ID credentials. DarkAtlas also reported APT42's TAMECAT modular surveillance framework delivered via LNK masquerading as PDFs in spear-phishing targeting the nuclear energy sector in April-May 2026, with the group using generative AI to accelerate operations.

The Hacker News·Aug 18, 12:12 UTC · 28d agoThreat actor

When AI Agents Go Rogue: Agent Session Smuggling Attack in A2A Systems

Unit 42 unveils agent session smuggling, where a rogue AI agent hides covert instructions in established Agent2Agent (A2A) protocol sessions to manipulate victim agents.

Palo Alto Networks Unit 42 discovered agent session smuggling, a new attack technique in which a malicious AI agent exploits an established cross-agent session under the Agent2Agent (A2A) protocol to send covert instructions hidden among benign client requests and server responses. The technique leverages the implicit trust agents place in collaborating agents and the stateful, multi-turn nature of A2A sessions; the researchers stress it affects any stateful protocol, not an A2A flaw. Unlike one-shot data-based attacks, a rogue agent can converse, adapt and build false trust over multiple interactions. Proposed mitigations include human-in-the-loop enforcement, cryptographically signed AgentCards for remote agent verification, and context-grounding to detect injected instructions.

Palo Alto Unit 42·Aug 17, 12:32 UTC · 29d agoAI safety & security2

Lightweight Zero Trust via Automotive SDN

Researchers map automotive SDN with MACsec/MKA and CORECONF/YANG to NIST SP 800-207, satisfying five of seven Zero Trust tenets without added infrastructure.

Zonal in-vehicle networks ship Ethernet, MACsec, and TSN but treat the network itself as trusted, with no standardized runtime way to revoke access, rotate keys, or contain a compromised ECU. The paper first analyzes what Open Alliance TC17 v1.0 MACsec/MKA with pre-shared CAKs already provides against the seven NIST SP 800-207 Zero Trust tenets. It then adds CORECONF/YANG management per Open Alliance TC19, mapping the SDN Controller and Agents one-to-one onto NIST's PE, PA, and PEP, and instantiates a YANG-based network-access-control flow and key-management scheme. The result fully covers five of the seven tenets and partially covers two, without any ZTA-specific infrastructure.

arXiv cs.CR·Sep 9, 07:20 UTC · 7d agoResearch

How Does mHC Use Its Residual Streams? Selective Routing and Near-Identity Mixing

Analysis of DeepSeek-V4-Flash shows four-stream mHC residual blocks use only about two streams effectively, with late-layer mixing providing little benefit.

The study examines the four-stream residual pathway of DeepSeek-V4-Flash, finding typical attention or FFN sites effectively use about two streams and that residual mixing is modest, occurring primarily in early layers. Replacing late mixers with identity increases C4 perplexity by only 1.9% while replacing early mixers raises it by 41%. Retaining the three largest routing weights per token increases perplexity by at most 2.7%, showing the model uses only part of the flexibility afforded by the four-stream design.

arXiv cs.AI / cs.LG / cs.CL·Sep 4, 16:02 UTC · 11d agoAI research

Researchers open-source a Wi-Fi cyber range for security training

NTNU and Aegean researchers open-source a software-emulated Wi-Fi cyber range using mac80211_hwsim with LLM-assisted scenario building.

Researchers from the Norwegian University of Science and Technology and the University of the Aegean published a design and prototype for a cyber range dedicated to IEEE 802.11 security training, emulating access points and clients with mac80211_hwsim, Linux namespaces, hostapd, wpa_supplicant, dnsmasq, and FreeRADIUS. The platform bundles Aircrack-ng, Wireshark, and custom tools WPAxFuzz and Bl0ck, and can convert plain-language scenario descriptions into deployable definitions via a locally hosted Llama model. A working prototype covering scenario creation and deployment is on GitHub; monitoring, access control, and orchestration zones remain future work.

Help Net Security·Aug 24, 04:21 UTC · 23d agoTools1

AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key

Huntress research shows AD RMS SLC root key is unrotatable and never expires, so its compromise permanently exposes all RMS-protected documents.

Part 2 of Huntress's AD RMS series details server-side attacks: extracting the Server Licensor Certificate (SLC) private key and performing offline decryption of protected documents. The SLC key has no expiry or rotation mechanism, with a 255-year certificate validity (2002–2258), so whoever recovers it can decrypt every document the deployment ever protected, indefinitely. The author released SharpRMS, a unified tool combining the 2016 DisARMS client-side attacks with new server-side key extraction and decryption capabilities. The research frames the SLC as comparable to KRBTGT and the DPAPI domain backup key, though not equivalent to domain compromise.

