Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Spektrum Labs delivers a cyber resilience platform that uses AI agents to continuously validate security posture and generate cryptographic proof of safeguards, enabling organizations to confidently demonstrate resilience to boards, customers, insurers, and regulators.
Trend Micro researchers identified a sophisticated "Premier Pass-as-a-Service" model where China-aligned APT groups Earth Estries and Earth Naga collaborate by sharing access to compromised networks, with Earth Estries acting as an access broker that hands off already-compromised systems to Earth Naga for continued exploitation. The attacks targeted government agencies and telecommunications providers across APAC, Southeast Asia, and NATO countries using multiple deployment vectors, including CrowDoor backdoors, ShadowPad malware, and Cobalt Strike beacons delivered through DLL side-loading and compromised credentials. This emerging collaboration pattern complicates attribution efforts and represents an evolution beyond traditional initial access brokers, as threat actors share access at later stages of the kill chain (command-and-control phase) rather than just initial entry points, requiring defenders to move beyond process chain analysis and monitor for suspicious file deployments and unauthorized remote administration tools.
Critical vulnerabilities across major LLM frameworks like SSRF, path traversal, SQL injection, RCE, server-side template injection, and DoS attacks arise from insufficient input validation, unsafe code execution features, and flawed integration with external resources. They stem from common implementation mistakes, including failing to validate URLs and paths in web crawlers, executing LLM-generated SQL without proper sanitization, failing to enforce import restrictions in code execution environments, and setting inadequate resource limits for streaming operations. Developers should avoid experimental/deprecated framework features, implement strict input validation using allowlists for URLs and paths, separate templates from user data, restrict LLM permissions to the minimum necessary levels, and apply multi-layered defenses.
A path traversal vulnerability in Docker Compose allowed attackers to write arbitrary files on host systems by crafting malicious OCI artifacts. The bug was triggered by seemingly harmless commands like 'docker compose ps', enabling attackers to escape the cache directory and gain SSH access by injecting public keys into authorized_keys files. Docker patched this high-severity flaw (CVSS 8.9) in version v2.40.2.
Sponsored
Attackers used stolen admin credentials to infiltrate a hospital network — aiming to deploy remote access tools, steal sensitive data, and unleash ransomware. See how ThreatLocker detected and
Security researchers have found a vulnerability in the WordPress plugin that allows authenticated users to access any server file due to missing capability checks, affecting over 100,000 servers.
Private equity firm Francisco Partners announced that it will be buying endpoint security software Jamf.
A security researcher found a denial of service flaw in Chromium's Blink engine caused by missing rate limiting on document.title updates, which was effective on nine out of eleven major browsers tested.
Sponsored
Every AI tool in your organization touches sensitive data—customer names, financial records, and more. One wrong move, and you could be facing a compliance nightmare. With Airia [4], you don't have to choose between innovation and governance.
RedTiger, an open-source Python-based infostealer repurposed by cybercriminals, targets Discord gamers (especially French-speaking users) to steal authentication tokens, payment information, browser credentials, cryptocurrency wallets, and webcam images while modifying Discord to maintain persistent access even after password changes. The malware evades detection by shutting down when it detects security tools, employs "mass file and process spamming" (creating 100 random files and launching 400 programs to hinder forensic analysis), and exfiltrates stolen data via GoFile with Discord webhook notifications to attackers. Security professionals should implement multi-factor authentication on Discord accounts, avoid downloading software from unverified sources, and recognize that legitimate security testing tools are increasingly weaponized for credential theft campaigns.
LG Uplus, one of South Korea's largest telecom operators, has reported a suspected data breach to Korea's national cybersecurity watchdog KISA, but did not say when the results of its investigation would be available. All three major Korean telcos have faced recent cyber incidents, raising concerns about the country's digital defenses.
Japanese advertising giant Dentsu has revealed that its subsidiary, Merkle, suffered a data breach that exposed sensitive information about clients, suppliers, and employees. The breach was detected following abnormal activity on Merkle's network, leading to some systems being shut down.
Researchers demonstrated that machine learning can significantly enhance acoustic side-channel attacks by analyzing keyboard typing sounds to reconstruct typed text with high accuracy, exploiting acoustic emanations from physical keystrokes captured via microphones or smartphones. The attacks leverage ML models trained on keystroke audio patterns to classify individual key presses, achieving reconstruction rates that pose realistic threats to password and sensitive data entry in shared or public spaces. Security professionals should educate users about acoustic eavesdropping risks in public environments, consider acoustic shielding for sensitive areas, and promote authentication methods less vulnerable to acoustic side-channels like biometrics or hardware tokens, rather than typed passwords.
An exploration of Almanax, Corgea, and ZeroPath Security's AI SAST capabilities. The post uses three steps in its evaluation: code retrieval and indexing, code scanning, and false positive detection, deduplication, and severity rating, along with some miscellaneous items like the ease of using the UIs. The author concludes that ZeroPath is the best out of the products tested, followed by Corgea and Almanax.
