Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Policy as Code (PaC) is an approach that aids the assessment of an organization's configuration and validation of compliance requirements through the use of software automations. Before beginning to implement PaC, an organization should map out the level of effort to codify policies and the criticality of the policy. One mechanism to begin using PaC can be through CloudFormation Hooks or CloudFormation Guards.
Vault AppRoles aim to solve the “Secret Zero” problem in systems that don't have native Vault authentication capabilities by splitting authentication into two components: a role ID and secret ID. The role ID is not sensitive and the secret ID is a time limited credential that should only be provided to the application at the expected time of use. Vault also supports wrapping the secret ID to decrease exposure. The Vault agent can automate AppRole authentication in applications that cannot be modified.
Sponsored
Today's ransomware operations combine phishing, infostealers, and vulnerability exploits [11] to wreak havoc on your defenses. Now is a good time to get your risk frameworks, threat intelligence, and incident response playbooks up to speed.
Bandit is a tool designed to find common security issues in Python code. To do this, Bandit processes each file, builds an AST from it, and runs appropriate plugins against the AST nodes. It generates a report once it has finished scanning all the files.
A stealthy command line tool to create TCP-over-CDN(http) tunnels that keep your connections cozy and comfortable.
The Package Analysis project examines open source packages for signs of malicious behavior by analyzing their file access, network connections, and commands they execute. It aims to enhance open source software security by detecting suspicious behavior and providing insights to consumers and researchers. The project's components work together to analyze packages in a sandboxed environment and store the results for inspection in BigQuery.
The amount of malware targeting macOS has increased along with the market share of Macs. This post provides an introduction to some common macOS malware analysis tools and then introduces each new macOS malware released in 2024. The samples are categorized into stealers or ransomware and each includes a brief overview, links to writeups, infection vectors, persistence mechanisms, and capabilities.
Temple University researchers have documented over 2,000 ransomware attacks on critical infrastructure since 2013, with government, healthcare, and education being the most targeted sectors. Their CIRA database shows increasing ransom demands, with the project providing valuable data for cybersecurity professionals and government entities.
The Mercari security team implemented automations through a Slackbot and LLM that saved 160-250 minutes of incident responder time for small security incidents. The Slack bot automates tasks such as establishing communication, managing document access, and assigning tasks. The LLM aids in adding documentation and evaluating incident impact and severity as well as summarizing incidents over a long period of time for reporting purposes.
The US government has introduced a new cybersecurity safety label called the U.S. Cyber Trust Mark for smart devices.
CISA released new cybersecurity goals for IT and product design sectors to improve software security and protect against cyber incidents.
Hackers breached the Green Bay Packers' website, exposing fans' personal and credit card details.
ESET is urging Windows 10 users to upgrade to Windows 11 before Oct 2025, which is when Windows 10 reaches EoL and stops receiving security updates. Almost 63% of Windows users are still running Windows 10. Adoption has been slow due to missing features and the TPM requirement. Microsoft will be offering Extended Security Update plans for businesses and individuals.
Wallet drainer malware stole nearly $500 million in cryptocurrency from over 332,000 victims in 2024, a 67% increase from 2023. The highest activity was in Q1 with $187.2 million stolen, though the largest single theft ($55.48 million) occurred in August.
French IT firm Atos has denied the Space Bears ransomware group's claims of a system breach from December 28. It initially rejected all compromise allegations, but later clarified that the incident involved compromised external third-party infrastructure containing Atos-related data, not its own systems.
This post provides an overview of how attackers exploit environment variables from serverless devices post-exploitation. When secrets are stored directly in environment variables, they can be leaked by an attacker that can achieve code execution on the function. As permissions are generally provided to the serverless execution environment via environment variables, they can also be acquired by the attacker to pivot to other services in the account that the function can access. To mitigate these issues, utilize Secrets Manager services, audit functions, scope roles to least privilege, and alert on abuse.
This post walks through the process of building a POC for an offensive AI security agent that was able to analyze a JavaScript file to discover API endpoints and detect a vulnerability. The author provided the AI agent with 4 “tools” to find endpoints, format an API request, execute the test, and analyze the results. The post also provides some lessons learned, such as the importance of effective prompting, the power of agentic workflows, and the strengths of Claude 3.5 Sonnet for code writing.
OpenAI has released two papers showcasing its advanced approach to AI security through red teaming. The company employs external teams to find vulnerabilities and use automated reinforcement learning for attack simulation. Its human-in-the-middle approach combines human expertise with AI techniques, setting new standards for AI model safety.
A collection of Cobalt Strike Beacon Object Files for use in red team engagements.
Frizbee is a tool that takes a tag and returns a checksum.
Access is a tool that utilizes the Okta API to provide a centralized portal for employees to discover, request, and manage their access to internal systems.
Insecure-by-Design flaws are vulnerabilities inherent to the design of a system. They require a full redesign of the system remediate. These vulnerabilities should first be mitigated by implementing guardrails and monitoring tools. Once mitigations are in place, a slow sunsetting process can be started to reduce downstream impacts.
Amit Yoran, CEO of cybersecurity company Tenable and former U.S. National Cybersecurity Director, died unexpectedly at 54 while on medical leave for cancer treatment. Tenable went public successfully in 2016 under his leadership. The company's COO and CFO are serving as interim co-CEOs.
Tenable disabled two Nessus scanner agent versions due to a faulty plugin update that caused agents to go offline. The company released Nessus Agent v10.8.2 to address the issue and has advised customers to upgrade to this version or downgrade to 10.7.3 to resolve offline agent problems. Plugin feed updates were temporarily paused to prevent further issues.
CISA confirmed that a recent hack attributed to the Chinese state-sponsored hackers at the US Treasury did not affect other federal agencies.
