Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
tturl is an HTTP/2 CLI for finding tiny timing differences by releasing batches of requests and recording response arrival order, then either showing what happened or helping to distinguish a repeatable arrival-order signal from noise.
Proton Mail's web interface can show a forged sender that looks identical to a real one. The attacker sets a display name containing an address-shaped string like sundar@gmaiI[.]com where the capital I matches lowercase l in the default UI font. Messages from domains without DMARC arrive in the inbox with no authentication banner, even when SPF fails. A Reply-To header can route responses to an attacker's address without showing it unless the user expands headers, and the spoofed sender also appears unchanged in macOS desktop notifications, outside the app interface. The issue was reported in February 2025, confirmed and bounty-awarded in April 2025, and can still be reproduced as of September 2026.
Google and Wiz launched Scan for Good using Gemini 3.8 Flash Cyber and Red Agent with authorized scans targeting public websites, APIs, and applications, while human researchers validate findings and handle disclosure. Red Agent found a GitHub Actions injection flaw in Snowflake's connector, allowing command execution. Other cases exposed 8.8 million files, hospital systems, elderly residents' data, and railway administrator sessions.
This walkthrough breaks down House of Apple 2, a glibc FSOP technique that bypasses the vtable validation added in newer glibc. It points a FILE structure's vtable to legitimate wide-character stream code, which then dispatches to a second vtable that glibc does not range-check. Step by step in GDB, the author turns that unchecked indirect call into an arbitrary call, pivots the stack, and runs a ROP chain to a shell. The technique still works cleanly on glibc 2.43 (Ubuntu 26.04 and Fedora 44). Exact offsets and gadgets vary between builds, but the underlying control-flow trick remains the same.
The District of Columbia's health agency exposed data linked to 399,086 Medicaid and DC Healthcare Alliance beneficiaries.
Former Army soldier Cameron Wagenius received 70 months in prison and nearly $295,000 in restitution.
Sponsored
Scaling deployments means more east-west traffic between pods and services — harder to inspect, easier to exploit. Static firewall rules and manual certificate management can't keep up. Palo Alto Networks VM-Series Next Generation Firewall [4] on AWS can help: * Automate TLS certificate lifecycle: AWS Certificate Manager Private CA handles rotation in Amazon EKS * Adapt policies dynamically: Respond to AWS tags and metadata as your environment changes * Block threats inline: AI/ML-powered inspection in real time without deployment latency Access technical tutorials [5] and start your free trial [4] in AWS Marketplace.
On September 24, attackers stole $387.5 million from Bitget's hot and warm wallets by feeding false transaction data into a compromised backend system, which then authorized the transfers. Bitget detected unauthorized activity at 18:31 UTC, paused withdrawals hours later, and ruled out private-key theft. Mandiant and SlowMist are investigating. CEO Gracy Chen has flagged possible North Korean involvement.
Zenity identified three Salesforce Agentforce weaknesses. Attackers could inject commands via Web-to-lead forms and bypass URL filters. If connected to Slack, they could post phishing links in internal threads. The lack of confirmation and attribution controls made messages appear to come from employees or IT. Salesforce added confirmation prompts, spec-compliant URL parsing, and centralized URL inspection.
Cloudflare remediated a cross-tenant flaw in Containers and Sandboxes that allowed a Workers Paid customer to read residual disk blocks left by other tenants on the same host. The flaw stemmed from dm-thin storage pools running with skip_block_zeroing, so a 4 KiB write into a reused 64 KiB block left the untouched 60 KiB readable via a raw read of /dev/vdc. Accomplish's Oren Yomtov, who reported it through HackerOne on September 4, recovered directory structures, database pages, and complete SQLite databases on 18 of 24 placements across 20 of 22 nodes, though an attacker could not target a specific victim or read an actively attached disk. Cloudflare removed skip_block_zeroing fleet-wide, retired running container disks, and cleared cached image snapshots by September 19. Its disk-I/O telemetry review found no exploitation beyond authorized validation, so no customer action is required.
Zero Salarium details a remote process injection technique that skips the heavily monitored VirtualAllocEx and WriteProcessMemory pair, instead spawning an interactive console child (nslookup.exe or netsh.exe) and writing shellcode into its memory via WriteFile on the child's hStdInput pipe, then using VirtualProtectEx to add execute permissions and a thread hijack to point RIP at the payload. A distinctive marker locates the planted bytes, and the payload must avoid 0x0D, 0x0A, and 0x1A, which the console would treat as command input. Since the classic API pair is absent, defenders should watch for VirtualProtectEx against remote processes, read/write activity on named pipes, and the console's command-storage memory region.
