Trail of Bits researchers discovered that the widely used pyaes and aes-js packages used default IVs in their documentation, which can lead to vulnerable applications. The team contacted both projects and received no response, but found that the maintainers behind pyaes had dismissed a ticket raised about the vulnerability in 2022. The team contrasted this with StrongMan VPN's response to the team contacting them about their use of the vulnerable pyaes library. The maintainer fully replaced the library and migrated to the more secure GCM-SIV mode of AES.
IRFlow Timeline is a native macOS DFIR timeline analysis app built on Electron and SQLite designed to ingest large forensic artifacts, including CSV, TSV, XLSX, EVTX, and Plaso output, without performance degradation. Inspired by Eric Zimmerman's Timeline Explorer for Windows, it fills the gap for macOS-native incident responders.
SonarQube CLI is a beta command-line tool for interacting with SonarQube Cloud and self-hosted SonarQube instances. It supports secrets scanning, issue querying, project listing, and Claude Code integration via MCP server hooks installable globally or per-project.
Evervault provides a developer-first platform to encrypt and orchestrate sensitive data - especially payment card data - so companies can process, share, and route it end-to-end without handling it in plaintext, simplifying PCI compliance and reducing breach risk.
Symantec's Threat Hunter Team has detected Seedworm (MuddyWater) activity on networks of a US bank, airport, defense-adjacent software company, and NGOs in the US and Canada since February, deploying two newly identified backdoors: Dindoor, a Deno-based JavaScript/TypeScript backdoor, and Fakeset, a Python backdoor, both signed with certificates previously linked to the group. The intrusions follow US and Israeli military strikes on Iran and coincide with escalating activity from aligned hacktivist groups, including Handala and DieNet, raising the threat of destructive wiper attacks, DDoS campaigns, and hack-and-leak operations against critical infrastructure. Defenders should prioritize MFA enforcement, Rclone/cloud-exfiltration monitoring, DDoS protection for public-facing services, and immutable offline backups, given Iran's demonstrated history of deploying destructive payloads, such as Shamoon, during geopolitical escalation windows.
Anthropic's Frontier Red Team applied AI-assisted vulnerability detection to the Firefox codebase, surfacing 14 high-severity bugs and 22 CVEs, plus 90 additional lower-severity issues, all shipped with reproducible test cases that allowed Mozilla engineers to validate and patch the findings within hours ahead of Firefox 148. Notably, the model identified distinct classes of logic errors that decades of fuzzing and static analysis had not previously uncovered, suggesting a significant backlog of latent bugs across mature, well-audited codebases. As a result, Mozilla has begun integrating AI-assisted analysis into its internal security workflows.
OpenAI's Codex Security is an AI agent that creates project context, threat models, and verifies vulnerabilities to reduce false positives while suggesting ready-to-review fixes. In beta, it analyzed 1.2 million commits, identifying thousands of critical and high‑severity issues across major open‑source projects.
TfL has disclosed that attackers accessed systems containing data on over 7 million customers, far beyond the 5,000 high‑risk users first flagged with exposed bank details.
Hackers breached an FBI network used to manage wiretaps and foreign intelligence surveillance warrants, prompting an internal investigation and technical incident response by the bureau.
The University of Mississippi Medical Center resumed normal operations nine days after a ransomware attack blocked access to electronic medical records and forced the cancellation of outpatient procedures, ambulatory surgeries, and imaging appointments across its seven hospitals and 35 clinics.
Most identity governance platforms create more manual work instead of reducing it. Databricks took a different approach with Opal, using automation and developer-friendly policy controls to manage access at scale while giving security teams visibility and control.
Following a recent announcement of a critical SD-WAN vulnerability that is being actively exploited, Cisco has identified two additional vulnerabilities also being exploited by attackers. One vulnerability allows authenticated attackers with read-only access to overwrite arbitrary files, and the other is an information disclosure flaw that requires local attackers to have vmanage permissions. Cisco recommends users upgrade to a patched release to protect against these issues.
