Announced at Fal.Con 2026 in Las Vegas, the launch marks a strategic pivot away from generic frontier AI models toward a dedicated offensive-defensive framework built to operate natively inside the CrowdStrike Falcon platform.

The system emerges from CrowdStrike’s newly established Cyber Superintelligence Lab and represents one of the most ambitious applications of agentic AI in enterprise security to date.

CrowdStrike Launches SafeMind

What sets SafeMind apart from conventional large language model deployments is its dual-model design. Red Tempest, the offensive component, is trained to emulate advanced AI-driven adversaries and probe for exploitable attack paths, while Blue Solano, the defensive counterpart, is built to close those gaps using battle-tested protection measures drawn from real-world incident response.

Rather than functioning as isolated tools, the two models operate inside harnesses that pit them against each other in a continuous, self-improving loop, allowing the system to sharpen its detection and remediation capabilities with every cycle.

Crucially, these harnesses are also compatible with other frontier and open-source models, giving security teams flexibility in model choice without sacrificing cost efficiency.

SafeMind’s differentiation lies heavily in its training foundation. The models were built using telemetry from CrowdStrike’s Falcon sensors, described as the largest pureplay cybersecurity dataset and edge install base in the industry, combined with threat intelligence, Falcon Complete managed detection and response annotations, and fifteen years of frontline incident response fieldwork.

This grounding in operational breach data, rather than generic internet-scale text corpora, is central to CrowdStrike’s argument that purpose-built security models outperform repurposed general-purpose AI systems in adversarial cyber scenarios.

CrowdStrike developed SafeMind in partnership with NVIDIA, using the NVIDIA Nemotron open model family as its foundation, while CoreWeave’s AI Cloud powers both training and inference workloads. NVIDIA CEO Jensen Huang framed the collaboration as part of a broader industry shift, noting that cyber defense is becoming one of the most compute-intensive applications of AI as attackers and defenders both race to scale their use of automated systems.

CrowdStrike CEO George Kurtz echoed that sentiment, stating that the future of cybersecurity “won’t be defined by AI that simply identifies threats, it will be defined by AI that defeats them”.

CrowdStrike’s internal evaluations claim SafeMind delivers a 29 percent higher detection rate than leading frontier and open-source models, along with six-times-faster end-to-end remediation and 99 percent cost savings on detection and remediation workflows.

Dr. Bartley Richardson, CrowdStrike’s chief AI and autonomous systems officer, described the launch as the foundation for the next decade of AI-driven security, emphasizing that CrowdStrike now controls the entire stack “from sensor to harness to model”.

Standalone access to SafeMind’s models and harnesses will roll out through CrowdStrike’s Project QuiltWorks program, offering trusted enterprise customers a pathway to integrate the agentic system beyond the native Falcon deployment.

As AI-enabled attacks continue to scale, SafeMind signals a broader industry move toward autonomous, closed-loop defense systems designed to act on risk rather than merely flag it, positioning CrowdStrike at the forefront of the agentic security race.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post CrowdStrike Launches SafeMind – First Agentic Cybersecurity Solution Built for Defenders appeared first on Cyber Security News.

Tracked as CVE-2026-75754, the flaw carries a CVSS 4.0 score of 10.0, the highest possible rating, reflecting how easily it can be exploited over a network and the catastrophic scope of what an attacker can achieve once inside.

ASUS Control Center Vulnerability

The vulnerability actually stems from a chain of three separate weaknesses working together. ASUS Control Center is missing authentication on a critical function, meaning certain sensitive operations can be triggered by anyone who can reach the service over the network.

That gap is compounded by a server-side request forgery flaw, which lets an attacker send a specially crafted HTTP request to trick the system into exposing its own encryption key. Once that key is retrieved, a local service on the host automatically enables an SSH listener on TCP port 2222, effectively opening a hidden backdoor into the machine.

The final piece of the chain is arguably the most damaging: ASUS Control Center contains hard-coded credentials baked into the software itself. Attackers who obtain the encryption key can use these fixed credentials to log directly into the newly opened SSH port and land a full root shell, the highest level of system access available on the machine.

From there, intruders can read, modify, or delete any data stored in ACC, and because the platform is designed to centrally manage fleets of servers, PCs, and workstations, a single compromised ACC instance can hand attackers remote control over an entire corporate IT environment.

The flaw affects all versions of ASUS Control Center Enterprise up to and including 4.0.0.2. ASUS is urging every organization running the software to update immediately to version 3.1.0.9 or later, and confirms further fix details are posted on its official Security Advisory page.

Enterprises unable to patch right away should isolate ACC management interfaces from public networks, block inbound and outbound traffic on port 2222, and audit hosts for unexpected SSH listeners as an interim safeguard.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post ASUS Control Center Flaw Allows Attackers to Gain Full Admin Control of the System appeared first on Cyber Security News.

MikroTik confirmed on September 3, 2026, that it had discovered a serious security vulnerability affecting RouterOS and had already shipped fixes across every release channel, including 7.25 beta 3, 7.24.2 stable, 7.23.4 long-term, and 6.49.21 long-term.

The vendor deliberately withheld technical specifics in its initial advisory, stating plainly that it was “not currently publishing detailed information” in order to give administrators time to update before attackers could reverse-engineer the flaw from public disclosure.

Despite that caution, exploitation began almost immediately, and forum users and researchers quickly pieced together the attack mechanics on their own.

