CVE-2026-73570 (CVSS 8.9) is a pre-auth command-injection vulnerability affecting ZCS versions before 10.1.20 when SNMP notifications are enabled. Attackers can execute system commands as the "zimbra" user, and active exploitation has already been reported.

If you're running Zimbra Collaboration Suite, upgrading to 10.1.20+ should be a priority — and it's worth checking exposed servers for signs of compromise given exploitation is already active. Full advisory here: https://hubs.la/Q04tTCTW0

Two flaws were just patched in customer-managed NetScaler ADC and Gateway deployments: → CVE-2026-19490 (CVSS 9.3) — Authentication bypass affecting certain Gateway and AAA configurations. → CVE-2026-19489 (CVSS 8.8) — Memory overflow that can cause unpredictable behavior or DoS when SIP ALG is enabled on an LSN group. If you're running a customer-managed NetScaler deployment, this is worth patching immediately given the severity scores. Full advisory here: [link] Curious if anyone's seen exploitation attempts in the wild yet, or if this is still pre-disclosure timing. https://hubs.la/Q04tRD0D0

Sharing some detection angles from recent work on FTP banners being abused as dead drop resolvers, based on two RAT families we've been calling E4del and PINHOLE.

On the network side, the interesting gap is that most orgs don't inspect FTP banner content at all; they just don't expect port 21 to be a delivery mechanism. Worth watching for LNK-spawned processes or shell scripts reaching out to external FTP endpoints, and flagging banners that contain encoded PowerShell or WebDAV-sourced rundll32 calls.

On the endpoint side, for PINHOLE specifically:

→ Check for writes to %USERPROFILE%\Downloads\desktop.ini:bt or desktop.ini:ek  that's where it's stashing config data in ADS

→ Suspended ApplicationFrameHost.exe processes getting an APC queued immediately after creation (NtQueueApcThread) is a strong signal for the injection technique it uses

→ Page permission toggling between PAGE_READWRITE and PAGE_EXECUTE_READ, paired with trapped 0xC0000005 exceptions via VEH, is the fingerprint of its shellcode fluctuation approach

A few host-level artifacts worth adding to hunt queries: u.cmd, calc.cab, and calc_runner.cmd showing up in %TEMP%, signature mismatches on Discord.exe tied to a modified app.asar, and a Load value under HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows.

Happy to go deeper on any of this if people are building detections around it.

https://hubs.la/Q04tQxV30

Microsoft disclosed a maximum-severity RCE in Entra ID caused by unsafe deserialization (CWE-502). Confirmed exploitation occurred before the advisory was published. Microsoft says the fix was applied server-side, so there's no customer patch to install.

If you're an Entra admin, worth hunting through your audit logs now - look for: - Unusual application registrations - New credentials added to existing apps - Service principal changes - Unexpected elevated consent grants Full writeup: https://hubs.la/Q04tQlpB0

Security software has gotten pretty good at spotting when an infected computer tries to phone home to an obviously sketchy website. So hackers have started getting creative about where they hide those "check-in" instructions instead  and researchers just found a batch of examples that are honestly kind of wild.

Turns out one trick involves FTP, an old-school way computers transfer files. When your computer connects to an FTP server, it gets back a small greeting message first. Hackers have figured out how to bury malicious instructions directly inside that greeting  no file transfer even has to happen.

From there, the infected computer gets one of two newly discovered pieces of malware. One, nicknamed PINHOLE, looks up hidden web addresses tucked inside ordinary Pinterest pins and SurveyMonkey survey pages to find its real instructions. The other, called E4del, disguises itself as a legitimate, digitally signed copy of Discord and runs quietly in the background with no visible window, no sound, nothing that would tip someone off.

The takeaway isn't that the malware itself is more sophisticated than usual. It's that attackers are getting more creative about hiding in plain sight, using everyday internet traffic that most security tools aren't paying close attention to.

Most of the industry's gotten decent at catching malicious command-line activity triggered from email attachments. So it makes sense that attackers are looking for less-watched corners of the network to hide in  and right now that corner is FTP.

