Claude Mythos is the first model reported to complete a cyber kill chain without step-by-step human direction. The finding does not describe malware or a confirmed victim breach. It is a controlled test, but shows how quickly autonomous attack capability is advancing.

The concern is speed. The model found weaknesses, entered a defended enterprise network, collected credentials, raised privileges, moved between systems and reached domain administrator control.

Those are stages defenders try to interrupt during an intrusion. GitHub hosts projects and discussions using the Claude Mythos name, but did not identify a malware campaign.

The finding comes from Booz Allen’s assessment of autonomous models. It is a benchmark result, not evidence of a named program independently attacking organizations.

Booz Allen said in a report shared with Cyber Security News (CSN) that it tested 18 U.S. and Chinese models as autonomous attackers against a production-grade enterprise network. Researchers used network and host telemetry to measure actions, rather than accept model claims.

Claude Mythos AI Autonomously Executes Full Cyber Kill Chain

The Cyber Weapon Index gave Claude Mythos an 80 score, combining 74 for vulnerability research and 86 for kill-chain attainment.

It was the only model assessed as reaching the final objective. Researchers said it moved from a stolen employee credential to administrator-level control in every credentialed attempt.

The harder scenario began with no credentials. The report says Claude Mythos penetrated from outside and worked out how to raise its access, instead of following a fixed plan.

The reported autonomous AI agent breach illustrates why this development has drawn attention. The test examined whether models could spot weaknesses in compiled software without source code.

Only frontier Anthropic models identified the previously unseen flaw used in testing, and only Claude Mythos reportedly exploited it. The result is from a defined setting, not proof of universal performance.

Other models showed progress without matching the full outcome. Four reached domain access and control, four achieved lateral movement, and two reached credential access.

All but one penetrated the network autonomously. An attacker need not finish every stage alone to cause disruption or give a human operator a head start.

Defenders face a speed problem

The report argues that risk lies in the entire AI system, not only its model. An attack harness can link a model with tools, memory, feedback and an execution environment.

This helps an agent retain context, recover from errors and connect tasks, as seen in agents breaching company networks.

A model that stops short alone can become more effective with automation, tailored prompts and operational tools. The report found that a harness paired with Claude Sonnet could rival Claude Mythos. A public model score, therefore, can leave serious blind spots.

The likely entry routes are familiar: exposed services, unpatched flaws, stolen credentials and weak access controls.

AI reduces the time and expertise needed to test options, analyze results and adapt. AI agents rebuilding attack tools illustrate how persistence after failure can amplify this advantage. The recommended response is to assume an initial foothold and restrict what happens next.

Organizations should connect vulnerability management, detection, containment and response; enforce least privilege, strong identity checks, segmentation and isolation of high-value systems; and test containment while keeping services running.

Teams should test safeguards in deployed configurations, including tool permissions and autonomy levels. The report recommends continuous measurement of models and surrounding systems, plus controlled access for vetted defenders to reproduce threatening behavior.

This exceeds paper compliance when attack methods change quickly. The headline is not that an AI model has become a criminal actor. A controlled assessment found one system capable of completing a realistic sequence of offensive tasks.

The gap between early access and full compromise may be narrowing, making patching, identity protection and segmentation urgent. Related AI-driven government system breaches show why coordinated automation needs preparation.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Claude Mythos AI Autonomously Executes Full Cyber Kill Chain Without Human Guidance appeared first on Cyber Security News.

A new intrusion campaign shows how quickly a Windows domain can be turned into a launchpad for deeper compromise. The operators used a Sliver command-and-control beacon, account creation, credential theft and remote administration to establish control after gaining an initial foothold.

The activity was staged from an exposed server and aimed at one unnamed US organisation. Its scripts were built for a real Active Directory environment, including a planned rollout across 18 hosts, while the recovered material contained no proof that ransomware was deployed in this specific incident.

Analysts at The Hunter’s Ledger identified the operation as a high-risk post-exploitation toolkit and tracked it as UTA-2026-024.

The research ties the infrastructure to a confirmed ransomware incident, but does not name the people behind this intrusion or conclude that they deployed an encryptor.

The Hunter’s Ledger said in a report shared with Cyber Security News (CSN) that the operators combined ordinary public tools with unusually detailed knowledge of the victim’s network.

The result was a durable access package designed to disable safeguards, steal credentials and keep its control channels available.

Hackers Disable Endpoint Protection

After entering the domain, the operators scripted the creation of an Active Directory account with a non-expiring password and added it directly to Domain Admins.

They also created a local administrator, enabled Remote Desktop Protocol access, and turned off Network Level Authentication, expanding the paths available for later movement.

The scripts stopped and disabled eight services associated with the victim’s endpoint protection product, then checked each service state.

They also collected the SAM, SYSTEM and SECURITY registry hives for offline password cracking, while a separate LSASS memory dump and Mimikatz supplied additional routes to credentials.

A central concern is the campaign’s persistence. Scheduled tasks ran as SYSTEM, used forged author details and included backdated registration dates.

One weekly task downloaded the latest attack chain without saving a fixed payload, a tactic similar to remote scheduled task delivery in EtherRAT attacks.

The team also manipulated the victim’s DNS content filter through its administrative interface. It added the attackers’ domain to an allowlist and placed a matching record in internal DNS, making the domain resolve internally and pass the same security control intended to block it.

This approach mirrors a broader pattern in Windows intrusions, where trusted administrative features become the delivery system after access is obtained.

Recent reporting on fake installer campaigns disabling Defender also showed attackers using installer workflows and scheduled tasks to weaken controls before maintaining access. In both cases, the danger is not a single tool but the sequence of actions surrounding it.

Blockchain C2 Complicates Response

Alongside Sliver, the toolkit used a Node.js implant that obtained its command server from an Ethereum smart contract.

The first domain recorded in that contract was the same one inserted into the victim’s DNS configuration, directly connecting the two seemingly different parts of the operation.

The contract changed domains five times over five months, making simple domain blocks short-lived. Yet the contract itself stayed unchanged and publicly readable, giving defenders a better tracking point.

The related beacon also contacted its main server every 60 seconds with no measured timing variation, a useful signal for network hunting.

The recommended response is to reset credentials across the affected domain, not solely for known accounts; review privileged-group additions and SYSTEM tasks; restore the DNS allowlist; rotate the filter administrator password; and remove planted internal DNS entries.

Teams should also look for RDP enabled with Network Level Authentication disabled and monitor the contract for later C2 changes. Security teams should favor behavior over broad signatures for public tools.

Baseline scheduled tasks, alert on fileless download commands running as SYSTEM and review sudden endpoint-protection service changes.

Readers examining related Windows tradecraft can compare Sliver implant activity targeting Germany and ransomware SYSTEM task abuse, which show how familiar components can be chained into an enterprise-wide incident. The pattern deserves sustained, careful attention.

Indicators of compromise (IoCs):-

Type	Indicator	Description
IPv4 address	193.233.202.17	Primary Sliver command-and-control and staging-server address
IPv4 address	77.110.126.46	Hardcoded third-tier fallback address, designated hunt-only
IPv4 address	146.103.127.44	Historical operator-used address from April 2026, designated monitor-only
Domain	publisherresolution.com	First C2 domain written to the Ethereum resolver contract
Domain	resumeacceptable.com	Historical Ethereum resolver C2 domain
Domain	simultaneouslypower.com	Historical Ethereum resolver C2 domain
Domain	wiselystarting.com	Historical Ethereum resolver C2 domain
Domain	itemrange.com	Most recently recorded Ethereum resolver C2 domain
URL	https://publisherresolution.com	Ethereum resolver contract value
URL	https://resumeacceptable.com	Ethereum resolver contract value
URL	https://simultaneouslypower.com	Ethereum resolver contract value
URL	https://wiselystarting.com	Ethereum resolver contract value
URL	https://itemrange.com	Ethereum resolver contract value
URL	http://193.233.202.17:42718/task_39.ps1	Fileless PowerShell download location used by the persistence task
File name	svcload.exe	Modified PrintSpoofer derivative
File name	ws35.exe	Reverse-shell sample containing the fallback address
File name	ws36.exe	Reverse-shell sample containing the fallback address
File name	ws37.exe	Reverse-shell sample containing the fallback address
File name	ws_3srv.exe	Reverse-shell sample containing the fallback address
File name	task_39.ps1	PowerShell payload retrieved by the scheduled task
File name	slv_beacon_sc.bin	Sliver beacon shellcode payload
Smart contract	0xb3f2897f2bc797e5b9033faef8c81e92b01cb831	Ethereum contract used to resolve the Node.js implant’s C2 location
MSI UpgradeCode	{B3D67F25-0E3A-4B6B-965C-2C7610958983}	Stable installer identifier observed in the MSI package
User-Agent	Chrome/108.0.6602.492	Hardcoded malformed User-Agent associated with the campaign’s request profile

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Disable Endpoint Protection and Deploy Sliver Across Compromised Windows Domain appeared first on Cyber Security News.

A proof-of-concept zero-click worm dubbed “WeWorm” that it says can spread through WeChat voice calls on both iOS and Android, compromising a target’s WeChat account in seconds without the victim answering the call.

Calif says the bug was reported to Tencent in July and that Tencent has since mitigated the exploit for users, but the research still serves as a stark warning about how mobile messaging apps can become wormable attack surfaces at planetary scale.

WeChat is not a niche target. Tencent says Weixin and WeChat together exceeded 1.4 billion monthly active users as of the end of Q1 2026, while WeChat’s own site describes the platform as serving over 1 billion users with chats and calls across major mobile and desktop platforms.

