Kimsuky has been observed using an AI agent to produce convincing phishing decoys at scale, then hiding malware inside Windows shortcut files. The latest activity shows how ordinary-looking documents can become the first step in compromise.

The campaign begins with spear-phishing messages carrying ZIP archives. Inside is a malicious LNK shortcut disguised as a document, often with a browser-style icon and false details. When opened, it displays a decoy while silently launching PowerShell to fetch additional code.

The 13 samples examined were collected between August 11 and 19, 2026, and used financial and corporate lures. That wider range raises the risk for corporate staff who routinely receive paperwork and financial notices.

Genians researchers identified the activity as a continuation of the Kimsuky-linked Operation GitPower cluster. 

Genians said in a report shared with Cyber Security News (CSN) that the campaign retains GitHub-based command infrastructure while adding evasion and varied decoy formats.

Kimsuky Hackers Use OpenCode AI Agent

The most notable change is evidence of opencode in the Creator and Producer metadata of several PDF lures.

Four documents carried the same August 16 creation timestamp, while their Author field remained set to “anonymous,” supporting the assessment that they were produced automatically rather than assembled one at a time.

The documents were not uniformly polished. Some contained unreplaced placeholder text for payment dates, grace periods, and financial values, a sign that drafts were pushed into use without careful review.

Other PDFs showed HeadlessChrome and Skia/PDF metadata, suggesting a separate workflow that generated HTML content and rendered it into cleaner-looking PDFs.

That combination gives attackers speed without abandoning familiar social engineering. Analysts found 29 retrieved decoy files but only 11 unique documents by MD5, with duplicated content redistributed under randomized names.

Readers can see the earlier context in Kimsuky local LLM phishing lures, where AI-made files were already used to make shortcut-borne attacks appear routine.

Such artifacts can disappear as operators refine their process, so defenders should not use document quality or metadata alone as the test for whether an attachment is safe.

LNK Loaders Hide GitHub-Based Payloads

Every analyzed LNK file launched PowerShell, concealing an encrypted loader in arguments stretching roughly 5,800 to 9,500 characters.

About 300 leading spaces helped keep the command out of sight in the shortcut properties window, while excess padding inflated file sizes to frustrate simple inspection and some automated checks.

After decoding the hidden content, the loader downloads a decoy and a follow-on script from GitHub Raw Content using a hardcoded personal access token.

It then creates randomly named PowerShell files in AppData or Temp, starts PowerShell through conhost.exe --headless, and registers hidden scheduled tasks that impersonate BitLocker, MATLAB, or .NET components.

One Visa-themed variant also pulled code from Pastebin, giving the operators a second delivery route if GitHub access is blocked. The approach builds on North Korea GitHub C2 attacks, where trusted developer platforms were used to blend malicious traffic into ordinary web activity.

Newer variants check for virtual-machine and analysis tools, look for the username “Bruno,” and delete PowerShell command history when they detect a likely research environment.

They also use error documents in some incomplete builds, but the persistence and payload retrieval stages can still run. Comparable LNK PowerShell loader techniques show why opening a file that merely looks like a PDF is not a reliable safety check.

Organizations should quarantine unsolicited ZIP attachments containing LNK files, especially when their icons and descriptions do not match their real type.

Security teams should correlate LNK launches with long command lines, hidden PowerShell, newly created scripts, scheduled-task registration, GitHub Raw requests carrying unusual tokens, and Pastebin access.

This behavior-first approach is more durable than relying on a single domain blocklist or decoy document review, and aligns with lessons from malicious shortcut file campaigns.

Indicators of compromise (IoCs):-

Type	Indicator	Description
MD5	10780939962b54addc9d31f57d80edfc	Malicious sample hash
MD5	1523a2fcc901965ab4568d9fe829e4af	Malicious sample hash
MD5	500e0bc0d7579fb338912770964076fe	Malicious sample hash
MD5	685bfc6b2c29fbc16cfad908894add55	Malicious sample hash
MD5	7a53089053b1381742856a5cf2b95f8b	Malicious sample hash
MD5	8db2f20b719dcb7029d6296505622093	Malicious sample hash
MD5	900e832c10d851bbdef3fb191a15db0e	Malicious sample hash
MD5	a2015665a3e18bf0ef86e3931245c7e6	Malicious sample hash
MD5	bb88940e915b11f6330b7446f6037f5b	Malicious sample hash
MD5	ce5932b88f879f26006df81f2fa7667e	Malicious sample hash
MD5	d0894d4626aae0f96d6b84ca3bb71a36	Malicious sample hash
MD5	e50f2ae7fb03675a1ef58b1cf9cda6d1	Malicious sample hash
MD5	f648bdd3c2cd902e239149de86d43e8f	Malicious sample hash
GitHub account	github[.]com/sven5500	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/montry111	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/jamjack2026	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/urusa4400	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/jamestony88	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/baras6600P	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/choemiyang	GitHub account linked to campaign infrastructure
GitHub account	github[.]com/jeni534	GitHub account linked to campaign infrastructure
URL	pastebin[.]com/raw/gybpx38s	Pastebin-based second-stage payload delivery URL
Email	baras6600@proton[.]me	Campaign-associated email address
Email	choemiyang@hotmail[.]com	Campaign-associated email address
Email	dustinharrise91@outlook[.]com	Campaign-associated email address
Email	jackal3300@proton[.]me	Campaign-associated email address
Email	jametony8@outlook[.]com	Campaign-associated email address
Email	jamjack2026@proton[.]me	Campaign-associated email address
Email	montry111@proton[.]me	Campaign-associated email address
Email	sven5500@proton[.]me	Campaign-associated email address
Email	taini7700@outlook[.]com	Campaign-associated email address
Email	urusa4400@proton[.]m	Campaign-associated email address, recorded exactly as listed in the source

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Kimsuky Hackers Use OpenCode AI Agent to Mass-Produce Phishing Decoys in LNK Attacks appeared first on Cyber Security News.

South Korean automotive and media organizations have been hit by a quiet Linux intrusion toolkit built for long-term access.

The malware hides inside software that manages web traffic, allowing attackers to watch users, steal information, and change pages delivered through compromised servers.

The operation appears designed for patience rather than disruption. Attackers likely entered through a groupware portal or mail server, used the edge server as a bridge into internal systems.

That pattern echoes the risks described in stealthy Linux server intrusions, where hidden access can remain active without drawing attention.

Analysts at Rapid7 identified the toolkit and assessed its link to DPRK-aligned advanced persistent threats with medium confidence.

Rapid7 said in a report shared with Cyber Security News (CSN) that the activity likely dates to early 2025, although the precise initial entry point and any exploited vulnerability have not been confirmed.

The affected organizations had ports 80, 443 and 25 exposed, with a groupware login service on port 443 and mail services on port 25.

These systems sit at the network edge, making their compromise serious: an intruder can collect credentials, move deeper inside, and potentially target visitors passing through that server.

DPRK-Linked Hackers Deploy Ted Backdoor

The central component, called ted backdoor, is a modified build of HAProxy 2.8.12, software commonly used to direct website traffic.

Instead of acting like a separate malicious program, it is compiled into the legitimate load balancer and uses its built-in features to inspect decrypted web requests while normal traffic continues to flow.

That placement gives the operators unusual control. The implant can capture session cookies and selected request details, run commands, upload or download files, and inject a malicious script into pages served to chosen visitors.

Its hidden command channel uses a request for a picture-like path, while its code also reduces HAProxy connection counters to make activity harder to spot. Researchers found an SSH keylogger as well as altered versions of crond, agetty, atd, sshd and polkitd.

The stager checks the operating system and whether HAProxy or cron is present before replacing the cron service, copying timestamps from a legitimate SSH binary, and removing chosen words from logs.

This reflects the same concern raised by Linux backdoors stealing SSH credentials: trusted system components can become the attacker’s hiding place.

CurlRAT supplies the remote-control layer. It polls attacker infrastructure for tasks, can execute commands, send system details, install added payloads, and open reverse or interactive shells with elevated privileges. A watchdog monitors HAProxy and reports whether the service starts, stops, reloads, or restarts.

Long-Term Espionage Risks and Defenses

Rapid7 said the combination of credential theft, web-session collection, selective page changes, and traffic redirection points to long-term espionage.

The targeting of South Korean media and automotive firms also fits a regional intelligence-gathering pattern. Readers following Kimsuky espionage activity in Korea will recognize why exposed groupware and stolen credentials remain valuable footholds.

The operators used basic XOR encryption and a substitution method to protect configurations and communications. Their command-and-control domains imitate image delivery services, including one that resembles a popular Korean web platform’s static-content naming style.

Rapid7 also noted overlap in timing and delivery concepts with other DPRK activity, but said more evidence is needed for a firmer attribution. Defenders should review edge systems that handle web traffic, encryption, mail, or runtime modules.

They should compare deployed HAProxy and Linux service binaries against known versions, inspect unexpected shared libraries and cron changes, and rotate credentials that may have passed through affected servers. Independent network monitoring matters because logs on a compromised device may have been altered.

Teams should also investigate unusual requests to image-like paths, unexpected outbound connections from load balancers, and web responses that change only for particular visitors.

Regular patching of groupware and mail servers reduces likely entry opportunities. As shown by recent Asia-focused Linux espionage, post-compromise tools can turn a single exposed server into a durable route across an organization.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
SHA-256	5db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a91	CurlRAT stager
SHA-256	09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe	CurlRAT stager variant
SHA-256	fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ade6df06e61	CurlRAT stager variant
SHA-256	83f7d565b0465546027052b597af46eae3a199e7a91fcc2ab936341147349130	CurlRAT
SHA-256	7007a78d50a993cb174c685eba96eb442c9507e38fd9d8e5dffc712f613ec110	CurlRAT
SHA-256	6cf1b5e92a9c0756f597a5ddefb38eba32961c52efac7ab2a0aa52c639a8fc53	CurlRAT
SHA-256	ed72f4cd8d467b5c5d95ae6aeca4aaeea14d79565d379c1ca5871a714727be16	CurlRAT
SHA-256	feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3	CurlRAT
SHA-256	d53c760c23b4405eb04ad0f20ead375440344b3bdf1fb7854ed12e40d155eabe	Trojanized cronie binary
SHA-256	2f02b09d61d432134e994ad671258f523bbf289ae6091fd4eae192c60bd51b6f	Trojanized agetty binary
SHA-256	8f30b57928934ae67478d0e690c91d046e35a638da098d02922a4a88a0fdb66c	Trojanized atd binary
SHA-256	a1d8af3a6acb731f07f72040eccb3450c1c83d40e29f736c2a63d35388660be4	Trojanized polkitd binary
SHA-256	12810854c8b2c391b23e2e18b013e873d0369b0637aa3cf993136c07188ba3b8	CurlRAT sample
SHA-256	009a1e2d7a582a24e50cf2ffc2a005482c8e38f22bf5ed416053855f8d054e1e	CurlRAT sample
SHA-256	4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f5	SSH keylogger
SHA-256	94630b96f628c96a6bff7904b40ffc9ad67c86f8a4ff6080c3b524831c93f402	Ted backdoor
SHA-256	72e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e558	Modified HAProxy build containing ted backdoor
SHA-256	a8bfab4de81a1acb04aacdf757346946b0f5e30f0c9f402004016d0e425119c7	Ted backdoor sample
Domain	img.monderhouse.space	CurlRAT command-and-control infrastructure
Domain	img.smartnords.site	Command-and-control infrastructure
Domain	img.darklights.store	Backup CurlRAT configuration host
Domain	img.responsive.pstatic.autos	Command-and-control infrastructure masquerading as static content
Domain	img.socialteams.store	Command-and-control infrastructure
Domain	img.worksongo.store	Command-and-control infrastructure

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post DPRK-Linked Hackers Deploy Ted Backdoor and CurlRAT Against South Korean Firms appeared first on Cyber Security News.

Roundcube Webmail has released security updates for its 1.6 LTS and 1.7 branches, fixing 12 vulnerabilities that could expose users and servers to cross-site scripting, email header injection, cross-user data access, remote-content bypasses, and server-side request forgery attacks.

The new releases, Roundcube 1.6.19 and 1.7.4, address flaws in how the open-source webmail platform processes email content, HTML, Cascading Style Sheets, attachment metadata, contact groups, and remote URLs. Administrators running production deployments of Roundcube 1.6.x or 1.7.x are urged to update as soon as possible.

One of the most serious issues fixed is a zero-click stored cross-site scripting vulnerability involving the injection of TNEF MIME tags into attachment URLs.

TNEF, or Transport Neutral Encapsulation Format, is commonly associated with Microsoft Outlook attachments. An attacker could potentially send a specially crafted email that triggers malicious script execution when the victim views the message, without requiring the user to click a link or open an attachment.

The updates also fix another XSS issue in Roundcube’s HTML editor when handling text/enriched email content. Cross-site scripting weaknesses can allow attackers to execute JavaScript in a victim’s webmail session, creating opportunities to steal session tokens, alter mailbox settings, read messages, or perform actions as the logged-in user.

Several fixes address email header injection risks. These bugs affected the subject field, recipient display name, and an identity’s organization field.

Header injection vulnerabilities can be abused to manipulate email metadata or insert unexpected mail headers if malicious input is not correctly sanitized.