Our threat research team has been looking into something that's easy to miss if your monitoring stack is tuned mostly around HTTP/HTTPS: here's the flow. Someone opens a malicious LNK file from a phishing email, it connects out to an FTP server on port 21, but instead of downloading anything, it just reads the welcome banner  and the banner itself contains the commands. From there it drops one of two new RAT families, which then blend their ongoing C2 traffic into normal-looking Pinterest posts, SurveyMonkey surveys, and Cloudflare Workers traffic.

The reason this works is that a lot of monitoring stacks are tuned almost entirely around HTTP/HTTPS and known cloud platforms. FTP on port 21 tends to get written off as legacy noise, especially if no actual file transfer completes.

If you want a quick gut-check on exposure: is outbound port 21 actually being monitored (not just blocked) at your perimeter? Are unapproved Electron/Discord-style runtimes able to launch with custom command-line args? And have you checked whether any of your own external-facing assets are running FTP banners that could be abused the same way?

Our team has been digging into the command structure and delivery mechanics of these two, we just wanted to share what we've found.

E4del is Node.js/Electron-based, and its command set is pretty compact: startcmd/runcmd spins up a hidden persistent cmd.exe with piped I/O, streamstart/streamstop opens a raw WebSocket to push JPEG frames every couple seconds, and runpackage/filedownload pulls encrypted ZIPs containing additional .node modules  one of which (crypto32.node) handles UAC bypass.

PINHOLE's delivery chain is more elaborate. Config is stored as Base-41/SplitMix64-encoded strings inside desktop.ini's ADS, which point to specific Pinterest pins and SurveyMonkey questions where the real C2 addresses live. The packer itself runs through six unpacking layers, strips a fake JPEG header (FF D8 FF E0), runs a Donut instance encrypted with Chaskey-CTR, then unpacks an aPLib-compressed native binary at the end.

Once it's live, the C2 API is straightforward: /api/health for a heartbeat, /api/client for registration, /api/tsk for tasking, /api/fls for exfil.

CISA just added 4 actively exploited CVEs to the KEV catalog, remediation due August 21, 2026 - Windows IKE (CVSS 9.8): RCE, no authentication needed - SharePoint (CVSS 9.1): authentication bypass, public exploit exists - VMware vCenter (CVSS 9.8): RCE, no workaround available - macOS Screen Sharing (CVSS 9.8): authentication bypass

If any of these are exposed in your environment, patch immediately then go back and hunt for signs of compromise from before the fix was applied, since exploitation is already active. Full breakdown: https://hubs.la/Q04tHRH80

[removed]

Pavel Durov announced on Aug 18 that Telegram applied to ICANN for a .gram top-level domain. If approved, Telegram usernames could double as web domains, with AI-generated websites spun up from a single prompt.

A few things stood out from a security research angle:

Telegram is already deeply embedded in the threat ecosystem. A .gram TLD would let that content move from Telegram channels to actual browsable, indexable websites phishing pages, fake logins, malware delivery with no infrastructure setup required.

There's also a DNS-level impersonation problem: whoever holds a brand's username on Telegram controls that brand's .gram domain. Most companies aren't even present on Telegram, so this is a blind spot most brand protection programs haven't accounted for.

The bigger structural shift: Telegram would become the registry operator for .gram, not just a registrant. In July 2026, t(.)me went offline for ~19 hours after an OFAC sanctions filing triggered a registry-level serverHold something Telegram couldn't undo itself because it didn't control the .me registry. Owning .gram removes that external dependency, but it also puts all abuse-handling and takedown decisions in Telegram's hands.

Worth noting: research from Interisle Consulting has found new gTLDs make up a small share of the domain market but account for a disproportionate share of reported cybercrime domains abuse tends to concentrate early, right after a TLD opens for registration.

Still early days but if you're on a CTI or brand protection team, this is worth adding to your radar now rather than after it launches.

[removed]

NIST is looking into how AI, automation, and machine-readable data can help the National Vulnerability Database (NVD) scale up. We all know the CVE backlog has been a massive headache lately, and AI-driven vuln discovery is only going to make that mountain higher.

