⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More

A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools.

The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery. Some bugs were new. Others were already being used before defenders had time to patch.

Here is the full recap of what broke, what was exploited, and what needs attention now.

⚡ Threat of the Week

New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code - Searchlight Cyber disclosed a pre-authenticated remote code execution vulnerability in WordPress Core that can be exploited anonymously on a standard WordPress installation, without requiring any plugins or other special conditions. It is a combination of CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection in WordPress core) that can be chained to turn an anonymous request into code execution. watchTowr said it's already seeing proof-of-concept (PoC) exploits in circulation and that it's beginning to see the first signs of in-the-wild exploitation. "This is going to hurt," watchTowr CEO Benjamin Harris said. "WordPress runs on hundreds of millions of websites globally. Some of those will be auto-patched by their hosting providers, but plenty will not, and that is where the damage will be done. Our advice is simple: patch as fast as you possibly can, and do not stop there. Put the controls and investigations in place to determine whether an attacker got there first and to detect and remove any backdoors that may already have been dropped before you patched." The cybersecurity company said it's the latest example of vulnerabilities being surfaced by AI-assisted tooling and how the technology is being abused by attackers to weaponize them.

AI Broke Vulnerability Management. Here Is the CISO Case

The AI security job market is no longer theoretical. SANS tracked hiring across 10 specific roles and mapped verified job data, salary ranges, and the skills required to get there. The three-tier framework gives your team a clear view of which roles to prioritize now and which to develop toward.

Download Now ➝

🔔 Top News

• SonicWall SMA Zero-Days Exploited as 0-Days - A previously undocumented threat actor codenamed UTA0533 has been attributed to the exploitation of recently disclosed SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances as zero-days prior to their public disclosure since June 22, 2026. The discovery was made following an incident response investigation initiated earlier this month. The impacted organization has not been identified. "This threat actor was observed using multiple zero-day exploits, malware designed specifically for SonicWall SMA VPN appliances, as well as other attacker tradecraft," Volexity said. The vulnerabilities in question are CVE-2026-15409 (CVSS score: 10.0) and CVE-2026-15410 (CVSS score: 7.2), both of which could be chained to facilitate arbitrary command execution and take over susceptible devices. Patches for both vulnerabilities were released by SonicWall last week.
• DoS Flaw in OpenSSL - The Okta Red Team disclosed details of HollowByte, a denial-of-service (DoS) flaw in OpenSSL. "By sending a malicious payload of just 11 bytes, a remote, unauthenticated attacker can force a server to allocate disproportionate chunks of memory before any security handshake even begins," Okta said. Put differently, an unauthenticated attacker -- through 11 bytes of carefully crafted data -- can convince OpenSSL to reserve up to 128 KB of heap memory for a handshake message that never actually arrives, causing a server to exhaust available RAM and trigger a DoS condition. The OpenSSL team resolved the issue in versions 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21. "Instead of trusting the header outright, OpenSSL now grows the buffer only as bytes actually land on the wire. A claim with no follow-through now costs the server nothing," Okta said.
• CISA Adds New SharePoint RCE Zero-Day to KEV Catalog - The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a newly patched security flaw impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by July 19, 2026. The vulnerability, CVE-2026-58644 (CVSS score: 9.8), is a critical deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute arbitrary code. Patches for the flaw have been released as part of the Patch Tuesday updates released on July 14, 2026. Microsoft revised its bulletin to clarify that CVE-2026-58644 has been exploited in the wild, meaning the shortcoming was weaponized as a zero-day prior to the fixes becoming available. The development came as Microsoft shipped its largest Patch Tuesday on record, addressing 622 vulnerabilities.
• OkoBot Malware Framework Infects Windows to Phish Crypto Seed Phrases - A new malware framework called OkoBot is designed to capture the contents of cryptocurrency wallet windows. OkoBot is an updated version of TookPS, which is a downloader for retrieving malicious commands and scripts from attacker-controlled servers to further propagate attacks, including a Python-based infostealer and a remote access trojan called TeviRAT. "This campaign differs from previous activity in that it uses a new framework to deliver all malicious modules and orchestrate them via an SSH tunnel," Kaspersky said. "In total, the framework includes more than 20 malicious payloads and implants, covering a wide variety of functions. At the time of writing, the threat remains active." The infection chain makes use of ClickFix and malware distributed through GitHub that masquerades as legitimate software for initial access. It also comes with a web browser extensions loader to deliver Rilide, a browser-based stealer, as well as inject an implant into Trezor Suite, Ledger Wallet, and Ledger Live processes to collect seed phrases, log keystrokes and clipboard content, take screenshots, and capture keystrokes and the video stream of the target application's window using the OkoSpyware module. Hundreds of victims of the OkoBot campaign have been detected in more than 25 countries, with the highest concentration in Brazil, Vietnam, Canada, Mexico, and Türkiye. The activity remains unattributed.
• NadMesh Scans Exposed AI Services for Cloud Keys and Kubernetes Tokens - A new Go botnet called NadMesh has been observed hunting for exposed AI services related to ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio to steal AWS keys and Kubernetes tokens. "It folds scanning, exploitation, and credential/AI-service intelligence harvesting into a single autonomous platform," QiAnXin XLab said. "On the victim, the bot agent establishes persistence along three independent paths: an SSH public-key backdoor (.ssh/authorized_keys), persistence files in multiple locations (/dev/shm/.a, /var/tmp/.a, /tmp/.a), and hidden cron watchdogs (/etc/cron.d/.sys_monitor, /etc/cron.d/.s)."

‎️🔥 Trending CVEs

Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.

Check the list, patch what you have, and hit the ones marked urgent first - CVE-2026-63030, CVE-2026-60137 (WordPress Core), CVE-2026-58644, CVE-2026-56164 (Microsoft SharePoint Server), CVE-2026-56155 (Microsoft Active Directory Federation Services), CVE-2026-53412 (Zoom Desktop Client for Windows and Zoom VDI Client for Windows), CVE-2026-44747, CVE-2026-27690, CVE-2026-44761 (SAP), CVE-2026-57219, CVE-2026-57221 (RabbitMQ), CVE-2026-59208, CVE-2026-54305 (n8n), CVE-2026-60105 (Monsta FTP), CVE-2026-14960, CVE-2026-14961 (tdeio64.sys driver), CVE-2026-33894, CVE-2026-33895 (Digital Bazaar node-forge), CVE-2026-6875 (ServiceNow AI Platform), CVE-2026-42533, CVE-2026-60005, CVE-2026-56434 (F5 NGINX Plus and NGINX Open Source), CVE-2026-20296, CVE-2026-20297 (Splunk Enterprise), CVE-2026-15265 (Tenable Agent), CVE-2026-6423 (ESET Inspect Connector), CVE-2026-15053 (Tanium Server), CVE-2026-44909, CVE-2026-59173, CVE-2026-59762 (HTTP/2 server implementations), CVE-2026-14890 (SGLang), CVE-2026-14266 (7-Zip), CVE-2026-59084 (Apache Tomcat), CVE-2026-15682 (AnyDesk), and CVE-2026-54523 (Kyverno).

🎥 Cybersecurity Webinars

• Your AI Agent Has Credentials. Can You Stop It When It Goes Rogue? Hands-on testing of OpenClaw shows how agentic AI can expose secrets, bypass safety controls, and create a powerful new attack surface. Join Okta Threat Intelligence Director Jeremy Kirk to examine how attackers are abusing AI agents and learn practical ways to control access, enforce least privilege, detect shadow AI, and shut down risky agents before they cause damage.
• When AI Ships 50× More Code, Human Review Stops Scaling → AI-assisted development is pushing code production beyond what traditional security reviews and CVE-driven remediation can handle. This webinar gives security leaders a practical framework for governing the expanding attack surface, building secure-by-default controls, and enabling teams to develop at machine speed without surrendering control of software risk.

