Vulnerability in Palo Alto PAN-OS (CVE-2026-0301)
September 18, 2026 – PAN-OS is the next generation firewall software of Palo Alto.
Updates
Blog
Our employees frequently engage in research projects to live up to the high standard. They analyze the latest topics, methods and tools in interesting information security areas and prepare them in this context. The results of these activities contribute, for example, to projects, lectures at conferences, market overviews and articles for technical journals as well in advisories and zero-day-vulnerabilities.
All blog articles
Red Teaming
Version-Trouble in Mimikatz-Town
July 7, 2026 – It is common knowledge that for a long time there were issues when trying to use Mimikatz to dump credentials on newer Windows versions like 24H2. Recently, researchers have updated Mimikatz to make its credential dumping compatible with Windows 11 24H2 and 25H2. However, although this seems to be working fine most of the time, there are some cases in which even this updated version will crash. In this blog post, we will investigate the cause of this issue and present a way to fix it.
Author: Timm Weber
Forensic
Analysis of a credential stealer malware campaign – Part II
June 23, 2026 – Researchers have uncovered an evolved credential-stealing malware campaign that lures Windows users through fake software download pages appearing in Bing search results. The updated malware deploys a malicious Chrome extension disguised as “Microsoft Teams Helper,” capable of keystroke logging, real-time screen recording, cryptocurrency clipboard hijacking, and full remote code execution on the victim’s machine.
Author: Colin Glätzer, Konrad Weyhing
AD Security
Microsoft Defender for Identity evasions in 2026 – Part II
June 17, 2026 – The first blogpost highlighted the detection capabilities and the resulting evasion options for Microsoft Defender for Identity (DfI). To complement the first part, the second part will present some alternative detection possibilities for the defensive side to improve visibility and security, as well as the upgrade from DfI version 2.2 to DfI version 3.0.
Author: Jakob Scholz
AD Security
Microsoft Defender for Identity evasions in 2026 – Part I
June 16, 2026 – Microsoft Defender for Identity (DfI) is one of Microsoft’s key solutions for detecting identity-based attacks in Active Directory environments – but how well does it hold up against a skilled attacker? This two-part blog post dives into DfI’s detection capabilities for high-impact attacks such as shadow credentials, pass-the-cert, ESC8, and DCSync. Additionally, it uncovers a spoofing and relaying vulnerability in DfI’s Network Name Resolution component that can be used to evade multiple alerts, and offers blue team perspectives on closing these gaps.
Author: Jakob Scholz
Pentesting
Fuzzing vhosts with SNI(tch)
June 10, 2026 – Host header fuzzing stops at the HTTP layer and can’t find services hardened at the TLS handshake via SNI validation. SNItch fills that gap by fuzzing the SNI field directly – and doubles as a tool to verify your own servers don’t leak hostnames to IP-based reconnaissance.
Author: Felix Friedberger
Forensic
Analysis of a credential-stealer malware campaign – Part I
May 20, 2026 – In March 2026, cirosec identified an ongoing malware campaign targeting developers, IT professionals, and power users who rely on popular open-source and productivity tools. The campaign is only accessible using the Bing search engine. Once executed, the malware exfiltrates browser credential stores, cryptocurrency wallet data, authentication tokens, VPN and SSH configurations, and sensitive documents.
Author: Colin Glätzer, Konrad Weyhing, Felix Friedberger
Pentesting
Reifegrad für Sicherheitsüberprüfungen
11. Mai 2026 – Eine kurze Zusammenfassung unseres Vortrags bei den cirosec-TrendTagen zu Pentesting, Assumed Breach, Red Teaming, TLPT & Co.
Author: Michael Brügge
Kubernetes
The seven seas of Kubernetes security
May 5, 2026 – Today a single malicious container image could be enough to take over a larger fleet of machines and grant an attacker control over confidentiality, integrity and availability of all the workloads running in a Kubernetes cluster and potentially beyond, since clusters often hold secrets and credentials for external services and infrastructure. In this article we outline a set of key security domains that organizations should address to secure Kubernetes effectively.
Author: Christoffer Albrecht
Pentesting
Penetration Testing LLM Web Apps: Common Pitfalls
April 14, 2026 – This article focuses exclusively on penetration testing applications that use off-the-shelf LLM models through inference APIs.
Author: Felix Friedberger
Vulnerability in Palo Alto PAN-OS (CVE-2026-0301)
September 18, 2026 – PAN-OS is the next generation firewall software of Palo Alto.
Red Teaming
Version-Trouble in Mimikatz-Town
July 7, 2026 – It is common knowledge that for a long time there were issues when trying to use Mimikatz to dump credentials on newer Windows versions like 24H2. Recently, researchers have updated Mimikatz to make its credential dumping compatible with Windows 11 24H2 and 25H2. However, although this seems to be working fine most of the time, there are some cases in which even this updated version will crash. In this blog post, we will investigate the cause of this issue and present a way to fix it.
Author: Timm Weber
Forensic
Analysis of a credential stealer malware campaign – Part II
June 23, 2026 – Researchers have uncovered an evolved credential-stealing malware campaign that lures Windows users through fake software download pages appearing in Bing search results. The updated malware deploys a malicious Chrome extension disguised as “Microsoft Teams Helper,” capable of keystroke logging, real-time screen recording, cryptocurrency clipboard hijacking, and full remote code execution on the victim’s machine.
