Parse notes
Sponsored
OX Security analyzed 101+ million security findings across 178 organizations [4] and the results are eye-opening : ONLY 2-5% OF THESE ALERTS ACTUALLY MATTER! The rest? Just static noise, draining your AppSec and Dev teams while real threats slip by unnoticed.
Next.js has disclosed a Critical (9.1/10) auth bypass vulnerability. Next.js uses an internal header, X-middleware-subrequest, to prevent infinite loops from recursive requests. The vulnerability allowed users to abuse the header, bypassing middleware checks, including authorization.
Five vulnerabilities in the NGINX Ingress Admission Controller, called IngressNightmare, enable remote code execution without authentication. Attackers can inject harmful configurations to compromise Kubernetes environments via the admission controller.
This past Saturday, a hacker took over NYU's website for at least two hours and exposed the personal data of over 3M applicants in an act of hacktivism. The leaked data included names, test scores, majors, zip codes, financial data, and information on applicants' family members dating back to at least 1989. The hacker claimed to have breached NYU to expose its continued use of affirmative action after the 2023 SCOTUS ruling.
Defensive tools that use command-line arguments to detect malicious activity are vulnerable to a technique called ArgFuscator. Obfuscation can exploit parsing flaws in executables to evade security detections, highlighting weaknesses in current cybersecurity methods.
Microsoft's Time Travel Debugging (TTD) framework is a powerful record-and-replay tool that uses CPU instruction emulation to replay program execution. Google's Mandiant team found a bug in the emulation engine and built a fuzzing harness to execute random instruction sequences through TTD and a real CPU, discovering three bugs in the process, which they reported to Microsoft.
This tutorial demonstrates how to unpack a modified UPX-packed executable using TinyTracer and PE-sieve tools, which avoids anti-debugging measures common in packed malware. The process involves first tracing the executable to identify its Original Entry Point (OEP), setting a stop offset in TinyTracer to pause execution at the OEP, then using HollowsHunter to dump and reconstruct the unpacked program with its Import Address Table. After dumping, final modifications are needed in PE-bear to fix the entry point and restore proper section characteristics for the executable to run successfully.
Sponsored
Are your security controls in fighting shape against today's threats? You don't have to guess. Prelude monitors and validates your security controls [11] - evaluating your full estate of devices (with no agents required), surfacing missing and suboptimal controls, ensuring best practices are in place, and alerting you on configuration drift. Start
Twistr is a domain name permutation and enumeration library powered by Rust. It aims to directly port the well-known dnstwist tool allowing for fast and flexible interfacing capabilities with the core libraries based on the client's requirements.
Microsoft is expanding Security Copilot with 11 AI agents across its security platform. Six Microsoft-built and five partner-developed agents will help automate cybersecurity tasks like phishing triage, threat intelligence, and vulnerability management, aiming to combat the growing complexity of cyber threats.
Bounty Prompt is a Burp Suite extension that allows users to save preconfigured AI prompts and automatically attach selected HTTP requests and responses.
Albabat ransomware is evolving to target Windows, Linux, and macOS platforms. Retrieving components from a GitHub repository, it now harvests system information, encrypts files across multiple operating systems, and tracks infections in a PostgreSQL database.
This post compares DryRun Security's contextual scanner to Snyk Code, GitHub Advanced Security, Semgrep, and SonarQube in finding vulnerabilities in the intentionally vulnerable RailsGoat. The test PR included SQL injection, XSS, SSRF, IDOR, user enumeration, and hardcoded token vulnerabilities. DryRun was the only tool that found all the vulnerabilities, whereas Semgrep found 3/6, GitHub and Snyk found 2/6, and SonarQube found none.
The UK's NCSC aims to adopt post-quantum cryptography (PQC) by 2035, with key milestones including completing discovery and planning by 2028 and high-priority migrations by 2031.
China-linked APT Weaver Ant infiltrated an Asian telecom provider's network for over four years, using web shells for persistence and stealthy control of compromised systems.
23andMe filed for bankruptcy and will sell its assets - customers should delete their DNA data for privacy.