Galileo has demonstrated its first real-world civil position fix using the upcoming Signal Authentication Service, holding a stable lock across five satellites during live spoofing at the Jammertest event in Andøya, Norway on September 16. SAS encrypts the E6-C ranging signal's spreading codes and publishes the decryption key on a delayed, separate channel, letting a receiver correlate the recorded signal only after the fact to confirm each satellite's pseudorange. It pairs with the already-operational OSNMA, which authenticates the navigation message itself. Both services will be free and worldwide, extend to the High Accuracy Service, and let receivers detect and reject a broad range of spoofing attacks. However, EUSPA still must run SAS validation and accreditation before declaring the service operational, and the delayed-key design leaves jamming and meaconing as open concerns.
OAuth token abuse gives attackers application-level access that survives password resets and MFA, since tokens belong to the app rather than the user, and can be obtained through consent phishing, device code phishing, credential additions to existing apps, or preconsented first-party applications. Because malicious apps live in the attacker's tenant, defenders should watch victim-tenant Entra ID events (Add service principal, Consent to application, Add delegated permission grant, and app role assignments) alongside anomalous post-consent activity, with behavioral app-to-purpose checks coming from Defender for Cloud Apps rather than native audit logs. The highest-value controls are preventive: restrict user consent to verified low-impact apps, require admin approval for high-risk scopes like Mail.Read and offline_access, and keep an approved application inventory, since eviction requires removing the grant and service principal rather than resetting credentials.
Sponsored
See how cloud AI and agentic systems introduce new risks across identity, data, and workflows. This on-demand demo explores IAM and access controls, sensitive-data protection, and modern detection strategies to help strengthen governance across the AI lifecycle.
RCEKit is an RCE detection and confirmation toolkit for authorized penetration testing, red teaming, and security research. Point it at a target you are authorized to test — a URL or a captured HTTP request — and every finding returns with the tier it earned.
ADE Skills, from Koifsec and Nikolas Bielski, is a knowledge base for adversarial detection engineering: the study of the gap between what a detection rule is intended to catch and what it literally matches. It organizes detection-logic bugs into a taxonomy of four categories (reformatting in actions, omitted equivalents like pwsh.exe vs powershell.exe, context development, and inverted or missing-field logic) across fifteen subcategories and thirty-seven worked technique files, each pairing a vulnerable rule with a hardened one. It also ships platform bug-pattern catalogs for Elastic, Sentinel, and Sigma, a false-negative checklist, a machine-mined catalog of ~593 candidate bypass findings across public rulesets, and Redamon, a purple-team scoping skill that maps in-scope techniques to a target's actual SIEM/EDR rules.
Mecatl is an open-source, cloud-native agent harness. Mecatl keeps the agent loop independent of the client and execution environment, so the same runtime can start locally, run remotely with durable external state and a recorded event history, and then scale across Kubernetes replicas without replacing the loop.
UpGuard found around 16,000 publicly accessible Supabase-hosted databases leaking names, addresses, phone numbers, and some passwords or tokens. Exposed data included private chats with sex workers on an Indian adult site, thousands of US valet license plates, immigration-service contacts, an African consulate's records in France, and a virtual SIM farm used to intercept OTP texts for scams. Most datasets were in the US, but the issue spans multiple regions. Supabase says projects are secure by default and blames misconfiguration on customers.
Researchers demonstrated a classical-computing attack that forges RSA signatures without factoring the private key. Using a "special" number field sieve against blind-signature (textbook) RSA, they reduced security from an estimated 2^80 operations and 500,000–1,000,000 CPU core-years for 1024-bit keys to about 2^65 operations and 1,380 core-years. The method applies only to blind-signature implementations like Privacy Pass (used by Apple and Cloudflare), not standard PKCS or PSS-padded RSA. Forging a Privacy Pass signature would require compromising a server and generating 2^43 signatures, a workload comparable to a day of Cloudflare's public traffic.