That sheer reach is what makes Calif’s demonstration so alarming: a memory-corruption flaw in the app’s VoIP stack is not just another messaging bug, but a potential entry point into one of the world’s most deeply embedded communications ecosystems.

According to Calif’s public research listing, WeWorm is described as “the first zero-click worm to spread through WeChat calls across iOS and Android,” and it was published on September 8, 2026, as part of the company’s Android-tagged research work.

Calif frames the finding not as a theoretical edge case but as a live demonstration of how a trusted messaging relationship can be weaponized, with one compromised contact becoming the launch point for attacks against everyone in that person’s social graph.

The company’s demo chain reportedly used three phones to prove cross-platform propagation. A Pixel 10a was used as the initial attacker device, which then called an iPhone 17e and exploited the flaw while the call was still ringing; the compromised iPhone was then used to call another Pixel 10a, which was reportedly taken over in the same way.

In practical terms, that is the textbook definition of a wormable condition in a communications app: the attacker calls the victim, the victim becomes the attacker, and the infection path continues with almost no friction.

What makes the scenario especially dangerous is the “zero-click” aspect. Calif says the victim does not need to answer the call or interact with the phone at all for exploitation to succeed, and even if the person does answer, they hear nothing while the compromise still goes through.

That claim places WeWorm in the most feared class of mobile exploits, where normal user caution offers little protection because there is no malicious link to avoid and no attachment to reject.

Calif also says exploitation yields full control of the victim’s WeChat account, including the ability to read and send messages, place calls, and act on the user’s behalf inside the app.

On its own, account takeover at that level would already be severe for identity abuse, surveillance, fraud, and lateral targeting; chained with additional device-level bugs, Calif says the same access could be extended to full control of the underlying Android or iOS device.

The company specifically links that possibility to its broader AI-assisted exploit research, including Android work such as OEMpocalypse, which it has presented as a path from app-level access to root on several vendor ecosystems.

One condition slightly narrows the attack surface: the attacker must already be on the victim’s friend list. But Calif argues that this is a weak barrier in real-world conditions because once a single trusted contact is compromised, that person’s account can be used to reach additional friends, turning the victim’s social trust network into the worm’s propagation layer.

That is a familiar and troubling pattern in modern communications security, where safety features and trust assumptions designed for convenience can become force multipliers once an adversary gets an initial foothold.

The technical root cause, Calif says, is a memory-corruption bug in WeChat’s VoIP stack, though the company is withholding full exploit details until a later conference presentation.

That restraint matters because memory-corruption flaws in real-time communications code are among the most sensitive bug classes in mobile security, especially when they sit inside call-handling paths that process network data before a user takes any action.

Calif further suggests that this bug is only one example of a broader class of “unconventional attack surfaces” spread across messaging apps, hinting that similar issues may exist in other platforms with rich calling and media features.

WeWorm may be a demo, but its significance is real. Calif has effectively shown that mobile messaging worms are no longer a distant nightmare or a plot device for conference talks; they are a practical research outcome in 2026, built against one of the world’s largest communications platforms and developed at AI speed.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post WeWorm – First 0-Click Worm Spreading Through WeChat Calls Across iOS and Android appeared first on Cyber Security News.

SAP has released its September 2026 Security Patch Day updates, delivering 19 new security notes and one update to a previously issued note.

The patches address vulnerabilities across SAP NetWeaver, SAP Extended Passport Processing, SAP Cloud Application Programming Model, SAP S/4HANA, SAP Integration Suite, SAP Commerce Cloud, and other enterprise products.

The most severe issue is CVE-2026-44756, a critical memory corruption vulnerability in SAP Extended Passport Processing, tracked under SAP Note 3747649. It carries a CVSS score of 10.0, the highest possible severity rating.

The flaw affects multiple SAP kernel and Web Dispatcher versions, including KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, and 9.16 through 9.20.

An unauthenticated remote attacker could potentially exploit the memory corruption flaw to compromise confidentiality, integrity, and availability. Organizations using affected SAP kernel components should treat this update as an emergency patching priority.

Another critical vulnerability, CVE-2026-58240, affects SAP NetWeaver Message Server. SAP Note 3759472 addresses a missing authentication check with a CVSS score of 9.8. The issue affects KERNEL versions 9.16, 9.18, 9.19, and 9.20.

Successful exploitation could allow an attacker without valid credentials to access or interact with exposed services, creating a serious risk to SAP environments.

SAP Security Updates September 2026

SAP also fixed CVE-2026-76969, a critical credential disclosure vulnerability in multitenant applications using the SAP Cloud Application Programming Model library sap/cds-mtxs.

The flaw has a CVSS score of 9.4 and affects versions up to 1.18.3, 2.7.6, 3.9.6, and 4.0.2. Developers and cloud administrators should update affected dependencies quickly, especially where they handle tenant data and application credentials.

A fourth critical issue, CVE-2026-66768, impacts SAP GUI for Java in SAP NetWeaver. The improper access control vulnerability, fixed by SAP Note 3781729, has a CVSS score of 9.0. It affects BC-FES-JAV 8.10 and could allow a low-privileged attacker to gain unauthorized access after user interaction.

The September release also includes high-severity fixes, including CVE-2026-76958, an 8.5-rated XXE flaw in SAP Integration Suite Trading Partner Management that could expose sensitive files, enable server-side requests, or disrupt XML processing.

SAP patched insecure deserialization in SAP NetWeaver Business Client, memory corruption in SAP NetWeaver Application Server for ABAP and ABAP Platform, and CRLF injection in SAP Commerce Cloud Search and Navigation.

The company also released an update for CVE-2026-58243, a high-severity privilege escalation flaw in SAP ABAP Developer Tools originally addressed during the August 2026 Patch Day.

SAP Note	CVE	Vulnerability	Affected product/versions	Priority
3747649	CVE-2026-44756	Memory corruption	SAP Extended Passport (EPP) Processing KRNL64NUC: 7.22, 7.22EXT; KRNL64UC: 7.22, 7.22EXT, 7.53, 8.04; WEBDISP: 9.16, 9.18, 9.19, 9.20; KERNEL: 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, 9.20	Critical
3759472	CVE-2026-58240	Missing authentication check	SAP NetWeaver Message Server KERNEL: 9.16, 9.18, 9.19, 9.20	Critical
3798315	CVE-2026-76969	Credential disclosure in multitenant CAP applications	SAP CAP library sap/cds-mtxs Versions: ≤1.18.3, ≤2.7.6, ≤3.9.6, ≤4.0.2	Critical
3781729	CVE-2026-66768	Improper access control	SAP NetWeaver SAP GUI for Java BC-FES-JAV: 8.10	Critical
3772411	CVE-2026-58243	Privilege escalation — updated August note	SAP ABAP Developer Tools SAP_BASIS: 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 918, 920	High
3792978	CVE-2026-76958	XML External Entity (XXE)	SAP Integration Suite Cloud Integration – Trading Partner Management V2: 2.9.2; B2B Integration Factory – Cloud Integration – Trading Partner Management: 1.10.0	High
3784138	CVE-2026-76967	Insecure deserialization	SAP NetWeaver Business Client BC-WD-CLT-BUS: 8.00, 8.10	High
3757002	CVE-2026-66767	Memory corruption	SAP NetWeaver AS for ABAP and ABAP Platform KRNL64NUC: 7.22, 7.22EXT; KRNL64UC: 7.22, 7.22EXT, 7.53, 8.04; KERNEL: 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.19, 9.20	High
3791068	CVE-2026-2332	CRLF injection through Jetty components	SAP Commerce Cloud Search and Navigation COM_CLOUD: 2211, 2211-JDK21	High
3750721	CVE-2026-76968	Information disclosure	SAP Web Dispatcher, Internet Communication Manager, and SAP Content Server KRNL64NUC: 7.22, 7.22EXT; KRNL64UC: 7.22, 7.22EXT, 7.53; WEBDISP: 7.22_EXT, 7.53, 7.54, 7.77, 7.93, 9.16; CONTSERV: 7.53, 7.54; KERNEL: 7.22, 7.53, 7.54, 7.77, 7.93, 9.16, 9.18, 9.19, 9.20	Medium
3756450	CVE-2026-44766	SQL injection	SAP S/4HANA Intercompany Matching and Reconciliation SAPSCORE: 136; S4CORE: 104, 105, 106, 107, 108, 109	Medium
3786489	CVE-2026-76971	Server-Side Request Forgery (SSRF)	SAP Manufacturing Integration and Intelligence XMII: 15.4, 15.5	Medium
3787345	CVE-2026-34477	Security misconfiguration due to Apache Log4j	SAP Commerce Cloud Search and Navigation COM_CLOUD: 2211, 2211-JDK21	Medium
3783189	CVE-2026-76977	Clickjacking	SAPUI5 Frame Options Allowlist SAP_UI: 750, 754, 755, 756, 757, 758, 816; UI_700: 200	Medium
3365276	CVE-2026-76960	Cross-Site Request Forgery (CSRF)	SAP S/4HANA Finance for Advanced Payment Management S4CORE: 105, 106, 107	Medium
3371336	CVE-2026-76961	Cross-Site Request Forgery (CSRF)	SAP S/4HANA Finance for Advanced Payment Management S4CORE: 108	Medium
3365311	CVE-2026-76959	Cross-Site Request Forgery (CSRF)	SAP S/4HANA Finance for Advanced Payment Management UIAPFI70: 800, 900, 901, 902	Medium
3657599	CVE-2026-76962	Missing authorization check	SAP S/4HANA Manage Bank Chains app S4CORE: 107, 108, 109	Medium
3772838	CVE-2026-76963	Missing authorization check	SAP NetWeaver and ABAP Platform SAP_BASIS: 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 758	Medium
3736494	CVE-2026-58234	Denial of service	SAP Process Integration SOAP Adapter MESSAGING: 7.50; SAP_XIAF: 7.50	Low

Medium-severity fixes cover SQL injection, server-side request forgery, clickjacking, cross-site request forgery, information disclosure, authorization bypass, and Apache Log4j-related security misconfiguration issues. SAP also patched a low-severity denial-of-service flaw in the SAP Process Integration SOAP Adapter.

