|
By Stacey Nosan
The emergence of the CRINK axis—a coordinated cyber-threat nexus comprised of China, Russia, Iran, and North Korea—has dramatically impacted the 2026 global risk landscape. As these nation-states utilize AI-driven scale and living-off-the-land (LOTL) tactics to target critical infrastructure, SafeBreach’s new content series provides essential intelligence on their evolving motivations and methods.
|
By SafeBreach
Dirty Frag (comprising CVE-2026-43284 and CVE-2026-43500) is a high-impact Linux kernel vulnerability chain that enables deterministic, reliable local privilege escalation (LPE) to root across major enterprise distributions. Unlike previous race-condition exploits, this logic flaw in the IPsec ESP and RxRPC subsystems offers a near 100% success rate, allowing attackers to escalate from a minor foothold to full system control without triggering typical kernel panics.
|
By Uzi Galili
CVE-2026-31431— the “Copy Fail” vulnerability—is a critical local privilege escalation (LPE) flaw in the Linux kernel’s cryptographic subsystem that allows unprivileged users to gain root access with near-perfect reliability. Boasting a CVSS score of 7.8 and affecting nearly every mainstream distribution since 2017 (including Ubuntu, RHEL, and Amazon Linux), Copy Fail has been added to the CISA KEV catalog due to its active exploitation and portable, low-footprint nature.
|
By SafeBreach
SafeBreach Helm is a pioneering AI agent designed to operationalize the complete Continuous Threat Exposure Management (CTEM) lifecycle by unifying SafeBreach’s industry-leading adversarial exposure validation (AEV) capabilities with data and insights from across an organization’s existing security ecosystem.
|
By Yossi Attas
In the fifth installment of SafeBreach’s AI-First series, VP of Development Yossi Attas explores how the development team’s AI-First philosophy is being extended to the customer frontier and improved upon through the Anti-Hallucination Protocol.
|
By Yossi Attas
In the fourth installment of SafeBreach’s AI-First evolution series, VP of Development Yossi Attas and Principal Software Design Engineer Guy Ephraim explore how test-driven development (TDD) serves as the essential “safety net” for high-speed AI code generation.
|
By Yossi Attas
In the third installment of SafeBreach’s AI-First development series, VP of Development Yossi Attas explores the resurgence of the Product Requirements Document (PRD) as the foundational “control surface” for AI-assisted engineering.
|
By Tova Dvorin
SafeBreach Senior Product Marketing Manager Tova Dvorin explores the critical necessity of continuous validation in Zero Trust architectures, specifically focusing on the integration of SafeBreach and Akamai Guardicore. While microsegmentation is a foundational element in the defense against lateral movement and ransomware propagation, dynamic infrastructure and policy drift often create “blind spots” that compromise security posture.
|
By Yossi Attas
In this second installment of a series on the transformation of SafeBreach’s development organization, VP of Development Yossi Attas details a structured operational workflow that integrates Jira, BitBucket, and Claude Code to turn AI usage from ad-hoc prompting into a rigorous engineering methodology.
|
By Uzi Galili
The new SafeBreach extension for VS Code integrates Breach Studio’s powerful custom attack development capabilities directly into the world’s most popular IDE to enable security teams to engineer custom attack simulations with unprecedented speed and precision. Security engineers can leverage Git-native version control, AI-assisted authoring, and real-time IntelliSense linting to eliminate friction and reduce failed executions.
|
By SafeBreach
PHP2Shell is two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, that can let a stranger run commands on your web server without logging in. On Apache mod_php, it can happen before your application code even loads. We unpack which PHP setups are exposed, why PHP says updating is the only safe fix, what to do about end-of-life PHP, and three questions every CISO should ask about a web-tier foothold. Update: on 26 Oct, researchers reported the first successful in-the-wild exploitation.
|
By SafeBreach
SafePay doesn’t need a zero-day. It logs in. The FBI, CISA, the US Secret Service and German and UK police just issued joint advisory AA26-293A on the ransomware crew, and its front door is your VPN. Tova Dvorin and Adrian Culley break down SafePay’s three initial-access routes, the five known CVEs across Cisco ASA, Veeam and SonicWall, its FileZilla, Mimikatz and ShareFinder.ps1 tool chain, and four controls to validate before a stolen password is used.