PromptLock is a proof-of-concept malware developed by NYU researchers to operate autonomously using an LLM hosted by the researchers. The author of this post wanted to experiment with building a post-exploitation tool that leverages the LLM included in Microsoft's Copilot+ PCs to create malware that's not dependent on a Command and Control (C2) Server. By providing the malware with tools to identify, modify, and restart vulnerable services, they were able to exploit two services using the LLM in a test environment.
Sponsored
At Persona, we've seen deepfake attacks surge 50x, yet 85% of CISOs say they lack GenAI-ready incident response plans. Workforce security is no longer about _if_ you'll be targeted, but whether you're prepared.
Cloudflare and Chrome are testing Merkle Tree Certificates (MTCs) to improve post-quantum signature performance, which are 20 times larger than current ECDSA signatures (ML-DSA-44 signatures are 2,420 bytes vs 64 bytes for ECDSA-P256). MTCs reduce TLS handshakes to one signature, one public key, and one Merkle inclusion proof by batching certificates into Merkle trees with signed tree heads sent out-of-band to clients, compared to today's five signatures and two public keys per handshake. The deployment will use "bootstrap certificates" from trusted CAs to validate MTCs via certificate transparency, starting early 2026 with some Cloudflare and Chrome users to assess performance and ossification issues.
SockTail is a compact binary that connects a device to a Tailscale network and provides a local SOCKS5 proxy on port 1080. It is designed for red team operations, enabling network access to a target system without the need for complex port forwarding, persistent daemons, or noisy tunnels.
CyberRidge has developed a plug-and-play photonic encryption system that transforms transmitted data into encrypted optical noise. This shields data from interception, quantum analysis, and “harvest now, decrypt later” attacks, aiming for post-quantum secure data transmission.
A Beelzebub LLM-powered SSH honeypot successfully detected a genuine threat actor who downloaded Perl backdoor scripts from a compromised Joomla site. The attacker attempted to establish IRC-based command-and-control (C&C) connections using "rootbox PerlBot v2.0" on Undernet channels #rootbox and #c0d3rs-TeaM. Their tactics, techniques, and procedures (TTPs) included downloading malware to /tmp, attempting to escalate privileges with sudo, and deploying botnet agents that connected to ix1.undernet.org:6667 for C&C operations. Security teams can utilize LLM honeypots to gather real-time threat intelligence and disrupt botnets by analyzing malware configurations and reporting C&C infrastructure to hosting providers.
Germany's cybersecurity agency warns that over 90% of Exchange servers in the country are using software that no longer receives support or updates. This leaves thousands of organizations, including hospitals and public institutions, vulnerable to critical security threats and ransomware. Microsoft offers extended updates for a limited time, but officials urge urgent upgrades or migration to avoid total network compromise.
Zimperium researchers discovered over 760 malicious Android apps exploiting NFC and Host Card Emulation features to relay payment card data in real-time to attackers via 70+ command-and-control servers and Telegram bots, with fake banking apps impersonating Google Pay, VTB Bank, and Santander across Russia, Poland, Brazil and other countries to enable fraudulent tap-to-pay transactions without physical card access, prompting recommendations to download apps only from Google Play Store and implement stronger NFC permission controls.
Sponsored
Security tends to look at threats trying to enter your network - but malicious outbound traffic can undo your entire security stack. READ
A 19-year-old California man faces federal charges for alleged involvement in the extremist "764" network, a Nihilistic Violent Extremist group focused on exploiting minors and collapsing social norms.
Canadian authorities report multiple opportunistic hacktivist breaches of internet-exposed Industrial Control Systems at critical infrastructure facilities.
Sponsored
Poorly-managed passwords are the #1 cause of breaches, and they leave IT teams struggling with fragmented access management and manual onboarding/offboarding processes. Reddit was dealing with all these challenges, plus a compromised security vendor. They needed a solution that reduced credential risk without slowing down their employees.
LayerX Security uncovered a flaw in OpenAI's ChatGPT Atlas browser that allows attackers to inject malicious commands, leading to remote code execution and persistent access. The exploit manipulates the browser's AI functions to process hidden malicious instructions, as Atlas provides 90% less phishing protection than Chrome or Edge. Security teams should restrict Atlas for sensitive accounts, monitor endpoints, and await OpenAI patches, treating AI browsers as higher risk with heightened security.
An extensive SMS phishing campaign, attributed to a Chinese-speaking group called Smishing Triad, has used over 194,000 domains since early 2024. The attackers impersonated services such as banks and delivery firms to steal personal data via urgent texts. Their tactics include cycling through disposable domains and running a phishing-as-a-service operation, making detection challenging for authorities worldwide.
Western Sydney University (WSU) reported its third security incident of the year, with an unauthorized user accessing data belonging to staff and students. The breached data includes tax file numbers, bank account details, passport and driver's license details, visa information, health and disability information, addresses, email addresses, phone numbers, names, dates of birth, ethnicities, and student and staff IDs. WSU stated that the breach was caused by a daisy chain of supply chain attacks culminating in a third-party student management system being breached.