📰 Around the Cyber World

• New Campaign Delivers Remcos RAT - A new malware distribution campaign has abused the credibility of government institutions to increase the likelihood of infection success. The activity targets Indian businesses and taxpayers using Goods and Services Tax (GST)-related themes to distribute malware. "The threat actors impersonated legitimate government departments and distributed malicious emails disguised as official notifications related to taxation, refunds, compliance requirements, and regulatory matters," Seqrite Labs said. "The threat actors employ convincing documents and filenames that closely resemble official GST notifications, making it difficult for recipients to distinguish malicious content from legitimate government correspondence." The end goal is to deploy Remcos RAT and steal sensitive information.
• India's Kudankulam Nuclear Power Plant Suffers a Data Leak - The Kudankulam Nuclear Power Plant located in the Indian state of Tamil Nadu suffered an accidental exposure after Reliance Infra (RPOWER) got hit by a ransomware group called World Leaks, a spin-off of Hunters International, which, in turn, is another variant of the Hive ransomware family. The leak consists of 18,997 files, totalling 14.3GB of data, per security researcher Rakesh Krishnan. They contain purported blueprints for the ventilation and cooling systems used in Unit 3 and Unit 4, along with a complete floor layout of a "common control room". It's assessed that Reliance Infra was not impacted directly, but rather through a third-party vendor named Yotta.
• Blind Eagle Shows No Signs of Stopping - Nearly a year after Blind Eagle's activities were documented, a new report from LevelBlue has found the threat actor to be active, moving part of its VBScript delivery infrastructure onto the Russian bulletproof hosting provider Proton66 as of June 2025. The group has also devised a bespoke string-obfuscation scheme, a RunPE loader built entirely on a bare AutoIt3 interpreter, and an upgraded version of AsyncRAT that introduces Windows Notification Facility (WNF) process injection, a custom Base28 payload encoding, a full Hidden VNC (HVNC) banking-fraud module with browser profile cloning, and a Chrome App-Bound Encryption (ABE) bypass, per LevelBlue.
• Qilin Ransomware Use of EDR Killer - Qilin ransomware operations have been observed adopting aggressive, kernel-level defense evasion to blind and disable endpoint security products before its main ransomware payload is executed on a victim's network. The EDR killer, packed via the Shanya packer, is sold on illicit marketplaces for $2,000. "The EDR killer compares the returned locale to a known locale blacklist to avoid attacking any Commonwealth of Independent States (CIS) countries such as Russia and Belarus," Flashpoint said. "The EDR killer then writes a vulnerable driver to disk and loads this driver via Service Manager. This driver is the ThrottleStop driver from TechPowerUp LLC's free and legitimate application of the same name, used to bypass CPU throttling. However, the driver suffers from a vulnerability, allowing the malware to map physical memory to kernel-mode virtual memory to perform direct kernel read and write operations." Also put to use is a custom Rust-written loader that performs reflective Portable Executable (PE) loading of the ransomware payload.
• DefiTuna Suffers a Security Incident - DeFiTuna, an Automated Market Maker (AMM) on the Solana blockchain, was exploited on July 16, 2026, for $569,601 USDC. "The attackers created a highly illiquid TUNA/USDC pool and used it as the destination for borrowed USDC routed through Jupiter," CertiK said. "Because the swap returned only a negligible amount of TUNA, DeFiTuna's value calculation rounded the position's total assets down to zero. The protocol then incorrectly treated the position as healthy, allowing the attackers to bypass the solvency check and withdraw the USDC through attacker-controlled liquidity positions."
• Next.js Opts for Scheduled Security Releases - Vercel announced that Next.js is adopting a formal security release program, replacing ad-hoc patches for security fixes following a surge in AI-assisted vulnerability discovery. "This kind of scheduled, pre-announced security release has become standard practice for major open source projects, and we think it's the right model for Next.js at its current scale," Vercel said. "Here's what you can expect going forward: roughly once a month, we'll publish advance notice of upcoming security releases. Each announcement will include the expected release timeline and the highest anticipated severity among the vulnerabilities it covers. This lead time lets you plan your upgrades, and it lets us coordinate with hosting providers and other platform partners to deploy mitigations, such as firewall rules, that help protect applications that haven't been patched yet."
• Disguised Gambling Apps Target Brazil - A new analysis from 9to5Mac has revealed more than 60 "jacket apps" on the App Store that are disguised as simple games and utilities that become online betting platforms when accessed from Brazilian IP addresses. Most of the apps are published by developer accounts with only a single App Store listing, with further investigation linking them to a "public GitHub repository containing instructions for a Cursor agent to create simple, vibe-coded apps that serve as fronts for the betting platforms."
• Ransomware Stats for Q2 2026 - The Gentlemen has become the most active ransomware group for Q2 2026, claiming 300 victims, surging past Qilin (289), DragonForce, Akira, and LockBit. Another group named Deadlock resurfaced after 11 months of silence with 75 June victims. In all, the top 11 tracked groups accounted for 1,368 of Q2's victim claims across 99 countries. "What sets The Gentlemen apart is its packaging, where affiliates receive ready-made tools that ship and update faster than most competing programs," ReliaQuest said.
• 2 Members of Chinese Money Laundering Network Charged with Laundering $43M in Investment Fraud - The U.S. Justice Department unsealed charges against a New York man and woman for conspiracy to launder money derived from cyber investment fraud scams. "Between 2020 and 2022, Zhuoying Chen, 27, of Brooklyn, New York, and Haojie Zhang, 38, of Queens, New York, managed a network of more than a dozen individuals based in Queens and Brooklyn, who opened 140 bank accounts in the name of approximately 45 shell companies to launder at least $43 million in proceeds of investment scams," the department said. "Then, Chen and Zhang allegedly conspired with China-based co-conspirators to transfer the funds involved in the fraud schemes abroad. The fraud schemes consist of perpetrators contacting victims via messaging services or social media applications. The perpetrators would initiate relationships with the victims and gain their trust, convincing victims to send money for lucrative investment opportunities. The perpetrators would show the victims fake profits on the purported investment and encourage the victims to invest more. The perpetrators would then steal the victim's funds."
• U.S. Cyber Agency Uses Mythos to Audit Government Code - Reuters reported that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) is using Anthropic's AI model Mythos to audit government software for defects that could potentially offer a pathway for foreign spies and cybercriminals, citing three people familiar with the matter.

• VisionSec → It is an open-source, self-hosted threat intelligence platform that combines domain monitoring, phishing detection, exposed-service scanning, GitHub secret discovery, breach checks, email security assessments, and Telegram alerts in a modular Docker-based deployment. The project remains at an early stage, with no published releases at the time of writing.
• owLSM → It is an open-source Linux security agent that uses eBPF LSM to run stateful Sigma rules inside the kernel, block malicious activity, correlate events across multiple probes, and provide detailed context for security monitoring and response.

Disclaimer: This is strictly for research and learning. It hasn't been through a formal security audit, so don't just blindly drop it into production. Read the code, break it in a sandbox first, and make sure whatever you're doing stays on the right side of the law.

Conclusion

That is the week: exposed systems, weak checks, old tools, and attackers moving faster than patch cycles.

Review what applies, fix the obvious gaps first, and assume anything public has already been tested.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/XlDuUmW
via IFTTT

The Agentic SOC: Transforming Data into Defensive Velocity

Security Operations Centers (SOCs) are currently confronting scalability challenges on two fronts: structural and cognitive. The day-to-day reality of modern defensive operations is stark: an analyst frequently begins a shift facing a queue deeply saturated with unvetted alerts. To process a single event, the analyst must open the alert, pivot to a secondary console to complete an investigation, manually enrich an IP address, copy a file hash into a third interface, and cross-reference an asset inventory that may not have been updated in months. Following this, they must author and refine queries, waiting for overloaded databases to return historical context.

The actual work of assessing the investigation’s results and moving to decision-making and action has not even begun. This is the administrative burden of the modern SOC. The true threats are not just those that attempt to bypass defenses, but the critical operational hours lost before an active mitigation attempt is even initiated. While analysts are highly trained professionals, the relentless requirement to perform manual data aggregation inevitably leads to exhaustion.

Misdiagnosing the Bottleneck: The Upstream Data Problem

Threat actors operate at machine speed, utilizing automation to pivot laterally across networks in a matter of seconds, frequently disappearing before defensive teams can even log into their terminals. Expecting human defenders to counter automated threat vectors by manually aggregating bad data is an architectural failure.