MikroTik RouterOS Vulnerability

According to detailed discussion on the official MikroTik support forum, the vulnerability lives inside a core library used by multiple RouterOS services, meaning any exposed service built on that codebase can be leveraged as an entry point.

One forum contributor who reverse-engineered the issue confirmed it is tied to SSH and grants any unauthenticated remote attacker direct shell access to the device, regardless of whether the router relies on password authentication or SSH key-based login.

In practical terms, if the SSH service is reachable from the internet or an untrusted network, the router is vulnerable until it receives the patch, with no additional credential theft or user interaction required.

Latvia’s national CERT issued its own alert corroborating a marked increase in attacker activity specifically targeting MikroTik routers, urging organizations and home users alike to update immediately to the patched builds MikroTik released. The agency’s guidance mirrored MikroTik’s own version list, reinforcing that the fix spans both the newer 7.x stable and legacy long-term branches.

Evidence of live exploitation surfaced quickly within the MikroTik user community. One administrator reported on Reddit that around September 2, 2026, at 08:00 UTC, an unauthorized user account named “ops” was created by another rogue account labeled “0,” granted both write and policy permissions, with the intrusion traced back to an SSH connection originating from the IP address 82.192.72.4.

The administrator noted that while the rogue account appeared to be used mainly for logging in and no obvious malicious scripts were visible in the configuration, the team suspected deeper compromise that RouterOS itself could not detect, ultimately requiring a full netinstall to guarantee the devices were clean.

RouterOS now includes a built-in detection mechanism to help flag this exact scenario. After upgrading, the operating system automatically inspects the full configuration at startup and sets a device to “Flagged” status if it finds signs of unauthorized tampering, logging a critical entry in the system log.

Devices in this state face operational restrictions, including a block on enabling new scheduler entries, SOCKS proxy, PPTP, L2TP, IPsec, proxy, and SMB configurations, until an administrator performs a manual audit.

MikroTik’s guidance is straightforward: if a device shows as flagged, assume it has been compromised, audit every configuration line, rotate all passwords, and only then clear the flagged state.

Even routers that never show a flagged status should not be considered safe by default; MikroTik and independent researchers both recommend manually reviewing configurations for unrecognized users, scripts, or scheduled tasks after updating, since some compromise artifacts may not trigger the automated detection.

Restricting SSH and other management interfaces from the public internet, enforcing key-based authentication, and limiting administrative access to trusted management networks remain essential complementary defenses while the patch rolls out fleet-wide.

Given the scale of MikroTik’s install base and the confirmed low barrier to exploitation, security teams should treat this as an urgent, internet-facing remote code execution scenario rather than a routine maintenance update.

Upgrading to 7.24.2, 7.23.4, or 6.49.21 (or later), auditing every device regardless of flagged status, and hardening remote management access should be treated as immediate priorities rather than items for the next maintenance window.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Hackers Exploiting MikroTik RouterOS Vulnerability in the Wild to Gain Complete Network Access appeared first on Cyber Security News.

“Never trust, always verify”: ZTNA okays only vetted users/devices, location-blind. Shrink attack planes, block lateral creeps, master app gates.

Market clutter and threat flux complicate picks. We rank 2026’s top 10: specs, perks, real impacts dissected.Prioritizing usability, relevance for CISOs, IT pros, scaling firms.

CISO, manager, or tech enthusiast find your Zero Trust match. Per-tool: intros, tables, specs, buy drivers, features—your 2026 blueprint.

Comparison Table: Top 10 ZTNA Solutions (2026)

1. OpenVPN Cloud Connexa

Best for: Small and mid-sized businesses that want Zero Trust Network Access without an enterprise budget or a bundled security suite.

OpenVPN’s CloudConnexa is a cloud-delivered ZTNA for SMB platform built on the open-source OpenVPN protocol. Rather than shipping ZTNA as one module inside a sprawling security stack, CloudConnexa combines identity-based, least-privilege application access with a globally distributed Wide-area Private Cloud (WPC) that links remote users, on-premises sites, and AWS, Azure, and GCP networks in a single service.

Users and private resources connect through encrypted outbound tunnels to CloudConnexa Regions, while Access Groups decide exactly which applications, hosts, and networks each user can reach. Because Connectors only establish outbound tunnels, private applications never require open inbound firewall ports or direct exposure to the public internet.

OpenVPN’s network security platforms provide secure remote access through both self-hosted and cloud-delivered VPN solutions for business, with the core tenets of Zero Trust Network Access at their center. Alongside the self-hosted Access Server, CloudConnexa helps teams securely reach company resources, SaaS platforms, the web, and data across cloud environments.

Why Do We Recommend It?

• ZTNA without the suite lock-in. You can add Zero Trust access on its own, without committing to a full security platform, complex contracts, or opaque enterprise pricing.
• Access control plus private networking in one service. Granular Zero Trust application access and a globally distributed WPC come together, so remote users, cloud VPCs/VNets, on-premises networks, and branch sites connect through the same fabric.
• Outbound-only Connector architecture. Connectors open encrypted outbound tunnels, keeping private applications off the public internet with no inbound port forwarding.
• Layered contextual access decisions. SAML SSO/MFA is combined with Device Posture, Location Context, and Device Identity Verification & Enforcement (DIVE) for context-aware policy enforcement.
• Integrated threat protection. Cyber Shield adds DNS-based domain/content filtering and IDS/IPS traffic inspection within the same service rather than limiting the platform to access control alone.
• Application domain-based routing and segmentation. Traffic can be routed by application domain, environments with overlapping IP ranges are supported, and networks are automatically segmented to limit lateral movement.

