Search the archive

UK PLANS SWEEPING OVERHAUL OF POLICING AMID SURGE IN ONLINE CRIMES

The UK government unveiled plans to create a new National Police Service to centralize the fight against cybercrime and fraud.

you one less thing to lose sleep over. Try Bitwarden free today

KUBERNETES REMOTE CODE EXECUTION VIA NODES/PROXY GET PERMISSION

An authorization bypass in Kubernetes allows service accounts with nodes/proxy GET permissions to execute commands in any Pod across the cluster, potentially leading to full cluster compromise. The vulnerability stems from the Kubelet authorizing WebSocket connections based on the initial HTTP GET handshake rather than verifying CREATE permissions for the /exec endpoint, affecting 69 Helm charts, including Prometheus, Datadog, Grafana, and Cilium. Kubernetes Security Team closed this as "Won't Fix (Working as Intended)," recommending migration to KEP-2862's fine-grained authorization when it reaches GA in April.

NETSUPPORT MANAGER 0-DAY VULNERABILITIES ENABLE REMOTE CODE EXECUTION

Two critical vulnerabilities in NetSupport Manager (CVE-2025-34164 and CVE-2025-34165) can be chained to achieve unauthenticated remote code execution through the software's undocumented broadcast feature, which operates on TCP port 5405 without requiring authentication. The flaws—a heap-based out-of-bounds write and a stack-based out-of-bounds read—enable attackers to bypass ASLR, perform arbitrary memory writes, and gain remote shell access, posing a significant risk to Operational Technology (OT) environments where the software is commonly deployed. Organizations should upgrade to version 14.12.0000 or later and restrict access to port 5405 as an interim mitigation.

CANVA AMONG ~100 TARGETS OF SHINYHUNTERS OKTA IDENTITY-THEFT CAMPAIGN

ShinyHunters is running an Okta single sign-on credential-stealing campaign against roughly 100 high-value organizations, including Canva, Atlassian, RingCentral, and others. The group uses evolved voice phishing to capture SSO logins, enroll its own devices in MFA, pivot into SaaS apps, exfiltrate data, and then extort victims. There is no confirmation of which named firms were successfully breached.

WHO OPERATES THE BADBOX 2.0 BOTNET?

A leaked screenshot from Kimwolf botnet operators revealed they had compromised the Badbox 2.0 control panel, exposing seven authorized user email addresses that OSINT investigation traced to Chen Daihai and Zhu Zhiyu of Beijing Astrolink Wireless Digital Technology—individuals whose domains were previously flagged in HUMAN Security's Badbox 2.0 report. The investigation used password reuse across breach databases, domain registration records, and social media pivots to connect qq.com email addresses to multiple Chinese technology companies distributing pre-infected Android TV boxes. This unauthorized access allows Kimwolf to bypass residential proxy mitigations by loading malware directly onto Badbox 2.0's 10+ million compromised devices.

HOW TO ENCRYPT YOUR PC'S DISK WITHOUT GIVING THE KEYS TO MICROSOFT

BitLocker encrypts Windows PCs to protect data, but many systems automatically store recovery keys with Microsoft when users sign in with a Microsoft account, creating a potential privacy risk if authorities obtain those keys. By upgrading to Windows 11 Pro, users can fully control BitLocker, decrypt any existing Microsoft-managed setup, and re-encrypt the drive while saving the recovery key locally, such as on paper or an external drive, rather than in the cloud.

LLM KEY SERVER: PROVIDING SECURE AND CONVENIENT ACCESS TO INTERNAL LLM APIS

Mercari's AI Security team developed a key server to address the challenge of managing API key-based access to LLMs. The key server uses Google Workspace and Google Cloud for OIDC authentication to LiteLLM, which provides time-limited API access to various models through a unified API. The team also developed an internal CLI, GitHub Action, and Google Apps Script template to support adoption of the LLM key server.

AGENT OS

Agent OS applies operating system concepts to AI agent governance, providing kernel-level policy enforcement that intercepts and blocks actions before execution rather than relying on prompt-based safety. The framework includes POSIX-inspired primitives such as signals, a virtual filesystem for agent memory, cross-model verification, inter-agent trust protocols with cryptographic signing, and integrations with LangChain, CrewAI, and OpenAI Assistants. An MCP server enables integration between Claude Desktop and tools for verification and kernel execution.