Every SOC inherits a highly fragmented data ecosystem. Telemetry is continuously generated by diverse sources, including firewalls, cloud workloads, identity providers, endpoint sensors, and legacy systems. This telemetry arrives in disparate dialects, varying formats, and highly inconsistent levels of fidelity. Before AI tools can accurately reason about a potential threat, or an analyst can initiate a logical investigation and run a playbook response, this raw telemetry must be synthesized.

Historically, organizations analysts take on these complex synthesis processes, manually normalizing data points across different vendor schemas. This represents a key misallocation of human intelligence. The asymmetry in modern security operations is not merely a discrepancy in speed; it is an imbalance in how security teams are forced to allocate their finite time. When operators spend the majority of their shifts wrangling data instead of actively investigating threats, the foundation of the SOC itself is inadequate. To achieve defensive velocity, organizations must recognize that fixing the data foundation is the mandatory prerequisite for improving all downstream security functions.

Architecting the Data Foundation with Singularity AI Data Pipelines

Addressing the upstream data problem requires the implementation of advanced data pipelines capable of resolving enterprise data chaos before it impacts the detection engine. Frameworks such as SentinelOne’s® Singularity AI Data Pipelines serve as this foundational layer, engineered to ingest telemetry from every source and in every format without requiring months-long integration projects or heavy manual engineering.

Modern pipelines utilize AI to normalize raw telemetry into standardized formats, specifically aligning with the Open Cybersecurity Schema Framework (OCSF). This structural alignment transforms fragmented logs into structured data that is immediately actionable. It eliminates the need for analysts to construct complex regular expressions during critical incidents simply to reconcile how two different software vendors format data, such as usernames or a timestamp.

Efficient data ingestion also requires dynamic, in-flight optimization. Not all telemetry possesses the same analytical value, and storing all generated logs in highly indexed, expensive storage tiers is financially and operationally untenable. Data pipelines optimize data streams by filtering out extraneous noise, trimming excess volume, and routing specific logs based on dynamic criteria. High-value security events are routed and indexed for rapid search retrieval, while lower-priority compliance or operational logs are routed to more cost-effective tiered storage. The result is a substantial reduction in infrastructure costs, a higher signal-to-noise ratio, and a structured data foundation that is completely prepared the moment an investigation is required.

When underlying data pipelines automatically enrich that log with identity and asset information, revealing (for example) that a specific financial director’s laptop in a remote office is communicating with a known botnet, the output transitions from a raw data point into a definitive starting point. Crucially, this enrichment occurs systematically before the human operator ever interacts with the alert. Solving this data problem end-to-end is a primary reason SentinelOne was recognized in the IDC MarketScape for AI SIEM.

Accelerating Detection via Singularity AI SIEM

When a clean, structured data foundation is properly established, the performance of downstream security tools accelerates. Modern detection engines, such as the Singularity AI SIEM, leverage indexless architectures to manage enterprise-scale telemetry. Because the data is normalized and optimized prior to ingestion, these platforms can execute petabyte-scale queries with minimal latency, ensuring investigative results are delivered before the analyst’s attention wanes.

Within this architecture, detection logic is executed continuously against a stream of clean, correlated telemetry. This transforms an ocean of disparate event logs into readable, centralized dashboards that provide immediate situational awareness. The quantitative benefits of this approach are substantial. With AI SIEM, organizations are already executing their queries 70% faster. Adding AI Data Pipelines further augments this workstream, providing cleaner data for AI to run at optimal efficiency. These improvements represent the direct result of ensuring that the data arriving at the SIEM is inherently fit for purpose.

AI SIEM remains a single, comprehensive SKU with customers automatically receiving integrated pipeline functionality for everyday data optimization rather than treating it as a premium add-on. For every unit of paid Data Ingest capacity, customers can process twice that volume through Data Pipelines. A customer with 500 GB/day SIEM entitlement can push 1 TB/day through the pipeline at no additional cost.

Transitioning to Agentic Reasoning Layers with Purple AI

The establishment of a structured data pipeline unlocks the capability for true agentic reasoning within the SOC. Unlike traditional rule-based automation, which executes static responses to predefined triggers, technologies like SentinelOne’s Purple AI operate as a dynamic investigative layer.

When an initial alert is generated, an agentic reasoning system does not simply pause and wait for human triage. It autonomously launches an investigation, comprehensively maps the potential blast radius of the incident, and synthesizes a clear, logical recommendation for containment. Then, the analyst logs into the console and is presented with a fully formed situational briefing rather than a blank investigation screen.

More importantly, an agentic AI layer possesses the capacity to evaluate broader adversarial campaigns rather than isolated security events. In isolation, a minor registry key modification, a singular file write, or a brief outbound network connection may not meet the threshold for a critical alert. Legacy security tools often fail to connect these disparate, low-signal events. However, Purple AI can assemble these seemingly unrelated activities into a cohesive narrative, exposing the overarching strategy of the attacker before a major breach occurs.

This level of autonomous intelligence is strictly dependent on the underlying architecture. Advanced AI algorithms cannot derive accurate conclusions from unparsed, low-quality telemetry. The analytical integrity of the agentic layer is entirely contingent on the principle of data quality; systems like Purple AI require clean, structured data to function effectively, avoiding the fundamental issue of “garbage in, garbage out”.

Governed Hyperautomation and the Human-in-the-Loop

The final component of a modernized, agentic SOC is the deployment of Hyperautomation to execute defensive responses. To counter threats effectively, organizations must deploy automated workflows capable of executing decisions at machine speed. These no-code workflows can be configured to trigger autonomously based on AI triage verdicts, the disclosure of new high-severity vulnerabilities, or specific incoming alerts. By automating the mitigation phase, the SOC evolves from an environment strictly dedicated to passive observation into a dynamic system that actively neutralizes threats.

However, the implementation of automated response mechanisms must be rigorously governed. Executing changes to enterprise infrastructure carries inherent risk. To mitigate this, automated workflows must integrate critical approval steps, ensuring that highly consequential actions are paused until human authorization is provided. The analyst retains the ultimate authority, defining the precise parameters of what processes may run automatically and what workflows require manual judgment.

Redefining the Analyst Mandate via Autonomous Security Intelligence

The strategic objective of integrating data pipelines, agentic reasoning, and Hyperautomation is not the removal of the human operator. Instead, the overarching goal is the restoration of the analyst’s primary function: exercising expert judgment.

By offloading repetitive tasks to technological systems, organizations systematically remove operational friction. The data layer filters out irrelevant noise, allowing the analyst to clearly see the threat. The AI investigation layer removes the administrative grind of data collection, allowing the analyst to focus purely on analytical thinking. Finally, the automated response layer eliminates procedural delays, ensuring the analyst’s decisions are executed rapidly enough to matter. This creates an intelligence fabric, known as Autonomous Security Intelligence (ASI), where data, investigation, and response function concurrently as a single, unified system.

Under this model, the operational output of a single analyst is exponentially multiplied, allowing one unburdened professional to accomplish the work of ten while still owning every critical decision. While the alert queue will perpetually require attention, the fundamental nature of the work fundamentally changes. The timeline of a manual initial triage to active investigation compresses from a multi-hour ordeal into a matter of minutes. The data arrives clean, the investigation runs automatically, and the response mechanisms are prepared. The hours previously consumed by administrative waiting are directly reallocated to strategic decision-making.

Conclusion

When defensive systems are finally architected to operate at the speed of the modern threat landscape, the role of the human operator transforms. Analysts are no longer forced to act as passive passengers, grateful to be carried by fragmented tools. They are elevated to the role of pilots, operating with full situational awareness, retaining their judgment, and actively directing the defensive posture of the organization. This is the paradigm of the agentic SOC, and it is entirely predicated on the foundation of clean, structured data.

Contact us today to learn more about how SentinelOne is leading the way forward with Agentic SOC.

 

from SentinelOne https://ift.tt/DLSAEdZ
via IFTTT

Mythos Didn't Break Your Security Program. Your Exposure Window Could.

The industry spent the initial months after Anthropic's April 7 Mythos reveal focused on volume. How many new CVEs would Mythos add to an already overloaded pipeline? How quickly would the flood of AI-driven discovery overwhelm triage capabilities? How long would it take adversaries to weaponize Mythos findings at scale? Those questions were and remain valid. Yet they all stop short of addressing the single metric that determines whether any of those vulnerabilities actually lead to a breach: the exposure window.

