156 casos · pág. 3/8
GreyNoise announced C2 Detection, a new intelligence module that identifies compromised edge and perimeter devices (routers, firewalls, VPN concentrators) from their outbound connections to attacker-controlled infrastructure. The capability extends GreyNoise beyond inbound scanning intelligence into post-exploitation, outbound-facing dete…
This GreyNoise blog post is a product-oriented piece describing five workflows the vendor wires into customer SOAR platforms. It reports no incident, vulnerability or threat actor activity. The use cases are automated IP enrichment, early warning of exploitation spikes against vendor CVEs, detection of compromised edge devices, validated …
GreyNoise published a vendor blog post describing four ways SOC teams can use its internet-wide scan and attack classification to improve SIEM detection. The use cases separate opportunistic mass-scanning noise from activity that may be targeted at an organization. The post is product-oriented guidance and does not describe a specific inc…
GreyNoise announced an updated integration with Google Security Operations that brings its internet-scanner classification data into the SIEM/SOAR platform. The aim is to separate mass-scanning noise from activity targeting the customer's own environment. GreyNoise says it observes over 800,000 unique IPs daily across 5,000+ sensors in 80…
GreyNoise announced Tactics, a new feature in the GreyNoise Visualizer (Observe → Tactics) that maps attacker sessions captured by GreyNoise Deception Sensors to the MITRE ATT&CK framework. It extends the company's visibility beyond Reconnaissance and Initial Access, following the earlier C2 Detection Module, to show what adversaries do a…
GreyNoise has described a revised detection engineering approach that uses agentic workflows built on frontier large language models to keep pace with rising CVE volumes. The post says CVE entries grew from 16,510 in 2018 to 48,162 in 2025, and that generative AI has contributed to 130% growth from 2022 through 2025. It also claims the me…
GreyNoise announced that a former Head of Global Signals Operations at Google Threat Intelligence Group (GTIG), who joined Google through its 2022 acquisition of Mandiant, is its new Senior Vice President of Adversary Operations. This is a personnel and business announcement with no incident, vulnerability or active campaign. The post say…
A Cisco blog post by Renato Morais compares past landmark threats with the emerging risk from autonomous AI agents, then presents Cisco's agentic security reference architecture. It recounts the ILOVEYOU worm (2000), a social-engineering email worm, and WannaCry (2017), a ransomware worm using EternalBlue against unpatched Windows systems…
At Splunk .conf26, Cisco, Splunk and Endace ran a live Agentic Security Operations Center (SOC) built around the Splunk Enterprise Security (ES) AI Triage Agent. The agent prepared findings, with a suggested disposition, rationale and next steps, and human analysts validated the evidence and made the decisions. No threat activity or incid…
Cisco's Agentic SOC team at Splunk .conf26 showed how retrospective packet replay can check for past zero-day exploitation. They used full line-rate packet capture from Endace, intrusion detection on Cisco Secure Firewall Threat Defense (FTD), and rule updates from Cisco Talos. The scenario was Talos releasing new rules for CVE-2026-82329…
Cisco described how its team ran the live Security Operations Center at Splunk .conf26 in Denver, protecting more than 5,145 attendees from 70 countries. The SOC used a multi-stage agentic pipeline: live telemetry feeds Splunk Enterprise Security, autonomous triage agents accelerate Tier 1 analysis, Cisco Cloud Control enforces confidence…
Cisco describes how it is adapting its Cisco Secure Development Lifecycle (CSDL), built on more than 400 software security requirements, to AI-assisted and agentic software engineering. The security bar is unchanged, but requirements become atomic, machine-readable and contextual so that engineers and AI agents can act on them directly. C…
A Cisco security blog post by Jonathan Felten argues that cryptographic failures rarely come from broken algorithms. They come from the gap between a fix being available and a fix being deployed, which he calls the "last mile of trust". He says AI-driven vulnerability discovery is widening this gap because discovery scales with compute wh…
Researcher Harsh Jaiswal of Hacktron describes using the AI-assisted Hacktron CLI with a custom "JDBC driver pack" to audit decompiled JDBC drivers during a bug bounty event. The audit surfaced multiple vulnerabilities across vendor drivers, earning $85,000 in bounties. The headline finding is in the Databricks JDBC driver, where an attac…
Hacktron published a vendor blog post arguing that frontier models such as Anthropic's Mythos are unnecessary for most vulnerability discovery work. To support this, it benchmarked its scanning pipeline across several LLMs against two zero-day authentication bypasses it found in oauth2-proxy v7.15.0: CVE-2026-34457 and CVE-2026-40575. Its…
Hacktron has opened Hacktron Review for Open Source, giving qualifying open source projects its commercial pull-request security reviewer at no cost. The announcement argues that attackers use AI agents to hunt vulnerabilities at scale and to push malicious dependencies into open source. It cites CISA and VulnCheck data that median time-t…
Hacktron published a vendor blog post comparing its AI pentesting platform against XBOW and Aikido, using the benchmark target from a Doyensec head-to-head report (sponsored by Aikido). Doyensec scanned the open-source projects Fider and Photoview at $4,000 per repo per platform. The author ran Hacktron on Fider v0.33.0, at an estimated c…
Hacktron tested eight LLMs, open-weight and frontier, in its fixed pentest and code-review orchestration. The target was Fider, an open-source Go and React feedback app. The test measured how many of 15 vulnerabilities patched between v0.33.0 and v0.36.1 (originally reported by XBOW and Aikido) each model could rediscover. The patches pos…
A Hacktron researcher argues that AI-assisted vulnerability research is rapidly widening the enterprise attack surface. He cites recent breaches at Vercel and GitHub and a wave of critical CVEs in F5, Fortinet, Cisco, Palo Alto and ImageMagick. According to the author, the Vercel compromise began with a breach of the AI platform Context.a…
Hakai Security has published Beerus Framework v1.1, a minor update to its on-device Android mobile pentest toolkit. The release adds KernelSU support alongside Magisk, an optional gRPC transport for memory dumps and sandbox exfiltration, integrated auto-update, and an iptables alternative to Proxy Profiles. It also fixes several defects a…
