A new open-core project called ARES is giving red teams a way to run planned, controlled attack tests against Active Directory and cloud systems. A developer who goes by Mafifrizi released the tool on GitHub.

It ships with 66 active modules, with 70 cataloged in total, covering more than 60 techniques mapped to MITRE ATT&CK. It is aimed at enterprise red teams, managed security providers (MSSPs), and security operations centers.

Mafifrizi publishes the project as an open-core platform, which means the base tool is free to read and test while a sponsorship page supports ongoing work.

The project page lists the repository under the handle “mafifrizi/ares” and describes it as an autonomous red-team engagement platform with MITRE ATT&CK module orchestration, attack-path solving, and reporting. The README does not give a real name, company, or team behind the code, so readers should treat it as an independent project for now.

The author’s pitch is simple. Traditional penetration tests cost a lot, happen rarely, and only show one moment in time, so new misconfigurations can sit unseen for months.

Vulnerability scanners add to the problem by listing thousands of possible CVEs without proving that any of them can be used. ARES tries to fill that gap by running real test steps and showing which ones lead to the most valuable systems, such as domain admin accounts.

The part of ARES that stands out most is how hard it tries to keep tests inside approved limits. Before a module runs, a check called ScopeGuard confirms the target is in scope.

A second layer, the Scope Firewall and Egress Filter, then blocks traffic at two levels. One level uses the operating system firewall, which is Windows Defender Firewall or Linux Netfilter when the tool runs with elevated rights. The other watches network calls inside Python itself. The goal is a “fail-closed” design, where the tool stops instead of sending traffic to an address nobody approved.

The tool also profiles how noisy each action is, so operators can pick quieter steps when they want to test whether the blue team notices. This matters because a careless test can knock over a production server. For the same reason, security teams are shifting toward tools that put a person in charge of each decision.

Active Directory Attack Paths

For Active Directory, ARES can load BloodHound collections or map live domain sessions. Its built-in graph engine then works out the shortest route to Domain Admin, points out chokepoints, and checks whether a sideways move is possible.

BloodHound uses the same graph idea, where a small group membership can open a path that is many steps long. Cyber Security News has explained how BloodHound Community Edition maps these paths across Active Directory and Azure.

Operators can set a goal such as domain_admin, full_compromise, or cloud_audit. The planning engine then builds a multi-step plan from graph rules. It can also use AI agents such as Claude, OpenAI, or a local Ollama model, but only after the operator gives clear permission.

The same planning engine covers cloud checks, and the cloud_audit goal is one of the built-in options. Letting a language model suggest next steps is now common in offensive tools. Cyber Security News recently reported on Decepticon, an open-source agent with 16 specialist roles. ARES keeps the AI optional, which many teams will prefer.

Defenders have a reason to watch this space. Criminals are using similar tools. Cyber Security News covered how hackers used the ARTEX AI agents to map Windows networks, steal service account passwords, and try to spread inside the network. A platform like ARES lets defenders test the same steps first, on their own terms.

Because ARES stores sensitive material, the author added several protections. Sessions live in the database, access tokens are short-lived and kept in memory, and refresh tokens are rotated. ARES stores harvested hashes and client evidence in a local vault protected with AES-256-GCM and PBKDF2-HMAC-SHA256 at 600,000 rounds.

When a test ends, ARES can produce branded reports in PDF, HTML, Markdown, and JSON. The PDF step runs through a headless browser, so it needs no extra GTK libraries on Windows or Linux. For teams that want a deeper guide to the Active Directory side, the Active Directory attack checklist on Cyber Security News is a useful companion.

Only run ARES on systems you own or have written permission to test. Start in a lab, check that the scope rules block out-of-range addresses, and review the code before using it on real networks. Fix any path the tool finds to a domain admin account, then run it again to confirm the fix.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post ARES AI Red Team Platform Automates 66 Attack Modules for Active Directory and Cloud Security Testing appeared first on Cyber Security News.

