ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “NetScaler”

40 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 73Vulnerability 69Ransomware 60Threat actor 16Data breach 14Industry 10Malware 6Policy & legal 4Advisory 2AI tools & infra 2Model release 2Phishing & fraud 1AI safety & security 1
SeverityAllcritical 189high 53medium 5low 6info 7

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

CISA Warns of Citrix NetScaler Authentication Bypass Vulnerability Exploited in Attacks

CISA adds exploited Citrix NetScaler authentication bypass CVE-2026-19490 to the KEV catalog; federal agencies must patch by September 12.

CISA added CVE-2026-19490, a CWE-288 authentication bypass affecting NetScaler ADC and Gateway deployments configured as AAA virtual servers or Gateway services (including SSL VPN, ICA Proxy, and RDP Proxy), to the Known Exploited Vulnerabilities catalog. Citrix released fixes on August 19, 2026; honeypots recorded 56 attack attempts between September 3 and 8 after a public PoC, though no confirmed production compromises have been reported. Affected builds include 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21; newer installations require SAML IdP configuration to be exposed.

Cyber Security Newsupdated · 5d agofirst · 5d agoExploit / PoC in the wild 5 sourcesCVE-2026-19490

AL26-019 - Vulnerabilities impacting Citrix NetScaler ADC and NetScaler Gateway - CVE-2026-19490 and CVE-2026-19489

Canadian Cyber Centre alerts on Citrix NetScaler ADC/Gateway flaws CVE-2026-19490 (authentication bypass) and CVE-2026-19489 (buffer overflow), urging emergency patching.

The Canadian Centre for Cyber Security issued alert AL26-019 covering two Citrix NetScaler vulnerabilities disclosed in a vendor advisory on August 19, 2026. CVE-2026-19490 (CWE-288) allows a remote unauthenticated attacker to bypass authentication on appliances configured as a Gateway for SSL VPN, ICA Proxy, CVPN, RDP Proxy, or as an AAA virtual server. CVE-2026-19489 (CWE-120) is a classic buffer overflow that may cause memory overflow, unpredictable behavior, or denial-of-service conditions. Affected appliances are vulnerable when configured as a SAML IdP; fixed versions include 14.1-73.32, 13.1-63.21, and 13.1-37.277 for FIPS.

Canadian Centre for Cyber Security · 11d agoAdvisory 3 sourcesCVE-2026-19490CVE-2026-19489

Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers

Citrix patches critical NetScaler Gateway and AAA authentication bypass CVE-2026-19490 (CVSS 9.3) plus a SIP ALG memory overflow flaw; exploitation attempts observed.

Citrix fixed CVE-2026-19490 (CVSS 9.3), an authentication bypass affecting customer-managed NetScaler ADC and Gateway appliances configured as Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual servers, and CVE-2026-19489 (CVSS 8.8), a memory overflow causing DoS when SIP ALG is enabled in Large Scale NAT groups. Updates are available in versions 14.1-73.32, 13.1-63.21, and corresponding FIPS/NDcPP builds, while Citrix-managed cloud services were already patched. The flaws were reported by Samarth Vashisht of JPMorgan Chase's penetration-testing team, and Previdian later observed 10 exploitation attempts against CVE-2026-19490 from six unique IP addresses in Australia, Germany, Japan, and the US, with no confirmed compromise.

The Hacker News · 11d agoVulnerability in the wildCVE-2026-19489CVE-2026-19490CVE-2026-8451

Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490)

Citrix patched a critical authentication bypass, CVE-2026-19490, in NetScaler Gateway and NetScaler ADC, urging customers to upgrade immediately.

Citrix has patched two flaws in NetScaler ADC and NetScaler Gateway. CVE-2026-19490 is a critical authentication bypass (CVSS v4.0 9.3) that works when the appliance is configured as an SSL VPN, ICA Proxy, CVPN, RDP Proxy Gateway or AAA virtual server, with additional conditions depending on firmware and SAML configuration. A second flaw, CVE-2026-19489 (CVSS 8.8), is a memory overflow that can cause denial of service when SIP ALG is enabled on LSN setups. Rapid7 had not observed exploitation as of August 19, 2026, but urged emergency patching; a signature-based mitigation is available via NetScaler Console.

