Cisco has released fixes for a maximum severity (10.0 CVSS score) vulnerability affecting IOS XE Software for Wireless LAN Controllers. The devices utilize a hardcoded JWT that could allow unauthenticated attackers to exploit the AP image download interface to upload files, perform path traversal, or execute arbitrary code. Only devices with the “Out-of-Band AP Image Download” feature, which allows APs to download AP's OS images via HTTPS, are vulnerable.
In this blog post, the author recounts creating defendnot, a Windows Defender disabling tool, after his previous project faced a DMCA takedown. The twist in the story is that he built it while traveling and got inspired while in Seoul, which made him seek to develop a "clean" implementation using Windows Security Center API.
This post explores SCIM (System for Cross-domain Identity Management), detailing its core components, potential security vulnerabilities, and common implementation issues. It provides insights into authentication bypasses, token management risks, user re-provisioning flaws, and potential account takeover scenarios in identity management systems.
Enforcing FIDO as the sole MFA is often seen as phishing resistant. However, this post shows a new attack that utilizes the OAuth 2.0 Device Code Flow to downgrade MFA. The Device Code Flow enables a user to authenticate devices. In this method, an attacker uses a headless browser to automate the Device Code Flow, allowing the user to be phished through an attacker-controlled link without entering the code.
Sponsored
Qwiet AI has been named BEST APPLICATION SECURITY SOLUTION [14] by the SC Awards [15]. Our Agentic AI AutoFix accelerates vulnerability detection, prioritizes by exploitability, and remediates code directly. We're reshaping AppSec for faster, more secure development. Schedule a personalized demo [16]to see why industry leaders trust Qwiet AI.
VanishID offers online executive (and families) protection, including continuous dark web monitoring for compromised passwords, detection of fake social media accounts, identification of misconfigured websites, and data and fake profile takedown capabilities.
The Agentic Radar analyzes and assesses agentic systems for security and operational insights. It helps developers, researchers, and security professionals understand how agentic systems function and identify potential vulnerabilities.
KoviD is a Linux kernel rootkit that hides itself and files, grants root privileges, and evades firewalls. It can easily manipulate network logs, gain root access, and persist through reboots.
German authorities seized €34 million from the eXch crypto exchange, alleging unlicensed operations and money laundering by North Korean hackers, including proceeds from the Bybit hack through illicit cryptocurrency transactions.
Micah Lee searched for DOGE employee Kyle Schutt's personal Gmail address on Have I Been Pwned and found that he appeared in 51 breaches and five pastes. Notably, Schutt's credentials appeared in info-stealer logs, meaning that a device belonging to him was infected with info-stealer malware at some point. Schutt has access to FEMA's core financial systems. DOGE has not confirmed if employees are using work or personal devices.
Zakhar Fedotkin found that ASCII control characters such as SOH (\x01) and ETX (\x03) can be exploited in Visual Studio Code to run arbitrary commands via node-pty, which sends raw bytes to the shell. The vulnerability exploits two vectors: injecting control characters into run configuration files and creating maliciously named files that execute commands when dragged into VS Code's terminal. This issue impacts macOS and Ubuntu systems, where control characters are permitted in filenames, although Microsoft does not view it as a security vulnerability due to measures like workspace trust warnings.
Florida's proposed social media encryption backdoor bill fails, and it was rejected after concerns about user privacy and potential security vulnerabilities from law enforcement access.
Roblox is being sued for allegedly tracking children's data without proper consent and sharing it with advertisers through hidden tools.
Hackers are now exploiting ClickFix attacks on both Linux and Windows systems by deceiving users into executing commands that install malware via fraudulent website error messages.
Sponsored
Your SOC team has a ransomware playbook… but your OT engineers live in a different universe. Meanwhile, attackers exploit this gap daily—with 45% of ICS compromises starting in IT networks before crossing into industrial systems. At $4.73M per incident, that's an expensive disconnect!
Ascension, the second-largest private healthcare system in the US, suffered a data breach that exposed the personal and health information of 437,329 patients through a former partner's compromise. In December 2024, the partner faced a security incident due to a vulnerability in third-party software, leading to the theft of sensitive data, including names, contact details, SSNs, and medical visit records. This marks Ascension's second major cybersecurity incident, following a Black Basta ransomware attack in May 2024, prompting the company to offer affected patients two years of free identity monitoring.
