Atarus Research https://atarussecurity.com/research/ Research and analysis from Atarus Offensive Security: how current attacks work, what they exploit, and what stops them. en-us Wed, 21 Oct 2026 00:00:00 GMT CVSS 9.2: two teams reported the same PHP core RCE on the same day. Old PHP gets a minimal patch at best. https://atarussecurity.com/research/php-core-rce-stale-workers/ PHP fixed two critical pre-auth RCEs in 8.2 to 8.5. Why two teams found them on the same day, why EOL PHP stays exposed, and what to do today. Wed, 21 Oct 2026 00:00:00 GMT https://atarussecurity.com/research/php-core-rce-stale-workers/ An AI agent cheated its way out of the lab and into someone else's production. One step was genuinely new. Four of them were things you already know how to fix. https://atarussecurity.com/research/agent-lab/ Two OpenAI models broke out of a test sandbox and compromised Hugging Face production. One step was a genuine zero-day. The other four were familiar weaknesses. Wed, 29 Jul 2026 00:00:00 GMT https://atarussecurity.com/research/agent-lab/ AI is now on both sides of the attack: the thing we break into, and the thing that breaks in. Here is what actually changed, and what didn't. https://atarussecurity.com/research/ai-on-both-sides/ Six AI coding assistants fell to one booby-trapped repository, and the first AI-run ransomware leaned on an already-fixed bug. Neither needed a novel exploit. Mon, 13 Jul 2026 00:00:00 GMT https://atarussecurity.com/research/ai-on-both-sides/ We get past MFA on most engagements, and we almost never break it. Here is how, and what actually stops us. https://atarussecurity.com/research/mfa/ MFA stops password attacks, so we go around it: stolen sessions, proxied logins, help desk resets and weak fallbacks. Here is what stops us. Fri, 26 Jun 2026 00:00:00 GMT https://atarussecurity.com/research/mfa/ Researchers caught a low-skilled attacker using AI agents to breach 14 companies. The uncomfortable part is that the AI mostly weaponized bugs you already have a patch for. https://atarussecurity.com/research/ai-agents-14-companies/ An attacker with little skill drove AI agents into 14 companies using bugs that already had patches. The recovered sessions show how little skill it took. Mon, 22 Jun 2026 00:00:00 GMT https://atarussecurity.com/research/ai-agents-14-companies/ Five days, ten exploited bugs, almost none of them touched a core app. A week attackers spent walking in through everything else. https://atarussecurity.com/research/edge-week/ In one week, about ten exploited bugs hit VPNs, file transfer, plugins, browsers, switches and npm. Almost none touched a core application. Fri, 19 Jun 2026 00:00:00 GMT https://atarussecurity.com/research/edge-week/ Microsoft patched three more Nightmare Eclipse zero-days on Tuesday, six in six weeks now. The story isn't the bugs, it's how fast a public PoC turns into a real attack. https://atarussecurity.com/research/nightmare-eclipse/ We wrote about Nightmare Eclipse on June 1, when the story was attackers turning Windows Defender against the people it was meant to protect. Wed, 10 Jun 2026 00:00:00 GMT https://atarussecurity.com/research/nightmare-eclipse/ Your network assumes the attacker comes through the firewall. A red team with a thirty-dollar badge cloner starts inside, as a trusted employee. https://atarussecurity.com/research/physical-access/ Legacy 125 kHz badges can be cloned in seconds with about $30 of hardware. A red team that clones one starts inside your network. Thu, 04 Jun 2026 00:00:00 GMT https://atarussecurity.com/research/physical-access/ Attackers are forging a cookie to log into Palo Alto VPNs as any user, admin included. It was rated medium severity, and they were inside four days after the patch. https://atarussecurity.com/research/palo-alto-vpn-cookie/ CVE-2026-0257 is an authentication bypass in Palo Alto Networks GlobalProtect, the VPN built into PAN-OS firewalls and Prisma Access. Wed, 03 Jun 2026 00:00:00 GMT https://atarussecurity.com/research/palo-alto-vpn-cookie/ Sophos found a ransomware crew using AI coding agents to build EDR-evasion malware and automate Active Directory attacks. The tooling works. The AI's claims about beating EDR were