Roundcube also patched a cross-user access issue in SQL-based address books. The flaw involved adding or removing members from contact groups.

It could allow one user to modify another user’s group associations under certain conditions. This type of issue can compromise contact privacy and the integrity of address book data in shared or hosted Roundcube environments.

Remote-content protections received multiple fixes, addressing CSS declaration smuggling, HTML body background property injection, CSS-escape bypasses in FuncIRI attributes, and SVG SMIL source animation techniques that could bypass remote-content blocking.

Roundcube Webmail Patches 12 Security Flaws

The updates further fix an is_local_url() validation bypass involving fully qualified domain names with a trailing dot in stylesheet URLs. Attackers could exploit differences in URL parsing to make an external resource appear local and bypass intended restrictions.

A server-side request forgery bypass was also resolved in the Roundcube CSS proxy. The weakness involved hexadecimal IPv6-mapped IPv4 addresses, which could potentially help an attacker bypass address validation and force the server to request internal or restricted network resources.

Roundcube said full technical details are available in the release notes for versions 1.6.19 and 1.7.4. The project strongly recommends that all organizations operating affected Roundcube installations apply the updates promptly.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Roundcube Webmail Patches 12 Security Flaws, Including Zero-Click XSS and SSRF Bypass appeared first on Cyber Security News.

A counterfeit Minecraft optimisation mod is installing Myth Stealer, malware that can steal browser passwords, cookies and data. Its malicious file looks useful because features work as advertised, giving players little reason to suspect a hidden threat.

The campaign exploits users seeking performance improvements from unofficial add-ons. Once installed, the fake mod starts a multi-stage infection chain that leads to a remote tool that lets its operator collect data and broadly control a Windows device.

Analyst devmihaylov identified the malware while examining samples obtained from a buyer of the commodity stealer.

devmihaylov said in a report shared with Cyber Security News (CSN) that the files initially received zero detections from VirusTotal, showing how lightly distributed threats can evade reputation-based checks.

Minecraft players remain frequent targets for malware distributors. Coverage of fake Minecraft Fabric mods showed how a harmless-looking game download can become the first step in account theft and compromise. The threat pairs a decoy with a loader designed to blend into a gaming setup.

Fake Minecraft Mod

The Java archive presents itself as a companion to a legitimate optimisation project and includes 12 working modules that change game performance settings.

A hidden thirteenth component waits briefly, gathers system information, then retrieves and starts the next stage in the background. That approach matters because victims may see the expected optimisation behavior and conclude the download is safe.

The loader uses a large executable built around a standard runtime and brings a private Java environment, letting the payload run even where Java is not otherwise installed.

Before launching the final stage, the program displays a polished administrator-rights request resembling a normal Windows prompt.

Accepting it can give the malware greater access and helps its installation. It also contains retry logic intended to cope with security software interrupting the process.

The final component is heavily disguised to slow investigation. Its code uses reserved Windows-style names, encrypted text and obstacles that can break basic extraction tools.

This concealment, combined with an apparently genuine mod, makes a quick visual check of a download an unreliable safeguard.

Credential theft and remote control

Myth Stealer targets data stored by Chromium-based browsers and Firefox, including saved usernames, passwords, browsing records and active session cookies.

Stolen cookies can be especially damaging because they may let an attacker reuse an already authenticated web session. Readers can see why browser passwords and cookies remain valuable targets in similar data-theft operations.

The malware also collects system details, chat content, clipboard data and files, can capture screenshots or webcam material.

Its remote-control features include running commands, downloading or deleting files, managing processes and setting itself to start again after a reboot.

Researchers also found functions that could disrupt a victim. These include changing display settings, interfering with the mouse or keyboard, showing misleading full-screen messages and attempting to restrict access to security tools.

They can complicate recovery and pressure users to follow an attacker’s instructions. The operation used web-based reporting channels to receive stolen information, a technique documented in coverage of Discord webhook abuse across other malware campaigns.

Although the analysed command infrastructure was no longer responding when reported, inactive servers do not erase the risk to systems already infected.

Players should obtain mods only from trusted project pages, confirm the developer and file integrity, and avoid downloads promoted through chat links, videos or unofficial file-sharing pages.

This echoes guidance from reporting on trojanized Minecraft mod downloads, where social engineering is central to reaching players.

Anyone who installed a suspicious mod should remove it, run a full security scan and change passwords from a clean device.

They should also sign out of important accounts to invalidate sessions, review browser extensions and look for unfamiliar programs that start automatically. An unexpected administrator prompt during mod installation is a serious warning sign.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	2003869ed68eaa053f63bf6a5093050f52d520da877c017a4f62658000bba2a3	MythStealer.jar stage-one dropper
SHA-256	38789d9ac5f8cad13f510bc9d0e47809777bef913f329a9f526a11d33aeca09d	DiscordNitroGenerator.exe stage-two container
SHA-256	bd4eb81a12526daa040ceccc14135006dfd9792e7c21ec5fab9c2cb0400f6718	client.jar, Myth Stealer 3.2-FIX payload
File name	MythStealer.jar	Counterfeit Minecraft mod and stage-one dropper
File name	DiscordNitroGenerator.exe	Stage-two Node.js-based container
File path	%APPDATA%\Microsoft\Windows\javaw.exe	Dropped stage-two executable
File path	%TEMP%\webcam-<timestamp>.jpg	Webcam-capture output
File name	sqlitejdbc.dll	Native library loaded from the temporary directory
File name	jnidispatch.dll	Native library loaded from the temporary directory
URL	hxxp[://]ip-api[.]com/json/?fields=query,countryCode	Host geolocation lookup
URL	hxxps[://]www[.]dropbox[.]com/scl/fi/tvvsyk7x5kkbdfyuw7zh7/DiscordNitroGenerator	Second-stage download location
IP address	146[.]19[.]191[.]11	Command-and-control infrastructure
URL path	hxxp[://]146[.]19[.]191[.]11/s	Command server-list endpoint
URL path	hxxp[://]146[.]19[.]191[.]11/t	Telemetry endpoint
URL path	hxxp[://]146[.]19[.]191[.]11/l	Upload endpoint
URL	hxxp[://]146[.]19[.]191[.]11/api/injection	Discord injection-script endpoint
Domain	ays[.]gamepazarin[.]com	Backup command-and-control domain
URL	hxxps[://]canary[.]discord[.]com/api/webhooks/1545915606111625276/LwbwHWZBbQTP	Stage-one reporting webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291391826034944/xXOpsSG_GM0Hvf74rKbqw	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291402403942472/Let5i1nhtIG1cScI3vJmp	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291404757078189/NI-dMuvT_02i7Ee-HgX3v	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291406283935865/GIRbMQaDzYFV1qH95IxAo	Embedded exfiltration webhook
URL	hxxps[://]discord[.]com/api/webhooks/1476291406795509872/Qxjec0dl9zszu2giJYC3R	Embedded exfiltration webhook
Registry value	HKCU\...\Policies\System\DisableTaskMgr	Disables Windows Task Manager
Registry path	HKCU\Control Panel\Cursors	Used for cursor replacement
Registry path	HKCU\Software\Microsoft\ColorFiltering	Used for screen-colour inversion
Product identifier	mythkg-exe 2.21	Launcher product name and version
Build identifier	myth-gee9ute7hb	Build identifier embedded in payload
C2 keys	rawr, owo, uwu	Obfuscated server-list configuration keys

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Fake Minecraft Mod Deploys Myth Stealer RAT to Steal Browser Credentials and Cookies appeared first on Cyber Security News.

Security researchers have uncovered a significant vulnerability chain in Telerik UI for ASP.NET AJAX, allowing unauthenticated attackers to execute remote code in vulnerable enterprise web applications.

The issue primarily affects Telerik’s RadAsyncUpload component, a widely used file-upload control in ASP.NET WebForms applications.

Progress Software has indicated that the flaw impacts versions from 2010.1.309 to 2026.2.519. The vulnerability was addressed in version 2026.2.708, released as part of the 2026 Q2 SP1 update.

The vulnerability chain includes four distinct flaws: CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, and CVE-2026-13184. While these vulnerabilities are serious, their exploitation requires specific conditions and cannot be applied universally to all default Telerik deployments.

At the heart of the issue is CVE-2026-13182, a padding oracle vulnerability within RadAsyncUpload’s handling of encrypted client states. Telerik employs AES-CBC encryption to safeguard configuration data exchanged between the server and the user’s browser.

A padding oracle occurs when the application provides different error responses for invalid encrypted data. In this case, malformed data results in a distinct error compared to valid padding with invalid JSON content.

Telerik Flaw Chain

This discrepancy enables an attacker to submit modified ciphertext repeatedly, gathering information on how the application decrypts it, ultimately allowing them to recover sensitive data and forge modified encrypted values without needing the encryption key.

Even when the ASP.NET customErrors feature is enabled, researchers noted that exploitation remains possible, albeit more challenging and time-consuming through timing analysis.

Exploiting this oracle, researchers manipulated Telerik’s serializedConfiguration data, which governs settings within the upload control. This enabled attackers to alter the AllowedFileExtensions field, permitting DLL files to be uploaded.

The attack utilized a CBC forgery technique, introducing a “sacrificial” encrypted block within a JSON string. This method preserved necessary configuration from legitimate page loads, including session controls, while inserting malicious entries in the configuration.

The second critical vulnerability, CVE-2026-13181, pertains to the management of upload metadata, where Telerik resolves the .NET type name supplied via the AsyncUploadTypeName value without a proper allowlist.

If a server-side FileUploaded handler reads the UploadResult property, Telerik deserializes corrupt data into the designated type. This behavior can be exploited together with the System.Configuration.Install.AssemblyInstaller gadget, enabling the application to load an uploaded mixed-mode DLL from a temporary directory, executing native code via its DllMain entry point.

The proof-of-concept demonstrated execution of a web shell within the IIS worker process, while an in-memory variant could run commands without writing any files to disk.

To successfully exploit this vulnerability chain, attackers must access a page containing a RadAsyncUpload control with an active server-side FileUploaded event handler that reads UploadResult.

Additionally, an explicit, non-default Telerik.AsyncUpload.ConfigurationEncryptionKey must be configured for the exploitation path to function, which is recommended as a security measure.

Organizations utilizing Telerik UI for ASP.NET AJAX are urged to upgrade immediately to version 2026.2.708 or later. It is critical for administrators to identify pages using RadAsyncUpload and review their upload event handlers to monitor for potential exploitation.

Vigilance against suspicious IIS activity is also necessary, with particular attention to instances of w3wp.exe unexpectedly spawning cmd.exe, the appearance of DLL files in temporary folders, and unexpected .aspx files in web roots.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Telerik Flaw Chain Lets Unauthenticated Attackers Turn Padding Oracle Into Remote Code Execution appeared first on Cyber Security News.

The OpenVPN project has shipped version 2.7.7, a security-focused release that patches seven distinct vulnerabilities spanning the software’s core reliability layer and its Windows-specific service components.

The update, released on September 3, 2026, addresses issues ranging from denial-of-service conditions to buffer overreads and configuration bypasses that could allow attackers to run unauthorized VPN configurations.

The most broadly impactful fix, tracked as CVE-2026-84732, targets OpenVPN’s reliability layer, a component responsible for managing TLS handshakes and acknowledgment packets.

The flaw combined two separate bugs: an unbounded reliable TLS timeout and improper handling of acknowledgments for packets that could never legitimately be outstanding. Both issues were discovered by security researcher Mark Bregman of Fox-IT, and since the reliability layer is shared across all supported platforms, the fix benefits Linux, Windows, and macOS deployments alike.

Six of the seven vulnerabilities specifically affect Windows installations, reflecting how deeply OpenVPN’s Windows service architecture had accumulated edge-case weaknesses.

OpenVPN Fixes 7 Security Flaws

CVE-2026-84256 involved incorrect command-line quoting in the CreateProcess() function, where characters with special meaning to cmd.exe could, in combination with a validation script and a rogue certificate authority, lead to unexpected behavior.

A related flaw, CVE-2026-84226, affected the tapctl utility, which previously invoked netsh.exe without specifying its full file path, a gap that researchers at BreachX Zero Day Labs identified using their Typhon AI Mil v2 tooling.

Local privilege abuse was also on the table. CVE-2026-82312 stemmed from OpenVPN’s use of NULL discretionary access control lists (DACLs) on system objects, including the service exit event and the netsh.exe guard semaphore.

This design flaw enabled a local denial-of-service scenario in which one logged-in user could interfere with another user’s OpenVPN session by blocking the semaphore or triggering spurious events, though the issue applies only to setups that skip the interactive service or rely on the automatic Windows service.

Two additional Windows flaws affected openvpnserv, the Windows service component. CVE-2026-78221 caused a buffer overread when internationalized domain names using UTF-8 encoding were processed, because the NRPT domain size passed to the function was incorrect.

Separately, CVE-2026-78043 revealed that openvpnserv’s configuration path validation failed to block forward slashes, even though Windows file-open APIs treat them as valid path separators. This mismatch could let an attacker slip past administrative restrictions and force openvpn.exe to launch a configuration file it was never authorized to run.