SAP administrators should review all relevant security notes in the SAP Support Portal, map them to deployed product versions, test patches under change-control procedures, and apply the fixes as soon as possible.

Internet-facing SAP services, NetWeaver Message Server instances, cloud application dependencies, and systems processing sensitive business data should receive priority attention.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport appeared first on Cyber Security News.

The U.S. Department of State’s Rewards for Justice program has announced a reward of up to $10 million for information leading to the identification or whereabouts of Amir Yaryab, a senior figure in Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC).

U.S. officials allege that Yaryab oversees the command’s Cyber Operations Command, managing cyber units responsible for attacks on critical infrastructure across the U.S., Europe, and the Middle East.

This reward is part of broader efforts to combat malicious cyber activities targeting U.S. critical infrastructure, as outlined under the Computer Fraud and Abuse Act.

U.S. Offers $10 Million Reward

Yaryab is said to lead various components within the IRGC-CEC known as Shahid Hemmat and Shahid Shushtari, both involved in cyber and cyber-enabled information campaigns against multiple sectors, including defense, telecommunications, energy, and finance.

U.S. authorities have linked Yaryab to several IRGC-affiliated groups, including CyberAv3ngers and Dadeh Afzar Arman (DAA), which have been implicated in malware incidents and assaults on civilian infrastructure worldwide.

This recent announcement has intensified scrutiny on the Iranian cyber command, especially as operational technology systems remain vulnerable to internet-based threats. The alert correlates with past warnings about CyberAv3ngers targeting industrial control systems.

A joint advisory issued by CISA, the FBI, NSA, EPA, and international collaborators revealed that IRGC-connected actors began compromising Israeli-made Unitronics Vision Series programmable logic controllers (PLCs) in late 2023. These devices are essential in various sectors, including water treatment, energy, transportation, and healthcare.

Reports indicate that between November 2023 and January 2024, CyberAv3ngers initiated multiple waves of attacks against U.S. based Unitronics PLCs, compromising at least 75 devices, 34 of which were in the U.S. water and wastewater sector.

The attackers primarily targeted internet-exposed devices that used default passwords or lacked password protection. The cyber offensive was not merely a matter of defacement; it involved altering the ladder logic within PLCs, which directly manage the operations of physical devices such as pumps and valves.

Unauthorized changes could disrupt essential functions, and attackers also tampered with device names, software versions, and remote access credentials, complicating recovery efforts.

Moreover, in some incidents, individuals responsible for these attacks replaced human-machine interface (HMI) displays with messages asserting responsibility and threatening Israeli-made equipment. This interference can obstruct plant operators from accessing crucial operational data.

CyberAv3ngers’ activities highlight the significant risks to critical infrastructure posed by weak operational technology security. When attackers compromise PLCs, they can take control of critical industrial processes, leading to potentially disastrous consequences.

In response, organizations operating PLCs and HMIs are urged to mitigate risks by identifying and eliminating devices directly exposed to the public internet. Strong password policies, multifactor authentication, and other security measures should be enforced.

For those using Unitronics Vision Series PLCs, CISA recommends updating engineering workstations and firmware to the latest versions and securing remote access through VPNs and firewalls.

Additionally, maintaining updated asset inventories and monitoring for unusual activities can help prevent such cyber threats. The ongoing activities of CyberAv3ngers underscore the urgent need for robust cybersecurity measures in industrial systems to defend against state-aligned adversaries seeking to disrupt critical services.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post U.S. Offers $10 Million Reward for Iranian IRGC Cyber Chief Linked to Critical Infrastructure Attacks appeared first on Cyber Security News.

Panzer ransomware has entered Italy amid a sharp rise in attacks. The ransomware-as-a-service, or RaaS, operation surfaced on August 5 and listed a kitchen manufacturer in Treviso and a telecommunications engineering firm in Catanzaro among its alleged victims.

The group advertises tools for Windows, Linux, FreeBSD, and VMware ESXi systems. An attack on a virtualization host can disrupt many business applications at once, turning one compromised server into a wider outage.

Panzer posted victims across 11 countries and the campaign arrived as claimed ransomware incidents in Italy reached 212 by September 6, above the 169 recorded during all of 2025.

Researcher Andrea Fortuna said in a report shared with Cyber Security News (CSN) that the Panzer’s victim posts should still be treated carefully.

Doimo Cucine and NTE Italia had not publicly confirmed the incidents when the report was published, but their listing may be a credibility-building tactic.

Panzer Ransomware Targets Italian Manufacturers

Panzer stands out less for a publicly examined encryptor than for the business system surrounding it. Prospective affiliates reportedly apply through Tox, face screening, and receive access to a dashboard for builds, negotiations, payment invoices, leak posts, and team accounts.

The stated split gives affiliates 80 percent of each payment and the platform 20 percent. Operators also claim to monitor new affiliates for signs of researcher or law-enforcement access, showing a controlled recruitment process.

Its ESXi option is particularly serious for manufacturers and telecom providers that run core workloads as virtual machines.

An intruder who reaches a hypervisor could encrypt multiple virtual disks and halt dependent services, rather than affecting a single employee device.

Reporting on VMware vCenter attack techniques illustrates how control of virtualization infrastructure can become a direct path to ransomware deployment.

Panzer also appears to pair encryption with data theft. The group claimed 30 GB of stolen data from Doimo Cucine and 16 GB of sensitive documents from NTE Italia.

Backups may restore systems, but they do not remove the pressure created by a threatened data leak or potential reporting duties. Researchers have not independently confirmed Panzer’s first access method or publicly analysed payload.

Available assessments instead associate the operation, with limited confidence, with password attacks, credential theft, remote-service movement, local data collection, security-tool tampering, and data transfers over alternative protocols.

Possible entry routes include vulnerable internet-facing VPN or gateway devices, exposed Remote Desktop Protocol services, phishing messages with malicious documents, and abused remote-management software.

The focus on exposed access points echoes reporting on RDP and VPN attack routes, where stolen credentials and unpatched perimeter systems open a route into internal networks.

Defending virtualized operations

Italian organizations should begin with remote access. Require phishing-resistant multi-factor authentication for VPN, remote administration, and privileged accounts; remove unnecessary privileges; and rotate credentials immediately when compromise is suspected.

Internet-facing appliances and remote-management tools also need prompt patching and regular exposure reviews.

Segmentation is equally important. Keep domain controllers, backup repositories, vCenter, and ESXi management interfaces away from everyday user networks.

Restrict administrative protocols to monitored management segments, so a compromised workstation cannot easily reach the systems that control an entire virtual estate.

Teams should watch for warning signs before encryption begins: unusual VPN logins, new administrator accounts, unexpected PsExec or WMI activity, unapproved remote-management tools, large archives in user or ProgramData folders, and unfamiliar cloud-transfer utilities.

A new ESXi ransomware campaign underscores why telemetry from hypervisors deserves the same attention as endpoint alerts.

Two commands deserve urgent attention when they appear unexpectedly on a server: vssadmin delete shadows and bcdedit recoveryenabled no.

They can remove recovery options, and responders should isolate the affected host, preserve evidence, and begin incident-response procedures rather than waiting for encryption.

Finally, maintain offline or immutable backups for every platform, including virtual machines, and test restorations routinely.

Monitor large outbound transfers, prepare legal and communications plans for double extortion, and ensure that recovery testing covers the applications and dependencies that keep production and telecom services operating.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Leak site (.onion)	pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd.onion	Panzer leak-site address
Tox ID (affiliate recruitment)	8C3D96497A9438794F705C055FC2FD3059F6CF11FF51060EE55ED7F0679CFC7218825BD56CB1	Publicly listed affiliate-recruitment contact

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS appeared first on Cyber Security News.

AI-powered customer service bots are being given more responsibility inside businesses, including access to customer profiles, billing data, support inboxes, account changes, and refund tools. The research showed that attackers may not need traditional vulnerability scanners or direct application exploitation.

Instead, they can manipulate the data and messages an AI agent receives, causing it to reveal sensitive information or perform actions as a legitimate customer.

One major risk involves chatbot transcript features. Many support bots let users email a copy of a conversation. An attacker could inject malicious text into a chat session and use the transcript function to create a phishing email that appears to come from a trusted support address.

If a customer receives a message from support@company.com, they may be more likely to trust it than a normal phishing attempt.

Email spoofing flaws can worsen the issue. Some AI agents identify users by reading the visible From header in an incoming email. However, email delivery and authentication systems may validate a different sender field.

An attacker could send an email that passes authentication using an attacker-controlled address, prompting the AI system to associate the message with a victim’s account.

AI Bots Tricked Into Stealing Security Codes

In one attack scenario, an AI customer service agent could receive a request that appears to come from a victim. The bot may then retrieve billing data, profile information, or account details.

If the attacker adds their own address to the CC or reply field, the bot could unintentionally send the confidential response to the attacker.

