ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “exposed-services”

30 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllThreat actor 1Vulnerability 1
SeverityAllcritical 1high 1medium 0low 0info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

Palo Alto PAN-OS Vulnerability Enables Arbitrary Code Execution as Root User

Palo Alto Networks patched CVE-2026-0310, an unauthenticated XML-processing buffer overflow in PAN-OS allowing root code execution on PA-Series firewalls.

Palo Alto Networks disclosed CVE-2026-0310, an out-of-bounds write (CWE-787) in PAN-OS XML processing with a CVSS-B base score of 9.2 and CVSS-BT of 7.2. An unauthenticated attacker with network access to a vulnerable management or dataplane interface can send crafted XML to execute arbitrary code as root on PA-Series appliances. On VM-Series the impact is limited to denial-of-service, while Prisma Access and Cloud NGFW require authentication and carry lower risk. Fixed releases include 12.2.3, 12.1.10, 11.2.13-h2, 11.1.16-h2, and 10.2.18-h10; no workaround exists beyond restricting management interface access.

Cyber Security Newsupdated · 6d agofirst · 6d agoVulnerability 3 sourcesCVE-2026-0310

Hackers Deploy Agentic AI to Automate Exploitation and Mass Credential Harvesting

Google GTIG documents a financially motivated actor using a multi-agent AI framework to automate credential harvesting, compromising over 23,800 secrets within hours.

Google Threat Intelligence Group (GTIG) documented a financially motivated actor that compromised an unnamed organization's cloud infrastructure and used a multi-agent AI framework to automate vulnerability scanning, credential harvesting, troubleshooting, and IP rotation. The operation went from planning to mass credential compromise in under six hours, harvesting more than 23,800 secrets including cloud and AI-service API keys via an exposed C2 dashboard called 'Recon'. The actor directed specialized agents using an AI coding chatbot and Markdown instruction files such as AGENTS.KNOWLEDGE.md and agentic_vuln_research.md. Google has not observed fully autonomous zero-day exploitation; the shift automates labor-intensive tasks like reconnaissance, account validation, and infrastructure management, sharply shrinking detection windows.

GBHackers · 1d agoThreat actor in the wild1

How to build an exposure management program the business trusts: Lessons from Tenable’s CSO

Tenable's CSO describes an AI-driven exposure management program that consolidates tool sprawl and translates cyber risk for boards.

A Tenable blog post shares lessons from CSO Robert Huber on moving to an AI-driven exposure management program. It argues tool sprawl and data silos hinder holistic risk assessment and that exposure management unifies attack-surface data into business-level metrics for the C-suite.

Tenable Blog · 20d agoIndustry

How MCP Servers Can Expose Enterprise Secrets

MCP servers holding AI agent credentials risk secret exposure via plaintext configs, credential sprawl, prompt injection, and over-permissioning; mitigations include centralization and least privilege.

The article examines how Model Context Protocol servers, which hold API keys, tokens, and service-account credentials for AI agents, can leak enterprise secrets. Documented exposure paths include plaintext credentials in config files, ungoverned credential sprawl, prompt injection, over-permissioning, and untrusted third-party servers. It cites CVE-2025-6514 in mcp-remote (400,000+ downloads), where a malicious server triggered OS command injection leading to remote code execution. Recommended mitigations include centralized secret stores, short-lived auto-rotated credentials, least privilege, and human approval for sensitive actions.

The Hacker News · Aug 17, 2026AI safety & securityCVE-2025-6514

Webinar: Learn How to Answer “Are We Exposed?” Faster After a New CVE

Tines will host a September 2026 webinar showing security teams how to combine SBOM, endpoint, cloud, and vulnerability data into one exposure assessment workflow.

The Hacker News published a contributed webinar announcement from Tines titled "Outpacing AI-Era Attacks Starts With Faster Time to Answer." Tines Co-founder Thomas Kinsella and Senior Security Operations Engineer Andrew Katz will demonstrate connecting SBOM data, endpoint application data, cloud inventory, and vulnerability feeds into a single interactive exposure view. The session also covers pairing AI-assisted analysis with deterministic, reviewed automation to reduce time from CVE disclosure to exposure determination.

The Hacker News · 7d agoIndustry

CISA Warns Water Utilities: Find Your Exposed PLCs Before Attackers Do

CISA urged water utilities to secure internet-exposed PLCs after July 2026 attacks compromised over 100 US water and wastewater systems, suspected Iran-linked.