Help Net Security · 26d agoVulnerabilityCVE-2026-19490CVE-2026-19489

CVE-2026-19490: Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway

CVE-2026-19490 is a critical unauthenticated authentication bypass in Citrix NetScaler ADC and Gateway, remotely exploitable without user interaction.

An advisory published August 19, 2026 describes CVE-2026-19490, a critical authentication bypass affecting Citrix NetScaler ADC and NetScaler Gateway. The flaw carries a CVSS v4.0 base score of 9.3 and is remotely exploitable by unauthenticated attackers over the network without user interaction or elevated privileges. NetScaler ADC and Gateway are widely deployed enterprise products positioned at or near the network perimeter, providing load balancing, SSL/TLS offloading, and secure remote access. The text does not state whether exploitation has been observed in the wild.

Rapid7 Blog · 27d agoVulnerabilityCVE-2026-194901

Previously patched Citrix NetScaler flaw exploited in the wild (CVE-2026-8452)

Actively exploited Citrix NetScaler flaw CVE-2026-8452, patched in June, now added to CISA KEV; attackers deploy web shells and run discovery commands.

CISA added CVE-2026-8452, a memory overflow vulnerability in Citrix NetScaler ADC/Gateway, to its Known Exploited Vulnerabilities catalog on August 26, 2026, giving federal agencies until August 29 to remediate. Citrix disclosed and patched the flaw on June 30, 2026 in versions 14.1-72.61, 13.1-63.18, and 13.1-37.272. watchTowr Labs found the flaw can be chained into unauthenticated remote code execution and released a PoC on August 14. Previdian and Defused reported exploitation with web shells named x.php and z.php from at least three unique source IPs.

Help Net Security · 20d agoExploit / PoC in the wildCVE-2026-8452CVE-2015-3246CVE-2015-5287+3 CVEs

You’re Back In The Room (Citrix NetScaler Pre-Auth RCE CVE-2026-8452(?))

watchTowr Labs details a pre-authentication remote code execution flaw, tracked as CVE-2026-8452, in Citrix NetScaler appliances.

watchTowr Labs published technical analysis of a pre-authentication remote code execution vulnerability in Citrix NetScaler, tentatively assigned CVE-2026-8452. The CVE identifier is marked as provisional in the write-up. No confirmation of in-the-wild exploitation is provided in the available text.

watchTowr Labs · Aug 14, 2026Exploit / PoCCVE-2026-8452

Citrix security advisory (AV26-645) – Update 3

Canada's Cyber Centre updates Citrix advisory as CVE-2026-8451 and CVE-2026-8452 in NetScaler ADC/Gateway are confirmed exploited in the wild.

The Canadian Centre for Cyber Security updated advisory AV26-645 on August 26, 2026, covering critical vulnerabilities in Citrix NetScaler ADC and Gateway (versions 14.1 before 14.1-72.61 and 13.1 before 13.1-63.18, plus FIPS builds). Open-source reporting indicates CVE-2026-8451 and CVE-2026-8452 are being exploited in the wild. Update 3 references related CISA action, and patched builds were released starting June 30, 2026.

Canadian Centre for Cyber Security · 20d agoExploit / PoC in the wildCVE-2026-8451CVE-2026-8452

U.S. CISA adds Red Hat, Linux Kernel, Ajax.NET Professional, Microsoft SQL Server, and Citrix NetScaler flaws to its Known Exploited Vulnerabilities catalog

CISA added six flaws, including actively exploited CVE-2026-8452 in Citrix NetScaler, to its Known Exploited Vulnerabilities catalog with federal patch deadlines.

CISA added six vulnerabilities to its KEV catalog: CVE-2015-3246 and CVE-2015-5287 (Red Hat libuser race condition and ABRT privilege escalation), CVE-2019-1068 (Microsoft SQL Server RCE), CVE-2021-23758 (Ajax.NET Professional deserialization), CVE-2022-0995 (Linux Kernel out-of-bounds write) and CVE-2026-8452 (Citrix NetScaler ADC/Gateway memory buffer flaw). CVE-2026-8452 has been observed under active exploitation in the wild and can cause denial-of-service. Under BOD 22-01, federal civilian agencies must patch CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, and the rest by September 9, 2026.

