AI pentesting can uncover vulnerabilities missed by human testers, but it also has limitations in consistency, risk assessment, and understanding business context. Intruder compares the strengths and weaknesses of both approaches and explains where AI agents can improve security testing.
Law enforcement authorities from 17 countries in Latin America and Europe have arrested 95 suspects in an INTERPOL-coordinated operation targeting the distribution of child sexual abuse material (CSAM) through online messaging groups. The joint action, dubbed International Effort Confluencia, included four law enforcement operations between March 2026 and September 2026. "Effective cross-border cooperation between law enforcement and the private sector has never been more urgent," said Stephen Fry, Executive Director of INTERPOL Investigation Support. "Behind every file is a child who was abused, and who is revictimized every time that image recirculates. Wherever offenders move, we have to move faster." The investigators executed 127 search warrants to arrest nearly 95 suspects and rescued a five-year-old victim whose parent had been producing and selling abuse material online.
Attackers exploit a critical Cisco email gateway flaw to gain root access. Cisco urges customers to update scanner tools and check for compromise. Cisco confirmed this week that threat actors are exploiting a critical vulnerability in Cisco Secure Email Gateway, tracked as CVE-2026-76519 with a CVSS score of 9.8. An attacker can exploit the flaw by sending a crafted email attachment through the gateway and, if it lands right, writing arbitrary files to the underlying operating system. “A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.” reads the advisory. “This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system.” The networking giant found this one in its own internal security scanning, which is at least some comfort, and became aware of active attacks in October. The advisory highlights that cleanest that not every Cisco email gateway is vulnerable. The File Reputation service, part of the Advanced Malware Protection feature, has to be enabled and assigned to a mail policy, and the Content Scanner Tools version has to be earlier than 25.3.0.5525. If either condition doesn’t apply, the attack path doesn’t exist. Checking is fast. To verify File Reputation status, open the web management interface and navigate to Mail Policies, then Advanced Malware Protection for either incoming or outgoing policies. To confirm the scanner version, run contentscannerstatus at the CLI. If the output shows anything older than 25.3.0.5525, the device is exposed. The cleanest remediation is updating the Content Scanner Tools package. “Updating the Content Scanner Tools does not require a software upgrade or a product restart. Customers who have enabled automatic Content Scanner Tools updates are not required to take any action once the update has been applied.” continues the advisory. “Customers who have disabled automatic updates should apply the Content Scanner Tools update manually.” Gateways with automatic updates enabled should check that the update has been installed by verifying the scanner version. If automatic updates are disabled, administrators can run contentscannerupdate from the command line to install it manually. Cisco has also released fixes in AsyncOS versions 15.5.5-014 and 16.5.0-780. Version 16.0 has no fixed release, so users must migrate to another version. Cisco recommends upgrading any version older than 16.5 directly to 16.5.0-780. Cisco-managed Secure Email Cloud customers are already protected and don’t need to take any action. Cisco’s compromise check is a single command: grep "System Security" system_logs. It returns one of three outputs: a confirmed compromise indicator, a scan that failed to complete, or a clean result. The last one isn’t a guarantee, though. “Upon successful exploitation of this vulnerability, attackers may obtain command execution with root privileges. With this level of access, attackers may remove or hide evidence of exploitation and indicators of compromise.” states the advisory. “Cisco strongly recommends that cross-checking the network logs and the firewall logs outside of the impacted device to identify any potential suspicious activity, including but not limited to unexpected uploads that were initiated from the affected device to external IP addresses or downloads from malicious IP addresses.” That means a clean log result isn’t proof the device wasn’t compromised. Cisco strongly recommends also pulling firewall and network logs from outside the appliance to look for unexpected uploads to external addresses or downloads from suspicious ones. For virtual appliances, Cisco recommends rebuilding the system if it has been compromised. First, save forensic data, as upgrading the affected system will destroy it. Then deploy a new virtual machine with a fixed software version, rebuild the configuration from scratch without importing old configuration files, and change all credentials and cryptographic keys. Clustered systems need extra care because SSH keys are used to authenticate between members. If one system is compromised, its private keys could put the others at risk. This is the third Cisco email gateway flaw that attackers have exploited to gain root access since December 2025. Previous incidents involved a SQL injection flaw reported in September and a zero-day in the spam quarantine feature. Cisco has now confirmed that attackers are exploiting two vulnerabilities disclosed in a September security update. Read the full Cisco advisory for indicators of compromise and details of the fixed releases. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISCO)
