ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “otsl”

30 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllAI research 1
SeverityAllcritical 0high 0medium 0low 0info 1

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

OpenSSL 4.1.0 Alpha1 Released With DTLS 1.3 and Faster Post-Quantum Cryptography

OpenSSL 4.1.0 Alpha1 adds DTLS 1.3 support, ML-DSA and ML-KEM post-quantum optimizations, and GREASE TLS compatibility, intended for testing only.

The alpha preview of OpenSSL 4.1.0 implements RFC 9147 DTLS 1.3 for UDP-based applications and integrates DTLS into the SSL listener API. It accelerates ML-DSA signatures and ML-KEM encapsulation with AVX-512 and VAES optimizations on x86_64, and adds GREASE (RFC 8701), IKEv2 KDF support, and Elbrus2000 (e2k) targets. The release is intended for testing and development, not production, and removes Windows-on-Itanium and Windows CE build targets.

Cyber Security News · 6d agoTools 2 sources

Tables Decoded: DELTA for Structure, TARQA for Understanding

DELTA extracts tables into compact OTSL text and TARQA fine-tunes LLMs on it, beating VLM baselines on table QA.

DELTA separates physical structure recognition, logical structure recognition, and OCR to output tables in Optimised Table Structure Language (OTSL), a compact unified format encoding cell arrangements and content. It achieves TEDS-Structure scores comparable to state-of-the-art methods across FinTabNet, PubTabNet, and PubTables-1M, with robustness tested on a curated Hindi benchmark, TORQUE. TARQA, an LLM fine-tuned on OTSL sequences, gains 9.3 percentage points on WTQ TabQA and 9.2 points on FinTabNetQA TabVQA; code, models, and the benchmark are released on GitHub.

arXiv cs.AI / cs.LG / cs.CL · 1d agoAI research

OpenSSL security advisory (AV26-846)

Canada's Cyber Centre relayed an OpenSSL advisory (AV26-846) covering vulnerabilities fixed across seven branches, urging users to update to patched releases.

Canadian Centre for Cyber Security bulletin AV26-846 states that OpenSSL is affected by vulnerabilities fixed in 1.0.2zr, 1.1.1zi, 3.0.22, 3.4.7, 3.5.8, 3.6.4, and 4.0.2. Given OpenSSL's ubiquity in TLS stacks, administrators should review the OpenSSL advisories and apply updates. The bulletin includes no exploitation details or CVE identifiers.

Canadian Centre for Cyber Security · 22d agoAdvisory

Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild

Attackers actively exploit CVE-2025-32433, a CVSS 10.0 unauthenticated RCE in Erlang/OTP SSH, heavily targeting OT and critical infrastructure networks.

CVE-2025-32433 enables unauthenticated RCE in Erlang/OTP's SSH daemon via SSH connection protocol messages (codes >= 80) processed before authentication, affecting versions before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20. Unit 42 recorded a spike in exploitation between May 1-9, 2025, with 70% of detections on firewalls protecting OT networks, disproportionately affecting healthcare, agriculture, media and high technology. Observed payloads bind TCP-connected shells or launch Bash reverse shells to hosts like 146.103.40.203:6667, with randomized DNS lookups under dns.outbound.watchtowr.com indicating OAST-driven blind RCE validation.

Palo Alto Unit 42 · Aug 17, 2026Exploit / PoC in the wildCVE-2025-32433

Update modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb

Rapid7 updated a Metasploit auxiliary scanner module that detects XML external entity injection in Elasticsearch via Apache Tika.

A commit in the Metasploit Framework updated modules/auxiliary/scanner/http/elasticsearch_tika_xfa_xxe.rb, an auxiliary scanner module. The module targets XML external entity (XXE) injection in Elasticsearch through Apache Tika, and was co-authored by jheysel-r7. The terse commit message contains no additional details, CVE references, or exploitation notes.

Metasploit Framework commits · 8d agoTools

Erlang security advisory (AV26-870)

Canada's Cyber Centre warns that multiple Erlang/OTP versions are affected by vulnerabilities and urges administrators to apply updates.

The Canadian Centre for Cyber Security issued advisory AV26-870 on September 1, 2026, noting vulnerabilities affecting Erlang OTP across multiple versions. The bulletin contains no CVE identifiers or exploitation details and directs users and administrators to Erlang's own security advisories to apply necessary updates.

Canadian Centre for Cyber Security · 15d agoAdvisory

OT Threat Research

Palo Alto Networks Unit 42 launched an OT Threat Research Lab to study how cyber threats disrupt industrial and critical-infrastructure operations.

Unit 42 announced a dedicated OT Threat Research Lab for testing emerging technologies, evaluating AI-OT scenarios, and examining how threats move across connected operational systems. The lab's findings are intended to inform vulnerability analysis, detection guidance, and risk prioritization for operational technology environments.

