ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Target”

757 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 8755Ransomware 8213Vulnerability 6868Exploit / PoC 4038Threat actor 3954Data breach 3141Phishing & fraud 2630Policy & legal 2000Industry 1170AI safety & security 297Advisory 273Research 253AI tools & infra 145AI research 142
SeverityAllcritical 16261high 13252medium 7953low 3907info 780

Speculative Decoding in vLLM on AMD GPUs

vLLM benchmarks speculative decoding on AMD Instinct MI300X and MI355X GPUs across five drafting methods including EAGLE-3 and native MTP.

The vLLM project documents draft-and-verify speculative decoding support for AMD GPUs via ROCm, comparing native MTP, Gemma 4 MTP, EAGLE-3, DFlash, and DSpark drafting approaches. Output-token throughput effects varied with drafting method, proposal length, model family, draft checkpoint, workload, and acceptance behavior. The post also covers how to enable each method plus practical tuning and observability considerations.

Hacker News · AI · 8d agoAI tools & infraHN 141↑ · 52 comments1

PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector

Check Point details PuzzleMask, a plain-prose technique that bypasses LLM gatekeeper policy checks, letting hidden payloads reach target models unreviewed.

Check Point Research describes PuzzleMask, a prompt-crafting technique that hides policy-violating payloads inside plain-English prose wrappers, bypassing quick LLM-based policy checks without emojis, Base64, or invisible formatting. The researchers tested 23 automated prompts against gatekeepers including GPT-4o-mini, GPT-OSS-Safeguard 20b, Claude 3 Haiku, and Llama Guard 3, and all were classified as safe despite policies that flagged the plain versions. When submitted to GPT-5 in thinking-high mode with a Python interpreter, the target model extracted and acted on the payload in over 90% of trials. The technique is not itself a jailbreak but can carry a jailbreak prompt as payload; mitigations include input paraphrasing, hardened gatekeeper policies, and output monitoring.

Check Point Researchupdated · 5d agofirst · 5d agoAI safety & security 2 sources

Countering misuse of AI: September 2026 / Anthropic

Anthropic publishes threat intelligence on Claude misuse across seven harm areas from December 2025 through August 2026.

Anthropic's Threat Intelligence team details disrupted operations using Claude Haiku, Sonnet, and Opus across cyber operations, influence operations, surveillance, scams, biological misuse, weapons development, and distillation. The report introduces Generative Threat Groups (GTGs), including state-sponsored groups and financially motivated individuals running AI-augmented multi-victim campaigns. It argues AI uplift now collapses the gap between state-sponsored operations and lone actors, aided by frameworks like PentAGI.

Lobsters · securityupdated · 3d agofirst · 4d agoAI safety & security 13 sources1

When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi

Unit 42 red-teamed Amazon Bedrock multi-agent applications, demonstrating prompt-injection attack chains that leak agent instructions and invoke tools, mitigated by Bedrock Guardrails.

Unit 42 red-teamed Amazon Bedrock Agents' multi-agent collaboration in Supervisor and Supervisor with Routing modes. The demonstrated attack chain detects the operating mode, discovers collaborator agents, delivers attacker-controlled payloads, and can disclose agent instructions and tool schemas and invoke tools with attacker-supplied inputs. No vulnerabilities were found in Bedrock itself, and the built-in prompt attack Guardrail blocked the attacks when properly configured. The researchers collaborated with Amazon's security team and frame the findings as a broader prompt injection risk for LLM-based systems.

Palo Alto Unit 42 · 29d agoAI safety & security

Introducing Unit 42’s Attribution Framework

Unit 42 releases its Attribution Framework, a systematic method using Diamond Model and Admiralty scores to attribute activity clusters to named threat actors.

Palo Alto Networks' Unit 42 introduced a structured framework for threat actor attribution built on the Diamond Model of Intrusion Analysis and Admiralty reliability/credibility scoring. The framework tracks activity at three levels: activity clusters (named CL-STA, CL-CRI, CL-UNK, or CL-MIX), temporary threat groups, and named threat actors using the constellation naming schema. Analysts score evidence across TTPs, tooling, malware code, OPSEC, infrastructure, timelines, and victimology to decide when to merge or elevate clusters, avoiding premature group naming.