Microsoft has resolved a known issue that was causing black screens, desktop loading issues, and Explorer crashes after installing Windows 11 updates released since August. As Microsoft explained when it acknowledged the issue last month, affected users experienced multiple symptoms, most commonly a black screen after sign-in, being unable to access their desktop until they manually started the desktop session, and Windows Explorer crashes in application event logs. However, this known issue mainly affects Azure Virtual Desktop (AVD) hosts using FSLogix, a software solution that speeds up user profile loading in virtual desktop environments. Microsoft has now addressed the bug in cumulative updates released as part of this month's Patch Tuesday and asked affected users to update their systems.
Android trojan Hirudo replaces genuine banking apps with modified versions to steal credentials and bypass security checks, enabling financial fraud. ThreatFabric researchers detailed a new Android banking trojan called Hirudo that takes a genuinely different approach to defeating banking security. Instead of throwing a fake login screen over the real app, it uninstalls the real app and puts a modified copy in its place. “What sets it apart is the lengths its operators go to once a bank is in their sights: rather than overlaying a fake screen on top of the genuine banking app, Hirudo attempts to replace the banking app itself with a modified copy that quietly disables the bank’s own security checks from the inside.” reads the analysis published by ThreatFabric. Eight Indonesian banking apps from seven banks already have specially designed replacements ready. The malware’s credential-stealing code also targets users in Indonesia, China, India, Mexico, Morocco, and Thailand. Hirudo is delivered as a second app hidden inside a convincing dropper. The dropper looks like a legitimate shopping app, short drama platform, or adult video service. It loads real content through a WebView to make the app look genuine. If it detects a banking app on the device and finds that Hirudo is not yet installed, it displays a fake in-app update prompt. One dropper analysed by researchers goes a step further. During installation, it creates a deliberately broken VPN connection that cuts off the device’s internet access while Hirudo is installed. This does not fully bypass Google Play Protect, but ThreatFabric believes the technique is designed to weaken online reputation checks and code analysis while the malicious APK is being installed. Hirudo is then installed as a separate app from the dropper. Before it can carry out its malicious activities, it must obtain its own Accessibility and notification permissions. When the payload detects a target banking app, it checks the app’s signing certificate against a stored reference, then shows a fake update prompt and immediately opens Android’s uninstaller without waiting for the user to tap confirm. It downloads the patched replacement in parallel. “Hirudo keeps a registry of 42 financial apps, but only eight Indonesian apps, across seven banks, have dedicated replacement downloads. For these, the RAT detects the installed banking app through Accessibility, checks its signing certificate against a stored reference, then shows a fake “update” prompt.” reads the analysis. “It opens Android’s uninstaller for the genuine app without waiting for the user to tap, and downloads the bank-specific replacement in parallel.” The replacement keeps the original package name and version number, but it’s signed with a public test key rather than the bank’s real certificate. Android won’t install it as an update over a properly signed app, which is why the original has to go first. That requirement is a real constraint: the victim can interrupt it. But if they don’t, what follows is clever enough to matter. The bank’s original code remains almost unchanged. Only one line is added to the app’s Application class. This line loads a built-in hooking engine when the app starts. The engine uses two open-source frameworks: YAHFA to modify Java methods and Dobby to modify native functions. It activates only when it finds a trigger file created by the RAT on the device. Without this file, the modified banking app appears harmless. Once activated, the engine runs inside the banking app and controls