ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Admin By Request”

1,332 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 420Exploit / PoC 217Malware 200Ransomware 153Data breach 79Threat actor 67Phishing & fraud 53Industry 51Policy & legal 34AI safety & security 18Research 13Tools 12AI tools & infra 8AI industry 7
SeverityAllcritical 617high 345medium 242low 94info 43

12 Best Endpoint Privilege Management (EPM) Tools Compared (2026): Features & Pricing

A 2026 buyer's guide compares 12 endpoint privilege management tools, ranking CyberArk and BeyondTrust as enterprise leaders.

An editorial comparison evaluates 12 endpoint privilege management (EPM) tools on elevation control, manageability, and pricing model. The guide argues that standing local-admin rights fuel ransomware and lateral movement, making their removal a high-impact control that cyber insurers increasingly mandate. CyberArk and BeyondTrust are positioned as enterprise-depth leaders, with Delinea, Heimdal, and ManageEngine for the mid-market, and Admin By Request and CyberFOX AutoElevate for SMBs and MSPs. Pricing is generally per endpoint or per user, and the article is explicitly an assessment rather than a product release or incident report.

GBHackers · 4d agoIndustry 4 sources

Top 10 Best Endpoint Privilege Management (EPM) Tools in 2026

A 2026 scorecard ranks ten endpoint privilege management tools, led by BeyondTrust, ThreatLocker and Delinea for elevation, coverage and policy depth.

The article ranks ten endpoint privilege management (EPM) tools using weighted criteria covering elevation workflow, platform coverage, policy depth, time-to-value and value. BeyondTrust scored highest overall (8.4) for cross-platform breadth, with ThreatLocker (8.2), Delinea (8.1) and Admin By Request (8.0) highlighted for allowlisting integration, cloud administration and deployment speed respectively. It also notes that Netwrix acquired CoSoSys in 2024, which affects bundling when shortlisting both EPM and device control.

Cyber Security News · 5d agoIndustry

Introducing the Admin plugin for ChatGPT Work and Codex

OpenAI launched an Admin plugin for ChatGPT Work and Codex to manage workspace usage, members, permissions, and limits.

OpenAI introduced an Admin plugin for ChatGPT Work and Codex aimed at enterprise workspace administration. The plugin lets administrators analyze workspace usage, manage members and permissions, adjust usage limits, and act on admin requests. The announcement is a routine product feature launch with no security incident or vulnerability details.

OpenAI News · 21d agoAI industry

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

Wiz found LiteLLM auth bypass (CVE-2026-59822) and post-auth RCE (CVE-2026-59821) chainable to cloud compromise; the bypass is in CISA KEV with in-the-wild exploitation.

Wiz scanned roughly 3,074 internet-facing LiteLLM deployments and found 9.6% accepted the default master key sk-1234 or required no authentication, making post-auth attacks effectively pre-auth. The MCP endpoint accepts any Bearer token and grants a valid session (CVE-2026-59822), confirmed exploited in the wild via honeypots and added to CISA's Known Exploited Vulnerabilities catalog. Custom code guardrails allow post-auth root-level RCE via exec(compile(...)) (CVE-2026-59821), while pass-through endpoints lack URL validation, enabling cloud credential theft in post-auth scenarios. All assigned vulnerabilities have been patched; the research was presented at DEF CON 34.

Wiz Blogupdated · 5d agofirst · 6d agoExploit / PoC in the wild 4 sourcesCVE-2026-59822CVE-2026-59821

AI bots "Timmy," "Ren," and "Jackie" are flooding social media with slop

iLands AI agents 'Ren', 'Timmy', and 'Jackie' spammed Mastodon admins and writers with unsolicited account requests and paid-citation offers after blocked signup attempts.

AI agents from startup iLands, including personas named Ren, Timmy, and Jackie, sent polite unsolicited messages to Mastodon server administrators requesting user accounts, though admins report the requests came only after multiple earlier account-creation attempts were blocked or closed. Writers, including Tedium editor Ernie Smith, received waves of unsolicited emails from the iLands.app domain offering to cite their work for a fee of roughly $25. Mastodon admins have largely blocked the bots, but iLands agents remain active on Bluesky and X as part of a startup promoting a mixed human-agent social platform.

Ars Technica · AI · 1d agoAI industry

A Deep Dive Into Attempted Exploitation of CVE-2023

Mirai-like botnet scans exploit TP-Link EOL router flaw CVE-2023-33538 after CISA KEV addition, though observed exploit code is flawed.

Unit 42 observed large-scale automated scans attempting to exploit CVE-2023-33538 in end-of-life TP-Link TL-WR940N, TL-WR740N and TL-WR841N routers after CISA added the flaw to its KEV catalog in June 2025. HTTP GET requests inject commands via the ssid1 parameter at the /userRpm/WlanNetworkRpm endpoint to download and execute an arm7 ELF binary, a Mirai variant related to the Condi IoT botnet. Firmware emulation and reverse engineering showed the observed exploits are flawed and would fail, but the underlying vulnerability is real and successful exploitation requires authentication to the router's web interface. TP-Link confirmed the devices are end-of-life with no patches available and recommends replacing units and eliminating default credentials.

Palo Alto Unit 42 · 27d agoExploit / PoC in the wildCVE-2023-335381

Dell Secure Connect Gateway Critical Flaws Allow Unauthenticated Remote Code Execution and Admin Access

Dell patched three critical Secure Connect Gateway flaws (CVE-2026-80172 up to CVSS 9.8) enabling unauthenticated admin access, remote code execution, and host takeover.

Dell Security Advisory DSA-2026-382 fixes three critical vulnerabilities in Secure Connect Gateway (SCG) 5.0, affecting appliances earlier than 5.36.00.16 and applications earlier than 5.36.00.00. CVE-2026-80172 (CVSS 9.8) allows unauthenticated replay of captured requests to obtain ADMIN access due to missing nonce and time validation; CVE-2026-61410 (9.4) enables unauthenticated command execution via missing authorization; CVE-2026-80238 (9.3) involves an exposed Docker socket allowing root access and container escape. Dell urges immediate upgrades and recommends restricting management interfaces to trusted networks and rotating credentials if compromise is suspected.

GBHackers · 7d agoVulnerabilityCVE-2026-80172CVE-2026-61410CVE-2026-80238