Security Affairs · 19d agoExploit / PoC in the wildCVE-2015-3246CVE-2015-5287CVE-2019-1068+3 CVEs

Week in review: Compromised Zimbra servers, previously patched Citrix NetScaler flaw exploited

Help Net Security's weekly digest highlights 274 compromised Zimbra servers, Gitea and Citrix NetScaler KEV additions, a PaperCut zero-day, and a suspected Iran-linked power plant attack.

The roundup reports at least 274 internet-facing Zimbra instances compromised via CVE-2026-73570, critical Gitea CVE-2026-60004 added to CISA's KEV catalog after exploitation began, and previously patched Citrix NetScaler flaw CVE-2026-8452 exploited in the wild. It also covers PaperCut NG/MF zero-day attacks, a suspected Iran-linked shutdown of a UK power plant, an FBI seizure of domains tied to a China-linked group that hit NASA, DOJ and the Senate, a cyberattack disrupting Boston Scientific, and the Manchester Airports Group breach. Additional items include Chameleon SEO poisoning phishing, Android car head unit proxy botnet malware, ReliaQuest social engineering by ShinyHunters, fake OpenAI Codex macOS malware, and AI-related workforce and supply chain interviews.

Help Net Security · 17d agoIndustry in the wildCVE-2026-73570CVE-2026-60004CVE-2026-8452

Exploits in the Wild for Citrix ADC and Citrix Gateway Directory Traversal Vulnerability CVE-2019

Unit 42 confirmed in-the-wild exploitation of CVE-2019-19781, a critical Citrix ADC/Gateway directory traversal flaw enabling unauthenticated file access and RCE.

CVE-2019-19781, a CVSS 9.8 directory traversal vulnerability, affects all supported versions of Citrix ADC and Citrix Gateway. Unit 42 captured multiple exploitation attempts in the wild and identified scanning activity from roughly 700 Shodan-exposed hosts. The flaw stems from improper pathname handling in Apache, allowing unauthenticated attackers to read sensitive files like smb.conf or achieve remote code execution via crafted XML. Palo Alto Networks released Threat Prevention signatures 57497 and 57570 on January 7, 2020, while Citrix published advisories CTX267027 and CTX267679 with responder policy mitigations pending a late-January patch.

Palo Alto Unit 42 · 29d agoExploit / PoC in the wildCVE-2019-19781

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA added four actively exploited vulnerabilities—Fortinet buffer overflow, Citrix NetScaler and Cisco auth bypasses, and a Chromium V8 write—to the KEV Catalog.

CISA added CVE-2025-25249 (Fortinet heap-based buffer overflow), CVE-2026-19490 (Citrix NetScaler authentication bypass), CVE-2026-87491 (Google Chromium V8 out-of-bounds write), and CVE-2026-20079 (Cisco Firewall Management Center authentication bypass) to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of these high-risk vulnerabilities on exposed assets and verify whether systems were compromised before patching. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog remediation.

CISA Advisories · 6d agoExploit / PoC in the wildCVE-2025-25249CVE-2026-19490CVE-2026-87491+1 CVEs

CISA Adds Six Exploited Flaws to KEV, Including NetScaler, Linux, and SQL Server Bugs

CISA added six actively exploited flaws to KEV, led by Citrix NetScaler CVE-2026-8452, with federal patch deadlines set.

CISA added six flaws to the KEV catalog on August 27, 2026, citing evidence of active exploitation, led by CVE-2026-8452, an improper buffer restriction in Citrix NetScaler ADC and Gateway that can cause denial-of-service. Defused Cyber and Previdian reported active exploitation of CVE-2026-8452, with 36 attempts over 12 days from 12 attacker IPs deploying web shells x.php and z.php. The other additions cover SQL Server RCE (CVE-2019-1068), Linux kernel out-of-bounds write (CVE-2022-0995), Red Hat ABRT and libuser privilege escalations (CVE-2015-5287, CVE-2015-3246), and AjaxPro deserialization RCE (CVE-2021-23758). FCEB agencies must patch CVE-2019-1068 and CVE-2026-8452 by August 29, 2026, and the rest by September 9, 2026.

