Attack Surface Management programs struggle to demonstrate ROI because they optimize for coverage metrics like asset counts and alerts generated rather than measuring actual risk reduction, creating a gap between effort and security outcomes. Traditional ASM implementations focus on discovery inputs while teams experience alert fatigue, long backlogs of unresolved assets, ownership confusion, and exposures that persist for months without clear evidence of improved security posture. Organizations should shift to outcome-based metrics, including mean time to asset ownership, reduction in unauthenticated state-changing endpoints, and time to decommission abandoned assets—measurements that directly correlate with exposure duration and demonstrate whether the attack surface is actually shrinking over time.
AI agents are increasingly embedded deep within corporate systems, automating tasks such as code review, alert triage, approvals, and even financial decisions, effectively acting with human-like privileges at machine speed. This makes misconfigurations and over-permissive “superuser” access especially dangerous, because a single prompt injection or tool-misuse bug can turn an agent into a silent insider capable of approving fraudulent transactions, exfiltrating data, or deleting backups. At the same time, these tools help defenders scale, triage noise, and think more strategically, so security leaders must strike a balance: apply least-privilege access, robust monitoring, and strong controls around internal LLMs and task-specific agents to harness benefits without enabling catastrophic abuse.
Smart pet feeders from Petlibro had several serious security flaws that allowed attackers to log in to any account via a broken social-login flow, because the backend trusted client-supplied Google IDs rather than validating OAuth tokens. Attackers could then pull detailed pet profiles, enumerate devices, hijack feeders and cameras, and even harvest owners' recorded mealtime audio messages through poorly authorized APIs. The researcher disclosed six issues, received a small bounty and a post‑hoc NDA request, and criticized Petlibro for leaving the legacy authentication bypass live for weeks in the name of “compatibility” despite the risk to users and their pets.
Certgrep is a Certificate Transparency Log search tool that allows you to search by regular expressions, wildcards, as well as suffix and prefix terms.
APISec is a dynamic, AI-powered API red team that continuously scans APIs for vulnerabilities. It includes a browser extension called Bolt that dynamically discovers APIs during user browsing without requiring a MitM proxy.
Web Check is an all-in-one OSINT tool for analyzing websites. This repository includes information for deploying the tool on Netlify or Vercel, building from source, or using Docker. A live demo is also included.
Cybersecurity professionals Ryan Goldberg (former Sygnia incident response manager) and Kevin Martin (DigitalMint ransomware negotiator) pleaded guilty to deploying BlackCat/ALPHV ransomware against multiple US victims from April to December 2023, extorting approximately $1.2M in Bitcoin from a medical device company while sharing 20% of ransoms with operators. The defendants leveraged their cybersecurity expertise to conduct attacks against five companies, with Goldberg later fleeing to Paris after learning of FBI raids on co-conspirators and both facing potential 50-year sentences. The case highlights insider threat risks and the FBI's recommendation for organizations to exercise due diligence when engaging third-party incident response providers.
When classical ML-based security tools are compared against LLM-based security tools, the classical ML tools often have several advantages that skew the results. Classical ML tools are frequently trained on a portion of the dataset and then tested on the same data, whereas LLM tools are tested in a one-shot fashion. The ground truth may contain labeling errors that classical ML models replicate, and classical ML models require continuous retraining to maintain accuracy. Moving forward, we should develop security-focused foundational models to help overcome scalability issues and hallucinations.
Formal verification is a highly specialized and time-consuming process of mathematically validating a system's behavior. The 8,700-line seL4 microkernel required 20 person-years and 200,000 lines of code in the Isabelle proof language, underscoring why formal verification remains largely an academic discipline at present. If we instead train users to write proper specifications for formal verification, it may be possible to use LLMs to generate proofs and reduce the barrier to formal verification.
Resecurity has refuted ShinyHunters' breach claims, revealing that the threat actor interacted with a honeypot containing synthetic employee accounts and fake infrastructure rather than production systems.
California's new Delete Requests and Opt-Out Platform (DROP) lets residents file a single verified request to force over 500 registered data brokers to delete their personal data and stop selling it.
Qilin ransomware actors breached Covenant Health's systems in May 2025, exfiltrating roughly 850 GB of data, including over 1.3 million files containing names, addresses, Social Security numbers, insurance details, and treatment information for 478,188 people across multiple US states.
Trust Wallet disclosed that the second iteration of the Shai-Hulud supply chain attack in November compromised its Google Chrome extension, resulting in the theft of approximately $8.5 million in cryptocurrency assets. The attack leveraged malicious packages published to npm and PyPI, compromising developer environments and enabling attackers to insert malicious code into the extension for wallet credential theft.
