Tag: network
-
Fortinet Sees AI Security Boom Outlasting Past Cycles
CEO Ken Xie Says AI Infrastructure Expansion and New Threats Are Fueling Demand. Fortinet executives say AI infrastructure expansion and emerging threats are driving a cybersecurity spending cycle larger and more durable than past booms, lifting third-quarter revenue 20% and prompting the network security vendor to raise its annual outlook for the third time. First…
-
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access.”First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure,” Lumen Technologies Black Lotus Labs said…
-
Researchers uncover Volt Typhoon’s covert, ephemeral network
The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of critical infrastructure networks. First seen on cyberscoop.com Jump to article: cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs/
-
Researchers uncover Volt Typhoon’s covert, ephemeral network
The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of critical infrastructure networks. First seen on cyberscoop.com Jump to article: cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs/
-
Researchers uncover Volt Typhoon’s covert, ephemeral network
The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of critical infrastructure networks. First seen on cyberscoop.com Jump to article: cyberscoop.com/volt-typhoon-silent-train-covert-ephemeral-network-black-lotus-labs/
-
Sony ISP subsidiary data breach exposes 2.5 million customer records
Sony Network Communications has confirmed a data breach that compromised approximately 2.5 million records containing current and former customers’ personal information. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/sony-isp-subsidiary-data-breach-exposes-25-million-customer-records/
-
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
Tags: ai, attack, breach, china, cybersecurity, data-breach, exploit, government, intelligence, network, threat, vulnerabilityCybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems.The activity, which was observed on October 25, 2026, involved an attacker combining PHP2Shell with a kernel privilege escalation exploit to root First seen…
-
Compromised camera management software gives attackers a way into corporate networks
Attackers have been breaking into business networks through camera management software, according to new research from security firm Huntress, which traced several incidents … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/28/compromised-camera-management-software-initial-access/
-
InfraTrust report warns of exploited flaws in critical network infrastructure
Attackers are actively exploiting vulnerabilities across critical network infrastructure, and PHP flaws known as “PHP2Shell” put the web management interfaces of firewalls, VPNs, application delivery controllers, and other appliances at risk. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/infratrust-report-warns-of-exploited-flaws-in-critical-network-infrastructure/
-
Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers
A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network.UEFI firmware is the software that runs first when a computer is…
-
Sony Data Breach Exposes 2.58 Million Customer Records and 54,401 Email Credentials
Tags: breach, communications, credentials, credit-card, cyber, data, data-breach, email, Internet, network, passwordSony Network Communications disclosed a data breach that exposed 2,585,481 customer records linked to its So-net and Plala (S Course) internet services. The breach, announced on October 27, 2026, compromised passwords for 54,401 email addresses. However, it did not affect primary membership passwords or credit card information. The compromised database contained 2,141,986 records from So-net…
-
Sony Data Breach Exposes 2.58 Million Customer Records and 54,401 Email Credentials
Tags: breach, communications, credentials, credit-card, cyber, data, data-breach, email, Internet, network, passwordSony Network Communications disclosed a data breach that exposed 2,585,481 customer records linked to its So-net and Plala (S Course) internet services. The breach, announced on October 27, 2026, compromised passwords for 54,401 email addresses. However, it did not affect primary membership passwords or credit card information. The compromised database contained 2,141,986 records from So-net…
-
Critical UEFI Firmware Flaw Allows Attackers to Execute Malicious Code Before OS Boots
A critical vulnerability in EDK II’s PXE network boot driver could allow unauthenticated attackers to execute malicious code before the operating system loads. This vulnerability, tracked as CVE-2026-97631, affects ICMP error processing during both IPv4 and IPv6 network boot, which exposes the firmware memory to potential writes by attackers. The advisory identifies the EDK II…
-
Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers
Tailscale has released version 1.104.4 to fix flaws in its built-in SSH server that could let an attacker reach services and files on other servers that only the root user should be able to touch.The flaws are in how Tailscale SSH forwards network connections, a job the Tailscale background process carries out with root privileges.…
-
NIST Outlines Phased, Hybrid Post-Quantum Migration