A hacker has started emailing customers of restaurants that use the HungerRush point-of-sale platform, informing them that their data was compromised and that HungerRush is ignoring their demands. Alon Gal, CTO of Hudson Rock, posted that infostealer logs show a HungerRush employee's device was hacked, which enabled the attacker to move laterally within the environment. However, HungerRush says that a third-party vendor's compromised credentials were used to access its email marketing account. The attacker claims to have data records for millions of customers containing names, emails, passwords, addresses, phone numbers, dates of birth, and credit card information. However, HungerRush disputes this, stating that no personal or financial information was stolen.
Researchers at Microsoft Threat Intelligence have detected a malware campaign in which attackers are using trojanized executables, masquerading as Roblox and Xeno utilities, and circulating them through chat rooms to install malware on users' systems. The malware installs a portable Java runtime, which runs a malicious JAR that relies on LOLBins to download and run a remote access Trojan (RAT). The RAT then tries to delete traces of the initial infection and add Windows Defender exclusions for the malicious files.
Nemesis 2.2 automates the full Windows DPAPI decryption chain, covering SYSTEM and user masterkeys, CNG keys, and Chromium's App-Bound Encryption introduced in Chrome 137+, which added a third decryption layer via the Google Chromekey1 CNG key stored in the Cryptography API Next Generation Key Storage Provider. The platform supports multiple credential input paths, including offline registry hives, LSASS dumps, NTLM hashes, and domain DPAPI backup keys, with the latter enabling persistent forward and retroactive decryption of all linked domain user masterkeys. Red teamers should note that submitting a domain backup key to Nemesis is the highest-leverage move, as it unlocks both existing and future masterkey blobs without requiring resubmission of per-user credentials.
ByteDance's Pangle ad SDK is embedded in more than 40 popular apps, including Duolingo, BeReal, Character.AI, and others, sending rich device fingerprints to ByteDance servers via HTTPS. The SDK uses a “cypher:3” scheme where each payload literally contains its own AES key and IV, plus a hardcoded AES key reused across versions, making the extra “encryption” simple obfuscation rather than real protection. Decrypted traffic reveals granular hardware, state, network, and identifiers, as well as regulatory-consent fields, while a stronger ECIES-based “cypher:4” is reserved for ad metrics, underscoring that user fingerprint data is only weakly protected despite its high tracking value.
A common challenge to passkey adoption is a user's difficulty signing in on a device that doesn't have the passkey installed and can't retrieve it from a cloud password manager. Hybrid transport addresses this issue by enabling cross-device passkeys, allowing a user to use another device's passkey to sign in. The flow involves the site the user wants to authenticate to generating a QR code, which the user then scans with another device. That second device performs a challenge-response with the server and a proximity check using BLE with the first device. If the challenge succeeds, the user is logged in on their original device.
Attack surfaces are larger than ever, traditional security testing isn't keeping up, and AI is making it worse. This Cobalt whitepaper [13] lays out the case for true security through a programmatic, offensive approach. Download it for 6 actionable recommendations to
An eBPF-based mandatory access control system for Linux that enforces role-based policies on file access, network operations, and process execution using BPF LSM hooks and task_storage maps. Processes enroll via Unix socket or auto-enrollment triggers (executable path, cgroup, or xattr), with jail policies inherited by child processes. Two deployment modes are supported: a daemon mode with hot policy reload and a daemonless mode that pins BPF programs during early boot to reduce the attack surface.
Reclaim Security is an AI-powered platform that turns vulnerability and threat-exposure findings into safe, automated remediation actions, simulating business impact to help organizations fix critical risks quickly without disrupting operations.
This repository contains Red Team Automations (RTAs) implemented in Python. These RTAs either reference binary samples by specifying a sample hash that exhibits behaviors we aim to detect or emulate attacker behaviors through code.
As age-verification laws spread across 25 states in the US and over a dozen countries, anonymous credential systems built on blind signatures and zero-knowledge proofs offer a cryptographic path to proving attributes such as age or residency without exposing the underlying identity to issuers or relying parties. The core challenge is preventing credential cloning: single-use Chaumian credentials bound to blind-signed serial numbers address this but require per-session issuance, while ZK-based reusable credentials solve efficiency and expressiveness at the cost of requiring N-time use limits enforced via PRF-derived serial numbers or hardware binding. Security practitioners building identity systems should treat the issuer-resource collusion threat model as a first-class design requirement rather than an afterthought.