CISA's exposure-reduction guidance, published August 21, follows July 2026 attacks in which threat actors remotely accessed PLCs connected directly through cellular modems, changed device IP addresses and passwords, and in some cases disabled alarms and shutdown processes without notifying operators. Iran is the suspected actor, though officials stopped short of formal attribution. CISA recommends routing remote access through centrally managed secure gateways, phishing-resistant MFA, unique credentials, and external scanning of industrial protocols such as Modbus, EtherNet/IP, DNP3, BACnet and OPC UA.

Security Affairs · 20d agoExploit / PoC in the wild

Cloud Delivered Security Services

Palo Alto Networks Unit 42 hosts a product archive page for its Cloud-Delivered Security Services subscription portfolio.

The page is a product category archive on the Unit 42 blog with no article text available. Cloud-Delivered Security Services is Palo Alto Networks' bundle of cloud-delivered network and threat prevention services. No research findings, incidents, or vulnerabilities are described.

Palo Alto Unit 42 · 8d agoIndustry

Patch Tuesday to Pentest Wednesday: How an Equipment Rental Company Is Turning Continuous Testing Into Continuous Exposure Management

An equipment rental company uses Horizon3 NodeZero for continuous exposure management, surfacing an SSH key exposure in eight hours versus annual pentesting.

The company moved from periodic penetration testing to continuous exposure management using the NodeZero Proactive Security Platform, feeding telemetry into a Splunk-based CTEM pipeline via Horizon3 APIs. NodeZero exposed SSH RSA key pairs from a PHP web server change about eight hours after introduction and found more findings in 12 hours than a third-party engagement found in roughly 30 days. An Active Directory password audit of 15,000 passwords found about 300 identical or similar compromised passwords, driving a banned-password list, 12-character minimums, service desk changes, and self-service reset rollout; users with similar passwords later dropped from 880 to 209. NodeZero also validated a suspected Cisco vulnerability as exploitable.

Horizon3.ai · 6d agoIndustry

Exposed AWS Access Key Linked to Data Breach Affecting 1500+ UK Charities

CRM provider Beacon says a compromised AWS access key likely caused a data breach affecting more than 1,500 UK charities.

Beacon, a UK CRM provider serving the charity sector, disclosed that an exposed AWS access key was the likely root cause of a data breach. The incident affected data belonging to more than 1,500 UK charities. The company said the compromised cloud credential enabled the unauthorized access; specific record volumes and data types are not detailed in the report.

Infosecurity Magazine · Aug 13, 2026Data breach in the wild

Unit 42 Deep and Dark Web Service Archives

Palo Alto Networks Unit 42 describes its Deep and Dark Web service monitoring underground forums for compromised credentials and leaked data.

Unit 42's Deep and Dark Web Service page describes monitoring underground forums to identify compromised credentials and leaked data. Analysts investigate suspicious content, escalate prioritized findings, and deliver actionable intelligence to customer SOCs. The page is a service description rather than a news report or incident disclosure.

Palo Alto Unit 42 · 28d agoIndustry

Malware Crypting Services and the Threat Actors Who Sell Them

Recorded Future's Insikt Group profiles 24 threat actors selling malware crypting services and urges defenders to favor behavioral detection over static analysis.

Recorded Future's Insikt Group analyzed 24 threat actors that sell malware crypting services. The report covers their evasion techniques and the market dynamics of crypting-as-a-service. Insikt recommends that defenders prioritize behavioral detection over static analysis because crypting regularly alters malware file characteristics.

Recorded Future · Aug 13, 2026Threat actor

Disruptive cyber activity highlights risk from internet-exposed systems and edge devices

NCSC links disruptive cyber activity to internet-exposed systems and edge devices, urging OT owners to fix avoidable vulnerabilities and improve resilience.

The UK's NCSC issued guidance following disruptive cyber activity that highlights the risk to internet-exposed systems and edge devices. It encourages owners of operational technology to remediate avoidable vulnerabilities and invest in long-term cyber resilience. The notice underscores that exposed edge devices remain a common entry point for attackers against OT environments.

NCSC UK · 20d agoAdvisory in the wild

ZDI-26-582: Cisco Identity Services Engine PatchUpdateListener Directory Traversal Information Disclosure Vulnerability

Cisco Identity Services Engine's PatchUpdateListener has an authenticated directory traversal (CVE-2026-20148, CVSS 4.9) enabling sensitive information disclosure.

ZDI advisory ZDI-26-582 describes a directory traversal information disclosure vulnerability in the PatchUpdateListener component of Cisco Identity Services Engine. Remote attackers can disclose sensitive information, but valid authentication is required to exploit the flaw. ZDI assigned a CVSS rating of 4.9 and CVE-2026-20148.

