Search: “proactive-security”

Organizations Warned of Cisco Secure FMC Exploitation

Cisco and CISA warn that critical FMC authentication bypass CVE-2026-20079 is actively exploited; CISA added it to the KEV catalog with a September 12 deadline.

Cisco and CISA flagged active exploitation of CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center allowing remote, unauthenticated attackers to run malicious scripts and gain root access via crafted HTTP requests. Cisco patched the flaw in early March and added IoCs in late July, but confirmed active exploitation in its September 9 advisory; CISA added it to the KEV catalog requiring federal remediation by September 12. Talos identified three activity clusters exploiting CVE-2026-20079 and CVE-2026-20316, including state-sponsored and financially motivated actors, and this is the third FMC vulnerability in KEV this year after CVE-2026-20316 and CVE-2026-20131.

SecurityWeek·updated Sep 14, 09:27 UTC · 2d ago·first Sep 10, 10:06 UTC · 6d agoExploit / PoC in the wild 9 sourcesCVE-2026-20079CVE-2026-20316CVE-2026-20131

What is Proactive Threat Intelligence? | Recorded Future

Recorded Future publishes a vendor explainer on proactive threat intelligence, arguing external adversary context helps teams act before alerts fire.

Recorded Future published a conceptual blog on proactive threat intelligence, describing how external context on adversaries, infrastructure, stolen credentials, and vulnerability exploitation helps security teams act before intrusions surface internally. The piece outlines a four-step program: defining intelligence requirements, collecting external sources including OSINT and dark web, analyzing relevance to the organization, and driving security actions. Use cases include prioritizing CVEs by real-world exploitation activity and identifying external exposure before it becomes an internal incident.

Recorded Future·Sep 14, 00:00 UTC · 3d agoIndustry

Hunt Malware & Phishing Threats with ANY.RUN for Proactive Enterprise Security

ANY.RUN promotes its Threat Intelligence platform for turning scattered malware and phishing indicators into proactive enterprise threat hunting workflows.

ANY.RUN published a vendor blog post describing how its Threat Intelligence product helps analysts consolidate endless alerts, indicators, behavioral evidence and infrastructure context. The post frames threat intelligence as a way to move from raw data collection to proactive protection against malware and phishing. No new threat activity, malware family or vulnerability is disclosed.

ANY.RUN·Aug 19, 10:27 UTC · 28d agoTools

NSA, CISA, FBI, DOE, and EPA Warn of Active AI

Five US agencies warn of active AI-assisted attacks on internet-exposed Siemens S7 PLCs across critical infrastructure, using disguised snap7 scripts for pre-positioning reconnaissance.

NSA, CISA, FBI, DOE, and EPA issued joint advisory CISA AA26-231A warning of an active hacking campaign against Siemens S7-series PLCs, from S7-200 through S7-1500 F-series, across US critical infrastructure. Threat actors use internet scanning services such as Censys and ZoomEye to locate exposed controllers, then perform read operations over S7comm on TCP port 102 using the legitimate snap7.dll and python-snap7 libraries, disguising AI-generated exploitation scripts as monitoring tools. The agencies assess the activity as pre-positioning ahead of possible process disruption, equipment damage, or safety incidents in Energy, Water, Critical Manufacturing, Chemical, Food and Agriculture, and Commercial Facilities sectors.

Security Affairs·Aug 20, 17:36 UTC · 27d agoExploit / PoC in the wild

When Intelligence Becomes Agency: A Theory of Governed, Proactive Agency for Symbiotic AI Systems

Researchers propose a formal framework for governed proactive AI agency, linking activation decisions to continuing authorization, accountability, and bounded delegation in symbiotic systems.

The paper defines the activation problem: persistent AI assistants must decide whether a situation warrants behavior, and whether to act, ask, monitor, defer, or deliberately refrain. It distinguishes autonomous from delegated agency and defines symbiotic agency as delegation under a standing, revocable mandate, coupled to the principal's situation with calibrated inference and bounded personalization. The framework links activation decisions to authorized perception, behavior selection, authority containment, traceable restraint, and constrained adaptation, and provides an agency classification method, evaluation framework, benchmark scenarios, and reference architecture for always-present assistants and embodied support systems.

arXiv cs.AI / cs.LG / cs.CL·Sep 7, 16:46 UTC · 9d agoAI safety & security

Synology ActiveProtect Manager 2.0 improves AI-driven security

Synology released ActiveProtect Manager 2.0, expanding backup coverage to EC2, Azure, Proxmox and Google Workspace, with AI anomaly detection and malware scanning coming in 2.1.