Rounding out the list, CVE-2026-81738 fixed an off-by-one error in write_dhcp_search_str(), where specially crafted DHCP search-domain options could overflow a temporary buffer by a single byte, a bug credited to researchers Andre Kropp of Nexory and ChinhNguyen.

CVE ID	Component	Platform	Issue Type	Impact
CVE-2026-84732	Reliability layer	All platforms	Unbounded reliable TLS timeout + acking non-outstanding packets	Potential DoS via TLS handshake mishandling
CVE-2026-84256	CreateProcess()	Windows	Improper command-line quoting of cmd.exe special characters	Misbehavior when combined with validation script + rogue CA
CVE-2026-84226	tapctl utility	Windows	netsh.exe invoked without full path	Potential binary hijacking/path abuse
CVE-2026-82312	Service exit event / netsh guard semaphore	Windows	NULL DACL on system objects	Local DoS — one user can interfere with another user’s OpenVPN process
CVE-2026-78221	openvpnserv	Windows	Incorrect NRPT domain size with UTF-8 IDN domains	Buffer overread
CVE-2026-78043	openvpnserv	Windows	Config path validation doesn’t block ‘/’ separator	Bypass of admin-restricted config paths, unauthorized config execution
CVE-2026-81738	write_dhcp_search_str()	Windows	Off-by-one in temp buffer guard	Single-byte buffer overflow via crafted DHCP options

Beyond the CVE fixes, OpenVPN 2.7.7 adds a Linux-specific improvement that validates netlink replies against the originating request, an enhancement suggested by researcher Joshua Rogers.

The release also reduces the number of future keys retained under the EPOCH data-channel format from sixteen to four, easing log noise and resource usage on high-throughput links, alongside several networking bug fixes affecting TCP handshakes, UDP checksum handling, and OpenSSL’s HMAC key management.

Administrators running OpenVPN on Windows should prioritize this update given the concentration of local-privilege and configuration-bypass flaws, while all users benefit from the reliability-layer patch. The release notes and full CVE details are published on the OpenVPN Community Wiki’s security announcements page.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post OpenVPN Fixes 7 Security Flaws Affecting VPN Connections and Windows Systems appeared first on Cyber Security News.

PEEP, a malicious Chrome extension posing as Smart Bookmarks, can steal active login sessions and turn an already compromised Windows computer into a remote backdoor.

The finding shows how a browser add-on can become far more dangerous than a simple data thief when it gains a path to the operating system.

The toolkit does not appear to provide its own way into a device. Instead, attackers need prior code execution or administrative access, then silently place it in Chrome or Edge profiles.

Its installers can alter browser settings so the extension launches without the usual store checks, approval prompts, or visible warnings.

Analysts at SOCRadar identified the operation as PEEP, a Chromium-based post-compromise toolkit derived from the open-source RedExt project.

SOCRadar said in a report shared with Cyber Security News (CSN) that the researchers found a primary build disguised as Smart Bookmarks, version 1.3.0, along with a related testing variant and an exposed development repository.

The scale of confirmed victim impact remains unclear. A server status snapshot recorded 34 agent entries, 10 active sessions, and 507 data records, but test identifiers mean those figures cannot prove the number of infected devices.

Still, the design creates a serious risk because stolen session cookies may let an intruder enter accounts without needing a password again.

Malicious Chrome Extension

Once active, PEEP runs inside the browser and asks for broad access to tabs, cookies, history, bookmarks, downloads, browser settings, scripting, and every website.

It gathers browsing history, open-tab details, session cookies, form data, clipboard contents, screenshots, and local or session storage, creating a broad view of a victim’s online activity.

The session-theft capability is especially concerning because a valid cookie proves that a user has already signed in.

As explained in this guide to stolen browser cookie risks, an attacker who obtains that token may be able to reuse an active session and sidestep a later password or MFA prompt until the session is revoked.

PEEP also accepts commands to open pages, inject JavaScript, change proxy settings, and capture page content. It contacts its command server at regular intervals using unencrypted HTTP, allowing the operator to send tasks and receive collected data.

That behavior resembles other malicious browser add-on campaigns that abuse extensions to monitor sensitive activity.

The native-messaging bridge is what changes the threat from browser monitoring into host control. The browser extension can call a companion Windows program, enabling shell commands, file operations, and discovery of running processes and services under the current user account.

Persistence Raises Cleanup Challenge

PEEP uses several methods to remain in place after installation. Its scripts can forge Chrome Secure Preferences integrity values, use enterprise force-install policies, or sideload the extension.

It can also exploit a ScriptCache fallback, leaving apparently harmless source files while Chrome reloads a previously compiled malicious service worker.

That layered approach means removing the visible extension alone may not be enough. Security teams should identify the listed extension IDs, remove the associated native-messaging host and local artifacts, and review browser policies and registry entries.

The finding follows earlier cases in which a native messaging host backdoor turned Chrome into a route for device-level control.

Organizations should block the identified infrastructure, restrict traffic to the exposed services, and investigate browser processes or PowerShell activity that modifies Secure Preferences files.

Strict extension allow-lists, disabled developer mode, restrictions on external sideloading, and approval of only trusted native-messaging hosts can reduce the chance of a similar installation succeeding.

Defenders should also treat a suspected PEEP infection as both an endpoint and identity incident. Remove the malware, end active sessions, rotate affected credentials, and examine account activity for misuse.

Phishing-resistant MFA and browser protections for stored credentials add useful friction, while the recent Chrome extension supply chain attacks show why every installed add-on deserves careful ongoing review.

Indicators of compromise (IoCs):-

Type	Indicator	Description
C2 host	206.237.30.232	Hardcoded command-and-control, payload distribution, and staging host
Domain	xfjcc.fun	Reported C2 domain
Domain	new.xfjcc.fun	Reported C2-related subdomain
Domain	newadmin.xfjcc.fun	Reported C2-related subdomain
Domain	newapi.xfjcc.fun	Reported C2-related subdomain
C2 service	tcp/5001	C2 control panel and agent API service
Staging service	tcp/5002	Exposed development and payload-staging repository
C2 endpoint	/api/register	Agent registration endpoint
C2 endpoint	/api/commands?agent_id=<id>	Command polling endpoint
C2 endpoint	/api/exfil	Data-exfiltration endpoint
C2 endpoint	/api/agents/<id>/heartbeat	Agent heartbeat endpoint
C2 endpoint	/api/agents/<id>/task_result	Task-result endpoint
C2 endpoint	/api/agents/<id>/data	Observed candidate alternate data channel
C2 endpoint	/api/extension_update/<id>	Extension update endpoint
C2 endpoint	/api/extension_crx/<id>	Extension delivery endpoint
C2 endpoint	/health	Unauthenticated server status endpoint
HTTP header	X-PEEP-Agent-Key	Agent identification header
HTTP header	X-PEEP-Agent-Id	Agent identification header
HTTP authentication realm	realm="PEEP"	Control-panel HTTP Basic authentication realm
Extension ID	ejkndncpkdcjcikfhiamcdehdoegilbj	Primary Smart Bookmarks payload
Extension ID	bibjjhidpdmfcbkodddndmoejcloobdh	Alternate smoke-agent variant
Extension ID	hpjgilbbdmfcnaapjbofmmmjjfijbdki	Reported related extension identifier
Extension ID	akhljhifabhkcoboncoiekfpdodjaack	Reported related extension identifier
Extension ID	eljagiodakpnjbaceijefgmidmpmfimg	Reported related extension identifier
Native-messaging host	com.peep.lab	Native host registered for browser-to-host communication
File	nm_host.exe	Windows native-messaging host binary
File	nm_host.js	Native-host script
File	install_silent.ps1	Silent installation script
File	patch_secure_prefs.ps1	Browser preference-forgery script
File	force_enable.ps1	Extension re-registration script
File	patch_secure_prefs_linux.py	Linux preference-forgery script
File	extension.pem	Extension signing private key included in recovered packages
File	CHROME150-LIVE-RESULT.md	Development and testing log
File	background.js	Extension service-worker script
File	content.js	Extension content script
Static key	peep_nm_host_aes256_key_32bytes!	Embedded native-host encryption key
Local path	%LOCALAPPDATA%\PEEP	Local staging and artifact directory
Registry path	HKCU/HKLM\...\NativeMessagingHosts\com.peep.lab	Native-messaging host registration location
File pattern	*.bak_peep_hmac_*	Backup artifact associated with preference modification
File pattern	*.bak_peep_enable_*	Backup artifact associated with extension enabling
Distinctive string	Smart Bookmarks	Malicious extension display name
Distinctive string	PEEP Client	Internal toolkit name
Distinctive string	AI · 法客-P	C2-panel string
Distinctive string	redext-compatible	Framework-related identifier
Agent key	a6dfab5a6e510ece	Reported embedded agent key
Agent key	348e99545a69b184	Reported embedded agent key
SHA-256	86a5fb2f14d175d1c13a7b49b55b968b2a5e96afc944d85a31b3	Reported PEEP-related hash value
SHA-256	6700e30a3224248085d30f2eb727cea28dec288355fca675344	Reported PEEP-related hash value
SHA-256	9402c0198ae5c8bed14cdeaabe7e8b25625debbc62a900cfcdb	Reported PEEP-related hash value
SHA-256	8edd653910f3217c96a603e8ce9e5e409d3b8674476f22e0a3a	Reported PEEP-related hash value
SHA-256	87db7138a80117ddf2989827c1dde09ee73c7a252d511c74ed66	Reported PEEP-related hash value
SHA-256	259d8eddb6caf509d7bffa2b4c0dd7d89668800c870f529729a	Reported PEEP-related hash value
SHA-256	e46aee4ca43ba66666f6572c62365cf57642f2cf1f6eca00fcf8e	Reported PEEP-related hash value
SHA-256	f031c00f592aa5e98893b4532f743362fed7fb0a485e8a3c0ad4	Reported PEEP-related hash value
SHA-256	a43bf7f81507c8f9d0942fed331e7590a43044a6d219ec100597	Reported PEEP-related hash value
SHA-256	b4e3ca8f44477b9ade1272f92516202f83a80219c8bd6176527a	Reported PEEP-related hash value
SHA-256	8e988b915b75dd749e3f4e1ca7ee21746885b4fe34e8a246e6f1	Reported PEEP-related hash value
SHA-256	9c6b269e5087a40b4552f72e9ff13d9b39e433af5075ad68f57e	Reported PEEP-related hash value
SHA-256	207e0d47c4e5493ef7313eb1faeb1c6195923c89f263e548609a	Reported PEEP-related hash value

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Malicious Chrome Extension Can Steal Login Sessions and Turn PCs Into Remote Backdoors appeared first on Cyber Security News.

N-able has released N-central 2026.3 Hotfix 4 to fix CVE-2026-86218. This critical vulnerability could allow an unauthenticated attacker to execute code remotely on an exposed N-central server.

The update, identified as build 2026.3.1.14, was issued for on-premises N-central deployments. N-able urged self-hosted customers to install the hotfix immediately, warning that systems left unpatched remain at risk even though the company has not confirmed exploitation in production environments.

CVE-2026-86218 is a pre-authenticated remote code execution vulnerability. This means an attacker may be able to trigger the flaw without first logging in or providing valid user credentials. If successfully exploited, the issue could allow an attacker to run commands on the N-central server.

N-central is used by managed service providers and IT teams to monitor, manage, automate, and secure customer systems. Because the platform can have broad access across endpoints, networks, credentials, and administrative tools, a compromise of the central management server could create serious downstream risks.

Attackers who gain control of an N-central server could potentially use that access to deploy malicious software, alter monitoring settings, steal stored information, create unauthorized accounts, or move further into managed customer environments.

N-able Released Hotfix

The exact technical details and attack vector for CVE-2026-86218 have not been publicly disclosed. N-able said a third party responsibly reported the flaw through its security disclosure program. The vendor stated that it currently has no confirmation of active exploitation.

However, organizations should not treat the lack of known attacks as a reason to delay patching. Public patch releases can help threat actors identify vulnerable systems and develop exploit attempts.

The new release replaces N-central 2026.3 Hotfix 3, build 2026.3.1.13. Customers running versions 2025.4, 2026.1, 2026.2, 2026.3, 2026.3.1 Hotfix 1, or 2026.3.1 Hotfix 2 can upgrade directly to build 2026.3.1.14. Organizations using older releases should first move to a supported upgrade version and then apply the latest hotfix.

N-able confirmed that hosted N-central customers, also known as NCOD users, do not need to take any action because the patches have already been applied to their environments. The urgent action applies to organizations operating their own self-hosted N-central infrastructure.

The company also said administrators do not need to upgrade N-central agents specifically to address CVE-2026-86218. However, it recommended keeping agents up to date with the latest available version as a general security practice.

Security teams should identify all self-hosted N-central instances, confirm their installed build number, and schedule the update to 2026.3.1.14 as soon as possible.

Administrators should also review server access logs, administrator account activity, remote command execution records, and unusual configuration changes for signs of suspicious behavior before and after patching.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post N-able Released Hotfix for RCE Vulnerability Affecting Platform appeared first on Cyber Security News.

The cybersecurity industry is confronting a threat landscape that is changing faster than most defenders can keep track of. New data from Epoch AI shows that critical and high-severity vulnerability disclosures from major technology firms have gone vertical since the beginning of this spring, climbing from a baseline of a few hundred a month to well over 600, with critical-severity CVEs alone jumping from single digits to more than 600 in recent months.