Palo Alto Unit 42 · 20d agoIndustry

From 88 lines to 1: Detecting DLL hijacking with Elastic Defend

Elastic condenses 88 lines of detection logic into one Elastic Defend 9.5.0 rule catching the DLL hijacking used by a ClickFix campaign.

The ClickFix campaign side-loads a malicious mscoree.dll next to a signed Microsoft binary and also ships a driver to kill Elastic Endpoint. Elastic rebuilt the DLL as a NativeAOT library, dropped it beside the signed binary, and confirmed that Elastic Defend 9.5.0 flags the load. The post replaces 88 lines of detection logic with a single rule for DLL search-order hijacking.

Elastic Security Labs · 19d agoTools in the wild

BGP Role model: tracking the adoption of RFC 9234

Cloudflare measured RFC 9234 adoption, finding BGP Role deployment growing but two Tier 1 networks unexpectedly stripping the Only to Customer attribute.

Cloudflare analyzed adoption of RFC 9234, which introduces BGP Roles and the Only to Customer (OTC) attribute allowing routers to reject route leaks on their own. The measurement study assessed who has deployed the mechanism in the global routing table. It found two Tier 1 networks unexpectedly stripping OTC attributes, which could undermine leak protection.

Cloudflare Blog · 29d agoResearch

Vulnerabilities fixed in libxml2-2.15.4

libxml2 2.15.4 fixes an out-of-bounds read in xmlregexp's NXT macro plus several integer overflow and parsing flaws.

libxml2 2.15.4 (released September 1, 2026) includes security fixes: an out-of-bounds read in the xmlregexp NXT macro, missing overflow checks in dict.c, uri.c, and valid.c, an integer overflow in xmlIO before the writecallback, and an overflow check in xmlXPtrEvalXPtrPart. The release also propagates parseFlags in xmlXIncludeProcess and xmlXIncludeProcessTree. No CVE identifiers, exploitation, or severity ratings are given in the announcement.

oss-security · 12d agoVulnerability

Any user process can escalate to root

A disclosed local privilege escalation flaw allows any user process to escalate to root on the affected system.

A Lobsters-linked security write-up describes a vulnerability in which any user process can escalate its privileges to root. The feed text provides no product name, CVE identifier, CVSS score, or exploitation details, limiting available detail. Local privilege escalation flaws are commonly chained with other issues for full system compromise, so defenders should review the full write-up for affected versions and patches.

Lobsters · security · 16d agoVulnerability

Linux Detection Engineering - Local Privilege Escalation

Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.

Elastic Security Labs describes how most Linux local privilege escalations share a common host flow — an unprivileged process launched from a writable path becoming root — and proposes layered detections combining general outcome-based rules with per-technique rules in Elastic Defend and Auditd. It tracks 13 recent LPE disclosures, seven of which share a copy-on-write/zero-copy bug class, including Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, DirtyClone, pedit COW, and RefluXFS. Qualys attributes RefluXFS to an LLM-assisted research effort with Anthropic using Claude Mythos Preview, and another bug is credited to an LLM-assisted workflow. Detection and endpoint rules are published in Elastic's detection-rules and protections-artifacts repositories.

Elastic Security Labs · 5d agoResearch

Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain

The Hunter's Ledger tracked campaign UTA-2026-024 using Sliver C2, Domain Admin account creation, and Ethereum-based C2 rotation to compromise a US organization's Windows domain.

The Hunter's Ledger tracked an intrusion at one unnamed US organization as UTA-2026-024, staged from exposed server 193.233.202.17 with a Sliver beacon. Operators created a non-expiring Domain Admin account, enabled RDP with NLA disabled, dumped SAM, SYSTEM and SECURITY hives plus LSASS memory, and disabled eight endpoint protection services. A Node.js implant resolved its C2 server from an Ethereum smart contract that rotated domains five times in five months, while SYSTEM scheduled tasks with backdated dates and DNS allowlist manipulation provided persistence. The infrastructure ties to a confirmed ransomware incident, but no encryptor deployment was proven in this intrusion.

Cyber Security News · 8d agoThreat actor in the wild

CVE-2026-86304: MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor

MojoX::Authentication before 0.006 for Perl allows SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor (CVE-2026-86304).

CVE-2026-86304 affects MojoX::Authentication versions before 0.006 for Perl. The parse_assertion function builds Net::SAML2::Binding::POST without a trust anchor, so SAML assertions are not validated against a trusted signing key, enabling authentication bypass. The flaw is fixed in version 0.006 of the module.

oss-security · 9d agoVulnerabilityCVE-2026-86304

SonicWall security advisory (AV26-853)

Canada's Cyber Centre relays a SonicWall advisory flagging vulnerabilities in NetExtender Linux Client 3.5 and earlier, urging administrators to apply updates as available.