Kali Linux 2026.3 has been released as the third Kali update of 2026, bringing six new penetration testing tools, Linux kernel 7.1.5, KDE Plasma 6.7, refreshed image-building scripts, and a large set of Kali NetHunter changes. The release arrived on October 26 with 126 package updates and moves the kernel from version 6.19 to 7.1.5.

The update follows June’s Kali Linux 2026.2 release, which added nine tools, changed Kali’s APT source format, and improved virtual machine boot times. It also continues the tool and mobile testing work seen in Kali Linux 2026.1, the first major Kali update of the year.

Six New Penetration Testing Tools

The six new tools are available from Kali’s network repositories. Dalfox is an open-source cross-site scripting scanner built for automation and parameter checks.

Katana is a crawling and spidering framework that can help researchers map web applications and find paths, files, and endpoints before deeper testing.

Qsreplace takes URLs from standard input and replaces query string values with a chosen value, which makes it useful for preparing URL lists for repeatable web tests.

Rustscan is a fast port scanner written in Rust. It can scan large port ranges and pass discovered ports to Nmap for deeper service checks. SDRangel is a Qt-based software-defined radio front end that supports devices such as RTL-SDR, BladeRF, and HackRF, giving wireless researchers a visual tool for receiving, sending, and studying radio signals.

Tool	Main purpose	Key use
Dalfox	Automated XSS scanner	Finds and verifies cross-site scripting flaws by testing web parameters.
Katana	Web crawling and spidering	Maps websites, parses JavaScript, finds endpoints, and supports standard or headless crawling.
Qsreplace	Query-string replacement	Reads URLs from standard input and replaces their query values for repeatable web security tests.
Rustscan	Fast network port scanner	Finds open ports quickly and can pass the results to Nmap for deeper checks.
SDRangel	Software-defined radio interface	Provides a graphical front end for radio devices such as RTL-SDR, BladeRF, and HackRF.
Snaffler-ng	SMB data scanner	Searches readable Windows SMB shares for exposed credentials and sensitive files.

Snaffler-ng searches readable Windows SMB shares for credentials and sensitive data. It supports NTLM and Kerberos sign-in, DFS discovery, archive checks, built-in classification rules, SQLite resume support, and several output formats.

These additions cover web discovery, XSS testing, URL processing, port scanning, radio research, and file-share review. Like any security tool, they should only be used on systems that the tester owns or has clear permission to assess.

Linux Kernel 7.1.5 and Package Updates

Kali 2026.3 contains 126 package updates and moves the main Kali kernel from 6.19 to 7.1.5. Kali’s package tracker lists 7.1.5-1kali1 for the rolling branch, confirming the kernel used by the new release.

The newer kernel matters because it provides the base for hardware support, drivers, system calls, and security fixes used by the rest of the distribution. Users should still test wireless adapters, graphics drivers, virtualization tools, and any custom kernel modules before relying on the update during live security work.

One of the largest changes is the refresh of Kali’s public build scripts. These are the same scripts the project uses to create the official images offered through its download site. The refreshed scripts now have a more consistent structure, layout, command-line options, features, and output across supported platforms.

Each refreshed project includes a build-in-container.sh script. It detects whether Docker or Podman is present, creates a build container, and runs the image build inside that container. This removes the earlier need to build Kali on a Kali system and makes the process easier to repeat on other Debian-based hosts. Kali has also improved its related build documentation.

Users who want to build a standard installer can clone the kali-installer build repository, install the required packages, and run sudo ./build.sh. The default command creates a Kali rolling installer for AMD64. Builders can change the hostname, add packages such as Rustscan, select kali-dev, choose a netinst image, or target ARM64 through command-line options. Podman users can instead install Podman and run sudo ./build-in-container.sh.

The work is not finished. Kali says some build scripts did not make the 2026.3 deadline, and the remaining refresh is planned for Kali 2026.4. Later stages are expected to focus on automated builds, workflows, example setups, and deeper customization. Teams with CI jobs based on the older scripts should review their pipelines because changes made during the refresh may have broken older workflows.