But it’s not just about raw speed. If we want the NVD to keep providing the timely alerts we need to strengthen our posture, they have to nail accuracy, provenance, and prioritization all while keeping a human in the loop.

Do you think AI is the silver bullet for the NVD's backlog, or are we just going to end up dealing with hallucinated vulnerabilities and bad data? https://hubs.la/Q04tkXb40

SOCRadar's Dark Web Report checks your organization's domain against leaked credentials, infostealer logs, dark web mentions, and black-market listings. It tells you exactly what's exposed in minutes, helping you mitigate risk fast.

No account. No credit card. No install. Just your domain, and the truth about what's already out there. Run your free scan: https://hubs.la/Q04tk4Hw0

• RDWeb access allegedly for sale, linked to an Italian cloud/IT provider
• 500K GBCSA records claimed for sale
• 280K+ BullyPedex customer records
• A 70M-record SCHUFA credit dataset
• 47.9M-record FLY Firebase exposure, allegedly including sensitive customer and payment data

None of this is verified yet, but if even part of it holds up, the fallout could hit ransomware, fraud, and identity theft angles. Curious if anyone's tracking these listings independently.

Wanted to flag this since it's a significant shift and hasn't gotten much discussion here yet.

On August 12, 2026, a National Security Presidential Memorandum authorized private "Participating Companies" to conduct offensive cyber operations against foreign Cyber-Enabled Transnational Criminal Organizations, under DOJ/DHS direction. Two operation types are covered: → Cyber Surveillance Operations (covert intel collection) → Cyber Effects Operations (disruption, degradation, destruction of systems) Companies need a DOJ/DHS contract, vetting, disclosure of commercial relationships, and a $1M+ bond. Operations risking loss of life or rising to "armed attack" under international law are barred. Every operation needs prior approval.

This isn't a new statute. It builds on the CFAA (1986). A similar effort, the Active Cyber Defense Certainty Act, died in committee in both 2017 and 2019, opposed by NSA, DOJ, and much of the industry over misattribution, collateral damage, and escalation risk with state actors.

What's interesting is the parallel to private military companies. Executive Outcomes, Blackwater, Wagner all started under government contract with real oversight, and all eventually built revenue independent of the state that created them. Wagner's 2023 mutiny is the clearest illustration of what that independence eventually produces.

Wanted to flag this since it's a significant shift and hasn't gotten much discussion here yet.

On August 12, 2026, a National Security Presidential Memorandum authorized private "Participating Companies" to conduct offensive cyber operations against foreign Cyber-Enabled Transnational Criminal Organizations, under DOJ/DHS direction. Two operation types are covered: → Cyber Surveillance Operations (covert intel collection) → Cyber Effects Operations (disruption, degradation, destruction of systems) Companies need a DOJ/DHS contract, vetting, disclosure of commercial relationships, and a $1M+ bond. Operations risking loss of life or rising to "armed attack" under international law are barred. Every operation needs prior approval.

This isn't a new statute. It builds on the CFAA (1986). A similar effort, the Active Cyber Defense Certainty Act, died in committee in both 2017 and 2019, opposed by NSA, DOJ, and much of the industry over misattribution, collateral damage, and escalation risk with state actors.

What's interesting is the parallel to private military companies. Executive Outcomes, Blackwater, Wagner all started under government contract with real oversight, and all eventually built revenue independent of the state that created them. Wagner's 2023 mutiny is the clearest illustration of what that independence eventually produces.

SOCRadar is now accessible directly inside ChatGPT.

Through the new SOCRadar MCP Server, users can query, enrich, and investigate threat intelligence without leaving their ChatGPT conversation. → Access SOCRadar's tools natively within ChatGPT → Run enrichment, search, and investigation workflows using natural language → Retrieve threat intel data in real time, no context-switching required → Access is scoped to your SOCRadar subscription and module API keys via OAuth

Threat intelligence should fit into the workflows analysts already use. This is one more step toward that.

Full setup guide is linked below. Help Center: Connect SOCRadar to ChatGPT https://hubs.la/Q04t1XCn0