ZDI Published Advisories · Aug 13, 2026VulnerabilityCVE-2026-20148

Cisco BroadWorks Out-of-Band Blind XML External Entity Injection Vulnerability

Cisco patched an XXE flaw in BroadWorks' OCI XML parser letting unauthenticated remote attackers read sensitive files from the filesystem.

Cisco BroadWorks permits external entity resolution by default in its Open Client Interface XML parser, enabling out-of-band blind XXE injection. An unauthenticated remote attacker can send crafted XML to the OCI-P provisioning service and read sensitive configuration files with BroadWorks user privileges. Cisco has released software updates and no workarounds are available.

Cisco Security Advisories · 27d agoAdvisory

ZDI-26-544: Microsoft Windows Deployment Services Use-After-Free Remote Code Execution Vulnerability

ZDI discloses an unauthenticated use-after-free remote code execution flaw in Windows Deployment Services (CVE-2026-62893, CVSS 7.5).

ZDI advisory ZDI-26-544 describes a use-after-free in Microsoft Windows Server Deployment Services that allows network-adjacent attackers to execute arbitrary code without authentication. Only systems with Windows Deployment Services enabled are vulnerable. The flaw carries a CVSS rating of 7.5 and is tracked as CVE-2026-62893.

ZDI Published Advisories · Aug 11, 2026VulnerabilityCVE-2026-62893

Rockwell Automation ArmorStart LT

CISA flags two flaws (CVE-2026-19471, CVE-2026-19472) in Rockwell Automation ArmorStart LT <=v2.001: stored XSS and web server denial-of-service.

Rockwell Automation reported two issues in the embedded web server of ArmorStart LT v2.001 and earlier. CVE-2026-19471 involves multiple stored cross-site scripting flaws (CVSS 7.3) where unsanitized input is stored server-side and executes in other users' browsers. CVE-2026-19472 is a denial-of-service issue (CVSS 7.5) triggered by a crafted HTTP PUT request that exhausts web server resources. No public exploitation has been reported to CISA.

CISA Advisories · 13d agoAdvisory 3 sourcesCVE-2026-19471CVE-2026-19472

ZDI-26-555: Parallels RAS Client RDP Backend Service Exposed Dangerous Function Local Privilege Escalation Vulnerability

ZDI discloses CVE-2026-18262, a CVSS 7.8 exposed dangerous function in Parallels RAS Client's RDP backend service allowing local privilege escalation.

ZDI advisory ZDI-26-555 describes an exposed dangerous function in the Parallels RAS Client RDP backend service, tracked as CVE-2026-18262 with a CVSS score of 7.8. The flaw allows local attackers to escalate privileges on affected installations. Exploitation requires first obtaining the ability to execute low-privileged code on the target system.

ZDI Published Advisories · Aug 11, 2026VulnerabilityCVE-2026-18262

Third-Party Script Security: How Tags, Pixels, and Embeds Can Put Websites at Risk

Sucuri details how third-party tags, pixels, and embeds expand website attack surface, letting compromised vendors read data and alter pages.

The article explains that third-party scripts used for analytics, ads, chat, payments, and video can read page content, collect visitor data, and change what users see. A compromise of the vendor, account, or integration configuration can affect every page loading the script. It recommends inventorying scripts, understanding their purpose and ownership, and detecting unexpected changes rather than removing useful integrations.

Sucuri Blog · 22d agoResearch

Who’s Tracking You? Use This New Service to Find Out

KrebsOnSecurity covers DecryptAds, a free service that scrapes and correlates adtech data to reveal which entities track users across sites and apps.

KrebsOnSecurity wrote about DecryptAds, a free service that scrapes and correlates adtech data. The service makes it simple to identify which entities are responsible for ads shown on websites and data harvested by mobile apps, information that is semi-public but traditionally walled away inside large advertising platforms. No security incident is involved; the piece is an introduction to a privacy-research tool.

Krebs on Security · Aug 14, 2026Tools

Advanced Dns Security

Palo Alto Networks Unit 42 hosts a product archive page for its Advanced DNS Security DNS-layer threat prevention service.

The page is a product category archive on the Unit 42 blog with no article text available. Advanced DNS Security is Palo Alto Networks' DNS-layer threat prevention offering. No research findings, incidents, or vulnerabilities are described.

Palo Alto Unit 42 · 8d agoIndustry 6 sources

Secure Access Service Edge (SASE) Archives

Palo Alto Unit 42 archive page describing Secure Access Service Edge (SASE), a cloud architecture unifying SD-WAN with SWG, CASB, FWaaS and ZTNA services.