Security researcher Inti De Ceukelaire warned at Bug Bounty Village during DEF CON 34 that these capabilities can be abused through email tricks, prompt injection, identity confusion, and weak authentication checks.

The research also highlighted risks around multi-factor authentication. Some bots require a one-time passcode before making sensitive changes, such as updating a phone number.

But weak email normalization can sometimes allow attackers to reset rate limits by changing the format of an email address while still pointing to the same mailbox.

For example, different systems may treat comments, aliases, or unusual formatting in an email address differently. One component may recognize the address as belonging to the attacker.

At the same time, another backend service could parse embedded data differently and retrieve a victim’s account. This type of flaw is especially dangerous when raw user input is inserted directly into API requests.

AI agents connected to support inboxes can also expose third-party account codes. An attacker may first send an instruction designed to influence the bot’s behavior.

They could then trigger a legitimate password reset email from another service, such as a social media platform, to the company support inbox.

If the AI agent reads the incoming code and follows the earlier malicious instruction, it could forward or leak the code to attacker-controlled infrastructure.

Human approval does not always stop these attacks. A human operator and an AI agent may process different versions of the same email.

Attackers can use multipart messages, hidden HTML, CSS styling, quoted replies, or specially formatted attachments to present a harmless message to a human while exposing a malicious instruction to the AI system.

Knowledge-base poisoning is another growing concern. Customer service agents often use retrieval-augmented generation to answer questions from company documentation.

If a crawler indexes community comments, user profiles, or untrusted pages on the company domain, attackers may plant false instructions or fake discount codes that the AI treats as trusted internal information.

Organizations deploying AI support agents should strictly separate untrusted customer content from system instructions. They should authenticate users with verified session-bound identity controls, normalize email addresses consistently, validate all tool requests server-side, and prevent bots from sending secrets to unverified recipients.

AI agents should also have limited permissions. A chatbot that can read emails, modify accounts, issue refunds, and access third-party verification codes creates a high-value target. Businesses must treat AI agents as privileged automation systems, not just conversational interfaces.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post AI Customer Service Bots Can Be Tricked Into Stealing Security Codes and Acting as Victims appeared first on Cyber Security News.

BigBear 2.0 is a phishing operation designed to steal proof that a user has already passed multi-factor authentication.

It targets Microsoft 365 accounts through convincing sign-in links, then takes over the logged-in browser session rather than attempting to break the authentication factor.

The operation is a rebranded Evilginx2 phishing framework that targets Microsoft 365 accounts. Victims are drawn in through email links that open a proxy page resembling a Microsoft sign-in page.

It relays their traffic to the genuine service while quietly collecting credentials and the session data returned after sign-in.

CloudSEK analysts identified BigBear 2.0 in June 2026 after gaining access to its administrative panel. The researchers linked the activity to an operator using the alias General Boss and found a network of 42 virtual private server nodes.

CloudSEK said in a report shared with Cyber Security News (CSN) that the panel held 5,137 stolen records tied to 461 organizations and 3,331 unique victim IP addresses across more than 40 countries.

Of those records, 474 represented complete authenticated sessions, alongside 1,032 passwords and 4,148 session cookies. The records illustrate an operation that collects both immediate account access and material that may support persistent access later.

BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA

BigBear 2.0 uses an adversary-in-the-middle setup, meaning it sits between the victim and the real Microsoft login service.

It captures the email address and password, lets Microsoft validate the request, and waits for the victim to complete their normal approval or code challenge.

When sign-in succeeds, Microsoft sends an authenticated session cookie to the browser. Because the proxy handled the exchange, it can copy that cookie before forwarding the response.

The attacker can replay it in another browser and enter email, Teams, SharePoint, OneDrive, and connected single sign-on applications as the victim. Microsoft 365 session hijacking campaigns have reported the same account-takeover risk.

This is not a weakness in a one-time password, SMS code, or push notification by itself. These methods confirm the user during the live session, but the proxy steals the resulting proof. BigBear used country-matched residential proxies and scripts that pushed users away from security-key authentication.

The campaign particularly affected IT services and managed service providers, a concern because one compromised provider can offer attackers a route into customer environments.

At least five affiliates were linked to the panel. Phishing kits targeting organizations show this service-based model is spreading.

Containing identity compromise

Organizations should treat a suspected stolen cookie as an identity incident, not merely a password problem. Reset affected passwords, revoke active sessions and refresh tokens, and force a new sign-in for impacted accounts.

Teams should examine mailbox forwarding rules, OAuth consent grants, unfamiliar application access, and sign-in activity for evidence that a hijacked session was used after authentication. This review should begin as soon as suspicious activity is reported.

The most useful long-term control is phishing-resistant authentication, especially FIDO2 or WebAuthn security keys and passkeys where properly deployed.

These methods bind a login cryptographically to the genuine site, making a lookalike proxy far less useful. Passkey attack techniques nevertheless deserve ongoing attention.

Administrators should require compliant devices through Conditional Access, shorten session lifetimes where appropriate, and watch for unusual residential IP ranges or new browser sessions.

Email filtering should inspect links that imitate sign-in pages even when they use valid certificates. Teams can monitor for the distinctive headers and cookies listed below, because infrastructure can be reassigned.

For users, a familiar Microsoft page and successful MFA prompt do not always prove that a browser is connected directly to Microsoft.

Verify unexpected sign-in requests through a trusted bookmark or known application, not an email link. This concern is reinforced by Evilginx session-cookie attacks, which also depend on real-time relaying rather than stolen passwords alone.

The campaign combined cookie theft, geographic proxy matching, and affiliate access. MFA must be paired with phishing-resistant methods, session controls, and rapid token revocation.

Indicators of compromise (IoCs):-

Type	Indicator	Description
IP address	38[.]60[.]250[.]157	BigBear 2.0 VPS node
IP address	95[.]179[.]233[.]79	BigBear 2.0 VPS node
IP address	80[.]240[.]27[.]55	BigBear 2.0 VPS node
IP address	65[.]20[.]103[.]58	BigBear 2.0 VPS node
IP address	38[.]54[.]124[.]88	BigBear 2.0 VPS node
IP address	208[.]85[.]20[.]79	BigBear 2.0 VPS node
IP address	95[.]179[.]169[.]154	BigBear 2.0 VPS node
IP address	107[.]191[.]46[.]14	BigBear 2.0 VPS node
IP address	130[.]94[.]82[.]180	BigBear 2.0 VPS node
IP address	38[.]54[.]124[.]58	BigBear 2.0 VPS node
IP address	208[.]85[.]18[.]18	BigBear 2.0 VPS node
IP address	45[.]32[.]147[.]239	BigBear 2.0 VPS node
IP address	208[.]76[.]222[.]214	BigBear 2.0 VPS node
IP address	130[.]94[.]82[.]230	BigBear 2.0 VPS node
IP address	65[.]20[.]102[.]80	BigBear 2.0 VPS node
IP address	70[.]34[.]208[.]46	Historical BigBear 2.0 VPS node
IP address	130[.]94[.]113[.]184	Historical BigBear 2.0 VPS node
IP address	78[.]141[.]193[.]59	Historical BigBear 2.0 VPS node
IP address	64[.]176[.]72[.]180	Historical BigBear 2.0 VPS node
IP address	136[.]244[.]114[.]85	Historical BigBear 2.0 VPS node
IP address	70[.]34[.]244[.]122	Historical BigBear 2.0 VPS node
IP address	199[.]247[.]10[.]14	Historical BigBear 2.0 VPS node
IP address	152[.]39[.]137[.]60	Historical BigBear 2.0 VPS node
IP address	91[.]245[.]235[.]208	Historical BigBear 2.0 VPS node
IP address	45[.]32[.]64[.]165	Historical BigBear 2.0 VPS node
Domain	konceptenterprises[.]com	Phishing domain
Domain	ccpipharma[.]com	Phishing domain
Domain	annastudios-paros[.]com	Phishing domain
Domain	dnsforward[.]com	Phishing domain
Domain	hotelmidtownsurat[.]com	Phishing domain
Domain	dataclust[.]com	Phishing domain
Domain	cifutura[.]com	Phishing domain
Domain	hoaivt[.]com	Phishing domain
Domain	dronalms[.]com	Phishing domain
Domain	virextec[.]com	Phishing domain
Domain	offtic[.]com	Phishing domain
Domain	rootreseller[.]com	Phishing domain
Domain	management[.]michaelmarcotte[.]com	Phishing domain
Domain	kgsscans[.]com	Phishing domain
Domain	soil-management[.]com	Phishing domain
Domain	daengrentacar[.]com	Historical phishing domain
Domain	arrmmy[.]com	Historical phishing domain
Domain	captelind[.]com	Historical phishing domain
Domain	planisteradmin[.]com	Historical phishing domain
Domain	hnospascualfadon[.]com	Historical phishing domain
Domain	haliotisbar[.]com	Historical phishing domain
Domain	knowncontractor[.]com	Historical phishing domain
Domain	valtteri[.]net	Historical phishing domain
URL	management[.]daengrentacar[.]com/meetings	Observed live Microsoft 365 phishing page
Filename	cookie.js	File attachment used in the credential-processing workflow
Telegram bot	@comeandget_bot	Primary administrator command-and-control bot, revoked
Telegram bot token	8629902848[:]AAGEFRukqwu9QaMSDNNuVRYF3juTcg4ehO4	Defanged token for revoked primary administrator bot
Telegram bot	@botterxyz_bot	Affiliate credential-exfiltration bot
Telegram bot token	8625043408[:]AAH6G8X0aW0QhoLEB1uJiYQ5-2aLSJzg8VE	Defanged affiliate bot token
Telegram bot	@PackingitonG_bot	Affiliate credential-exfiltration bot
Telegram bot token	8783369414[:]AAGENRhb7By-0-cQFgrnOw1AW4NbOeUutVE	Defanged affiliate bot token
Telegram bot	@donplayer_bot	Affiliate credential-exfiltration bot
Telegram bot token	8807072847[:]AAEYbUaFcbeAgxTZ2Zl8pFbpjRPM9jXvvzE	Defanged affiliate bot token
Telegram bot	@bolywan_bot	Affiliate credential-exfiltration bot
Telegram bot token	8462028468[:]AAEQt7oq0c3nTHzApQtHk3RdZ7ifnkYd1XM	Defanged affiliate bot token
Telegram bot	@rdsxtdytguyg75d_bot	Affiliate credential-exfiltration bot
Telegram bot token	8794520788[:]AAERSVBlWMpzHc21CCP_-9tL_pjqH9-WuFI	Defanged affiliate bot token
HTTP header	x-evg-token	Evilginx-related application header
HTTP header	x-evg-server	Evilginx-related application header
HTTP header	x-evg-session	Evilginx-related application header
Cookie	evginx_session	Evilginx-related session cookie
Cookie	evginx_token	Evilginx-related token cookie
Cookie	evginx_admin	Evilginx-related administrator cookie
Cookie	bigbear_session	BigBear 2.0 session cookie
Cookie	bigbear_token	BigBear 2.0 token cookie