Author: Colin Glätzer, Konrad Weyhing
AD Security
Microsoft Defender for Identity evasions in 2026 – Part II
June 17, 2026 – The first blogpost highlighted the detection capabilities and the resulting evasion options for Microsoft Defender for Identity (DfI). To complement the first part, the second part will present some alternative detection possibilities for the defensive side to improve visibility and security, as well as the upgrade from DfI version 2.2 to DfI version 3.0.
Author: Jakob Scholz
AD Security
Microsoft Defender for Identity evasions in 2026 – Part I
June 16, 2026 – Microsoft Defender for Identity (DfI) is one of Microsoft’s key solutions for detecting identity-based attacks in Active Directory environments – but how well does it hold up against a skilled attacker? This two-part blog post dives into DfI’s detection capabilities for high-impact attacks such as shadow credentials, pass-the-cert, ESC8, and DCSync. Additionally, it uncovers a spoofing and relaying vulnerability in DfI’s Network Name Resolution component that can be used to evade multiple alerts, and offers blue team perspectives on closing these gaps.
Author: Jakob Scholz
Pentesting
Fuzzing vhosts with SNI(tch)
June 10, 2026 – Host header fuzzing stops at the HTTP layer and can’t find services hardened at the TLS handshake via SNI validation. SNItch fills that gap by fuzzing the SNI field directly – and doubles as a tool to verify your own servers don’t leak hostnames to IP-based reconnaissance.
Author: Felix Friedberger
Forensic
Analysis of a credential-stealer malware campaign – Part I
May 20, 2026 – In March 2026, cirosec identified an ongoing malware campaign targeting developers, IT professionals, and power users who rely on popular open-source and productivity tools. The campaign is only accessible using the Bing search engine. Once executed, the malware exfiltrates browser credential stores, cryptocurrency wallet data, authentication tokens, VPN and SSH configurations, and sensitive documents.
Author: Colin Glätzer, Konrad Weyhing, Felix Friedberger
Pentesting
Reifegrad für Sicherheitsüberprüfungen
11. Mai 2026 – Eine kurze Zusammenfassung unseres Vortrags bei den cirosec-TrendTagen zu Pentesting, Assumed Breach, Red Teaming, TLPT & Co.
Author: Michael Brügge
Kubernetes
The seven seas of Kubernetes security
May 5, 2026 – Today a single malicious container image could be enough to take over a larger fleet of machines and grant an attacker control over confidentiality, integrity and availability of all the workloads running in a Kubernetes cluster and potentially beyond, since clusters often hold secrets and credentials for external services and infrastructure. In this article we outline a set of key security domains that organizations should address to secure Kubernetes effectively.
Author: Christoffer Albrecht
Pentesting
Penetration Testing LLM Web Apps: Common Pitfalls
April 14, 2026 – This article focuses exclusively on penetration testing applications that use off-the-shelf LLM models through inference APIs.
Author: Felix Friedberger
Research
Vulnerability in Palo Alto PAN-OS (CVE-2026-0301)
September 18, 2026 – PAN-OS is the next generation firewall software of Palo Alto.
Red Teaming
Version-Trouble in Mimikatz-Town
July 7, 2026 – It is common knowledge that for a long time there were issues when trying to use Mimikatz to dump credentials on newer Windows versions like 24H2. Recently, researchers have updated Mimikatz to make its credential dumping compatible with Windows 11 24H2 and 25H2. However, although this seems to be working fine most of the time, there are some cases in which even this updated version will crash. In this blog post, we will investigate the cause of this issue and present a way to fix it.
Author: Timm Weber
Forensic
Analysis of a credential stealer malware campaign – Part II
June 23, 2026 – Researchers have uncovered an evolved credential-stealing malware campaign that lures Windows users through fake software download pages appearing in Bing search results. The updated malware deploys a malicious Chrome extension disguised as “Microsoft Teams Helper,” capable of keystroke logging, real-time screen recording, cryptocurrency clipboard hijacking, and full remote code execution on the victim’s machine.
Author: Colin Glätzer, Konrad Weyhing
Advisories
Vulnerability in Palo Alto PAN-OS (CVE-2026-0301)
September 18, 2026 – PAN-OS is the next generation firewall software of Palo Alto.
Vulnerability in Two App Studio Journey (CVE-2025-41459)
July 21, 2025 – Journey is a journaling app for iOS that stores personal entries and media.
Vulnerability in Two App Studio Journey (CVE-2025-41458)
July 21, 2025 – Journey is a journaling app for iOS that stores personal entries and media.
Vulnerabilities
cirosec follows this responsible disclosure policy when dealing with zero-day vulnerabilities found during research or customer projects. The goal is to balance the need of giving the vendor or open-source project enough time to develop and distribute a fix for the vulnerability with the need of the public to know about the security vulnerability. The policy is in accordance with industry-standard responsible disclosure practices. Our Responsible Disclosure Policy could be found here.
Do you want to protect your systems? Feel free to get in touch with us.