ZeroHour

Search: “Lightpost”

20 stories

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

RelightFormer: Feed-forward Generative Transformer for Multiview Object Relighting

RelightFormer is a feed-forward generative transformer for photorealistic single- and multi-view object relighting, trained on a 90K-object dataset.

Researchers introduce RelightFormer, a feed-forward generative transformer adapted from a video foundation model that performs direct image relighting without explicit intrinsic property estimation. The architecture injects target environment maps via a latent illumination module with cross-attention and uses permutation-invariant positional encodings for unordered multi-view inputs. Training relies on the newly constructed Laval Objaverse Dataset (LOD) with 90K objects and 39K unique illuminations, and the model shows state-of-the-art quality with strong zero-shot generalization across single-view, multi-view, and novel-view relighting.

Hugging Face daily papers · 10d agoAI research

PEEP: A Browser RAT Posing as a Chrome Extension

SOCRadar's STRU analyzed PEEP, an emerging Chromium-based RAT disguised as a Chrome extension enabling post-exploitation control of browsers.

SOCRadar's Threat Research Unit (STRU) identified and analyzed PEEP, a Chromium-based post-exploitation toolkit distributed as a browser extension. PEEP provides RAT-style capabilities while posing as a legitimate Chrome extension. It is assessed as an emerging threat worth monitoring by defenders.

SOCRadar · 12d agoMalware

Hierarchical NeRF with JAX3D for Volumetric Rendering, Novel-View Synthesis, and 3D Reconstruction

MarkTechPost tutorial implements a hierarchical NeRF in JAX using jax3d volume-rendering primitives for novel-view synthesis and 3D reconstruction.

The tutorial builds an end-to-end hierarchical Neural Radiance Field using JAX, Flax, Optax, and jax3d's volume-rendering functions (sample_along_rays, volume_rendering, sample_piecewise_constant_pdf). It implements positional encoding, skip connections, separate coarse and fine networks, and view-direction conditioning with hierarchical importance sampling. Training uses JAX JIT compilation, Adam optimization, exponential learning-rate decay, and gradient clipping. Evaluation covers PSNR, depth and opacity visualization, 360-degree rendering, and marching-cubes geometry extraction.

MarkTechPost · 3d agoAI research

Code to Cloud Platform Archives

Unit 42 archive page for Code to Cloud platform product-category articles; no new research or announcements.

This Unit 42 archive page lists product-category posts about Palo Alto Networks' Code to Cloud platform, which secures public cloud environments, SaaS applications and remote locations. It contains no new research, incidents, or announcements.

Palo Alto Unit 42 · 28d agoIndustry

Prisma Cloud Archives

Unit 42 archive page for Prisma Cloud product-category articles; contains no new research or announcements.

This Unit 42 archive page lists product-category posts about Prisma Cloud, Palo Alto Networks' cloud security platform for public clouds, SaaS applications and remote users. It contains no new research, incidents, or product announcements.

Palo Alto Unit 42 · 28d agoIndustry

Re: AI slops from Eve

oss-security moderator Solar Designer says he may reject repetitive AI-generated postings after debate over AI slop submissions.

oss-security list moderator Solar Designer responded to criticism triggered by AI-generated 'slop' postings from an account known as Eve, saying that in his moderator role he may start rejecting repetitive AI-generated submissions. The brief thread reflects open-source security community concern about automated content quality on the mailing list.

oss-securityupdated · 3d agofirst · 5d agoIndustry 12 sources1

12 Best CWPP Solutions Compared (2026): Features & Pricing

CWPP comparison favors Sysdig for container runtime depth, Prisma Cloud for workload breadth, and Aqua for cloud-native lifecycle security.

An editorial comparison of twelve CWPP solutions covers Trend Micro, Aqua, Prisma Cloud, Illumio, Microsoft Defender for Cloud, Fidelis, CrowdStrike and others, with pricing models and category notes. It names Sysdig (Falco lineage) the leader in Kubernetes/container runtime depth and Prisma Cloud the breadth benchmark across hosts, containers, and serverless. It flags Illumio as microsegmentation and Fidelis as NDR/XDR rather than classic CWPP.

GBHackersupdated · 13h agofirst · 1d agoIndustry 14 sources

What the AI Warning Letter Completely Missed

Opinion piece argues the recent AI warning letter identifies a risk window but omits which actors pose risks and who can mitigate.

This Dark Reading commentary critiques a recent AI warning letter for correctly identifying an approaching risk window while failing to name who is coming through it or who will close it. The piece is brief opinion commentary on AI risk discourse rather than a technical report.

Dark Reading · 13d agoAI safety & security

When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE

WordPress 7.0.4 patches an author-level RCE in how uploaded media is handed to ImageMagick.

WordPress maintenance release 7.0.4 includes a security fix that changes how uploaded media is passed to ImageMagick, closing a path that let a logged-in author turn a crafted image upload into remote code execution. Patchstack's analysis explains the flaw as a file-type handling issue where a PNG may not be treated as a PNG. The text does not mention a CVE ID or observed exploitation, but the flaw affects extremely widely deployed software.

Patchstack · Aug 12, 2026Vulnerability

Re: Retrospective by 'gpg.fail' authors

Peter Gutmann replies to gpg.fail retrospective, pointing to PGP's arbitrary packet format as root of many past vulnerabilities.

Peter Gutmann posted a follow-up on oss-security referencing an Hacker News discussion of the gpg.fail authors' retrospective. The thread argues that a recurring source of severe PGP vulnerabilities is the format's permissive packet system, where a PGP message is a practically arbitrary stream of packets. This is discussion and retrospective analysis rather than a new disclosure.

oss-securityupdated · 5h agofirst · 3d agoResearch 8 sources4

Metasploit Wrap Up: Payloads and Exploits, and Scanners, Oh my!