By June 2026, twenty-one notable organizations, including Microsoft, Google, Apple, Adobe, Oracle, Cisco, and IBM, disclosed around 1,500 high- and critical-severity CVEs, more than 3.5 times the previous monthly record set before the release of Anthropic’s Claude Mythos Preview.

Critical Software Vulnerabilities Surge

That surge did not stop there; by July, disclosures reached roughly 2,500, nearly five times the pre-Mythos baseline and 60 percent above June’s already record-breaking total.

Researchers point to Anthropic’s Project Glasswing, an AI-powered vulnerability discovery initiative, as a major driver behind the spike, with the effort reportedly surfacing more than 10,000 high- or critical-severity flaws, many of which have not yet been individually disclosed.

Whether this reflects a genuine increase in exploitable weaknesses or simply a change in how vulnerabilities are found and classified remains uncertain, but analysts agree that AI-assisted discovery tools have fundamentally altered the pace at which flaws surface.

Compounding the disclosure surge is a parallel collapse in the time attackers need to weaponize new flaws. According to ZeroDayClock, the zero-day rate, meaning the share of exploited vulnerabilities attacked on or before the day of public disclosure, has climbed to nearly 87 percent, up roughly 60 percent from last year and almost quadruple the rate recorded in 2020.

The median time to exploit now sits at around one day, and some researchers project it could shrink to just one minute by next year. As recently as 2018, the median gap between disclosure and first observed exploitation stretched to 771 days; by 2023 that window had fallen to roughly six days, and by 2024 it was down to hours.

The so-called exploit survival curve, which tracks what percentage of eventually-exploited CVEs remain unexploited over time, now falls to zero within about 1.5 months of disclosure, reads the report.

In 2022, half of all exploits that would ever be weaponized were still unexploited at the 1.5-month mark, and even at three months a substantial share had gone untouched. Today, defenders effectively have no cushion once a flaw becomes public.

Security teams prepared to patch cycles measured in weeks are now operating in an environment where exploitation can begin before a fix is even available.

Ransomware operators have already adapted, with more than half of ransomware-linked CVEs in 2025 first identified through zero-day exploitation, up sharply from the prior year.

Industry analysts note that AI is reshaping both sides of the equation, accelerating offensive discovery while also promising to strengthen automated defense and detection capabilities. For now, organizations that delay patching by even a few days are increasingly likely to find that attackers got there first.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Critical Software Vulnerabilities Surge From Under 100 to More Than 600 a Month appeared first on Cyber Security News.

Endpoint detection and response (EDR) records what happens on your endpoints, detects attacker behaviour that prevention missed, and gives you the ability to investigate and contain it.

CrowdStrike leads on detection engineering and threat intelligence, SentinelOne on autonomous response, and Microsoft Defender for Endpoint on economics if you already hold E5.

But the honest question in this category isn’t which platform detects most it’s which one your team can actually operate. Here are the ten best, and how to choose without buying capability you’ll never use.

The Decision Matrix

If this describes you	Choose	Why
Mature SOC, want the best telemetry and hunting	CrowdStrike	Deepest detection engineering and intel
Small team, need automation to compensate	SentinelOne	Strongest autonomous response and rollback
Already licensed Microsoft 365 E5	Microsoft Defender for Endpoint	Included, and genuinely competitive
Want endpoint plus network and cloud in one	Palo Alto Cortex XDR	Broadest native data fusion
Generalist IT, no security specialists	Sophos	Best usability, easy MDR escalation
Server and cloud workloads dominate	Trend Micro	Strong workload and hybrid coverage
Good EDR on a mid-market budget	Bitdefender	Top detection at accessible pricing
Consolidating a broad Trellix estate	Trellix	Integrated with existing tooling
Want malicious-operation-centric detection	Cybereason	Distinctive attack-chain visualisation
Cisco networking and SecureX estate	Cisco Secure Endpoint	Native integration across Cisco security

Definitional answer: endpoint detection and response continuously records process, file, registry, and network activity on endpoints, applies behavioural analytics to identify attacker techniques, and provides investigation and containment tools isolating a host, killing a process, or rolling back changes from a central console.

What Actually Separates These Platforms

Detection quality is table stakes; analyst burden is the differentiator. Every platform here detects the common attack techniques. Where they diverge is what lands in your queue: how many alerts per hundred endpoints per week, how much correlation happens automatically, and how long it takes an analyst to go from alert to answer.

A platform that generates 40 alerts and correlates them into one incident is fundamentally different from one that generates 40 alerts.

MITRE ATT&CK Evaluations are useful and widely misrepresented. MITRE runs vendors through a simulated adversary campaign and publishes what each detected and how — with no scores, no rankings, and no winners.

Every vendor claiming to have “won MITRE” has constructed a metric to say so. Read the raw results against adversary emulation and threat hunting for the techniques relevant to your environment, note how many detections required configuration changes during testing, and ignore the marketing entirely.

Update staging is now a first-order requirement. The July 2024 CrowdStrike content update incident, which caused widespread Windows failures globally, changed how mature buyers evaluate every EDR vendor.

Ask each one: can you define rollout rings, can you delay content updates on critical systems, and what is the documented rollback procedure and its expected duration? This applies to all vendors, not one.

Retention length quietly determines investigation quality. Attackers frequently dwell for weeks. An EDR with seven days of telemetry cannot answer questions about an intrusion that began a month ago.

Retention is tiered at nearly every vendor and is one of the biggest hidden cost drivers.

How We Evaluated

Research-based comparison; no lab testing performed or claimed. We weighted detection depth and telemetry richness, response and containment capability, analyst experience and alert quality, platform coverage across Windows, macOS, Linux, and servers, and operational cost including retention tiers and managed service options.

Published evaluation results from MITRE, AV-Comparatives, and AV-TEST informed the assessment; we did not conduct our own tests.

The 10 Best EDR Solutions

1. CrowdStrike — Best Overall

The pitch: the richest endpoint telemetry in the market, paired with elite threat intelligence and a managed hunting team that finds what automation doesn’t.

Where it wins: Exceptional detection engineering with consistently strong independent evaluation results; Falcon OverWatch managed hunting is genuinely differentiated; adversary attribution turns alerts into context; lightweight single agent ranking among the best EDR security tools, extending to identity, cloud, and log management; excellent API for automation.

Where it strains: premium pricing with modular add-ons that accumulate; retention beyond the base tier costs meaningfully more; the July 2024 incident makes update-staging controls a mandatory evaluation topic.

Pricing signal: per-endpoint subscription with modular tiers; quote-based with published small-business entry pricing.

Image ALT: CrowdStrike Falcon EDR detection timeline and process tree

2. SentinelOne — Best Autonomous Response

The pitch: on-agent AI that detects, correlates, and remediates without a cloud round trip designed for teams that can’t staff a 24/7 SOC.

Where it wins: Strong autonomous containment and one-click rollback of ransomware damage on Windows; Storyline automatically assembles related events into a single narrative, which cuts investigation time sharply; connects seamlessly with threat intelligence feeds; good Windows, macOS, and Linux parity; agent functions when disconnected.

Where it strains: automated response needs careful tuning to avoid disrupting legitimate software; premium pricing; the platform has broadened considerably, so scope your licence deliberately.

Pricing signal: per-endpoint subscription in tiers with some published pricing.

Image ALT: SentinelOne Singularity Storyline attack correlation and rollback

3. Microsoft Defender for Endpoint — Best Value in an E5 Estate

The pitch: competitive EDR you may already own, with unmatched integration into the Microsoft security stack.

Where it wins: Strong independent evaluation results; deep correlation with Entra ID, Office 365, and Intune signals through Defender XDR; enforces foundational Zero Trust implementation policies; no additional agent on Windows; automated investigation and remediation reduces triage load; enormous telemetry from Microsoft’s install base.

Where it strains: full EDR requires the P2 tier or E5 — licensing confusion is the most common problem here; macOS and Linux capability trails Windows; the console rewards familiarity with Microsoft’s ecosystem and punishes the lack of it.

Pricing signal: included in Microsoft 365 E5, or standalone P1/P2; Microsoft publishes list pricing.

Image ALT: Microsoft Defender for Endpoint incident graph and device timeline

4. Palo Alto Cortex XDR — Best Native Data Fusion

The pitch: endpoint detection that correlates natively with network and cloud telemetry from the same vendor, rather than through integrations.

Where it wins: Genuine cross-source correlation reduces alert volume substantially; strong behavioural analytics; excellent for organizations already running Palo Alto firewalls; capable identity analytics; bridges the gap between endpoint security EDR vs XDR
environments.

Where it strains: delivers most value inside a Palo Alto estate; data ingestion pricing needs careful modelling; deployment and tuning require more effort than the endpoint-only platforms.

Pricing signal: per-endpoint plus data ingestion; quote-based.

Image ALT: Palo Alto Cortex XDR incident correlation across endpoint and network

5. Sophos — Best for Generalist IT Teams

The pitch: capable EDR presented in a way a non-specialist can use, with a clear path to handing it over to a managed service.

Where it wins: The most approachable console here; guided investigations help teams without threat hunting experience; synchronized security shares context with Sophos firewalls automatically; strong anti-ransomware; streamlines SOC challenges with threat intelligence; the February 2025 Secureworks acquisition adds Counter Threat Unit research depth.

Where it strains: telemetry depth and hunting flexibility trail the leaders for mature SOCs; post-acquisition portfolio positioning is a fair question to ask; retention is limited at lower tiers.

Pricing signal: per-endpoint subscription, partner-quoted with published small-business guidance.

Image ALT: Sophos Intercept X EDR guided investigation and threat case

6. Trend Micro — Best Server and Workload Coverage

The pitch: EDR that treats servers, containers, and cloud workloads as first-class citizens rather than afterthoughts.

Where it wins: Excellent coverage across physical, virtual, container, and cloud workloads; Vision One correlates endpoint with email, network, and cloud detections; integrates smoothly into centralized SOC tools and platforms; strong vulnerability research heritage; good value at platform scale.

Where it strains: the platform breadth requires careful licence scoping; console complexity reflects that breadth; endpoint-only buyers may find it over-specified.

Pricing signal: per-endpoint or per-workload credits within Vision One; quote-based.

Image ALT: Trend Micro Vision One endpoint and workload detection correlation

7. Bitdefender — Best Mid-Market Value

The pitch: detection engines that consistently test at the top, with EDR capability at pricing mid-market organizations can approve.

Where it wins: Excellent prevention reduces how much EDR work you need to do in the first place; GravityZone serves as a high-performing endpoint protection platform providing real investigation capability at accessible cost; strong ransomware remediation; broad platform coverage including virtualized environments; published pricing at lower tiers.

Where it strains: threat intelligence and managed hunting depth below the leaders; fewer large-enterprise references; investigation tooling is capable but less flexible than CrowdStrike’s query language.

Pricing signal: per-endpoint subscription with published SMB and mid-market pricing.

Image ALT: Bitdefender GravityZone EDR incident visualisation and root cause

8. Trellix — Best Within a Trellix Estate

The pitch: the combined McAfee Enterprise and FireEye endpoint technology, correlated with Trellix network, email, and sandbox detections.

Where it wins: Mature enterprise policy control and deep configurability; strong integration across the Trellix detection portfolio; informed by cyber threat intelligence (CTI); on-premises deployment available where cloud is not permitted; proven detection heritage against targeted attacks.

Where it strains: portfolio consolidation since the merger warrants a direct roadmap conversation; agent footprint heavier than cloud-natives; standalone buyers should compare carefully.

Pricing signal: per-endpoint subscription; quote-based.

Image ALT: Trellix endpoint detection and response investigation console

9. Huntress Managed EDR — Best for Managed Endpoint Security

The pitch: managed endpoint detection and response that combines EDR telemetry with 24/7 security operations, threat hunting, investigation, and human-led response, reducing the burden on internal security teams.

Where it wins: Strong fit for organizations without a fully staffed SOC; combines endpoint visibility with managed detection and response (MDR), helping analysts investigate suspicious activity and respond to threats without operating the EDR console alone.

Where it strains: Huntress is primarily a managed EDR/MDR service, rather than a direct replacement for Cybereason’s MalOp-centric attack-chain visualization. Organizations wanting extensive native XDR data fusion or highly customizable threat-hunting workflows should validate those capabilities during evaluation.

Pricing signal: per-endpoint subscription; generally subscription-based with pricing depending on the selected service and deployment.

Image ALT: Huntress Managed EDR endpoint threat detection and response

10. Cisco Secure Endpoint — Best in a Cisco Estate

The pitch: endpoint detection integrated natively with Cisco networking, email, and identity, backed by Talos intelligence.

Where it wins: Strong integration across the Cisco security portfolio and XDR; Talos threat intelligence context enriched with OSINT threat intelligence tools; retrospective detection flags files later found malicious; sensible for organizations already Cisco-standardized.

Where it strains: detection engineering trails the specialist leaders; licensing complexity typical of Cisco; console feels dated relative to newer platforms; value concentrates inside the ecosystem.

Pricing signal: per-endpoint subscription within Cisco licensing; quote-based.