|
By SafeBreach
An OpenAI agent spent 84 days inside Australia’s Medicare statistics portal before anyone was told — and the only reason Australia found out is that OpenAI emailed a public disclosures inbox. Tova Dvorin and Adrian Culley walk the timeline, the Transluce logs showing agents escalating through proxy relays, Base64 scripts, filename guessing and SQL injection, and the three changes CISOs need now: a threat model for persistent non-malicious visitors, detection that doesn’t depend on the attacker volunteering, and scoping your own agents like pen testers.
|
By SafeBreach
Two Citrix NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, were exploited in the wild before a patch existed, and 88771 hits every configuration with no login required. Tova Dvorin and Adrian Culley break down Citrix bulletin CTX697096 and all eight CVEs, why this is NetScaler’s third CISA KEV entry in five weeks, and why patching won’t tell you whether you were already breached.
|
By SafeBreach
Ten government agencies across seven countries put their names on one advisory. AA26-281A profiles Integrity Technology Group — a China-based, for-profit contractor that builds, sells and hosts the tooling behind large-scale intrusions, and whose domains the FBI seized on October 8. Tova Dvorin and Adrian Culley break down MicroScan’s 1,300 pentest scripts, the eBurst spray that tries ten interfaces into one Microsoft 365 mailbox, SoftEther VPN hiding behind trusted Windows process names, and a 12-year-old Bash CVE still exploited in the wild.
|
By SafeBreach
The FBI and US Secret Service just dropped joint advisory JCSA 2026-1601 on FortiBleed—and there is no CVE to patch. Tova Dvorin and Adrian Culley walk the full chain: credential stuffing against internet-facing FortiGate SSL VPNs, legacy SHA-256 admin hashes cracked on rented GPUs, fake vendor-style admin accounts, and attackers deleting your accounts to lock you out of your own firewall. Plus the INC/Lynx ransomware link, what the 86,000 figure really means, and the question that matters: would a new admin on your edge device at 3am fire anything?
|
By SafeBreach
ShinyHunters breached FBIJobs.gov, leaked personal data on roughly 5,000 Bureau personnel—including 14 staffers tied to China-focused counterintelligence—and triggered arrests in Amsterdam and Jordan. We separate what the FBI confirmed from what the crew claimed: the unverified Oracle PeopleSoft zero-day, the vishing and OAuth token abuse behind 140+ breaches, and why the arrests wound the brand but not the playbook. Plus, the four controls worth validating this week, starting with FIDO2.
|
By SafeBreach
An AI agent that drifts from your intent looks exactly like an insider attack: legitimate credentials, sanctioned tools, plausible actions, at machine speed. In this episode, we break down Anthropic's "Zero Risk Isn't the Job" CISO guide: a four-question review framework, seven vendor-neutral controls, and why egress allowlisting is the strongest defense against prompt injection. Plus: the Claude Opus 4.5 upgrade that had an incident-response agent recruit another agent, and why agentic AI needs continuous adversarial exposure validation.
|
By SafeBreach
Is your AI compliance up to par? Anthropic's deputy CISO reveals that Claude Cowork activity isn't captured in compliance logs. If you're in a regulated EMEA sector, DORA's ICT logging and the EU AI Act's obligations are here. Relying on a self-configured OTel stream isn't enough for formal audits. Stay informed about data boundaries and privacy reviews before enabling streams.