A financially motivated operator ran three open-source AI harnesses (Strix, Cairn, and Hermes) against hundreds of online retailers from July to mid-September, spending roughly $12,000–$18,000 on AI model calls. The campaign exfiltrated over 600,000 unexpired credit card records from two victims, injected skimmers into at least 27 sites, and achieved access to assets of a Fortune 500 hospitality firm, a major US airline, and other large retailers. In several breaches, the agent executed a "database wipe after extraction" routine that deleted payment data and, in one case, dropped 180 tables including backups.
Kiteworks advised customers to shut down systems for nine hours after receiving threat intelligence about a possible attack.
OpenAI's research agents uploaded 53 training-eligible user images to third-party image hosts as unlisted links, most of which have since been removed as OpenAI's post-Hugging Face review of agent activity continues.
OpenAI agents scanned UNCTAD's statistics site over 16,000 times between April and June while trying to pull Productive Capacities Index data, escalating from bypassing their HTTP-tool limits to masking their behavior against an imagined filter and hijacking Google's XSS training game to reach the data.
Sponsored
Everyone can ship fast. The challenge is shipping reliably, securely, and autonomously, with minimal human involvement or none at all. Join Dr. Ariel Shiftan, Co-Founder & CTO of Autonomous Security [5], for an inside look at the architecture behind their autonomous software factory: * How AI agents move from tasks to end-to-end delivery * The risks of long-running AI workflows, and how to keep them
* The KPIs and trade-offs that matter when AI, not humans, drives development See how they built it, what they learned, and how it changed the way they develop software.
Graphalgo malware appeared in two Terraform providers and two Go modules. Trigger conditions hide execution until targeted inputs appear, and the payload reports host data through Slack, receives encrypted commands through Slack and an Arbitrum Sepolia contract, then runs Go or Node code. Aikido recommends removing affected packages, isolating exposed hosts, rotating credentials, reviewing deployments, and reimaging machines.
GitLab incoming email addresses embed non-expiring tokens that act as the owner across accessible projects. A leaked address can create merge requests, submit patches, or push code to private projects after changing project identifiers, and can be used to bypass IP restrictions via email. Aikido recommended that organizations reduce their attack surfaces by preemptively rotating the access tokens in their GitLab email addresses and by scanning for these addresses in their development environments and repositories as if they were any other secrets.
Someone registered third-party[.]com, a non-IANA-reserved placeholder cited in 1,700+ GitHub repos, including AI agent skills and MCP docs, and it now serves a ClickFix PowerShell lure only to Windows visitors, while yoursite[.]com and your-domain[.]com push scams to macOS users that static scans miss.
A bug bounty hunter built PhantomRaven, an LLM-generated JS info-stealer, and pushed it through typosquatted npm packages that used HTTP-URL dependencies to fetch payloads on install. It grabs OS/hostname/IP data, Git/npm credentials, and CI/CD env vars from GitHub Actions, GitLab CI, Jenkins, and CircleCI, then sends data via HTTP GET/POST. The operator used compromises to file bug bounty claims on HackerOne, Bugcrowd, Intigriti, YesWeHack, and HackenProof rather than selling logs. Npm 12+ now blocks preinstall scripts by default. Use --ignore-scripts and a private registry to block this vector.
At DEFCON 34, Intigriti researchers reported on various ways to abuse AI customer service agents. This article walks through different methods to abuse the agents to send phishing emails, invoke tool calls, and bypass MFA. It also demonstrates mechanisms to steal third-party OTPs and poison knowledge base articles to deceive victims.
CARBONATO worms through unauthenticated Docker daemons on port 2375 via privileged, host-mounted containers, then installs the stock open-source Hermes Agent and overwrites its SOUL.md persona so that Telegram-tasked LLM sessions run post-exploitation and loot AI API keys before SSH credentials. ThreatDown recovered the toolkit from the crew's own open registry, which doubles as the fleet's update server, and ties the operators to Costa Rica through voseo Spanish, UTC-6 build timestamps, and a +506 Telegram handle. Keep the Docker API off the network, hunt for a SOUL.md containing "GH0ST" rather than blocklisting the legitimate hermes-agent package, and inventory and rotate AI API keys like bank credentials.
Sponsored
ThreatSpike tried TLDR after Google and LinkedIn ads fell short. Its campaigns now generate $25K–$75K in new business pipeline each. If your company markets a cybersecurity product, share this case study with your marketing team [14].