Image ALT: Cisco Secure Endpoint detection with Talos threat intelligence

Full Comparison Table

Platform	Telemetry depth	Auto response	Rollback	Linux/macOS	On-prem option	Managed service	Best-fit size
CrowdStrike	Highest	Strong	Limited	Full	No	OverWatch	Mid–enterprise
SentinelOne	High	Strongest	Yes	Full	Limited	Vigilance	SMB–enterprise
Microsoft Defender	High	Strong	Partial	Good	No	Defender Experts	Any M365 estate
Palo Alto Cortex XDR	High	Strong	Partial	Full	No	Unit 42 MDR	Mid–enterprise
Sophos	Moderate	Good	Yes	Full	Limited	Sophos MDR	SMB–mid
Trend Micro	High	Good	Partial	Full	Yes	Service One	Mid–enterprise
Bitdefender	Moderate	Good	Yes	Full	Yes	Bitdefender MDR	SMB–mid
Trellix	High	Good	Partial	Full	Yes	Yes	Enterprise
Huntress Managed EDR	High	Strong	Yes	Windows, macOS, Linux	No	Core offering	SMB–mid-market
Cisco Secure Endpoint	Moderate	Good	No	Full	Limited	Cisco MDR	Cisco estates

Buyer’s Guide

Be honest about who will use it. EDR generates work. If nobody is watching the console at 2 a.m., buy a platform with strong automated response (SentinelOne, Sophos) or buy managed detection and response alongside it. An unmonitored EDR is an expensive audit log.

Model retention cost before you compare per-endpoint prices. Base tiers commonly include short telemetry retention, and extending it is where quotes diverge sharply. Decide what retention your incident response process actually requires 30 days is a common floor, 90 is safer and price that.

Run the proof of concept with real attack simulation. Use an open-source adversary emulation tool or a red team exercise, not the vendor’s demo.

Measure three things: what was detected, how many alerts it produced, and how long it took an analyst to reach a conclusion. The third number is the one that predicts your operational cost.

Test on your non-Windows estate specifically. Linux server and macOS capability varies far more between vendors than the datasheets suggest, and this is where gaps go unnoticed until an incident.

Common mistakes: buying enterprise EDR with no plan for who responds to alerts; leaving prevention features disabled during a “monitoring period” that never ends; and treating EDR as a substitute for patch management and identity controls rather than a complement to them.

Frequently Asked Questions

What is EDR?

Endpoint detection and response continuously records process, file, registry, and network activity on endpoints, applies behavioural analytics to identify attacker techniques, and provides investigation and containment tools isolating a host, killing a process, or rolling back changes from a central console. It catches attacks that prevention missed.

What is the best EDR solution in 2026?

CrowdStrike leads on telemetry depth, detection engineering, and managed hunting. SentinelOne offers the strongest autonomous response for teams without 24/7 staffing, Microsoft Defender for Endpoint the best economics for Microsoft 365 E5 organizations, and Bitdefender the best value for mid-market buyers.

What is the difference between EDR and XDR?

EDR focuses on endpoints. XDR extends the same detection and response model across endpoints, network, email, identity, and cloud, correlating signals from multiple sources into single incidents.

Most EDR vendors now sell XDR platforms with EDR as the core component, and the distinction is often about which data sources are included in your licence.

Do I need EDR if I have antivirus?

Modern business antivirus and EDR are usually the same agent at different licensing tiers. Prevention stops known and predictable threats; EDR gives you visibility and response when something gets through.

If you handle sensitive data, face compliance requirements, or would need to answer “what did the attacker access,” you need the EDR tier.

How much does EDR cost?

EDR is licensed per endpoint per year, with tiers determining telemetry retention, hunting capability, and managed services. Bitdefender and Microsoft publish list pricing; premium vendors are largely quote-based with published small-business entry pricing.

Retention length and managed service add-ons are the biggest variables between quotes.

What do MITRE ATT&CK Evaluations actually show?

MITRE runs vendors through a simulated adversary campaign and publishes exactly what each product detected and how — with no scores, rankings, or winners. Any vendor claiming to have won has invented a metric.

Read the raw results for the techniques that match your threat model, and note how many detections required configuration changes during the evaluation.

The Verdict

CrowdStrike is the strongest platform if you have analysts to use it and budget to fund it. SentinelOne is the better answer for teams who need the product to act on its own.

Microsoft Defender for Endpoint is the rational default in an E5 estate competitive, integrated, and already paid for. Bitdefender is the value pick, Sophos the most usable for generalist IT.

Before signing anything, settle two questions: who responds to alerts, and how long is your telemetry retained. Those determine whether EDR protects you or just documents what happened.

Related reading on Cyber Security News:

• Top 10 Best Extended Detection & Response (XDR) Platforms

• Top 10 Best Managed Detection & Response (MDR) Services

• Top 10 Best Antivirus (Endpoint Protection) Software for Business

• Top 10 Best Managed XDR Services

• Top 10 Best Patch Management Software

• Top 10 Best Network Detection & Response (NDR) Tools

• Top 10 Best Identity Threat Detection & Response (ITDR) Solutions

• Top 10 Best Privileged Access Management (PAM) Tools

• 10 Best Identity and Access Management Solutions

• 25 Best Managed Security Service Providers (MSSP)

• Top 10 Best Zero Trust Security Vendors

The post Top 10 Best Endpoint Detection & Response (EDR) Solutions in 2026 appeared first on Cyber Security News.

CrowdStrike has unveiled SafeMind, a family of purpose-built security models and harnesses that the company is calling the first agentic system engineered specifically for cyber defenders.

Announced at Fal.Con 2026 in Las Vegas, the launch marks a strategic pivot away from generic frontier AI models toward a dedicated offensive-defensive framework built to operate natively inside the CrowdStrike Falcon platform.

The system emerges from CrowdStrike’s newly established Cyber Superintelligence Lab and represents one of the most ambitious applications of agentic AI in enterprise security to date.

CrowdStrike Launches SafeMind

What sets SafeMind apart from conventional large language model deployments is its dual-model design. Red Tempest, the offensive component, is trained to emulate advanced AI-driven adversaries and probe for exploitable attack paths, while Blue Solano, the defensive counterpart, is built to close those gaps using battle-tested protection measures drawn from real-world incident response.

Rather than functioning as isolated tools, the two models operate inside harnesses that pit them against each other in a continuous, self-improving loop, allowing the system to sharpen its detection and remediation capabilities with every cycle.

Crucially, these harnesses are also compatible with other frontier and open-source models, giving security teams flexibility in model choice without sacrificing cost efficiency.

SafeMind’s differentiation lies heavily in its training foundation. The models were built using telemetry from CrowdStrike’s Falcon sensors, described as the largest pureplay cybersecurity dataset and edge install base in the industry, combined with threat intelligence, Falcon Complete managed detection and response annotations, and fifteen years of frontline incident response fieldwork.

This grounding in operational breach data, rather than generic internet-scale text corpora, is central to CrowdStrike’s argument that purpose-built security models outperform repurposed general-purpose AI systems in adversarial cyber scenarios.

CrowdStrike developed SafeMind in partnership with NVIDIA, using the NVIDIA Nemotron open model family as its foundation, while CoreWeave’s AI Cloud powers both training and inference workloads. NVIDIA CEO Jensen Huang framed the collaboration as part of a broader industry shift, noting that cyber defense is becoming one of the most compute-intensive applications of AI as attackers and defenders both race to scale their use of automated systems.

CrowdStrike CEO George Kurtz echoed that sentiment, stating that the future of cybersecurity “won’t be defined by AI that simply identifies threats, it will be defined by AI that defeats them”.

CrowdStrike’s internal evaluations claim SafeMind delivers a 29 percent higher detection rate than leading frontier and open-source models, along with six-times-faster end-to-end remediation and 99 percent cost savings on detection and remediation workflows.

Dr. Bartley Richardson, CrowdStrike’s chief AI and autonomous systems officer, described the launch as the foundation for the next decade of AI-driven security, emphasizing that CrowdStrike now controls the entire stack “from sensor to harness to model”.

Standalone access to SafeMind’s models and harnesses will roll out through CrowdStrike’s Project QuiltWorks program, offering trusted enterprise customers a pathway to integrate the agentic system beyond the native Falcon deployment.

As AI-enabled attacks continue to scale, SafeMind signals a broader industry move toward autonomous, closed-loop defense systems designed to act on risk rather than merely flag it, positioning CrowdStrike at the forefront of the agentic security race.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post CrowdStrike Launches SafeMind Cybersecurity’s First Agentic System Built for Defenders appeared first on Cyber Security News.

ASUS has issued an urgent security update for ASUS Control Center Enterprise (ACC) after researchers uncovered a maximum-severity vulnerability that lets remote attackers seize complete administrative control over the platform and every device it manages, without needing a password or any user interaction.

Tracked as CVE-2026-75754, the flaw carries a CVSS 4.0 score of 10.0, the highest possible rating, reflecting how easily it can be exploited over a network and the catastrophic scope of what an attacker can achieve once inside.

ASUS Control Center Vulnerability

The vulnerability actually stems from a chain of three separate weaknesses working together. ASUS Control Center is missing authentication on a critical function, meaning certain sensitive operations can be triggered by anyone who can reach the service over the network.

That gap is compounded by a server-side request forgery flaw, which lets an attacker send a specially crafted HTTP request to trick the system into exposing its own encryption key. Once that key is retrieved, a local service on the host automatically enables an SSH listener on TCP port 2222, effectively opening a hidden backdoor into the machine.

The final piece of the chain is arguably the most damaging: ASUS Control Center contains hard-coded credentials baked into the software itself. Attackers who obtain the encryption key can use these fixed credentials to log directly into the newly opened SSH port and land a full root shell, the highest level of system access available on the machine.

From there, intruders can read, modify, or delete any data stored in ACC, and because the platform is designed to centrally manage fleets of servers, PCs, and workstations, a single compromised ACC instance can hand attackers remote control over an entire corporate IT environment.

The flaw affects all versions of ASUS Control Center Enterprise up to and including 4.0.0.2. ASUS is urging every organization running the software to update immediately to version 3.1.0.9 or later, and confirms further fix details are posted on its official Security Advisory page.

Enterprises unable to patch right away should isolate ACC management interfaces from public networks, block inbound and outbound traffic on port 2222, and audit hosts for unexpected SSH listeners as an interim safeguard.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post ASUS Control Center Flaw Allows Attackers to Gain Full Admin Control of the System appeared first on Cyber Security News.

Attackers are actively exploiting an unauthenticated remote access flaw in MikroTik RouterOS, and network administrators worldwide are being urged to patch their devices immediately before compromise turns into a full network takeover.

MikroTik confirmed on September 3, 2026, that it had discovered a serious security vulnerability affecting RouterOS and had already shipped fixes across every release channel, including 7.25 beta 3, 7.24.2 stable, 7.23.4 long-term, and 6.49.21 long-term.

The vendor deliberately withheld technical specifics in its initial advisory, stating plainly that it was “not currently publishing detailed information” in order to give administrators time to update before attackers could reverse-engineer the flaw from public disclosure.

Despite that caution, exploitation began almost immediately, and forum users and researchers quickly pieced together the attack mechanics on their own.

MikroTik RouterOS Vulnerability

According to detailed discussion on the official MikroTik support forum, the vulnerability lives inside a core library used by multiple RouterOS services, meaning any exposed service built on that codebase can be leveraged as an entry point.

One forum contributor who reverse-engineered the issue confirmed it is tied to SSH and grants any unauthenticated remote attacker direct shell access to the device, regardless of whether the router relies on password authentication or SSH key-based login.

In practical terms, if the SSH service is reachable from the internet or an untrusted network, the router is vulnerable until it receives the patch, with no additional credential theft or user interaction required.

Latvia’s national CERT issued its own alert corroborating a marked increase in attacker activity specifically targeting MikroTik routers, urging organizations and home users alike to update immediately to the patched builds MikroTik released. The agency’s guidance mirrored MikroTik’s own version list, reinforcing that the fix spans both the newer 7.x stable and legacy long-term branches.

Evidence of live exploitation surfaced quickly within the MikroTik user community. One administrator reported on Reddit that around September 2, 2026, at 08:00 UTC, an unauthorized user account named “ops” was created by another rogue account labeled “0,” granted both write and policy permissions, with the intrusion traced back to an SSH connection originating from the IP address 82.192.72.4.

The administrator noted that while the rogue account appeared to be used mainly for logging in and no obvious malicious scripts were visible in the configuration, the team suspected deeper compromise that RouterOS itself could not detect, ultimately requiring a full netinstall to guarantee the devices were clean.

RouterOS now includes a built-in detection mechanism to help flag this exact scenario. After upgrading, the operating system automatically inspects the full configuration at startup and sets a device to “Flagged” status if it finds signs of unauthorized tampering, logging a critical entry in the system log.

Devices in this state face operational restrictions, including a block on enabling new scheduler entries, SOCKS proxy, PPTP, L2TP, IPsec, proxy, and SMB configurations, until an administrator performs a manual audit.

MikroTik’s guidance is straightforward: if a device shows as flagged, assume it has been compromised, audit every configuration line, rotate all passwords, and only then clear the flagged state.

Even routers that never show a flagged status should not be considered safe by default; MikroTik and independent researchers both recommend manually reviewing configurations for unrecognized users, scripts, or scheduled tasks after updating, since some compromise artifacts may not trigger the automated detection.