KDE Plasma 6.7 and New Icons

The optional KDE desktop has been updated to Plasma 6.7. A key feature is per-screen virtual desktops, which lets users change the workspace on one monitor without changing every display.

This can be useful when keeping Burp Suite on one screen, terminals on another, and notes or documentation on a third. Plasma’s Overview also supports faster desktop switching by scrolling or using Page Up and Page Down.

KDE Plasma 6.7 adds more Wayland protocol and portal support, better performance and lower power use for integrated Intel graphics, CPU-rendered applications, and setups with many full-screen windows. Network connections can be duplicated, while System Monitor, software management, printing, background application display, microphone testing, and desktop search controls also receive changes.

KDE has added a light and dark theme switch, improved Breeze, restored the Oxygen and Air styles, and introduced an early preview of its Union theming system.

Kali has also added icons to tools that did not have them and updated older icons so applications are easier to identify in the menu and on the Kali tools website. Xfce remains Kali’s default desktop even though KDE received the main desktop version change in this release.

Major Kali NetHunter Changes

Kali NetHunter, the project’s Android and wearable security testing platform, receives some of the release’s most unusual changes. The team addressed compatibility problems between modern systemd and udev components and older mobile kernels without requiring large sets of patches.

Wardriving is now supported on the TicWatch Pro 3 series. An updated libnexmonkali library enables internal Wi-Fi monitor mode on the watch, allowing compatible tools inside the Kali chroot, including Aircrack-ng and Kismet, to work with the watch’s wireless hardware. Kali’s TicWatch guide says all Pro 3 GPS, LTE, Ultra GPS, and Ultra LTE variants are supported, though installation requires bootloader, recovery, operating system, root, and NetHunter changes.

WearHunter is a new experimental feature that lets a user control a NetHunter watch from a phone through ADB over Wi-Fi or Bluetooth. It can run commands and install applications, with more functions planned. NFC Arsenal now provides NFC access to the Kali chroot and can read, clone, and edit Mifare Classic cards without an external adapter. The release also adds KernelSU support, allowing a generated installer ZIP to be installed through the KernelSU application when used with a patched kernel.

Other NetHunter work includes a fix for TicWatch Pro 3 reboot problems and early support for devices that do not use a ramdisk. Bluetooth Arsenal’s airplane mode has returned. EvilTwin and Wardriving are easier to start, while custom commands now support Nexmon monitor mode and Wifite. Kali also fixed a crash caused by the NetHunter application’s storage request and delivered other bug fixes and speed improvements.

Nine new device kernels were added. They cover Google Pixel on LineageOS 22.2 with Android 15, Huawei P9 on EMUI 8 or LineageOS 16, LG K20 Plus on LineageOS 14.1, Moto G Stylus 5G 2022 on LineageOS 23.2, Nubia Z17 on LineageOS 22.2, POCO X5 5G and Redmi Note 12 5G on crDroid 12, Redmi Note 5 Pro on LineageOS 18.1, Sony Xperia 10 V on LineageOS 23.2, and Ulefone Armor 34+ on Android 16.

The release announcement also highlighted the Wardriver Project, a 2021 Honda Civic Type R shown at the Cars and Cops event in Altus, Oklahoma. The project was used to show how vehicle culture, wireless research, and cybersecurity can meet in a single build.

Website and Documentation Updates

Kali has applied the category layout and icons introduced in its desktop menu to kali.org/tools. Users who prefer the older short view can still open the Top 100 tools page.

The documentation set gains three new pages. They explain how to extract and squash vendor firmware for mainline Linux, import a pre-made Kali QEMU virtual machine, and use NetHunter EvilTwin.

Nine existing guides were updated, covering Live USB persistence, graphics problems on bare-metal systems, NetHunter on the TicWatch Pro 3, Kali as a UTM guest, the Xfce FAQ, Kali NetHunter, Raspberry Pi full-disk encryption, setting up a Kali mirror, and SSH configuration.