The Hacker News · 20d agoExploit / PoC in the wildCVE-2019-1068CVE-2026-8452CVE-2022-0995+3 CVEs

New infosec products of the week: August 21, 2026

Weekly product roundup covering NETSCOUT outbound DDoS mitigation, F5 AI Gateway enhancements, Intezer Workflows, and Tufin TOS 5.3.

NETSCOUT extended Adaptive DDoS Protection to automatically mitigate outbound attack traffic for service providers. F5 enhanced its AI Gateway and integrated it into the F5 AI Security Platform for unified AI access governance. Intezer launched Workflows, native automation and response inside its platform without a separate SOAR, and Tufin released Orchestration Suite 5.3 with AI-powered Segmentation Intelligence for multi-vendor environments.

Help Net Security · 26d agoTools

August 2026 CVE Landscape

Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.

Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.

Recorded Future · 8d agoVulnerability in the wildCVE-2025-62593CVE-2026-72898CVE-2026-9198+4 CVEs

Pyramid Solutions NetStaX EtherNet/IP Stack

CISA flags critical CVE-2026-78012 (CVSS 9.8) stack buffer overflow in Pyramid Solutions NetStaX EtherNet/IP stacks below v5.6.1, risking crashes or remote attack vectors.

CISA republished Pyramid Solutions' advisory for CVE-2026-78012, a CWE-121 stack-based buffer overflow in the NetStaX EtherNet/IP stack versions prior to 5.6.1, scored CVSS 9.8. Large Class 3 explicit-message requests can exceed the application-side receive buffer without generating a CIP error, potentially causing memory corruption, device crashes, or a silent remote attack vector. All eight adapter and scanner DLL/development kit variants, including CIP Security editions, are affected across critical manufacturing, energy, water, and chemical sectors. No public exploitation has been reported.

CISA Advisories · 12d agoAdvisoryCVE-2026-78012

Threat Matrix: Mapping threats across cloud web applications

Microsoft released a Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework mapping threats to cloud-hosted web apps and serverless platforms.

Microsoft introduced the cloud web applications threat matrix, which organizes attack techniques for cloud-hosted web apps and serverless platforms using MITRE ATT&CK tactics, from resource development through impact. The framework covers attack paths spanning application code, managed runtimes, workload identities, and deployment pipelines, cataloging techniques such as subdomain takeover, code injection in connected repositories, compromised registry images, exposed admin interfaces, and serverless trigger injection. It builds on Microsoft's earlier Kubernetes and storage services matrices to help defenders identify visibility gaps, prioritize hardening, and plan investigations in cloud-native environments.

Microsoft Security Blog · 6d agoTools

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.

The week's top stories included a suspected China-nexus APT exploiting VMware vCenter CVE-2026-59310 (CVSS 9.8), a directory-traversal flaw enabling arbitrary code execution, with backdoors, reverse SSH and Babuk-derived ransomware deployed, per QUIRSO. NCSC-NL reported active exploitation of macOS Screen Sharing flaw CVE-2026-65400 (CVSS 9.8) to install Monero miners on systems with port 5900 exposed. Lazarus Group exploited Windows zero-day CVE-2026-68820 (CVSS 7.0) in Operation Dream Job, delivering ForestTiger and Troy backdoors to defense and aerospace targets. GeoServer patched a critical SQL injection flaw exploited within hours of disclosure, and Jamf analyzed the new Amnesia Stealer for macOS with live browser control.

The Hacker News · 29d agoExploit / PoC in the wildCVE-2026-59310CVE-2026-65400CVE-2026-688201

[Control Systems] National Instruments security advisory (AV26-856)

Canada's Cyber Centre relayed National Instruments advisories for memory corruption, out-of-bounds read, and out-of-bounds write flaws in LabVIEW versions.

The Canadian Centre for Cyber Security published control systems advisory AV26-856 covering National Instruments LabVIEW. Affected versions include releases before 23.0.0, 23.3.10, 24.3.7, 25.3.5, and 26.3.1. The flaws include memory corruption, an integer conversion out-of-bounds read, and an integer overflow out-of-bounds write. Users and administrators are urged to review the links and apply NI security updates.