Category archive page defining SASE as a cloud-native architecture that converges SD-WAN with security functions such as SWG, CASB, FWaaS and ZTNA into one cloud service. It frames SASE as a shift from separate networking and security disciplines to unified, cloud-delivered security and connectivity. The page contains no news, incident, vulnerability or research findings.

Palo Alto Unit 42 · Aug 17, 2026Industry

Over 36,000 exposed Plex servers vulnerable to recent flaws

Over 36,000 internet-exposed Plex Media Server instances remain unpatched against recently disclosed vulnerabilities, leaving them open to attack.

BleepingComputer reports that more than 36,000 Plex Media Server instances exposed to the internet have not yet applied patches for multiple recently disclosed security vulnerabilities. These unpatched, publicly reachable servers remain vulnerable to attacks until administrators install the available updates. The report underscores slow patch adoption for internet-facing media server software.

BleepingComputer · 7d agoVulnerability

Detecting cloud ransomware in Azure with Tenable One’s cloud detection and response capabilities

Tenable details ransomware group Storm-0501's Azure tenant-hijacking tactics and how its cloud detection and response identifies them.

Tenable's blog describes how cybercrime group Storm-0501 conducts cloud-first ransomware campaigns against Azure environments. The group has shifted from endpoint encryption to total hijacking of cloud tenants and systematically neutralizes resource locks, immutability policies, and backups. Tenable outlines its One Cloud Exposure detections, using AI-powered threat stories and precision alerts, to expose these TTPs early.

Tenable Blog · Aug 17, 2026Threat actor in the wild

Cisco Advance Notification for Publication of August 19, 2026, Security Advisories

Cisco PSIRT's advance notice previews August 19, 2026 advisories including Critical CVSS 10.0 hardening releases for Crosswork and Secure Workload.

Cisco PSIRT issued an advance notification for security advisories published August 19, 2026. The batch includes Critical-rated (CVSS 10.0) hardening releases for Cisco Crosswork and Cisco Secure Workload, a High-severity blind XML External Entity injection in BroadWorks (CVE-2026-20320, CVSS 7.5), a Medium SQL injection in Unified Intelligence Center (CVE-2026-20327, CVSS 6.5), and a RoomOS stack overflow. Full details and fixes follow in the individual advisories.

Cisco Security Advisories · 27d agoAdvisoryCVE-2026-20030CVE-2026-20357CVE-2026-20358+8 CVEs

ClickFix Campaigns Abuse Legitimate Services for Persistent Access

Dark Reading reports two ClickFix social engineering campaigns abusing legitimate services to compromise organizations and maintain persistent access.

Dark Reading describes two separate attacks in which threat actors used the ClickFix social engineering tactic to compromise organizations. The campaigns abuse legitimate, trusted services to gain and maintain persistent access to victim environments. No specific victims, actors, or indicators were named in the available text.

Dark Reading · 7d agoThreat actor in the wild

Identity-as-a-Service: Uncovering Dark Web Marketplaces Trading Executive SSNs

Rapid7 research uncovered dark web marketplaces trading executive Social Security numbers, fueling synthetic identity fraud and unauthorized lines of credit.

Rapid7 threat research documents dark web marketplaces where stolen executive Social Security numbers are bought and sold, a tier of the cybercrime ecosystem more durable than stolen payment cards because SSNs cannot be deactivated. Exposed SSNs enable unauthorized credit lines, synthetic identity fraud, and long-term impersonation. The article cites FTC statistics of over 1 million identity theft reports annually, with related fraud and imposter scams causing billions in losses each year.

Rapid7 Blog · 20d agoResearch

[webapps] Bludit CMS - Stored XSS

A stored cross-site scripting (XSS) vulnerability in Bludit CMS was disclosed through a public proof-of-concept published on Exploit-DB.

Exploit-DB published a webapps entry for a stored XSS flaw in Bludit CMS, an open-source flat-file content management system. Stored XSS allows an attacker to persist malicious scripts that execute in other users' browsers, potentially enabling session theft or unauthorized actions. The listing did not include a CVE identifier or affected version range.

Exploit-DB · 15d agoExploit / PoC1

Next

Palo Alto Networks product-category page describing Next-Generation Firewall threat detection, including encrypted traffic; no standalone article.

The page is a product category listing for Palo Alto Networks Next-Generation Firewalls, stating the products detect known and unknown threats, including in encrypted traffic, using intelligence from many thousands of customer deployments. It contains no research findings, vulnerabilities, or incident details relevant to defenders.

Palo Alto Unit 42 · 28d agoIndustry