ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Shell”

68 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 1273Vulnerability 1007Exploit / PoC 646Ransomware 628Threat actor 365Data breach 165Phishing & fraud 115Policy & legal 75Industry 61AI safety & security 33Research 28Advisory 25AI tools & infra 17Tools 17
SeverityAllcritical 1753high 1710medium 739low 208info 68

The AI Malware Maturity Gap

Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.

Recorded Future proposes AIM3, a five-level model defining AI malware from LLM-translated to LLM-embedded, spanning experimentation to fully autonomous agentic campaigns. Public examples remain early-stage: PROMPTFLUX uses Google Gemini to rewrite its VBScript dropper (Level 1), while Lamehug/PROMPTSTEAL, attributed to APT28, invokes the HuggingFace API to generate reconnaissance commands (Level 3). The authors argue most current AI malware augments existing tradecraft rather than enabling one-click autonomous attacks.

Recorded Future · 21d agoResearch

Researchers open-source a Wi-Fi cyber range for security training

NTNU and Aegean researchers open-source a software-emulated Wi-Fi cyber range using mac80211_hwsim with LLM-assisted scenario building.

Researchers from the Norwegian University of Science and Technology and the University of the Aegean published a design and prototype for a cyber range dedicated to IEEE 802.11 security training, emulating access points and clients with mac80211_hwsim, Linux namespaces, hostapd, wpa_supplicant, dnsmasq, and FreeRADIUS. The platform bundles Aircrack-ng, Wireshark, and custom tools WPAxFuzz and Bl0ck, and can convert plain-language scenario descriptions into deployable definitions via a locally hosted Llama model. A working prototype covering scenario creation and deployment is on GitHub; monitoring, access control, and orchestration zones remain future work.

Help Net Security · 23d agoTools1

Srsly Risky Biz: Trump's Private Hacker Memo Is the Right Idea

A Trump presidential memo directs DHS to authorize vetted private-sector hackers to conduct cyber operations against foreign cybercriminal groups (CE-TCOs).

A presidential memorandum directs the Department of Homeland Security to establish a program authorizing private companies to conduct cyber surveillance and cyber effects operations against Cyber-Enabled Transnational Crime Organisations (CE-TCOs). Participating companies must pass vetting, obtain government approval before operations, and post a USD $1 million bond. The accompanying fact sheet cites more than USD $20.8 billion in US losses to cyber-enabled crime in 2025. Critics worry about accidental escalation if operations touch foreign government systems.

Risky Business News · 27d agoPolicy & legal1

AI "Mind Viruses" Can Spread Between Agents Through Persistent Prompt Files

Anthropic and EPFL researchers showed self-propagating payloads can spread between AI agents via persistent system-prompt files, though no in-the-wild spread was found.

A preprint released August 10, 2026 by Anthropic and EPFL researchers demonstrates that "mind virus" payloads can propagate between AI agents through persistent files such as SOUL.md and MEMORY.md that are injected into system prompts after context resets. In simulated agent chains modeled on OpenClaw, payloads stored in SOUL.md accounted for 88% of propagation attempts and succeeded 55% of the time, versus 17% success for ordinary workspace files; tested payloads ranged from crypto-ad text files to home-directory deletion. Susceptibility varied by model and configuration: Claude Sonnet 4.6 resisted and removed planted payloads, while DeepSeek V3.2, Qwen 3.5 32B, and Gemini 3 Flash adopted an ideological payload, and a one-paragraph warning in the system prompt reduced spread to near zero across 150+ adversarial payloads. No successful agent-to-agent propagation was found in the wild in archived Moltbook posts, and Anthropic's Frontier Red Team separately observed multiagent "turf wars" between unaware model instances sharing a codebase.

The Hacker News · 28d agoAI safety & security

13 million tool calls: auditing every AI coding agent action with Elastic Agent

Elastic Security Labs shows how Cursor hooks plus Elastic Agent turn AI coding agent activity into 13 million huntable security events.

Elastic Security Labs demonstrates auditing AI coding agent behavior by pairing Cursor hooks with Elastic Agent, capturing every tool call, shell command, file read, and MCP request as structured events. The dataset of 13 million captured events can be hunted with ES|QL, giving defenders visibility into agent actions.

Elastic Security Labs · Aug 11, 2026AI safety & security1