Hackers breached Aflac's US network in June 2025, stealing data on about 22.65 million people, including names, addresses, Social Security numbers, IDs, and medical and insurance details. Aflac contained the attack without ransomware impact and is now offering 24 months of credit, identity, and medical fraud monitoring, urging vigilance.
A hacker calling themselves Lovely claims to have breached Condé Nast's user database, leaking 2.3 million records with names and contact details. They have threatened to dump 40 million more from brands like Vogue and The New Yorker.
Equifax Continental Europe CISO Javier Checa detailed the company's $3 billion transformation following the 2017 breach that compromised 147 million records, including a complete cloud migration, zero legacy systems, and embedding security culture across all 300 cybersecurity specialists, plus company-wide employee bonus structures tied to security metrics. The company built its recovery strategy on transparency and collaboration, publishing annual security reports with incident-response metrics and sharing security control frameworks publicly, while neutralizing 15 million daily threats (175 per second, up 25% from 2023). Security teams should adopt hybrid defense strategies combining AI-powered tools with traditional signature-based protections, implement biometric authentication to counter deepfake attacks, and ensure CISO representation on management committees to maintain strategic alignment between security investments and business objectives.
Cloudflare Workers can provide a serverless, rapidly adaptable platform for Conditional Access Payload Delivery (CAPD). Authentication can be achieved via a custom header, and the system can be enhanced by supplying secrets as environment variables, using more generic error codes, or by using timing-safe comparisons. The post also details detection opportunities for defenders.
Singularity demonstrates advanced Linux rootkit tactics by leveraging legitimate kernel features (ftrace) for syscall hooking and implementing defense-in-depth across processes, filesystems, network layers, and logging systems. The rootkit's dual-architecture support (x86_64 and ia32) prevent a common detection bypass in which investigators use 32-bit binaries to circumvent 64-bit-only hooks. Comprehensive anti-forensics capabilities, including log sanitization, taint flag manipulation, and module auto-hiding, render traditional detection methods ineffective. Defenders should adopt memory-based forensics techniques, monitor ftrace hook signatures in kernel debug interfaces, test with both 32-bit and 64-bit tools, and recognize that filesystem-based security checks can be completely intercepted by kernel-level adversaries.
Third Eye is a user-mode WDA_MONITOR/WDA_EXCLUDEFROMCAPTURE bypasser using undocumented Windows functions with C# bindings.
Ciphero provides an AI security and governance platform that acts as an AI verification layer for enterprises. It captures, verifies, and governs all AI interactions (including shadow AI and agentic workflows) to prevent data loss, enforce policies, and improve AI reliability.
Those setting New Year's goals should start by establishing a system, such as a study schedule, to achieve them. To-do lists or scheduled blocks of time can help fight procrastination. Having a mentor or friend keep you accountable can also help with ensuring goals are met.
A critical flaw in MongoDB's use of the zlib compression library allows network attackers to leak sensitive data from server memory without requiring authentication. By sending specially crafted compressed messages, they can gradually extract user information, passwords, and API keys from affected MongoDB versions. Updating to patched releases, closing unnecessary ports, and disabling zlib compression where possible are key steps to reduce exposure.
South Korean Coupang will distribute 50,000 won vouchers to 33.7 million account holders after a data leak, totaling 1.69 trillion won ($1.18 billion). Critics say the vouchers, usable only on Coupang, turn a privacy crisis into marketing and don't reflect the breach's seriousness, sparking parliamentary hearings and consumer anger.
Sax, a major US accounting firm, has disclosed a breach that happened in 2024 that exposed data on about 220,000 individuals.
Cybersecurity researchers have revealed a nine-month campaign that exploited CVE-2025-55182 in React2Shell to hijack IoT devices and web servers, incorporating them into the RondoDox botnet.
Microsoft has announced that it will be dropping support for RC4, the default encryption method in Active Directory for the last 26 years.
Nissan has confirmed that data belonging to approximately 21k customers was breached via a data breach at Red Hat in September. The breached data includes full names, physical and email addresses, phone numbers, and sales data for some customers who purchased or received services at Nissan in Fukuoka, Japan.
France's postal service, La Poste, suffered a widespread DDoS attack that disabled all IT systems for over twelve hours, affecting the website, mobile app, Digiposte digital document service, and digital ID services. The attack also disrupted La Poste's banking subsidiary Banque Postale's online services, though over-the-counter operations and payment processing remained functional. The timing raised concerns about potential Christmas delivery disruptions, with no timeline provided for service restoration.
