Corelight gives you the high ground—a commanding view of your network that lets you outsmart and outlast adversaries.

Corelight researchers have disclosed a Windows Server vulnerability that lets attackers with network access crash affected systems with a single malicious DFS referral response.

Pinned MCP servers silently pulled new dependencies in Corelight’s tests, an MCP server supply chain risk for admins who hold credentials.

An MCP server configured to run one fixed release on an administrator’s workstation ran with 15 different sets of dependencies over five weeks, with its configuration untouched. James Lagermann, Director of Technical Alliances at Corelight, found the drift in his company’s lab. Twenty-three of the server’s 69 packages changed versions, including the cryptography library, the JSON Web Token library and the MCP software development kit itself. MCP (Model Context Protocol) servers let AI coding assistants …

管理者のワークステーション上で、特定の1リリースだけを実行するよう設定されたMCPサーバーが、設定に一切手を加えていないにもかかわらず、5週間で15通りの異なる依存関係セットで動作していました。この変化を見つけたのは、Corelightで技術アライアンス担当ディレクターを務めるJames Lagermann氏です。同

Corelight gives you the high ground—a commanding view of your network that lets you outsmart and outlast adversaries.

Corelight gives you the high ground—a commanding view of your network that lets you outsmart and outlast adversaries.

In this Help Net Security video, Vince Stoffer, Field CTO at Corelight, talks about how AI is changing work in the SOC and how attackers are using the same tools. He explains how LLMs help with vulnerability analysis and detection engineering, including writing SIEM rules and small programs that analyze packets or Zeek metadata. Those using agentic triage report faster work and fewer false positives, and junior analysts can dig deeper into network data. Stoffer …

Corelight’s Vince Stoffer explains how AI in the SOC speeds up triage and detection work, and how attackers are using the same AI tools.

Exposure management company Tenable Holdings announced expansion of its open technology and partner ecosystem to accelerate integrated security workflows across the entire tech stack. Tenable OPEN for AI delivers validated, ready-to-use AI workflows, enabling organizations to use Tenable’s deep exposure intelligence with their preferred AI models, agents and tools. Tenable OPEN for AI launch partners include BeyondTrust, Cohesity, Command Zero, Corelight, Infoblox, Recorded Future, Securonix, SentinelOne, Setyl, Snyk, Sparkle In and Splunk.

Tenable Holdings (TENB) launched OPEN for AI, expanding its technology partner ecosystem to connect exposure data with customers’ preferred AI tools. The program supports standardized MCP connectors and direct APIs, which connect software systems, for workflows across security platforms.Launch partners include BeyondTrust, Corelight, SentinelOne, Snyk and Splunk. Available workflows cover security alert investigation, network threat mapping, code-to-runtime vulnerability checks and identity-based risk assessment. Tenable says the program enables customers to combine data across vendors without custom software development.

Microsoft patched a Windows Server vulnerability that lets a network-adjacent attacker crash a server with a crafted Distributed File System (DFS) referral response. Tracked as CVE-2026-70111, the flaw affects Windows Server 2019, 2022, and 2025. Corelight researchers reported the issue after finding it while testing Microsoft Remote Procedure Call (MS-RPC) and DFS interfaces. The company said it had not seen signs of active exploitation when it disclosed the flaw on October 13, 2026. The vulnerability poses a denial-of-service risk, not server takeover. An attacker needs network access to make the target connect to a malicious SMB server , which returns a malformed DFS referral that crashes the service a process Corelight says can take seconds. Windows uses DFS to direct users and systems to files stored across a network. When a Windows Server resolves a DFS path, a component called mup.sys requests referral information over SMB. Corelight found that a crafted response can reach a vulnerable code path while the driver processes a DFS referral. The reported cause is a missing length check. In a particular NameList referral, an offset can point to an empty string. The server code does not reject that value before processing it, and the kernel can hit an invalid memory reference. The result is a blue screen and an unexpected reboot. Corelight reproduced the crash 11 out of 11 times on Windows Server 2022 and 3 out of 3 times on Server 2019. Those results show the issue was repeatable in the researchers’ lab. Microsoft Windows Server 0-Day Flaw However, they don’t show how often organizations use it. Corelight said Windows 10 is not affected because it retains checks absent from the affected Server builds. Windows Server may restart automatically after a kernel fault, which can limit the length of a single disruption. However, an attacker who can repeatedly trigger the flaw may keep a system offline. The impact depends on which servers are reachable and targeted. Repeated crashes of important systems, such as domain controllers, could disrupt key services across an organization. Corelight says reboots may leave little evidence beyond Windows System log Event IDs 41 and 6008, which indicate an unexpected shutdown without explaining the cause, making network monitoring essential to identify activity before and after the crash. Microsoft’s October 2026 security update, released October 13, addresses CVE-2026-70111 on Windows Server 2019, 2022, and 2025. Organizations should apply the relevant update and prioritize servers that actively use DFS. Corelight advises monitoring internal, or “east-west,” SMB traffic between servers and domain controllers, not only traffic crossing the perimeter. Its researchers say Zeek connection logs may show sessions going silent during a crash and reset activity after the server returns. A sudden cluster of connection states such as S1, RSTR, or RSTRH involving the same Server may merit investigation. However, those signs alone do not prove exploitation. For more background on Windows authentication coercion, see Cyber Security News’ coverage of Windows authentication coercion attacks . Its earlier report on Windows denial-of-service vulnerabilities offers related context on service availability risks. CVE-2026-70111 shows how an overlooked input check in a kernel driver can turn a network response into a server outage. Patching affected systems and monitoring internal SMB transactions are key steps to reduce the risk. The technical findings and patch details are described in Corelight’s disclosure. Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs . The post Microsoft Windows Server 0-Day Flaw Lets Attackers Crash Servers With a Single Packet appeared first on Cyber Security News .

Corelight researchers have disclosed a Windows Server vulnerability that lets attackers with network access crash affected systems with a single malicious DFS referral response.

Corelightの研究者らは、ネットワークにアクセスできる攻撃者が、悪意あるWindows Serverの脆弱性を突き、DFS（分散ファイルシステム）リファラル応答1つで対象システムをクラッシュさせられると公表しました。 この脆弱性は「CVE-2026-70111」として追跡されており、Windows Server

Corelight gives you the high ground—a commanding view of your network that lets you outsmart and outlast adversaries.

A desktop workbench for writing, validating, compiling, and testing YARA rules.

Corelight gives you the high ground—a commanding view of your network that lets you outsmart and outlast adversaries.

Corelight gives you the high ground—a commanding view of your network that lets you outsmart and outlast adversaries.

Corelight gives you the high ground—a commanding view of your network that lets you outsmart and outlast adversaries.

Corelight gives you the high ground—a commanding view of your network that lets you outsmart and outlast adversaries.

Corelight gives you the high ground—a commanding view of your network that lets you outsmart and outlast adversaries.