Palo Alto Unit 42 · 29d agoResearch

Weekly Cybersecurity Newsletter – Top 50 Biggest Cybersecurity Stories of the Week

GBHackers weekly digest rounds up 50 stories including Microsoft's 973-CVE patch drop, exploited Cisco FMC flaws, and Claude agent attacks.

GBHackers' September 7-12, 2026 newsletter summarizes the 50 biggest cybersecurity stories of the week. Highlights include Microsoft patching a record 973 CVEs with two exploited zero-days, active exploitation of Cisco FMC, Check Point VPN and Ivanti flaws, China-linked crews chaining Chrome and Windows zero-days, AI agents mass-exploiting PaperCut to compromise 440 servers, and the emergence of Panzer cross-platform ransomware. It also covers Anthropic and OpenAI agentic AI incidents and CrowdStrike's SafeMind launch.

GBHackers · 18h agoIndustry in the wild

The Fraud Ecosystem: A Transition From Known Marketplaces to a Fragmented Environment

Rapid7 analyzes how fraud marketplaces are fragmenting into specialized shops after larger marketplaces were dismantled, aided by new MITRE F3 framework

Rapid7 reports a shift from large known fraud marketplaces to a fragmented environment of smaller specialized storefronts such as Xleet, Blackpass, Infodig, and Styx, operating across dark web channels, Telegram, and P2P options. These Fraud-as-a-Service shops sell stolen accounts, PII, synthetic identity generation, infrastructure, and money laundering support, supporting schemes like business email compromise. MITRE's Fraud Fighting Framework (F3), introduced in early 2026, aims to help security teams prioritize monitoring of fraud TTPs, particularly account takeover techniques. Fraud damages are anticipated to approach hundreds of billions of USD.

Rapid7 Blog · 4d agoPhishing & fraud

NVIDIA Details BioNeMo Inference Runtime (BioIR): 2.90x Higher Boltz-2 Folding Throughput and 58.5K Residues per GPU-Hour on 8xH100

NVIDIA released BioNeMo Inference Runtime (BioIR), an open-source PyTorch-compatible library delivering 2.90x higher Boltz-2 protein-folding throughput on 8xH100 GPUs.

NVIDIA detailed BioIR, a Python library that accelerates Boltz-2, OpenFold2, and OpenFold3 structure-prediction inference on NVIDIA GPUs while preserving standard PyTorch workflows. On a matched benchmark of 1,000 human dimers on 8xH100 80GB GPUs, BioIR delivered 58.5K folded residues per GPU-hour versus 20.2K for a torch.compile baseline, a 2.90x throughput gain. BioIR already powered the AlphaFold Database expansion, generating about 31 million candidate complexes across 4,777 proteomes, with 1.81 million released as high-confidence predictions. Extrapolated to 1 million targets, estimated folding energy drops from 35 MWh to 11 MWh at 8-GPU TDP equivalents.

MarkTechPost · 5d agoAI tools & infra1

Coupled Calibration and Learning: Mitigating Teacher Bias in LLM Distillation without Target-Domain Reward Feedback

CCL couples teacher calibration with student updates via token-level branching, provably removing teacher bias in LLM distillation.

The paper proposes Coupled Calibration and Learning (CCL), an LLM distillation algorithm that alternates teacher calibration using source-question reward feedback with student training on target questions under covariate shift. Each iteration calibrates the teacher on source feedback, trains the student on target questions, and lets the updated student inform subsequent calibration. The authors prove the student's expected KL divergence to the oracle student converges to zero at a polynomial rate, and show regularized direct matching error can remain bounded away from zero.

arXiv cs.AI / cs.LG / cs.CL · 13h agoAI research

25 Years of Mass Surveillance Is Enough

Bruce Schneier and Cindy Cohn argue post-9/11 mass surveillance expanded far beyond its counterterrorism justification and should be reevaluated for costs to rights.

