Find what you’re looking for
Browse everything
6,838 results in Threat Reports
AgentCorruption: How One AI Prompt Nearly Broke AWS Security
In December 2025, Zenity Labs discovered 'AgentCorruption,' a critical vulnerability in AWS Bedrock AgentCore that allowed attackers to compromise entire AWS environments through a single malicious prompt to AI agents. The flaw exploited AWS Instance Metadata Services (IMDS) access within Firecracker MicroVMs, enabling lateral movement across all AgentCore resources in affected regions. Attackers could obtain temporary credentials, invoke additional agents, access secrets from AWS Secrets Manager, and poison agent memory through overprivileged default roles and insufficient network isolation. This incident highlights the growing security risks as organizations rapidly deploy AI agents in cloud environments without proper isolation controls. The vulnerability demonstrates how AI and cloud security intersect, creating new attack vectors that traditional security measures may not adequately address.
The New Threat Vector: How Cybercriminals Target Executive Families to Breach Corporate Networks
Cybercriminals are increasingly targeting executives' family members and personal contacts as a pathway to corporate networks, exploiting the weaker security postures of non-technical household members. Research shows that 51% of organizations reported attacks on business leaders in 2025, with 39% of executives having already compromised devices during security onboarding. Attackers leverage AI-enhanced reconnaissance to map family relationships through social media, then execute impersonation attacks, device compromises, and sophisticated phishing campaigns targeting spouses, children, and trusted associates. The consequences extend beyond digital breach to physical surveillance, extortion, and fraudulent financial transfers. This trend represents a critical evolution in social engineering tactics, where the weakest link in an executive's personal ecosystem becomes the entry point for enterprise compromise, demanding immediate expansion of security awareness programs beyond corporate boundaries.
Social Engineering AI Agents: The Evolution of Business Email Compromise
As artificial intelligence agents become increasingly integrated into business operations with elevated system privileges, cybercriminals are developing sophisticated social engineering techniques to manipulate these autonomous systems. Unlike traditional business email compromise (BEC) attacks that target human decision-makers, threat actors are now crafting attacks specifically designed to exploit AI agents' logical processes and decision trees. These attacks leverage prompt injection techniques, context manipulation, and adversarial inputs to trick AI systems into executing unauthorized transactions, data transfers, or administrative actions. The financial and operational impact mirrors traditional BEC schemes but with potentially greater scale and automation capabilities. This emerging threat vector represents a critical evolution in social engineering as organizations rapidly deploy AI agents for financial transactions, supply chain management, and customer service operations without adequate security controls.
FBI Takes Down Flax Typhoon: Major Win Against China's Critical Infrastructure Campaign
In October 2024, the FBI and Department of Justice disrupted the China-linked advanced persistent threat group Flax Typhoon by seizing seven domains used to scan and infiltrate U.S. critical infrastructure. The operation blocked access to command and control platforms that the threat actors had been using to maintain persistent access to compromised systems across energy, telecommunications, and transportation sectors. This coordinated law enforcement action represents a significant disruption to an ongoing espionage campaign targeting critical infrastructure organizations. The Flax Typhoon campaign highlights the increasing focus of state-sponsored actors on critical infrastructure targets and demonstrates the growing collaboration between cybersecurity agencies and law enforcement to proactively disrupt threat operations before they can cause significant damage.
Critical Citrix NetScaler SAML Vulnerability Exposes Identity Infrastructure to RCE Attacks
Citrix disclosed CVE-2026-107406, a critical memory overflow vulnerability in NetScaler ADC and NetScaler Gateway with a CVSS score of 9.5. The flaw affects systems configured as SAML identity providers or service providers, potentially enabling remote code execution or denial-of-service attacks. The vulnerability was discovered by security researchers from JPMorgan Chase and affects multiple NetScaler versions, with patches now available across affected product lines. This incident underscores the ongoing security challenges facing identity infrastructure as organizations increasingly rely on SAML-based authentication systems for cloud and hybrid environments.
Three Teams Crack Google Pixel 10 Security at Pwn2Own Ireland 2026
At Pwn2Own Ireland 2026 on October 8, three security research teams successfully demonstrated remote exploits against fully patched Google Pixel 10 devices, earning a combined $562,500 in prizes. Ikotas Labs claimed the top $300,000 prize by chaining multiple vulnerabilities, while Xint and a third team led by Dimitrios Valsamaras also achieved successful remote code execution. The exploits targeted various attack vectors including web browsers and wireless protocols (NFC, Wi-Fi, Bluetooth, baseband), with two of the three exploits utilizing previously known but unpatched vulnerabilities. This incident highlights the persistent vulnerability landscape in mobile devices and the effectiveness of coordinated security research in uncovering critical flaws. The high success rate at Pwn2Own Ireland 2026, with 51 of 63 scheduled attempts succeeding across multiple device categories, underscores the ongoing challenges in securing consumer technology platforms.
