55
30
57
55
30
Chaotic Eclipse Releases Crowdstrike Falcon ZeroDay FalconFlank
Researcher Chaotic Eclipse released FalconFlank, a PoC zero-day privilege escalation exploit against CrowdStrike Falcon's Microsoft Office macro removal feature.
Security researcher Chaotic Eclipse (also known as Nightmare Eclipse) published FalconFlank, a proof-of-concept zero-day exploit for a privilege escalation flaw in CrowdStrike Falcon Sensor. It abuses the Microsoft Office file malicious macro removal remediation feature, which runs with high privileges, and works on fully updated Windows 11 25H2 and Windows Server 2025 with Falcon Phase 3 Optimal Protection. CrowdStrike says it is investigating and advises customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy. The same researcher recently released zero-day PoCs against Kaspersky Endpoint Security (HardBreacher) and Avast Antivirus (PrettyPrague), the latter dumping the SAM database for a SYSTEM shell.
72
Horizon3 Announces Integration with CrowdStrike Falcon® Next-Gen SIEM
Horizon3 announces NodeZero integration pushing validated exposure findings into CrowdStrike Falcon Next-Gen SIEM for correlated investigations.
Horizon3 announced an integration enabling validated NodeZero findings to flow into CrowdStrike Falcon Next-Gen SIEM, available now in the CrowdStrike Marketplace. Security teams can ingest and correlate exposure data with endpoint, identity, cloud, and other telemetry during investigations. CrowdStrike claims Falcon Next-Gen SIEM delivers up to 150x faster search than legacy SIEMs at up to 80% lower total cost of ownership.
20
42
55
30
55
57
55
Operation Falcon II: Unit 42 Helps INTERPOL Identify Nigerian Business Email Compromise Ring Members
30
57
60
Prolific Microsoft 0-day hunter drops CrowdStrike Falcon exploit PoC
Researcher Nightmare Eclipse released a PoC for FalconFlank, a privilege escalation zero-day in CrowdStrike Falcon's Office macro remediation feature.
Researcher Nightmare Eclipse published a zero-day PoC dubbed FalconFlank targeting CrowdStrike Falcon's Microsoft Office malicious macro removal feature, achieving privilege escalation on fully updated Windows 11 25H2 and Windows Server 2025 with Optimal Protection and macro removal enabled. Kevin Beaumont independently confirmed the exploit works. The same researcher also released HardBreacher, an elevation-of-privilege bug in Kaspersky Endpoint (since fixed via update), PrettyPrague, an Avast Sandbox flaw that dumps the SAM database for a SYSTEM shell (Gen Digital is developing a patch), and GreenSection, an Nvidia memory corruption bug that crashes systems. CrowdStrike advises customers to disable the Suspicious Macro Removal Windows policy while it investigates.
55
Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon
Researcher Chaotic Eclipse released FalconFlank, a zero-day privilege escalation PoC abusing CrowdStrike Falcon's Office macro remediation; CrowdStrike is investigating and issued a tech alert.
Researcher Chaotic Eclipse published FalconFlank, a proof-of-concept zero-day local privilege escalation in CrowdStrike Falcon Sensor that abuses the Microsoft Office malicious macros remediation feature, tested on fully updated Windows 11 25H2 and Windows Server 2025. CrowdStrike said it is investigating, advised disabling the Microsoft Office File Suspicious Macro Removal policy, and pointed customers to a FalconFlank tech alert, noting cloud anti-malware protection remains active. The article also covers related PoCs from the same researcher: HardBreacher against Kaspersky (fixed via update), ShieldBreak (CVE-2026-69414) against Microsoft Defender, an unpatched patch bypass of CVE-2026-50656, GreenSection against NVIDIA, and PrettyPrague against Avast, which Gen Digital patched in versions 26.7.11086 and 26.8.11125.
58
NVIDIA and CrowdStrike Strengthen Agentic Cybersecurity Frontier
NVIDIA and CrowdStrike announce SafeMind, an agentic cybersecurity system built on Nemotron models, plus Falcon IQ for agentic workload automation.
At CrowdStrike's Fal.Con 2026, NVIDIA and CrowdStrike announced SafeMind, an agentic cybersecurity system combining CrowdStrike's purpose-built frontier models and harnesses with NVIDIA Nemotron open models in a continuous red-versus-blue coevolution loop. A Blue Solano model post-trained on Nemotron 3 Super reportedly achieved higher accuracy than leading frontier models at 99% lower cost. CrowdStrike also introduced Falcon IQ, powered by Nemotron models in the Charlotte AI AgentWorks platform, coordinating more than 50 agents for automated defensive workflows. CrowdStrike cited an 89% year-over-year rise in AI-enabled attacks and a fastest eCrime breakout time of 27 seconds as context for agentic defense.