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post BigBear 2.0 Evilginx2 Phishing Campaign Bypasses Microsoft 365 MFA With Session Cookie Theft appeared first on Cyber Security News.

Managed XDR is MDR with a wider aperture: analysts monitoring correlated telemetry from endpoints, network, email, identity, and cloud rather than endpoints alone.

Deploying modern Extended Detection and Response (XDR) solutions helps bridge coverage gaps across hybrid environments, while dedicated Managed Detection and Response (MDR) services provide continuous human oversight.

Palo Alto’s Unit 42 service scores highest on the combination of platform depth and incident response pedigree, Secureworks Taegis leads on detection research, and Trend Micro offers the broadest native telemetry.

Here are the ten best, scored plus an honest answer to whether MXDR is a real category or a rebranding of MDR.

The 2026 Managed XDR Scorecard

Rank	Provider	Telemetry breadth (25%)	Detection quality (25%)	Response authority (20%)	Platform flexibility (15%)	Value (15%)	Total
1	Palo Alto (Unit 42)	10	9	9	5	6	8.3
2	deepwatch	9	8	8	9	7	8.2
3	CrowdStrike	9	10	10	5	6	8.5
4	Trend Micro	10	8	7	6	8	8.1
5	Rapid7	9	8	7	8	7	7.9
6	Sophos	8	8	9	7	8	8.0
7	Bitdefender	7	8	8	6	9	7.6
8	Fortinet	8	7	8	4	8	7.2
9	Ontinue	9	8	8	9	8	8.5
10	eSentire	9	9	9	8	6	8.5

Weighted averages rounded to one decimal. Rank reflects overall buyer fit including the market notes below, not score alone.

Is MXDR a Real Category?

Partly. Here is the honest distinction.

MDR historically meant managed endpoint detection and response an analyst team watching your EDR. MXDR means the same team watching correlated telemetry from endpoints plus network, email, identity, and cloud, on an XDR platform.

Evaluating EDR vs MDR architecture differences reveals that modern attacks quickly expand past endpoints.

That is a genuine difference, because most modern intrusions progress through identity and cloud rather than staying on the endpoint. A service that only sees endpoints misses the part of the attack that matters most.

But the labels have collapsed. Several providers on our MDR list already cover identity and cloud, and several MXDR services are endpoint-heavy in practice. Ignore the acronym and audit the data sources. Ask each provider for a written list of telemetry sources they will actually ingest, monitor, and write detections against in your environment. That list is the product.

One consolidation note affecting this list: Sophos completed its acquisition of Secureworks in February 2025 at approximately $859 million. Both appear here because both services remain in market with distinct heritage, but a competitive process containing both is a negotiation with one company.

How We Scored

A structured research-based evaluation, not a comparative service trial, with no testing claims. Five criteria:

• Telemetry breadth (25%) — how many sources beyond endpoint are natively monitored: identity, cloud, email, network, SaaS, OT.

• Detection quality (25%) — analyst capability and the threat research feeding detections.

• Response authority (20%) — what the provider can do without asking you first.

• Platform flexibility (15%) — whether you must adopt the provider’s platform or can bring your own. This drives long-term cost and switching risk.

• Value (15%) — cost relative to coverage, with credit for predictable pricing.

The Providers, Scored

1. deepwatch — 8.0/10

Why it scores here: managed XDR combines continuous security monitoring, detection engineering, threat hunting, and response across a broad enterprise security stack.

Strengths: 24/7 managed SOC; strong third-party technology integrations; threat hunting and detection engineering; broad coverage across endpoint, cloud, identity, and network environments; designed to complement existing security investments rather than require a complete technology replacement.

Trade-offs: smaller market footprint than the largest MDR providers; service quality depends on the technologies and telemetry you bring into the platform; pricing is quote-based.

Ideal buyer: organizations that want a managed SOC/XDR service while retaining their existing security technologies.

Verify before buying: native integrations for your current tools, response authority, telemetry retention, and contractual SLA commitments.

Image ALT: deepwatch managed XDR security operations and threat detection

2. CrowdStrike — 8.5/10

Why it scores here: Perfect scores on detection quality and response authority. CrowdStrike’s managed services combine elite detection with genuine unilateral containment deployed on top of the best EDR security tools.

Strengths: best-in-class detection engineering and threat intelligence; OverWatch managed hunting adds human expertise beyond automated detection; full containment authority; telemetry extends natively into identity, cloud, and log management.

Trade-offs: low platform flexibility — this requires the Falcon platform; the most expensive tier of provider here; modular pricing accumulates as you extend telemetry coverage.

Ideal buyer: organizations standardizing on CrowdStrike that want maximum detection and containment.

Verify before buying: which modules are required for the telemetry sources you need covered.

Image ALT: CrowdStrike managed XDR detection with OverWatch hunting

3. Palo Alto (Unit 42) — 8.3/10

Why it scores here: The only perfect telemetry breadth score. Cortex XDR’s native fusion of endpoint, network, cloud, and identity data gives Unit 42 analysts the widest view of any provider here, backed by proven resilience across Palo Alto Cortex XDR platforms and one of the most respected incident response practices in the industry.

Strengths: unmatched native telemetry breadth, particularly network context if you run Palo Alto firewalls; Unit 42’s incident response pedigree means the same team can escalate from detection into full IR; strong containment authority; excellent threat intelligence.

Trade-offs: lowest platform flexibility alongside CrowdStrike — you’re adopting Cortex; data ingestion pricing needs careful modelling and is where budgets overrun; premium cost.

Ideal buyer: Palo Alto estates wanting the widest telemetry and an IR team on the same platform.

Verify before buying: ingestion volume and cost, and where the MXDR service boundary ends and IR retainer begins.

Image ALT: Palo Alto Unit 42 managed XDR across endpoint, network and cloud

4. Ontinue — 8.1/10

Why it scores here: strong managed XDR and SOC capabilities with human-led detection, investigation, threat hunting, and response across heterogeneous security environments.

Strengths: 24/7 managed security operations; broad telemetry coverage across endpoint, identity, cloud, and network; multi-vendor approach; human-led threat hunting and investigation; useful for organizations that want to extend their SOC without replacing their existing security stack.

Trade-offs: smaller market presence than the largest MDR/XDR providers; response capabilities and integrations should be validated against your specific environment; pricing is generally quote-based.

Ideal buyer: organizations with heterogeneous security tooling that want a managed SOC partner without committing to a single security platform.

Verify before buying: supported integrations, pre-authorized response actions, service-level commitments, and the exact telemetry sources included.

Image ALT: Ontinue managed XDR SOC threat detection and response

5. Trend Micro — 8.1/10

Why it scores here: A perfect telemetry breadth score alongside Palo Alto, with notably better value. Vision One natively covers endpoint, email, server, cloud workload, and network, bridging the divide in endpoint security EDR vs XDR and email as a first-class source is a genuine advantage.

Strengths: email is where most attacks begin, and Trend correlates it natively rather than through a connector; excellent server and cloud workload coverage; strong vulnerability research; good value at platform scale; risk insights prioritize exposure alongside detection.

Trade-offs: response authority more advisory than unilateral at standard tiers — confirm what’s pre-authorized; detection engineering trails the top specialists; requires the Vision One platform.

Ideal buyer: organizations where email and server workloads are the dominant risk surface.

Verify before buying: the credit-based consumption model, and response authority at your tier.

Image ALT: Trend Micro managed XDR service across email, endpoint and cloud

6. Sophos — 8.0/10

Why it scores here: Strong response authority and good value, with the broadest mid-market reach here, feeding directly into specialized incident response tools.

Strengths: full-response tier where analysts contain threats directly; ingests third-party telemetry alongside Sophos products; strong mid-market economics; huge partner delivery network; Secureworks acquisition adds Counter Threat Unit research depth.

Trade-offs: telemetry breadth and detection engineering trail the leaders; portfolio positioning against Secureworks is an open question; service tiers vary meaningfully.

Ideal buyer: mid-market organizations wanting real containment authority at accessible pricing.

Verify before buying: which tier includes full response and third-party telemetry.