An essay by Bruce Schneier and Cindy Cohn (originally in Lawfare) traces the post-9/11 shift from targeted surveillance to mass collection of telephone and internet metadata. It cites the Section 215 bulk phone records program, struck down in interpretation by the Second Circuit in 2015 and curtailed by the USA Freedom Act, and the NSA's Upstream program under Section 702 of the 2008 FISA Amendments Act, which ended content searches in 2017. The authors note mass surveillance now serves routine law enforcement and immigration actions, with FBI Director Kash Patel confirming purchases of Americans' data from brokers, and private systems like Flock license plate readers and venue facial recognition feeding government access.

Schneier on Security · 19h agoPolicy & legal

Six in 10 Cyberattacks in Colombia Target Hospitals

A Biofile report based on IBM X-Force data finds 60% of cyberattacks in Colombia target healthcare institutions, making medical data a prime target.

A Biofile report drawing on IBM's X-Force Index found that six out of ten cyberattacks recorded in Colombia target health sector institutions. The finding highlights the growing exposure of hospitals and clinics to digital threats. Medical information has become one of the main targets for attackers in the country.

DataBreaches.net · 2d agoResearch

Top 10 Best Mobile Threat Defense (MTD) Solutions in 2026

Roundup of 2026 mobile threat defense tools recommends Zimperium and Lookout for targeted-attack detection and Defender for Endpoint for Microsoft shops.

This guide ranks ten mobile threat defense solutions, recommending Zimperium and Lookout for on-device detection against targeted users such as executives and journalists, and Microsoft Defender for Endpoint mobile for organizations already licensing Microsoft 365 E5. It explains that MDM enforces configuration while MTD detects attacks, and that mobile phishing now arrives via SMS, messaging apps and QR codes rather than email. It also highlights mercenary spyware and zero-click exploits as shifting requirements for high-risk users, referencing Apple's threat-notification program and Lockdown Mode.

Cyber Security News · 6d agoIndustry

A Secretive DHS ‘Predictive Policing’ Unit is Analyzing Americans’ Financial Habits and Pulling Them Over

404 Media reveals DHS Border Patrol's secretive Predictive Intelligence Targeting Teams (PITT) analyzing Americans' financial activity and feeding intelligence to local police for traffic stops.

404 Media identified Predictive Intelligence Targeting Teams (PITT) in the Spokane Sector (Washington) and Laredo Sector (Texas), which review law enforcement-sensitive databases including Americans' financial activity and pass intelligence to local police. In one case, a PITT analyst flagged financial patterns associated with narcotics activity, leading Montana Highway Patrol to stop a driver for an obstructed license plate and charge him with DUI and possession with intent to distribute. CBP declined to say what financial data is monitored or whether warrants are obtained; the program extends AP's earlier reporting on ALPR-based predictive policing.

404 Media · 7d agoPolicy & legal

Alissonerdx/Minimax-H3-ComfyUI — new model trending #30 on Hugging Face

Alissonerdx released a rank-64 LoRA sharpening videos from MiniMax H3 in ComfyUI via guide-latent conditioning, trending #30 on Hugging Face.

Alissonerdx published Minimax-H3-ComfyUI, a repository containing a rank-64 LoRA (minimax_h3_lms_v1.0_r64) that sharpens source videos while keeping them photorealistic. It targets the MiniMax H3 ref2va base model, runs with Comfy-Org's ComfyUI-ready weights, and uses the native MiniMaxH3AddGuide node for aligned guide-latent conditioning. The release ships with a ComfyUI workflow, eight before/after example videos, and an Apache 2.0 license.

Hugging Face trending models · 9d agoModel release2

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News · 26d agoResearch2

ThreatsDay: GhostJacking AI Attacks, EtherHiding ClickFix, Cursor CLI Flaw + 17 More Stories

A weekly bulletin aggregating short security updates, including the City-Forum data-theft campaign, a ShipMonk breach, a Cursor CLI flaw, and GhostJacking AI attacks.

The Hacker News ThreatsDay Bulletin bundles roughly 20 short updates across cloud services, AI tools, malware, breaches, and scams. Highlights include the City-Forum campaign pulling data from unauthenticated guest access in Salesforce Experience Cloud and ServiceNow Service Portals since March 2025, and a ShipMonk breach exposing Trezor customer order data for orders in seven countries between May 10 and August 8, 2026. Other items cover a patched Cursor CLI flaw that let cloned repositories run commands before the workspace-trust prompt, Okta's analysis of the Work Panel vishing console used by actors like UNC6671, and GhostJacking AI agent hijacking via a patched Claude Desktop sandbox escape. Meta also launched an on-device WhatsApp Scam Alert machine learning model that keeps message content on the device.

