Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
A new threat actor named Silent Lynx has been targeting organizations in Kyrgyzstan and Turkmenistan with cyber attacks using sophisticated methods like using ISO files, C++ loaders, PowerShell scripts, Golang implants, and Telegram bots for command and control.
Sponsored
Security researchers from Check Point's open-appsec tested the efficacy of several leading WAF solutions using a comprehensive dataset: 1,040,242 legitimate HTTP requests from 692 real websites [4], and 73,924 malicious payloads from common attack vectors.
Grubhub reported a data breach through a third-party provider that affects customers, merchants, and drivers. Hackers accessed personal information including names, emails, phone numbers, and partial payment data for some campus diners. While hashed passwords were exposed, bank details and Social Security numbers weren't compromised.
Zyxel has issued a security advisory about actively exploited flaws in CPE series devices that it has no plans to fix. VulnCheck released the full details of two CVEs - one is for insecure default passwords and the other is for improper command validation leading to command injection. According to FOFA and Censys, there are over 1,500 potentially vulnerable devices that are internet exposed.
A security flaw in AMD's SEV could allow an attacker to inject malicious CPU microcode with admin access. The vulnerability, tracked as CVE-2024-56161, has a high severity score of 7.2 and could lead to loss of confidentiality and integrity in a virtual machine environment. Google researchers discovered the flaw and AMD is working on a fix to address the issue.
Security has a unique position as a systems requirement. While "building security from the ground up" is a popular way of starting, using established security mechanisms and following best practices might be more practical.
This article examines an Attacker-in-the-Middle technique for stealing access and refresh tokens from the OAuth 2.0 authorization flow. The attacker first allows the user to go through the initial steps of the OAuth 2.0 flow until a response from the upstream server that has a header containing “nativeclient?code=“ is seen. This code can be used to request access and refresh tokens from the /oauth2/token endpoint.
Watchtowr Labs researchers discovered abandoned Amazon S3 buckets and monitored incoming requests to them. They found vulnerabilities in how these abandoned buckets were accessed and used by organizations, highlighting security risks. They registered and monitored the abandoned buckets to raise awareness and improve internet security.
An automated GitHub Actions-based crawler that fetches and updates public scopes from popular bug bounty platforms (like HackerOne, Bugcrowd, and Intigriti, etc) that updates every 10 minutes.
Seccomp-Diff is a tool that analyzes binaries and containers to extract and disassemble seccomp-bpf profiles. It includes a CLI tool for comparing seccomp profiles between containers and a web interface for visually comparing system calls within a Kubernetes cluster. The project is open-source under the MIT License but has limitations regarding architecture support and Kubernetes deployment.
The People Researcher Agent from Langchain AI searches the web for information about a person and organizes it based on a JSON schema provided by the user. The agent follows a multi-step process to research, extract, and evaluate data, allowing for thorough information collection. Users can customize the schema for the structured data output and evaluate the agent's performance using a provided dataset and evaluation script.
Anthropic has released Constitutional Classifiers, a new system for preventing AI model jailbreaks. The system uses natural language rules and extensive training data to detect and block prohibited content requests. It has withstood 3,000+ hours of bug bounty testing. Anthropic invites public testing through to February 10.
US prosecutors charged Andean Medjedovic, 22, for allegedly hacking Indexed Finance ($16M) in 2021 and KyberSwap ($48M) in 2023. The Canadian math prodigy, who's been a fugitive since 2021, faces fraud, money laundering, and extortion charges.
An in-depth look at the user-mode Treyarch Anti-Cheat (TAC) system used in Call of Duty Black Ops Cold War. The system uses Arxan as an obfuscation/protection tool which includes features such as runtime executable decryption, continuous executable checksum monitoring, Jmp and entry point obfuscation, and pointer encryption. Layered on top of this is TAC, which features various anti-cheat systems like network monitoring, API hook detection, debug register detection, anti-debugging capabilities, visuals detection, and custom syscall encryption, among others, and terminates the process on detection.
Android and iOS apps from Google Play and Apple App Store have a malicious SDK that steals cryptocurrency wallet recovery phrases using image recognition.
Over 700 vulnerabilities were publicly reported as exploited for the first time in 2024, a significant increase from the previous year.
A new ValleyRAT malware variant is spreading through fake Chrome downloads, targeting high-value individuals in organizations like finance and sales to steal sensitive data.
Sponsored
How to instantly improve cloud visibility.
Globe Life discovered a data breach affecting up to 850,000 individuals after an extortion attempt in October 2024. The breach, linked to its American Income Life Insurance subsidiary, potentially exposed personal, health, and insurance data.
A malware campaign was spotted targeting Android users in Malaysia and Brunei with fake wedding invitations that prompt users to download an app to view the invitation. The malware is an infostealer that harvests sensitive data from messaging apps, email, and call logs. It utilizes compromised WhatsApp and Telegram accounts to spread further.
Google patched 48 vulnerabilities in February's Android security releases, including a new kernel zero-day under active exploitation. The kernel vulnerability was a privilege escalation vulnerability in the USB Video Class driver that could allow local, authenticated attackers to escalate privileges. The updates also include a fix for a critical vulnerability in Qualcomm's WLAN component.
This post dives into web skimmers and how they were used in a web skimming campaign affecting 17+ websites. The skimmer used a unique approach, operating on all pages except checkout and presenting a fake payment form when users clicked the checkout button from their cart.
This post describes the RAG process and where authorization fits in. SpiceDB can be used to apply Relationship-Based Access Control (ReBAC), which can be used to create pre or post query filters to the pipeline. The second part of the series contains a step-by-step guide for implementing this authorization scheme using Langchain.