Image ALT: Sophos managed XDR threat response and case management

7. Rapid7 — 7.9/10

Why it scores here: Strong telemetry breadth and good flexibility, uniquely combining managed detection with vulnerability management and cloud security, checking environments against the CISA Known Exploited Vulnerabilities catalog.

Strengths: breadth across detection, exposure, and cloud that few MXDR providers match; good value bought together; strong open-source community heritage; useful correlation between vulnerability exposure and active detection.

Trade-offs: response authority generally advisory rather than unilateral; detection engineering good rather than leading; broad portfolio requires careful licence scoping.

Ideal buyer: organizations wanting detection and exposure management from one provider.

Verify before buying: response authority, and how the services price together.

Image ALT: Rapid7 managed XDR with vulnerability and cloud context

8. Bitdefender — 7.6/10

Why it scores here: The best value score here, delivering competent managed XDR and enterprise-tested malware protection solutions at pricing well below the premium providers.

Strengths: strong underlying prevention means less gets through to be managed; genuine response authority at accessible cost; good coverage across endpoint, network, and productivity suites; accessible to mid-market and smaller organizations.

Trade-offs: telemetry breadth is narrowest among the serious providers; threat research depth below the leaders; smaller enterprise reference base.

Ideal buyer: mid-market organizations wanting managed coverage without premium pricing.

Verify before buying: which telemetry sources are included at your tier.

Image ALT: Bitdefender managed detection and response GravityZone console

9. eSentire — 8.2/10

Why it scores here: strong detection and response capabilities combined with broad multi-signal coverage and an emphasis on rapid threat containment.

Strengths: 24/7 managed detection and response (MDR); strong threat hunting and detection engineering; broad coverage across endpoint, network, cloud, and identity; rapid containment capabilities; dedicated threat research through its Threat Response Unit.

Trade-offs: premium pricing compared with value-oriented MDR providers; smaller overall scale than the largest global security platforms; organizations should validate coverage and response capabilities for their specific environment.

Ideal buyer: mid-market and enterprise organizations where rapid detection and containment are higher priorities than minimizing service cost.

Verify before buying: response-time commitments, pre-authorized containment actions, telemetry coverage, and what is included in the contracted service tier.

Image ALT: eSentire managed XDR threat detection and rapid response

10. Fortinet — 7.2/10

Why it scores here: Good telemetry breadth within the Security Fabric and solid value, integrating with enterprise SOC tools, with the lowest platform flexibility here — the service is only meaningful if your estate is Fortinet.

Strengths: strong value for existing Fortinet customers; broad Fabric telemetry across network, endpoint, email, and cloud; automated response across Fabric components; manageable for generalist IT.

Trade-offs: value collapses outside a Fortinet estate; detection engineering trails the specialists. Fortinet’s exploited-vulnerability record, including a FortiCloud authentication bypass added to CISA’s Known Exploited Vulnerabilities catalog in January 2026, makes patch and response commitments important contract terms.

Ideal buyer: Fortinet-standardized organizations.

Verify before buying: what proportion of your telemetry actually originates in the Fabric.

Image ALT: Fortinet managed XDR Security Fabric telemetry and response

Head-to-Head Comparisons

Unit 42 vs CrowdStrike. Unit 42 sees more natively, particularly network, and can escalate seamlessly into full incident response. CrowdStrike has better endpoint detection engineering and more aggressive containment authority driving SOC cyber threat detection.

Both require adopting the platform, so your existing estate usually decides.

Secureworks Taegis vs Critical Start. Both let you keep your tools. Taegis brings far deeper detection research; Critical Start brings a distinctive alert-resolution model and broader tool support. If detection quality is paramount, Taegis. If tool coverage is, Critical Start.

MXDR vs MDR. Don’t choose by acronym. List the telemetry sources you need monitored, get each provider to confirm in writing which they’ll ingest and write detections for, and compare that. Several providers marketed as MDR cover more sources than some marketed as MXDR.

Buyer’s Guide

Write down your telemetry sources first. Endpoints, identity provider, Microsoft 365 or Google Workspace, cloud accounts, firewalls, SaaS applications. Get each provider to confirm in writing which they will monitor and write detections against. This is the single most useful thing you can do in this evaluation.

Separate the platform cost from the service cost. Palo Alto, CrowdStrike, Trend Micro, and Fortinet services require their platforms. Secureworks, Critical Start, and Rapid7 are more flexible. You cannot compare monthly figures until you normalize for what technology you’re also buying.

Model data ingestion explicitly. MXDR means more telemetry, and telemetry is priced by volume at most providers. Get a written estimate at your actual log volume with a stated overage policy — this is where MXDR budgets break.

Get response authority in the contract. Which actions, under what conditions, with what notification. “Managed XDR” does not imply containment authority; several providers here are advisory by default.

Common mistakes: buying MXDR while excluding identity telemetry, when identity is where most attacks progress; assuming MXDR includes full incident response when it usually covers containment only; and paying for correlated telemetry from sources the provider will only ingest, not actually monitor.

Frequently Asked Questions

What is managed XDR (MXDR)?

Managed XDR is an outsourced service where a provider’s analysts monitor, investigate, and respond to threats using correlated telemetry from multiple sources — endpoints, network, email, identity, and cloud — rather than endpoints alone.

It combines XDR technology with a 24/7 analyst team, and at better providers includes authority to contain threats directly.

What is the difference between MDR and MXDR?

MDR historically meant managed endpoint detection and response. MXDR extends the monitored surface to network, email, identity, and cloud.

In practice the labels have blurred, with several MDR services covering multiple sources and some MXDR services remaining endpoint-heavy. Compare the actual telemetry sources monitored rather than the acronym.

What is the best managed XDR service in 2026?

Secureworks Taegis scores highest overall on detection research quality combined with platform flexibility, with CrowdStrike leading on detection and containment authority and Palo Alto’s Unit 42 on native telemetry breadth.

Critical Start is the strongest choice if keeping your existing tools matters, and Bitdefender the best value.

How much does managed XDR cost?

MXDR is typically priced per endpoint or per user per month, plus data ingestion charges that scale with telemetry volume, and nearly all providers are quote-based. Services requiring the provider’s platform involve technology licensing on top.

Ingestion volume is the variable that most often causes budget overruns.

Do I need MXDR if I already have EDR?

If your team can monitor and respond to EDR alerts around the clock, possibly not. MXDR earns its cost when nobody is watching overnight, or when attacks progress through identity and cloud where your EDR has no visibility. Most organizations under a few hundred staff cannot staff 24/7 coverage economically.

Does managed XDR include incident response?

Generally only containment. Full incident response forensics, root cause analysis, regulatory notification, and recovery — is usually a separate retainer, with Palo Alto’s Unit 42 being notable for having both under one roof. Confirm exactly where the service boundary sits before you need it.

Bottom Line

deepwatch takes the top score by pairing genuine detection research depth with the flexibility to keep your existing tools though the Sophos acquisition makes roadmap questions essential.

CrowdStrike and Palo Alto Unit 42 are the strongest platform-native services, the former for detection and containment, the latter for telemetry breadth and a clean path into full incident response.

Ontinue is the best answer for organizations unwilling to replace their stack, Sophos and Bitdefender for mid-market budgets. Whichever you choose, list your telemetry sources and get written confirmation of which are monitored that list, not the acronym, is what you’re actually buying.

Related reading on Cyber Security News:

• Top 10 Best Managed Detection & Response (MDR) Services

• Top 10 Best Extended Detection & Response (XDR) Platforms

• Top 10 Best Endpoint Detection & Response (EDR) Solutions

• 25 Best Managed Security Service Providers (MSSP)

• Top 10 Best Identity Threat Detection & Response (ITDR) Solutions

• Top 10 Best Network Detection & Response (NDR) Tools

• Top 10 Best Antivirus (Endpoint Protection) Software for Business

• 10 Best Cloud Security Tools

• 10 Best Identity and Access Management Solutions

• Top 10 Best Zero Trust Security Vendors

• Top 10 Best Patch Management Software

The post Top 10 Best Managed XDR Services in 2026 appeared first on Cyber Security News.

MDR gives you a 24/7 security operations team without hiring one. Modern Managed Detection and Response (MDR) services fuse advanced analytics with continuous human oversight to contain intrusions across distributed environments.

CrowdStrike Falcon Complete scores highest on detection and response authority, Expel leads on transparency, and Huntress delivers the best value for small businesses and the MSPs who serve them.

But the single most important variable in this category isn’t detection quality it’s what the provider is contractually allowed to do at 3 a.m. without waking you up. Here are the ten best, scored, plus two consolidation facts that affect this list directly.

The 2026 MDR Scorecard

Rank	Provider	Detection quality (25%)	Response authority (25%)	Transparency (20%)	Coverage breadth (15%)	Value (15%)	Total
1	CrowdStrike Falcon Complete	10	10	8	8	6	8.8
2	Expel	9	8	10	9	7	8.7
3	Red Canary	9	8	9	9	7	8.5
4	Arctic Wolf	8	7	8	9	8	7.9
5	Sophos MDR	8	9	8	8	8	8.2
6	SentinelOne Vigilance	8	9	7	7	7	7.7
7	eSentire	9	9	8	8	6	8.2
8	Rapid7	8	7	8	9	7	7.8
9	Ontinue	8	8	8	9	8	8.2
10	Huntress	8	8	9	6	10	8.1

Weighted averages rounded to one decimal. Rank reflects overall buyer fit including the market notes below, not score alone.

