Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

While attackers often find low-privileged credentials after creating a process dump of LSASS or harvesting hashes with a tool like Responder, they are rarely able to do anything with those credentials (RDP aside). We set out to discover how malicious actors might exploit Microsoft Windows remote procedure call (RPC) protocols to gather data remotely as a low-privileged user using RPC as an attack surface.

In this first installment of a series on the transformation of SafeBreach’s development organization, VP of Development Yossi Attas outlines how his team is managing the strategic shift toward an AI-First development methodology. This includes moving beyond simple tool adoption to a fundamental redefinition of the software engineer’s role. Read on as we explore.

2025 marked a pivotal year for SafeBreach as we took our first steps in our evolution from the pioneers in Breach and Attack Simulation (BAS) to the leader in Continuous Threat Exposure Management (CTEM). The year was marked by a number of impressive highlights, all of which we could not have achieved without the partnership of our employees, customers, and partners: Read on for more in-depth insights into the year that was 2025 for SafeBreach and a sneak peak at what’s in store for 2026.

In January 2026, the GNU telnetd service from GNU InetUtils was found to be vulnerable to authentication-bypass by Simon Josefsson. Tracked as CVE-2026-24061, this flaw allows an attacker to establish a Telnet session without providing valid credentials, granting unauthorized access to the target system. The vulnerability exists all the way up to version 2.7-2 of the GNU telnetd service and, as indicated by Simon, looks like it was taken right out of the 90s.