2026.03.06·
blog.cryptographyengineering.com·18 min read·TLDR InfoSec
Researchers from IMDEA Networks Institute demonstrated that Tire Pressure Monitoring Systems (TPMS) in vehicles from Toyota, Mercedes, Renault, and Hyundai broadcast unencrypted, static sensor IDs that can be captured with ~$100 SDR hardware at distances exceeding 50 meters, enabling persistent vehicle fingerprinting via Jaccard index correlation across a network of roadside receivers. Over a ten-week field study, the team collected more than 6 million messages from more than 20,000 vehicles, confirming that TPMS data can be used to reconstruct detailed movement patterns and daily routines. Researchers are calling on manufacturers and policymakers to mandate rotating sensor IDs, as current EU and UK regulations legally require TPMS but do not mandate encryption or ID randomization.
Italian prosecutors confirm that the phones of journalist Francesco Cancellato and activists Giuseppe Caccia and Luca Casarini were hacked using Paragon's Graphite spyware in a coordinated 2024 campaign, while the perpetrator and motive remain unclear. Authorities' failure to detect infections identified by Citizen Lab and prior oversight gaps raise serious concerns about the government's use of commercial spyware and safeguards for journalists across Europe.
Bitwarden now supports phishing-resistant Windows 11 login using vault-stored passkeys via Microsoft's FIDO2 security key flow, available across all plans for Entra ID-joined devices.
Iranian state-linked crews are scanning and exploiting known, patched flaws in Hikvision and Dahua IP cameras across Israel and nearby states, using commercial VPNs and VPS infrastructure as staging.
International Operation Leak has dismantled the LeakBase credential marketplace, seizing its database, two domains, and rich metadata on 142,000 users trading credentials, PII, and financial data.
CVE-2026-21902 (CVSS 9.8) is a pre-authentication RCE in Juniper Junos OS Evolved on PTX Series routers caused by the On-Box Anomaly Detection Framework's Python REST API binding to 0.0.0.0:8160 instead of an internal-only interface, exposing unauthenticated shell command execution running as root. Exploitation requires four unauthenticated HTTP POST requests: register a RE-SHELL command, wrap it in a DAG, schedule a DAG instance, then commit, after which the schedule enforcer passes the attacker-controlled syntax field directly into subprocess.run(). Affected versions are Junos OS Evolved 25.4 before 25.4R1-S1-EVO and 25.4R2-EVO. Operators should patch immediately and audit exposure of port 8160/TCP at network boundaries.
CVE-2017-7529, a now-patched integer overflow in nginx's Range header parser, affected versions 0.5.6 through 1.13.2 and allowed attackers to read out-of-bounds memory from nginx's cache files by crafting two negative byte ranges that caused a signed 64-bit integer overflow in the size accumulator, bypassing the content-length bounds check. When nginx operated as a caching proxy, the exploit leaked the raw cache file contents, including internal request headers, backend server identity, and potentially backend IP addresses. The vulnerability carried limited direct impact but demonstrated how information disclosure primitives can serve as links in a broader attack chain.
LexisNexis confirmed that attackers accessed legacy servers, exposing customer identifiers, business contact data, survey respondents' IPs, and support tickets, while denying any impact on current products and services. Hackers claim React2Shell and misconfigured AWS led to theft of over 2 GB of data, including 400,000 personal records and sensitive enterprise, employee, and development information.
Coruna is a sophisticated iOS exploit kit containing five full exploit chains and 23 total exploits targeting iOS 13.0 through 17.2.1. It proliferated from a commercial surveillance vendor customer to a Russian espionage group, UNC6353, which conducted watering hole attacks against Ukrainian users, and ultimately to a Chinese financially motivated actor, UNC6691, that deployed it via fake crypto exchange sites to steal cryptocurrency wallet credentials. The kit's final payload, PLASMAGRID, hooks into 18 crypto wallet apps, scans for BIP39 seed phrases, and uses a DGA seeded with "lazarus" to generate fallback C2 domains. iPhone users should update to the latest iOS immediately. Where updates aren't possible, enabling Lockdown Mode is recommended, and defenders should review the published YARA rules and IOCs for hunting activity.