Key Features

1. Identity-based, least-privilege access – Access Groups restrict users to only the applications, IP services, hosts, and networks they are authorized to use, with a default-deny model under Custom WPC topology.
2. Device Posture Checking – Evaluates operating system and OS version, antivirus status, disk encryption, client certificate validity, and more, and can block noncompliant devices.
3. SAML SSO and MFA – Integrates with SAML 2.0 identity providers such as Microsoft Entra ID, Okta, OneLogin, Google Workspace, and Keycloak; built-in TOTP 2FA is available for username/password and LDAP authentication.
4. Device Identity (DIVE) – Adds device-level identity verification and enforcement to every access decision.
5. Location Context – Applies geographic and location-based conditions to access policies.
6. Cyber Shield – DNS-based domain/content filtering plus IDS/IPS detection and blocking of malware, intrusion activity, and denial-of-service traffic, with policies based on threat category or severity.
7. SCIM 2.0 provisioning – Automated user and group provisioning with documented examples for Okta, Microsoft Entra ID, JumpCloud, and OneLogin, alongside private LDAP support for directory-based authentication and group mapping.

Deployment and Platform Support

• Delivery model: Cloud-delivered ZTNA service built around a globally distributed WPC with CloudConnexa Regions.
• Deployment options: Cloud, on-premises, and hybrid. Connectors (or IPsec where applicable) link AWS VPCs, Azure VNets, GCP VPCs, and on-premises networks into the WPC.
• Supported devices: Windows, macOS, iOS, and Android via OpenVPN Connect; Linux via the supported open-source OpenVPN client.
• Integrations: SAML SSO, SCIM 2.0, private LDAP, APIs and session data for external monitoring and security workflows, and device-posture checks for several EDR/antivirus products.

Primary Use Cases

• Secure remote and hybrid-work access for employees and contractors without exposing the underlying network.
• Secure access to cloud applications and workloads across AWS, Azure, GCP, and other environments.
• Hybrid and multi-cloud connectivity between on-premises sites, private networks, cloud networks, and remote users.
• Application-level access and network segmentation to reduce lateral movement.
• Context-aware access for managed endpoints using Device Posture, DIVE, and Location Context.
• Threat-protected private access with Cyber Shield DNS filtering and IDS/IPS.

Who Is It Best Suited For?

CloudConnexa is designed for small and medium-sized businesses that want scalable Zero Trust security without significant infrastructure or management overhead, but it also supports larger organizations with distributed, hybrid, or multi-cloud environments.

It is particularly relevant for technology, professional services, healthcare, financial services, retail, and other regulated or distributed organizations that need secure remote access, segmentation, and auditability. Its audit logs support compliance requirements such as GDPR, HIPAA, and PCI-DSS.

Comparison Table

Pricing

CloudConnexa uses seat-based pricing, where each activated user or Connector consumes a seat.

Full details: CloudConnexa pricing

Pros and Cons

What Is Good?

• Standalone ZTNA with transparent, seat-based pricing and no suite lock-in.
• Combines Zero Trust access, private networking, and threat protection in one service.
• Outbound-only Connectors eliminate open inbound firewall ports.
• Broad identity support: SAML SSO, SCIM 2.0, LDAP, and built-in TOTP 2FA.
• Free Starter plan and 14-day trial make evaluation low-risk.

What Could Be Better?

• End-user access relies on the OpenVPN Connect client (open-source OpenVPN client on Linux); there is no agentless, browser-only option.
• Device Posture checks vary by operating system and client, so organizations should confirm their required endpoint controls are supported.
• Built-in TOTP 2FA applies to native and LDAP authentication only; with SAML SSO, MFA is handled by the identity provider.
• ZTNA is delivered as part of a broader WPC/private-networking model, which may not suit buyers looking solely for an application-proxy-style ZTNA product.
• Some advanced capabilities depend on subscription tier, so buyers should verify current plan entitlements.

Verdict

For SMBs that want to adopt Zero Trust principles without buying an entire security suite, OpenVPN CloudConnexa offers one of the most accessible paths available. It pairs granular, identity-driven access control with hybrid and multi-cloud connectivity, layers on device and location context, and includes Cyber Shield threat protection, all under straightforward seat-based pricing that starts free.

Website: OpenVPN Cloud Connexa

2. Zscaler Private Access

Zscaler Private Access (ZPA) is a cloud-native ZTNA platform that connects users directly to applications without exposing the network.

It continuously verifies user and device context, enforcing dynamic policies based on identity, device posture, and location.

ZPA eliminates the need for traditional VPNs, reducing the risk of lateral movement and simplifying secure access.

Zscaler’s architecture supports high scalability, making it ideal for organizations with a distributed workforce.

The platform offers seamless integration with identity providers, endpoint security, and threat intelligence solutions.

Specifications

• ZTNA Type: Cloud-native
• Deployment: SaaS
• Supported Devices: Windows, macOS, Linux, Mobile
• Policy Controls: Identity-based, Dynamic
• Threat Prevention: Inline SSL inspection, Real-time

Reason to Buy

• Direct-to-app access without network exposure
• Continuous verification of user and device context
• Seamless integration with IAM and endpoint solutions
• High scalability for global organizations

Features

• Application segmentation and least-privilege enforcement
• Inline SSL inspection and advanced threat prevention
• Continuous monitoring and policy adjustment
• Supports hybrid and multi-cloud environments

Best For: Large organizations needing cloud-native, scalable Zero Trust access.