A ransomware-linked campaign exploited zero-day flaws in Oracle E-Business Suite to access University of Phoenix systems, leading to data theft affecting nearly 3.5 million people. Exposed data includes names, dates of birth, Social Security numbers, and bank account details, though no leak has yet appeared online.
Red teamers traditionally must manually configure C2 redirector proxy rules by reviewing profiles and adding User-Agent strings and HTTP endpoints to configuration files, requiring updates whenever the C2 profile changes. The author developed caddy-c2, a Caddy web server module that automatically parses Cobalt Strike profiles using goMalleable to extract User-Agents and URI paths, then dynamically routes legitimate C2 traffic without manual rule configuration. The module simplifies redirector deployment by eliminating the need to manually sync proxy configurations with C2 profile changes, though current support is limited to Cobalt Strike, with plans to expand to frameworks such as Mythic and Havoc.
Mintlify lets customers write pages in MDX, but processes that content in a way that allows attackers to run arbitrary JavaScript on the server during build. This means an attacker can take over the build environment, poison cached pages, and inject malicious scripts into many companies' docs, including big names like Discord and Vercel. Because some docs were served from the same domain or path as real apps, those scripts could steal auth tokens or perform actions as logged-in users.
LinkedIn modernized its SAST pipeline by building custom GitHub Actions workflows using CodeQL and Semgrep that deviated from paved paths to accommodate complex internal build processes, implementing dynamic rule filtering, SARIF enrichment, and extensive metrics instrumentation across tens of thousands of repositories. The team deployed a "stub workflow" approach combined with a Drift Management System that daily checks repository compliance and automatically commits workflow files, ensuring consistent security coverage while allowing centralized updates without touching individual repos. LinkedIn implemented "blocking mode" enforcement via GitHub Repository Rulesets requiring SARIF submission and zero high-risk vulnerabilities before PR merges, protected by multi-level kill switches (organization/repo/language/tool/rule-specific) and fail-safe mechanisms that upload blank SARIFs to unblock developers during scanning failures while triggering oncall alerts.
CLR-Unhook is a native C++ utility that bypasses EDR/AV hooks in the .NET Common Language Runtime by restoring the original nLoadImage function implementation.
Mandiant released GoStringUngarbler, a Python tool that deobfuscates strings in Go binaries protected by garble's literal transformation flag, supporting Windows PE and Linux ELF executables compiled with Garble v0.11.0-v0.13.0 and Go v1.21-v1.23. The tool identifies decrypting subroutines via regex pattern matching, emulates them using the Unicorn emulator to extract plaintext strings, and patches the binary by replacing obfuscation routines with stubs that directly reference the decrypted content. Security analysts can use this to accelerate malware analysis of garble-obfuscated Go samples, though it only works when garble's "-literals" flag was used during compilation.
Gambit Cyber provides an AI-native, risk-centric continuous threat exposure management platform called KnightGuard. It uses coordinated AI agents to help enterprises continuously identify, validate, prioritize, and remediate cyber risks across CTI, SecOps, and IT operations.
The libxml2 library temporarily lost its sole volunteer maintainer, Nick Wellnhofer, after years of unpaid security work, creating a critical risk for GNOME, web browsers, and countless projects depending on this XML/XSLT processing library. Wellnhofer experienced burnout from companies that sent security reports, expecting immediate CVE responses and patches, with no financial compensation beyond a single Google donation, while providing no code contributions or test cases. Two new maintainers have assumed responsibility, but the incident highlights the unsustainable model in which commercial software relies on unpaid volunteers to maintain critical infrastructure components.
Security market analyst James Berthoty predicts that supply chain and AI tooling will dominate the market in 2026. Berthoty predicts that the following critical product capabilities will be essential: supply chain malware detection, AI vulnerability remediation and prioritization, AI visibility, guardrails, testing, AI based detections, and SOC augmenters. Teams should also have runtime function level reachability (ADR), developer endpoint security, and realtime AI threat modeling and design review on their radar.
OpenAI acknowledges that prompt injection attacks in AI browsers like ChatGPT Atlas are a long-term, unsolved security risk, similar to social engineering on the web. The company is layering defenses, including an LLM-based automated attacker that repeatedly probes Atlas in simulation to discover new attack strategies, tighten protections, and enforce user confirmations. Experts still question whether the current agentic browser value justifies their elevated risk.
Amazon blocked over 1,800 job applications from suspected North Korean agents since April 2024.
Pirate preservation group Anna's Archive scraped 256 million Spotify track records and 86 million audio files through unauthorised data collection.
ServiceNow is acquiring Armis, a nine-year-old cybersecurity company focused on securing critical infrastructure for Fortune 500s and governments, in an all-cash $7.75 billion deal.
