info1 source
France's national cybersecurity agency, ANSSI, released a new baseline publication focused on corporate Wi-Fi security. Published under their 'Les Essentiels' series, the document is targeted at organizations looking to lock down their wireless footprint regardless of their baseline technical maturity.
Unlike exhaustive configuration documents or granular hardening guidelines, this format functions as an accessible collection of standalone, complementary best practices. The recommendations encompass core defensive measures such as adopting the `WPA3` protocol and tightening wireless credential management policies.
According to the agency's publication metadata, the material serves to distill practical, anti-intrusion advice reflecting ANSSI's operational perspective at the time of release. The guidance aims to address common operational pitfalls in corporate wireless environments across roughly twenty practical recommendations.
ANSSI noted that this series of recommendations is designed to evolve continuously. Updates will be issued based on shifts in the wireless threat landscape, emerging protocols, and empirical feedback from incident response engagements.
The document is distributed directly through the agency's dedicated MesServicesCyber platform to provide broad accessibility across private and public sector infrastructure operators.
Organizations evaluating their perimeter defense are encouraged to treat these guidelines as a pragmatic reference check against their internal wireless deployment standards.
Read more → about ANSSI Refreshes Corporate Wi-Fi Security Guidance Under Its 'Essentiels' Collectioncritical1 sourceCVE-2026-19766 CVE-2026-73700 +50
Hewlett Packard Enterprise has released security updates addressing 52 vulnerabilities across HPE Networking Fabric Composer deployments running versions 7.3.3 and earlier.
The massive batch of fixes includes two maximum-severity issues rated at CVSS 10.0 that allow unauthenticated remote attackers to take full control of the platform. The first critical flaw, tracked as `CVE-2026-76658`, stems from an authentication weakness inside the product's SSH daemon that allows arbitrary privileged command execution without requiring credentials or user interaction. The second CVSS 10.0 bug, identified as `CVE-2026-76657`, resides in the Fabric Composer API and lets remote attackers bypass authentication controls to gain administrative privileges.
Three other vulnerabilities carry critical severity ratings, encompassing adjacent-network authentication bypasses and remote code execution flaws under `CVE-2026-19766`, `CVE-2026-73700`, and `CVE-2026-73701`.
The broader advisory covers 24 high-severity, 17 medium-severity, and six low-severity vulnerabilities spanning SQL injection, arbitrary file writes, path traversal, broken access controls, and local privilege escalation. Many of these flaws allow attackers to execute code with root-level permissions or alter configuration states on systems managed by the fabric platform.
HPE's internal networking security researchers discovered the entire collection of vulnerabilities. As of the September 1 advisory release, the vendor stated that no public exploit code or active exploitation had been observed in the wild.
Organizations running affected deployments are advised to update the 7.3 release train to version 7.3.4 or upgrade directly to branch 7.4.0 or later. Unmaintained and end-of-support versions were not assessed and must be treated as vulnerable by default.
For environments unable to patch immediately, HPE recommends isolating CLI and web management interfaces onto dedicated Layer 2 segments or VLANs protected by strict Layer 3 firewall policies.
Read more → about HPE Fabric Composer Patches 52 Security Flaws Including Two Maximum-Severity RCE Bugscritical1 source
China-nexus espionage group Fire Ant has shifted its focus from hypervisors to core control-plane infrastructure, compromising Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts.
According to an investigation by Sygnia, the threat actor modified the underlying execution environments of Cisco IOS XR devices to establish persistence, anti-forensic capabilities, and covert communication channels. On affected routers, investigators discovered an active GRE tunnel interface that was missing from running configurations and commit-history records.
The intrusion toolkit utilized a rogue persistence script disguised as a boot service alongside an implant named `acpid` that executed intermittently to minimize runtime visibility. The attackers deployed a modified IOS XR syslog library designed to intercept and suppress any log events containing the string "Health", returning fake success statuses rather than alerting administrators.
To further mislead network engineers, the malware hooked the CLI command-execution path to append hidden exclusion filters to `show` commands, hiding all trace of malicious VRFs, interfaces, and tunnel configurations.
The group abused administrative workflows to perform packet captures across router interfaces, staging and exfiltrating PCAP dumps to external FTP servers to map topology and capture credentials. Concurrently, Fire Ant attacked TACACS servers using a modular toolset tracked as TacTap, which injected a rogue shared library at `/lib/libseconfd.so` via `/usr/sbin/acppid` directly into the `tac_plus` daemon.
TacTap hooked the `accept` and `accept4` socket APIs to capture live administrator sessions and credential material, writing the data to `/var/log/.tacplus.acct` obfuscated with a single-byte XOR key (`0xEF`).
Additionally, the actors maintained a Linux staging node utilizing a root backdoor dubbed BridgeAgent, which masqueraded as a `zabbix_agent.service` systemd unit and disguised its process name as `/usr/bin/gnome-shell` while probing downstream critical infrastructure targets.
Read more → about Fire Ant Targets Network Core: Cisco IOS XR and TACACS Servers Subverted for Covert Espionage