3. Palo Alto Prisma Access

Palo Alto Prisma Access delivers a comprehensive ZTNA solution as part of its SASE platform.

It secures remote and on-site users with consistent policies, advanced threat prevention, and real-time visibility into network traffic.

Prisma Access supports hybrid workforces and integrates with cloud, SaaS, and on-premises applications.

The platform offers autonomous digital experience management (ADEM), giving IT teams insights and remediation capabilities for end-user connectivity and security issues.

Its ZTNA 2.0 approach addresses modern attack surfaces and operational complexity.

Specifications

• ZTNA Version: 2.0
• Deployment: Cloud, Hybrid
• Employee Size: Scalable for enterprises
• Integration: SIEM, IAM, EDR
• Policy Management: Centralized, Autonomous

Reason to Buy

• Advanced threat prevention and policy enforcement
• Autonomous experience management for end-users
• Consistent security across cloud, SaaS, and on-premises
• Scalable for large, distributed organizations

Features

• ZTNA 2.0 for hybrid work and direct-to-app architectures
• Real-time traffic visibility and autonomous remediation
• Application and data protection with microsegmentation
• Integration with advanced analytics and threat intelligence

Best For: Enterprises seeking advanced, autonomous Zero Trust with SASE integration.

4. Cloudflare Zero Trust

Cloudflare Zero Trust provides secure, fast, and reliable access to internal applications without a VPN.

Its platform is designed for ease of deployment and management, supporting identity-based policies, device posture checks, and robust threat intelligence.

Cloudflare’s global network ensures low latency and high availability.

The solution integrates with major identity providers, supports multi-factor authentication, and offers a free tier for small teams.

Cloudflare’s unified dashboard simplifies policy management and monitoring.

Specifications

• Free Version: Yes
• Deployment: Cloud
• Supported Devices: Windows, macOS, Linux, Mobile
• Integration: SSO, IAM, EDR
• Pricing: Starts at $7/user/month

Reason to Buy

• Rapid deployment and easy management
• Global network for low-latency access
• Free tier for small teams and startups
• Strong integration with identity and endpoint security

Features

• Identity-based access controls and device posture checks
• Real-time threat intelligence and monitoring
• Multi-factor authentication and SSO support
• Unified dashboard for policy and user management

Best For: Organizations needing fast, easy-to-manage Zero Trust with global reach.

5. Google BeyondCorp Enterprise

Google BeyondCorp Enterprise brings Zero Trust to the cloud, enabling secure access to applications from any device, anywhere.

The platform leverages Google’s robust infrastructure, offering identity-aware proxies, device security checks, and continuous monitoring.

BeyondCorp supports granular access policies and integrates with Google Workspace and third-party identity providers.

The solution is suitable for organizations embracing cloud-first strategies and seeking seamless integration with Google services.

Specifications

• Free Version: Yes
• Deployment: Cloud-native
• Supported Devices: Any (browser-based)
• Integration: Google Workspace, SSO, IAM
• Policy Controls: Granular, Identity-based

Reason to Buy

• Seamless integration with Google cloud services
• Browser-based access for any device
• Continuous monitoring and device security checks
• Granular, identity-aware access policies

Features

• Identity-aware proxy for secure application access
• Real-time device posture and risk assessment
• Integration with Google Workspace and third-party IAM
• Scalable for organizations of any size

Best For: Organizations leveraging Google Cloud and Workspace for Zero Trust.

6. NordLayer ZTNA

NordLayer ZTNA is designed for businesses looking for easy-to-use, scalable Zero Trust solutions.

The platform offers centralized management, multi-factor authentication, and device posture checks, with support for cloud and on-premises environments.

NordLayer’s intuitive interface and affordable pricing make it accessible for SMBs and enterprises alike.

NordLayer integrates with major identity providers and supports secure remote access for distributed teams.

Specifications

• Pricing: Starts at $11/user/month
• Deployment: Cloud, On-premises
• Supported Devices: Windows, macOS, Linux, Mobile
• Integration: SSO, MFA, IAM
• Management: Centralized

Reason to Buy

• Affordable and scalable for all business sizes
• Easy deployment and intuitive management
• Strong authentication and device security
• Supports remote and hybrid workforces

Features

• Centralized dashboard for user and policy management
• Multi-factor authentication and device posture checks
• Integration with identity providers and cloud platforms
• Real-time monitoring and reporting

Best For: SMBs and enterprises needing affordable, easy-to-manage Zero Trust.

7. Ivanti Neurons ZTNA

Ivanti Neurons ZTNA focuses on secure remote access and user experience, supporting a wide range of devices and operating systems.

The platform emphasizes compliance and detailed reporting, making it suitable for regulated industries and organizations with diverse device fleets.

Ivanti’s solution integrates with existing security infrastructure, providing centralized management, policy enforcement, and real-time monitoring.

Specifications

• Deployment: Cloud, On-premises
• Supported Devices: Windows, macOS, iOS, Android
• Compliance: Detailed reporting and auditing
• Integration: IAM, EDR, SIEM
• Policy Management: Centralized

Reason to Buy

• Comprehensive remote access for all device types
• Strong compliance and reporting capabilities
• Integration with existing security tools
• Centralized management and policy enforcement

Features

• Secure access for hybrid and remote workforces
• Detailed compliance and audit reporting
• Real-time monitoring and threat detection
• Flexible deployment and integration options

Best For: Organizations with diverse devices and strict compliance needs.

8. Appgate SDP

Appgate SDP delivers identity-centric ZTNA using a software-defined perimeter model.