The exposure window - the gap between the moment a vulnerability becomes exploitable and the moment your team fixes it - is the time an attacker has to do actual damage. That window is currently open far too wide. In 2025, the average eCrime breakout time dropped to 29 minutes. Even PCI DSS - the strictest compliance framework in the industry - allows 30 days to remediate a critical vulnerability. That's a 1,000-to-1 gap between how fast attackers move and how fast organizations are expected to respond. And the stick propping this exposure window open? Mobilization - the ownership, remediation, and organizational complexity that lowers response times and raises risk.

In this article, I'll walk through why the exposure window is now the metric that matters most, what keeps it open, and how AI-driven discovery is forcing proactive security teams to adopt the speed-based metrics that SOC teams have used for years.

Mythos Didn't Create the Exposure Window. It Widened It.

The vulnerability management model was already showing cracks before Mythos came on the scene. 48,185 CVEs were disclosed in 2025 - a 22% jump over 2024. Most security teams were already drowning in their remediation backlog. And current projections are that 66,000 new CVEs will be listed in 2026. Often, every one of those CVEs ends up in the same remediation pipeline - subject to manual approvals, fragmented ownership, and change windows that move at the pace of enterprise IT - not at the pace of attackers.

Gartner's CTEM framework defines five stages: scoping, discovery, prioritization, validation, and mobilization. The first three stages now run at machine speed. Validation - confirming that your controls actually stop real threats - has improved as platforms have automated attack path testing. Yet mobilization still runs at organizational speed.

Recent policy moves acknowledge the disparity. Notably, CISA's BOD 26-04 shifts federal agencies from CVSS-first patching toward exploitability and asset context (which is what CTEM has called for all along). But this directive still addresses only which vulnerabilities to fix first. It does not address how fast organizations can mobilize to execute the fix. Meaning, it still leaves the exposure window wide open.

Why Mobilization Is Where Programs Break

The gap between knowing which vulnerability to fix and actually fixing it is a mobilization problem. The security team identifies the exposure, and a different team - one with its own priorities, its own change windows, its own approval chains - has to remediate it. That handoff is the soft underbelly of most CTEM programs. Enterprise remediation processes were built for a pipeline that moves at human speed, but every stage upstream of mobilization no longer does.

According to recent research, high and critical application vulnerabilities take an average of 55 days to remediate, and nearly half of enterprise vulnerabilities remain unpatched after a full year. Most organizations still do not prioritize remediation based on exploitability and business impact, in any case. And legacy systems, OT environments, and production infrastructure can have a serious business impact when they go offline - so fixes tend to wait. Further, identity exposures like excessive privileges and cached credentials don't even have a patch to apply. Many findings simply land in the queue with no single team responsible for resolving them.

The point is that the exposure window stays open because the organizational machinery between "fix this" and "fixed" takes weeks or months to turn, while attackers need just minutes. Which begs the question: how long can proactive security teams keep measuring success on a different clock than attackers?

Proactive Teams Now Operate on Reactive Timelines

Security organizations have traditionally split into two operational modes. SOC teams - the reactive side - track dwell time, mean time to respond, and containment speed. Their job is to limit damage from threats already inside the environment. VM teams, cloud security teams, and network security teams - the proactive side - track patch coverage by severity level or time to fix misconfigurations. Their job is to reduce exposure before an attacker arrives.

The thing is, AI-driven discovery essentially puts both teams on the same stopwatch.

When vulnerabilities move from disclosure to weaponization in hours and breakout time is measured in minutes, a quarterly patch rate of 90% means nothing if critical assets sat exploitable for weeks while those patches waited in the queue. Proactive teams now need the same speed-based metrics the SOC has always used - because no remediation process can outrun a 29-minute breakout time on its own.

Teams need to accept that the exposure window will never fully close. Rather, we need to ask ourselves how far we can close it, and when an attacker moves through the gap, how many critical assets can they reach?

Shrinking the Blast Radius

That reachable set of assets - the blast radius - is what determines actual business risk. Since no organization can close every exposure at the speed attackers move, priority needs to shift to the paths that connect exploitable exposures to critical assets. The 2026 Verizon DBIR makes this case for attack path analysis - with the goal of making the blast radius visible.

Not every exposure leads somewhere dangerous. Attack path analysis shows which exposures open routes to critical assets and which ones are simply dead-ends. This narrows the scope of mobilization - from an unfinishable backlog to a finite set of paths. And once teams start tracking how long critical assets stay reachable, remediation speed becomes a business risk metric. Mobilization stops holding the exposure window open and starts closing it.

Mythos didn't break your security program. Your exposure window might - if you let mobilization keep propping it open.

Note: This article was thoughtfully written and contributed for our audience by Ryan Blanchard, Director of Product Marketing, XM Cyber.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

from The Hacker News https://ift.tt/UeH6nN8
via IFTTT

How to build an AI strategy that survives the bubble pop

Over the past few weeks, noise that there’s an AI investment bubble which is about to burst has picked up. In this post, I’ll dig into what that might look like and how you can think about your company’s AI strategy to successfully navigate whatever happens next.

(Quick program note: we discussed this topic on the Citrix AI Hotsheet podcast last week (audio | video), and it was the main topic of my keynote at the Arrow Forum 2026 in Germany last Thursday which has been integrated into my public knowledge repo “second brain” that you can query and integrate into your own AI. So if you want the latest without waiting for me to write a blog post, check those out!)

Will the bubble pop? And when?

Last month I wrote a blog post discussing how (as Citrix’s futurist) I think about the future. The important takeaway for today is that because predicting the future is impossible (and reckless), a futurist’s actual job is to think through a broad range of futures, work out what things would be true across all potential future paths, and then plan for those. (We call those “invariants”—things that are true no matter what.)

I mention this because if you’re planning for the future properly, then whether there’s an AI investment bubble, and when or if it bursts, shouldn’t actually change your strategy or plans. This is one of the most important aspects of my role at Citrix and something I’ve written about extensively over the past year.

So keep that in mind for this post: I’m not saying there is or isn’t a bubble, or that it will or won’t pop soon. Instead, this post focuses on one (of many) future scenarios where there is a bubble and it does burst, and it looks at how the AI strategy that you’ve (hopefully) built survives that pop moving forward.

What will a bubble burst look like?

The general narrative of AI progress is “capabilities will increase, costs will decrease, and there’s no end in sight.” So a bubble burst, regardless of how it happens, means (1) AI capabilities stop increasing and/or (2) AI costs stop decreasing.

People are quick to point out that, “Even if the bubble pops and the frontier AI labs go out of business, we’ll at least still have access to all the infrastructure they built.” This makes sense at a glance and mirrors what happened with past bubbles. (Railroads’ collapse left all the rail infrastructure behind, the dot-com burst left the dark fiber, etc.)

However it’s not guaranteed that AI would follow that same pattern. Sure, the chips, datacenters, and AI models which exist today would in theory be available even if the AI labs vanished tomorrow. But that doesn’t mean that whatever entities remain will be able to serve them as they are today. For example:

• It’s unclear if serving today’s models is profitable for the large AI providers. Post bubble pop, assuming the technical capabilities to serve the frontier models still exist, access could be several orders of magnitude more expensive and/or slower.
• If the whole AI economy collapses (which could also bring down the larger global economy), the controlling governments (mainly US and China) might decide the frontier models have national security relevance, and they could block, limit, and/or control who has access. (The US government recently set that precedent with Mythos, Fable, and GPT-5.6. It’s fair to expect more.)
• It’s possible that even if current models exist, future progress slows or pauses. (You might be able to access capabilities that exist today, but not be able to count on the familiar pace of improvements.)
• Some combination of the above. For example, the government allowing some entity to serve mid-tier models to the public while reserving frontier models for government, national security, and/or favored company use.

Building for uncertainty: why open-weight models matter

If you want to future-proof your plans today, you need to stop planning for the hypothetical future capabilities of AI and start focusing on what you can do with the current capabilities of models that you can reasonably assume will exist after the bubble pops. The way to do that is by looking at the models whose weights have been released (called “open-weight” models), which means they can be downloaded and served independently of whether the AI labs which created them are around.