The Canadian Centre for Cyber Security issued advisory AV26-853, noting SonicWall vulnerabilities affecting NetExtender Linux Client version 3.5 and earlier as of August 25, 2026. The relay provides no CVE identifiers or exploitation details and directs users and administrators to review SonicWall's security advisories and apply updates as they become available.

Canadian Centre for Cyber Security · 20d agoAdvisory

ZDI-26-608: Linux Kernel KVM IOAPIC Use-After-Free Local Privilege Escalation Vulnerability

The Linux kernel KVM IOAPIC has a use-after-free (CVSS 8.2) allowing local privilege escalation, but exploitation requires high-privileged code execution first.

ZDI-26-608 describes a use-after-free vulnerability in the Linux kernel's KVM IOAPIC component, with a CVSS score of 8.2. An attacker must first obtain the ability to execute high-privileged code on the target system, which limits the practical impact of the privilege escalation. The advisory text does not list an assigned CVE identifier.

ZDI Published Advisories · 23d agoVulnerability

Communicating Under Pressure: Best Practices for Service Providers

CISA, FBI, and international partners issued guidance on crisis communications for service providers during IT and OT outages, emphasizing clarity, transparency, and backup channels.

CISA, the FBI, and international partners published guidance on planning and executing clear, timely, audience-appropriate communications during IT and OT service outages, whether caused by cyber threat actors, human error, or natural hazards. The guidance stresses clarity, accountability, and transparency, and warns that outages at one organization can cascade across interconnected systems. It recommends critical infrastructure owners assume telecommunications may be unreliable and integrate backup communication methods into crisis plans, and points to CISA's CI Fortify initiative for OT isolation and recovery resources.

CISA Advisories · 14d agoAdvisory

Okta Fixes Auth0 and Access Gateway Flaws Enabling XSS, Auth Bypass, and SQL Injection

Okta patched three flaws in Auth0 AD/LDAP Connector and Access Gateway, including a CVSS 9.0 stored XSS tracked as CVE-2026-85982.

Okta disclosed and patched three vulnerabilities on September 8, 2026 affecting the Auth0 AD/LDAP Connector and Okta Access Gateway. CVE-2026-85982 is a CVSS 9.0 stored XSS in the connector's admin panel caused by improper HTML encoding of directory search results and updater logs; CVE-2026-78626 is a CVSS 8.1 authorization bypass in Access Gateway Protected Rules; CVE-2026-78623 is a CVSS 7.7 SQL injection in advanced-mode datastores via unsanitized SAML assertion attributes. Fixes ship in connector version 8.0.0 and Access Gateway 2026.9.1; no exploitation has been reported.

Cyber Security Newsupdated · 5d agofirst · 5d agoVulnerability 2 sourcesCVE-2026-85982CVE-2026-78626CVE-2026-786231

Memory-safety defects in the upstream (abandoned) AOSP OpenCORE AAC decoder, shipped unpatched by Samsung TizenRT

Abandoned AOSP OpenCORE AAC decoder has out-of-bounds-write and wild-pointer flaws reachable from attacker-controlled frames, unpatched in Samsung TizenRT.

The OpenCORE AAC decoder in AOSP's abandoned external/opencore tree contains memory-safety defects of the out-of-bounds-write and wild-pointer class. The code is still vendored and built by multiple projects, most notably Samsung's widely deployed TizenRT embedded RTOS. The defects are reachable from untrusted media because an AAC frame is attacker-controlled. The researcher is requesting a CVE ID for the issue.

oss-security · 6d agoVulnerability1

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

Wordfence Argus found two critical unauthenticated RCE vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites.

Wordfence Argus identified two independent critical vulnerability chains in The Events Calendar WordPress plugin on August 21-22, 2026. Both chains originate in the plugin's widget-rendering pipeline and can lead to unauthenticated Remote Code Execution via two separate methods. The plugin is active on more than 600,000 websites.

Wordfence · 2d agoVulnerability

ZDI-26-577: Trend Micro VPN OpenSSL Configuration Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

ZDI disclosed a local privilege escalation (CVE-2026-67212, CVSS 7.0) in Trend Micro VPN's OpenSSL configuration, requiring prior low-privileged code execution.

The Zero Day Initiative published advisory ZDI-26-577 describing an uncontrolled search path element vulnerability in Trend Micro VPN's OpenSSL configuration. Local attackers who can already execute low-privileged code on an affected installation can escalate privileges. ZDI rated the issue 7.0 on CVSS and assigned CVE-2026-67212.

