A “two-face” binary is a binary that contains a malicious program designed to run on a target host and a benign binary that executes on any other host. To ensure that the malicious program runs only on the target host, it is encrypted with a key derived from the target's disk partition UUIDs. The author of this article developed a twoface Rust binary to implement this process, which also includes defenses to prevent detection of the decrypted binary.
AWS WAF provides an Anti-DDOS managed rule group to detect and mitigate HTTP DDOS events. By default, the rule group uses a JavaScript challenge for all GET requests with low or medium suspicion and blocks all GET requests with high suspicion of contributing to DDoS attacks. This post provides ways to customize the rule group for scenarios where clients don't support the JavaScript challenge, clients can't use the WAF client integration, non-challengeable requests overwhelm resources, and when challengeable requests overwhelm resources before they're blocked.
The NVIDIA AI Red Team has observed three common vulnerabilities in the implementation of AI systems. The first vulnerability involves directly executing LLM-generated code, which could lead to remote code execution in the case of direct or indirect prompt injection. The second vulnerability is related to insufficient access controls in RAG data sources, which could allow a user to read data they are not privileged to read or write data to the data store. The third vulnerability is related to active content rendering of LLM outputs, which could lead to information leakage via images or other network requests.
40% of IT teams still mistrust AI-generated outcomes. In this on-demand Tines webinar [11], 7x CIO Mark Settle, ASOS CISO Indu Sajeev, and Genesys CIO Trevor Schulze explore how orchestration can bridge governance gaps and boost employee confidence - opening the
Win11Debloat is a PowerShell script that removes preinstalled apps, disables telemetry, and performs various other changes to customize, declutter, and improve the Windows 11 user experience.
Sweet Security offers AI-powered security solutions for real-time threat detection and response across cloud and AI environments. The platform uncovers shadow AI, misconfigurations, risky access, and prevents prompt injection and abnormal model behavior.
Shannon is an AI pentester whose goal is to break your web app before someone else does. It autonomously hunts for attack vectors in your code, then uses its built-in browser to execute real exploits, such as injection attacks and auth bypass, to prove the vulnerability is actually exploitable.
Mozilla has announced that, beginning in the recently released Firefox 145, further fingerprinting blocking will be implemented, dropping the percentage of user trackability to 20%. The specific enhancements block requests to discover installed fonts, hardware details, number of processor cores, multi-touch support, and dock/taskbar dimensions. The enhancements will initially be rolled out for users in Private Browsing who set their Enhanced Tracking Protection to Strict.
Synnovis has completed an exhaustive 18-month investigation into a crippling ransomware attack in June 2024 that affected nearly a million NHS patients, severely disrupted London pathology services and leading to a patient's death. The probe struggled with fragmented data. While no ransom was paid and systems were replaced, many patients must still wait for official notification if their data was compromised.
Google filed a lawsuit in the Southern District of New York against 25 individuals connected to Lighthouse, a Chinese phishing-as-a-service toolkit that has compromised over 1 million victims across 120 countries by spoofing USPS, toll road operators, e-commerce sites, and financial institutions via SMS. The operation captures payment card data through fake mobile sites and then exploits the legitimate Apple Pay and Google Pay enrollment processes by tricking victims into providing one-time authentication codes, enabling attackers to load stolen cards onto mobile wallets they control. Security teams should monitor SMS gateways for brand impersonation, educate users to verify unexpected payment requests through official channels, and watch for unusual mobile wallet enrollment patterns that could indicate credential theft.
Elon Musk's X platform disrupted user access by mishandling a switch from twitter.com to x.com for two-factor authentication using security or passkeys, with many users becoming locked out, caught in error loops, and unable to re-enroll.
Google awarded $458,000 in bounty rewards at the ESCAL8 bugSWAT event after 38 top security researchers reported 107 vulnerabilities across AI, Android, and Google Cloud.
SAP patched 19 vulnerabilities in November, including CVE-2025-42890 (CVSS 10/10), a critical hardcoded credentials flaw in SQL Anywhere Monitor (Non-GUI) that enabled arbitrary code execution with complete system compromise. Additional critical fixes include CVE-2025-42887 (CVSS 9.9) in SAP Solution Manager, which addresses code injection via missing input sanitization, and an update to CVE-2025-42944 that addresses insecure deserialization in SAP NetWeaver AS Java. Organizations should immediately discontinue SQL Anywhere Monitor usage, delete all monitor database instances, and apply patches across affected SAP products. No evidence of active exploitation has been reported.