AWESOME HACKING

Awesome hacking is a curated list of hacking tools for hackers, pentesters, and security researchers. Its goal is to collect, classify, and make awesome tools easy to find by humans, creating a toolset you can checkout and update with one command.

ZEROPULSE

ZeroPulse is a comprehensive C2 platform that utilizes CloudFlare Tunnel technology. It is designed for secure remote management and monitoring.

WHY HAS MICROSOFT BEEN ROUTING EXAMPLE.COM TRAFFIC TO A COMPANY IN JAPAN?

Microsoft's autodiscover service was found routing email traffic for example.com—a domain reserved for testing under RFC2606—to subdomains belonging to Sumitomo Electric in Japan, potentially causing test credentials to be sent outside Microsoft's network. The misconfiguration, which may have persisted for five years, has been suppressed, but Microsoft has not explained how the Japanese company's servers were added to its network configuration. The incident raises concerns about other potential misconfigurations following Microsoft's 2024 breach, where forgotten test account privileges enabled Russian state hackers to monitor executive emails.

BROWSER-BASED ATTACKS HIT 95% OF ENTERPRISES — AND TRADITIONAL SECURITY TOOLS NEVER SAW THEM COMING

95% of organizations experienced browser-based attacks last year that evaded traditional security tools. Attackers operated inside trusted sessions where web gateways, cloud access brokers, and endpoint protection lose visibility after login. Recent incidents, including ShadyPanda's weaponized extensions and Cyberhaven's supply chain compromise, demonstrate how attackers exploit browser auto-updates and session tokens rather than zero-days. Security leaders recommend inventorying extensions, implementing 48-72 hour auto-update delays, and moving data protection to the browser layer, where 64% of encrypted traffic currently goes uninspected.

NOYB WIN: MICROSOFT ORDERED TO STOP TRACKING SCHOOL CHILDREN

Austria's data protection authority ruled that Microsoft illegally placed tracking cookies on a pupil's device through Microsoft 365 Education, using them to analyse behaviour, collect browser data, and support advertising. The authority ordered Microsoft to stop tracking the child within four weeks and rejected Microsoft's attempt to shift responsibility to its Irish subsidiary.

HACKERS CAN BYPASS NPM'S SHAI-HULUD DEFENSES VIA GIT DEPENDENCIES

Researchers discovered "PackageGate" vulnerabilities in JavaScript package managers that allow bypassing npm's '--ignore-scripts' defense via malicious .npmrc files in Git dependencies, with pnpm, vlt, and Bun issuing patches while npm rejected the report as expected behavior.

GOOGLE WILL SETTLE ITS ASSISTANT SPYING LAWSUIT FOR $68 MILLION

Google has agreed to pay $68 million to resolve a class action lawsuit over “false accepts,” when Google Assistant devices recorded audio without users intentionally saying “Ok Google.”

'STANLEY' TOOLKIT TURNS CHROME INTO UNDETECTABLE PHISHING VECTOR

A new malware-as-a-service kit called Stanley generates malicious Chrome extensions that overlay convincing phishing pages on top of real sites while keeping the legitimate URL visible through a fake productivity extension.

👉 Download the report

impact. Sublime Security's 2026 EMAIL THREAT RESEARCH REPORT

analyzes real-world email attacks across organizations of all sizes to reveal what actually changed and why it matters.

PALO ALTO NETWORKS PATCHES FIREWALLS AFTER DISCOVERY OF A NEW DENIAL-OF-SERVICE FLAW

Palo Alto Networks has patched CVE-2026-0227 (CVSS 7.7), a high-severity DoS vulnerability in PAN-OS affecting firewalls with GlobalProtect gateway or portal enabled that allows unauthenticated attackers to force devices into maintenance mode. A PoC already exists, and the flaw mirrors CVE-2024-3393 from late 2024, which was exploited as a zero-day before patches were available. Organizations running PAN-OS versions 10.2 through 12.1 with GlobalProtect enabled should apply patches immediately, while most Prisma Access customers have already been automatically updated.