ZDI Published Advisories · Aug 13, 2026VulnerabilityCVE-2026-67212

GNU security advisory (AV26-923)

Canadian Cyber Centre advisory AV26-923 flags a stack overflow in GNU libextractor before v1.15 via OLE2 files.

The Canadian Centre for Cyber Security issued advisory AV26-923 on September 15, 2026, covering CVE-2026-91752, a stack overflow vulnerability in GNU libextractor versions prior to 1.15 triggered via OLE2 file parsing. The Cyber Centre encourages users and administrators to review the provided links and apply necessary updates as they become available.

Canadian Centre for Cyber Security · 1d agoAdvisoryCVE-2026-91752

Learning Intrusion Response Strategies for OT Systems

Researchers model OT intrusion response as a POMDP and train PPO-based automated response strategies effective against MITRE attacks in an emulated OT system.

The paper formalizes automated intrusion response for OT systems as a partially observable Markov decision process, with partial observability modeled from traffic measurements. Learning-based solution methods built on PPO are developed and evaluated on an emulated OT system. The resulting response strategies proved effective against several types of MITRE attacks for the studied use case.

arXiv cs.CR · 7d agoResearch2

ZDI-26-532: SonicWall Email Security updateNetIf Command Injection Local Privilege Escalation Vulnerability

ZDI advisory ZDI-26-532 discloses CVE-2026-66149, a command injection in SonicWall Email Security updateNetIf allowing local privilege escalation (CVSS 7.8).

SonicWall Email Security contains a command injection flaw in the updateNetIf routine, tracked as CVE-2026-66149 with CVSS 7.8. A local attacker must first obtain the ability to execute low-privileged code on the target system in order to escalate privileges. The vulnerability was disclosed via ZDI advisory ZDI-26-532.

ZDI Published Advisories · Aug 11, 2026VulnerabilityCVE-2026-66149

UK Council Attack Linked to Mass Exploitation of SonicWall Flaw

Hunt.io links a UK council attack to mass exploitation of SonicWall SMA1000 flaw CVE-2026-15409 (CVSS 10.0), enabling credential and Active Directory theft.

Hunt.io links, with moderate confidence, the July 17, 2026 attack on the Borough Council of King's Lynn and West Norfolk to mass exploitation of SonicWall SMA1000 appliances via CVE-2026-15409, an unauthenticated SSRF in the WorkPlace portal WebSocket proxy with CVSS 10.0. The operator adapted Rapid7's July 15 PoC into a 50-thread mass scanner within days and stole LDAP credentials for 534 Active Directory accounts across 160 domains, with nine environments losing SAM/LSA secrets and five losing full AD databases via DCSync. CISA added the flaw to its Known Exploited Vulnerabilities catalog and noted use in ransomware campaigns; targeting of ~200,000 Shodan-derived SonicWall addresses spanned government, healthcare, finance, universities, and manufacturing worldwide.

Security Affairs · 5d agoExploit / PoC in the wildCVE-2026-154091

DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive sectors

Rapid7 uncovered a DPRK-linked Linux toolkit using a HAProxy-embedded ted backdoor, SSH keylogger, and curlRAT against South Korean media and automotive firms.

Rapid7 Labs identified a previously undocumented framework attributed with medium confidence to DPRK actors, targeting South Korean automotive and media organizations likely since early 2025. The toolkit embeds a backdoor compiled into HAProxy 2.8.12 using its filter API, plus trojanized crond, agetty, atd, sshd, and polkitd, an SSH keylogger storing credentials under /var/lib/sshd/, and a curl-based RAT with a watchdog thread. It enables remote command execution, malicious script injection into served webpages (a watering-hole loop), credential harvesting, and long-term surveillance. Hardcoded C2s are associated with APT37 via ThreatFox, and exposed groupware portals and mail servers align with Kimsuky tradecraft; the initial access vector and any CVE remain unconfirmed.

Rapid7 Blog · 12d agoThreat actor in the wild1

Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode

Check Point's hasherezade details static deobfuscation of JSCeal, a V8-bytecode stealer targeting cryptocurrency applications since March 2024.

JSCeal is an infostealer distributed as compiled V8 bytecode (.jsc) executed by a bundled Node.js runtime, aimed at cryptocurrency applications. Other vendors track the same family under the names WEEVILPROXY or MeadowLocust. Check Point Research has tracked the campaign since early 2024, with activity dating back to March 2024. The write-up presents a static approach to unpacking the bytecode without executing it.

Check Point Research · 16d agoMalware in the wild1

Iot Security

Vendor product-category page for Palo Alto Unit 42 IoT security content, published with no article text available.

The URL points to Palo Alto Unit 42's 'IoT Security' product category listing rather than a research article. No article body was available, so no incident, vulnerability, or research findings can be extracted from this item.

Palo Alto Unit 42 · 28d agoIndustry