Microsoft Bing displays a misleading Google-like search page when users search for 'Google'.
Malicious npm packages are targeting Ethereum developers by impersonating Hardhat plugins to steal private keys and sensitive data.
Sponsored
Security researchers from Check Point's open-appsec tested the efficacy of several leading WAF solutions using a comprehensive dataset: 1,040,242 legitimate HTTP requests from 692 real websites [4], and 73,924 malicious payloads from common attack vectors.
Researchers discovered 33 compromised Chrome extensions affecting 2.6 million devices during the holiday season. The incident began when Cyberhaven's extension was hijacked through a phishing attack on Christmas Eve, leading to malicious code that stole sensitive data including Facebook and ChatGPT credentials.
MyGiftCardSupply's unsecured server exposed over 600,000 customer ID documents and selfies belonging to around 200,000 customers. After researcher JayeLTee discovered the breach, the company secured the server and promised better data handling, but wouldn't commit to notifying affected individuals or explain the delayed response.
Volkswagen Group's software subsidiary Cariad exposed sensitive data of 800,000 EV owners through a misconfigured Amazon cloud storage system. The breach revealed vehicle locations, contact details, and addresses across multiple European countries, affecting various VW brands. The issue was fixed after ethical hackers reported it.
Cybersecurity budgets are expected to increase for 90% of organizations in 2025, with leaders facing pressure to demonstrate ROI. While 35.9% of CISO budgets go to software, automation of SOC workflows and patch management offers clear returns. Gartner predicts industry spending will grow from $184B (2024) to $294B (2028), with cloud security leading growth.
The blog discusses the risks of unsafe archive unpacking in software development due to vulnerabilities in handling archive files across different programming languages. The author demonstrates vulnerable implementations and provides safe alternatives, along with Semgrep rules, to automatically detect and mitigate these risks. The research aims to help developers identify and address security vulnerabilities in archive extraction methods to prevent potential attacks like path traversal.
Managed Identities as Federated Identity Credentials for Microsoft Entra allow secure access to cloud resources without using secrets or certificates. This new approach improves security by reducing the risk of credential leaks and simplifies resource access setup. Apps can now trust managed identities, eliminating the need to manage app secrets or certificates for accessing Entra-protected resources.
Ephemeral, zero-knowledge sensitive data sharing with end-to-end encryption and seamless UX - no sign-up, just secure and instant sharing.
Amitai Cohen built this Pivot Atlas as an educational tool to help cyber analysts understand various pivoting strategies. This website contains simple reference material for how to make the best use of various threat activity observables, such as IP addresses and file hashes. Mermaid diagrams are also included for easy and clickable navigation between artifact types.
Pytune is a post-exploitation tool that enrolls devices into Microsoft Intune.
Apple has agreed to pay $95 million to settle claims that Siri inadvertently recorded private conversations. US users who had Siri-enabled devices between 2014-2024 and can swear their private conversations were accidentally recorded could receive up to $20 per device, pending judicial approval.
Akamai will end its China CDN services by June 30, 2026, with content requests to be served from neighboring countries unless a partner solution is activated. It has partnered with Tencent Cloud and Wangsu Science & Technology to offer high-performance content delivery and security solutions in mainland China. Existing China CDN customers must transition to the partner solutions by the deadline to avoid service interruptions.
macOS has become more private over the last five years, with a significant increase in Private Frameworks. The percentage of Private Frameworks has risen from 76% to 84% from 2019 to 2024. Apple's Private Frameworks are not accessible to third-party developers and are crucial for app approval in the App Store.
A lawsuit by Youtuber LegalEagle claims that PayPal's Honey extension is diverting earnings from creators by substituting affiliate links, accusing the company of undermining the affiliate marketing system.
The U.S. Department of the Treasury sanctioned Integrity Technology Group, a Beijing-based cybersecurity company, for supporting a Chinese state-sponsored cyber group called Flax Typhoon that targeted U.S. critical infrastructure sectors.
49 Videos from FIRSTCON 24, an event that focused on the issues of incident response and security teams.
Sponsored
Flashpoint identified 4,500+ ransomware attacks in 2024, with 53% targeting U.S. companies. Ransomware operations have grown more sophisticated — strategically combining phishing, infostealers, and vulnerability exploits to breach defenses.
The popular macOS terminal emulator iTerm2 released a critical security fix for versions 3.5.6-3.5.10. The vulnerability arises from a bug in the SSH integration feature which causes input and output to be logged to a file /tmp/framer.txt on the remote host. Users are advised to upgrade and remove any /tmp/framer.txt files that may have been created.
Clickjacking attacks are when an attacker utilizes an iframe to trick a user into clicking on content from a legitimate page that an attacker is hiding from the user and is largely prevented by modern browser defenses. A security researcher has introduced a new technique called DoubleClickjacking where the attacker launches a new window that covers the original page and prompts the user to double click to solve a captcha or the like. The page will then listen for the first click and close itself while having the parent navigate to the target site and capture the second click, bypassing browser defenses.
Scans from the ShadowServer security threat monitoring platform Shadowserver has shown that around 3.3 million hosts are running POP3/IMAP services without TLS encryption enabled and expose usernames and passwords in plain text when transmitted over the Internet. IMAP is recommended for accessing emails on multiple devices, while POP3 downloads emails to a single device. Enabling TLS encryption can protect usernames and passwords from being exposed in plain text during email exchanges.
Dave Bogle of Red Canary steps through the process of investigating a strange behavior in GCP where a service account's access to GCP wasn't revoked when the access key was deleted. Bogle discovered that the token that GCP creates for service account's access access is not revocable but ultimately this is mentioned in the GCP documentation. In this post, Bogle walks through how he created detection logic around this behavior based on his research.