Restricting SSH and other management interfaces from the public internet, enforcing key-based authentication, and limiting administrative access to trusted management networks remain essential complementary defenses while the patch rolls out fleet-wide.

Given the scale of MikroTik’s install base and the confirmed low barrier to exploitation, security teams should treat this as an urgent, internet-facing remote code execution scenario rather than a routine maintenance update.

Upgrading to 7.24.2, 7.23.4, or 6.49.21 (or later), auditing every device regardless of flagged status, and hardening remote management access should be treated as immediate priorities rather than items for the next maintenance window.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Hackers Exploiting MikroTik RouterOS Vulnerability in the Wild to Gain Complete Network Access appeared first on Cyber Security News.

Zero Trust Network Access (ZTNA) anchors 2026 cybersecurity amid remote, cloud, and hybrid booms. ZTNA solutions aren’t hype—they’re vital for data locks, compliance wins, and borderless teams.

“Never trust, always verify”: ZTNA okays only vetted users/devices, location-blind. Shrink attack planes, block lateral creeps, master app gates.

Market clutter and threat flux complicate picks. We rank 2026’s top 10: specs, perks, real impacts dissected.Prioritizing usability, relevance for CISOs, IT pros, scaling firms.

CISO, manager, or tech enthusiast find your Zero Trust match. Per-tool: intros, tables, specs, buy drivers, features—your 2026 blueprint.

Comparison Table: Top 10 ZTNA Solutions (2026)

Tool Name (with Homepage)	Free Version	Cloud Support	MFA	Device Posture Check	SSO
OpenVPN Cloud Connexa	Yes	Yes	Yes	Yes	Yes
Zscaler Private Access	No	Yes	Yes	Yes	Yes
Palo Alto Prisma Access	No	Yes	Yes	Yes	Yes
Cloudflare Zero Trust	Yes	Yes	Yes	Yes	Yes
Google BeyondCorp Enterprise	No	Yes	Yes	Yes	Yes
NordLayer ZTNA	Yes	Yes	Yes	Yes	Yes
Ivanti Neurons ZTNA	No	Yes	Yes	Yes	Yes
Appgate SDP	No	Yes	Yes	Yes	Yes
Twingate	No	Yes	Yes	Yes	Yes
Fortinet FortiClient ZTNA	Yes	Yes	Yes	Yes	Yes

1. OpenVPN Cloud Connexa

Best for: Small and mid-sized businesses that want Zero Trust Network Access without an enterprise budget or a bundled security suite.

OpenVPN’s CloudConnexa is a cloud-delivered ZTNA for SMB platform built on the open-source OpenVPN protocol. Rather than shipping ZTNA as one module inside a sprawling security stack, CloudConnexa combines identity-based, least-privilege application access with a globally distributed Wide-area Private Cloud (WPC) that links remote users, on-premises sites, and AWS, Azure, and GCP networks in a single service.

Users and private resources connect through encrypted outbound tunnels to CloudConnexa Regions, while Access Groups decide exactly which applications, hosts, and networks each user can reach. Because Connectors only establish outbound tunnels, private applications never require open inbound firewall ports or direct exposure to the public internet.

OpenVPN’s network security platforms provide secure remote access through both self-hosted and cloud-delivered VPN solutions for business, with the core tenets of Zero Trust Network Access at their center. Alongside the self-hosted Access Server, CloudConnexa helps teams securely reach company resources, SaaS platforms, the web, and data across cloud environments.

Why Do We Recommend It?

• ZTNA without the suite lock-in. You can add Zero Trust access on its own, without committing to a full security platform, complex contracts, or opaque enterprise pricing.
• Access control plus private networking in one service. Granular Zero Trust application access and a globally distributed WPC come together, so remote users, cloud VPCs/VNets, on-premises networks, and branch sites connect through the same fabric.
• Outbound-only Connector architecture. Connectors open encrypted outbound tunnels, keeping private applications off the public internet with no inbound port forwarding.
• Layered contextual access decisions. SAML SSO/MFA is combined with Device Posture, Location Context, and Device Identity Verification & Enforcement (DIVE) for context-aware policy enforcement.
• Integrated threat protection. Cyber Shield adds DNS-based domain/content filtering and IDS/IPS traffic inspection within the same service rather than limiting the platform to access control alone.
• Application domain-based routing and segmentation. Traffic can be routed by application domain, environments with overlapping IP ranges are supported, and networks are automatically segmented to limit lateral movement.

Key Features

1. Identity-based, least-privilege access – Access Groups restrict users to only the applications, IP services, hosts, and networks they are authorized to use, with a default-deny model under Custom WPC topology.
2. Device Posture Checking – Evaluates operating system and OS version, antivirus status, disk encryption, client certificate validity, and more, and can block noncompliant devices.
3. SAML SSO and MFA – Integrates with SAML 2.0 identity providers such as Microsoft Entra ID, Okta, OneLogin, Google Workspace, and Keycloak; built-in TOTP 2FA is available for username/password and LDAP authentication.
4. Device Identity (DIVE) – Adds device-level identity verification and enforcement to every access decision.
5. Location Context – Applies geographic and location-based conditions to access policies.
6. Cyber Shield – DNS-based domain/content filtering plus IDS/IPS detection and blocking of malware, intrusion activity, and denial-of-service traffic, with policies based on threat category or severity.
7. SCIM 2.0 provisioning – Automated user and group provisioning with documented examples for Okta, Microsoft Entra ID, JumpCloud, and OneLogin, alongside private LDAP support for directory-based authentication and group mapping.

Deployment and Platform Support

• Delivery model: Cloud-delivered ZTNA service built around a globally distributed WPC with CloudConnexa Regions.
• Deployment options: Cloud, on-premises, and hybrid. Connectors (or IPsec where applicable) link AWS VPCs, Azure VNets, GCP VPCs, and on-premises networks into the WPC.
• Supported devices: Windows, macOS, iOS, and Android via OpenVPN Connect; Linux via the supported open-source OpenVPN client.
• Integrations: SAML SSO, SCIM 2.0, private LDAP, APIs and session data for external monitoring and security workflows, and device-posture checks for several EDR/antivirus products.

Primary Use Cases

• Secure remote and hybrid-work access for employees and contractors without exposing the underlying network.
• Secure access to cloud applications and workloads across AWS, Azure, GCP, and other environments.
• Hybrid and multi-cloud connectivity between on-premises sites, private networks, cloud networks, and remote users.
• Application-level access and network segmentation to reduce lateral movement.
• Context-aware access for managed endpoints using Device Posture, DIVE, and Location Context.
• Threat-protected private access with Cyber Shield DNS filtering and IDS/IPS.

Who Is It Best Suited For?

CloudConnexa is designed for small and medium-sized businesses that want scalable Zero Trust security without significant infrastructure or management overhead, but it also supports larger organizations with distributed, hybrid, or multi-cloud environments.

It is particularly relevant for technology, professional services, healthcare, financial services, retail, and other regulated or distributed organizations that need secure remote access, segmentation, and auditability. Its audit logs support compliance requirements such as GDPR, HIPAA, and PCI-DSS.

Comparison Table

Capability	CloudConnexa
Free version or trial	Yes – 14-day free trial, plus an always-free Starter plan (up to 5 seats, with some limitations)
Cloud deployment	Yes – Connect AWS VPCs, Azure VNets, and GCP VPCs via Connectors or IPsec
Multi-factor authentication	Yes – Built-in TOTP 2FA, or MFA via SAML IdPs (Microsoft Entra ID, Okta, OneLogin)
Device-posture checking	Yes – OS/version, antivirus, disk encryption, client certificate validation, and more
Single sign-on	Yes – SAML 2.0

Pricing

CloudConnexa uses seat-based pricing, where each activated user or Connector consumes a seat.

Plan	Price
Starter	Free (up to 5 seats)
Essential	$7 per seat/month
Premium	$9.50 per seat/month
Enterprise & IoT	Custom pricing based on requirements and volume

Full details: CloudConnexa pricing

Pros and Cons

What Is Good?

• Standalone ZTNA with transparent, seat-based pricing and no suite lock-in.
• Combines Zero Trust access, private networking, and threat protection in one service.
• Outbound-only Connectors eliminate open inbound firewall ports.
• Broad identity support: SAML SSO, SCIM 2.0, LDAP, and built-in TOTP 2FA.
• Free Starter plan and 14-day trial make evaluation low-risk.

What Could Be Better?

• End-user access relies on the OpenVPN Connect client (open-source OpenVPN client on Linux); there is no agentless, browser-only option.
• Device Posture checks vary by operating system and client, so organizations should confirm their required endpoint controls are supported.
• Built-in TOTP 2FA applies to native and LDAP authentication only; with SAML SSO, MFA is handled by the identity provider.
• ZTNA is delivered as part of a broader WPC/private-networking model, which may not suit buyers looking solely for an application-proxy-style ZTNA product.
• Some advanced capabilities depend on subscription tier, so buyers should verify current plan entitlements.

Verdict

For SMBs that want to adopt Zero Trust principles without buying an entire security suite, OpenVPN CloudConnexa offers one of the most accessible paths available. It pairs granular, identity-driven access control with hybrid and multi-cloud connectivity, layers on device and location context, and includes Cyber Shield threat protection, all under straightforward seat-based pricing that starts free.

Website: OpenVPN Cloud Connexa

2. Zscaler Private Access

Zscaler Private Access (ZPA) is a cloud-native ZTNA platform that connects users directly to applications without exposing the network.

It continuously verifies user and device context, enforcing dynamic policies based on identity, device posture, and location.

ZPA eliminates the need for traditional VPNs, reducing the risk of lateral movement and simplifying secure access.

Zscaler’s architecture supports high scalability, making it ideal for organizations with a distributed workforce.

The platform offers seamless integration with identity providers, endpoint security, and threat intelligence solutions.

Specifications

• ZTNA Type: Cloud-native
• Deployment: SaaS
• Supported Devices: Windows, macOS, Linux, Mobile
• Policy Controls: Identity-based, Dynamic
• Threat Prevention: Inline SSL inspection, Real-time

Reason to Buy

• Direct-to-app access without network exposure
• Continuous verification of user and device context
• Seamless integration with IAM and endpoint solutions
• High scalability for global organizations

Features

• Application segmentation and least-privilege enforcement
• Inline SSL inspection and advanced threat prevention
• Continuous monitoring and policy adjustment
• Supports hybrid and multi-cloud environments

Best For: Large organizations needing cloud-native, scalable Zero Trust access.

3. Palo Alto Prisma Access

Palo Alto Prisma Access delivers a comprehensive ZTNA solution as part of its SASE platform.

It secures remote and on-site users with consistent policies, advanced threat prevention, and real-time visibility into network traffic.

Prisma Access supports hybrid workforces and integrates with cloud, SaaS, and on-premises applications.

The platform offers autonomous digital experience management (ADEM), giving IT teams insights and remediation capabilities for end-user connectivity and security issues.

Its ZTNA 2.0 approach addresses modern attack surfaces and operational complexity.

Specifications

• ZTNA Version: 2.0
• Deployment: Cloud, Hybrid
• Employee Size: Scalable for enterprises
• Integration: SIEM, IAM, EDR
• Policy Management: Centralized, Autonomous

Reason to Buy

• Advanced threat prevention and policy enforcement
• Autonomous experience management for end-users
• Consistent security across cloud, SaaS, and on-premises
• Scalable for large, distributed organizations

Features

• ZTNA 2.0 for hybrid work and direct-to-app architectures
• Real-time traffic visibility and autonomous remediation
• Application and data protection with microsegmentation
• Integration with advanced analytics and threat intelligence

Best For: Enterprises seeking advanced, autonomous Zero Trust with SASE integration.

4. Cloudflare Zero Trust

Cloudflare Zero Trust provides secure, fast, and reliable access to internal applications without a VPN.

Its platform is designed for ease of deployment and management, supporting identity-based policies, device posture checks, and robust threat intelligence.

Cloudflare’s global network ensures low latency and high availability.

The solution integrates with major identity providers, supports multi-factor authentication, and offers a free tier for small teams.

Cloudflare’s unified dashboard simplifies policy management and monitoring.

Specifications

• Free Version: Yes
• Deployment: Cloud
• Supported Devices: Windows, macOS, Linux, Mobile
• Integration: SSO, IAM, EDR
• Pricing: Starts at $7/user/month

Reason to Buy

• Rapid deployment and easy management
• Global network for low-latency access
• Free tier for small teams and startups
• Strong integration with identity and endpoint security

Features

• Identity-based access controls and device posture checks
• Real-time threat intelligence and monitoring
• Multi-factor authentication and SSO support
• Unified dashboard for policy and user management

Best For: Organizations needing fast, easy-to-manage Zero Trust with global reach.

5. Google BeyondCorp Enterprise

Google BeyondCorp Enterprise brings Zero Trust to the cloud, enabling secure access to applications from any device, anywhere.

The platform leverages Google’s robust infrastructure, offering identity-aware proxies, device security checks, and continuous monitoring.

BeyondCorp supports granular access policies and integrates with Google Workspace and third-party identity providers.

The solution is suitable for organizations embracing cloud-first strategies and seeking seamless integration with Google services.