hallucinated. https://atarussecurity.com/research/sophos-ai-ransomware/ The reaction to AI in attacker hands tends to skip straight to the ceiling: autonomous malware, machine-speed intrusions, defenders hopelessly outpaced. Wed, 03 Jun 2026 00:00:00 GMT https://atarussecurity.com/research/sophos-ai-ransomware/ CISA added three supply chain CVEs to KEV including the Nx Console that compromised GitHub. The methodology is federally confirmed. https://atarussecurity.com/research/cisa-kev-supply-chain/ CISA added three actively exploited supply chain vulnerabilities to its Known Exploited Vulnerabilities catalog on May 27. Fri, 29 May 2026 00:00:00 GMT https://atarussecurity.com/research/cisa-kev-supply-chain/ A single syscall escapes the browser sandbox and lands SYSTEM. CVE-2026-40369 is patched. The public exploit code is everywhere. https://atarussecurity.com/research/browser-sandbox-escape/ CVE-2026-40369: one Windows kernel syscall escapes the Chrome, Edge and Firefox sandboxes to SYSTEM. Patched 12 May 2026, with public exploit code. Wed, 27 May 2026 00:00:00 GMT https://atarussecurity.com/research/browser-sandbox-escape/ A new open-source framework turns 7 AI coding tools into 50 autonomous bug-hunting agents. Your adversaries now have it too. https://atarussecurity.com/research/ai-bug-hunting-agents/ A researcher going by H-mmer open-sourced Pentest Agent Suite on May 25. Tue, 26 May 2026 00:00:00 GMT https://atarussecurity.com/research/ai-bug-hunting-agents/ The long weekend in review: Glasswing found 10,000 vulnerabilities. The supply chain attacks didn't break for the holiday. https://atarussecurity.com/research/memorial-day-review/ We hold posts over the weekend, so this is the catch-up. The long Memorial Day weekend was not quiet. Mon, 25 May 2026 00:00:00 GMT https://atarussecurity.com/research/memorial-day-review/ Trend Micro patched an actively exploited Apex One zero-day. Compromise the endpoint security server, own every endpoint it manages. https://atarussecurity.com/research/trend-micro-apex-one/ CVE-2026-34926 is a directory traversal flaw in the on-premise version of Trend Micro Apex One, the company's enterprise endpoint security platform. Fri, 22 May 2026 00:00:00 GMT https://atarussecurity.com/research/trend-micro-apex-one/ GitHub confirmed overnight: TeamPCP exfiltrated 3,800 internal repositories via a poisoned VS Code extension. https://atarussecurity.com/research/github-teampcp-repos/ TeamPCP poisoned a VS Code extension a GitHub employee installed. The stolen credentials reached GitHub internal source code repositories. Wed, 20 May 2026 00:00:00 GMT https://atarussecurity.com/research/github-teampcp-repos/ Grafana lost its codebase to Coinbase Cartel, the new offshoot of ShinyHunters, Scattered Spider, and LAPSUS$. https://atarussecurity.com/research/grafana-coinbase-cartel/ Grafana Labs confirmed Sunday that an unauthorized party obtained a token granting access to its GitHub environment and downloaded the company's codebase. Wed, 20 May 2026 00:00:00 GMT https://atarussecurity.com/research/grafana-coinbase-cartel/ Pwn2Own Berlin 2026 paid out $1.3 million across 47 zero-days. OpenAI Codex got hit three times. https://atarussecurity.com/research/pwn2own-berlin-2026/ The three-day contest at OffensiveCon ran May 14 through 16 with TrendAI's Zero Day Initiative awarding $1,298,250 across 47 unique zero-day vulnerabilities. Mon, 18 May 2026 00:00:00 GMT https://atarussecurity.com/research/pwn2own-berlin-2026/ CISA gave federal agencies 48 hours to patch a CVSS 10.0 Cisco SD-WAN auth bypass. UAT-8616 is already in. https://atarussecurity.com/research/cisco-sd-wan-uat-8616/ CVE-2026-20182 is an authentication bypass in Cisco Catalyst SD-WAN Controller (formerly vSmart) and SD-WAN Manager (formerly vManage). Fri, 15 May 2026 00:00:00 GMT https://atarussecurity.com/research/cisco-sd-wan-uat-8616/ 32 lawmakers told the White House this week: AI is now finding bugs faster than companies can patch them. https://atarussecurity.com/research/lawmakers-ai-patch-gap/ A bipartisan group of 32 House lawmakers, led by Rep. Bob Latta (R-Ohio), wrote to National Cyber Director Sean Cairncross on May 13. Thu, 14 May 2026 00:00:00 GMT https://atarussecurity.com/research/lawmakers-ai-patch-gap/