ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “naming”

561 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 5770Ransomware 4050Vulnerability 3378Data breach 3159Threat actor 1898Exploit / PoC 1798Phishing & fraud 1612Policy & legal 1414Industry 1149Research 262AI safety & security 211AI tools & infra 154Advisory 150Tools 83
SeverityAllcritical 6831high 9417medium 5253low 3216info 572

How to correlate Kubernetes audit logs with container runtime data

Elastic Security Labs shows how to join Kubernetes audit logs with Defend for Containers runtime data to investigate service account abuse and container escapes.

Elastic Security Labs demonstrates correlating Kubernetes audit logs with Defend for Containers (D4C) runtime telemetry in Elastic. In an Amazon EKS lab, a compromised workload service account performed discovery, read secrets, minted a token, created a privileged pod, and execed into it to attempt a container escape via nsenter and chroot. The escape wrappers appeared only in the decoded Kubernetes audit requestURI, not in runtime process events. The post covers join fields, prebuilt EQL sequence rules, and continues the control-plane correlation thread from the TeamPCP container attack scenario and the Hugging Face intrusion write-up.

Elastic Security Labs · 13d agoResearch1

Introducing Unit 42’s Attribution Framework

Unit 42 releases its Attribution Framework, a systematic method using Diamond Model and Admiralty scores to attribute activity clusters to named threat actors.

Palo Alto Networks' Unit 42 introduced a structured framework for threat actor attribution built on the Diamond Model of Intrusion Analysis and Admiralty reliability/credibility scoring. The framework tracks activity at three levels: activity clusters (named CL-STA, CL-CRI, CL-UNK, or CL-MIX), temporary threat groups, and named threat actors using the constellation naming schema. Analysts score evidence across TTPs, tooling, malware code, OPSEC, infrastructure, timelines, and victimology to decide when to merge or elevate clusters, avoiding premature group naming.

Palo Alto Unit 42 · Aug 17, 2026Research

Inside NVIDIA’s cuDNN Graph API: Fusion, Autotuning, and Plan Reuse with cuDNN Frontend

MarkTechPost tutorial walks through NVIDIA's cuDNN Frontend graph API, covering kernel fusion, autotuning, plan reuse, and CUDA graph capture on Colab GPUs.

The tutorial explains how to express GPU computations as operation graphs via the cuDNN Frontend graph API, running the five-step build pipeline of validate, build operation graph, create execution plans, check support, and build plans. It progresses from a single fused convolution with bias and ReLU to autotuning across engine configs, FP8-style epilogues, attention, plan serialization, dynamic shapes, and CUDA graph capture. Each kernel is benchmarked against a PyTorch reference on a single Colab GPU to verify correctness and measure cost. The piece also covers practical setup issues like making libcudnn.so visible to the frontend's dynamic loader.

MarkTechPost · 1d agoAI tools & infra2

New CISO appointments 2026

Companies including Mistral AI, Trellix, Marriott, and ANZ appointed new CISOs in July-September 2026 amid high security-leadership turnover.

CSO Online's rolling column tracks senior security appointments, noting many companies are hiring a CSO/CISO for the first time. Notable moves include Thomas Coudray leaving Ledger to become Mistral AI's CISO, David Soto joining Trellix from Amazon, and Daniel Dubowski becoming Marriott International's SVP and CISO. Other appointments span ANZ, Gigamon, Axonius, Tricentis, Remitly, Allied Universal, and the State of California.

CSO Online · 9d agoIndustry

The AI ‘Ghosts’ Contaminating Academic Publishing

Samsung and University of Warsaw researchers find LLMs repeatedly generate the same fake author names, contaminating academic records with 1,655 ghost-authored DOIs.

A preprint from Samsung and the University of Warsaw, "The Ghost Couple: Correlated LLM Name Priors and Their Haunting of the Web and Academic Publishing," shows that LLMs such as Claude, ChatGPT, and Gemini repeatedly generate the same fictional names like Elena Vasquez, Marcus Chen, and Aris Thorne as experts and co-authors. Researchers identified 1,655 ghost-authored records on CERN-operated Zenodo carrying real DataCite DOIs, fabricated journals, and backdated publication dates. Ghost names also form synthetic research groups on ResearchGate and are indexed without verification by Google Scholar and Semantic Scholar. The researchers suggest correlated name priors could serve as provenance signals for detecting AI-generated content.

404 Media · 20d agoAI research

TLD Tracker: Exploring Newly Released Top

Unit 42 tracked 19 newly released top-level domains and found large-scale phishing, unwanted program distribution, and cybersquatting tied to TLD launch dates.

