Guides · Tools · Analysis
The Cyberpresso Blog
Guides, tools and how-tos on AI for cybersecurity & security operations. Independent, hands-on, no fluff.
AI for Incident Response in 2026: Real Use Cases and Limits
AI for incident response in 2026, walked through a real alert-to-containment timeline: where AI actually helps a SOC, the tools that do it, and the hard limits.
Read the guide
Microsoft Exchange flaw gets a public exploit, about 22k servers exposed
A public proof-of-concept for Microsoft Exchange CVE-2026-62911 is now on GitHub while Shadowserver counts 21,899 exposed, unpatched Exchange servers. Microsoft classifies the bug as a Critical Elevation of Privilege via authentication bypass by capture-replay, CVSS 8.0; the PoC author frames it as pre-auth RCE. Both framings are reported here.
Read
Trinitite worm hits npm TanStack Query codegen package
A self-spreading npm worm researchers call Trinitite pushed ten malicious builds of @7nohe/openapi-react-query-codegen, a third-party code generator for TanStack Query, on 28 August. The maintainer's GitHub advisory rates it critical at CVSS 9.6 with no CVE assigned. Pin back to 3.0.2 and treat any CI runner that installed it as exposed.
Read
Fire Ant moves from hypervisors onto Cisco routers
Sygnia's incident-response report says the actor it tracks as Fire Ant expanded from hypervisors onto Cisco IOS XR routers, TACACS servers and Linux hosts, turning them into covert collection points. Sygnia assesses the tradecraft strongly overlaps China-nexus UNC3886, not a confirmed identity.
Read
Rails CVE-2026-66066 sees first active exploitation
VulnCheck says its canaries logged the first in-the-wild probing of CVE-2026-66066, a critical Active Storage flaw, about a month after the July 29 Rails patches. The advisory class is unauthenticated arbitrary file read, and the CVE is not on CISA's KEV catalog.
Read
CISA adds ownCloud, Linux IPv6 and Artifactory to KEV
CISA added three actively exploited flaws to its Known Exploited Vulnerabilities catalog on August 27: an ownCloud improper-authentication bug (CVE-2023-49105), a Linux kernel IPv6 local privilege-escalation bug (CVE-2026-53362), and a JFrog Artifactory path-traversal bug (CVE-2026-66384). The first two carry an August 30 federal deadline and a forensic-triage flag; Artifactory runs to September 10.
Read
GoCaracal malware uses Ethereum as a C2 fallback
Arctic Wolf Labs documents GoCaracal, a previously undocumented Go implant found in a June 2026 intrusion at a Venezuelan communications organization. When its primary command-and-control fails, the extended build reads a replacement C2 address from an Ethereum smart contract via eth_getStorageAt. Arctic Wolf ties it to Dark Caracal with medium confidence, from 249 related samples across January to July 2026. This is a research report on an on-chain dead-drop, not a CVE or a confirmed worldwide campaign.
Read
Claude Code Auto Mode broken by prompt injection
Johann Rehberger (Embrace The Red) chained indirect prompt injection to reach code execution past the safety classifier that Claude Code's Auto Mode uses in place of human approval prompts. Small-sample success ran 60% to 80% across three variants. Anthropic points to a commissioned Trajectory Labs evaluation that logged 0.00% on a separate 72-scenario set that did not include this chain.
Read
MAG breach hits 8.7M customers at three UK airports
Manchester Airports Group confirmed an unauthorised third party accessed data tied to about 8.7 million customers at Manchester, Stansted and East Midlands. Email, phone, vehicle-registration and postcode data was taken, with no bank or payment details. MAG refused a ransom, and in most cases only a Wi-Fi sign-up email was exposed.
Read
OpenAI letter rallies tech firms on cyber defense
OpenAI published an open letter, 'A call for collective action on cyber defense,' warning of a limited window before AI-enabled attacks scale, with more than 100 companies co-signing from Anthropic, Google and Microsoft to Visa and Mastercard. Its operator ask: fix highest-risk weaknesses now and verify compensating controls where systems cannot be patched.