It evaluates user and device context before establishing encrypted, one-to-one network connections.

The platform supports dynamic entitlements, real-time decisioning, and integration with SIEM, IAM, and EDR tools.

Appgate is designed for hybrid and multi-cloud deployments, offering granular policy controls and comprehensive visibility into network activity.

Specifications

• ZTNA Model: Software-defined perimeter
• Deployment: Cloud, On-premises, Hybrid
• Integration: SIEM, IAM, EDR
• Policy Controls: Identity and context-based
• Encryption: End-to-end

Reason to Buy

• Identity-centric access with dynamic policies
• Support for hybrid and multi-cloud environments
• Real-time monitoring and decision making
• Comprehensive integration with security tools

Features

• Encrypted, one-to-one network connections
• Dynamic entitlements and policy enforcement
• Real-time visibility into user and device activity
• Scalable for complex enterprise environments

Best For: Enterprises requiring granular, identity-driven Zero Trust in hybrid environments.

9. Twingate

Twingate offers a modern, cloud-native ZTNA solution that replaces traditional VPNs with identity-based, per-application access controls.

It is designed for rapid deployment, requiring no changes to network infrastructure. Twingate integrates with SSO, MFA, and endpoint security, providing granular access policies and robust encryption.

The platform is suitable for both hybrid and cloud environments, with a user-friendly interface and support for Windows, macOS, Linux, and mobile devices.

Specifications

• Free Version: Yes
• Deployment: Cloud-native
• Supported Devices: Windows, macOS, Linux, Mobile
• Integration: SSO, MFA, EDR
• Pricing: Starts at $5/user/month

Reason to Buy

• Easy, rapid deployment with minimal configuration
• Granular, identity-based access controls
• Strong encryption and device authentication
• Flexible for hybrid and multi-cloud environments

Features

• Per-application access and least-privilege enforcement
• Seamless integration with identity and endpoint solutions
• Traffic encryption and compliance-ready auditing
• Cross-platform support for diverse teams

Best For: Teams seeking a fast, flexible, and user-friendly ZTNA alternative to VPNs.

10. Fortinet FortiClient ZTNA

Fortinet FortiClient ZTNA integrates endpoint security with Zero Trust access, providing protection for devices and network resources.

Its zero trust agent supports multi-factor authentication, device posture checks, and split-tunneling for optimized user experience.

Centralized management via EMS or FortiClient Cloud enables streamlined deployment and real-time endpoint status.

FortiClient is ideal for organizations already invested in the Fortinet Security Fabric, offering seamless integration with FortiGate firewalls and FortiSandbox.

Specifications

• ZTNA Agent: Yes
• Deployment: Cloud, On-premises
• Integration: Fortinet Security Fabric
• Central Management: EMS, FortiClient Cloud
• Web Filtering: Yes

Reason to Buy

• Deep integration with Fortinet ecosystem
• Centralized management and reporting
• Advanced endpoint and network protection
• Supports split-tunneling and web filtering

Features

• Multi-factor authentication and device posture checks
• Real-time endpoint monitoring and upgrades
• Centralized logging for compliance and security analysis
• Flexible deployment options for diverse environments

Best For: Organizations using Fortinet products seeking integrated Zero Trust.

Conclusion

ZTNA has surged essential amid remote shifts, cloud leaps, and threat twists.

Reviewed platforms from Check Point’s all-in-one guard to Google’s BeyondCorp cloud magic scale Zero Trust to fit any operation.

Vet choices by size, regs, stack synergy, and expansion horizon. Prime picks lock data/apps while unleashing anywhere-productivity.

ZTNA transcends upgrades: it’s resilience, compliance, and transformation fuel. Navigate to 2026’s best with this roadmap forge a tougher, sharper, nimbler enterprise.

The post 10 Best ZTNA Solutions (Zero Trust Network Access) In 2026 appeared first on Cyber Security News.

Dutch e-commerce security firm Sansec disclosed the flaw, dubbed StyleSmuggler, on September 5, 2026, warning that unauthenticated attackers can achieve remote code execution on vulnerable installations and that live attacks began the previous day .

The company said it was publishing its findings early, before completing its full technical analysis, “because stores are being compromised right now”.

StyleSmuggler affects every current version of Magento and Adobe Commerce, including the latest 2.4.9 release, and requires no authentication whatsoever to exploit.

Sansec reproduced the complete unauthenticated attack chain on clean installations of Magento Open Source 2.4.7, 2.4.8, and 2.4.9, confirming the bug is not tied to any single outdated build.

Disturbingly, the first identified victim was running 2.4.6-p15 with July and August 2026 security patches fully applied, meaning fully patched stores were compromised just as easily as neglected ones.

As of September 6, Adobe has not issued an advisory, assigned a CVE identifier, or released any official fix or workaround, and the company’s most recent Commerce security bulletin still dates to August 11.

The exploit unfolds in two distinct stages that abuse Magento’s own template rendering and email systems rather than a single obvious injection point. In the first stage, attackers plant malicious PHP code inside a file that Magento itself writes during normal operation, such as a payment failure report, by manipulating “styles” properties within a GraphQL request to slip past existing input sanitization.

Magento and Adobe Commerce 0-Day RCE

Independent analysis from Magento hosting firm Disrex Group, which handled two breached stores, found that a crafted directive inside the injected text forces a chain of Magento’s own classes to execute code that was only ever meant to run through the command-line dependency-injection compiler, ultimately including the attacker-poisoned log file.