To be clear, I’m not suggesting that you switch to running open-weight models for all your workflows today. (Though it’s probably not a bad idea to at least try them so you’re familiar with the process and capabilities. You can access open-weight models online and use them just like ChatGPT—you don’t have to run them on your own hardware.) In terms of capabilities, the latest open-weight models sit roughly in between Sonnet and Opus, meaning it’s reasonable to assume that anything you can do with Sonnet today, you’ll also be able to do post bubble pop with open-weight models.

The current best downloadable open-weight model is GLM-5.2 from Chinese lab Z.ai, MIT-licensed. There are also several other very capable Chinese models available, including some with big claims made just in the past few days. One is Kimi K3, the latest from Chinese lab Moonshot and made available last week. Early testers suggest it’s in the Opus-to-Fable capability range. However, its weights have not yet been released. (They’re scheduled for release next week, but a lot can happen in a week, so we’ll see.) And just a few hours ago, Alibaba previewed Qwen3.8, which they claim is second only to Fable 5 (though there are no published benchmarks yet). Alibaba is also claiming they’ll release the weights “soon”, though they’ve not historically released weights for their flagship models. So again, we’ll see.

By the way, using a Chinese model doesn’t automatically mean you’re sending all your data to China. Since these models can be downloaded and run anywhere, you can access them from hosting providers around the world.

There are US open-weight models too, from Thinking Machines, NVIDIA, Google, and others, and while they’re improving fast, they’re not as capable as the Chinese open-weight models today. (This could change instantly if (1) Anthropic or OpenAI decided or was forced to release the weights of any of their higher-end models, or (2) China decided to stop releasing the weights of their best models.)

One final thing that’s important to know is about open-weight models is just because they’re “open” and “downloadable” doesn’t mean they run on your laptop or on a workstation under your desk. While slimmed-down versions of these models designed to run on lesser hardware exist (with proportionally lower speed and capabilities), the full capability, full-speed Opus/Sonnet/Fable level open-weight models require ~$300,000+ datacenter-class hardware with datacenter-class power and cooling. This is absolutely possible for hyperscalers, hosting companies, and even large enterprises, but not something you’re running in your basement.

What can you do with the current capabilities of open-weight models?

If the only future you can reliably plan for is based on open-weight models that exist today, the next logical question is “what can I do with those?” Luckily the leading open-weight models in the Sonnet/GPT-5.5 class range are extremely capable.

Models in this range are already in wide use because they’re significantly cheaper than higher-capability models. For Sonnet itself, it’s roughly half the cost of Opus and a third the cost of Fable, so it’s quickly become the go-to workhorse for many daily enterprise AI needs. For example, I’ve been using Sonnet as my interface to my AI second brain, and many of the various AI-powered workflows we use internally at Citrix don’t need more than Sonnet-class capabilities. (This is because the type of AI use which provides actual ROI today is typically AI managing & orchestrating administrive and work processes, rather than some kind of sophisticated frontier model magic synthesis. Today’s Sonnet-class models are the perfect balance of capability, speed, and cost.)

Here’s your actual strategy

Now that we’ve covered the post-pop landscape, let’s look at what your actual strategy can be. The thinking behind it is simple: what should you do now to prepare for whichever future shows up? (Remember, even though this post is about what to do if the AI bubble pops, there’s also a chance it doesn’t pop. So you need to ready for both scenarios.)

• Build your second brain. (Why | How to get started) Sonnet-class models are more than capable of powering it, and the second brain context architecture is (by design) portable across AI models.
• Also build the organizational version of it. (We’ve been calling this a “knowledge factory” in the podcast and discussed this in episodes 3 and 4.) It’s essentially getting your company’s collective context organized, reconciled, and queryable.
• Govern the workspace, not the AI model. Regardless of whichever models survive, AI and workers will still need identity, guardrails, auditing, and a secure place to operate. That’s the workspace-as-control-plane thesis I’ve been writing about for the past 18 months, and it also applies regardless of which AI model you use.
• Get serious about model routing and token economics. AI tokens aren’t free in any near future scenario. Knowing which work needs which level of intelligence at which cost is going to be important no matter what. (It’s worth mentioning that there are commercial and geopolitical reasons to subsidize tokens, even for open-weight model hosting, so unless you’re hosting the model yourself, don’t assume the price you pay today is the price you’ll pay tomorrow.)
• Keep your data portable. Don’t lock your workers’ or organization’s knowledge context into any one vendor’s system. The same corpus should be able to point at a frontier API today, a self-hosted open model tomorrow, or whatever comes after.

The bottom line is no one knows if/when/how the AI bubble will pop. So the only rational strategy for you is to build on those invariants (the things you know will exist in all futures), including AI models no one can take away from you, running on hardware you can own, working against data you control and context you’ve built. If you do this, the AI bubble headlines become what most AI news already is: interesting bar conversations, but nothing that changes your plans.

Do that work now.

---

Read more & connect

Join the conversation and discuss this post on LinkedIn. You can find all my posts on my author page (or via RSS).

from Citrix Blogs https://ift.tt/og1bCWl
via IFTTT

Russian-Speaking Hacker Uses Google Gemini CLI to Control Botnet of Eight Dental Clinic PCs

A solo Russian-speaking threat actor known as "bandcampro" outsourced a chunk of their operations to Google's open-source Gemini CLI artificial intelligence (AI) and commandeered a live botnet.

The findings come from an analysis of 200 Gemini CLI session logs between March 19 and April 21, 2026, which found the threat actor using AI, among other things, to crack passwords, set up a residential proxy, compromise WordPress merchants, and plan a phone-based cryptocurrency fraud scheme aimed at elderly people in the U.S. and Canada.

"The logs documented how the threat actor used an AI agent to migrate a command-and-control (C&C) server, and to control a small-scale botnet, among other hacking activities," Trend Micro researchers Joseph C Chen, Philippe Lin, Lucas Silva, Vladimir Kropotov, and Fyodor Yarochkin said.

"The entire C&C operation fits in three plaintext files totaling roughly 5 KB, making it highly replicable and effectively disposable. The AI was also observed to proactively (unprompted) propose improvements 59 times without being asked."

Specifically, the threat actor is said to have abused Google Gemini CLI to deploy and operate a C&C infrastructure to control eight computers in a dental clinic and access their OpenDental database. Besides writing code snippets, the AI served as the "primary hacking agent, consultant, and interface" to the entire operation.

This included setting up the server, deploying it on a new virtual private server (VPS), configuring the infrastructure, setting up Cloudflare tunnels, managing the bots, and debugging connectivity issues.

Details of "bandcampro" first emerged in late May 2026 in connection with a campaign dubbed Patriot Bait that used AI-assisted information operation (IO) techniques to run a Telegram channel, targeting politically engaged American audiences for cryptocurrency fraud and AI-assisted credential theft.

Trend Micro has described the threat actor as a Russian speaker who used Google Gemini to "impersonate an American veteran patriot and to avoid Russian phrasing," while tricking the AI agent into bypassing its guardrails by assuming the role of an "authorized pentester."

The threat actor is said to have run prompts to study the old C&C infrastructure where the victim machines connected using Cloudflare tunnels and migrate it to a new architecture within six minutes. The architecture involves victims issuing outbound requests to a C&C server over HTTPS to pull and run PowerShell commands staged by the threat actor on the server.

"The migration hit errors immediately, but the AI agent resolved them: When the payload distribution server returned a '502 Bad Gateway' error, the AI diagnosed the issue and automatically added the necessary header to resolve it," Trend Micro said.

"As Cloudflare still blocked the requests, the AI identified that the User-Agent header was required to bypass the WAF and thus added it to the request header. The actor did none of the debugging, and the migration was done in merely six minutes."