The release cycle also added four European mirrors. Two are in the Netherlands at mirror.hacker.nl and mirror.netone.nl. Portugal gained mirror.randhost.com, while Switzerland gained kalimirror.velden.media. Kali’s mirror system can direct users to a nearby current server, but its documentation warns against adding extra repositories to the Kali source configuration because mixing repositories can break an installation.

Kali also thanked community members who worked on documentation, tool pages, NetHunter, and package maintenance. The long contributor list reflects how much of the mobile kernel, device, documentation, and packaging work comes from outside contributors rather than only the core Kali team.

Downloading and Upgrading Kali 2026.3

New users can obtain tested installer, live, virtual machine, ARM, cloud, container, and NetHunter images from the official Kali download page. Kali recommends the latest point-release image for most users. Weekly images contain newer packages and can reduce the number of updates needed after installation, but they are automated and do not receive the same quality checks as standard point-release images.

Existing rolling users should first confirm that /etc/apt/sources.list.d/kali.sources points to the official kali-rolling repository with the main, contrib, non-free, and non-free-firmware components. They can then run sudo apt update followed by sudo apt full-upgrade -y. If the system marks a reboot as required, users should restart before checking the result.

The installed release can be checked with grep VERSION /etc/os-release, which should show 2026.3. The active kernel can be checked with uname -r, with the AMD64 release example showing 7.1.5+kali-amd64. The exact kernel string can differ by architecture.

Kali’s update guidance recommends checking for updates every few days or weeks, or sooner when a required tool or security fix is released. It also advises testing all needed tools before a planned security engagement and avoiding updates during active work because a rolling package change can sometimes break a tool at the wrong time

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Kali Linux 2026.3 Released With 6 New Penetration Testing Tools and Linux Kernel 7.1 appeared first on Cyber Security News.

REA, short for Reverse Engineer Anything, connects AI coding agents such as Claude Code and Cursor to tools that inspect software without its source code.

The open-source project brings Ghidra, IDA Pro, and Hopper into an agent-driven workflow, helping researchers trace program behavior and explain findings with supporting evidence.

Rather than replacing a disassembler, REA acts as a bridge between the agent and analysis tools. Its scope extends beyond native binaries to JavaScript, Electron applications, .NET assemblies, Android packages, firmware, websites, and selected runtime activity. The same workflows are also available through terminal commands for researchers who prefer scripting.

REA Connects Agents to Reverse Engineering Tools

REA uses Model Context Protocol, or MCP, to let agents request analysis through a local server. The agent asks tools to inspect a target, follows relevant code, and receives findings with evidence and stated limits. It can then ask further questions or write and test an implementation based on those findings.

For native binaries, REA returns pseudocode, assembly instructions, strings, symbols, function calls, and references. These results help researchers connect a visible feature to the code behind it. Deep native analysis requires an existing Ghidra, IDA, or Hopper installation, although setup can install Hopper with approval.

This approach builds on the role of tools covered in Cyber Security News’s Ghidra reverse engineering coverage. REA adds an agent interface to that analysis process, rather than making the underlying code inspection unnecessary.

For JavaScript and Electron targets, the tool maps modules, imports, source maps, routes, and communication between application processes. Static .NET inspection exposes metadata, intermediate language instructions, and declared native dependencies. Neither workflow needs a native analysis engine.

Users can start with npx rea-agents setup after installing a supported Node.js version and npm. Setup asks them to choose agents, review changes, and approve registration. It installs matching workflow instructions, backs up existing configuration, and requires an agent restart afterward.

Supported setup options include Claude Code, Cursor, Codex, Gemini CLI, and Grok Build. Other clients that support local MCP servers can use manual registration. The official REA repository provides installation details and notes that platform support depends on the chosen analysis provider.

The project’s examples show what evidence based reconstruction can look like. In its DX-Ball case study, a recovered sound positioning calculation passed 3,205 tests against the original x86 code and reproduced all 63 compiled function bytes. Another example traces Notion’s clipboard handling through Electron’s renderer, preload layer, and main process.