The second stage triggers execution. Sansec found that StyleSmuggler deliberately causes Magento to send its standard “Payment Transaction Failed Reminder” email, and the poisoned code runs the moment Magento renders that message internally, meaning nobody has to open or even receive the email for the attack to succeed.

Once triggered, a PHP dropper cycles through six different PHP functions until it finds one capable of spawning a process, then downloads and launches a persistent implant. Disrex described the malware as a small, statically linked Rust binary of roughly 1.9 megabytes, compiled for both x86-64 and ARM64 architectures, disguised as a Linux kernel thread named “[kworker/u:8:0]” and restarted every five minutes through a cron entry written directly into the crontab spool file to avoid leaving normal system logs.

Detecting an infection is harder than it sounds because the malware actively evades naive checks. A genuine Linux kernel worker thread is owned by root and consumes no resident memory, so any bracketed “[kworker]” process running under a website’s own user account with real memory usage is a red flag.

Disrex also discovered that the binary running in memory sometimes differs from the file sitting on disk, meaning defenders should hash both the file and the live process to be thorough.

On one compromised store, the implant made no outbound internet connections at all, instead opening 28 simultaneous connections to the site’s own Redis instance to read live Magento session data, which let it operate almost invisibly to network-based monitoring.

Sansec’s own detection guidance searches Magento’s var/report directory for a marker string, but Disrex found both of its breached stores were actually poisoned through var/log/system.log instead, meaning administrators need to check both locations.

With Adobe’s next scheduled security release set for September 8 and no confirmation it will address this flaw, store owners are left relying on stopgap measures. Sansec recommends temporarily disabling GraphQL entirely for stores that don’t rely on headless or progressive web app storefronts, since classic and Hyvä themes generally don’t need it.

Disrex, security researcher ProxiBlue, and vendor Graycore have each independently published unofficial code patches that guard specific Magento classes and email template functions, though all three stress these are hardening measures rather than a genuine fix, and Disrex specifically warns its rules only block the current attack traffic pattern, not the underlying vulnerability.

Server-level protections that don’t depend on understanding the exploit chain at all, such as disabling PHP’s proc_open function and mounting temporary directories with noexec, have also proven effective at stopping the dropper from launching its payload.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Hackers Actively Exploiting Magento and Adobe Commerce 0-Day RCE Vulnerability appeared first on Cyber Security News.

The company acknowledged the problem, tracked internally as TM1466820, and confirmed it remains unresolved as engineers continue digging through service logs to find a root cause.

According to Microsoft’s incident notice, affected users encounter trouble specifically during the first launch of Teams on a Windows device. Some cannot load the client at all, while others experience delays stretching up to two minutes before the app becomes usable.

For an application many organizations rely on for daily communication, even a two-minute hang at startup can disrupt morning routines, delay meeting joins, and frustrate employees trying to check urgent messages.

Microsoft has classified the issue’s scope as affecting “some users” within impacted organizations, particularly those opening Teams to view new messages. The company noted that impact varies across tenants, meaning not every organization or every user within an affected organization will necessarily notice the slowdown.

While a permanent fix is being developed, Microsoft has recommended workarounds to keep productivity moving. Affected users can switch to Microsoft Teams on the web through a browser, or use the Teams mobile app, both of which reportedly remain unaffected by the desktop client’s loading problem. These alternatives don’t fix the underlying issue but let employees stay connected until Microsoft rolls out a resolution.

In its most recent update, posted at 8:41 AM on September 4, 2026, Microsoft said its analysis of service logs and telemetry data has so far been “inconclusive.” Engineers have not yet pinpointed why the desktop client is struggling to load on some Windows machines.

Microsoft Teams Desktop Client Fails

To move the investigation forward, Microsoft is reaching out directly to a subset of impacted users, requesting client-side logs from their devices. The company expects these logs will help isolate the underlying trigger and clarify what remediation options are viable.

This is not the only Teams-related disruption Microsoft has grappled with recently. Earlier in the year, a regression in the Teams client’s build-caching system caused similar launch failures, which Microsoft resolved by reverting a faulty service update.

Separately, Windows 11 users on ARM-based devices, such as Surface Pro and Surface Laptop models, have faced Teams and Outlook launch failures tied to an August security update, an issue Microsoft has since mitigated through a Microsoft Store update.

For now, IT administrators managing Windows fleets should monitor the Microsoft 365 admin center’s service health dashboard for updates on TM1466820 and consider proactively informing staff about the web and mobile workarounds.

Microsoft has not provided an estimated resolution timeline, but its outreach for client logs suggests the investigation is entering a more targeted, evidence-gathering phase rather than a quick patch rollout.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Microsoft Teams Desktop Client Fails to Load on Windows System – Microsoft Investigating appeared first on Cyber Security News.

The threat actor told Unit 42 investigators during ransom negotiations that they relied on frontier AI models paired with attack-specific agentic AI frameworks to automate the intrusion.

Rather than manually executing each stage of the attack, the operator directed AI agents to monitor, evaluate, act, and re-plan in real time, compressing more than 50 distinct MITRE ATT&CK techniques into a single automated loop.

Unit 42 noted that the attack did not rely on a zero-day exploit or unusually sophisticated tradecraft, but instead achieved its speed and scale purely through AI-assisted operational efficiency.

AI Agents Breach Company Network

Once the agents gained initial access by breaching a publicly accessible web service, they tunneled into the network and deployed an automated reconnaissance agent to map internal microservices.