Specifications

• Free Version: Yes
• Deployment: Cloud-native
• Supported Devices: Any (browser-based)
• Integration: Google Workspace, SSO, IAM
• Policy Controls: Granular, Identity-based

Reason to Buy

• Seamless integration with Google cloud services
• Browser-based access for any device
• Continuous monitoring and device security checks
• Granular, identity-aware access policies

Features

• Identity-aware proxy for secure application access
• Real-time device posture and risk assessment
• Integration with Google Workspace and third-party IAM
• Scalable for organizations of any size

Best For: Organizations leveraging Google Cloud and Workspace for Zero Trust.

6. NordLayer ZTNA

NordLayer ZTNA is designed for businesses looking for easy-to-use, scalable Zero Trust solutions.

The platform offers centralized management, multi-factor authentication, and device posture checks, with support for cloud and on-premises environments.

NordLayer’s intuitive interface and affordable pricing make it accessible for SMBs and enterprises alike.

NordLayer integrates with major identity providers and supports secure remote access for distributed teams.

Specifications

• Pricing: Starts at $11/user/month
• Deployment: Cloud, On-premises
• Supported Devices: Windows, macOS, Linux, Mobile
• Integration: SSO, MFA, IAM
• Management: Centralized

Reason to Buy

• Affordable and scalable for all business sizes
• Easy deployment and intuitive management
• Strong authentication and device security
• Supports remote and hybrid workforces

Features

• Centralized dashboard for user and policy management
• Multi-factor authentication and device posture checks
• Integration with identity providers and cloud platforms
• Real-time monitoring and reporting

Best For: SMBs and enterprises needing affordable, easy-to-manage Zero Trust.

7. Ivanti Neurons ZTNA

Ivanti Neurons ZTNA focuses on secure remote access and user experience, supporting a wide range of devices and operating systems.

The platform emphasizes compliance and detailed reporting, making it suitable for regulated industries and organizations with diverse device fleets.

Ivanti’s solution integrates with existing security infrastructure, providing centralized management, policy enforcement, and real-time monitoring.

Specifications

• Deployment: Cloud, On-premises
• Supported Devices: Windows, macOS, iOS, Android
• Compliance: Detailed reporting and auditing
• Integration: IAM, EDR, SIEM
• Policy Management: Centralized

Reason to Buy

• Comprehensive remote access for all device types
• Strong compliance and reporting capabilities
• Integration with existing security tools
• Centralized management and policy enforcement

Features

• Secure access for hybrid and remote workforces
• Detailed compliance and audit reporting
• Real-time monitoring and threat detection
• Flexible deployment and integration options

Best For: Organizations with diverse devices and strict compliance needs.

8. Appgate SDP

Appgate SDP delivers identity-centric ZTNA using a software-defined perimeter model.

It evaluates user and device context before establishing encrypted, one-to-one network connections.

The platform supports dynamic entitlements, real-time decisioning, and integration with SIEM, IAM, and EDR tools.

Appgate is designed for hybrid and multi-cloud deployments, offering granular policy controls and comprehensive visibility into network activity.

Specifications

• ZTNA Model: Software-defined perimeter
• Deployment: Cloud, On-premises, Hybrid
• Integration: SIEM, IAM, EDR
• Policy Controls: Identity and context-based
• Encryption: End-to-end

Reason to Buy

• Identity-centric access with dynamic policies
• Support for hybrid and multi-cloud environments
• Real-time monitoring and decision making
• Comprehensive integration with security tools

Features

• Encrypted, one-to-one network connections
• Dynamic entitlements and policy enforcement
• Real-time visibility into user and device activity
• Scalable for complex enterprise environments

Best For: Enterprises requiring granular, identity-driven Zero Trust in hybrid environments.

9. Twingate

Twingate offers a modern, cloud-native ZTNA solution that replaces traditional VPNs with identity-based, per-application access controls.

It is designed for rapid deployment, requiring no changes to network infrastructure. Twingate integrates with SSO, MFA, and endpoint security, providing granular access policies and robust encryption.

The platform is suitable for both hybrid and cloud environments, with a user-friendly interface and support for Windows, macOS, Linux, and mobile devices.

Specifications

• Free Version: Yes
• Deployment: Cloud-native
• Supported Devices: Windows, macOS, Linux, Mobile
• Integration: SSO, MFA, EDR
• Pricing: Starts at $5/user/month

Reason to Buy

• Easy, rapid deployment with minimal configuration
• Granular, identity-based access controls
• Strong encryption and device authentication
• Flexible for hybrid and multi-cloud environments

Features

• Per-application access and least-privilege enforcement
• Seamless integration with identity and endpoint solutions
• Traffic encryption and compliance-ready auditing
• Cross-platform support for diverse teams

Best For: Teams seeking a fast, flexible, and user-friendly ZTNA alternative to VPNs.

10. Fortinet FortiClient ZTNA

Fortinet FortiClient ZTNA integrates endpoint security with Zero Trust access, providing protection for devices and network resources.

Its zero trust agent supports multi-factor authentication, device posture checks, and split-tunneling for optimized user experience.

Centralized management via EMS or FortiClient Cloud enables streamlined deployment and real-time endpoint status.

FortiClient is ideal for organizations already invested in the Fortinet Security Fabric, offering seamless integration with FortiGate firewalls and FortiSandbox.

Specifications

• ZTNA Agent: Yes
• Deployment: Cloud, On-premises
• Integration: Fortinet Security Fabric
• Central Management: EMS, FortiClient Cloud
• Web Filtering: Yes

Reason to Buy

• Deep integration with Fortinet ecosystem
• Centralized management and reporting
• Advanced endpoint and network protection
• Supports split-tunneling and web filtering

Features

• Multi-factor authentication and device posture checks
• Real-time endpoint monitoring and upgrades
• Centralized logging for compliance and security analysis
• Flexible deployment options for diverse environments

Best For: Organizations using Fortinet products seeking integrated Zero Trust.

Conclusion

ZTNA has surged essential amid remote shifts, cloud leaps, and threat twists.

Reviewed platforms from Check Point’s all-in-one guard to Google’s BeyondCorp cloud magic scale Zero Trust to fit any operation.

Vet choices by size, regs, stack synergy, and expansion horizon. Prime picks lock data/apps while unleashing anywhere-productivity.

ZTNA transcends upgrades: it’s resilience, compliance, and transformation fuel. Navigate to 2026’s best with this roadmap forge a tougher, sharper, nimbler enterprise.

The post 10 Best ZTNA Solutions (Zero Trust Network Access) In 2026 appeared first on Cyber Security News.

A newly discovered zero-day vulnerability in Magento Open Source and Adobe Commerce is being actively exploited by attackers to seize full control of online stores, and there is still no official patch available.

Dutch e-commerce security firm Sansec disclosed the flaw, dubbed StyleSmuggler, on September 5, 2026, warning that unauthenticated attackers can achieve remote code execution on vulnerable installations and that live attacks began the previous day .

The company said it was publishing its findings early, before completing its full technical analysis, “because stores are being compromised right now”.

StyleSmuggler affects every current version of Magento and Adobe Commerce, including the latest 2.4.9 release, and requires no authentication whatsoever to exploit.

Sansec reproduced the complete unauthenticated attack chain on clean installations of Magento Open Source 2.4.7, 2.4.8, and 2.4.9, confirming the bug is not tied to any single outdated build.

Disturbingly, the first identified victim was running 2.4.6-p15 with July and August 2026 security patches fully applied, meaning fully patched stores were compromised just as easily as neglected ones.

As of September 6, Adobe has not issued an advisory, assigned a CVE identifier, or released any official fix or workaround, and the company’s most recent Commerce security bulletin still dates to August 11.

The exploit unfolds in two distinct stages that abuse Magento’s own template rendering and email systems rather than a single obvious injection point. In the first stage, attackers plant malicious PHP code inside a file that Magento itself writes during normal operation, such as a payment failure report, by manipulating “styles” properties within a GraphQL request to slip past existing input sanitization.

Magento and Adobe Commerce 0-Day RCE

Independent analysis from Magento hosting firm Disrex Group, which handled two breached stores, found that a crafted directive inside the injected text forces a chain of Magento’s own classes to execute code that was only ever meant to run through the command-line dependency-injection compiler, ultimately including the attacker-poisoned log file.

The second stage triggers execution. Sansec found that StyleSmuggler deliberately causes Magento to send its standard “Payment Transaction Failed Reminder” email, and the poisoned code runs the moment Magento renders that message internally, meaning nobody has to open or even receive the email for the attack to succeed.

Once triggered, a PHP dropper cycles through six different PHP functions until it finds one capable of spawning a process, then downloads and launches a persistent implant. Disrex described the malware as a small, statically linked Rust binary of roughly 1.9 megabytes, compiled for both x86-64 and ARM64 architectures, disguised as a Linux kernel thread named “[kworker/u:8:0]” and restarted every five minutes through a cron entry written directly into the crontab spool file to avoid leaving normal system logs.

Detecting an infection is harder than it sounds because the malware actively evades naive checks. A genuine Linux kernel worker thread is owned by root and consumes no resident memory, so any bracketed “[kworker]” process running under a website’s own user account with real memory usage is a red flag.

Disrex also discovered that the binary running in memory sometimes differs from the file sitting on disk, meaning defenders should hash both the file and the live process to be thorough.

On one compromised store, the implant made no outbound internet connections at all, instead opening 28 simultaneous connections to the site’s own Redis instance to read live Magento session data, which let it operate almost invisibly to network-based monitoring.

Sansec’s own detection guidance searches Magento’s var/report directory for a marker string, but Disrex found both of its breached stores were actually poisoned through var/log/system.log instead, meaning administrators need to check both locations.

With Adobe’s next scheduled security release set for September 8 and no confirmation it will address this flaw, store owners are left relying on stopgap measures. Sansec recommends temporarily disabling GraphQL entirely for stores that don’t rely on headless or progressive web app storefronts, since classic and Hyvä themes generally don’t need it.

Disrex, security researcher ProxiBlue, and vendor Graycore have each independently published unofficial code patches that guard specific Magento classes and email template functions, though all three stress these are hardening measures rather than a genuine fix, and Disrex specifically warns its rules only block the current attack traffic pattern, not the underlying vulnerability.

Server-level protections that don’t depend on understanding the exploit chain at all, such as disabling PHP’s proc_open function and mounting temporary directories with noexec, have also proven effective at stopping the dropper from launching its payload.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Hackers Actively Exploiting Magento and Adobe Commerce 0-Day RCE Vulnerability appeared first on Cyber Security News.

Microsoft is investigating an ongoing issue causing some Windows users to face significant delays or outright failures when launching the Microsoft Teams desktop client.

The company acknowledged the problem, tracked internally as TM1466820, and confirmed it remains unresolved as engineers continue digging through service logs to find a root cause.

According to Microsoft’s incident notice, affected users encounter trouble specifically during the first launch of Teams on a Windows device. Some cannot load the client at all, while others experience delays stretching up to two minutes before the app becomes usable.

For an application many organizations rely on for daily communication, even a two-minute hang at startup can disrupt morning routines, delay meeting joins, and frustrate employees trying to check urgent messages.

Microsoft has classified the issue’s scope as affecting “some users” within impacted organizations, particularly those opening Teams to view new messages. The company noted that impact varies across tenants, meaning not every organization or every user within an affected organization will necessarily notice the slowdown.

While a permanent fix is being developed, Microsoft has recommended workarounds to keep productivity moving. Affected users can switch to Microsoft Teams on the web through a browser, or use the Teams mobile app, both of which reportedly remain unaffected by the desktop client’s loading problem. These alternatives don’t fix the underlying issue but let employees stay connected until Microsoft rolls out a resolution.

In its most recent update, posted at 8:41 AM on September 4, 2026, Microsoft said its analysis of service logs and telemetry data has so far been “inconclusive.” Engineers have not yet pinpointed why the desktop client is struggling to load on some Windows machines.

Microsoft Teams Desktop Client Fails

To move the investigation forward, Microsoft is reaching out directly to a subset of impacted users, requesting client-side logs from their devices. The company expects these logs will help isolate the underlying trigger and clarify what remediation options are viable.

This is not the only Teams-related disruption Microsoft has grappled with recently. Earlier in the year, a regression in the Teams client’s build-caching system caused similar launch failures, which Microsoft resolved by reverting a faulty service update.

Separately, Windows 11 users on ARM-based devices, such as Surface Pro and Surface Laptop models, have faced Teams and Outlook launch failures tied to an August security update, an issue Microsoft has since mitigated through a Microsoft Store update.

For now, IT administrators managing Windows fleets should monitor the Microsoft 365 admin center’s service health dashboard for updates on TM1466820 and consider proactively informing staff about the web and mobile workarounds.

Microsoft has not provided an estimated resolution timeline, but its outreach for client logs suggests the investigation is entering a more targeted, evidence-gathering phase rather than a quick patch rollout.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Microsoft Teams Desktop Client Fails to Load on Windows System – Microsoft Investigating appeared first on Cyber Security News.

A human attacker armed with frontier artificial intelligence models breached an enterprise network and seized root credentials in under 10 hours, a timeline that would normally take human red teams roughly two weeks to complete, according to a new incident response report from Palo Alto Networks’ Unit 42.