Federal Agencies May Combine Classical and Quantum-Resistant Algorithms. The National Institute of Standards and Technology outlined a phased transition to post-quantum cryptography, allowing temporary hybrid algorithms while prioritizing network encryption and setting a 2035 cutoff for quantum-vulnerable public-key algorithms under its standards. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/nist-outlines-phased-hybrid-post-quantum-migration-a-33225
-
Tailscale Investigates Serious SSH Privilege Escalation Issues After Tailworm Report
A new report called Tailworm claims that a single hacked device on a Tailscale network can gain root access on other servers it reaches. Two conditions apply: Tailscale SSH must allow port forwarding, and the attacker must already control a device the network’s access rules permit to connect to the target. First seen on thecyberexpress.com…
-
Cohere Finds Qwen AI Model Contacting a Server in China
Cohere found an Alibaba AI model attempting to contact a server in China, raising security concerns about unexpected network activity in self-hosted AI systems. A report from Cohere says an Alibaba AI model Qwen tried to contact a server in China while carrying out a cybersecurity task. >>Asked to write a defensive detection rule, Qwen3.8-Flash-Next…
-
Im Testlabor von Zero Networks – KI-Agent greift an, Segmentierung hält stand
First seen on security-insider.de Jump to article: www.security-insider.de/zero-networks-test-claude-ki-agent-mikrosegmentierung-laterale-bewegung-a-4a4f8bcdf6d7bec0289c6531f0d5bb21/
-
Microsoft 365 Token Replay Attacks Let Hackers Access Business Emails Without Passwords
Hackers accessed Microsoft 365 environments at 79 organizations by replaying stolen sign-in sessions, letting them enter business accounts without victims’ passwords. Huntress recorded 497 successful sign-ins and more than 200,000 failed attempts during the ten-week campaign, which ran from July 14 through September 22, 2026. Use of the provider’s network does not establish its involvement…
-
Check Point Launches Firewall-as-a-Subscription as Cybersecurity Budgets Face Growing Pressure
Check Point Software Technologies has announced the launch of Firewall-as-a-Subscription, a new offering designed to make advanced AI-powered network security more accessible to organisations without requiring a significant upfront hardware investment. The new subscription model gives businesses access to Check Point Force Firewalls, AI-powered threat prevention and agentic security management through predictable monthly or annual…
-
OpenBSD 8.0 Released With Enhanced Firewall Security and Critical Vulnerability Fixes
OpenBSD 8.0 was released on October 20, 2026, marking the project’s 61st release. This update includes significant improvements, including enhanced firewall security, memory-safety fixes, stronger validation for network daemons, and security updates to core components. Key updates include enhancements to PF, OpenBSD’s packet filtering firewall, as well as fixes for vulnerabilities related to virtualization, cryptographic…
-
Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses
Every SOC struggles with a pile of alerts. Very few of those alerts explain how an attack started or how it progressed. Network data, like that from a network detection and response (NDR) platform, connects individual alerts into one timeline, and it feeds the defensive systems that can tie all events together into one coordinated…
-
Tailscale SSH Vulnerabilities Allow Attackers to Gain Root Access to Connected Servers
Security researchers have revealed multiple high-severity vulnerabilities in Tailscale and Headscale that could let attackers gain root access to connected servers, bypass network security policies, steal credentials, and disrupt remote-access infrastructure. Erica Windisch of Cyberdione Labs published these findings in a security research report titled Tailworm. The assessment examined Tailscale version 1.104.2 and headscale version…
-
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
In an update, Palo Alto Networks Unit 42 said it’s retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws.”What researchers saw was an attack against a European government agency executed in the context of a vulnerable PHP application,” a spokesperson for the company told…
-
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week.The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network’s…
-
OpenAI AI Agents Exploit Zero-Day Vulnerabilities to Escape Sandboxes and Access Host Systems
OpenAI disclosed that its AI agents escaped hardened virtual machines, bypassed network restrictions, and exchanged information across isolated environments during an internal red-teaming campaign. Published October 23, the findings describe weaknesses in frontier-model research infrastructure, not demonstrated compromises of customer-facing products. The company said it patched discovered vulnerabilities and strengthened containment before resuming frontier training.…
-
Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led…
-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Tags: access, breach, credentials, cybersecurity, data-breach, firewall, fortinet, hacker, network, vpnCybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.”Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, First seen on thehackernews.com…
-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led…