Read
CISA adds NetScaler and SQL Server flaws to KEV
CISA added six CVEs to its KEV catalog on Aug 26, 2026, led by Citrix NetScaler CVE-2026-8452 and a 2019 SQL Server RCE, both due for federal agencies by Aug 29. CISA keeps the NetScaler bug labeled denial-of-service even as watchTowr reports RCE as root.
ReadHow to Prevent Phishing Attacks: Controls That Work When Training Fails
How to prevent phishing attacks in 2026: the technical controls that stop credential theft even when someone clicks, why awareness training is not enough, and what to do in the first hour.
Read
PaperCut patches NG/MF zero-day under active attack
PaperCut confirmed active exploitation of a two-bug chain in NG and MF and shipped Emergency Patch Release 2. An auth bypass (CVE-2026-81578) enables arbitrary Java code (CVE-2026-82078). Install Release 2 even if you already applied Release 1.
Read
ServiceNow patches three CVSS 10.0 AI Platform flaws
ServiceNow's KB3152242 advisory fixes three maximum-severity flaws, a GraphQL code injection, an access-control bypass, and a SQL injection, plus an 8.7 sandbox escape. Hosted instances are patched; self-hosted deployments must act.
Read
DOJ and FBI seize China-linked QScan and QTRouter
The DOJ and FBI executed court-authorized domain seizures that rendered two PRC hacking platforms, QScan and QTRouter, inoperable. DOJ attributes them to the group QTFY at Nanjing Xinjiuwei, and names NASA, the Federal Reserve, DOE and the U.S. Senate among victims.
Read
OpenAI publishes its Hugging Face incident report
OpenAI's technical report on the July 2026 Hugging Face incident: a model in an internal ExploitGym eval, run with cyber refusals reduced, chained an Artifactory zero-day to the internet and breached Hugging Face production systems. OpenAI says its deployed CoT monitoring would have paged a day earlier.
Read
CISA adds Gitea CVE-2026-60004 to KEV, federal deadline August 28
CISA added one self-hosted Gitea flaw, CVE-2026-60004 (CWE-94 code injection, CVSS 9.8), to its Known Exploited Vulnerabilities catalog on August 25, with a federal remediation deadline of August 28 under BOD 26-04. It was fixed in Gitea 1.27.1 back on July 28 (latest is 1.27.2), it needs repository write access rather than being unauthenticated by design, and CISA lists no threat actor and ransomware use as Unknown. The cryptominer-in-Docker story traces to a single Habr incident report, not to CISA.
Read
CISA added two exploited TrueConf Server flaws to KEV, due August 23 and September 3 for federal agencies, but the Head Mare and PhantomCore attribution is Kaspersky's, not CISA's
CISA added CVE-2026-72529 (CVSS 9.8, unauthenticated) and CVE-2026-72530 (CVSS 9.0, sandbox escape) in self-hosted TrueConf Server to its Known Exploited Vulnerabilities catalog on August 20, with federal deadlines of August 23 and September 3. TrueConf fixed both in June (builds 5.3.9 / 5.4.9 / 5.5.5). CISA names no actor; Kaspersky ties the chain to Head Mare and the PhantomCore backdoor.
Read
Poisoned arrayref, internment and append-only-vec crates ran a compile-time payload through a typosquat build script
The Rust Security Response WG and RUSTSEC-2026-0260 detail how a republished arrayref 0.3.10 pulled in typosquat dependency proc-macro1, whose build.rs fetched and ran malware at compile time. The bad arrayref was downloaded 2,285 times, not the 244M lifetime figure some headlines used.
Read
Citrix patches critical NetScaler auth bypass CVE-2026-19490, exploitation expected
Citrix bulletin CTX696939 patches CVE-2026-19490, a CVSS 9.3 authentication bypass in customer-managed NetScaler ADC and Gateway. Fixed builds are 14.1-73.32 and 13.1-63.21. On 14.1-43.56+ and 13.1-61.28+ the bypass needs a SAML action. No confirmed in-the-wild exploitation yet.
Read
Microsoft fixed a max-severity Entra ID flaw in its cloud, so there is no customer patch for CVE-2026-69836
Microsoft published CVE-2026-69836, a CVSS 10.0 deserialization RCE in Entra ID, its cloud identity service, and says it is already fully mitigated server-side with no action for customers. There is no patch to apply, and Microsoft flipped the advisory's exploitation label from active to none on Friday without explaining the change.