Researchers analyzed 19 new generic TLDs, including .zip, .bot, .ing, and .meme, released or approaching general availability over roughly 18 months. Data from passive DNS, registry zone files, newly registered domain feeds, and the Tranco top-1M list showed phishing campaigns, potentially unwanted program distribution, and domain squatting on these TLDs. Abuse correlated with each TLD's rollout phases, indicating attackers monitor general availability dates to register and weaponize domains. The IANA root database now lists over 1,000 generic TLDs.

Palo Alto Unit 42 · Aug 17, 2026Research

macOS 27 Golden Gate – Review

Ars Technica reviews macOS 27 Golden Gate, highlighting an unavoidable Apple Intelligence upgrade, new AFM 3 Core models, and dropped Intel Mac support.

macOS 27 Golden Gate delivers the first significant Apple Intelligence upgrade two years after launch, and the toggle to disable the AI features or delete downloaded models is gone. Apple Intelligence runs on a new AFM 3 Core model built in collaboration with Google, while the more capable AFM 3 Core Advanced requires an M3 chip and at least 12GB of RAM. The release drops all Intel Mac support, requiring Apple Silicon, with Sequoia security updates expected to end in fall 2027 and Tahoe's in 2028.

Hacker News · AI · 7h agoAI industry 2 sourcesHN 45↑ · 28 comments

Hillingar - MirageOS Unikernels on NixOS

A technical write-up details Hillingar, enabling reproducible Nix-based builds and NixOS deployment of MirageOS OCaml unikernels such as authoritative DNS servers.

This blog post (published December 2022, updated February 2025) describes Hillingar, work from the author's master's thesis enabling reproducible builds and deployments of MirageOS OCaml unikernels using Nix and a custom NixOS module, demonstrated with an authoritative DNS server. MirageOS unikernels embed application and low-level OS code in a single kernel, allowing dead-code elimination that reduces attack surface and improves efficiency. The post covers challenges such as solving opam dependency version constraints when linking a single dependency set.

Lobsters · security · 12d agoTools1

Function Name Is All You Need to Detect Blockchain Application Attacks

TxLucent detects blockchain dApp attacks from transaction function-name sequences using a transformer, achieving 1.56% false negatives without source code.

Researchers propose TxLucent, which maps transaction call traces to function name sequences and uses a transformer to detect blockchain application attacks without source code or handcrafted rules. Evaluated on 424 real-world incidents with 14,611 attack transactions, it achieves a 1.56% false negative rate and an estimated 0.0017% false positive rate across over 500 million Ethereum transactions. Average analysis time of 24.90 milliseconds supports real-time detection on popular blockchains.

arXiv cs.CR · 6d agoResearch1

A rant about phishing: It's not the user's fault (and not DNS either)

Opinion piece argues multi-domain login redirects make legitimate flows indistinguishable from phishing, urging organizations to standardize on one recognizable root domain.

The author shows a real-world login flow that chains through numerous third-party domains (identity providers, cloud auth endpoints, OAuth APIs, 2FA pages), none on the company's own domain, so credentials and 2FA prompts are trivially impersonable. The piece argues URLs are inherently confusing because the security-relevant second-level domain sits mid-string, and that users trained to ignore URLs cannot distinguish legitimate pages from scams. It proposes RFC 2119-style requirements: single recognizable root domain, internal services on its subdomains, emailed or SMS links on that domain, and local redirects instead of third-party hosted pages.

Lobsters · security · 6d agoPhishing & fraud

Microsoft named a Leader in the Frost Radar™: Cloud Workload Protection Platforms, 2026

Microsoft was named a leader in the 2026 Frost Radar for Cloud Workload Protection Platforms, cited for Defender for Cloud runtime security.

The 2026 Frost Radar for Cloud Workload Protection Platforms placed Microsoft in its leadership tier, calling the company a visionary leader. Microsoft attributes the recognition to unified runtime security delivered through Microsoft Defender for Cloud. The post is vendor marketing with no incident, vulnerability, or technical detail.

Microsoft Security Blog · 28d agoIndustry3

Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection

Unit 42 clusters behavior of 40,000+ AWS identities from 125 cloud environments to map functional roles and enable lightweight SQL-based detection.

Palo Alto Unit 42 built an unsupervised behavioral clustering model using UMAP and HDBSCAN on AWS CloudTrail logs to map cloud identities to functional roles such as administrators, backup services, security tooling and DevOps. The study analyzed over 40,000 identities across 125 cloud environments over two months. The researchers show that heuristics extracted from the clustering map can be implemented in standard SQL, enabling role classification at scale without running a continuous ML pipeline. The methodology extends to audit logs from other cloud providers, SaaS and Kubernetes.