Gatekeeper enforces security policies in Kubernetes by using Constraints and ConstraintTemplates to control cluster access and prevent unauthorized actions. Administrators can define custom policies or use pre-built templates to enhance cluster security by leveraging Gatekeeper. However, misconfigurations in policy logic, such as omitting trailing slashes in Constraint values, can introduce security risks and allow for policy bypasses.
Conifers.ai maps incidents to a relevant security use case and uses pre-trained underlying agents and models to handle the complexities of security operations incidents.
PWN is an open security automation framework that promotes trust and innovation by leveraging pre-built modules and allowing users to create custom automation drivers. Installation is straightforward on Debian-Based Linux Distros and OSX, with instructions provided on GitHub. Users are encouraged to contribute to the framework's success by providing access to commercial security tools and following the guidelines for contributing.
authentik is an open-source Identity Provider that emphasizes flexibility and versatility. It supports various protocols like OAuth2 and LDAP for easy integration with existing environments. The product offers user-friendly dashboards and comprehensive documentation for easy installation and configuration.
A Remote Code Execution vulnerability was found in Marvel Rivals that allows attackers on shared networks to exploit the game's unverified hotfix system. The risk is heightened as the game runs with admin privileges.
The OWASP recently launched a new project called the OWASP Non-Human Identities Top 10 to categorize the most common vulnerabilities affecting non-human identities. This post includes an overview of each vulnerability class as well as additional insights from the Orca Research Pod. It concludes with recommendations on how to prevent these vulnerabilities, such as using JIT provisioning, rotating secrets, and mapping third-party integrations.
AWS has added support to DataSync SMB locations for Kerberos authentication. DataSync is used for syncing data between AWS services, on-prem networks, or multiple clouds using SMB. Previously, only NTLM authentication was available.
768 vulnerabilities were reported as exploited in the wild in 2024, up from 639 CVEs in 2023, registering a 20% increase year-over-year.
Alpine Linux is seeking infrastructure support for the project since its previous provider is sunsetting their bare metal hosting service.
Researchers discovered malicious malware hidden in fake DeepSeek PyPI packages targeting developers and AI enthusiasts stealing sensitive data from users' systems.
Sponsored
Many ransomware attacks start when a user runs a harmless-looking executable on their endpoint device — and chasing down every new install can be impossible.
A cyberattack on the Community Health Center affected over 1 million patients' personal and medical data. The breach, discovered on January 2, follows recent attacks on Frederick Health and NY Blood Center. Though access was quickly blocked, CHC is offering affected patients free identity theft protection and monitoring services.
A security researcher discovered a new jailbreak for ChatGPT that involves abusing a mechanism to confuse ChatGPT into believing that it's in the past (temporal confusion) and then asking ambiguous questions. This vulnerability allowed the researcher to ask ChatGPT for information such as how a programmer in the 1700s could create polymorphic malware with modern techniques. The researcher attempted to disclose this vulnerability to OpenAI with the aid of various government agencies, but the vulnerability has not been fixed.
AWS has remediated an issue with IAM use sign-in flow that could allow for a malicious user to enumerate logins. The vulnerability was due to a timing attack in which the server response times for a valid or invalid user varied. AWS remediated the issue by introducing a timing delay across all authentication failure scenarios.
Major cybersecurity tools meant to protect networks have repeatedly become vectors for mass hacking campaigns. From 2023-2025, vulnerabilities in products by Cisco, Citrix, Ivanti, Palo Alto, and more have led to widespread breaches affecting thousands of organizations and millions of individuals. This post dives into the brief history of these attacks.
The AWS GuardDuty team has released a tool called GuardDuty Tester to generate infrastructure and synthetic events to test GuardDuty alerts and actions. This post walks through deploying GuardDuty Tester and creating alerts and automations based on GuardDuty findings. AWS has cautioned users to not run GuardDuty Tester in production environments and ideally to use a dedicated account.
This investigation revealed how mobile apps, even with location services disabled, leak sensitive data through real-time bidding (RTB) systems and advertising networks, with Unity Ads, Facebook, and various data brokers collecting precise location data, device information, and behavioral patterns. It highlights how data brokers create comprehensive user profiles by combining Mobile Advertising IDs (MAIDs) with personally identifiable information (PII), suggesting that security assessments should examine not just individual data points but the entire data flow ecosystem, including third-party integrations and data marketplace vulnerabilities.
Clutch's Universal Non Human Identity Security Platform can provide organizations with a unified view across all these identities, regardless of the environment they reside in, tracking their access, origin, ownership, storage, and usage.
A CLI tool (and library) that identifies hash types.
The team behind Wireshark has released a new tool called Stratoshark for monitoring system calls with a similar interface and syntax as Wireshark.
Texas has banned DeepSeek and social media apps Xiaohongshu and Lemon8 from government devices, citing security concerns about data harvesting. The move follows similar bans on TikTok. DeepSeek has gained popularity among U.S. users and emerged as an OpenAI competitor.
The EU AI Act prohibits AI systems that pose unacceptable risks, including manipulative systems, social scoring, unauthorized facial recognition databases, and certain emotion recognition technologies. Violations face fines up to €35M or 7% of annual turnover.
OAuth provides the perfect model for authenticating AI Agents as it is designed for auditable and secure delegation of access. OAuth adoption is scant and even where it exists, scopes are often very minimal and incomplete. This solution doesn't scale to tools where the AI is acting as the user's identity such as ChatGPT Desktop or Claude computer use.
KuCoin's operator pleaded guilty to running an unlicensed money-transmitting business and will pay $297 million in penalties in the U.S. for failing to implement required anti-money laundering measures.
U.S. and Dutch authorities worked together to shut down 39 websites connected to a fraud network last month.