Amazon's threat intelligence team discovered an APT exploiting zero-day vulnerabilities CVE-2025-20337 in Cisco Identity Service Engine (pre-authentication RCE via deserialization) and CVE-2025-5777 in Citrix systems. The attacks were detected via MadPot honeypots before public disclosure. The threat actor deployed a custom Java web shell named IdentityAuditAction, which features in-memory operation, Java reflection for thread injection, DES encryption with non-standard Base64 encoding, and HTTP header-based authentication requiring specific knowledge to access. Organizations should immediately patch affected Cisco ISE and Citrix NetScaler systems, implement firewall restrictions on management portal access, deploy defense-in-depth strategies for identity infrastructure, and monitor for anomalous behavior patterns in authentication systems even when properly configured.
Synology has fixed a critical vulnerability in its BeeStation OS, which powers Synology NAS devices, discovered by researchers at Pwn2Own Ireland. A buffer overflow causes the vulnerability and can result in remote code execution.
A showcase on how to exploit a modern ARM-based IoT device, specifically a network camera, by bypassing Address Space Layout Randomization (ASLR) to achieve unauthenticated remote code execution (RCE) using a Return-Oriented Programming (ROP) chain. This approach cleverly bypasses ASLR, a memory protection mechanism designed to block exploit attempts, allowing remote code execution without requiring the leakage of addresses. By manipulating writable memory and leveraging known offsets, the attacker can execute commands on the device, illustrating how gaps in embedded device security can be exploited even with mitigations in place.
Active Directory remains the authentication backbone for 90% of Fortune 1000 companies, with attackers exploiting golden ticket attacks, DCSync privilege escalation, Kerberoasting, and compromised credentials (involved in 88% of breaches per Verizon DBIR) to gain network-wide control, as demonstrated by the 2024 Change Healthcare breach, where MFA absence enabled full AD compromise. Critical vulnerabilities include weak passwords, service accounts with excessive permissions and non-expiring credentials, cached admin credentials in memory, legacy NTLM protocol exploitation, and hybrid environment complexity, creating visibility gaps between on-premises and cloud security teams. Implement layered defenses, including continuous credential monitoring against breach databases (blocking 4B+ compromised passwords), privileged access management with just-in-time elevation, zero-trust conditional access with MFA for all privileged accounts, continuous AD change monitoring for suspicious patterns, and aggressive patching of domain controllers within days of security updates.
Many people feel intimidated by the number of potential scenarios and never perform threat modeling. Instead, many of the insights of a threat modeling exercise can be garnered by considering only a worst case scenario and a likely but impactful scenario. Security teams should devise detailed story-driven scenarios for these exercises and then proceed in either an informal or formal threat modeling exercise.
Tenzai is an AI-driven penetration testing platform that continuously identifies and addresses software vulnerabilities, aiming to automate manual and infrequent pentesting.
Private AI Compute is a Google platform that enhances AI privacy by combining the power of advanced Gemini cloud models with on-device security standards. This approach ensures users' data is kept private while unlocking fast, intelligent features like smarter suggestions. The system uses encrypted, hardware-secured spaces and multi-layered safeguards, allowing advanced AI without compromising personal data privacy.
Australia's intelligence chief warns that authoritarian states are increasingly willing and able to sabotage critical infrastructure via cyber-attacks. He cites Chinese hacker groups probing Australian networks, and highlights a shift from espionage to disruptive actions that could cripple essential services.
AWS Backup now allows for creating fully managed backups of EKS clusters. It supports scheduled backups, data retention, immutable vaults, and cross-region and cross-account copies for application data and cluster state.
Microsoft's November 2025 Patch Tuesday addressed 63 vulnerabilities, including CVE-2025-62215, an actively exploited Windows Kernel race condition enabling local privilege escalation to SYSTEM, and CVE-2025-62199, a use-after-free RCE in Microsoft Office.
A typosquatted npm package named "@acitons/artifact," with 260K downloads, targeted GitHub Actions CI/CD pipelines through a post-install hook that ran obfuscated shell scripts to steal tokens and impersonate GitHub by publishing malicious artifacts.
Attackers sent 40,000 phishing emails to 5,000 Facebook Business users by exploiting Meta's invitation feature to send credential-harvesting links from @facebookmail.com, targeting SMBs in various sectors with fake invites that redirected to phishing pages which mimicked Meta branding.
The Quantum Route Redirect phishing-as-a-service platform leverages ~1,000 pre-configured domains with automated bot filtering to steal Microsoft 365 credentials across 90 countries (76% US-targeted), using specific URL patterns matching "/([\w\d-]+.){2}[\w]{,3}/quantum.php/" and hosting on legitimate compromised domains to evade detection. The platform redirects humans to credential-harvesting pages while sending security scanning tools to benign sites. Security teams should implement URL filtering that targets the identified pattern, deploy account compromise monitoring, and recognize phishing lures that mimic DocuSign, payment notifications, and QR codes. Quantum Route Redirect represents an evolution in PhaaS sophistication similar to VoidProxy and Tycoon2FA campaigns.