Canadian Centre for Cyber Security · 18d agoAdvisory

Week in review: Records allegedly stolen from Azure tenants, Medusa ransomware hits 500+ orgs

Week in review: Medusa ransomware hit 500+ orgs per CISA, millions of Azure tenant records allegedly stolen, SafePal and French tax authority breaches disclosed.

Help Net Security's weekly roundup covers the FBI, CISA, and HHS joint advisory update reporting Medusa ransomware has breached more than 500 organizations since June 2021, and threat actor TheHatman's claim of millions of employee records stolen from Azure tenants of Fortune 500 firms including McDonald's, Vodafone, Kyndryl, and Tata Consultancy Services, per Hudson Rock. It also covers the SafePal breach affecting 39,798 customers, France's DGFiP breach exposing data on 678,000 individuals, and UT San delaying its fall semester after a cyberattack. Security items include critical unauthenticated GitLab flaw CVE-2026-19478, an actively exploited patched macOS Screen Sharing flaw deploying a cryptominer, US charges against 17 Mabna Institute Iranian hackers over 31TB of stolen academic data, and Google Mandiant's AI agents finding 100+ high-severity vulnerabilities.

Help Net Security · 24d agoData breach in the wildCVE-2026-19478

A Graph-Based Approach for Mapping Kernel-Level Telemetry to MITRE ATT&CK

Trace2ATT&CK maps eBPF kernel telemetry to MITRE ATT&CK via provenance graphs and RAG with local open-weights LLMs, validated on 347 Atomic Red Team tests.

Trace2ATT&CK collects kernel-level events via eBPF, correlates attacker commands into a provenance graph, and derives compact graph representations suitable for LLM-based reasoning, mapping behavior to MITRE ATT&CK techniques with ranked candidates and rationales. Mapping uses both pure LLM prompting and retrieval-augmented generation grounded in the ATT&CK knowledge base. It was evaluated on 347 Linux Atomic Red Team tests using locally deployed open-weights LLMs. RAG consistently improved ATT&CK mapping over pure prompting, and provenance graphs substantially outperformed raw telemetry, without compromising data confidentiality.

arXiv cs.CR · 4d agoResearch

The complex corporate web behind a $3.2 billion AI data center

Ars Technica probes diffuse accountability behind TeraWulf's $3.2B Lake Mariner AI data center after a June fire exposed safety and job gaps.

A June fire at the Lake Mariner data center in Somerset, New York exposed missing alarms, a nonfunctioning suppression system, and dry hydrants, highlighting how responsibility is split across TeraWulf (owner-operator), Fluidstack (operator), Google (lease guarantees and equity warrants), and Anthropic (compute customer). The article details local concerns over the gap between promised 165 permanent jobs and a projected 35-40, socialized grid costs, and Governor Hochul's moratorium on hyperscaler development. Anthropic's February 2026 pledge to cover electricity price increases applies to the site but leaves other commitments unverified.

Ars Technica · AI · 8d agoAI industry

Risky Bulletin: The EU publishes its upcoming cybersecurity standards

ETSI releases 17 draft cybersecurity standards vendors must meet when the EU Cyber Resilience Act takes effect in December 2027.

The European Telecommunications Standards Institute published 17 interim draft standards covering operating systems, routers, firewalls, VPNs, SIEMs, browsers, password managers, smart home devices, toys and wearables. They mandate basic security features such as post-sale updates, shipped SBOMs, modern cryptography and secure-by-default settings; public comments run until November, with final versions expected in December, one year before CRA compliance begins in December 2027. The newsletter also reports Irregular taking responsibility for AI test-environment escapes involving Anthropic and Meta frontier models, a breach at France's tax agency exposing 678,000+ citizens' data claimed by hacker ZeroBytes, and Kazakhstan eGov data covering 15 million citizens listed for sale on an underground forum. Additional briefs cover a $3.2 million Harmony Protocol theft crashing the ONE token 40%, Columbus Police still restoring systems two years after ransomware, DDoS attacks on Threema's provider, and Ukraine's GUR claiming a cyberattack on Wildberries.

