Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Fieldtex Products, a US medical supply and contract sewing provider, reported unauthorized access to its systems in mid-August that exposed protected health information for about 238K individuals, including names, addresses, dates of birth, insurance IDs, plan details, and gender. Akira ransomware has claimed responsibility, saying it stole over 14 GB of corporate, employee, customer, and financial data.
A hacker accessed 700Credit's systems and stole personal data, including names, addresses, dates of birth, and Social Security numbers for at least 5.6 million people whose details were collected by US auto dealerships between May and October. The company is notifying victims by mail. Michigan's attorney general has urged affected individuals to use credit freezes or monitoring to reduce their risk of fraud.
Security researcher Ben Zimmermann discovered an exposed GitHub access token belonging to a Home Depot employee that granted access to hundreds of private source code repositories, cloud infrastructure, and critical systems, including order fulfillment and inventory management, for approximately one year. Despite multiple attempts to privately disclose the issue via email and LinkedIn to Home Depot's CISO, Zimmermann received no response until TechCrunch contacted the company, highlighting the absence of a vulnerability disclosure or bug bounty program. Home Depot revoked the token's access following media outreach, but has not confirmed whether logging capabilities exist to determine if unauthorized parties accessed internal systems during the exposure period.
Shai-Hulud 2.0 is a malicious npm supply-chain worm that abuses install-time scripts to run hidden malware on developer machines, steal credentials with tools like TruffleHog, and then exfiltrate them to attacker-controlled GitHub repositories using obfuscation techniques such as multi-layer base64 encoding. With stolen tokens, it can mass-clone private code, attempt destructive git operations, and, if npm publish credentials exist, automatically republish trojanized versions of popular packages, rapidly propagating through the JavaScript ecosystem. Recommendations to prepare against it include disabling npm scripts by default, adopting pnpm's safer defaults and minimum package age, enforcing branch protection everywhere, and moving to short-lived CI-based publishing via OIDC to eliminate long-lived secrets on developer laptops.
Google Project Zero analyzed in-the-wild DNG image exploits targeting Samsung's Quram image parsing library (CVE-2025-21042), discovered through suspicious files uploaded to VirusTotal that were distributed via WhatsApp and exploited Samsung's com.samsung.ipservice process when images were automatically scanned. The vulnerability allowed out-of-bounds writes through malformed DNG opcode parameters, which attackers leveraged to corrupt heap metadata, bypass ASLR through crafted MapTable operations that leaked library addresses, construct JOP chains, and ultimately achieve system() command execution to deploy spyware—all without control flow integrity mitigations like PAC/BTI present in the Quram library. Samsung silently patched the vulnerability in April by adding bounds checks to prevent plane index overflows. The case demonstrates how image format specifications provide powerful exploitation primitives that enable single-bug exploits to achieve interactionless remote code execution and access to all media store contents, capabilities that would likely have been prevented by MTE deployment.
Traditional IAM systems are inadequate for securing AI agent delegation because they verify identity rather than track authority derivation across dynamic task chains, creating the Confused Deputy problem where agents possess ambient permissions without understanding their origin or intended scope. Capability-based authorization systems address this by treating authority as cryptographically-signed tokens that are explicitly passed between agents, monotonically attenuated at each delegation hop, bound to holder keys for proof of possession, and automatically expire when tasks complete. This model prevents prompt injection attacks from escalating to data exfiltration by ensuring agents can only exercise the specific, constrained authority delegated to them rather than role-based permissions, making injection attempts succeed at the language layer but fail at the authorization layer.
Sponsored
The 2025 GigaOm Radar Report for Penetration Testing as a Service (PTaaS) evaluates the top 16 PTaaS vendors. Learn why Cobalt was named
Lumia Security provides a network-level security and governance platform that gives enterprises visibility and control over how employees and autonomous agents use AI tools. It understands AI interactions' intent and context, continuously evaluates risk, and enforces policies across thousands of AI applications.
BlackArch Linux is an Arch Linux–based penetration testing distribution for penetration testers and security researchers. The repository contains 2,880 tools. You can install tools individually or in groups. BlackArch Linux is compatible with existing Arch installations.
Kali Linux 2025.4 introduces three new penetration testing tools (bpf-linker, evil-winrm-py, and hexstrike-ai) alongside major desktop environment upgrades, including GNOME 49 with complete transition to Wayland and removal of X11 support. The release includes expanded Kali NetHunter support for Android 15/16 devices with Wifipumpkin3 preview for rogue access point attacks, enhanced VM guest utilities support for VirtualBox, VMware, and QEMU, and distribution changes requiring BitTorrent for Live image downloads due to increased file sizes. Users can upgrade existing installations via apt commands or download fresh ISO images. The update focuses on improving both security testing capabilities and user experience across desktop environments.