Malware can easily detect VirtualBox environments through obvious indicators such as registry keys, file artifacts, MAC addresses, and VirtualBox-specific naming conventions, undermining VM-based malware analysis. Security researchers created vbox_stealth (Bash) and VBoxCloak (PowerShell) tools to mask VM indicators by renaming hardware identifiers, modifying registry entries, and removing VirtualBox-specific processes and files. While these tools improve VM stealth capabilities, sophisticated malware may still employ more subtle detection methods that remain difficult to circumvent.
When launching AWS ECS tasks on EC2 instances, each task, by default, has access to the Instance Metadata Service (IMDS), which can be used to access credentials of other tasks or to escalate privileges to the instance role. Using IMDSv2 with a hop limit of 1 is not effective for stopping this attack vector, as some networking modes can still access IMDS. The article includes details for blocking IMDS access in each networking mode.
Prompt injection is an increasingly critical security issue as AI-driven browsers gain agentic capabilities: they can now act on users' behalf, from opening web pages to handling emails and files. This opens up new attack vectors, such as direct injection via URLs or indirect injection hidden within website or document text, allowing attackers to trick bots into performing dangerous actions without user consent. While some countermeasures, such as reduced privileges and human oversight, can lower risks, experts believe prompt injection is unavoidable, not just a bug but a fundamental vulnerability whenever AI interprets untrusted data.
OSDFIR Infrastructure is a Kubernetes-based platform that uses Helm charts to simplify the deployment and integration of multiple open source digital forensics tools, including Timesketch, Yeti, OpenRelik, GRR, and others. The platform enables collaborative forensic investigations by providing a unified environment where tools can work together and share data through workflows and integrations. It streamlines the setup process for DFIR teams who want to deploy a comprehensive suite of forensic analysis tools in local or cloud Kubernetes clusters.
Sublime Security has developed an agentic email security platform that leverages AI agents to analyze messages in search of threats. The platform uses a distributed detection model that conducts intent and behavioral analysis, along with deep content inspection.
A lightweight, cryptography-powered, open-source toolkit built to enforce Zero Trust security for infrastructure, applications, and data in the AI-driven world.
The New York State Department of Financial Services announced new guidance regarding the use of third-party service providers. Third-party suppliers can cause supply chain attacks if attackers compromise them, and can be the weak link in an organization's security strategy. The new guidance does not impose new regulations or restrictions on regulated organizations.
Chinese threat actors exploited the ToolShell SharePoint vulnerability (CVE-2025-53770) just two days after Microsoft patched it in July, compromising a Middle East telecoms company and multiple government agencies by using the Zingdoor backdoor, the ShadowPad Trojan, and KrustyLoader malware. The attackers demonstrated rapid exploitation capabilities by mass-scanning for vulnerable systems, then deploying sophisticated toolsets, including DLL sideloading techniques, credential-dumping utilities, and the Sliver C2 framework for persistent access. Organizations should prioritize immediate patching of SharePoint servers and monitor for indicators, including the provided file hashes, with particular focus on DLL sideloading activities and connections to the identified AWS-hosted C2 infrastructure.
Ransomware groups are adapting as ransom payment rates hit historic lows at just 23% of ransom attacks. Attackers are increasingly using social engineering and insider bribes, like in Medusa's BBC attack, driven by shrinking profits and tougher defenses. Mid-market firms remain the most frequent victims, but larger enterprises face new, targeted extortion methods.
Sponsored
Malware monsters. Defender superheroes. Epic battles for your data. We're making cybersecurity as entertaining as your favorite Halloween movie. Real lessons, zero boredom. October 30th, 2-3pm CET. Don't miss
X will require users with hardware security keys or passkeys to re-enroll their 2FA devices by November 10, as it is moving from twitter.com to x.com.
Meta's latest smart glasses are pushing wearable surveillance into daily life, challenging both privacy laws and social norms.
Chrome 154 will enable "Always Use Secure Connections" by default in October 2026 to protect against MITM attacks.
Sponsored
AI code editors now generate weeks of code in hours. Traditional security crawls behind, creating backlogs that will never close.
Pentest-Tools researchers developed a working exploit for CVE-2025-54236 "SessionReaper," an unauthenticated vulnerability in Magento 2's ServiceInputProcessor that allows customer account takeover through session manipulation. The exploit leverages a Magento\Customer\Model\Session\Proxy object's setCustomerId function to inject arbitrary customer IDs into PHP sessions, enabling attackers to impersonate any customer by crafting malicious session cookies. Organizations should patch immediately and monitor for unauthorized attempts to manipulate sessions targeting Magento installations.
A security researcher reported an unencrypted and non-password-protected database containing PII of over 7,000 applicants to the research firm Safety Detectives. The data includes names, phone numbers, email addresses, and security clearance status or level. 469 records listed individuals with “top secret” federal security clearance, which could expose those individuals to phishing risks.