Palo Alto Unit 42 · 2d agoResearch

Google stole open source code without crediting the authors (Artemis/Minitap)

Minitap alleges Google's Artemis mobile-agent project reused its open-source mobile-use code and stripped author attribution, despite Apache 2.0 requirements.

Minitap says Google's Artemis project for automating mobile devices contains code identical to its open-source mobile-use agent, including the Hopper agent's verbatim instructions and a WhatsApp messaging example, and that a package file listing authors Pierre-Louis Favreau, Jean-Pierre Lo, and Nicolas Dehandschoewercker was replaced via an August force push removing their names. The company argues this conflicts with Apache 2.0's requirement to preserve copyright and attribution notices. Minitap also claims the AndroidWorld leaderboard ignored its later 94.8% and 100% submissions while showing Artemis at 99.1% and mobile-use at 91.4%. It has published a public factual record with archived file comparisons.

Hacker News · security · 5d agoAI industryHN 25↑ · 6 comments

The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

Unit 42 demonstrates that root access on a Kubernetes node lets attackers spoof SPIFFE/SPIRE attestation and harvest co-located workloads' SVIDs.

Palo Alto Networks Unit 42 describes post-exploitation techniques in which an attacker with root on a compromised Kubernetes node spoofs Linux cgroup metadata used by the SPIRE agent during workload attestation, tricking it into issuing a co-located workload's SPIFFE Verifiable Identity Document to an attacker-controlled process. The research shows the core trust assumption of machine-identity systems—that the node is trusted—collapses once root is obtained, exposing all cryptographic identities scoped to that node. Unit 42 released an open-source tool, Spooffe, for defenders to test identity exposure, and notes the technique has not been observed exploited in the wild.

Palo Alto Unit 42 · 6d agoResearch1

Autoencoder Is All You Need: Profiling and Detecting Malicious DNS Traffic

Palo Alto Unit 42 details an autoencoder-based method that profiles DNS traffic to detect C2 and malicious domains, blocking ~374,000 malicious DNS requests daily.

Unit 42 built an RNN-based autoencoder that compresses DNS traffic time series into fixed-dimensional 'DNS profiles' for each domain and device. Downstream classification, clustering, and anomaly detection modules flag suspicious domains, capturing 170 emerging suspicious domains in May 2024. Signatures block roughly 374,000 malicious DNS requests daily and run in the Advanced DNS Security service, with detections shared to Advanced URL Filtering. Case studies link DNS traffic patterns to C2 beaconing, dynamic DNS abuse, and DNS tunneling for data exfiltration.

Palo Alto Unit 42 · Aug 17, 2026Research

Mapping out your unknown: A threat hunter’s guide to GitHub

Datadog Security Labs publishes a threat-hunting guide with audit-log queries to detect GitHub token theft, device code phishing, and source code exfiltration.

Datadog's threat-hunting guide covers GitHub audit log queries for detecting compromised accounts, stolen personal access tokens, and malicious OAuth app authorizations. Attackers typically obtain credentials through phishing, credential stuffing, leaked secrets, or device code phishing, then map private repositories, exfiltrate source code, and pivot into connected cloud and CI/CD environments. The guide maps detections to MITRE techniques like T1078 and T1528 and documents GitHub logging quirks affecting attribution, token metadata, and visibility fields.

Datadog Security Labs · 1d agoResearch in the wild1

Saving Jet Fuel

Tutorial optimizes flight paths to cut jet fuel costs using open-source Scikit-decide planning framework and OpenAP aircraft performance models.

A technical walkthrough demonstrates wind-aware flight path optimization using Scikit-decide, an open-source framework for reinforcement learning and automated planning, paired with OpenAP fuel-consumption models built by Dr. Junzi Sun at TU Delft and NOAA wind data. A Boeing 787-9 flying EWR to FCO can require roughly $68K in fuel, and adjusted routing could save thousands. The post uses Python 3.12, DuckDB with spatial extensions, and QGIS for map rendering.

Hacker News · AI · 1d agoAI tools & infraHN 45↑ · 19 comments

Linux Detection Engineering - Local Privilege Escalation

Elastic details a layered detection framework for Linux local privilege escalation, covering 2026's copy-on-write bug wave and LLM-assisted discovery.