Risky Business News · Aug 17, 2026Policy & legal1

Cisco security advisory (AV26-876)

Canada's Cyber Centre relayed Cisco advisories covering a Nexus 9000 Silicon One RCE, IOS XR hardening, and denial-of-service flaws across IP phone lines.

The Canadian Centre for Cyber Security advisory AV26-876 lists Cisco vulnerabilities affecting IOS XR, Nexus 9000 Series switches, and several IP phone series. Included are a Nexus 9000 Silicon One remote code execution vulnerability, a September 2026 IOS XR security hardening release, and SIP software denial-of-service flaws in Desk Phone 9800, IP Phone 7800/8800, and Video Phone 8875. The Cyber Centre urges users and administrators to review the Cisco advisories and apply updates as they become available. No active exploitation is reported in the advisory.

Canadian Centre for Cyber Security · 12d agoAdvisory

Check Point Patches Critical VPN Vulnerabilities

Check Point patches two critical unauthenticated RCE flaws (CVE-2026-85102, CVE-2026-85103) in VPN gateways and firewalls; no exploitation observed.

Check Point released patches for CVE-2026-85102 and CVE-2026-85103, two critical vulnerabilities (CVSS 9.8) enabling unauthenticated remote code execution in products using VPN functionality. CVE-2026-85102 involves improper validation of certificate data during VPN negotiation, while CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoding flow. Updates cover versions R82.10, R82, and R81.20; manually defining VPN rules is offered as a mitigation, though it does not apply to locally managed Spark Firewall instances. Check Point discovered both flaws internally and reports no evidence of exploitation in the wild.

SecurityWeekupdated · 2d agofirst · 4d agoVulnerability 9 sourcesCVE-2026-85102CVE-2026-85103CVE-2026-16232+1 CVEs1

[Control Systems] National Instruments security advisory (AV26-914)

Canada's Cyber Centre relayed a National Instruments advisory covering improper access control and cleartext sensitive-information flaws in NI SystemLink and SystemLink Server.

Advisory AV26-914, dated September 11, 2026, notes that NI SystemLink and SystemLink Server prior to or equal to 2026 Q3 Patch 1 are affected by improper access controls and storage of sensitive information in cleartext. The Canadian Centre for Cyber Security urges users and administrators to review the vendor's links and apply available security updates.

Canadian Centre for Cyber Security · 4d agoAdvisory2

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business News · 9d agoPhishing & fraud in the wild1

Security Affairs newsletter Round 594 by Pierluigi Paganini – INTERNATIONAL EDITION

Weekly Security Affairs newsletter aggregates top stories including Cisco FMC exploitation, Qilin ransomware, Chrome zero-days, and Berlin leak.

Pierluigi Paganini's Security Affairs newsletter Round 594 (International Edition) rounds up the week's security headlines. Topics include attackers exploiting a critical Cisco FMC flaw to deploy Qilin ransomware, SonicWall mass exploitation linked to a UK council attack, multiple CISA KEV additions, Chrome zero-days used by four nation-state actors, a $320 million Liquid Network theft, and a Berlin ransomware data leak. It also covers AI security items such as agent sandbox failures and distillation campaigns by Chinese AI firms.

Security Affairs · 2d agoIndustry in the wildCVE-2026-42016CVE-2026-42018CVE-2026-82329+1 CVEs1

Webinar: The forgotten Google Workspace access that can lead to a breach

BleepingComputer and Material Security will host a September 23, 2026 webinar on breaches caused by forgotten third-party Google Workspace integrations.

BleepingComputer announced a live webinar on September 23, 2026, titled 'Breach autopsy: How fast-growing companies are breached through Google Workspace' in partnership with Material Security. Speakers include Rajan Kapoor, VP of Security at Material Security, and Rick Fitzgerald, President of Fireside Consulting LLC. The session will examine real documented Google Workspace breaches involving overly permissive third-party integrations, social engineering entry paths, first-hours breach response decisions, and high-value security controls for lean security teams.