Island runs an enterprise browser and SASE platform combining ZTNA, device posture checks, and inline DLP to block unapproved clipboard, download, and screen-capture actions.
ceasta is a single C++ tool that combines an IDA-style disassembler, a pseudocode decompiler, a function graph, and an x64dbg-style debugger for PE, ELF, and raw shellcode, with a full GUI on Windows and a CLI with a ptrace debugger on Linux. Its built-in MCP server (ceasta-cli mcp target.exe) lets Claude Code or Cursor decompile, rename, and diff builds. With --allow-debug, it can also set breakpoints and call functions in the running process. The decompiler is best-effort, with no types or structs yet.
Pixi Audit, now in beta, scans Pixi lock files for vulnerable conda-forge and PyPI packages, and --fix bumps direct dependencies to the lowest compatible fixed version before re-running pixi update. Matching relies on Basilisk, prefix.dev's new conda-forge vulnerability database, which links repackaged conda-forge builds to their upstream PURL and CPE identities so existing OSV and NVD advisories apply. For CI, --severity high sets the failure threshold, with JSON and SARIF output, though it doesn't cover statically linked binaries yet.
An OpenAI agent gained unauthorized access to a Medicare statistics portal in June. It accessed public and non-public files, including aggregate health data and internal filenames. Australia was notified on September 10 through a generic disclosure mailbox. Officials later said agents also targeted two state-government sites.
Elsevier.com, Evolve.elsevier.com, and Submit.elsevier.com redirected visitors to a LAPSUS$ “Chapter II” page for at least 78 minutes on September 21. Researchers suspect a DNS, CDN redirect rule, or management account change. Elsevier restored service and said its investigation found no compromise of core platforms, customer data, research content, or operational systems.
Mandiant published a five-pillar blueprint (endpoint, repositories, artifacts, CI/CD, and deployment) for hardening the SDLC, prompted by campaigns that poison GitHub Actions caches, extract OIDC tokens, and repoint mutable action tags to publish malicious packages that still carry valid provenance. Standout recommendations include a seven-day cooldown before new public package versions become installable, pinning images and actions to digests and commit hashes, ephemeral runners with egress limited to approved registries, and replacing PATs with GitHub Apps and hardware-backed SSH keys. It also addresses AI coding agents, advising teams to keep .env files out of model context and require human review of AI-generated code.
Attackers spoofed Astrana Health's main phone number and impersonated staff to access company servers.
Canonical is replacing Ubuntu's 4-week regular and 2-week security kernel SRU cycles with overlapping 2-week cycles that ship a kernel every week.
CISA has flagged CVE-2026-63077, an unauthenticated RCE in JetBrains TeamCity On-Premises reachable through the agent polling protocol, as exploited in ransomware attacks.
Sponsored
You want to run securely, not translate vendor-specific schemas into usable formats, hunt down the IT and business context you need, or pay by the byte for the privilege. Security doesn't thrive in a SIEM silo. You need an open platform where you can use all your telemetry and enterprise context to tell real threats from false positives. Lakewatch is an open, agentic SIEM built on the Databricks security lakehouse, so you can correlate 100% of your telemetry on one governed platform where agents handle triage, investigation and detection authoring at machine speed.
Download the eBook: The Security Lakehouse — Outpacing AI Zero-Days
Bifrost, an open-source AI gateway for 20+ LLM providers, ships with management auth disabled by default, so a single unauthenticated POST to /api/mcp/client can register a stdio MCP client and run arbitrary commands as the gateway user (CVE-2026-90898, CVSS 9.8). That exposes every stored provider API key. The official Docker image binds the management API to 0.0.0.0, and v2.0.0 only fixed a related plugin-loading flaw (CVE-2026-86242, CVSS 8.1). Upgrade to transports/v2.1.0 or set governance.auth_config.is_enabled to true, and treat any exposed unauthenticated instance as compromised by rotating virtual and provider API keys.
Attackers used compromised Ribon API credentials from a Fastr system breach to access BigCommerce merchant customer data from September 13 to 17. Exposed records included names, email addresses, phone numbers, and postal addresses. BigCommerce revoked the credentials, uninstalled affected Ribon apps, and notified merchants.
GitGuardian tested 4,802 leaked GitHub App private keys and found 474 that were still authenticated as 440 apps. Forty-four apps held organization-admin permissions. 207 could write repository content, and with the keys having no expiry, the leaked PEM files can remain usable for years. Cases included an Actions token app installed across roughly 300 organizations, BuildBuddy's internal app, Crusher.dev, and a CDC-related app.