The Hacker News · 28d agoIndustry

Tracking the Unseen: An Occlusion-Robust Framework for Target Tracking Under Full and Long-Term Occlusion

Occlusion-robust tracker combining YOLOv11n, Kalman filtering, and appearance Re-ID cuts identity switches and beats OccluTrack by 18.1% MOTA on OVIS.

The framework integrates YOLOv11n object detection, Kalman Filter motion prediction, and occlusion-aware appearance-based re-identification to maintain target identity through full and long-term occlusion. Six Re-ID architectures were evaluated under identical conditions, with the Occlusion-Aware Mask Network (OAMN) performing best. On the public OVIS dataset it improves MOTA by 18.1% and IDF1 by 25.1% over OccluTrack while reducing identity switches by 12.8%; on a custom military surveillance dataset it achieves MOTA 0.734 and IDF1 0.729.

arXiv cs.AI / cs.LG / cs.CL · 13h agoAI research

Metasploit Wrap Up: This One Goes to Sixteen!

Metasploit adds 16 modules including 10 exploits, five covering CISA KEV vulnerabilities in Cisco, SonicWall, PaperCut, JetBrains and Langflow.

Rapid7's weekly Metasploit update ships 16 new modules, 10 of them exploit modules, with five targeting CISA KEV entries. New exploits cover Cisco Secure Firewall Management Center auth bypass (CVE-2026-20079), a SonicWall SMA1000 SSRF-to-root RCE chain (CVE-2026-83548/CVE-2026-83549), JetBrains TeamCity deserialization RCE (CVE-2026-63077), PaperCut NG/MF chain (CVE-2026-81578/CVE-2026-82078), and Langflow authenticated RCE (CVE-2026-19295). The SonicWall and PaperCut chains were reported as actively exploited zero-days, and a new ESC8 relay module exploits CVE-2026-20929 against AD CS Web Enrollment.

Rapid7 Blog · 4d agoTools in the wildCVE-2025-66516CVE-2025-54988CVE-2026-20929+8 CVEs1

Tactical Threat Intelligence Explained: Benefits & Use Cases

Recorded Future explains tactical threat intelligence, covering attacker TTPs, IOC collection, and use in SOC detection, response, and control hardening.

Recorded Future published an explainer on tactical cyber threat intelligence, describing how it differs from strategic and operational intelligence by focusing on attacker tactics, techniques, and procedures. The piece outlines sources such as OSINT, dark web monitoring, malware analysis, and internal telemetry, and describes the intelligence lifecycle from collection through dissemination. It argues tactical CTI improves detection tuning, incident response, preventive controls, and resource allocation for SOC teams.

Recorded Future · Aug 17, 2026Industry

U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches

U.S. Treasury sanctioned nearly 60 Iran-linked entities, including MOIS-affiliated Mabna Institute hackers behind breaches of U.S. critical infrastructure and millions in crypto theft.

The U.S. Treasury launched Operation Economic Outcast, designating nearly 60 Iran-linked entities, individuals, and vessels across nuclear, missile, oil, cyber, and digital asset networks. Five sanctioned individuals are members of the Tehran-based Mabna Institute indicted last week; three allegedly breached and exfiltrated data from U.S. energy, defense, healthcare, IT, and financial organizations since late 2023. TRM Labs traced roughly $16.8 million across 30 wallets tied to the members, and the State Department announced a reward of up to $10 million. The action follows Iranian hacking of FBI Director Kash Patel's email and attacks on over 30 U.S. water and wastewater utilities.

The Hacker News · 21d agoPolicy & legal in the wild

The 20 Most Common Passwords Hackers Target in 2026

Huntress details the 20 most common passwords of 2026 and how attackers use brute force, spraying, and credential stuffing against weak credentials.