The threat actor told Unit 42 investigators during ransom negotiations that they relied on frontier AI models paired with attack-specific agentic AI frameworks to automate the intrusion.

Rather than manually executing each stage of the attack, the operator directed AI agents to monitor, evaluate, act, and re-plan in real time, compressing more than 50 distinct MITRE ATT&CK techniques into a single automated loop.

Unit 42 noted that the attack did not rely on a zero-day exploit or unusually sophisticated tradecraft, but instead achieved its speed and scale purely through AI-assisted operational efficiency.

AI Agents Breach Company Network

Once the agents gained initial access by breaching a publicly accessible web service, they tunneled into the network and deployed an automated reconnaissance agent to map internal microservices.

From there, sub-agents combed through enterprise code repositories, harvesting hard-coded tokens and service passwords. The attacker then used those exposed tokens to infiltrate the organization’s secrets management system, extracting master administrative credentials that granted root-level access across the environment.

The agents did not stop at credential theft. They hijacked the company’s CI/CD pipeline through custom workflows to exfiltrate cloud access keys and attempted to plant backdoors inside Terraform infrastructure-as-code configurations, an effort that was ultimately blocked by branch-protection controls.

Using the stolen cloud keys, the attacker also seized control of the victim’s AI infrastructure, repurposing the company’s own compute resources to support future stages of the attack.

Unit 42 identified several telltale signs of AI-driven operations, including parallel calls to multiple large language models, structured Markdown files used to pass information between agent sessions, and custom scripts bearing UI elements consistent with AI-generated code.

In an unusual twist, the attacker also directed the agents to compile an 80-page technical audit of the victim’s security weaknesses, effectively automating a full penetration-testing report as leverage.

Researchers warned that adversaries are increasingly likely to fold autonomous AI agents into their toolkits, since the technology helps establish redundant persistence across SSH keys, cloud identities, and CI/CD pipelines simultaneously.

To counter machine-speed attacks, Unit 42 recommends that organizations deploy synchronized containment playbooks that can instantly revoke credentials and freeze pipelines, treat AI models and API keys as core infrastructure requiring strict governance, and enforce mandatory multi-party code review on infrastructure-as-code repositories to block automated backdoor injection.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post AI Agents Breach Company Network in Under 10 Hours and Steal Root Credentials appeared first on Cyber Security News.

Microsoft has introduced Project Zenith, a new developer-optimized Windows 11 experience built for a class of high-memory PCs capable of running large AI models directly on-device, marking a significant shift away from cloud-dependent AI development workflows.

Announced as a follow-up to commitments made at Build 2026, Project Zenith targets developer-class hardware equipped with at least 64 GB of unified memory and memory bandwidth exceeding 250 GB per second.

That hardware profile allows developers to run AI models with more than 30 billion parameters locally and without usage metering, reducing reliance on cloud-based token consumption during experimentation and coding tasks.

The first devices supporting Project Zenith will ship with AMD’s Ryzen AI Halo platform, with additional OEM and silicon partners expected to join in the coming months.

Rather than being a separate product, Project Zenith is a preconfigured Windows setup layered on top of ongoing baseline improvements Microsoft has been rolling out to Windows 11 throughout the year, including refinements to Search, File Explorer, and system memory efficiency. Devices running Project Zenith inherit these performance gains while adding a development-first configuration out of the box.

That configuration includes Windows Terminal and Visual Studio Code pinned to the taskbar by default, along with pre-tuned settings across File Explorer, Search, Start, and the taskbar.

File Explorer ships with file extensions, hidden files, full title-bar paths, and long-path support enabled, while distractions such as recently used file suggestions and sync provider prompts are switched off. Search and Start come with Command Palette enabled and notification clutter minimized, aiming for what Microsoft describes as a calmer, distraction-free workspace.

Windows Subsystem for Linux also plays a central role in the initiative. Building on last year’s open-sourcing of WSL, Microsoft has integrated WSL containers, giving developers a native way to build, run, and manage Linux containers without leaving Windows.

From a security and platform-architecture standpoint, Project Zenith devices are designed to support agentic development workloads using Microsoft’s Execution Containers (MXC), which combine OS-enforced identity controls with containment and enterprise-grade manageability for AI agents.

Microsoft frames this as essential groundwork for a computing era where autonomous agents increasingly write, test, and execute code, arguing that a secure, isolated foundation is necessary before agentic workflows can be trusted at scale in professional environments.

Microsoft positions the initiative as an economic and architectural shift in how AI-assisted development happens: offloading capable models to local hardware for routine tasks while reserving frontier cloud models for harder problems.

The company says Project Zenith is an evolving effort shaped directly by developer feedback, with hardware variety expected across OEM partners even as the core “ready-to-code” promise stays consistent.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Microsoft Unveils Project Zenith Windows PCs That Can Run 30B+ AI Models Locally appeared first on Cyber Security News.

A financially motivated threat group known as Toy Ghouls has begun using two custom Windows backdoors that communicate through popular messaging and broker services.

The tools give attackers a discreet way to run commands, collect system details, and maintain control over compromised devices.

The campaign marks a change for the group, which had previously relied heavily on public tools and leaked ransomware builders.

Its move to custom malware suggests a broader effort to stay inside victim networks longer while making activity harder for security teams to spot.

Analysts at Securelist identified the malware in early July 2026 and linked it to Toy Ghouls, also tracked as Bearlyfy, Laboo.boo, and Feral Wolf. The group has targeted Russian organizations since 2025 and has previously been associated with its own GenieLocker ransomware.

The new backdoors are called mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0. They are delivered after attackers gain access to an organization, showing how a small initial breach can develop into a persistent and serious compromise.

Kaspersky said in a report shared with Cyber Security News (CSN) that the tools provide full control over an infected Windows device.

Hackers Use Popular Messaging Services

Toy Ghouls uses Windows Remote Management, or WinRM, to place the backdoors and their configuration files on already compromised systems.

The attackers use Evil-WinRM and WinRM-fs, tools that can help move files and run remote commands across Windows environments.

WinRM is widely used for legitimate administration, which can make malicious use difficult to identify without close monitoring.

Organizations have faced similar risks from Windows Remote Management abuse, where attackers use valid access and remote sessions to move deeper into a network. The HiveMQ version uses the public broker.hivemq.com MQTT service as its command-and-control channel.

It reports whether a device is online, sends information such as processor usage and free memory, and retrieves instructions that are then run through a hidden PowerShell process.

Using a broker service allows attackers to blend malicious traffic with normal internet activity. The approach resembles an earlier MQTT command channel used by WailingCrab, demonstrating why familiar cloud and messaging infrastructure can complicate network investigations.

The second version uses an attacker-controlled Element server based on the Matrix protocol. It sends device status messages to a designated room, receives commands from an account called panel-bot, and executes those instructions through the Windows command line.

Both variants can run interactively or install themselves as Windows services, allowing them to start again after a reboot. This persistence method makes the infection more dangerous because an attacker may regain access even after the original remote session has ended.

Persistence and Defensive Response

The malware stores its settings in a config.toml file before protecting sensitive fields with encryption tied to the infected computer.

On the Element variant, the file is deleted after first use and the information is moved into the Windows registry, reducing the number of obvious artifacts left on disk.

Security teams should review WinRM access, limit it to approved management systems, and investigate unusual remote PowerShell activity.

They should also watch for unexpected services named cplsupport or wtas, suspicious configuration files in ProgramData folders, and outbound traffic involving the listed messaging infrastructure.

Administrators should treat remote-management credentials as high-value assets and enforce strong authentication for privileged accounts.

Recent incidents involving the Teams and Quick Assist campaign show how social engineering and trusted Windows tools can be combined to create a path toward wider network access.

The discovery also reinforces the value of checking for quiet backdoor behavior, rather than looking only for known ransomware activity.

A recent Windows backdoor investigation similarly highlighted how attackers can minimize visible network signals while waiting for instructions.

Toy Ghouls’ use of MQTT and Element does not mean the services themselves are malicious. Instead, the case shows how threat actors can misuse legitimate or common technology to hide command traffic, gather system data, and keep control of compromised Windows systems for longer periods.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File name	cplsupport.exe	HiveMQ-based backdoor executable
MD5 hash	BFADBEEE63A4F0BF19EC9DEB8FA58F58	Hash associated with cplsupport.exe
File name	wtass.exe	Element-based backdoor executable
MD5 hash	7916C33688385525078BEE504C90F359	Hash associated with wtass.exe
File name	config.toml	Backdoor configuration file
Registry key	HKLM\Software\synapse\Config\SealedConfig	Stores sealed Element backdoor configuration
Registry key	HKLM\Software\SynapseAgent\metrics_interval	Stores Element variant metrics reporting interval
Service name	cplsupport (Problem Reports Control Panel)	Service used by the HiveMQ variant
Service name	wtas (Windows Telemetry Aggregator Service)	Service used by the Element variant
Domain	broker.hivemq.com	Legitimate MQTT broker abused for command-and-control communications
Domain	ip-api.com	Legitimate service queried to identify the victim system’s public IP address and country
Domain	meet.element[.]tw	Attacker-controlled Element server used for command-and-control

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Popular Messaging Services to Control New Windows Backdoors appeared first on Cyber Security News.

NodeStealer has returned with a more invasive toolkit. The Python-based information stealer can now record keystrokes, watch copied text, and capture victims’ screens, turning an account-stealing infection into continuous surveillance.

The change raises the stakes for people whose browsers hold work, banking, or social-media access. First tracked in 2023, NodeStealer initially focused on sensitive browser data and Facebook accounts.

It later widened its interest to Facebook Ads Manager accounts and payment-card information. The latest activity mainly affected victims in Asia and North America, with financial services the leading sector, but the campaign crossed several industries.

Netskope researchers identified the upgraded variant in August 2026 and said it adds spyware functions alongside the earlier theft features.

Netskope said in a report shared with Cyber Security News (CSN) that the researchers also found signs that some new code may have been produced with AI assistance.

The report does not identify a confirmed initial delivery method, so organizations should avoid assuming a single infection route.

What is clear is the malware’s objective after execution: collect enough credentials, session data, personal details, and screen content to support fraud, impersonation, or follow-on account takeover.

NodeStealer Can Now Record Everything Victims Type

The most worrying addition is a keylogger that uses Python’s pynput library to monitor keyboard input.

It saves captured text in a temporary file, sends it to the primary Telegram command-and-control channel every 120 seconds, and then clears the file’s contents. The logging is designed to continue indefinitely.

That can expose passwords, search terms, customer data, private messages, and other information that users enter manually. Clipboard monitoring fills a similar gap by collecting plain text copied and pasted into the device.

Readers following Snake Keylogger’s capture techniques will recognize how this combination gives criminals visibility beyond saved browser credentials.

NodeStealer also takes a screenshot when it runs and another before its screenshot function finishes, transmitting both images through Telegram.

A screen capture can reveal data that may never reach the clipboard or keyboard, including dashboards, recovery codes, open documents, and active conversations.

The separation of stolen material across two Telegram bots may also make disruption harder. One bot receives an archive of browser credentials, passwords, and cookie databases, while the other receives Facebook-specific data.

This approach resembles other Telegram bot driven malware operations that abuse legitimate messaging infrastructure for attacker communications.

Facebook Data Theft Expands

The newest samples query more than 20 Facebook Graph API endpoints, up from two in previous versions.

Rather than only checking an account, the malware seeks a detailed picture of the person managing it, covering identity details, contacts, interests, posts, pages, advertising assets, business records, integrations, and login-related data. For companies that run advertising campaigns, the impact can extend beyond one employee’s profile.

Access to business and Ads Manager information could help attackers run unauthorized ads, steal budgets, target colleagues, or make convincing social-engineering approaches. The risk mirrors Facebook advertising account theft reported in other malware campaigns.

Analysts noted an apparent AI-assisted element in the new functions: repeated, similarly structured calls marked with decorative emoji labels, a pattern absent from earlier NodeStealer code.

That observation is not proof of a particular tool or author, but it suggests attackers may be accelerating routine feature development.

The malware is also distributed as compiled Python bytecode with altered header fields, apparently intended to obscure its compilation timeline and possibly interfere with automated analysis.

Security teams should ensure that inspection workflows examine Python bytecode even when its metadata looks incomplete or misleading.

Defenders should treat unusual Python-based files, unexpected browser-data access, persistent keystroke collection, and Telegram-bound archives as high-priority signals.

Reduce exposure by limiting administrator access, keeping browsers and endpoint protections updated, reviewing active sessions, and warning staff not to run untrusted attachments or downloads. Recent phishing-delivered VIP Keylogger campaigns show why these basics still matter.

People responsible for Facebook business accounts should use strong multi-factor authentication, review connected apps, and watch for unfamiliar advertising changes.

Since cookies and session data can be valuable to attackers, prompt session revocation and credential resets are important after a suspected infection.

These steps cannot undo stolen screenshots, but they can limit further account abuse and reduce the chance of costly misuse.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File name pattern	keylog({ip}).txt	Temporary keystroke-log filename pattern used by the NodeStealer keylogger, with the victim IP value inserted into the name.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post NodeStealer Can Now Record Everything Victims Type and Steal Their Screenshots appeared first on Cyber Security News.