how it responds to security checks. If the app asks for its signing certificate, the engine returns the genuine one. If it checks which accessibility services are enabled, the engine returns an empty list. It also removes the flag that blocks screenshots, allowing the attacker to view and record the banking screen remotely. Play Integrity checks are sent over plain HTTP to a server controlled by the operator, which returns an acceptable result. Researchers highlight two important points. First, the keybox used for attestation has been leaked publicly, and at least two of its certificates are already on Google’s revocation list. Second, a valid Play Integrity response does not prove that the app has not been tampered with. In this case, the response was relayed through the operator’s server rather than generated through a genuine integrity check. The lures don’t spread through side-loaded APKs from shady forums. They’re served from Amazon CloudFront, tied to campaign tracking through OpenInstall attribution, and linked to Meta Pixel IDs connecting specific branding to specific campaign groups. Some download routes were still live through late September and into October 2026. The operator APK-processing panel, which rebuilds dropper and payload APKs into finished lures and patched banking apps, was reachable without authentication, with cloud storage buckets and credentials left exposed, a significant operational security failure that helped ThreatFabric map the operation. Records from August 2026 included thousands of credential entries split across campaign groups, device records, lock-screen history, and financial profiles with monthly income and risk score fields. Operators annotated records they considered “phished,” which signals a workflow built to convert stolen data into actual fraud rather than just collect it. ThreatFabric’s conclusion on the defensive side is worth reading directly: “once an app can be replaced, its locally produced signals — signature, accessibility list, integrity verdict — must be treated as attacker-influenced and verified server-side.” A valid Play Integrity verdict from a relayed request is not a green light. A clean accessibility list from a patched app is not evidence there’s no controlling service running. The signals the app produces locally are no longer trustworthy, and any bank relying on them as blockers rather than inputs to server-side risk scoring is running on assumptions this trojan was designed to exploit. “Hirudo marks a deliberate escalation in how Android bankers approach hardened applications. By moving its tampering inside the target app, the operation shifts the contest from the device to the application’s own integrity checks, and from a bespoke patch to a reusable engine that can be retargeted at other apps and regions.” concludes the report. “The defensive conclusion is consistent across every capability we examined: signals produced locally by an app that may have been replaced cannot be trusted on their own.” Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Android malware)
The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, according to GitGuardian, was observed on October 8 and 9, 2026. "This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories' CI," security researchers Gaetan
Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows developers to build artificial intelligence (AI) applications and agentic workflows. In February 2025, DataStax, the parent company of Langflow, was acquired by IBM. The vulnerability in question is CVE-2026-105740 (CVSS score: 9.9), a case of
Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerability, tracked as CVE-2026-0322 (CVSS score: 8.6), is a case of remote code execution in the management interface. "A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS software enables an
Palo Alto Networks has released security updates for a high-severity PAN-OS RCE zero-day, tracked as CVE-2026-0322, that has been exploited in attacks targeting firewalls. The vulnerability affects the PAN-OS management interface and lets authenticated attackers with network access execute code as root on vulnerable devices. Palo Alto Networks confirmed in a security advisory published Wednesday that it has seen limited exploitation of the flaw in attacks. "Very limited exploitation has been observed targeting the Palo Alto Networks management interface," the company said. The vulnerability has a severity score of 8.6 and affects PA-Series and VM-Series firewalls, as well as Panorama virtual and M-Series appliances. Palo Alto says Cloud NGFW and Prisma Access are not affected. To exploit the vulnerability, attackers need existing credentials and network access to the PAN-OS management interface.
We investigated an intrusion where attackers exploited CVE-2024-47575 to target 500+ firewalls and deploy PEERSTITCH, a memory-resident ARM64 malware. The post Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant appeared first on Unit 42.
Confirm this action.
Leaving now will discard your changes.