Huntress published an awareness piece based on NordPass's seventh annual list of the 200 most commonly used passwords, compiled from exposed data in cyberattacks across 44 countries. The top passwords remain simple sequences and variants such as "123456", "admin", "password", and "P@ssw0rd", all crackable in under a second. The article explains four password attack types: brute force, password spraying, credential stuffing, and dictionary attacks. Huntress cites its own data showing more than 1 in 4 IT professionals consider employees' password habits their biggest weakness, and recommends avoiding common passwords, not reusing credentials, and combining letters, numbers, and symbols.

Huntress · 5d agoPhishing & fraud

Kimi-maker Moonshot AI targets $2 billion in annual revenue

Moonshot AI targets $2 billion annualized revenue by year-end on K3 open-weight demand; Anthropic alleges Kimi routed ~300,000 requests to Claude Opus.

Bloomberg reported that Moonshot AI is targeting $2 billion in annualized revenue by the end of 2026, double its August run rate, driven by its open-weight K3 model. OpenRouter data shows up to 300 billion tokens generated per day by K3 models, though usage has slipped slightly in recent months. Moonshot's projection remains far below reported figures for OpenAI ($40B) and Anthropic ($65B), with lower margins due to freely available weights. Anthropic this week alleged Kimi routed nearly 300,000 requests to Claude Opus and collected more than 23 million responses for use in Moonshot's training.

TechCrunch · AI · 4d agoAI industry

Benign Loss Landscapes Can Coexist with Worst-Case Hardness

Theory paper shows tree tensor networks contain worst-case hard targets yet benign loss landscapes, with difficulty arising from degenerate saddles.

The paper studies tree tensor networks (TTNs), which generalize deep linear networks and Tucker decompositions and embed arbitrary read-once Boolean formulas. It proves that every local minimum that is minimum-norm is global for every realizable target, so bad local minima do not distinguish typical from worst-case problems. Instead, learning difficulty arises from high-order degenerate saddle points caused by rank-deficiency, illustrated via a parity function case study, linking landscape geometry to computational hardness.

arXiv cs.AI / cs.LG / cs.CL · 4d agoAI research

ThreatsDay: 200 Android Flaws, Browser-Built Phishing, 119K Scam Shops + 23 More Stories

Hacker News ThreatsDay digest: malicious browser extensions, AI-agent intrusions, NCSC shadow AI warning, M&A wire fraud, and 119,000-domain fake shops.

Socket found four malicious Chrome and Firefox extensions (J7Tracker, VREO, Orbit Tracker) stealing session tokens and wallet data from Axiom Trade and Padre users via attacker-controlled Vercel deployments. Hunt.io reported a Chinese-speaking operator using Claude Code, Alibaba Qwen, and DeepSeek with the SecFlow orchestration framework to automate intrusions against government and financial targets in Afghanistan, Thailand, Taiwan, and the US. The UK NCSC warned shadow AI use risks breaches and regulatory failure, Microsoft announced privacy-preserving Windows Age APIs, and Gen Digital described fake M&A wire-fraud scams. A 119,000-domain fake-shop operation called DoppelCart was also highlighted.

The Hacker News · 5d agoIndustry in the wild

Target leakage, not model class, explains reported accuracy in survey-based cardiovascular screening: a leakage-tiered audit of glass-box and tabular foundation models

Audits of 10 classifiers on BRFSS show target leakage, not model class, drives the reported 0.89 AUROC in survey-based cardiovascular screening.

The study benchmarks ten model classes, including glass-box and tabular foundation models, for prevalent myocardial infarction on 442,067 respondents of the 2022 BRFSS across five feature tiers of decreasing leakage risk. Removing two post-diagnostic features costs every model 0.049-0.051 AUROC and collapses performance into a 0.0045-wide band, and the explainable boosting machine matches all alternatives within 0.005 while scoring roughly 104x faster than the strongest foundation model. Frozen models transport within 0.002 AUROC to 2023 data; the authors conclude evaluation practice and feature sets, not model capacity, are the binding constraint.

arXiv cs.AI / cs.LG / cs.CL · 5d agoAI research1

What Makes Adversarial Examples Transfer Across Deepfake Detectors?

A controlled study of 60 deepfake detectors shows adversarial example transfer depends heavily on source-target compatibility, with source averaging understating vulnerability.