Huntress·Sep 10, 04:00 UTC · 6d agoResearch

Hacking Public Wi-Fi DNS to Steal Credentials

Attackers can hijack public Wi-Fi DNS to redirect users to credential-stealing fake login pages; commenters debate HTTPS limits and mitigations like encrypted DNS.

The discussion examines how an attacker controlling DNS on shared or public Wi-Fi networks can redirect requests for legitimate services to attacker-controlled servers to steal credentials. Commenters analyze whether HTTPS and certificates mitigate the attack, noting attackers often rely on HTTP or browser trust quirks. Suggested defenses include encrypted DNS (DoH), DNSSEC, and travel routers running OpenWRT. No specific campaign, victims, or indicators are provided.

Schneier on Security·Aug 17, 11:18 UTC · 29d agoResearch1

OpenAI Pauses Astra Model Over Critical Cybersecurity Risk Concerns

Security Affairs·Aug 10, 11:16 UTC · Aug 10, 2026Exploit / PoC1

Unit 42 Deep and Dark Web Service Archives

Palo Alto Networks Unit 42 describes its Deep and Dark Web service monitoring underground forums for compromised credentials and leaked data.

Unit 42's Deep and Dark Web Service page describes monitoring underground forums to identify compromised credentials and leaked data. Analysts investigate suspicious content, escalate prioritized findings, and deliver actionable intelligence to customer SOCs. The page is a service description rather than a news report or incident disclosure.

Palo Alto Unit 42·Aug 18, 22:02 UTC · 28d agoIndustry

DoppelCart fraud network uses 119,000 fake shops to steal credit cards

DoppelCart, the largest documented fake-shop network, runs 119,000 domains impersonating 44,182 brands to steal payment card details via WebSocket-connected checkout pages.

German cybersecurity startup Nebty discovered DoppelCart, a network of more than 119,000 fake e-commerce domains, mostly in the .SHOP TLD, that harvest payment card details through fraudulent checkout pages. Over 105,000 shops remain active, impersonating 44,182 brands with discounts of up to 65%, and 96% of confirmed shops share identical build files resolving to 27 commerce backends. Checkout code exfiltrates card numbers, expiration dates, CVVs, cardholder names, contact details, and even bank one-time codes to attacker C2 over WebSockets in real time, potentially bypassing bank security controls. The network surpasses BogusBazaar, the previously largest documented fake-shop cluster with 75,000 sites and an estimated 850,000 fraudulent transactions.

BleepingComputer·Sep 8, 20:35 UTC · 7d agoPhishing & fraud

SMOKE#SCREEN Campaign Abuses ScreenConnect to Give Attackers Remote Control Access

Security Affairs·Aug 9, 11:05 UTC · Aug 9, 2026Threat actor1

Ukrainian lawyer's second career as a Conti coder earns him 4 years behind bars

Ukrainian lawyer turned Conti malware coder sentenced to four years in US prison, ordered to forfeit $25,042 in Bitcoin.

Oleksii Oleksiyovych Lytvynenko, 44, a trained lawyer who joined Conti under the handle "henry", pleaded guilty in June to conspiracy to commit wire fraud and was sentenced to four years. He coded a malware loader, researched targets using Google and ZoomInfo, and possessed data stolen from eight US victims who reported over $1.5 million in losses. Investigators found Cobalt Strike running and a Rocket.Chat session over Tor on his laptop when Gardaí arrested him in County Cork, Ireland in July 2023; he was extradited to the US in October 2025. Conti attacked over 1,000 victims across 47 US states and 31 countries, with payouts exceeding $150 million by January 2022.

The Register · Security·updated Sep 11, 16:07 UTC · 4d ago·first Sep 11, 12:15 UTC · 4d agoPolicy & legal 7 sources

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.

Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.

Rapid7 Blog·Sep 4, 12:00 UTC · 11d agoThreat actor in the wild1

FortiPAM Chrome Extension Vulnerability Lets Malicious Sites Control Browser Proxy and Record Tabs

Fortinet patched CVE-2026-84388 (CVSS 9.1) in its FortiPAM Chrome extension, letting malicious websites alter proxy settings, open tabs and record sessions.

The Fortinet FortiPAM Chrome extension flaw (CVE-2026-84388, CVSS 9.1) lets attacker-controlled domains be trusted as FortiPAM servers because a webRequest listener adds requested hostnames without verifying the initiator. A second issue exposes the extension's message interface to all URLs and accepts non-JWT tokens without validation, enabling unauthenticated session launches, proxy manipulation, tab control and recording; the consent dialog can also be bypassed via shadow-root clicks. Fortinet issued advisory FG-IR-26-168 after a July 17 report and released a fix on August 1, 2026, with no confirmed exploitation in the wild.

GBHackers·updated Sep 9, 14:33 UTC · 6d ago·first Sep 9, 13:18 UTC · 6d agoVulnerability 2 sourcesCVE-2026-84388