Research - From Square Root to /root: Escalating Privileges in Azure Containers with Python in Excel
|
By SafeBreach
Isolation is not the same thing as security. Ron Ben Yizhak from SafeBreach Labs presented this research at Black Hat USA and DEF CON: when Microsoft shipped Python in Excel, the code didn't run on a machine. It ran in an isolated container in Azure. So he asked the obvious question. How isolated is it, really? An isolated environment still has an attack surface. It just moves. See how Ron: If your teams are evaluating cloud-executed code features, this one is worth the full read—the methodology matters as much as the findings.
|
By SafeBreach
Today's CISOs and security teams must constantly validate security controls to identify gaps, remediate misconfigurations, and optimize performance against a rapidly increasing threat landscape. Breach and attack simulation (BAS) solutions-designed to continuously test the effectiveness of security controls and identify potential vulnerabilities-have emerged as a powerful tool to help organizations navigate this new reality. But not all BAS platforms are created equal.
|
By SafeBreach
The mission of today's security teams is clear: protect the company from emerging cyber threats. What's less clear is how to ensure stakeholders understand the impact of their programs. Traditional security reporting focuses on threats and vulnerabilities and how many were stopped and prevented, but non-technical stakeholders-who are concerned with the business's bottom line and how these threats can impact business continuity-need to know how these activities translate to tangible business values. As risk is tied to revenue, security teams need a simple way to understand and share the real efficacy of their programs with their stakeholders.
|
By SafeBreach
There are a number of security validation methods available on the market today, but each has different uses and functions. And, not all of them are appropriate in every IT environment. As a result, many organizations waste time and resources on technologies or approaches that may work well for others, but aren't a good fit for their specific use case.
|
By SafeBreach
Starting a red-team program but not sure where to begin? Looking to improve your existing red-team operation? Before getting too far in the cyber weeds, go back to the basics with "The Fundamentals of Modern Cybersecurity Red Teaming."
|
By SafeBreach
2022 saw a dramatic increase in the prevalence, severity, and impact of cyberattacks, presenting a striking new reality for CISOs and their security teams. They were-and continue to be-in a constant race against time to improve security and performance.
|
By SafeBreach
Modern SOCs are complex environments with dozens of tools, overlapping teams, and a constantly growing attack surface to protect. To combat these challenges and keep up with the rapidly evolving threat landscape, security leaders must constantly strive to improve SOC efficiency and keep team members engaged.
- October 2026 (7)
- September 2026 (7)
- August 2026 (11)
- July 2026 (20)
- June 2026 (11)
- May 2026 (7)
- April 2026 (11)
- March 2026 (9)
- February 2026 (8)
- January 2026 (9)
- December 2025 (15)
- November 2025 (4)
- October 2025 (11)
- September 2025 (4)
- August 2025 (7)
- July 2025 (3)
- June 2025 (2)
- May 2025 (2)
- April 2025 (1)
- March 2025 (1)
- February 2025 (2)
- January 2025 (2)
- November 2024 (1)
- October 2024 (3)
- September 2024 (3)
- August 2024 (8)
- July 2024 (3)
- June 2024 (3)
- May 2024 (7)
- April 2024 (4)
- March 2024 (5)
- February 2024 (5)
- January 2024 (2)
- December 2023 (9)
- November 2023 (8)
- October 2023 (4)
- September 2023 (7)
- August 2023 (11)
- July 2023 (4)
- June 2023 (8)
- May 2023 (13)
- April 2023 (7)
- March 2023 (3)
- February 2023 (4)
- January 2023 (2)
- December 2022 (5)
Combining the mindset of a CISO and the toolset of a hacker, SafeBreach is the pioneer in breach-and-attack simulation (BAS) and is the most widely used platform for continuous security validation. SafeBreach continuously executes attacks, correlates results to help visualize security gaps, and leverages contextual insights to highlight remediation efforts.
With its Hacker’s Playbook™, the industry’s most extensive collection of attack data enabled by state-of-the-art threat intelligence research, SafeBreach empowers organizations to get proactive about security with a simple approach that replaces hope with data.
Unleash the power of your security controls to drive down risk.
- Attack with Purpose: Execute real-world attacks safely and continuously to identify what your security controls will prevent, detect, or miss.
- Analyze with Real-Time Data: Gain a quantitative view of your security posture by visualizing security-control performance data that’s not available anywhere else.
- Remediate with Intention: Review actionable data to quickly identify gaps, expedite remediation, and efficiently reduce risk.
- Report with Confidence: Communicate to key stakeholders with clear insights to quantify risk, prioritize investments, and ensure strategic alignment.
Gain visibility across the entire cyber kill chain.