From there, sub-agents combed through enterprise code repositories, harvesting hard-coded tokens and service passwords. The attacker then used those exposed tokens to infiltrate the organization’s secrets management system, extracting master administrative credentials that granted root-level access across the environment.

The agents did not stop at credential theft. They hijacked the company’s CI/CD pipeline through custom workflows to exfiltrate cloud access keys and attempted to plant backdoors inside Terraform infrastructure-as-code configurations, an effort that was ultimately blocked by branch-protection controls.

Using the stolen cloud keys, the attacker also seized control of the victim’s AI infrastructure, repurposing the company’s own compute resources to support future stages of the attack.

Unit 42 identified several telltale signs of AI-driven operations, including parallel calls to multiple large language models, structured Markdown files used to pass information between agent sessions, and custom scripts bearing UI elements consistent with AI-generated code.

In an unusual twist, the attacker also directed the agents to compile an 80-page technical audit of the victim’s security weaknesses, effectively automating a full penetration-testing report as leverage.

Researchers warned that adversaries are increasingly likely to fold autonomous AI agents into their toolkits, since the technology helps establish redundant persistence across SSH keys, cloud identities, and CI/CD pipelines simultaneously.

To counter machine-speed attacks, Unit 42 recommends that organizations deploy synchronized containment playbooks that can instantly revoke credentials and freeze pipelines, treat AI models and API keys as core infrastructure requiring strict governance, and enforce mandatory multi-party code review on infrastructure-as-code repositories to block automated backdoor injection.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post AI Agents Breach Company Network in Under 10 Hours and Steal Root Credentials appeared first on Cyber Security News.

Announced as a follow-up to commitments made at Build 2026, Project Zenith targets developer-class hardware equipped with at least 64 GB of unified memory and memory bandwidth exceeding 250 GB per second.

That hardware profile allows developers to run AI models with more than 30 billion parameters locally and without usage metering, reducing reliance on cloud-based token consumption during experimentation and coding tasks.

The first devices supporting Project Zenith will ship with AMD’s Ryzen AI Halo platform, with additional OEM and silicon partners expected to join in the coming months.

Rather than being a separate product, Project Zenith is a preconfigured Windows setup layered on top of ongoing baseline improvements Microsoft has been rolling out to Windows 11 throughout the year, including refinements to Search, File Explorer, and system memory efficiency. Devices running Project Zenith inherit these performance gains while adding a development-first configuration out of the box.

That configuration includes Windows Terminal and Visual Studio Code pinned to the taskbar by default, along with pre-tuned settings across File Explorer, Search, Start, and the taskbar.

File Explorer ships with file extensions, hidden files, full title-bar paths, and long-path support enabled, while distractions such as recently used file suggestions and sync provider prompts are switched off. Search and Start come with Command Palette enabled and notification clutter minimized, aiming for what Microsoft describes as a calmer, distraction-free workspace.

Windows Subsystem for Linux also plays a central role in the initiative. Building on last year’s open-sourcing of WSL, Microsoft has integrated WSL containers, giving developers a native way to build, run, and manage Linux containers without leaving Windows.

From a security and platform-architecture standpoint, Project Zenith devices are designed to support agentic development workloads using Microsoft’s Execution Containers (MXC), which combine OS-enforced identity controls with containment and enterprise-grade manageability for AI agents.

Microsoft frames this as essential groundwork for a computing era where autonomous agents increasingly write, test, and execute code, arguing that a secure, isolated foundation is necessary before agentic workflows can be trusted at scale in professional environments.

Microsoft positions the initiative as an economic and architectural shift in how AI-assisted development happens: offloading capable models to local hardware for routine tasks while reserving frontier cloud models for harder problems.

The company says Project Zenith is an evolving effort shaped directly by developer feedback, with hardware variety expected across OEM partners even as the core “ready-to-code” promise stays consistent.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Microsoft Unveils Project Zenith Windows PCs That Can Run 30B+ AI Models Locally appeared first on Cyber Security News.

The tools give attackers a discreet way to run commands, collect system details, and maintain control over compromised devices.

The campaign marks a change for the group, which had previously relied heavily on public tools and leaked ransomware builders.

Its move to custom malware suggests a broader effort to stay inside victim networks longer while making activity harder for security teams to spot.

Analysts at Securelist identified the malware in early July 2026 and linked it to Toy Ghouls, also tracked as Bearlyfy, Laboo.boo, and Feral Wolf. The group has targeted Russian organizations since 2025 and has previously been associated with its own GenieLocker ransomware.

The new backdoors are called mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0. They are delivered after attackers gain access to an organization, showing how a small initial breach can develop into a persistent and serious compromise.

Kaspersky said in a report shared with Cyber Security News (CSN) that the tools provide full control over an infected Windows device.

Hackers Use Popular Messaging Services

Toy Ghouls uses Windows Remote Management, or WinRM, to place the backdoors and their configuration files on already compromised systems.

The attackers use Evil-WinRM and WinRM-fs, tools that can help move files and run remote commands across Windows environments.

WinRM is widely used for legitimate administration, which can make malicious use difficult to identify without close monitoring.

Organizations have faced similar risks from Windows Remote Management abuse, where attackers use valid access and remote sessions to move deeper into a network. The HiveMQ version uses the public broker.hivemq.com MQTT service as its command-and-control channel.

It reports whether a device is online, sends information such as processor usage and free memory, and retrieves instructions that are then run through a hidden PowerShell process.

Using a broker service allows attackers to blend malicious traffic with normal internet activity. The approach resembles an earlier MQTT command channel used by WailingCrab, demonstrating why familiar cloud and messaging infrastructure can complicate network investigations.