DNS-01 is a standard for validating ACME certificate issuance by publishing a DNS record to verify the domain ownership. The mechanism can lead to operational complexity because it requires a new TXT record for each issuance, which may need DNS API credentials to be embedded in automation scripts. It also makes the renewal process vulnerable to DMS propagation delays. Let's Encrypt has proposed a new standard called DNS-PERSIST-01, which enables a persistent DNS record to pin an ACME request and specific CA that can issue records.
Gitleaks has traditionally built its secrets scanner using a combination of regexes, entropy, and rule-based filters. This post details how the team adapted the scanner to use token efficiency, which tests how frequently a piece of text appears in a model's training data by dividing it into tokens, instead of entropy, to boost performance. Using this method and a few other tweaks, the author created a tool called BetterLeaks, which outperforms other scanners, such as CredSweeper, on secret detection in the CredData dataset.
2026.03.05·
lookingatcomputer.substack.com·6 min read·TLDR InfoSec
The launch of Claude Code Security validates what you already know: AI coding risks require AI-native, agentic app security [12]. But enterprise security isn't redundant. Real risk extends beyond AI-generated code. Agentic AppSec delivers end-to-end coverage across development, build, and runtime. Read the Checmarx blog to see why.
CStrike v2 is an autonomous offensive security platform built on a containerized Docker stack with a real-time web dashboard and AI-driven scan orchestration across 35+ integrated tools.
JetStream provides an AI governance platform that builds dynamic “AI Blueprints” to map AI agents, models, data, tools, and identities, giving enterprises real-time visibility, risk control, and cost tracking for production AI deployments.
TrustTunnel is an open-source VPN protocol originally developed by AdGuard VPN that delivers fast, secure, and reliable VPN connections that are indistinguishable from regular HTTPS traffic.
Quarkslab disclosed three vulnerabilities in Avira Internet Security (versions 1.1.109.1990 and below, fixed in 1.1.114.3113): CVE-2026-27748, a symlink-following arbitrary file delete in the Software Updater running as SYSTEM; CVE-2026-27749, an unfiltered .NET BinaryFormatter deserialization in System Speedup's RealTimeOptimizer that reads an attacker-controlled file from the user-writable ProgramData directory; and CVE-2026-27750, a TOCTOU folder delete in the Optimizer that enables the Config.msi junction trick for a SYSTEM shell. The file delete primitive chains into the deserialization bug when temp_rto.dat already exists and can't be overwritten, while the TOCTOU path plants HID.DLL via MSI rollback. The writeup also documents a contentious disclosure process in which Gen Digital refused to accept vulnerability reports outside its NDA-bound bug bounty platform.
Chinese threat actor Silver Dragon, linked to APT41, has targeted government networks in Southeast Asia and Europe since mid‑2024 using phishing and exploits against Internet‑facing servers to conduct espionage. It relies on Cobalt Strike, DNS tunneling, and other methods, so security teams should harden public‑facing services and monitor for any suspicious movements.
Browser extensions posing as free VPNs or ad blockers are intercepting AI chats and feeding verbatim prompts and responses into commercial datasets, exposing names, health data, immigration issues, legal problems, and corporate secrets. Data brokers resell these searchable transcripts, undermining anonymization claims and creating major risks around re‑identification, patient privacy violations, abuse disclosures, and sensitive corporate leakage.
TikTok has decided against rolling out end-to-end encryption for direct messages, arguing that it would hinder law enforcement and internal safety teams' ability to access harmful content involving users, especially minors.
A February 2026 phishing campaign documented by Microsoft Defender researchers uses fake Zoom, Teams, and Adobe Reader update pages signed with a stolen EV certificate from TrustConnect Software PTY LTD to deliver RMM tools and establish persistent backdoor access for credential theft and ransomware deployment.
There is an active phishing campaign that uses spoofed support email threads and fake unauthorized access alerts to direct victims to a credential-harvesting page at verify-lastpass[.]com.