The US State Department mandated that H-1B visa applicants and their H-4 dependents set all social media profiles to public starting December 15, ostensibly to screen for national security threats through “online presence reviews” that assess hostility toward US institutions, effectively forcing digital exposure on over a million technology workers and their families. This policy creates severe security risks by providing foreign adversaries with free organizational intelligence on defense contractors, chip makers, and AI labs, exposing workers to spear-phishing, SIM swapping, recruitment exploitation, and extortion tactics while turning legitimate employees into attack vectors through publicly available personal data that can be scraped and weaponized for deepfake impersonations and social engineering. The mandatory public exposure normalizes government-mandated privacy erosion while ironically creating the intelligence security risks it aims to prevent, as sophisticated threat actors using fake accounts remain hidden while legitimate applicants become vulnerable targets with their professional affiliations, family connections, and personal vulnerabilities exposed to hostile nation-state surveillance operations.
Researchers from the University of Cambridge have determined that SMS numbers, which are commonly used by services to verify account activation and combat fraud, can be readily purchased, typically for less than 30 cents each. Costs varied by country, with the UK and Russia selling for 10 cents at the lower end, and Australia and Japan selling for $3-$5 at the higher end. The cost could also vary by service, with throwaway numbers for WhatsApp costing more than those for X.
Three organizations reported security incidents in which Notepad++ processes initiated access, allowing threat actors to gain hands-on keyboard activity and potentially exploit the application's update mechanism.
South Korea's largest retailer, Coupang, traced a 33.7 million customer data breach to a former employee who retained system access after leaving in 2024.
Sponsored
ThreatLocker's annual Zero Trust World [4] is the most interactive, HANDS-ON CYBERSECURITY LEARNING event. Join hacking labs, get Cyber Hero certified, and attend sessions with cybersecurity, IT, and business experts.
Two major flaws in Freedom Chat have been discovered: one allowed attackers to enumerate nearly 2,000 users' phone numbers by mass-guessing them against the app's servers, and another leaked users' PIN codes to everyone in the default public channel via backend responses. Freedom Chat reset all PINs, tightened rate limiting, removed exposed numbers, and shipped an updated version. This is founder Tanner Haas' second messaging app to face serious security issues.
OpenAI has stated that the cybersecurity capabilities of its frontier models are accelerating rapidly and that upcoming models are likely to pose a “high” risk. OpenAI notes that in August, GPT-5 scored 27% on a CTF, whereas last month GPT-5.1-Codex-Max scored 76%. OpenAI's Fouad Martin points to the models' ability to work for extended periods as a driving force behind this.
Criminals are exploiting interest in OpenAI's Atlas browser by buying Google ads that point to a shared ChatGPT conversation posing as an installation guide for a macOS “Atlas browser.” The guide instructs users to run a one‑line Terminal command that silently downloads a script, steals credentials, and deploys the AMOS infostealer, which exfiltrates browser data, crypto‑wallet info, documents, and more, while also installing a backdoor for persistent remote access.
MCP (Model Context Protocol) server configurations used by AI development tools like Cursor and Claude Code typically store plaintext API keys in mcp.json files, creating a risk of credential exposure when repositories are pushed to version control or shared with teammates. Developers can eliminate this risk by storing secrets in 1Password vaults, referencing them using op://vault/item/field syntax in .env files, and launching MCP servers with the 1Password CLI command op run --env-file=.env to dynamically inject credentials at runtime without persisting them on disk. This pattern ensures secrets are decrypted only in memory during process execution and automatically disappear when the process exits, preventing accidental exposure in Git history while maintaining developer productivity.
The AWS CLI allows users to define command aliases that can run arbitrary bash commands. A limitation that previous work faced when trying to abuse aliases was that if an attacker overwrote a command (such as `aws sts`) with a malicious alias, they could not call the original command. This post introduces a one-liner that dynamically modifies the alias file to restore the original command so it can be used in the malicious alias and then restores the malicious alias after running.
Sponsored
SO-CON 2026 (April 13-18, 2026) [11] is where the community comes together to advance the practice of Attack Path Management. We are excited to share that Kevin Mandia, Founder and Former CEO of Mandiant, will deliver the featured keynote at SO-CON 2026 [11].
Prime Security (Prima) provides an AI-powered “agentic security architect” that autonomously performs design-stage security reviews across planned development work, continuously identifying, prioritizing, and helping mitigate software design flaws so security teams can focus on higher-level architecture strategy.
AI Infra Guard integrates capabilities such as AI infra vulnerability scan, MCP Server risk scan, and Jailbreak Evaluation to provide users with the most comprehensive, intelligent, and user-friendly solution for AI security risk self-examination.
RAPTOR is an autonomous offensive/defensive security research framework built on Claude Code.