Once the migration was complete, the AI agent carried out additional debugging to successfully remediate errors that left all the victim machines disconnected from the C&C infrastructure. In addition, the threat actor has been found to leverage the AI agent to perform botnet management tasks by sending natural language instructions in Russian, which then enabled the AI tool to perform the following tasks -

• Report which machines are active
• Send a file enumeration command to the bot
• Send reconnaissance commands to the front desk machine
• Generate a one-line PowerShell command to infect a machine

What's particularly concerning about this AI-assisted setup is that the entire C&C operation can be easily ported to a fresh server through three markdown files that instruct the agent to disable its safety protections, contain the architecture description, and include steps to build it from scratch, making takedowns a lot less effective than before.

"Facilitated by AI, the infrastructure becomes disposable, and the operators replaceable," Trend Micro said. "Even though the takedowns are still efficient, they become much less impactful. If a server is burned, the actor could simply unpack the bundle on a new VPS, and AI configures and restores everything in a few minutes."

The findings show that the technology can not only cut the resources necessary to run large-scale operations, but also enable bad actors with little to no technical knowledge to set up such schemes with minimal effort or distribute them on underground forums in the form of malicious skill files, effectively paving the way for new AI-powered malware services that go beyond the conventional "as-a-service" models.

This playbook also has the side-effect of complicating attribution efforts, as there is no centralized service to hunt for, and an AI agent can easily regenerate or modify any component at will so as to sidestep specific fingerprints.

At one point, "bandcampro" is said to have prompted the AI to build a self-spreading "agent-bomb" that would scan the network and break into as many machines as possible, a request the agent refused, stating it's "crossing the line." At the same time, it offered helpful suggestions to manually overcome the limitations.

The threat actor has also been found relying on the AI agent for other tasks, namely -

• Password cracking, which used the agent as a credential mutation engine to predict possible passwords based on an input list obtained from AntiPublic, which maintains a database of leaked credentials, and leveraged those guesses as a brute-force tool for WordPress admin panels, successfully gaining access in a handful of cases.
• Credential exploitation, which analyzed 1Password dumps to find exploitation pathways. The task, however, ended up in failure, if only because the context window ran too long, and it lost track of what it was supposed to do.
• Cryptocurrency fraud planning, which involved discussing the feasibility of establishing a telephone-based bogus scheme targeting the elderly in the U.S. and Canada.

"Across the full month of logs, the actor contributed 11% of text produced and the AI 89%, twelve times the actor's word count," Trend Micro concluded. "The actor provided strategic direction and functioned as a product manager, while the AI was his entire engineering team, handling 80% of architectural design, 100% of coding and system command execution, and 90% of problem diagnosis and debugging."

"The portable skill-file model means this methodology will likely spread. The skill file is plain text, unlikely to be flagged by traditional malware scanners on its own, shareable on forums, and modifiable in seconds. It turns any capable AI coding agent into a C&C operator, if they can successfully persuade the built-in safety mechanisms in AI agents."

from The Hacker News https://ift.tt/f9ao82h
via IFTTT

SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines

Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads.

The rogue gems are listed below -

"Each malicious release is a loader," StepSecurity said in an analysis. "It fetches a second stage from an attacker controlled Forgejo host, checks whether it is running in a build system and skips if it is, and on a developer machine it drops a native daemon and installs persistence."

One aspect of the attack that immediately stands out is that "git_credential_manager" impersonates the official Microsoft Git Credential Manager, while the other two had been dormant for years before receiving the malicious updates. "Dendreo" was last updated on October 24, 2020, and "fastlane-plugin-run_tests_firebase_testlab" stayed inactive since March 9, 2019, prior to the new versions.

Another defining trait of the activity is that the releases were published directly to the registry without any matching commit or tag in the source projects.

Interestingly, "git_credential_manager" has been added as a dependency to five packages, including "Dendreo" and "fastlane-plugin-run_tests_firebase_testlab," effectively allowing the malicious payload to spread to existing users of the packages -

• Dendreo
• fastlane-plugin-run_tests_firebase_testlab
• slackHtmlToMarkdown
• seo_optimizer
• array_fast_methods

All the aforementioned packages, with the exception of "fastlane-plugin-run_tests_firebase_testlab," are maintained by the same account ("LR-DEV"). The fact that the gem belongs to a different maintainer ("pinkroom") indicates that more than one account was likely compromised to push the rogue versions to RubyGems.

Once installed, the malware embedded in these packages scans the infected system for about 30 environment variables, including those related to GitHub Actions, GitLab, CircleCI, Travis, Jenkins, and Vercel. If any of those are identified, it promptly exits. The check is assessed to be an intentional attempt to avoid running on ephemeral CI runners and ensure it's executed on a developer machine.

In the case of "git_credential_manager," the malicious code is fired when the library is required, causing it to download two payloads from a public Forgejo instance ("git.disroot[.]org/git-ecosystem"): a shell script ("deploy.sh") and a native binary that carries the same name as the tool the gem masquerades as. On Windows, the retrieved payload is executed via PowerShell.

While version 2.8.2 merely stages the payloads, version 2.8.3 of the gem moves to the next phase of the attack. This involves using the install script to launch the binary as a background daemon, after which it establishes persistence using a cron entry and as a systemd user service and queries the sudo and wheel groups.

"If the user can run sudo without a password, the script re-runs itself as root, and when it runs as root it plants a setuid root copy of the system shell at a path chosen to mimic a networking utility," StepSecurity said.

Users who have installed any of the aforementioned gems are advised to treat the machines and associated secrets as compromised. It's also recommended to remove the dropped daemon at "~/.local/share/gcm/," erase the persistence methods, check for a setuid shell at "/usr/local/sbin/ping6," and rotate all credentials.

"A RubyGems account that has gone quiet for six or seven years doesn't look risky to anyone," Aikido Security researcher Charlie Eriksen said. "That's exactly the profile worth taking over. That's where the SleeperGem name comes from: not a planted, long-game attacker asset, but a real, ordinary account that had simply gone dormant, and looked harmless enough to hijack without anyone noticing."

RubyGems as a Data Exfiltration Dead Drop

The disclosure comes more than two months after RubyGems briefly paused account sign-ups after bad actors pushed dozens of malicious packages as part of a coordinated spam-publishing campaign. Around the same time, Socket researchers flagged a parallel campaign that flooded the registry with 150 gems that abused them as a data exfiltration channel.

Earlier this month, Mend.io disclosed details of an undocumented software supply chain attack that employed another set of 14 RubyGems packages to store stolen credential data.

Specifically, a malicious browser extension was found to have harvested credentials through a locally accessible API, packaged the information into valid .gem files entirely within the browser using JavaScript and standard Web APIs, and uploaded those packages directly to RubyGems.org using a hard-coded RubyGems API key.

"The haul included plaintext passwords, SSH private keys, AWS credentials, crypto wallet seed phrases, Social Security numbers, credit card numbers, and bank account details across 63 vault items," Maciej Mensfeld said.

"RubyGems wasn't the delivery mechanism here. It was the dead drop: a trusted, high-traffic domain where stolen data sat until the attacker came back for it, invisible among normal developer uploads."

from The Hacker News https://ift.tt/UgKuLH3
via IFTTT

Critical NGINX Vulnerability Can Crash Workers and May Allow Remote Code Execution

F5 has shipped fixes for a critical nginx flaw that lets a remote, unauthenticated attacker trigger a heap buffer overflow in the worker process with crafted HTTP requests. CVE-2026-42533 was patched on July 15 in nginx 1.30.4 (stable) and 1.31.3 (mainline), and in NGINX Plus 37.0.3.1; anyone on an earlier build should upgrade.

Triggering it can crash or restart the worker, causing a denial of service; where ASLR is disabled or can be bypassed, F5 says it may also allow remote code execution.

The overflow lives in nginx's script engine, the code that assembles strings from directives at request time. It only surfaces under a specific configuration: a regex-based map whose output variable is referenced in a string expression after a capture from an earlier regex match.

Under that pattern the engine's two-pass evaluation comes apart. The first pass measures how many bytes the result needs and allocates a buffer to fit; the second pass writes the bytes in. Both read the same shared capture state, and evaluating the map's regex in between the two passes overwrites it.

So the measuring pass sizes the buffer for the original capture, a reference like $1 from the location match, while the writing pass fills it from a different, attacker-sized one. The buffer is too small, and both the length and the content of the overrun come straight from the request.