SYNOLOGY DSM 7.3.2

A local privilege escalation vulnerability chain in Synology DSM 7.3.2-86009 allows any authenticated user with shell access to gain root when DownloadStation with BitTorrent is enabled. The exploit chains three misconfigurations: a world-writable Transmission RPC socket running as root, a world-writable /volume1/@eaDir/ system directory, and a missing nosuid mount flag on /volume1, enabling attackers to configure Transmission's script-torrent-done-filename to execute arbitrary payloads as root upon torrent completion. A full PoC is available, and the vulnerability has been reported to Synology PSIRT.

KONNI HACKERS TARGET BLOCKCHAIN ENGINEERS WITH AI-BUILT MALWARE

Researchers from CheckPoint have discovered a new malicious campaign from the North Korean Konni hackers. The attack begins with a Discord link that downloads a zip archive containing a lure document and two batch files which downloads a PowerShell backdoor and then deletes other signs of infection. Notably, the malware contains signs of it being AI-generated, such as comments with variable placeholders.

ORGANIZED TRAFFER GANG ON THE RISE TARGETING WEB3 EMPLOYEES AND CRYPTO HOLDERS

Hybrid Analysis uncovered a sophisticated Russian-speaking Traffer operation targeting cryptocurrency users and Web3 employees through fake Electron applications disguised as AI productivity tools, meeting software, and gaming platforms, with documented earnings of at least $2.4 million. The campaign uses 80+ domains, elaborate fake company ecosystems with purchased social media accounts, and abused code-signing certificates to deliver second-stage payloads, with shared infrastructure suggesting links to the Marko Polo, CrazyEvil, and Wagmi Traffer groups. Security teams should monitor for the provided IOCs and exercise caution with unsolicited software downloads from Web3-themed applications, particularly those requiring invitation codes or tokens for access.

EXPLOITING KEYSPACE REDUCTION AND RELAY ATTACKS IN 3DES AND AES-PROTECTED NFC TECHNOLOGIES

Modern NFC cards used in hotel keys, tickets, and access systems can be attacked not by breaking 3DES or AES, but by abusing how keys and memory are handled after authentication. By relaying the legit reader–card handshake and then partially overwriting key bytes, attackers can shrink the effective keyspace from astronomically large to something brute‑forceable with modest hardware. Weak or missing integrity checks, non‑atomic key writes, and flawed non‑NXP clone cards make it possible to recover full keys from one or a few tags, sometimes in under a minute. Proper key diversification, locking key pages, enabling CMAC/secure messaging, and migrating to stronger platforms like DESFire EV3 sharply reduce these risks.

AMAZON CLOUDFRONT MTLS WITH OPEN-SOURCE SERVERLESS CA

AWS added support for CloudFront to use mTLS to require client certificates in requests at re:Invent 2025. This article walks through setting up CloudFront to use mTLS via an open-source serverless CA that the author developed. AWS should offer a standardized Trust Store, possibly in ACM, rather than having all services that support mTLS implement it separately.

SEC-CONTEXT

Comprehensive security anti-pattern reference distilled from 150+ sources designed for LLM consumption, addressing the 86% XSS failure rate and other critical vulnerabilities in AI-generated code. Provides two reference documents covering 25+ anti-patterns with pseudocode examples, Common Weakness Enumeration (CWE) references, and mitigation strategies optimized for use as system prompts, Retrieval-Augmented Generation (RAG) references, or dedicated security review agents.

WINDOWS-PENETRATION-TOOLS

A comprehensive Windows security toolkit written in C++ using MFC, designed for security researchers, penetration testers, and developers interested in Windows internals. This project demonstrates various security techniques, including DLL injection, process manipulation, privilege escalation, and system monitoring capabilities.

UPWIND (PRODUCT LAUNCH)

Upwind provides a runtime-native CNAPP platform that gives deep visibility into cloud networks, APIs, and data flows, reducing alert noise and helping prioritize real risk.