AllTrust (Valsoft Corporation) is notifying 160,000+ people of a February data breach at its subsidiary, Aspire USA. Unauthorized access occurred February 12-15, with security teams interrupting an in-progress file transfer. Potentially compromised data includes names, driver's licenses, Social Security numbers, and financial details. No misuse has been reported.
SK Telecom suffered a massive cyberattack in April 2025 that compromised the personal data of 23 million South Koreans. This article navigates the timeline, highlighting potential losses of $5 billion if cancellation fees are waived. The malware was found in SKT's home subscriber server.
This tutorial shows how to use BallisKit tools (ShellcodePack and MacroPack Pro) to deploy Sliver C2 implants while evading security measures. It demonstrates how to set up a Sliver server on Linux, generate implant types, and weaponize them with ShellcodePack to bypass EDRs. It also explains how to create initial access payloads like LNK files and ClickOnce applications to deploy the obfuscated Sliver implants on target Windows machines.
This blog post explains how Google's Project Zero created a custom fuzzing harness to identify vulnerabilities in macOS's CoreAudio system by targeting Mach IPC messages, using a "knowledge-driven fuzzing" approach that merges automation with reverse engineering. Through iterative enhancements to the harness, including proper system initialization, API call chaining for stateful operations, mocking out problematic functionality, and refining message structures, the author identified a type confusion vulnerability (CVE-2024-54529) in the CoreAudio daemon. This vulnerability arose because several message handlers did not verify object types before function calls, allowing arbitrary code execution via crafted Mach messages sent from a sandboxed process.
2025.05.12·googleprojectzero.blogspot.com·23 min read·TLDR InfoSec Sponsored
This white paper outlines a DevSecOps maturity model [13] based on Datadog's work with thousands of organizations. The model maps key competencies and practices across culture, development, testing, deployment, operations, and incident response - with clear definitions that help you understand where you are today, and where you should aim
NomadScanner is a stealthy Windows port scanner designed for red teamers and penetration testers. It operates in-memory to avoid leaving disk artifacts and sends randomized HTTP probes for maximum stealth.
Valarian's platform, ACRA, segments data and communications into tightly controlled “compartments” to enforce environment isolation.
vAPI is a Vulnerable Adversely Programmed Interface, a Self-Hostable API that mimics the OWASP API's Top 10 scenarios through exercises.
The Bluetooth Special Interest Group (SIG) has announced Bluetooth Core Specification 6.1, which includes key improvements to the wireless communication protocol. One new feature is increased device privacy through randomized Resolvable Private Addresses (RPA) updates. The SIG states that varying the timing of address changes significantly complicates third parties' ability to monitor or relate device activities over time.
Law enforcement dismantled a 20-year-old botnet behind Anyproxy and 5socks services, arresting four suspects, including three Russians. The U.S. Justice Department charged them with operating illegal proxy networks and exploiting infected routers for profit. The FBI warned about these malicious services targeting vulnerable end-of-life routers, urging users to replace compromised devices to prevent cyberattacks.
A bipartisan Senate bill from Senators Bill Cassidy (R-La.) and Jacky Rosen (D-Nev.) seeks to ban federal contractors from using DeepSeek, a Chinese-made language model whose hosted version transmits data to China. This legislation addresses national security fears about sensitive data access by the Chinese government while allowing case-by-case waivers for national security or research reasons. The bill contributes to a broader initiative to limit Chinese AI in government, complementing a House bill prohibiting DeepSeek on government devices and similar laws in Texas, New York, and Virginia.
Google has agreed to pay Texas $1.375 billion to settle privacy violation claims related to geolocation tracking and data collection, reflecting a significant increase compared to earlier settlements.
Microsoft Teams is introducing a screen capture blocking feature for meetings, ensuring sensitive information is protected - users on unsupported platforms will be switched to audio-only mode.
Cybercriminals target old routers that no longer receive updates, exploiting vulnerabilities to install malware and create botnets.
Sponsored
As the avalanche of AI-generated code transforms development practices, AppSec teams face unprecedented security challenges.