These are project-reported demonstrations, not proof that every target can be fully reconstructed. They complement earlier reporting on AI assisted XLoader malware analysis, where researchers combined model output with runtime checks.

REA analyzes targets locally, but the agent receives its results. Those results remain subject to the model provider’s data policy, so local execution does not mean all findings stay on the machine.

Static JavaScript and .NET inspection reads files without running the application. Runtime capture, however, launches or interacts with targets using the user’s permissions. Researchers handling suspicious software should distinguish these modes before starting an investigation.

Despite its name, REA has target, platform, and dependency limits. Its value lies in connecting questions to inspectable code and testable findings, while keeping evidence, authorization, and human review central to the work.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC

The post REA Tool Connects Claude Code and Cursor to Ghidra and IDA Pro to Reverse Engineer Anything appeared first on Cyber Security News.

Anthropic has introduced OSS Scanner, a free service that checks critical open-source repositories for security vulnerabilities and sends findings directly to project maintainers.

The opt-in program uses the company’s strongest AI models to run repeated scans, giving developers a faster route to potential flaws without waiting for human review.

According to Anthropic’s service overview, OSS Scanner builds on its work with Project Glasswing. The company says it had reviewed more than 6,000 vulnerability reports by October 2026 through its existing disclosure process. The new service offers a separate path for projects willing to assess AI-generated reports.

Anthropic OSS Scanner

According to the GitHub repository, the scanner first builds an enrolled project inside an isolated virtual machine with network access enabled. This stage installs dependencies and prepares the software for testing.

Anthropic then removes Internet access before the security audit begins, allowing scanning agents to examine the project within a restricted environment.

Reports arrive by email with steps to reproduce the suspected issue and a proposed patch where available. Anthropic says its pipeline includes agents that double-check bugs and examine their root causes.

However, these checks are automated. A human does not review the findings before maintainers receive them. After the first scan, the service checks projects again for newly introduced vulnerabilities and issues missed earlier. Scan frequency depends on factors such as demand and project usage.

This extends Anthropic’s wider push into security research, including earlier work in which Claude uncovered 22 Firefox vulnerabilities.

Core maintainers apply through the official GitHub repository by opening a pull request that adds a directory under projects/<name>. Each submission needs a project.yaml configuration containing the repository address and a primary contact email. Anthropic manually checks that applicants are core maintainers before accepting a project.

Eligibility focuses on established projects with broad use, exposure to remote attacks, and significant infrastructure security impact.

A Dockerfile must explain how to install dependencies and build the software. Developers can keep it in their own repository or beside project.yaml in the enrollment repository. Everything needed for building and testing must be downloaded during setup because the later audit cannot access the Internet.

An optional threat_model.md file helps guide the scan. Maintainers can describe where untrusted input enters, which components are outside scope, and how they rate severity.

They can also explain preferred report formats and patch requirements, reducing the need for the scanner to guess project-specific security expectations.

Before applying, developers can use tools/validate.py to check their configuration and tools/check <name> to test the build. The checking tool runs with network access, so Anthropic warns users to test only trusted projects or use a separate machine.

Configuration email addresses are public, making a dedicated security alias useful. Maintainers can add an OpenPGP public key for encrypted reports, but encrypted messages go only to the primary contact and cannot include additional recipients.

Anthropic does not impose a 90-day disclosure deadline on unvalidated findings. However, a report later confirmed through its human-reviewed program may enter that disclosure process.

This safeguard matters amid concerns about AI-generated vulnerability reports wasting maintainers’ time. Project owners still need to reproduce suspected flaws and test suggested fixes before treating them as confirmed vulnerabilities. Reports can be paused with disabled: true, while deleting the enrollment directory withdraws the project entirely

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC

The post New Anthropic OSS Scanner Tool to Scan Open-source Repositories for Vulnerabilities appeared first on Cyber Security News.