ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Empirical Security”

385 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllRansomware 63Vulnerability 63Malware 58Exploit / PoC 31Data breach 30Threat actor 29Policy & legal 27Phishing & fraud 21Industry 20Research 17AI safety & security 8AI industry 7AI tools & infra 4Advisory 3
SeverityAllcritical 117high 124medium 58low 58info 30

An Empirical Security Analysis of Open-Source Software Used in Onboard Satellite Systems

Study of 126 onboard satellite OSS repositories finds 2,827 security findings, 72% medium severity or higher, dominated by memory safety and code quality weaknesses.

Researchers performed an empirical security analysis of 126 public repositories of open-source software used in onboard satellite systems using SBOM generation, software composition analysis, static application security testing, infrastructure-as-code analysis, and secret scanning. After cleaning and deduplication the pipeline produced 2,827 findings, with medium-severity findings accounting for 49% and 72% classified medium or higher. A CWE-based taxonomy mapped all findings to eight weakness families, with Memory Safety and Code Quality dominating, followed by Input Validation and Injection. Project-developed code accounted for 81.4% of findings, though external dependency code remained relevant; findings do not establish mission-specific exploitability.

arXiv cs.CR · 5d agoResearch1

Forget the AI Slowdown—the Vulnerability Explosion Is Already Happening

AI-assisted bug hunting drives record vulnerability disclosures, with 66,401 CVEs logged in 2026 so far, nearly double last year's pace, straining defenders and open-source maintainers.

WIRED's Kernel Panic newsletter reports that AI-enhanced vulnerability discovery is producing record CVE volumes: 66,401 CVEs had been recorded in 2026 as of mid-September, versus 33,512 by the same date in 2025, according to cve.icu's Jerry Gamblin. Microsoft has patched 974 CVEs this month, Oracle shipped 1,448 patches in July versus 309 in July 2025, and Chrome's two June releases included 1,072 patches, more than the prior 23 major releases combined. Mozilla found 271 Firefox vulnerabilities in a single bug-hunting sprint using Anthropic's Mythos model. Experts warn that discovery now scales with compute while remediation scales with people, risking developers and under-resourced security teams being outpaced.

WIRED · Security · 17h agoIndustry2

Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

Unauthenticated RCE CVE-2026-58138 in Orkes Conductor is actively exploited; Fortinet blocked ~7,000 attacks; patch to 3.30.2.

Fortinet reports active in-the-wild exploitation of CVE-2026-58138 (CVSS v3.1 9.8), an unauthenticated remote code execution flaw in Orkes Conductor 3.21.21 before 3.30.2. Attackers submit inline workflow definitions with malicious JavaScript or Python expressions to the workflow API, escaping unsandboxed GraalVM evaluators configured with HostAccess.ALL to run arbitrary OS commands. Fortinet blocked 1,290 attempts in 24 hours as of September 9, 2026, and nearly 7,000 between September 2-9, with most activity from Germany, Hong Kong, Indonesia, the U.A.E., and India. Previdian and Empirical Security also observed exploitation since July 24, 2026.

The Hacker News · 20h agoExploit / PoC in the wild 2 sourcesCVE-2026-581381· 1 read

Toward an Empirical Probabilistic Risk Manifestation Model of Organizational Cybersecurity in SMEs

Empirical study of 22 SME security assessments builds a probabilistic risk model and shows assessments can be cut 24-45% while retaining most critical findings.

Researchers analyzed 281 validated security findings from 22 real-world SME cybersecurity assessments conducted over two years via a pro bono university clinic. They derived an empirical Risk Manifestation Model linking eight organizational security functions to two exposure conditions, five attack mechanisms, and six outcome categories, using probability propagation to identify dominant risk pathways. The dominant pathway runs from asset exposure to credential compromise to unauthorized access, stable under leave-one-organization-out analysis. Retaining six functions reduces assessment burden by 24% while preserving 97% of critical findings; five functions cut burden 45% while preserving 89% of critical findings.

arXiv cs.CR · 6d agoResearch

Autonomy in Check: Governor-Mediated Adaptive Security at the Edge

Split-control architecture adds a deterministic governor to validate LLM and rule-based planner intents before eBPF enforcement at the edge.

Researchers propose a split-control edge security architecture in which an untrusted planner emits typed security intents that a deterministic governor checks against safety, resource, temporal-stability, and proportionality invariants. Admitted actions are bound to signed receipts and compiled into pre-installed eBPF map updates. A Raspberry Pi 5 prototype on a university 5G test network admitted, rejected, and bounded intents at microsecond cost.

arXiv cs.CR · 3d agoResearch1

Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF

AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.

GreyNoise tracked a likely Russian-speaking actor using AI (OpenAI Codex harness plus a DeepSeek model) to develop, test, and deploy exploits for PaperCut NG/MF (CVE-2026-81578, CVE-2026-82078) starting 31 August 2026. The actor compromised at least 440 PaperCut instances across 395 organizations in 48 countries, achieving domain admin at 12 victims — fastest time to domain admin was five minutes and a US high school was fully compromised in seven minutes. Attack paths involved LSASS memory and registry secret harvesting, pass-the-hash to domain controllers, noPac attacks, account additions to Domain Admins, and DCSync to exfiltrate full NTDS.DIT credential dumps. Impact scope suggests access development potentially for handoff, with prior PaperCut intrusions historically leading to extortion.

GreyNoise · 11d agoThreat actor in the wildCVE-2026-81578CVE-2026-82078CVE-2021-42278+1 CVEs1

Characterizing Network Centralization and Observability in the Remote MCP Ecosystem

A measurement study of 179 remote MCP servers finds heavy infrastructure concentration (HHI 0.736) and a security-observability tradeoff in platform OAuth.

The paper introduces a three-tier observability framework (catalog metadata, passive compliance signals, live vulnerability analysis) applied to a stratified sample of 179 remote Model Context Protocol (MCP) endpoints from two public registries. The Herfindahl-Hirschman Index over ASN distribution is 0.736, well above the 0.25 high-concentration threshold, and 95% of commercial PaaS-hosted servers enforce gateway-level OAuth 2.1 with PKCE. Authentication correlates strongly with hosting platform choice rather than operator configuration, creating a security-observability tradeoff that constrains automated scanning for tool-poisoning vectors without prior credentials.

arXiv cs.CRupdated · 3d agofirst · 3d agoAI safety & security 2 sources1

Propagation Model for SSC attacks: Why SBOM (tools) don't tell the whole truth

Study shows open-source SBOM tools only cover structural exposure and vulnerability presence, missing code reachability and taint-path analysis stages.

An arXiv paper proposes a four-stage propagation model for software supply chain attack effects and empirically evaluates four open-source SBOM tools against it using three projects and the Log4j vulnerability as the test case. Current SBOM tools systematically support only Stage 1 (structural exposure) and Stage 2 (vulnerability class presence), while Stage 3 (code reachability) and Stage 4 (taint path analysis) require capabilities absent from the SBOM ecosystem. The authors argue propagation-centred SSC security research is needed to prevent cyber risk from evolving into systemic risk.

arXiv cs.CR · 15d agoResearch1