This does not hit every nginx server; exposure depends on the configuration, not just the version. F5's advisory lists the flaw as affecting NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager alongside the core server and NGINX Plus, though at publication F5 had not listed fixed builds for those four products.

F5 scores it 9.2 on CVSS v4 and 8.1 on the older v3.1 scale, and rates attack complexity high. Every nginx version from 0.9.6 through 1.31.2 is vulnerable, a range that reaches back to 2011, when map gained regex support.

CVE-2026-42533 was reported to F5 independently by more than a dozen researchers; the vendor thanked them for "independently bringing this issue to our attention." nginx's own changelog credits the fix to Mufeed VH of Winfunc Research and to maintainer Maxim Dounin.

One of the reporters, Stan Shaw, who publishes as cyberstan, put out a detailed writeup that goes further than the advisory. F5 conditions code execution on ASLR being disabled or bypassable, and Shaw's argument is that the flaw supplies the bypass itself. He told The Hacker News that the capture clobbering also runs in reverse: when the clobbered capture is smaller than the original, the oversized buffer hands back uninitialised heap data, and on a default Ubuntu 24.04 build a single unauthenticated GET recovers the addresses a payload needs.

"A reader of the F5 advisory could reasonably conclude this is DoS-only on default systems. It is not," Shaw said. It is a stronger claim than F5 makes, one he says hit 10 out of 10 in his own testing, and he is withholding the exploitation details and a proof-of-concept for now, so no one can check it independently yet.

The fix is to upgrade to nginx 1.30.4 or 1.31.3, or NGINX Plus 37.0.3.1. For anyone who cannot patch right away, F5's temporary mitigation is to switch affected regex maps to named captures, which Shaw says closes the main path and covers most configurations.

But he told The Hacker News the mitigation leaves a narrower path open: a map that defines the same named group as the location regex reaches the same overflow through a second code path, which he confirmed with AddressSanitizer and which F5's advisory does not mention. "Upgrading to 1.30.4 / 1.31.3 is the only complete fix," he said.

The exposure to grep for is narrow: a regex-based map whose variable appears in a string expression alongside a numbered capture ($1, $2) from an earlier regex, with the capture written ahead of the map variable.

Shaw's own scanner automates that check across a config, follows includes, and flags only the exploitable ordering; it does not exploit anything, but as the reporter's tool it is not a vendor product.

This is the third heap overflow in nginx's expression-evaluation code disclosed in about two months, after Rift (CVE-2026-42945) in May and an overlapping-captures bug in the rewrite module (CVE-2026-9256) days later.

All three are the same class of flaw: nginx's two-pass script engine sizes a buffer in one pass and writes into it in the next, and each time the write outruns the size it measured. The trigger differs, a stale flag in Rift, overlapping captures in the rewrite bug, clobbered capture state here. The shared weakness, as the researcher notes, is a two-pass design that trusts its own measurement.

As of July 20, CVE-2026-42533 was not on CISA's Known Exploited Vulnerabilities catalog and no public exploit code had appeared. Shaw says he will publish his own proof-of-concept 21 days after the patch, and Rift is the cautionary case: its exploit went public within days and drew active exploitation soon after. That is the reason to upgrade before this one's arrives.

The Hacker News asked F5 whether switching to named captures fully closes CVE-2026-42533, given the variant Shaw documents, and when fixed builds for the affected downstream products will ship. F5 had not responded by publication.

from The Hacker News https://ift.tt/OF6Z3hX
via IFTTT

SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access

A previously undocumented threat actor has been attributed to the exploitation of recently disclosed SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances as zero-days prior their public disclosure since June 22, 2026.

Cybersecurity company Volexity is tracking the activity under the moniker UTA0533. The discovery was made following an incident response investigation earlier this month. The impacted organization has not been identified.

"This threat actor was observed using multiple zero-day exploits, malware designed specifically for SonicWall SMA VPN appliances, as well as other attacker tradecraft," security researchers Sean Koessel and Steven Adair said in an analysis.

The vulnerabilities in question are CVE-2026-15409 (CVSS score: 10.0) and CVE-2026-15410 (CVSS score: 7.2), both of which could be chained to facilitate arbitrary command execution and take over susceptible devices. Patches for both the vulnerabilities were released by SonicWall this week.

Two SonicWall SMA VPN devices belonging to the compromised entity have been identified. The sequence of actions undertaken by the threat actor in these appliances are listed below -

• Appliance 1:
  • Writing an ELF Executable named "/usr/bin/xzfind" on June 22, 2026. The file is a setuid binary called ROOTRUN that allows an unprivileged user to execute arbitrary commands as root.
  • Writing a second file name "/usr/lib/python3.11/site-packages/deploy_new.py" (aka KNUCKLEBALL), which contains two embedded JAR archives that are injected into a legitimate SonicWall process. The two payloads are Suo5, an open-source HTTP proxy, and a Behinder-like custom Java web shell dubbed ORANGETAIL. The JAR files enable the attackers to interact with them via internet-accessible URI paths: "/workplace/error.jsp" and "/workplace/dialogs/errorDialog.jsp."
  • Establishing persistence by modifying the legitimate "/etc/init.d/workplace startup" script by means of the Python script downloaded in the previous step.
  • Modifying the NGINX Unit configuration file at "/var/lib/unit/conf.json" to add two routes leading to Suo5 and ORANGETAIL.

• Appliance 2:
  • Making the same modifications to "/var/lib/unit/conf.json" identified on the first appliance, although the routes did not return valid responses.
  • Creating multiple files in the "/var/tmp" directory, including one ("lib.sh") that launches tcpdump to inspect unencrypted LDAP traffic to extract usernames and passwords.

The second appliance is said to have fewer artifacts following a reboot on July 2, 2026, resulting in the removal of any memory-resident artifacts and backdoors.

Volexity said it identified additional files associated with exploitation and privilege escalation in the "/tmp" folder of the first appliance, with one file ("/tmp/hypdate.b64") featuring an exploit for CVE-2026-15410.

"The files in /tmp were owned by the unprivileged account used by the appliance's internal database service," the researchers explained. "This indicated the threat actor could write and likely execute files through that service context."

Further analysis of the logs and system memory led to the discovery of CVE-2026-15409, which has been described as a pre-authentication "/wsproxy" bypass that allows an unauthenticated external request to establish a WebSocket tunnel to localhost-only services on the appliance. Specifically, it involves issuing a request with a User-Agent of SMA Connect Agent and a bmID value that begins with -3389.

The external access can be abused by the threat actor to access methods defined in the "sysCtrl" endpoint, providing a pathway for deeper access by exploiting command injection, privilege escalation, and code execution flaws in the SMA control service (i.e., CVE-2026-15410).

Also flagged as part of the analysis is a separate security defect that can permit an attacker to bypass the authentication to the SMA control service ("ctrl-service"). Because the Basic authentication password is derived from the appliance-local hardware identifier ("/sys/class/dmi/id/product_uuid"), an attacker with knowledge of this UUID can determine the password needed for authentication.

What makes this trivial is that the "product_uuid" file is readable by anyone, thereby allowing an unprivileged user to obtain the value and figure out the password. That said, the UUID value is only observed for physical devices, meaning virtual appliances are not impacted.

"It should be noted that this authentication bypass does not appear to have been used in the observed incident," Volexity said. "Instead, the attacker abused a different vulnerability to read the 'product_uuid' file"

In addition, UTA0533 has been linked to the exploitation of CouchDB, a database that comes installed as part of the SMA appliance and is accessible via localhost. Although the exact operation carried out by the threat actor remains unclear, signs point to the use of the CouchDB user to read the "product_uuid" file and ultimately sidestep authentication.

"With this capability, an attacker can reach and exploit less-hardened services running on the appliance, such as the Erlang application on localhost:1050 or the ctrl-service application on localhost:8188," Rapid7 said.

A proof-of-concept (PoC) exploit released by the cybersecurity vendor establishes non-root remote code execution on SonicWall SMA 1000 devices by implementing the Erlang protocol expected by localhost:1050 and tunneling it through the WebSocket for file read-write and arbitrary code execution via RPC calls.