Flare's research reveals that over 10,000 public Docker Hub images expose active secrets from more than 100 organizations, including a Fortune 500 company and a major bank, often via personal or “shadow IT” accounts. These images leak API keys and other live credentials for cloud, CI/CD, and AI services, and even when secrets are removed from images, about three-quarters of the underlying keys remain valid, leaving organizations open to compromise.
Nontechnical employees can quickly build Copilot Studio agents that connect to sensitive systems, but these bots are easily tricked into ignoring security instructions, leaking customer data, and even modifying records such as trip costs. Tenable's experiment with a travel-booking bot shows how simple prompt injections expose credit card details and abuse edit permissions.
A group of current and former CISOs, security leaders, and practitioners has released an open letter urging the public, employers, journalists, and policymakers to stop spreading outdated security recommendations. Specifically, they cited: avoid public WiFi, never scan QR codes, never charge devices from public USB ports, turn off Bluetooth and NFC, regularly clear cookies, and regularly change passwords as outdated advice. Instead, they recommend focusing on reminding the public to keep critical devices and applications updated, enabling MFA, and using strong passphrases and password managers.
Sponsored
The 2025 GigaOm PTaaS Radar Report confirms traditional, periodic testing is no longer adequate protection. Read it for an expert
Microsoft has announced an expansion of its bug bounty program to include any Microsoft service and third-party service that impacts Microsoft and doesn't offer its own bug bounty program.
The UK's Information Commissioner's Office (ICO) fined LastPass £1.2M over failing to implement security measures that could have prevented the 2022 data breach.
Sponsored
SOC efficiency is the most valuable currency in cybersecurity [5] - but ESG research has found that 55% of security teams take hours just to confirm if an alert is real [6]. This gives attackers plenty of time to move laterally through your network.
A .NET Framework design flaw, dubbed SOAPwn, allows attackers to weaponize WSDL-based SOAP client proxies to write arbitrary files or redirect SOAP requests to attacker-controlled locations. This can enable NTLM credential capture and remote code execution via web shells or malicious scripts. Impacted enterprise products include Barracuda Service Center RMM and Ivanti EPM, which have begun shipping security fixes.
A Mirai variant named Broadside is actively compromising maritime logistics systems by exploiting a vulnerability in TBK digital video recorder (DVR) devices. Broadside uses a custom C2 protocol, a unique “Magic Header,” and aggressively kills competing malware. Beyond DDoS capabilities, it can harvest system credentials, posing an elevated risk to operational technology environments.
A phishing campaign uncovered by Kaspersky and Huntress is abusing Google ads to lure macOS users searching for troubleshooting tips. The ads lead to public ChatGPT and Grok “shared conversations” posing as legitimate guides, but instead push victims to download the AMOS infostealer.
Kaitai Struct enables describing binary file formats in a declarative YAML-based language and automatically generating parsers in many languages, which is very useful for reverse engineering, malware analysis, and protocol or firmware research. This example walks through designing a dummy KAISTDE binary format, manually serializing and parsing it in C and Python, then expressing the same structure in a .ksy spec so the Kaitai compiler can emit a robust parser and visualizations.
During re:Invent 2025, AWS announced Lambda Managed Instances, which enable Lambda functions to run on AWS-managed EC2 instances. AWS prevents users from attaching instance roles to these instances, unlike other managed instances. EKS-managed nodes do not allow direct instance access via tools like SSM or EC2 Instance Connect. The instances run AWS' container-optimized Linux distribution, Bottlerocket OS, and execute Lambda functions as containerd containers.
01flip is a new Rust-based ransomware family (tracked as CL-CRI-1036) that targets critical infrastructure in the Asia-Pacific region, leveraging Rust's cross-compilation capabilities to support both Windows and Linux platforms. Attackers exploited CVE-2019-11580 for initial access, deployed Sliver C2 framework for lateral movement, and used AES-128-CBC with RSA-2048 encryption while demanding one bitcoin ransom, with subsequent data leaks appearing on dark web forums. Organizations should monitor for Rust-based malware signatures, patch internet-facing applications against known vulnerabilities, and implement detection for cross-platform ransomware that uses low-level API calls and string obfuscation techniques to evade traditional security controls.
Sponsored
“Thought leaders” are confident about non-human identities, but can they predict what this landscape will look like in 12 months? Not reliably...
Equixly provides an AI-powered API security testing platform that continuously probes APIs like a virtual hacker to uncover technical and business-logic vulnerabilities across the SDLC, integrating into CI/CD pipelines to automate penetration testing and guide remediation.
SentryPeer is a fraud detection tool that tracks bad actors' attempted calls by saving their IP addresses and dialed numbers.
Fil-C is a memory-safe implementation of the C and C++ programming languages that can compile and run a lot of software with zero or minimal changes.
Ransomware attacks are hitting major Japanese companies and government bodies, forcing factories, retailers, and service providers offline for months. Many Japanese organizations depend on older systems and complex supply chains, so recovery is slow and costly.