Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Oregon's Department of Environmental Quality (DEQ) is investigating a cyberattack that forced network shutdowns. Despite the agency repeatedly stating it found no evidence of a data breach, the ransomware group Rhysida claims to have stolen 2.5 TB of files, demanding $2.5 million in bitcoin to prevent the auction of the allegedly stolen data.
A critical vulnerability (CVE-2025-32433) in Erlang/OTP's SSH implementation allows attackers to execute arbitrary code without authentication. The flaw received a maximum CVSS score of 10.0. Affecting all SSH servers using the Erlang/OTP SSH library, it enables unauthenticated attackers to send protocol messages before authentication. Users are advised to update ASAP.
The head of the UK's House of Commons Lucy Powell's X account was hacked to promote a new scam cryptocurrency. The post described a new community-driven digital currency known as $HCC. Analysts noted that there had been only 34 transactions for the coin resulting in a profit of around £225.
Private API Gateways in AWS are not internet accessible but are accessible to anyone in the AWS networks. Users who don't realize this can misconfigure the API Gateway with a Principal of ‘*' with the intention of allowing access from any VPC in their account, but are actually opening it to any VPC in AWS. This attack generally cannot be exploited without some initial access or knowledge of the API Gateway endpoint and REST API spec.
This post discusses a method for analyzing mobile app data sharing and provides a Python notebook and guide to enable anyone to monitor and investigate how apps share location and other personal data. The author has created visualization tools showing how adtech companies like Unity dominate mobile game traffic, with hundreds of data requests happening within seconds of opening an app. The guide walks readers through setting up mitmproxy to intercept mobile traffic, recording app sessions, and analyzing the captured data to discover what personal information is being shared with third parties.
Pillar Security provides security controls throughout the entire AI lifecycle, from integrating with existing code repositories and data infrastructures to mapping AI models, datasets, and frameworks.
BlackCat is a PowerShell module designed to assess the security posture of Azure environments.
Corsha provides a machine identity platform (m-IdP) that authenticates, manages, and governs the growing traffic between machines, facilitating secure multi-factor authentication (MFA) between any machines.
Florida's draft bill, which requires social media companies to implement encryption backdoors for law enforcement, has advanced to the Senate floor. The "Social Media Use by Minors" legislation would also require parental access to children's accounts and prohibit the use of disappearing messages for minors. Critics argue the bill would compromise security and make users less safe.
MCP servers are the future of security as they can unify disparate security tooling, handle the massive amounts of data used in security, and enable security professionals who don't know how to code. MCP servers offer a fully customized, single-pane-of-glass interface for organizations. Authentication and auditing remain issues that need to be implemented outside of the spec.
This document details a two-month investigation by cybersecurity researchers who discovered North Korean IT workers infiltrating legitimate open-source projects, particularly through the freelance platform onlyDust. The researchers identified three leading actors (0xExp-po, bestselection18/Hiroto Iwaki, and aidenwong812/cryptogru812) who created elaborate false identities, manipulated commit histories, and received payments totaling at least $1,874 across 11 repositories while contributing 62 pull requests. The investigation highlights serious security risks, including potential supply chain attacks, as these DPRK IT workers often collaborate with North Korean hacking teams to identify targets and establish initial access for future attacks.
Monitor AWS documentation changes and security updates in real-time and track modifications across all AWS services to stay informed about critical security changes.
A House report warns that DeepSeek, a Chinese AI tool, poses national security and economic risks to the U.S. due to its low cost, ties to Chinese entities, and use for intelligence gathering on Americans, and recommends stricter export controls and closer monitoring of emerging AI technologies.
Microsoft Office 2016 and 2019 will lose support after October 14, so users are advised to upgrade to Microsoft 365 or Office 365 to avoid security risks and maintain support.
Sponsored
Flashpoint's Threat Intelligence Report looks at +3.6 petabytes of data from the hardest-to-reach corners of the web — revealing 2.1B stolen credentials and 5,742 ransomware attacks in 2024, with five major RaaS groups responsible for nearly half.
The Common Vulnerability and Exposures (CVE) repository, a 25-year-old program run by MITRE for DHS, serves as the global cybersecurity standard for identifying and documenting security vulnerabilities. Yesterday, there were rumors that MITRE's contract would expire, but it has received an 11-month extension from CISA, averting potential widespread disruption to vulnerability management worldwide.
Apple has released emergency security updates to patch two new zero-day vulnerabilities exploited in sophisticated attacks against iPhones. The first vulnerability is a flaw in CoreAudio, which can be exploited by processing an audio stream in a malicious file to execute remote code. The second vulnerability is a flawed RPAC that allows attackers with read or write access to bypass Pointer Authentication, which is a security feature to protect against memory vulnerabilities.
Security researchers have discovered a publicly accessible server containing 1,229 unique AWS credentials. Upon investigation, the researchers found that the active keys were used in S3 ransomware campaigns, where the attackers utilized SSE-C to encrypt S3 bucket data and demanded 0.3 BTC (~$25,000) per victim. In some cases, the highly automated attackers were willing to offer a “proof of decryption” test file restoration.
EDV is a tool that feeds Windows Sysmon security events to Microsoft's Copilot AI through WebSocket connections, asking it to identify malicious activity. Testing with known attack techniques showed Copilot could detect about 40% of malicious events not blocked by Windows Defender, though with inconsistent results and false positives.
IDOR vulnerabilities occur when attackers manipulate direct object references like IDs in URLs to access unauthorized data. As a common form of Broken Access Control, these flaws are prevalent in web applications, relatively easy to find, and highly impactful. This guide walks through how bug bounty hunters regularly exploit it.