GoBalance Flaw Exposes Critical Weakness in Dark Web Infrastructure Security
A critical vulnerability in GoBalance, a load balancer used by dark web sites, allowed attackers to hijack .onion addresses by recovering private keys from public descriptors. The flaw occurred because GoBalance only used the first 32 bytes of Tor's 64-byte private keys during signing, exposing the secret values. Between October 5-7, 2026, this vulnerability was exploited to take over major dark web forums including Dread, redirecting users to attacker-controlled sites. While server access and user data remained secure, the compromised addresses could be used indefinitely for phishing and credential harvesting attacks. This incident highlights the growing sophistication of attacks targeting anonymity networks and the critical importance of proper cryptographic implementation. As organizations increasingly rely on privacy-preserving technologies and zero-trust architectures, vulnerabilities in foundational security tools pose significant risks to operational continuity and user trust.
Flax Typhoon Exploits Five Critical Flaws as CISA Sets Federal Compliance Deadline
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five security vulnerabilities to its Known Exploited Vulnerabilities catalog following active exploitation by the China-linked threat actor Flax Typhoon. The vulnerabilities span multiple systems including ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND, with CVSS scores ranging from 7.2 to 10.0. The attacks were facilitated by China-based cybersecurity company Integrity Technology Group, targeting organizations through scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers to establish persistence and exfiltrate sensitive data including emails and credentials. This incident highlights the escalating threat from state-sponsored actors positioning themselves within critical infrastructure networks, including operational technology systems, with the strategic intent to disrupt critical functions at predetermined times. The coordinated international response from seven nations underscores the global recognition of this persistent threat landscape.
AhsayCBS Zero-Day Exploitation: When Backup Security Becomes a Cryptojacking Gateway
In October 2026, threat actors exploited two critical vulnerabilities in AhsayCBS backup utility (CVE-2026-105133 and CVE-2026-105134) to deploy XMRig cryptocurrency miners disguised as Microsoft Edge processes. The attackers chained an authentication bypass flaw with a command injection vulnerability to achieve remote code execution on affected systems. Exploitation began just three days after CVE publication, targeting five organizations initially. Post-compromise activities included reconnaissance, web shell deployment, and installation of AI-assisted PowerShell scripts designed to evade detection by monitoring and terminating Windows Task Manager during mining operations. This incident highlights the accelerating pace of zero-day weaponization and the evolution of cryptojacking campaigns toward more sophisticated evasion techniques, including AI-generated scripts and legitimate process impersonation.
Anthropic Launches Free AI Vulnerability Scanner to Defend Open Source Ecosystem
In October 2026, Anthropic launched OSS Scanner, a free AI-powered vulnerability detection service for open-source projects. The initiative leverages Claude AI models to conduct automated security audits without human review, aiming to strengthen the open-source ecosystem's security posture. Through their Project Glasswing research, Anthropic has already identified over 29,000 candidate vulnerabilities across critical software projects, with 6,000 reported to maintainers and 584 advisories issued by October 2026. This development highlights the accelerating arms race between AI-powered offensive and defensive capabilities in cybersecurity. As threat actors increasingly leverage AI to discover and exploit vulnerabilities at scale, organizations must adopt similar AI-driven defensive measures to maintain security parity and protect critical infrastructure.
Critical Satel Netco Design Vulnerabilities Expose Global Telecommunications Infrastructure
In October 2026, CISA published advisory ICSA-26-281-03 detailing multiple critical vulnerabilities in Satel Netco Design network management software versions prior to v2.1.7. The Finnish telecommunications equipment vendor's platform suffered from four distinct security flaws including stored cross-site scripting (CVE-2026-105269), inefficient regular expression complexity causing denial of service (CVE-2026-104628), and two relative path traversal vulnerabilities (CVE-2026-105275, CVE-2026-101024). These vulnerabilities could allow authenticated attackers with minimal privileges to execute arbitrary scripts, consume system resources, enumerate files, and potentially achieve arbitrary code execution on affected systems deployed worldwide in critical communications infrastructure. This incident highlights the growing security challenges in industrial control systems and network management platforms, particularly as telecommunications infrastructure becomes increasingly targeted by nation-state actors and ransomware groups seeking to disrupt critical communications services.
Critical Infrastructure Under Fire: Grid Protection Alliance Vulnerabilities Expose Energy Sector Risks
CISA issued advisory ICSA-26-281-02 revealing five critical vulnerabilities in Grid Protection Alliance's openPDC and openHistorian systems, widely deployed energy sector infrastructure tools. The vulnerabilities include deserialization flaws (CVE-2026-100730), missing authentication for critical functions (CVE-2026-105281, CVE-2026-85479), server-side request forgery (CVE-2026-101022), hard-coded credentials in Docker images (CVE-2026-105278), and unsafe reflection allowing arbitrary code execution (CVE-2026-104629). These flaws enable unauthenticated remote code execution, complete system compromise, and unauthorized access to critical energy grid monitoring data. The vulnerabilities affect systems deployed worldwide in energy infrastructure, with patches available but requiring manual configuration updates for existing installations. This advisory highlights the persistent security challenges in operational technology environments where default configurations often prioritize functionality over security, creating significant attack surfaces in critical infrastructure systems.