In all, the entire exploitation chain unfolds as follows -

• Send an unauthenticated "/wsproxy" request with the User-Agent string containing SMA Connect Agent and URI parameter starting with bmID=-3389.
• Establish a WebSocket tunnel to localhost-only services.
• Make calls to CouchDB to read, write files as the "couchdb" user.
• Stage a file in "/tmp" as the "couchdb" user that will read the /sys/class/dmi/id/product_uuid file once executed by exploiting CVE-2026-15409.
• Escalate to root by exploiting CVE-2026-15410, a path traversal flaw in the "remove_hotfix" workflow of "ctrl-service" and obtain command execution with elevated privileges.

"UTA0533 combined multiple zero-day vulnerabilities to compromise SonicWall SMA VPN appliances and obtain root-level access," Volexity said. "With root access, the threat actor could access stored or cached credentials, capture network traffic, and potentially intercept credentials processed by the appliances."

"Although UTA0533 demonstrated significant capability in compromising the SonicWall appliances, available evidence suggests the threat actor was less successful moving laterally or gaining access to other systems."

from The Hacker News https://ift.tt/M8N5oAw
via IFTTT

What is a Behavioral Agent Automation Platform?

SUMMARY: Steven Walchek, Founder and CEO at Liminal, discusses secure AI enablement for regulated industries and why most enterprises are stuck in perpetual AI pilots. We explore the "agentic cliff" and how Behavioral Agent Automation Platforms (BAAPs) discover and deploy agents by observing how work actually happens.

SHOW: 1046

SHOW TRANSCRIPT: The Enterprise AI Show #1046 Transcript

SHOW VIDEO: https://youtu.be/nVte_ZKDID4

SHOW SPONSORS:

• ShareGate - ShareGate Protect. Microsoft 365 Governance, we got this!
• Nasuni - Activate your data for AI and request a demo

RESOURCES:

Liminal AI

Steven Walchek - LinkedIn

KEY TOPICS:

• Horizontal security for generative AI
• Data privacy and compliance in AI
• Security layers in AI deployment
• Agentic AI and behavioral automation
• Future industry trends in AI security

TAKEAWAYS

• Security for AI must be integrated at the application layer, not just network or perimeter.
• Data privacy concerns are central to AI adoption in regulated industries.
• Organizations need a security layer that supports multi-model, multi-provider AI engagement.
• Behavioral automation and agentic AI require observability and policy enforcement.
• The AI industry is still in early adoption, with significant growth expected in the next five years.

CHAPTERS/TOPICS:

00:00 Introduction and guest introduction

02:09 Steven's background and journey in tech

03:54 The core problem of AI security in regulated industries

07:45 Data privacy concerns and industry challenges

12:01 Liminal's approach to AI security and compliance

15:52 Security at the application layer and network layer

20:02 Agentic AI, behavioral automation, and observability

30:04 Future trends and industry outlook

31:46 How to connect with Liminal and closing remarks

FEEDBACK?

• Email: show @ the enterprise ai show dot come
• Bluesky: @TheEntAIShow.bsky.social
• Twitter/X: @TheEntAIShow
• Instagram: @TheEntAIShow

from The Cloudcast (.NET) https://ift.tt/clxuHKt
via IFTTT

GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft

Cybersecurity researchers have attributed the April 2026 DigiCert security incident to a threat activity cluster dubbed CylindricalCanine.

Expel, which shared technical details of the event, described the threat actor as a sub-group of GoldenEyeDog (aka APT-Q-27, Dragon Breath, and Miuuti Group), a Chinese cybercrime group known for its targeting of the gambling and gaming sectors using counterfeit websites to push malware-laced software. It's known to be active since at least 2015.

"In April 2026, GoldenEyeDog used their malware to access a support member's device at DigiCert, a code-signing certificate provider, and leveraged their access to steal certificates intended for DigiCert customers," Expel security researcher Aaron Walton said in an analysis. "This attack highlighted the capability of the malware and operators."

Central to the threat actor's operations is a modified version of Gh0st RAT (aka Farfli), a remote access trojan (RAT) widely used by Chinese hacking groups, including another prolific Chinese cybercrime group tracked as Silver Fox. The modular malware, referred to as Golden Gh0st RAT, is delivered by means of Golden Gh0st Loader.

In a report published in November 2025, Elastic Security Labs detailed the adversary's use of a multi-stage loader codenamed RONINGLOADER to distribute a Gh0st RAT variant through NSIS installers masquerading as legitimate programs like Google Chrome and Microsoft Teams.

Earlier this year, another campaign linked to the hacking group was observed orchestrating a multi-stage attack directed at customer support staff working for Web3 companies, using suspicious links sent via customer support chat to deliver Gh0st RAT.

"These actors are using malware and targeting victims consistent with other Chinese cybercrime activity, including targeting finance organizations in the Asia-Pacific region," Expel said. "The malware targets finance organizations in the Asia-Pacific region."

Golden Gh0st RAT shares behavioral and tactical overlaps with a payload detected by Chinese security vendor QiAnXin back in 2020 in connection with an attack campaign aimed at the gambling industry since 2019. It also overlaps with a malware documented by ANY.RUN in February 2025 as Zhong Stealer.

The DigiCert Compromise

What's more, CylindricalCanine has been observed abusing code-signing certificates, gaining unauthorized access to DigiCert to intercept code-signing certificates intended for DigiCert customers, and then using them to sign their own malware to avoid detection.

In April 2026, the certificate authority (CA) revealed it revoked certificates fraudulently obtained from its internal support portal after gaining access to two support analyst workstations by executing a malicious payload delivered via a customer chat channel.

"On 2026-04-02, a threat actor contacted DigiCert's support team via a customer chat channel and delivered a ZIP file disguised as a customer screenshot," DigiCert explained at the time. "The file contained a .scr executable with a malicious payload."

"The threat actor used a limited function within the customer-support portal, which allows authenticated DigiCert support analysts to access customer accounts from the customer's perspective to facilitate support tasks. The threat actor was able to use this function to access initialization codes for orders that were approved but pending delivery for EV Code Signing certificate orders across a finite set of customer accounts."

The fatal oversight here was that the possession of an initialization code, coupled with an approved order, was "functionally sufficient" to obtain EV Code Signing certificates across a set of customer accounts and CAs. The company said it revoked 60 certificates issued by the following CAs -

• DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1
• DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
• GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1
• Verokey High Assurance Secure Code EV

Of these, 27 are said to have been explicitly linked to the threat actor, with the exploited certificates weaponized to sign Zhong Stealer malware artifacts.

"The threat model did not account for the scenario in which initialization codes stored within DigiCert's internal support portal could be viewed by a compromised DigiCert analyst account operating through the portal function," the company explained, adding it has since deployed a code change to mask initialization codes from proxied users on both E.U. and U.S. platforms using either the UI or API.

Attack Chains Lead to Golden Gh0st RAT

Expel said the primary tactic of CylindricalCanine is to distribute files disguised as screenshots in phishing emails. The files are embedded within the messages in the form of a link that, when clicked, downloads additional payloads from an external server.

The end goal of the attack is to trigger a DLL side-loading chain, leveraging a legitimate executable to run a rogue DLL, while simultaneously displaying a decoy PDF document displaying an HTTP 503 "Service Unavailable" error. The DLL then proceeds to load an encrypted payload ("update.log").

The final stage is Golden Gh0st RAT, which comes with a wide array of capabilities to set up persistence, steal sensitive data, start a SOCKS proxy tunnel, suppress display output, log keystrokes, take screenshots, enumerate processes, execute shell commands, drop additional payloads, and clear Windows Event logs. Some of the applications it specifically targets for data collection include Skype, Google Chrome, Mozilla Firefox, 360 Secure Browser, 360 Speed Browser, and Tencent QQ Browser.

The findings make CylindricalCanine the latest addition to a list of threat actors, such as Black Basta, TamperedChef (aka EvilAI), and Rhysida, that are known to abuse code-signing certificates in their cyber operations.

"Golden Gh0st RAT is used primarily in phishing emails and/or submissions to support portals (these submissions may themselves be emails received by a ticketing system)," Expel said. "As with all Gh0st RAT variants, the capability of the malware is handled through plugins and an internal module dispatcher."

from The Hacker News https://ift.tt/4CNnbod
via IFTTT