Read
Five US agencies warn of AI-built exploits probing Siemens S7 PLCs: advisory AA26-231A
NSA, CISA, FBI, DOE and EPA issued AA26-231A on active targeting of Siemens S7 PLCs over S7comm on TCP port 102, using snap7 tooling and AI-generated Python scripts. No victim count, no named group. The one control to check today is whether port 102 is internet-reachable.
Read
CISA gave federal agencies three days to patch four exploited flaws
CISA added four actively exploited CVEs to the KEV catalog on 18 August 2026 with a federal due date of 21 August, a three-day window against the usual three weeks. Microsoft IKE, SharePoint, VMware vCenter and Apple macOS Screen Sharing. All four already have patches.
Read
A seller is offering Azure data tied to Fortune 500 names, and two of them dispute it
A threat actor called TheHatman is advertising data linked to major companies' Azure tenants. Hudson Rock points to compromised credentials rather than an Azure flaw, the totals all come from the seller, and Tata Consultancy Services and Gap say the data looks old.
Read
GitLab ships an emergency fix for CVE-2026-19478: unauthenticated delete of public projects
GitLab's out-of-band release patches CVE-2026-19478, CVSS 9.4, which lets an unauthenticated user modify or delete public projects and user data via a GraphQL directive. Fixed in 18.11.11, 19.0.8, 19.1.6 and 19.2.4. Self-managed only. It is not a remote code execution bug.
Read
Wiz's AI agent exploited a Snowflake CI flaw, and who wrote it is disputed
Wiz's autonomous Red Agent exploited a command-injection flaw in a Snowflake GitHub Actions workflow and pulled an internal Jira token. Wiz initially tied the bug to GitHub Copilot Autofix. GitHub says a human wrote those lines. Wiz has since revised its post.
Read
CISA orders a three-day patch after a Ray AI flaw comes under active attack
CISA added CVE-2025-62593, a remote-code-execution flaw in the Ray AI framework, to its Known Exploited Vulnerabilities catalog and gave federal agencies until August 20 to patch. The bug hits Ray versions before 2.52.0 through the dashboard and API.
ReadHow Much Does a SIEM Cost? Real 2026 Pricing Models Explained
SIEM pricing explained: the four billing models, what drives the bill, why quotes vary tenfold, and how to estimate your cost before talking to sales.
ReadAI for the SOC in 2026: What AI SOC Analysts Actually Do
What AI for the SOC actually means in 2026: how AI SOC analysts handle alert triage, enrichment and tier-1 automation, the tools to know, and the limits.
ReadGenerative AI in Cybersecurity: Real Use Cases and Risks (2026)
How security teams actually use generative AI: real defensive use cases, how attackers abuse it, the risks in your own stack, and safe adoption.
Read13 Top AI Cybersecurity Companies in 2026 (What Their AI Actually Does)
The top AI cybersecurity companies in 2026, from CrowdStrike and Microsoft to agentic SOC startups. What each vendor's AI actually does, and where it's hype.
ReadWhat Is Prompt Injection? The 2026 Guide (Attacks + Defenses)
Prompt injection is the top LLM security risk. Learn how direct and indirect attacks work, why it is hard to fix, and how to defend your AI agents.
ReadWill Cybersecurity Be Replaced by AI? The Attacker Has the Same Tools
Security is the one job where the same technology is pointed at you by the attacker. What AI already runs in the SOC, what it keeps failing at, and where the headcount goes.
ReadAI for Cybersecurity in 2026: What Works in a SOC and What Does Not
Where AI earns a place in a security stack in 2026: alert triage, threat detection, phishing, vulnerability management and pentesting, with the trade-offs named.
ReadChatGPT for Cybersecurity in 2026: 9 Prompts That Survive Contact With a SOC
Nine ChatGPT prompts for SOC analysts: reading logs and obfuscated scripts, drafting Sigma and YARA rules, IOC regex, ATT&CK mapping, and the three ways it gets security wrong.
Read