Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
The Cyber Security Transformation Chef (CSTC) is a Burp Suite extension. It enables security experts to extend Burp Suite by chaining simple operations on each incoming or outgoing HTTP message. It can also be used to quickly apply custom formatting on each message.
Government officials and AI industry executives have agreed to apply basic safety measures and establish an international AI safety research network. The agreement will promote a common understanding of AI safety, aligning research, standards, and testing to accelerate advancements.
A Moroccan cybercrime group called Atlas Lion upgraded the gift card scam by compromising retailer portals used to issue gift cards, enabling them to "print" money at will without targeting individual victims. This automated approach eliminates labor-intensive social engineering tactics while maximizing profitability.
Rapid7 discovered that attackers had backdoored JAVS courtroom recording software with malware, allowing them to take over systems. JAVS has removed the compromised version and advises reimaging all potentially affected endpoints.
This attack report covers zero-day exploits, mass supply chain compromise incidents, and multi-factor authentication woes.
The UK has launched an investigation into the “privacy nightmare” that is Microsoft's recently announced Recall, a feature of its new Copilot+ PCs that stores encrypted screenshots on devices.
The SEC fined Intercontinental Exchange (ICE) $10 million for not promptly reporting a cybersecurity breach to its subsidiaries.
Sponsored
Ever feel like keeping track of all your cloud resources is a full time job? With Orca's AI-powered search [4], it's as simple as asking a question like:
Researchers have discovered a severe memory corruption vulnerability dubbed "Linguistic Lumberjack" in Fluent Bit, an open-source cloud logging utility with over 3 billion downloads widely used by major organizations and cloud providers like AWS, Microsoft, and Google Cloud. The vulnerability potentially allows denial of service, data leakage, and remote code execution in cloud environments.
Semiconductor manufacturing giant OmniVision Technologies disclosed a ransomware attack in September 2023 that led to data theft, including personal information. However, it has not detailed the type of personal information that was compromised.
GitHub has addressed a critical authentication bypass vulnerability (CVE-2024-4985) in GitHub Enterprise Server that allowed attackers to gain unauthorized administrative access by forging a SAML response on instances using SAML single sign-on with encrypted assertions enabled.
GitHub addressed a serious flaw in GitHub Enterprise Server that allowed unauthorized access without authentication for server versionsserver versions below 3.13.0.
This blog post presents a workflow that uses AI agents to simulate an AppSec team. The workflow features a manager, code reviewer, exploiter, mitigation expert, and report writer agent to attempt to find vulnerabilities, write PoCs, and mitigate the vulnerabilities. The post makes slightly exaggerated claims on the efficacy of the toolchain, but it serves as an early demonstration of the potential of these tools.
This is a walkthrough for implementing a SOC 2-compliant GitOps workflow. The workflow features an app repo to test and build the code and an infra repo to deploy it. The walkthrough also presents hotfix and rollback flows.
A post from Canva outlining its vulnerability management pipeline. The pipeline begins by extracting vulnerability information from its EDR, then utilizing its MDM to automatically push updates for managed applications or when an application is not managed, creating tickets for IT. The post also includes success metrics and a discussion of the results and difficulties of the process.
Sponsored
Mobile apps and SDKs face threats such as reverse engineering, back-end abuse, app cloning, and piracy. What's the best way to protect them? This Guardsquare webinar [14] will compare two popular answers: compiler-based tech and wrapper solutions. How does each approach balance depth of protection, build times, and adaptability?
Covering API and web application security, NightVision will simulate attacks to identify exploitable defects before they enter production and integrates directly with the standard development workflows and CI/CD pipelines.
Precli is designed to do static code analysis of source code with a number of rules covering the standard library for the corresponding programming language.
HoneyTrail is a set of honey services to be deployed in an AWS account to detect unauthorized access. The suite uses a separate CloudTrail trail for ease of detection and alerting.
Students have discovered a security flaw in internet-connected laundry machines used by millions of college students that allows free operation and manipulation of account balances through an app's API vulnerability. The vulnerability affects over a million machines across North America and Europe owned by CSC ServiceWorks.
The European Union has approved the groundbreaking and first-of-its-kind AI Act, establishing risk-based regulations for artificial intelligence. The law bans certain high-risk AI use cases and imposes obligations for high-risk applications like biometrics. It will come into force across the EU in phases.
Elastic Security Labs uncovered an intrusion set named REF4578 with a primary payload called GHOSTENGINE that targeted crypto mining operations by deploying malicious modules and exploiting vulnerable drivers. GHOSTENGINE aims to disable security solutions, establish persistence, and execute a crypto-miner while utilizing elaborate techniques to evade detection and ensure system infection.
Veeam has warned customers about a critical security vulnerability in its Backup Enterprise Manager (VBEM), which allows attackers to sign into any account without authentication.