149M LOGINS FROM ROBLOX, TIKTOK, NETFLIX, CRYPTO WALLETS FOUND ONLINE

A security researcher discovered a 96GB database containing 149 million stolen credentials for services including Facebook (17M), Netflix (3.4M), Binance (420K), Gmail (48M), and government domains from multiple countries, exposed online without authentication. The data appeared to be collected via infostealer malware through an organized system with reversed labeling to sort by device and website. The database was actively growing during the month it took to get the hosting provider to take it offline. Users should enable MFA, use unique passwords via password managers, and monitor for credential exposure on services like Have I Been Pwned.

MALICIOUS VS CODE AI EXTENSIONS WITH 1.5 MILLION INSTALLS STEAL DEVELOPER SOURCE CODE

Security firm Koi Security uncovered two popular AI-branded VS Code extensions that quietly exfiltrate every opened and edited file to China-based servers, while still functioning as legitimate coding assistants. They also support remote-triggered bulk exfiltration of up to 50 workspace files, fingerprint devices via embedded analytics SDKs, and are linked to a broader “MaliciousCorgi” campaign alongside new PackageGate flaws in JavaScript package managers that weaken common supply chain defenses.

TIKTOK USERS FREAK OUT OVER APP'S “IMMIGRATION STATUS” COLLECTION - HERE'S WHAT IT MEANS

TikTok updated its privacy policy as part of its new ownership agreement, which triggered user notifications. Many users noted concerning amounts of sensitive data the app collects, such as precise location data and immigration status. TikTok has noted that this disclosure is required by laws such as California's CCPA.

CHATGPT TEMPORARY CHAT FEATURE IS GETTING A MUCH-NEEDED UPGRADE

OpenAI is testing an upgrade to ChatGPT's temporary chat feature that allows users to retain personalization while still preventing the conversation from being saved to chat history or used for model training.

DATA THIEVES BORROW NIKE'S 'JUST DO IT' MANTRA, CLAIM THEY RAN OFF WITH 1.4TB .

WorldLeaks claims to have stolen 1.4TB of internal Nike data, mainly design and manufacturing files rather than customer records.

APPLE C-SERIES MODEM ENABLES NEW PRIVACY-FOCUSED LIMIT PRECISE LOCATION FEATURE

iOS 26.3 introduces a new "limit precise location" setting for devices with Apple's C-series modem that obfuscates user location data from cellular carriers, reducing both third-party tracking and government surveillance capabilities.

POLAND'S ENERGY GRID WAS TARGETED BY NEVER-BEFORE-SEEN WIPER MALWARE

Poland's power grid faced a cyberattack in December that involved a new “DynoWiper” malware. Likely linked to Russia's Sandworm group, the attempt to disrupt electricity failed. The operation coincided with the 10th anniversary of Sandworm's landmark 2015 Ukraine blackout, and it fits a long pattern of Russian wiper use.

FORTINET ADMITS FORTIGATE SSO BUG STILL EXPLOITABLE DESPITE DECEMBER PATCH

Attackers can still exploit a critical FortiCloud SSO authentication vulnerability in FortiOS, even on systems fully patched in December, by abusing a new SAML-based SSO attack path. Recent campaigns involve automated reconfiguration of FortiGate firewalls, the creation of backdoor admin accounts, and the theft of configuration files. Fortinet has urged customers to monitor authentication logs, restrict management exposure, and track admin changes while it develops a new fix.

ANCIENT TELNET BUG HAPPILY HANDS OUT ROOT TO ATTACKERS

A critical (CVSS 9.8) vulnerability in telnet could allow unauthenticated users to obtain root privileges on systems running InetUtils telnetd. To exploit the vulnerability, an attacker only needs to set their USER environment variable to “-f root” and pass the “-a” or “--login” flag to telnet. Experts recommend updating to the latest version of telnet or, ideally, switching to a more secure protocol such as SSH.

KUBERNETES V1.35: A BETTER WAY TO PASS SERVICE ACCOUNT TOKENS TO CSI DRIVERS

Kubernetes v1.35 added the ability for CSI drivers to opt-in to receiving service account tokens via the `secret` field in `NodePublishVolumeRequest`. Prior to this update, service account tokens were received via the `volume_context` field, which could lead to secrets being included in gRPC request logs if drivers did not implement custom sanitizer logic. To opt in to this feature, CSI drivers should implement the `serviceAccountTokenInSecrets' field as well as implement logic for backwards compatibility.

