ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Monday.com”

11 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 3AI industry 1Model release 1Industry 1Phishing & fraud 1
SeverityAllcritical 3high 0medium 2low 0info 2

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Inside Knight Office, a New M365 AiTM Phishing Kit

Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.

Huntress investigated an August 18, 2026 adversary-in-the-middle attack using the Knight Office phishing kit, which captured Microsoft 365 session tokens via a DocuSign-style lure routed through a Monday.com tracking link and a compromised Joomla site. After token capture, the actor enrolled an unauthorized host in Microsoft Entra ID and bound a Windows Hello for Business key credential to the account. The kit's operator console, found at IP 104.37.188.94, is built on Python Flask and hosts at least 25 .vu phishing domains. Telemetry links the kit to at least nine token-replay logins in two weeks and roughly 700 reported lure emails since April.

Huntress · 13d agoPhishing & fraud in the wild1

A week in security (August 31 – September 6)

Malwarebytes publishes its weekly security recap covering cyber news from August 31 through September 6.

Malwarebytes Labs' recurring 'A week in security' digest aggregates the past week's cybersecurity stories. The published text contains only newsletter boilerplate without specific incident, vulnerability, or threat-actor details.

Malwarebytes Labs · 9d agoIndustry

ISC Stormcast For Friday, September 11th, 2026 https://isc.sans.edu/podcastdetail/10090, (Fri, Sep 11th)

SANS ISC released its daily Stormcast podcast for September 11, 2026; the feed provides no story details.

The SANS Internet Storm Center published its daily ISC Stormcast podcast episode for Friday, September 11, 2026. The feed contains only the standard copyright notice and links, without any story details.

SANS Internet Storm Centerupdated · 10h agofirst · 5d agoIndustry 5 sources

HuggingFace: Security.txt

Hugging Face published a security.txt file, prompting limited Hacker News discussion of the RFC 9116 disclosure standard.

Hugging Face's security.txt file, which lists its security contact and disclosure channels per the RFC 9116 standard, drew attention on Hacker News. The RFC 9116 standard lets organizations publish where and how security researchers should report issues, but the submission received only one comment.

Hacker News · securityupdated · 4d agofirst · 4d agoIndustry 2 sourcesHN 22↑ · 1 comments

Serial Microsoft 0-day hunter drops yet another Defender exploit

Researcher Nightmare Eclipse released ShieldCrash, a Microsoft Defender zero-day PoC that bypasses September patches and reads files as SYSTEM.

Zero-day researcher Nightmare Eclipse (MSNightmare) published ShieldCrash, their 11th Microsoft zero-day, a proof-of-concept bypass of the ShieldBreak patch (CVE-2026-69414), which itself had bypassed the fix for RoguePlanet (CVE-2026-50656). ShieldCrash works on Windows 10, Windows 11, and Windows Server systems that have applied the September 2026 patches and allows arbitrary file reads as SYSTEM, though not arbitrary writes or a full SYSTEM shell. Microsoft has not said when it plans to patch the issue. The researcher recently also released zero-days affecting CrowdStrike Falcon (FalconFlank), Kaspersky endpoint antivirus (HardBreacher, patched), and Gen Digital's Avast (PrettyPrague).

The Register · Securityupdated · 6d agofirst · 6d agoExploit / PoC 4 sourcesCVE-2026-69414CVE-2026-50656

Upcoming Speaking Engagements

Bruce Schneier lists upcoming 2026 speaking engagements at LAcon V, Elevate Festival, CanSecWest, and events in Anaheim, Toronto, Vancouver, and Montreal.

Bruce Schneier posted his upcoming schedule, including LAcon V in Anaheim, an online League of Women Voters event on September 22, 2026, Elevate Festival in Toronto (September 22-24), CanSecWest 2026 in Vancouver (September 30-October 1), and ATTENTION: Democracy, Rebuilt in Montreal (October 21-23, 2026).

Schneier on Security · Aug 15, 2026Industry

PaperCut Zero-Day Under Active Attack: Emergency Patch Released

PaperCut warns that a zero-day in NG and MF print management products is being actively exploited, shipping emergency patches with no CVE assigned yet.

PaperCut Software confirmed active exploitation of a zero-day affecting PaperCut NG and MF, with confirmed customer incidents, and released emergency patches on Friday ahead of technical details or a CVE assignment. The company urges customers to restrict web access to trusted IP addresses, disconnect application servers from the internet, and watch for indicators including tampered or truncated server.log files, database error strings, and suspicious activity involving pc-app.exe. The article recalls the May 2023 exploitation of CVE-2023-27350 and CVE-2023-27351 by the financially motivated Lace Tempest group, a Clop ransomware RaaS affiliate, though no attacker attribution has been given for the current campaign.

Security Affairs · 17d agoExploit / PoC in the wildCVE-2023-27350CVE-2023-273511

Print management outfit PaperCut is under 0-day attack, and it’s drawing customers’ blood

PaperCut print management software is under active zero-day attack, with only an unofficial emergency patch or server shutdown available as mitigation.

Attackers are actively exploiting an unpatched zero-day vulnerability in PaperCut print management software. The only available fix is an unvalidated, unofficial emergency patch, or taking affected servers offline. PaperCut is widely deployed in enterprise environments, giving exposed instances a broad and consequential attack surface.

The Register · Security · 19d agoExploit / PoC in the wild