Synology launched ActiveProtect Manager 2.0 for its DP Series data protection appliances, adding platform coverage for Amazon EC2, Azure VM, Proxmox VE, Nutanix AHV and Google Workspace. The release introduces cross-platform recovery, expanded backup destinations including Azure Blob Storage, and volume-level software storage encryption. The upcoming 2.1 update will add AI/ML anomaly detection tracking change rates, mass deletions and entropy, plus pre-restore malware scanning using Microsoft Defender, Bitdefender and ESET with Auto Fallback to the last clean version.

Help Net Security·Sep 4, 00:00 UTC · 13d agoTools

Legit Security VibeGuard 2.0 brings endpoint security and real-time guardrails to AI coding agents

Help Net Security·Aug 4, 00:00 UTC · Aug 4, 2026AI safety & security

Ambient @ EgoProactive 2026 : Proactive Egocentric Assistance with Visually Grounded Supervision

ECCV 2026 challenge winner reformulates egocentric intervention timing as single-token classification, boosting macro-F1 by 0.249 over free-form generation.

The paper describes the winning submission to the EgoProactive track of the ECCV 2026 Wearable AI Challenge, ranking first in the large-model division and second in the <=2B division. The method reformulates intervention timing as single-token yes/no classification, improving macro-F1 by 0.249 and G-mean by 0.30 over free-form generation. Supervision generated by a tool-calling video agent transferred better than a narration-only dataset that was four times larger and ten times cheaper, suggesting visual grounding matters more than annotation volume.

Hugging Face daily papers·Sep 9, 20:00 UTC · 7d agoAI research

Why AI raises the stakes for exposure validation

Fal.Con 2026 commentary argues AI accelerates vulnerability discovery and exploitation, making evidence-based exposure validation essential for defender prioritization.

CSO Online reports on the exposure-validation theme at CrowdStrike's Fal.Con 2026 conference, where CEO George Kurtz described AI as the new cyber battlefield and emphasized AI red teaming and continuous security. The piece argues that as AI speeds up vulnerability discovery and exploitability analysis on both sides, teams must determine which exposures are actually exploitable in their environments—chained weaknesses, credential abuse, lateral movement, privilege escalation—rather than chasing theoretical risk. It points readers to Horizon3's conference perspective.

CSO Online·Sep 11, 21:49 UTC · 5d agoIndustry

Malicious SIMs can hijack smartphones, steal files, and lock them onto 2G

Help Net Security·Aug 11, 00:00 UTC · Aug 11, 2026VulnerabilityCVE-2025-48618

Vulnerability giving attackers full control of Macs is under active exploitation

An actively exploited macOS screen-sharing vulnerability lets remote attackers log in without a password and take full control of Macs.

Ars Technica reports that a vulnerability in macOS screen sharing is under active exploitation, allowing remote hackers to log in to Macs without a password. Successful exploitation gives attackers full control of affected machines. The article excerpt does not include a CVE identifier, affected versions, or patch details.

Ars Technica · Security·Aug 14, 18:32 UTC · Aug 14, 2026Exploit / PoC in the wild

Three smart ways SMBs can improve cybersecurity

Opinion piece urges small and midsize businesses to adopt proactive prevention, threat detection, and 24/7 MDR or XDR services.

This opinion article argues SMBs face outsized cyber risk due to limited budgets, small IT teams, and reactive security postures. It recommends proactive prevention, a defined threat detection and response strategy, and managed detection and response (MDR) or extended detection and response (XDR) services. It cites ransomware costs up to $10,000 per device and an attack every 39 seconds as motivation for adopting vendor-operated 24/7 monitoring.

Help Net Security·Aug 27, 06:50 UTC · 20d agoIndustry

Mars Security Debuts Automated Threat Engine Processing Live Cyber Intelligence Into Validated Rules Within Minutes

Mars Security launches Real-Time Intel-Based Detection, converting threat intelligence advisories into validated, ATT&CK-mapped detection rules within minutes for SOCs.

Mars Security, an autonomous threat hunting and detection engineering platform founded by former offensive security operators, announced Real-Time Intel-Based Detection. The capability ingests advisories from sources like CISA, Mandiant, Unit 42, and Microsoft Threat Intelligence, maps indicators to MITRE ATT&CK, and authors native query logic across connected infrastructure including CrowdStrike Falcon, Wiz, Splunk, Sysmon, identity providers, Snowflake, and Databricks. Every rule is backtested against 30 days of historical telemetry to quantify false positives before analyst approval and one-click deployment. The feature is free for existing customers and available via AWS Marketplace.

CSO Online·Sep 8, 15:05 UTC · 8d agoTools2

Disruptive cyber activity highlights risk from internet-exposed systems and edge devices

NCSC links disruptive cyber activity to internet-exposed systems and edge devices, urging OT owners to fix avoidable vulnerabilities and improve resilience.