MediSecure, an Australian e-prescription provider, has fallen victim to a ransomware attack that resulted in the suspected theft of patients' personal and health data. The company stated that the incident likely originated from a third-party vendor breach. MediSecure has notified regulators about the large-scale data breach, which impacted an unspecified number of individuals.
A critical vulnerability dubbed "Llama Drama" (CVE-2024-34359) has been discovered in the llama_cpp_python package used for integrating AI models with Python. The flaw, related to the improper use of the Jinja2 template rendering tool, enables template injection attacks and allows arbitrary code execution, putting AI application systems and data at risk.
Santander Bank has reported that some customer data, as well as all data from all past and present employees which was stored in a third-party database, were accessed by an unauthorized party. No data on transactions or credentials were leaked.
This article explains how to use AuditD to detect threats by creating rules based on logs and analyzing them further. It provides a simple example rule to monitor executions in the /tmp directory, emphasizing the importance of monitoring to enhance security. The article offers insights into investigating AuditD events and conducting in-depth analysis for security monitoring.
Zero Trust Architecture (ZTA) is a revolutionary cybersecurity approach that shifts from the outdated "trust but verify" model to a robust "never trust, always verify" principle, addressing weaknesses of traditional security measures. This post dives into the intricacies of Zero Trust.
This article introduces a new attack method for injecting rogue files and forcing victims to download them. The attack requires a page to have a path confusion vulnerability, a download link with an anchor tag that uses relative paths, and content that is injectable via a persistent XSS or XSS cache poisoning. The attack expands on RPO because it doesn't rely on deprecated technologies.
Sponsored
Are you an expert in all things cloud security? Come prove it at at Lacework's virtual Capture the Flag Challenge [10]!
Sydeabs is a security and risk management platform aimed at securing Generative AI throughout the entire development lifecycle.
JavaScript & Node.js open-source SAST scanner. A static analyzer for detecting most common malicious patterns.
Reverst is a load-balanced, Golang reverse tunnel that runs over HTTP3/QUIC. The tunnel server is meant to be deployed publicly while clients in restrictive networks connect out to it.
YARA has been rewritten as YARA-X in Rust for better user experience, rule-level compatibility, performance, reliability, and developer-friendliness. The rewrite was necessary due to significant design changes and the limitations of the existing C codebase. YARA-X is currently stable but in beta. The project aims to surpass YARA in all aspects through ongoing enhancements.
Chinese nationals Daren Li and Yicheng Zhang have been charged with laundering $73 million in a pig butchering crypto scam. Victims were tricked into transferring money to U.S. bank accounts opened by shell companies. Li and Zhang face up to 20 years in prison for money laundering charges.
Slack is facing backlash from users over its approach to using customer data for training AI models. While many tech companies leverage user data for AI training, Slack's confusing and seemingly outdated privacy policy allows it to opt users in by default, requiring them to actively email the company to opt out.
Microsoft will enforce multi-factor authentication for Azure users starting in July to enhance security.
Due to a misconfiguration, Google Cloud accidentally deleted the entire account of Australian pension fund UniSuper, which manages $135 billion in funds for 647,000 members, including all backups stored on the service.
The American Radio Relay League (ARRL) faced a cyberattack that affected its online services, including Logbook of the World.
Sponsored
Harden your environment and lock down your machines against evolving threats including Zero-Day attacks, ransomware, malware, and data exfiltration with ThreatLocker® [4] — the pioneers in Zero Trust Endpoint Protection [4]. Here's how ThreatLocker® protects your endpoints at every level:
Singing River Health System (SRHS) has notified around 900,000 individuals that their personal information, including names, addresses, dates of birth, Social Security numbers, and medical data, was compromised in an August 2023 ransomware attack.
Researchers have uncovered a new vulnerability in the IEEE 802.11 WiFi standard that affects every WiFi client and operating system. The vulnerability occurs because the WiFi standard does not require authentication of the SSID during beaconing which could allow an attacker to trick a victim into connecting to a different network. This post provides more details of the vulnerability and threat models that apply.
Linux maintainers' infrastructure was infected with backdoor malware for two years, starting in 2009. The attackers accessed encrypted password data and compromised servers connected to kernel.org. The malware spread to thousands of servers, but there is no evidence of tampering with the Linux kernel source code.
A tutorial on deploying mutual TLS on an AWS application load balancer utilizing an open-source serverless CA. It includes an overview and explanation of the solution as well as Terraform code for deploying it.
This blog post discusses adversary tactics in cloud environments, focusing on techniques like modifying cloud compute infrastructure to evade defenses. Adversaries can manipulate cloud components, create snapshots, launch new instances, and modify configurations to bypass security measures and maintain stealthy access. Understanding these techniques can be crucial for defending against malicious activities in the cloud.