GlobalLogic, owned by Hitachi, suffered a significant data breach that exposed the personal and financial data of over 10,000 current and former staff members. The attack, attributed to the Clop ransomware group, exploited vulnerabilities in the Oracle E-Business Suite. Clop focuses on stealing and leaking data while pressuring victims for payment. Oracle has issued emergency patches to counter these attacks.
Researchers from Mandiant discovered a critical zero-day in Gladinet's Triofox file-sharing platform. The vulnerability allowed unauthenticated attackers to login to the platform by changing the HTTP host header to localhost. The attackers then configured the anti-virus scanner path to a malicious batch script.
The GlassWorm self-propagating worm resurfaced two weeks after eradication, infecting three new OpenVSX VS Code extensions (with over 10,000 downloads) and GitHub repositories using invisible Unicode characters and a blockchain-based C2 infrastructure, with victims including global enterprises and Middle Eastern government entities. The Russia-based attack steals GitHub credentials, pushes malicious AI-generated commits appearing as legitimate code changes, and exploits OpenVSX's lack of manual code review resources. Security teams should whitelist only trusted extension publishers, disable auto-updates, monitor for credential harvesting and abnormal outbound connections, and treat developer toolchains with the same security rigor as production infrastructure, as automated scanning alone cannot reliably stop these supply chain attacks.
DNS rebinding attacks occur when an attacker can trick a victim into leaking data by having the victim first communicate with the attacker's public server and then switching the DNS record to point to a private server. In Safari, a private IP address will be prioritized over a public IP address, but an attacker can circumvent this by delaying the DNS response with the private IP address. In Chrome, IPv6 will be prioritized over IPv4, allowing an attacker to send an IPv6 response with a public IP address and then an IPv4 response with a private IP address. In both cases, the attacker blocks the user from their server after connection, forcing the browser to rebind to the private IP.
Mandiant has uncovered a significant security flaw in the Triofox file-sharing platform (tracked as CVE-2025-12480), which allows attackers to bypass authentication by manipulating the Host header to impersonate “localhost.” This gave unauthorized access to critical admin configuration pages, enabling the creation of privileged accounts. Attackers can exploit this to upload and execute arbitrary files, abusing Triofox's anti-virus feature to run malicious scripts with high privileges. The vulnerability is now patched, but organizations using Triofox should urgently update, check for rogue admin accounts, audit anti-virus configuration, and monitor for unusual administrator and SSH activity.
Security shouldn't just be for mega-corporations with the budgets to match. 💸 ALL businesses deserve that level of protection—and that's what Huntress [12] provides. Fully owned and managed tech and 24/7 expert team to protect your endpoints, identities, data, people,
Flare provides a threat exposure management platform that uses intelligence from the clear and dark web to help organizations prevent ransomware, data breaches, and other incidents, leveraging AI and machine learning for tailored cybersecurity insights and credential exposure detection.
The EU's leaked "Digital Omnibus" proposal would shift cookie tracking from opt-in to opt-out by moving regulation from ePrivacy Directive to GDPR, explicitly permit AI training on personal data under "legitimate interest" without consent, and narrow sensitive data protections to only data that directly reveals protected characteristics. Companies would no longer need consent management for most cookies, but must document legitimate interest justifications, while privacy advocates warn this fundamentally weakens GDPR's core protections. Security professionals should prepare for the November 19 formal unveiling by reviewing data processing practices, documenting AI training justifications, and reassessing compliance frameworks for the shift from explicit consent to legitimate interest models.
North Korean APT37/KONNI actors are targeting South Koreans via KakaoTalk spear-phishing with digitally-signed MSI files that deploy AutoIT scripts which establish persistence, deliver RemcosRAT/QuasarRAT/RftRAT, and steal Google/Naver credentials to access Find Hub for GPS tracking and remote Android device wiping. The attackers are exploiting stolen credentials to execute factory resets three times, preventing recovery, use GPS data to time attacks when victims are outside, then hijack compromised KakaoTalk PC sessions to spread malware laterally through contacts. Organizations should enforce MFA on Google accounts, verify messenger file senders via direct calls before opening attachments, and maintain accessible recovery accounts. This attack abuses legitimate Find Hub features rather than exploiting vulnerabilities.
Security researchers have uncovered critical vulnerabilities in Ollama and NVIDIA Triton Inference Server that could allow for remote code execution, exposing companies to significant risks in their AI infrastructure. These flaws, now fixed, reflect a shift in AI security research from attacking models to probing the underlying infrastructure.