The study evaluates adversarial example transferability across 60 deepfake detectors spanning six backbones, two pretraining regimes, and five training-data configurations, using AutoAttack (AA) and Carlini-Wagner with Expectation over Transformation (CW-EOT). Transfer rises sharply when source and target share an exact backbone, architecture family, pretraining regime, or training data, with the dominant factor depending on the attack. Mean attack success rate is 7.21% under AA and 19.52% under CW-EOT for single sources, while a multi-source oracle reaches 64.48% after excluding exact matches, showing source averaging can substantially understate target vulnerability. The authors release 240,000 adversarially perturbed images, pairwise transfer results, detector configurations, and evaluation code.

arXiv cs.CR · 6d agoAI safety & security

Cross-modal learning for SAR target recognition using optical vision foundation models

Frozen DINOv3 optical prototypes supervise SAR target recognition without EO/SAR pairs, improving classification on the heavily imbalanced UNICORNv2 dataset.

The framework aligns SAR embeddings to class-level prototypes built from a frozen DINOv3 electro-optical encoder, requiring no strict EO/SAR image pairs. At inference the SAR model operates independently without access to optical imagery. On UNICORNv2, a civilian vehicle dataset with heavy speckle and severe class imbalance, EO prototype alignment improves accuracy over frozen DINOv3, SAR-only finetuning, and unpaired distribution alignment baselines.

arXiv cs.AI / cs.LG / cs.CL · 8d agoAI research

Hackers Frequently Target Healthcare and Finance Orgs

A new Huntress survey indicates threat actors frequently target healthcare organizations and banks because of the highly personal data they hold.

Huntress published survey findings indicating that healthcare organizations and banks are frequent targets for threat actors. The piece attributes this to the highly personal information these sectors handle. The article is framed around cyberattack readiness rather than a specific incident.

Huntress · 14d agoIndustry

Trump Targets Foreign Technology in New U.S. Power Grid Security Order

Trump's Executive Order 14420 declares a national emergency to restrict foreign-made bulk-power grid equipment over cyber, sabotage and supply-chain risks.

Executive Order 14420, signed August 26, declares a national emergency regarding the foreign supply of bulk-power system electric equipment to the United States. It empowers the Energy Secretary to restrict transactions with designated Covered Foreign Entities involving equipment, software, firmware, digital services, maintenance services, and remote-access capabilities. Covered equipment includes transformers, generators, inverters, RTUs, PLCs, intelligent electronic devices, and protective relays, with transmission rated 69 kV or higher in scope while local distribution is excluded. Already-installed foreign equipment may be subject to identification, isolation, monitoring, or replacement requirements, with phased compliance and pre-qualified vendor exemptions permitted.

Security Affairs · 18d agoPolicy & legal

Srsly Risky Biz: Trump's Private Hacker Memo Is the Right Idea

A Trump presidential memo directs DHS to authorize vetted private-sector hackers to conduct cyber operations against foreign cybercriminal groups (CE-TCOs).

A presidential memorandum directs the Department of Homeland Security to establish a program authorizing private companies to conduct cyber surveillance and cyber effects operations against Cyber-Enabled Transnational Crime Organisations (CE-TCOs). Participating companies must pass vetting, obtain government approval before operations, and post a USD $1 million bond. The accompanying fact sheet cites more than USD $20.8 billion in US losses to cyber-enabled crime in 2025. Critics worry about accidental escalation if operations touch foreign government systems.

Risky Business News · 27d agoPolicy & legal1

A bold new strategy or a dangerous precedent? Experts are divided on Trump's memo.

Trump presidential memorandum authorizes private-sector companies to conduct federally supervised hacking operations against transnational criminal organizations.

A newly signed presidential memorandum enlists private companies in federal law enforcement hacking operations aimed at transnational criminal organizations, with a 60-day window to establish the program. Experts told CyberScoop the shift raises attribution, targeting and constitutional questions, including risks of private firms accidentally attacking foreign governments and procedures for prior approval before targeting US persons. Critics likened the approach to historical letters of marque, while supporters including NSC cyber policy director Amanda Naylor framed it as bringing private-sector speed to the fight against cybercrime and fraud.

CyberScoop · Aug 13, 2026Policy & legal

What is Proactive Threat Intelligence? | Recorded Future

Recorded Future publishes a vendor explainer on proactive threat intelligence, arguing external adversary context helps teams act before alerts fire.