A new phishing kit called CoGUI was used to send over 580M emails to targets between January and April. The attack chain begins with an email impersonating a legitimate site with an urgent subject line. The email includes a link that checks if the victim's machine matches a series of criteria such as IP, browser language, OS, etc, and presents a fake login page if the criteria match or redirects the victim to the legitimate site if not. CoGUI is the largest volume phishing campaign Proofpoint is tracking.
Kickidler is an employee monitoring tool that can capture keystrokes, take screenshots, and create videos of employees' screens. A new ransomware campaign operates by using Google Ads masquerading as ads for RVTools, a free Windows utility for managing VMware vSphere deployments. This leads users to download a trojanized version of the software that includes a PowerShell backdoor that deploys Kickidler on the device. The ransomware operator then monitors the victim's (likely an administrator) machine to collect credentials for sensitive systems and off-site cloud backups without detection.
rand-user-agent, an npm package, was compromised in a supply chain attack that caused it to inject obfuscated code that activates a remote access trojan (RAT) on users' systems. Aikido detected the compromise on May 5, when its malware analysis flagged version 1.0.110. Researchers found obfuscated code hidden in 'dist/index.js', visible only by scrolling horizontally in the npm site's source view.
The PortSwigger research team developed a Burp AI extension that automatically documents a pentest based on the request history. The initial implementation was good at spotting Path Traversal vulnerabilities, but struggled with more complex vulnerabilities like XSS until the team added a regex translator to transform inputs. The team found that the AI could be directly asked to explain why it reported that a false positive was a vulnerability and how to improve its prompt to classify vulnerabilities better.
Advertisers use Traffic Distribution Systems (TDSs) to direct potential customers to highly targeted ads. Insikt Group has been tracking how cybercriminals utilize malicious TDSs to direct victims to the malware with the highest likelihood of success against the target. Insikt Group has identified a TDS known as TAG-124 that is used by multiple threat actors, such as the Rhysida Ransomware-as-a-Service operation, Iterlock Ransomware, and TA866/ Asylum Ambuscade, but notes that TDSs are hard to defend against because they occur so early in the cyberattack life cycle.
This article discusses memory safety approaches beyond language choice, emphasizing comprehensive solutions including sanitizers, fuzzers, and compiler-based mitigations. The practices include selecting robust distributions like Debian, using tools like Fil-C for C/C++ safety, and implementing runtime protections.
Rulehound is an index of publicly available and open-source threat detection rulesets.
CodeAnt automatically reviews pull requests, flags issues, and proposes fixes. It continuously scans and monitors code and dependencies for a wide range of quality and security issues.
Nosey Parker is a command-line tool that finds secrets and sensitive information in textual data and Git history.
Daniel Stenberg, the original author of the curl project, posted on LinkedIn about an increasing issue of AI-generated bug reports being submitted to the program on HackerOne. Stenberg has said that maintainers on the project are getting bogged down by “AI slop” reports that include hallucinated vulnerabilities such as one that he cites in the article in which the reported claimed to have found a “novel exploit leveraging stream dependency cycles in the HTTP/3 protocol stack” but the reporter continuously gave nonsensical responses to follow-up questions. Stenberg announced that any reporters of “AI slop” vulnerabilities will be banned from the project.
Google is enhancing Chrome security with Gemini Nano, an on-device AI model, to protect desktop users against scams through Enhanced Protection mode. New AI warnings on Android will also help users identify malicious notifications. Google claims these AI systems have already reduced airline customer service scams by 80% and blocked millions of scammy pages.
Ubuntu 25.10 will be the first major Linux distribution to adopt sudo-rs, a Rust reimplementation of sudo developed by the Trifecta Tech Foundation. This memory-safe alternative aims to enhance security at the privilege boundary while maintaining compatibility. The transition should be transparent for most users, though some niche features may not be included.
A federal judge has advanced a class action lawsuit against Delta Air Lines by passengers affected by the July 2024 CrowdStrike software outage.
Fake crypto exchange ads on Facebook are spreading malware through deceptive tactics like using celebrity names and trusted cryptocurrency exchange logos to lure users into downloading malicious software.
Europol has shut down six DDoS attack websites and arrested four individuals in Poland for running a network of platforms used for attacks.
Sponsored
AI is transforming business – but securing it? That's a whole new challenge.