OCI, Oh My: Remote Code Execution on Oracle Cloud Shell and Code Editor Integrated Services
Tenable Research discovered a Remote Code Execution (RCE) vulnerability (now remediated) in Oracle Cloud Infrastructure (OCI) Code Editor. We demonstrated how an attacker could silently 1-click hijack a victim’s Cloud Shell environment and potentially pivot across OCI services. The vulnerability als...
How Tenable Research Discovered a Critical Remote Code Execution Vulnerability on Anthropic MCP Inspector
Tenable Research recently discovered a critical vulnerability impacting Anthropic's MCP Inspector tool, a core element of the MCP ecosystem. In this blog, we provide details on how we discovered the vulnerability in this widely used open-source tool — and what users can do about it.....
AI Security: Web Flaws Resurface in Rush to Use MCP Servers
In the rush to implement AI tools and services, developers are rapidly embracing the Model Context Protocol (MCP). In the process, classic vulnerabilities are resurfacing and new ones are being introduced. In this blog, we outline key areas of concern and how Tenable Web App Scanning can help....
GerriScary: 널리 사용되는 Google 제품(ChromiumOS, Chromium, Bazel, Dart 등)의 공급 사슬을 해킹
Tenable Cloud Research discovered a supply chain compromise vulnerability in Google's Gerrit code-collaboration platform which we dubbed GerriScary. GerriScary allowed unauthorized code submission to at least 18 Google projects including ChromiumOS (CVE-2025-1568), Chromium, Dart and Bazel, which ar...
CSE(클라이언트 쪽 확장 기능)의 악용: AD 환경에 백도어
Crucial for applying Active Directory Group Policy Objects, client-side extensions (CSEs) are powerful but also present a significant, often overlooked, attack vector for persistent backdoors. Rather than cover well-documented common abuses of built-in CSEs, this article demonstrates how to create c...
Where Capability Meets Opportunity: Introducing the Tenable Research Special Operations Team
Meet the elite squad that’s hunting the next major cyberattack. With more than 150 years of combined research experience and expert analysis, the Tenable Research Special Operations team arms organizations with the critical and actionable intelligence necessary to proactively defend the modern attac...
공격자가 사용하는 원격 모니터링 및 관리 도구를 탐지
Following up on last year’s LOLDriver plugin, Tenable Research is releasing detection plugins for the top Remote Monitoring and Management (RMM) tools that attackers have been more frequently leveraging in victim environments....
바이브 코딩에 대해 자주 묻는 질문
Vibe coding has attracted much attention in recent weeks with the release of many AI-driven tools. This blog answers some of the Frequently Asked Questions (FAQ) around vibe coding....
MCP 프롬프트 인젝션: Not Just For Evil
MCP tools are implicated in several new attack techniques. Here's a look at how they can be manipulated for good, such as logging tool usage and filtering unauthorized commands....
최근 보안 강화에도 불구하고 Entra ID 동기화 가능은 여전히 남용되고 있습니다
하이브리드 환경에서 ID를 관리하기 위한 Microsoft 동기화 가능에 위험이 없는 것은 아닙니다. 이 블로그에서 Tenable Research는 이런 동기화 옵션이 악용될 수 있는 잠재적 약점을 알아봅니다....
Verizon 2025 DBIR: Tenable Research의 협업으로 CVE 수정 추세에 집중합니다
2025년 Verizon Data Breach Investigations Report(DBIR)에서는 20의 침해에서 취약성 악용이 있어서 작년 동기 34% 증가했음을 보여줍니다. 이 보고서를 지원하기 위해 Tenable Research에서는 가장 악용되는 취약성에 대한 보강된 데이터를 기여했습니다. 이 블로그에서는 17개 엣지를 분...
CISA BOD 25-01 컴플라이언스: 미국 정부 기관이 알아야 하는 사
미국 정부 기관은 사용하는 Microsoft 365 클라우드 서비스가 최근 Binding Operational Directive를 준수하도록 해야 합니다. Tenable이 다음과 같은 도움이....