Elastic Security Labs describes how most Linux local privilege escalations share a common host flow — an unprivileged process launched from a writable path becoming root — and proposes layered detections combining general outcome-based rules with per-technique rules in Elastic Defend and Auditd. It tracks 13 recent LPE disclosures, seven of which share a copy-on-write/zero-copy bug class, including Copy Fail, DirtyFrag, Fragnesia, DirtyDecrypt, DirtyClone, pedit COW, and RefluXFS. Qualys attributes RefluXFS to an LLM-assisted research effort with Anthropic using Claude Mythos Preview, and another bug is credited to an LLM-assisted workflow. Detection and endpoint rules are published in Elastic's detection-rules and protections-artifacts repositories.

Elastic Security Labs · 6d agoResearch

Muse, the band, lost its social media handles to Muse, Meta's new AI agent

Meta's new Muse AI agent took the @muse Instagram and X handles long used by the English rock band Muse.

Meta's newly released AI agent Muse now uses the @muse social media handles that the English rock band Muse, which trademarked its name in 1999, had used on Instagram and X for years. The band's Instagram handle reportedly changed to @museband around June-July 2026, and Meta executives' launch posts about the agent mistakenly tagged the band's account. Meta has not explained the change, and the piece notes a pattern of Meta acquiring notable handles around major launches, including @Meta in 2021 and @threads in 2023.

Hacker News · AI · 7d agoAI industryHN 84↑ · 32 comments1

Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance

Anthropic's new Compliance API endpoints expose Claude Code local session transcripts, highlighting governance gaps for endpoint AI agents.

Anthropic added local session transcript endpoints to its Compliance API on August 11, 2026, giving security teams visibility into prompts, bash commands, file operations, and MCP commands run by Claude Code harnesses on endpoints. The article argues local harnesses break the classic shared-responsibility model, citing Token Security data that 68.6% of discovered AI agents run on endpoints, and a Cloud Security Alliance survey of 418 IT and security professionals in which 82% found an unknown agent within the past year. It outlines three governance layers: Anthropic managed settings as a policy baseline, the Compliance API for cloud-visible transcripts, and endpoint telemetry to connect agent activity to identity, credentials, and permissions.

The Hacker News · 16d agoAI safety & security1

Rapid7 Named Among Notable Vendors in Forrester MDR Landscape: Why the Future is Exposure-informed, Preemptive MDR

Rapid7 touts its listing in Forrester's Q3 2026 MDR Landscape, arguing MDR must converge with exposure management for measurable risk reduction.

Forrester's Managed Detection and Response Services Landscape, Q3 2026 names Rapid7 among notable providers and predicts MDR services will converge with exposure and posture improvement. Rapid7 pitches its exposure-informed, preemptive MDR built on its own SIEM, combining vulnerability findings and asset risk scoring with detection and response. The service includes unlimited incident response and a human-led, AI-enhanced investigation model. Forrester advises buyers to demand providers prove investigations rather than narrate dashboards.

Rapid7 Blog · 2d agoIndustry

Implementation of Machine Learning Workflows with NVIDIA cuML, RAPIDS, GPU Benchmarking, Explainability, Clustering, and Model Inference

Hands-on tutorial implements NVIDIA cuML and RAPIDS to GPU-accelerate scikit-learn-style ML workflows with benchmarking, clustering, and inference.

The tutorial demonstrates NVIDIA cuML as a GPU-accelerated machine learning framework, using cuml.accel to speed up unmodified scikit-learn scripts with zero code changes and the native cuML API for CuPy/cuDF interoperability. It benchmarks CPU versus GPU implementations of PCA, K-Means, nearest-neighbor search, logistic regression, random forests, and DBSCAN on datasets up to 200,000 samples with 64 features. It also builds GPU pipelines with UMAP, t-SNE, and HDBSCAN, validates GPU-generated SHAP explanations, uses the FIL library for forest inference, and covers model serialization and GPU/CPU portability.

MarkTechPost · 4d agoAI tools & infra

The Rise of the Forward Deployed Engineer — and How To Do the Job Right

Palantir veteran Vinoo Ganesh traces the forward deployed engineer role and shares practices for building effective FDE teams.

Kepler CEO and former Palantir forward deployed engineer Vinoo Ganesh argues that labs, startups, and PE firms hire FDEs without a shared definition of the role. He recounts Palantir's Project Frontline rotation, which trained about 250 software engineers as FDEs, many now leading forward deployed teams at OpenAI, Anthropic, xAI, and Anduril. A 2013 failure of the Phoenix transaction store at a bank, where real-world data gaps caused roughly 2.3 million keyspaces and an out-of-memory crash, illustrates why FDEs must own the gap between design and production reality. At Kepler he places the FDE function inside product rather than sales.