Frequency analysis is a technique that allows for the detection of anomalies in a set of data. This post details how Fourier Transforms can be used to shift data to the frequency domain and then detect C2 beaconing behavior. When a C2 beacon utilizes jitter to vary its periodicity, a sliding window must be used to properly detect the activity.
Sponsored
Developers are moving fast - your security should too. Symbiotic Security v1 [11] helps you ship secure code without slowing down. With AI-powered remediation, real-time contextual training, and an AI chat assistant built into your IDE, security works with developers to accelerate their flow. Teams can save an estimated $750+ per developer, per month. Speed and security, finally aligned. Get
Aurascape helps corporate IT departments monitor AI employee usage across thousands of AI applications—both approved and unauthorized. The technology tracks interactions, decodes prompt-response data, and evaluates security risks, even for less common AI tools.
Security automation content in SCAP, Bash, Ansible, and other formats
ollvm-unflattener is a Python tool to deobfuscate control flow flattening applied by OLLVM.
Companies with cyber insurance face ransomware demands 2.8 times higher than uninsured victims, as criminals specifically search for insurance policies during attacks. Insured victims pay more often (44% vs 24%) and pay significantly larger amounts.
SIEM provider RunReveal released an MCP server for use with its product. In this post, RunReveal provides insights into some ways that its customers are using the MCP server for threat hunting with Cursor, investigating GuardDuty alerts, and tuning and testing alerts. RunReveal believes that enriching and standardizing data to make it easier for LLMs to query is the future of its product.
This blog post focuses on kernel-mode registry objects essential for runtime hive management. It meticulously examines key internal structures, including _CMHIVE, _HHIVE, memory mapping mechanisms, cell maps, and key control blocks that collectively enable registry functionality like transaction management and synchronization. The post provides detailed explanations of these previously undocumented structures based on reverse engineering of Windows Server 2019, noting these findings apply to Windows 11 as well.
Chris Krebs resigned from SentinelOne after his security clearance was revoked and a presidential order was issued to review CISA's conduct under his leadership.
BidenCash Market leaked over 910,000 stolen credit card records on a Russian forum without names but with card details.
Microsoft has advised Windows 11 users of blue screen crashes following recent updates and suggests using Known Issue Rollback or Group Policy for fixes - deployment guidance is available on its support website.
Sponsored
Earlier this year, Microsoft made MFA mandatory on all Azure logins. IT and security teams were faced with the daunting task of forcing _everyone_ to transition all at once.
The internet forum 4chan was hacked and taken offline on Tuesday. Screenshots of internal systems circulated online, exposing moderator lists and backend code. A janitor confirmed the breach's authenticity and noted that hackers may have accessed subscriber data.
Landmark Admin and Young Consulting have reported major data breaches that affect 2.6 million individuals. A ransomware attack on Landmark via stolen VPN credentials compromised 1.6 million people's sensitive personal data, while a breach at Young Consulting affected 1 million people, exposing names, SSNs, and health information.
DaVita, a major kidney care provider, reported a ransomware attack over the weekend. The firm isolated affected systems, but some operations are still disrupted. DaVita is investigating and has not disclosed which ransomware gangs may be involved or if patient data was stolen.
ReliaQuest discovered a sophisticated attack chain in March 2025 that targeted finance and professional services sectors. It begins with Microsoft Teams phishing but evolves into a novel persistence technique that involves Component Object Model Type Library hijacking. The attack deploys previously unseen malware with a PowerShell backdoor that uses Telegram for command and control, showing similarities to earlier campaigns attributed to the "Storm-1811" threat group known for deploying Black Basta ransomware. To defend against these tactics, organizations should restrict external Microsoft Teams communications, block specific domains at the network edge, and implement various Windows security hardening measures.
MDSec, a British cybersecurity consultancy, provides an overview of ServiceNow functionality and ways to abuse it for red team functionality. This post discusses some access vectors, such as the API and login.do endpoint, and details how custom actions, discovery, orchestration, the LDAP listener, and relaying can be abused.
Sponsored
This checklist compares Drata with other solutions in the industry including custom, basic, one-stop, and niche players.
NetRise's Supply Chain Detection and Response (SCDR) platform provides a Software Bill of Materials (SBOM) covering various devices, which improves vulnerability detection and remediation and helps ensure regulatory compliance.
Justniffer is a network traffic analysis tool that allows you to analyze and trace HTTP traffic in a network. Justniffer allows capturing network packets and decoding of HTTP data, providing detailed information about HTTP requests and responses, such as the IP address of the client and server, the requested URL, header fields, and message content.
An MCP server for using Semgrep to scan code for security vulnerabilities.
OpenAI launched GPT-4.1 without providing a safety report, deviating from its usual practice of publishing such reports. The omission has raised concerns among safety researchers and former employees, who argue that transparency in AI safety is critical.
The Browser Forum voted to reduce SSL/TLS certificate validity from the current 398 days to just 47 days by 2029. The phased reduction begins in March 2026 with 200-day limits, dropping to 100 days in 2027. Tech giants unanimously supported the change to enhance security by limiting abuse of compromised certificates, though sysadmins worry about increased workload without automation.
Microsoft announced that it will begin disabling all ActiveX controls in Windows versions of Office 2024 and Microsoft 365 starting later this month. After this change goes into effect, users will see a notification at the top of content that uses ActiveX stating: "BLOCKED CONTENT: The ActiveX content in this file is blocked." ActiveX can be re-enabled via the Trust Center.