The UK's NCSC issued guidance following disruptive cyber activity that highlights the risk to internet-exposed systems and edge devices. It encourages owners of operational technology to remediate avoidable vulnerabilities and invest in long-term cyber resilience. The notice underscores that exposed edge devices remain a common entry point for attackers against OT environments.

NCSC UK·Aug 27, 12:00 UTC · 20d agoAdvisory in the wild

Toward an Empirical Probabilistic Risk Manifestation Model of Organizational Cybersecurity in SMEs

Empirical study of 22 SME security assessments builds a probabilistic risk model and shows assessments can be cut 24-45% while retaining most critical findings.

Researchers analyzed 281 validated security findings from 22 real-world SME cybersecurity assessments conducted over two years via a pro bono university clinic. They derived an empirical Risk Manifestation Model linking eight organizational security functions to two exposure conditions, five attack mechanisms, and six outcome categories, using probability propagation to identify dominant risk pathways. The dominant pathway runs from asset exposure to credential compromise to unauthorized access, stable under leave-one-organization-out analysis. Retaining six functions reduces assessment burden by 24% while preserving 97% of critical findings; five functions cut burden 45% while preserving 89% of critical findings.

arXiv cs.CR·Sep 14, 01:15 UTC · 3d agoResearch

Calling on Cyber Pros to Help Defend City Hall

Dark Reading urges security professionals to volunteer expertise helping under-resourced municipal government agencies improve cyber defenses.

The piece highlights that smaller government agencies such as city hall operate with limited security budgets and staffing. It lays out ways cybersecurity professionals can contribute volunteer support to strengthen local government defenses. No specific incident, vulnerability, or actor is involved.

Dark Reading·Aug 21, 14:00 UTC · 26d agoIndustry

CISA Shares 17 Techniques Used by Hackers to Compromise Active Directory

CISA and five international agencies publish joint guidance detailing 17 techniques attackers use to compromise Microsoft Active Directory environments.

CISA, NSA, and the Australian Signals Directorate's ACSC, with contributions from Canadian, UK, and New Zealand cyber centers, released technical guidance on 17 Active Directory attack techniques. It covers AD Domain Services, AD Certificate Services, and AD Federation Services, including Kerberoasting, DCSync, Golden Ticket, Golden SAML, Skeleton Key, and Shadow Credentials. The guidance recommends treating domain controllers, CAs, AD FS servers, and Entra Connect systems as Tier 0 assets with phishing-resistant MFA, Kerberos pre-authentication enforcement, and disabling NTLM/SMBv1.

Cyber Security News·Sep 15, 16:05 UTC · 1d agoAdvisory

CISA Warns Hackers Exploit 17 Active Directory Techniques to Gain Control of Enterprise Networks

CISA and Five Eyes agencies issued joint guidance detailing 17 Active Directory attack techniques like Kerberoasting and DCSync, with hardening and detection advice.

CISA, the NSA, and cyber agencies from Australia, Canada, the UK, and New Zealand released joint guidance on September 15 covering 17 techniques attackers use to compromise Active Directory, including AD CS, Certificate Services, and Federation Services attacks. Named techniques include Kerberoasting, AS-REP roasting, password spraying, DCSync, NTDS.dit dumping, Golden and Silver Tickets, Golden SAML, and Skeleton Key. Recommendations include minimizing SPN accounts, enforcing AES encryption, disabling NTLM, account lockout thresholds of five attempts, phishing-resistant MFA, and Tier 0 prioritization. The guide also lists Windows event IDs 4769, 4768, 4625, 4771, and 2889 for detecting Kerberoasting and password spraying on domain controllers.

GBHackers·Sep 16, 06:04 UTC · 20h agoAdvisory

Mars Security brings threat intelligence to detection in real time

Mars Security launched Real-Time Intel-Based Detection, converting advisories from CISA and Mandiant into backtested MITRE ATT&CK-mapped detection rules for CrowdStrike, Wiz, and Splunk.

Mars Security announced a capability that automatically turns newly published threat intelligence from sources like CISA, Mandiant, Unit 42, and Microsoft into MITRE ATT&CK-mapped detection rules. Each rule is written in the native query language of the customer's telemetry (CrowdStrike Falcon, Wiz, Splunk, firewalls, identity providers, AWS, Snowflake, Databricks) and backtested against 30 days of the customer's data before deployment, with indicator scoring to drop noisy or stale indicators. The platform also maps existing detection coverage, flags gaps such as AWS CloudTrail tampering and pass-the-hash movement, and delivers some recommendations as open pull requests for detection-as-code workflows.