Latent Space · 4d agoAI industry 4 sources1

We've got one word for it, and it's usually the wrong one

Cisco Talos's Threat Source newsletter critiques 'burnout' terminology, describing four occupational injuries, and flags a UAT-10820 WebDAV stealer campaign at a Ukrainian government organization.

Cisco Talos's Threat Source newsletter argues that 'burnout' is the wrong word for most cybersecurity occupational harm, distinguishing exhaustion, secondary traumatic stress, vicarious trauma, and moral injury based on clinical literature from trauma-exposed professions. The featured disclosure describes a complex WebDAV infection chain found at a Ukrainian government organization, attributed with moderate confidence to the Russian-tracked actor UAT-10820 and assessed as an opportunistic cryptocurrency and credential-stealing operation. The campaign delivers the Amatera stealer alongside ZigCryptoStealer and NetSupport Manager, abusing BNB Smart Chain bulletproof hosting, fake CAPTCHA prompts, a vulnerable driver to kill EDR, and rundll32.exe execution of disguised DLLs with ordinal calls. Weekly headlines also cover a Microsoft Defender 'ShieldCrash' zero-day exploit released after September 2026 Patch Tuesday, a North Korean Linux espionage toolkit backdooring HAProxy, and a multi-hop Google-domain redirect phishing campaign.

Cisco Talos · 6d agoIndustry in the wild1

Show HN: MultiMatte, a Promptable Image Background Removal Model

Feyn releases MultiMatte, a promptable background-removal model fine-tuned from Meta's SAM 3 via LoRA, outputting alpha mattes that beat SAM 3 on segmentation benchmarks.

Feyn introduced MultiMatte, a promptable image background-removal model built on Meta's SAM 3 (860M parameters). It modifies only 19.49M parameters (2.27%) using a rank-16 LoRA adapter and replaces binary masks with alpha mattes to handle fuzzy boundaries like hair. On the DIS-VD benchmark it scores 0.901 S-measure versus SAM 3's 0.667, and it improves on SAM 3 across all twelve evaluated splits. Training used 19,953 images for 14,000 steps with focal and Dice loss, and the merged weights are available via the nobg library and a web demo.

Hacker News · security · 6d agoModel releaseHN 21↑ · 4 comments1

AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance

Huntress maps AD RMS architecture and recon paths, setting up an offline key-extraction attack against its unrotatable 255-year root key.

Huntress's multi-part research examines Active Directory Rights Management Services, Microsoft's enterprise DRM role that still ships in Windows Server 2025 despite migration guidance favoring Azure Information Protection. Part 1 covers the trust model and how an ordinary domain account can locate RMS clusters and read rights-policy templates. Part 2 will detail four independent paths for extracting the Server Licensor Certificate (SLC) private key via service-group membership and the configuration database, enabling fully offline decryption of protected documents. The SLC certificate is valid from 2002 to 2258 and has no key-rotation mechanism, so a stolen key decrypts protected content indefinitely.

Huntress · 8d agoResearch1

The story behind the intelligence

Cisco Talos newsletter features adversary-engagement podcast, flags AI guardrail 'safety penalty' slowing defenders, and recaps McKesson breach and PaperCut patching headlines.

The Threat Source newsletter spotlights the Beers with Talos podcast, in which researcher Azim Khodjibaev describes maintaining eight dark-web personas to identify prolific cybercriminals and support disruption efforts. Talos also argues frontier AI guardrails impose an AI 'safety penalty', citing a July 2026 incident where Hugging Face's primary cloud LLM refused to analyze forensic breach data and delayed response. Recapped headlines include ShinyHunters claiming theft of 284 million patient records from McKesson via vishing and Okta account takeover, Anthropic warning Claude users about infostealer malware, and PaperCut issuing emergency patches for chained vulnerabilities.

Cisco Talos · 13d agoIndustry

The Year in Web Threats: Web Skimmers Take Advantage of Cloud Hosting and More

Unit 42 analyzed 2.24 million web threat incidents, finding web skimmers increasingly hosted on cloud infrastructure to steal payment card data.

Palo Alto Unit 42 analyzed 2,241,354 web threat incidents and 831,550 unique URLs detected via Advanced URL Filtering between October 2020 and September 2021. Threat activity peaked from October 2020 to January 2021, coinciding with the holiday shopping season, with most malicious domains geolocated to the United States, Russia, and Germany. Web skimmers ranked third among the top five threat classes and showed the most code diversity, making detection harder. Researchers observed more web skimmer families being hosted on cloud platforms to steal payment data and PII.

Palo Alto Unit 42 · Aug 17, 2026Research