The second version uses an attacker-controlled Element server based on the Matrix protocol. It sends device status messages to a designated room, receives commands from an account called panel-bot, and executes those instructions through the Windows command line.

Both variants can run interactively or install themselves as Windows services, allowing them to start again after a reboot. This persistence method makes the infection more dangerous because an attacker may regain access even after the original remote session has ended.

Persistence and Defensive Response

The malware stores its settings in a config.toml file before protecting sensitive fields with encryption tied to the infected computer.

On the Element variant, the file is deleted after first use and the information is moved into the Windows registry, reducing the number of obvious artifacts left on disk.

Security teams should review WinRM access, limit it to approved management systems, and investigate unusual remote PowerShell activity.

They should also watch for unexpected services named cplsupport or wtas, suspicious configuration files in ProgramData folders, and outbound traffic involving the listed messaging infrastructure.

Administrators should treat remote-management credentials as high-value assets and enforce strong authentication for privileged accounts.

Recent incidents involving the Teams and Quick Assist campaign show how social engineering and trusted Windows tools can be combined to create a path toward wider network access.

The discovery also reinforces the value of checking for quiet backdoor behavior, rather than looking only for known ransomware activity.

A recent Windows backdoor investigation similarly highlighted how attackers can minimize visible network signals while waiting for instructions.

Toy Ghouls’ use of MQTT and Element does not mean the services themselves are malicious. Instead, the case shows how threat actors can misuse legitimate or common technology to hide command traffic, gather system data, and keep control of compromised Windows systems for longer periods.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Use Popular Messaging Services to Control New Windows Backdoors appeared first on Cyber Security News.

The change raises the stakes for people whose browsers hold work, banking, or social-media access. First tracked in 2023, NodeStealer initially focused on sensitive browser data and Facebook accounts.

It later widened its interest to Facebook Ads Manager accounts and payment-card information. The latest activity mainly affected victims in Asia and North America, with financial services the leading sector, but the campaign crossed several industries.

Netskope researchers identified the upgraded variant in August 2026 and said it adds spyware functions alongside the earlier theft features.

Netskope said in a report shared with Cyber Security News (CSN) that the researchers also found signs that some new code may have been produced with AI assistance.

The report does not identify a confirmed initial delivery method, so organizations should avoid assuming a single infection route.

What is clear is the malware’s objective after execution: collect enough credentials, session data, personal details, and screen content to support fraud, impersonation, or follow-on account takeover.

NodeStealer Can Now Record Everything Victims Type

The most worrying addition is a keylogger that uses Python’s pynput library to monitor keyboard input.

It saves captured text in a temporary file, sends it to the primary Telegram command-and-control channel every 120 seconds, and then clears the file’s contents. The logging is designed to continue indefinitely.

That can expose passwords, search terms, customer data, private messages, and other information that users enter manually. Clipboard monitoring fills a similar gap by collecting plain text copied and pasted into the device.

Readers following Snake Keylogger’s capture techniques will recognize how this combination gives criminals visibility beyond saved browser credentials.

NodeStealer also takes a screenshot when it runs and another before its screenshot function finishes, transmitting both images through Telegram.

A screen capture can reveal data that may never reach the clipboard or keyboard, including dashboards, recovery codes, open documents, and active conversations.

The separation of stolen material across two Telegram bots may also make disruption harder. One bot receives an archive of browser credentials, passwords, and cookie databases, while the other receives Facebook-specific data.

This approach resembles other Telegram bot driven malware operations that abuse legitimate messaging infrastructure for attacker communications.

Facebook Data Theft Expands

The newest samples query more than 20 Facebook Graph API endpoints, up from two in previous versions.

Rather than only checking an account, the malware seeks a detailed picture of the person managing it, covering identity details, contacts, interests, posts, pages, advertising assets, business records, integrations, and login-related data. For companies that run advertising campaigns, the impact can extend beyond one employee’s profile.

Access to business and Ads Manager information could help attackers run unauthorized ads, steal budgets, target colleagues, or make convincing social-engineering approaches. The risk mirrors Facebook advertising account theft reported in other malware campaigns.

Analysts noted an apparent AI-assisted element in the new functions: repeated, similarly structured calls marked with decorative emoji labels, a pattern absent from earlier NodeStealer code.

That observation is not proof of a particular tool or author, but it suggests attackers may be accelerating routine feature development.

The malware is also distributed as compiled Python bytecode with altered header fields, apparently intended to obscure its compilation timeline and possibly interfere with automated analysis.

Security teams should ensure that inspection workflows examine Python bytecode even when its metadata looks incomplete or misleading.

Defenders should treat unusual Python-based files, unexpected browser-data access, persistent keystroke collection, and Telegram-bound archives as high-priority signals.

Reduce exposure by limiting administrator access, keeping browsers and endpoint protections updated, reviewing active sessions, and warning staff not to run untrusted attachments or downloads. Recent phishing-delivered VIP Keylogger campaigns show why these basics still matter.

People responsible for Facebook business accounts should use strong multi-factor authentication, review connected apps, and watch for unfamiliar advertising changes.

Since cookies and session data can be valuable to attackers, prompt session revocation and credential resets are important after a suspected infection.

These steps cannot undo stolen screenshots, but they can limit further account abuse and reduce the chance of costly misuse.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post NodeStealer Can Now Record Everything Victims Type and Steal Their Screenshots appeared first on Cyber Security News.