Help Net Security·Sep 8, 13:43 UTC · 8d agoTools

FlyWP Adds Proactive Vulnerability Protection with Patchstack

FlyWP integrated Patchstack into its managed WordPress hosting platform via a new FlySecurity Pro add-on for proactive vulnerability protection.

FlyWP, a managed WordPress cloud hosting and server management provider, has integrated Patchstack vulnerability intelligence into its platform. The new FlySecurity Pro add-on gives customers proactive protection against WordPress vulnerabilities from a single dashboard. The announcement is a vendor partnership rather than a new flaw or incident.

Patchstack·Aug 17, 15:16 UTC · Aug 17, 2026Tools1

Your Critical Vulnerabilities Might Not Be Your Biggest Risk

Autonomous penetration testing advocates prioritize exploitable attack paths over raw vulnerability severity for continuous security validation.

The article argues that scanner severity scores lack context: a critical flaw behind strong segmentation may be low priority, while a medium flaw on internet-facing systems can provide a foothold chained toward sensitive data. It positions autonomous penetration testing and attack path validation as the execution layer for continuous security validation, replacing point-in-time assessments. The piece is vendor-authored thought leadership rather than incident or vulnerability news.

The Hacker News·Sep 11, 11:30 UTC · 5d agoIndustry1

LastPass enhancements improve visibility, governance, and control

LastPass releases SaaS monitoring enhancements, Mobile Smart Scanner, and auto-enrolled dark web monitoring across its password management products.

LastPass announced enhancements to SaaS Monitoring and SaaS Protect in its Business Max offering, including Persistent Monitoring that keeps visibility active through the browser extension even when users are signed out, fully released as of July. It launched Mobile Smart Scanner to convert printed, handwritten, or screenshot passwords into vault credentials, and began phasing in automatic enrollment of all consumer accounts in dark web monitoring. The company also completed its transition to a Unified Admin Console, added company-wide onboarding links, and passed SOC 2 and ISO 27001/27701 audits with zero findings for the second consecutive year.

Help Net Security·Sep 1, 00:00 UTC · 16d agoTools

How to build an exposure management program the business trusts: Lessons from Tenable’s CSO

Tenable's CSO describes an AI-driven exposure management program that consolidates tool sprawl and translates cyber risk for boards.

A Tenable blog post shares lessons from CSO Robert Huber on moving to an AI-driven exposure management program. It argues tool sprawl and data silos hinder holistic risk assessment and that exposure management unifies attack-surface data into business-level metrics for the C-suite.

Tenable Blog·Aug 27, 14:30 UTC · 20d agoIndustry

Hackers Impersonate IT Support on Microsoft Teams to Take Control of Employee PCs

Microsoft warns of a human-operated campaign where attackers pose as IT support in Teams to gain remote PC control and reach domain controllers.

Microsoft Threat Intelligence observed attackers abusing Microsoft Teams external collaboration to impersonate IT/helpdesk staff, persuading employees to grant screen control via Quick Assist or RMM tools. Operators deploy malicious MSI packages via silent msiexec, run encrypted JavaScript implants through portable Node.js, and persist via EdgeUpdate Run keys or Startup folder entries. The Node.js backdoor uses HTTPS long-polling C2, captures screenshots, enumerates Active Directory, and moves laterally over WinRM (TCP 5985) to domain controllers and certificate authorities. Initial access maps to MITRE ATT&CK T1566.003 (Spearphishing via Service); no Teams vulnerability is exploited.

GBHackers·Sep 8, 13:28 UTC · 8d agoPhishing & fraud in the wild

HOL Guard: Open-source antivirus for AI agents

HOL Guard is an open-source local guardrail that pauses AI coding agents before risky actions like secret access and prompt injection.

HOL Guard sits between AI coding agents (Claude Code, Cursor, Codex, Gemini CLI and others) and the host machine, intercepting risky commands before execution with checks taking under 50 milliseconds and running fully offline. It offers four sensitivity modes — Gentle, Balanced (default), Strict, and Paranoid — and parses command structure, environment, sensitive-path access and network destinations to decide when to interrupt. The core runtime is free and open source on GitHub, with 552,000 downloads reported; the vendor says it has no telemetry on adoption because collection is off by default.

Help Net Security·Aug 31, 12:02 UTC · 16d agoAI tools & infra1

The Agentic SOC – From AI Theater to Real Defense

Recorded Future and Accenture experts outline how security teams can move beyond 'AI theater' toward agentic SOC operations guided by measurable KPIs.

Recorded Future published a blog featuring perspectives from its own and Accenture experts on building an agentic security operations center. The piece argues organizations should prioritize measurable KPIs and proactively mitigate risks from autonomous agents. It also discusses evolving the analyst role from managing alerts to managing agents.

Recorded Future·Sep 1, 00:00 UTC · 16d agoIndustry