Two Consolidation Facts That Affect This List

Sophos MDR and Secureworks are now the same company. Sophos completed its acquisition of Secureworks in February 2025, in a transaction valued at approximately $859 million.

Both appear on this list because both services remain in market with distinct heritage — Sophos MDR built for the mid-market, Secureworks Taegis built around two decades of Counter Threat Unit research.

But if you are running a competitive process with both in it, you are negotiating against one vendor.

Ask directly how the two portfolios will be positioned long term.

Arctic Wolf now owns Cylance. Arctic Wolf acquired BlackBerry’s Cylance endpoint security assets, with the transaction completing in February 2025.

This matters because Arctic Wolf historically positioned itself as endpoint-agnostic — it monitored whatever you already ran. Owning an endpoint product changes that positioning.

If vendor neutrality was part of why you shortlisted Arctic Wolf, ask how the Cylance acquisition affects it.

How We Scored

A structured research-based evaluation, not a comparative service trial, and we make no testing claims. Five criteria weighted for what determines whether MDR actually protects you:

• Detection quality (25%) — analyst capability, detection engineering, and threat research feeding the service.

• Response authority (25%) — whether the provider can contain a threat unilaterally or must call you first. This is the criterion that separates real MDR from managed alerting, and it is the most commonly misunderstood term in the category.

• Transparency (20%) — can you see the detections, the analyst notes, and the decisions, or only the summary? Opaque providers create dependency by design.

• Coverage breadth (15%) — endpoint only, or identity, cloud, network, email, and SaaS too.

• Value (15%) — cost relative to capability, with credit for published or predictable pricing.

What “Response” Actually Means — Read This Before Comparing Quotes

Providers use the same word for four very different services:

What they say	What it actually means
“24/7 monitoring”	Someone watches. They may only email you.
“Alerting and triage”	They filter noise and tell you what matters. You act.
“Guided response”	They tell you exactly what to do. You still act.
“Full response”	They isolate hosts, kill processes, disable accounts — without asking.

Only the last one protects you at 3 a.m. on a Sunday. Understanding EDR vs MDR operational differences is critical: get the specific actions the provider is authorized to take written into the contract, along with the conditions and the notification process.

A service that emails you at 3 a.m. and waits is a monitoring service with an MDR price tag.

The Providers, Scored

1. CrowdStrike Falcon Complete — 8.8/10

Why it scores here: the only perfect score on both detection and response authority. Falcon Complete analysts operate the Falcon platform directly and are authorized to contain threats without waiting for customer approval.

Strengths: Elite detection backed by CrowdStrike’s threat intelligence and OverWatch hunting, deploying across the best EDR security tools; genuine full response authority; a breach prevention warranty backs the service; excellent for organizations that want the problem handled rather than described.

Trade-offs: requires the CrowdStrike platform — this is not a bring-your-own-tools service; the most expensive option here by a clear margin; value depends on committing to the Falcon ecosystem.

Ideal buyer: organizations that can fund premium and want maximum containment authority.

Verify before buying: exactly which actions are pre-authorized and the warranty terms.

Image ALT: CrowdStrike Falcon Complete managed detection and response console

2. Expel — 8.7/10

Why it scores here: the only perfect transparency score, and it’s genuinely differentiated. Expel shows you every alert, every analyst decision, and every action in real time through its Workbench — you can watch the investigation happen.

Strengths: Radical transparency that builds internal capability rather than dependency; genuinely tool-agnostic, working with the security stack you already own; integrates seamlessly with enterprise Security Operations Center (SOC) tooling across endpoint, cloud, and SaaS; excellent for organizations that want to learn, not just outsource.

Trade-offs: response authority is strong but generally more collaborative than Falcon Complete’s unilateral model confirm what’s pre-authorized; premium pricing; you need to own the underlying tools.

Ideal buyer: organizations with some in-house capability wanting a partner rather than a black box.

Verify before buying: which of your existing tools are supported natively, and pre-authorized response actions.

Image ALT: Expel Workbench transparent alert investigation and analyst notes

3. Red Canary — 8.5/10

Why it scores here: exceptional detection engineering and strong transparency, with a long-standing reputation for detection quality and for publishing genuinely useful threat research.

Strengths: Outstanding detection engineering with publicly documented methodology; tool-agnostic across major EDR platforms; integrates actionable threat intelligence that the wider industry relies on; strong analyst quality and low false positive rates.

Trade-offs: response is generally collaborative rather than fully unilateral by default — confirm your tier; premium pricing; you supply and pay for the underlying EDR.

Ideal buyer: organizations prioritizing detection quality and threat intelligence value.

Verify before buying: response authority at your service tier.

Image ALT: Red Canary managed detection threat timeline and analyst findings

4. Sophos MDR — 8.2/10

Why it scores here: strong response authority at genuinely accessible pricing, with the broadest reach into the mid-market of any provider here.

Strengths: Full-response tier where Sophos analysts contain threats directly; works with third-party telemetry as well as Sophos products; feeds directly into central incident response tools; strong value for mid-market budgets; huge installed base and partner delivery network; the Secureworks acquisition adds Counter Threat Unit research depth.

Trade-offs: detection engineering trails the specialists at the top; portfolio positioning against Secureworks is an open question worth asking; service tiers vary meaningfully in what’s included.

Ideal buyer: mid-market organizations wanting real response authority without premium pricing.

Verify before buying: which tier includes full response, and how Secureworks capability is being integrated.

Image ALT: Sophos MDR threat response and case management console

5. eSentire — 8.2/10

Why it scores here: strong on both detection and response authority, with an explicit focus on rapid containment and a well-regarded threat research unit.

Strengths: Aggressive containment posture with documented mean-time-to-contain commitments; strong Threat Response Unit research supporting a structured cybersecurity incident response plan; good multi-signal coverage across endpoint, network, cloud, and identity; financial services and legal sector depth.

Trade-offs: premium pricing; smaller than the largest providers, which matters for global coverage; less brand recognition than CrowdStrike or Arctic Wolf in some markets.

Ideal buyer: mid-market and enterprise organizations where containment speed is the priority.

Verify before buying: documented response time commitments and what they’re measured against.

Image ALT: eSentire managed detection and response threat containment

6. Ontinue — 8.1/10

Why it scores here: strong 24/7 managed detection and response (MDR) built around human-led threat hunting, investigation, and response across endpoint, identity, cloud, and network telemetry.

Strengths: continuous SOC monitoring; human-led threat hunting and investigation; broad telemetry coverage; strong multi-vendor approach; useful for organizations that want to extend security operations without building a full 24/7 SOC internally.

Trade-offs: less market recognition and ecosystem scale than the largest MDR providers; response capabilities and integrations should be validated against your specific security stack; pricing is generally quote-based.

Ideal buyer: organizations with heterogeneous security environments that need a managed SOC partner for continuous detection, investigation, and response.

Verify before buying: supported integrations, pre-authorized response actions, 24/7 analyst coverage, and the exact service-level commitments in the contract.

Image ALT: Ontinue managed detection and response SOC threat investigation

7. Huntress — 8.1/10

Why it scores here: the only perfect value score, and it’s earned. Huntress built a service specifically for small businesses and the managed service providers serving them, with published pricing and a genuinely useful product.

Strengths: Transparent published pricing, rare in this category; excellent at persistence detection and managing core endpoint protection solutions; strong MSP delivery model; low operational burden; expanding beyond endpoint into identity and Microsoft 365.

Trade-offs: coverage breadth scores lowest here — it’s not built for complex enterprise estates; less suited to organizations with mature SOCs wanting deep customization; enterprise references are fewer.

Ideal buyer: small businesses and MSPs. If you have under 250 endpoints, start here.

Verify before buying: current published pricing and which modules are included.

Image ALT: Huntress managed detection and response for small business

8. Arctic Wolf — 7.9/10

Why it scores here: the broadest coverage of the mid-market providers with a distinctive concierge model — a named security team that learns your environment over time.

Strengths: The concierge security team model provides genuine continuity and context; broad coverage across endpoint, network, cloud, and identity; transparent approach to pricing MDR services with strong log ingestion without punitive volume pricing; good value at mid-market scale; large customer base and mature operations.

Trade-offs: response authority is generally more advisory than unilateral — confirm precisely what they can do without you; the Cylance acquisition changes the historically vendor-neutral positioning, which is worth probing; detection engineering trails the top specialists.

Ideal buyer: mid-market organizations wanting broad coverage and a consistent named team.

Verify before buying: pre-authorized response actions, and how Cylance ownership affects endpoint neutrality.

Image ALT: Arctic Wolf concierge security team dashboard and risk coverage

9. Rapid7 — 7.8/10

Why it scores here: strong coverage breadth combining MDR with vulnerability management and cloud security in one relationship.

Strengths: Broad platform spanning detection, vulnerability management, and cloud security, which few MDR providers match; continuously correlates findings against the CISA Known Exploited Vulnerabilities catalog; good value when bought together; strong open-source community heritage; useful for organizations wanting exposure and detection from one vendor.

Trade-offs: response authority generally more advisory than unilateral; detection engineering good rather than leading; the breadth means scoping the licence carefully.

Ideal buyer: organizations wanting detection and vulnerability management from one provider.

Verify before buying: response authority, and how the MDR and vulnerability management services price together.

Image ALT: Rapid7 managed detection and response with vulnerability context

10. SentinelOne Vigilance — 7.7/10

Why it scores here: strong response authority delivered on top of a platform whose autonomous capabilities already do much of the work.

Strengths: Analysts operate the SentinelOne platform directly with real containment authority; backed by autonomous malware protection solutions so less depends on human reaction time; good value relative to Falcon Complete; strong rollback capability in ransomware incidents.