BleepingComputer · 7d agoIndustry

'HTTP Terminator' Hunts for Novel Desync Attacks

PortSwigger's James Kettle discusses HTTP Terminator, an AI-powered open source tool that uncovered new HTTP request-smuggling (desync) techniques.

PortSwigger researcher James Kettle spoke with Dark Reading about HTTP Terminator, an AI-powered open source tool built to hunt for novel HTTP desync vulnerabilities. The tool has already discovered new HTTP request-smuggling techniques, extending Kettle's prior desync research.

Dark Reading · 20d agoTools

Researchers open-source a Wi-Fi cyber range for security training

NTNU and Aegean researchers open-source a software-emulated Wi-Fi cyber range using mac80211_hwsim with LLM-assisted scenario building.

Researchers from the Norwegian University of Science and Technology and the University of the Aegean published a design and prototype for a cyber range dedicated to IEEE 802.11 security training, emulating access points and clients with mac80211_hwsim, Linux namespaces, hostapd, wpa_supplicant, dnsmasq, and FreeRADIUS. The platform bundles Aircrack-ng, Wireshark, and custom tools WPAxFuzz and Bl0ck, and can convert plain-language scenario descriptions into deployable definitions via a locally hosted Llama model. A working prototype covering scenario creation and deployment is on GitHub; monitoring, access control, and orchestration zones remain future work.

Help Net Security · 23d agoTools1

Self-Verifying Anomaly Detection using Explainable AI for Cybersecurity of DER Networks

ExCYDER framework self-verifies anomaly detection alerts for DER power grids using LightGBM and SHAP, reaching over 98% detection accuracy.

The paper presents ExCYDER, an explainable AI anomaly detection framework for Distributed Energy Resource networks that combines LightGBM with SHAP to validate whether each model decision aligns with its feature-attribution evidence. On a realistic DNP3 dataset it achieved over 98% detection accuracy, 14.5 ms SHAP latency per alert, and confidence deviation within 5%. The self-verifying mechanism distinguishes coherent from inconsistent alerts, improving interpretability and auditability for DER-focused security operations centers.

arXiv cs.CR · 5d agoResearch

Three JFrog Artifactory Flaws Exploited for Backdoor Deployment

Wiz reports multiple actors chaining three JFrog Artifactory auth flaws to gain admin and deploy backdoors; CISA added all three CVEs to KEV.

Wz reports threat actors exploiting CVE-2026-42018, CVE-2026-42016, and CVE-2026-82329 in self-hosted JFrog Artifactory instances to bypass authentication and gain administrative privileges. Between August 15 and September 8, 2026, multiple actors chained CVE-2026-42018 and CVE-2026-42016 to mint anonymous-user tokens, escalate privileges, create persistent admin accounts, install malicious plugins for code execution, and drop second-stage payloads. From early September, CVE-2026-82329 was exploited for configuration exfiltration, cluster key theft, token minting, and SSH key attachment to attacker-created accounts. CISA added all three CVEs to its KEV catalog, giving federal agencies two weeks under BOD 26-04 to patch to versions 7.161.20, 7.146.38, 7.133.29, 7.125.20, 7.117.28, or 7.111.21.

SecurityWeek · 2d agoExploit / PoC in the wild 7 sourcesCVE-2026-42016CVE-2026-42018CVE-2026-82329

PaperCut Flaws Exploited in AI-Powered Attacks

GreyNoise says a Russian-speaking actor used AI to build and deploy exploits hitting 440 PaperCut NG/MF deployments across 395 organizations in 48 countries.

Two PaperCut NG/MF zero-days, CVE-2026-82078 and CVE-2026-81578, disclosed August 27 and patched August 28, enable unauthenticated authentication bypass and remote code execution. GreyNoise observed a Russian-speaking threat actor using AI to orchestrate attacks against 440 deployments in 48 countries, including 204 education-sector organizations, achieving domain admin at 12 victims. Attack paths included harvesting LSASS memory and registry secrets, mounted NoPac attacks, and adding accounts to Domain Admins, with AI automation shortening compromises to minutes or seconds.

SecurityWeekupdated · 5d agofirst · 5d agoExploit / PoC in the wild 8 sourcesCVE-2026-82078CVE-2026-81578