Recorded Future published a conceptual blog on proactive threat intelligence, describing how external context on adversaries, infrastructure, stolen credentials, and vulnerability exploitation helps security teams act before intrusions surface internally. The piece outlines a four-step program: defining intelligence requirements, collecting external sources including OSINT and dark web, analyzing relevance to the organization, and driving security actions. Use cases include prioritizing CVEs by real-world exploitation activity and identifying external exposure before it becomes an internal incident.

Recorded Future · 2d agoIndustry

Hierarchical NeRF with JAX3D for Volumetric Rendering, Novel-View Synthesis, and 3D Reconstruction

MarkTechPost tutorial implements a hierarchical NeRF in JAX using jax3d volume-rendering primitives for novel-view synthesis and 3D reconstruction.

The tutorial builds an end-to-end hierarchical Neural Radiance Field using JAX, Flax, Optax, and jax3d's volume-rendering functions (sample_along_rays, volume_rendering, sample_piecewise_constant_pdf). It implements positional encoding, skip connections, separate coarse and fine networks, and view-direction conditioning with hierarchical importance sampling. Training uses JAX JIT compilation, Adam optimization, exponential learning-rate decay, and gradient clipping. Evaluation covers PSNR, depth and opacity visualization, 360-degree rendering, and marching-cubes geometry extraction.

MarkTechPost · 2d agoAI research

The Top 4 Threats We Found by Investigating Every Alert for a Quarter

Prophet Security's quarterly threat report finds identity attacks made up roughly half of confirmed malicious activity, with stolen authenticated sessions bypassing conditional access controls.

Between May 1 and July 31, 2026, Prophet Security investigated every alert in customer environments immediately on arrival; about 7% of completed investigations were confirmed malicious. Direct account/session attacks made up roughly 18% of confirmed activity, with replayed authenticated sessions bypassing conditional access since no re-authentication occurs. Infostealer activity affected about a quarter of investigated organizations, mostly delivered via browsers through compromised websites, malicious ads, sponsored search results and ClickFix fake CAPTCHA gates, with payloads including Lumma Stealer, Vidar, HijackLoader and AsyncRAT. Credential phishing was the largest category at about 28%, with adversary-in-the-middle relays revealed by seconds-long MFA approvals from distant countries and MFA fatigue attacks exploiting automatic unlock policies.

BleepingComputer · 5d agoThreat actor in the wild

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

SpecterOps released CDP-Enable-BOF, a Beacon Object File that enables Chrome DevTools Protocol in live Chrome or Edge processes on Windows for session hijacking.

SpecterOps released CDP-Enable-BOF, an x64 Beacon Object File that activates Chrome DevTools Protocol inside running chrome.exe or msedge.exe processes on Windows, exposing cookies, history, saved passwords, and authenticated sessions without administrator rights. It calls Chromium's StartRemoteDebuggingServer on the browser UI thread to stay reliable under CFG, TLS, and CET, and was tested on Chrome 147 and Edge 147. The technique builds on work by DeathFlamingo and Cedric Van Bockhaven; Google had hardened remote debugging in Chrome 136 after attackers used it to steal cookies post-App-Bound Encryption. Defenders can watch Sysmon Event IDs 8 and 10 for injection into browser processes.

The Hacker News · 21d agoResearch2

Risks in IoT Supply Chain

Unit 42 analyzes multilayer IoT supply chain risks across hardware, firmware, and software, citing counterfeit Cisco switches and OpenWrt attacks.

Unit 42 examines weaknesses in the IoT supply chain ecosystem across hardware, firmware, operation, and vulnerability layers, noting that 89% of IT decision-makers reported IoT device growth and IDC forecast 41.6 billion connected IoT devices by 2025. Examples include counterfeit Cisco Catalyst 2960-X switches with possible backdoor access (F-Secure, July 2020), a March 2020 OpenWrt flaw enabling malicious update impersonation, and threat actor interest in TeamViewer remote support software. The report stresses that untracked third-party components and missing device inventories make it hard to assess vulnerability impact across vendors.

Palo Alto Unit 42 · 27d agoResearch