BUILDING TAMPER-PROOF MEDIA APPS: C2PA VS CPP DEEP DIVE FOR DEVELOPERS

This technical deep dive compares C2PA (the industry standard backed by Adobe and Sony) with the emerging Content Provenance Protocol (CPP) for building tamper-proof media applications that prove content authenticity. CPP's key differentiator is its "Completeness Invariant," which uses XOR hash sums to mathematically detect deleted evidence—a critical capability for legal proceedings, insurance claims, and regulatory compliance that C2PA cannot provide architecturally. The article provides Swift and Python implementations of cryptographic patterns, including Secure Enclave signing, Merkle tree construction, RFC 3161 timestamp anchoring, and privacy-preserving human attestation without storing biometric data.

THE DUAL-USE DILEMMA OF AI: MALICIOUS LLMS

While LLMs can be a useful tool for defenders, they can also be used by attackers. WormGPT was the first malicious LLM that was released. It is still being developed. KawaiiGPT is an open-source malicious LLM. This article analyzes the efficacy of these models at producing ransomware notes, data exfiltration scripts, and lateral movement detection.

AWESOME-BLACKHAT-ARSENAL

Whether you're in red teaming, blue teaming, appsec, or OSINT, this list helps you explore and leverage the best tools demonstrated live by security professionals across the world.

SECURITY DETECTIONS MCP

Security Detections MCP is an MCP server that enables LLMs to query a unified database of over 7,200 Sigma, Splunk ESCU, Elastic, and KQL security detection rules through natural language. The tool features SQLite FTS5-powered full-text search across detection fields, MITRE ATT&CK mapping, CVE coverage lookup, and process name filtering, with token-optimized analysis tools that reduce data transfer by 25x compared to traditional queries. Security teams can integrate this with Claude Desktop, Cursor IDE, or VS Code to perform coverage analysis, identify detection gaps against threat profiles, and generate ATT&CK Navigator layers directly from their AI assistant.

BANDJACKS

Bandjacks is a comprehensive Cyber Threat Intel system that quickly extracts MITRE ATT&CK techniques from threat reports, builds a knowledge graph of threat actors, and utilizes LLM response caching for faster extraction, among other features.

MICROSOFT GAVE FBI A SET OF BITLOCKER ENCRYPTION KEYS TO UNLOCK SUSPECTS' LAPTOPS

The FBI has obtained a warrant compelling Microsoft to hand over BitLocker recovery keys for three seized laptops, allowing agents to decrypt the drives despite full‑disk encryption. BitLocker recovery keys are often stored in Microsoft's cloud, enabling lawful access but also raising privacy and security fears if the company or its keys are compromised.

MICROSOFT FLAGS MULTI-STAGE AITM PHISHING AND BEC ATTACKS TARGETING ENERGY FIRMS

Microsoft describes a layered phishing and BEC campaign against energy companies that abuses trusted services like SharePoint and OneDrive to deliver links leading to adversary-in-the-middle credential theft pages. Attackers then use stolen credentials and session cookies to set stealthy inbox rules, launch large internal and external phishing waves, and bypass MFA using tailored phishing kits and social engineering, prompting defenders to adopt phishing-resistant MFA, conditional access, continuous access evaluation, and robust anti-phishing controls.

IRELAND WANTS TO GIVE ITS COPS SPYWARE, ABILITY TO CRACK ENCRYPTION

Ireland has announced the release of a new communications bill that seeks to provide sweeping updates to its decades-old telecommunications legislation. Among the provisions in the bill, Ireland is looking to provide law enforcement with the ability to utilize spyware as well as the ability to intercept encrypted messages. Ireland is looking to follow the framework laid out by the EU Commission in 2024.

ANTHROPIC PREPARES TO RELEASE SECURITY CENTER FOR CLAUDE CODE

Anthropic is preparing to launch Security Center for Claude Code, a feature that will provide users with an overview of recent security scans, detected issues, and the ability to manually initiate repository scans.