Trade-offs: requires the SentinelOne platform; transparency and coverage breadth trail the tool-agnostic specialists; less independent threat research than CrowdStrike, Red Canary, or Secureworks.

Ideal buyer: existing SentinelOne customers wanting managed coverage over their own platform.

Verify before buying: which Vigilance tier includes what, and pre-authorized response actions.

Image ALT: SentinelOne Vigilance managed response and threat investigation

Head-to-Head Comparisons

Falcon Complete vs Expel. Falcon Complete handles it and tells you afterwards; Expel shows you everything and works with the tools you own. Choose Falcon Complete if you want the problem to disappear and can standardize on CrowdStrike.

Choose Expel if you want to build internal capability and keep your existing stack.

Arctic Wolf vs Sophos MDR. Both target the mid-market with broad coverage. Sophos generally offers stronger unilateral response authority; Arctic Wolf offers broader log ingestion and the named-team continuity model. Press both hard on exactly what they can do without calling you.

Huntress vs everyone. For organizations under roughly 250 endpoints, Huntress is usually the right answer on cost alone, and the service is genuinely good at the threats that hit that segment. Above that size, its coverage breadth starts to constrain you.

Buyer’s Guide

Get pre-authorized response actions in the contract. Not the sales deck — the contract. Which actions, under what conditions, with what notification. This single clause determines whether you have MDR or expensive monitoring.

Confirm whether you’re buying tools or a service. CrowdStrike, SentinelOne, and Sophos MDR run on their own platforms, which you must license. Expel, Red Canary, and Arctic Wolf work with tools you own. The total cost comparison is meaningless until you normalize this.

Ask about coverage beyond endpoint. Most modern intrusions progress through identity and cloud. An endpoint-only MDR misses the part of the attack that matters most. Confirm identity provider, Microsoft 365, and cloud coverage explicitly.

Test the escalation path during evaluation. Ask each provider to walk through a scenario: ransomware detected at 2 a.m. Saturday. Who does what, in what order, how fast, and who do they call? The quality of that answer predicts your experience better than any capability matrix.

Common mistakes: buying MDR while leaving identity threat detection out of scope; assuming “24/7 monitoring” means someone will act; and not clarifying who owns incident response if a detection becomes a breach MDR and full incident response are usually separate engagements.

Frequently Asked Questions

What is MDR?

Managed detection and response is an outsourced service combining security technology with a 24/7 team of analysts who monitor your environment, investigate threats, and respond to them.

Unlike traditional managed security services that mostly forward alerts, MDR includes active investigation and at the better providers authority to contain threats directly.

What is the best MDR service in 2026?

CrowdStrike Falcon Complete scores highest on detection quality and response authority, with Expel leading on transparency and Red Canary on detection engineering.

Sophos MDR offers strong response authority at mid-market pricing, and Huntress is the clear value leader for small businesses.

What is the difference between MDR and MSSP?

A traditional MSSP manages security devices and forwards alerts, typically leaving investigation and response to you. MDR includes analyst-led investigation, threat hunting, and — critically — response actions.

The distinction has blurred as MSSPs added MDR services, so evaluate what the contract actually authorizes rather than the label.

How much does MDR cost?

MDR is typically priced per endpoint or per user per month, and most providers are quote-based. Huntress publishes pricing, which makes it a useful benchmark.

Cost varies widely based on whether the platform is included, coverage breadth beyond endpoint, and response authority level. Compare against the fully loaded cost of a 24/7 in-house team, which typically requires five to six analysts.

Does MDR include incident response?

Usually only partially. Most MDR services include containment of detected threats, but full incident response forensics, root cause analysis, regulatory notification support, and recovery is generally a separate engagement or retainer.

Confirm where the service boundary sits before you need it, because that conversation is much harder during a breach.

Can MDR replace an in-house security team?

For small and mid-sized organizations, largely yes MDR provides 24/7 coverage that would otherwise require five or six analysts.

You still need someone internally who owns the relationship, makes business-context decisions, and handles the response actions MDR isn’t authorized to take. Larger organizations typically use MDR to extend an in-house team rather than replace it.

Bottom Line

CrowdStrike Falcon Complete is the strongest service if you can fund it and standardize on Falcon nothing else combines that detection quality with that much containment authority.

Expel is the best choice for organizations that want to see the work and keep their own tools, and Red Canary the pick for detection quality with a tool-agnostic model.

Sophos MDR delivers real response authority at mid-market pricing, and Huntress is close to unbeatable under 250 endpoints.

Before you sign anything, get the pre-authorized response actions written into the contract and remember that Sophos and Secureworks are now one company, so a competitive process with both in it isn’t one.

Related reading on Cyber Security News:

• Top 10 Best Managed XDR Services

• Top 10 Best Endpoint Detection & Response (EDR) Solutions

• Top 10 Best Extended Detection & Response (XDR) Platforms

• 25 Best Managed Security Service Providers (MSSP)

• Top 10 Best Identity Threat Detection & Response (ITDR) Solutions

• Top 10 Best Antivirus (Endpoint Protection) Software for Business

• Top 10 Best Network Detection & Response (NDR) Tools

• 10 Best Identity and Access Management Solutions

• 10 Best Cloud Security Tools

• Top 10 Best Zero Trust Security Vendors

• Top 10 Best Patch Management Software

The post Top 10 Best Managed Detection & Response (MDR) Services in 2026 appeared first on Cyber Security News.

Jellyfin has released version 12.0, a significant update to its open-source media server. This version includes a wide range of platform improvements and essential security updates affecting both the server and the web client. The project strongly advises administrators to plan their upgrade carefully because it includes database migrations and compatibility-breaking changes for existing deployments. […]

The post Jellyfin 12.0 Released With Security Fixes for Unauthorized File Access and XSS Flaws appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Dell has released security updates for the Secure Connect Gateway (SCG) Application and Appliance after discovering three critical vulnerabilities. These flaws can expose enterprise deployments to unauthenticated administrative access, remote command execution, and potential host-level compromise. Detailed in Dell Security Advisory DSA-2026-382, these issues affect SCG 5.0 appliance versions earlier than 5.36.00.16 and application versions […]

The post Dell Secure Connect Gateway Critical Flaws Allow Unauthenticated Remote Code Execution and Admin Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Anthropic’s Claude Mythos Preview has demonstrated the ability to complete an end-to-end enterprise intrusion simulation, progressing from initial access through chained exploitation and network traversal to the defined compromise objective. The result marks a material shift in frontier-model cyber capability: the model did not merely solve isolated CTF-style tasks, but autonomously connected weaknesses commonly found […]

The post Claude Mythos Executes End-to-End Intrusion From Initial Access to Full Domain Compromise appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

WhatsApp is developing a guest-call feature that would let people without a WhatsApp account join encrypted calls through a web link. This capability would extend WhatsApp’s existing Call Links feature to include guests, letting invited participants join calls directly from a browser without installing the mobile app or creating an account. Currently, the feature is […]

The post WhatsApp Testing Guest Calls for People Without a WhatsApp Account appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

ASUS has released a security update for the Control Center Express Agent to address CVE-2026-19397, a high-severity vulnerability related to missing authentication. This vulnerability allows an unauthenticated nearby attacker to potentially take control of an affected host through a direct connection to the agent. The issue affects versions before 1.7.24 and was published and updated […]

The post ASUS Control Center Critical Flaw Allows Unauthenticated Attackers to Gain Root Access appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Best value overall: Microsoft Defender for Endpoint — if you hold Microsoft 365 E5, you already own competitive enterprise endpoint protection and the marginal cost is zero. Best published pricing: Bitdefender and ESET, both of which let you budget without a sales call. Best detection: CrowdStrike. Best cleanup tool: Malwarebytes. One vendor on the standard […]

The post The 12 Best Antivirus (Endpoint Protection) Software for Business, Compared and Priced appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

SAP released 19 new Security Notes addressing four critical vulnerabilities and 15 additional flaws throughout its enterprise portfolio. The vendor also updated one note from August. The most urgent issue is CVE-2026-44756, a memory-corruption vulnerability in Extended Passport (EPP) Processing with a CVSS score of 10.0. This flaw affects numerous SAP Kernel and Web Dispatcher […]

The post SAP September 2026 Security Update Fixes 4 Critical Vulnerabilities and 15 Other Flaws appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Best value overall: Fortinet. Delivered directly and through the largest partner network in security, at price points the premium providers can’t approach provided you vet the actual delivery partner. Best detection quality: Secureworks. Best global reach: NTT Data. Best if you want to stop owning firewalls: Cato Networks. Best for SMB: Barracuda MSP. Managed firewall […]

The post The 12 Best Managed Firewall Services, Compared and Priced appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Best value overall: Opinnate. It targets the gap the enterprise vendors leave open policy automation at a price mid-market organizations can actually approve and it’s the most accessible commercial model in this list. Best capability: AlgoSec and Tufin. Best for change detection: FireMon. Cheapest credible entry: ManageEngine, which is the only vendor here with genuinely […]

The post The 12 Best Network Security Policy Management Tools, Compared and Priced appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

DNS security delivers more blocked attacks per dollar than any other network control when you buy the right shape at the right tier. The value verdict: DNSFilter and SafeDNS own transparent per-user pricing for SMBs, Cloudflare Gateway starts free and scales to national infrastructure (it now runs the UK’s public-sector PDNS with Accenture), Cisco Umbrella […]

The post The Best DNS Security Solutions, Compared and Priced (2026) appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.