62
GreyNoise + CrowdStrike: Real-Time Edge Intelligence in Falcon Next-Gen SIEM and Charlotte Agentic SOAR
GreyNoise expanded its CrowdStrike Falcon integration with Next-Gen SIEM dashboards, correlation rules, and Charlotte Agentic SOAR playbooks.
GreyNoise announced an expanded integration with the CrowdStrike Falcon platform, adding purpose-built content for Falcon Next-Gen SIEM and Charlotte Agentic SOAR. The integration includes a dedicated SIEM dashboard, correlation rules that detect allowed inbound traffic from malicious infrastructure, and SOAR playbooks that inject GreyNoise threat context into automated response workflows.
25
57
55
42
30
FalconFlank: CrowdStrike Falcon 0-Day PoC
A researcher published a working proof-of-concept for an alleged privilege escalation zero-day in CrowdStrike Falcon Sensor for Windows.
SOCRadar describes 'FalconFlank,' an alleged privilege escalation zero-day vulnerability in the CrowdStrike Falcon Sensor agent for Windows. The finding was published alongside working proof-of-concept code by a researcher. The available text does not state that exploitation has been observed in the wild, nor does it mention an assigned CVE.
48
55
30
55
30
55
30
60
30
12 Best CNAPP Platforms Compared (2026): Features & Pricing
Independent comparison of 12 CNAPP platforms finds identical estates draw quotes 2-3x apart; Microsoft Defender for Cloud is the only fully published per-resource option.
A vendor-independent buyer's guide compares twelve CNAPP platforms including Prisma Cloud, CrowdStrike Falcon Cloud Security, Wiz, Uptycs, Aqua, Zscaler, and Microsoft Defender for Cloud on pricing mechanics, procurement leverage, and capability-per-dollar. It finds quotes swing 2-3x on identical estates because vendors define 'workload' differently. Microsoft Defender for Cloud is highlighted as the only major with fully published per-resource rates.
6
Top 10 Best Device Control & USB Security Tools in 2026
A 2026 scorecard ranks ten USB and device control tools, placing Safetica, Ivanti DeviceLock and DriveLock at the top.
The article compares ten device control and USB security tools using a weighted scorecard covering control granularity, platform coverage, DLP integration, operability and value. Safetica, Ivanti DeviceLock and DriveLock rank highest, with notes on cross-platform depth, Windows granularity and European compliance fit. The piece highlights ownership changes, including CoSoSys joining Netwrix and Digital Guardian joining Fortra, and stresses device control as part of Zero Trust and DLP strategies.
12
60
Security Data Isn’t the Problem. Security Context Is.
Horizon3 blog argues security context, not data volume, is the SOC bottleneck, promoting its NodeZero integration with CrowdStrike Falcon Next-Gen SIEM.
Horizon3.ai published a vendor blog explaining how its NodeZero Proactive Security Platform integration with CrowdStrike Falcon Next-Gen SIEM brings validated exposure findings into existing security operations workflows. The post argues SOCs are now limited by confidence rather than visibility, needing context to decide which issues matter. It cites a global chemical manufacturer that validated exploitable exposures with NodeZero before completing a $2 billion merger.
15
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
Google and Mandiant attribute vishing-based SaaS data extortion attacks to UNC6671, now operating under the Redact, Pink, Helix, and Falcon brands.
Google Threat Intelligence Group and Mandiant track extortion group UNC6671, which uses vishing calls impersonating IT help desks to lure employees to adversary-in-the-middle phishing pages that capture credentials, MFA tokens, and session tokens. The group then registers adversary-controlled MFA devices, pivots through identity providers into Microsoft 365, Okta, and other SaaS applications, and runs automated Python and PowerShell exfiltration scripts. UNC6671 has rotated through extortion brands including BlackFile, Redact, Pink, Helix, and Falcon, and Google tracked over $10.6 million in Bitcoin payments between January 7 and May 12, 2026, with initial demands exceeding $3 million. The actor has hit dozens of organizations in North America, Australia, and the UK, shifting toward high-value financial and legal firms in July 2026.
78
60
30