Rapid7's weekly Metasploit roundup highlights newly added exploit modules, payloads, and scanners in the Metasploit Framework.

Rapid7 published its weekly Metasploit Wrap Up summarizing community contributions to the Metasploit Framework, including new exploit modules, payloads, and scanners. No article text was available; the post serves as a routine digest for practitioners tracking newly packaged modules.

Rapid7 Blog · 19d agoTools

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

SOCRadar disclosed PEEP, a post-exploitation Chromium extension toolkit that turns Chrome and Edge into host-level backdoors via native messaging and C2 polling.

SOCRadar researchers detailed PEEP, a Chromium-based post-exploitation toolkit masquerading as a 'Smart Bookmarks' extension injected directly into Chrome and Edge profiles by forging Secure Preferences integrity values, bypassing Web Store checks. A native-messaging host binary (nm_host.exe) extends the browser agent to host-level command execution, file management, credential theft, and session hijacking, while the extension polls C2 endpoints at 206.237.30.232 or xfjcc.fun every 30 seconds over plaintext HTTP and exfiltrates browsing history, cookies, and tab metadata. PEEP is derived from the open-source RedExt red teaming framework, adds PowerShell persistence scripts, and includes a Linux-targeting Python script, suggesting cross-platform intent. The activity is unattributed but contains Chinese-language artifacts; a C2 /health endpoint showed 34 agent entries and 10 active sessions.

The Hacker News · 9d agoMalware in the wild1

Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware

Huntress uncovered post-DEF CON phishing via X direct messages using a malicious Google Doc to deliver AMOS and NetSupport RAT malware.

Huntress uncovered a phishing campaign targeting attendees after Black Hat and DEF CON. Attackers used X direct messages pointing to a malicious Google Doc as the delivery vehicle. Payloads include AMOS, a macOS infostealer, and the NetSupport RAT, among other malware.

Huntress · 28d agoPhishing & fraud

ICE Wants to Know Everyone Who Bought a Certain Green Beanie From REI in the Last 2 Years

DHS subpoenaed REI for all Minneapolis-area customers who bought a specific green beanie since 2024, part of an investigation into 39 ICE protest defendants.

Court filings allege Homeland Security Investigations agents subpoenaed REI in March for transaction records of all persons in the greater Minneapolis–St. Paul area who purchased a specific dark green beanie since 2024. The subpoena was one of 92 sent in a federal case against 39 people, including journalists, who attended an ICE protest at a church. Companies responded differently: T-Mobile handed over six months of a defendant's call and text logs, Google refused a request for YouTube viewers, Reddit withdrew after a First Amendment objection, and Meta pushed back on at least one summons. The 1509 customs summonses require no judicial oversight, and the total number issued under the Trump administration is unknown.

WIRED · Security · 12d agoPolicy & legal

Campaign Evolution: Darkleech to Pseudo

Unit 42 traces the pseudo-Darkleech campaign, which compromises websites to inject scripts redirecting visitors to exploit kits delivering ransomware.

Palo Alto Networks Unit 42 analyzed the evolution of the pseudo-Darkleech campaign, which injects malicious script into compromised Apache, IIS and WordPress sites to redirect visitors to exploit kits such as Angler and Neutrino. The original Darkleech Apache module infected thousands of servers starting in 2012 and delivered Blackhole EK until that kit disappeared after Paunch's 2013 arrest. From 2015 onward, pseudo-Darkleech delivered ransomware families like CryptoWall and TeslaCrypt, and by early 2016 its injected scripts added obfuscated numeric blocks with frequently changing separator characters. Unit 42 tracks these patterns to help defenders identify compromised websites.

Palo Alto Unit 42 · Aug 17, 2026Threat actor in the wild

FlyWP Adds Proactive Vulnerability Protection with Patchstack

FlyWP integrated Patchstack into its managed WordPress hosting platform via a new FlySecurity Pro add-on for proactive vulnerability protection.

FlyWP, a managed WordPress cloud hosting and server management provider, has integrated Patchstack vulnerability intelligence into its platform. The new FlySecurity Pro add-on gives customers proactive protection against WordPress vulnerabilities from a single dashboard. The announcement is a vendor partnership rather than a new flaw or incident.

Patchstack · Aug 17, 2026Tools1

Top 10 Best Cloud Workload Protection (CWPP) Solutions in 2026

Editorial scorecard ranks 2026 cloud workload protection platforms, placing Prisma Cloud first, Sysdig second, and CrowdStrike third on detection quality.

A research-based scorecard rates ten cloud workload protection (CWPP) platforms across runtime depth, container/Kubernetes support, coverage breadth, cloud context, and value. Palo Alto Prisma Cloud leads at 8.9, followed by Sysdig at 8.8 and CrowdStrike at 8.6, with Aqua Security tying CrowdStrike at 8.6. The piece argues agent-versus-agentless is a false choice, with leaders now pairing agentless visibility with eBPF-based runtime sensors. Scores are editorial assessments, not lab benchmarks.

Cyber Security News · 5d agoIndustry1

Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms

Wordfence finds an unauthenticated arbitrary file upload flaw in Gravity Forms (1M+ installs) that can lead to remote code execution.

On August 9, 2026, Wordfence's Argus scanner discovered an unauthenticated arbitrary file upload vulnerability in the WordPress plugin Gravity Forms, estimated at over one million active installations. Attackers can write files with attacker-selected extensions to a public temporary upload directory, potentially enabling remote code execution. The post does not mention a CVE identifier or observed exploitation.

Wordfence · 15d agoVulnerability