Dropbear SSH server versions through 2024.84 contain CVE-2025-14282 (CVSS 9.8 Critical), which allows privilege escalation to root via Unix socket forwarding. Programs that authenticate forwarded connections, by misusing SO_PEERCRED, receive root credentials instead of the actual user's credentials. Dropbear 2025.89 fixes this by implementing comprehensive changes to Unix socket handling and disabling socket forwarding when forced command options are used, preventing command restriction bypass. Organizations running Dropbear on embedded systems, such as OpenWRT routers and single-board computers, should immediately update or deploy the temporary mitigation using the dropbear -j flag (which also disables TCP forwarding) or compile with #define DROPBEAR_SVR_LOCALSTREAMFWD 0 in localoptions.h and distrooptions.h header files.
Romanian water authorities suffered a ransomware attack that encrypted systems using BitLocker and disabled about 1,000 computers across 10 of 11 regional offices. Core IT services, such as email, web platforms, databases, and GIS, were impacted, though the water supply continued.
The lotusbail npm package masqueraded as a legitimate WhatsApp Web API fork with functional code while secretly intercepting authentication tokens, messages, contacts, and media files through a malicious WebSocket wrapper. The malware employed sophisticated evasion techniques, including custom RSA encryption, four-layer obfuscation, 27 anti-debugging traps, and a hardcoded pairing code that established persistent backdoor access surviving package removal. Security professionals should implement behavioral runtime analysis to detect anomalous activities, such as custom encryption in communication libraries, and manually unlink all devices from WhatsApp settings if compromised.
Modern vulnerability research can blend static analysis with large language models to cut through overwhelming false positives and highlight only issues that look genuinely exploitable. By feeding CodeQL findings and carefully chosen code context into an LLM, and then guiding it with structured questions about data and control flow, the system mimics how senior researchers reason about real bugs rather than surface patterns. Pre-extracting functions and related entities into fast-searchable CSVs makes this scalable across huge C and C++ codebases, enabling discovery of impactful issues and even new CVEs with modest time and compute.
Red Canary detected a novel attack where adversaries deployed spam bombing followed by fake tech support calls leveraging Quick Assist to introduce a QEMU virtual machine (Windows 7 SP1) running Sliver C2 implants, QDoor backdoor, and ScreenConnect for redundant persistence. The VM was configured for internal network reconnaissance via SRV record queries and external C2 communications to marnyonline[.]com and 45[.]61[.]169[.]127. Forensic analysis of the 8GB disk image revealed the adversary's toolkit through prefetch data, browser history, persistence mechanisms in start.txt, and volume shadow copies containing deleted artifacts. Defenders should monitor for anomalous QEMU execution on standard endpoints, implement strict Quick Assist controls, detect internal SRV record enumeration and ping sweeps with single-packet patterns, hunt for Sliver team server SSL certificates with CN=multiplayer and O=operators fingerprints, and deploy behavioral analytics to identify VM deployment following remote assistance sessions.
MacPersistenceChecker is a native macOS security tool that enumerates all persistence mechanisms across 20+ categories, including launch agents, system extensions, and BTM database entries, scoring each item 0-100 based on code signatures, LOLBins detection, and behavioral anomalies mapped to MITRE ATT&CK framework. The tool includes real-time monitoring with optional Claude AI integration that analyzes changes using full context, including risk scores and intent mismatches, plus MCP server support enabling Claude Code integration for natural language queries against persistence data. Security teams can leverage containment features to quarantine suspicious items with automatic backup and timed release.
TokenFlare is a serverless AITM phishing simulation framework targeting Entra ID/M365. Its core logic is just 530 lines of JavaScript. TokenFlare supports multiple OAuth flows, including Intune Conditional Access bypass techniques, and is deployable to Cloudflare Workers or a local HTTPS proxy, with built-in bot/scraper blocking and production-ready infrastructure, in under 60 seconds. The framework captures credentials, auth codes, and session cookies via configurable webhooks, uses modular campaign configuration for custom branding and URL structures, and includes Certbot integration for automated SSL certificate provisioning. Blue teams can detect TokenFlare via static IoCs: the HTTP header "X-TokenFlare: Authorised-Security-Testing" and the User-Agent "TokenFlare/1.0 For_Authorised_Testing_Only". They should monitor for serverless worker abuse, suspicious OAuth flows with rapid authentication handoffs, and webhook exfiltration patterns targeting M365 authentication tokens.
Docker has released over 1,000 secure images that are free and open source for developers. These images are regularly scanned and updated to minimize or eliminate exploitable CVEs. They run as non-root by default, are minimal to lower the attack surface, meet compliance standards, and are available across multiple distributions.