QNAP issued a warning to customers to patch a critical ASP.NET Core vulnerability that affects the company's NetBak PC Agent software for backing up data to a QNAP NAS (Network Attached Storage). This vulnerability could allow an authenticated attacker to gain unauthorized access to sensitive data, modify server files, or perform a denial-of-service on the device. QNAP recommends that users either reinstall the NetBak PC Agent or manually update the ASP.NET Core install on their PCs.
This deep dive explains the Linux boot sequence from CPU reset through various modes, including firmware handoffs, bootloader operations, kernel decompression, and memory setup with paging. It covers mode transitions, interrupt handling, GDT and IDT configuration, and kASLR, which randomizes kernel memory locations to prevent exploits. kASLR enhances security by randomizing kernel addresses, but can be disabled with nokaslr for debugging.
CryptoChameleon cybercriminal group targets LastPass users with phishing emails claiming "Legacy Request Opened (URGENT IF YOU ARE NOT DECEASED)" that trick victims into entering master passwords on fake sites by exploiting legacy access scenarios when family members request deceased users' accounts. The campaign uses domain spoofing, fabricated support case details, and phone calls to direct victims to attacker-controlled URLs designed to harvest credentials for cryptocurrency theft. Organizations should implement phishing-resistant MFA for password managers, educate employees about this specific "Legacy Request" subject line, and establish policies requiring additional authentication factors beyond master passwords for account access.
AI-powered coding, often called "vibecoding," claims to enable fast and seemingly secure development of features like two-factor authentication (2FA). However, this method often only creates the illusion of security, missing essential protections such as rate limiting and strong account lockout mechanisms. Attackers can easily bypass superficial safeguards, especially if limits depend on factors like IP addresses. Large language models (LLMs) tend to generate code that appears convincing, but without clear guidance, critical security measures are frequently overlooked or implemented incorrectly.
grounds identity in real-time employee data instead - enabling automatic updates without manual provisioning or custom scripts. See how it works in tomorrow's webinar [11]. Stay until the end for a chance to win a $500 gift card!
PDF Object Hash is a method for identifying similarities between PDFs based on their structure rather than content, akin to imphash or ja3 hashes. It involves extracting object types and hashing them to cluster similar documents and detect overlaps. Recent updates to the parsing scripts improve accuracy, especially for irregular or corrupted PDFs.
SpiderFoot is an open source intelligence (OSINT) automation tool. It integrates with just about every data source available and utilises a range of methods for data analysis, making that data easy to navigate.
Irregular builds AI security labs to test the cybersecurity of advanced models like ChatGPT and Claude. It develops tools, testing methods, and scoring frameworks, collaborating with top AI companies to ensure the secure and responsible deployment of AI.
Kaspersky uncovered Operation ForumTroll, a sophisticated espionage campaign using personalized phishing emails that exploit CVE-2025-2783, a Chrome sandbox escape vulnerability affecting Windows Inter-Process Communication (IPC) pseudo handles. The operation deployed "Dante" spyware by Memento Labs, targeting Russian entities through zero-day exploits and evasion techniques such as WebGPU validation and COM hijacking. Security teams should monitor for Base64 folders in %LocalAppData%, enhance email filtering for personalized phishing, and update Chrome to version 134.0.6998.177/178 or later to mitigate the sandbox vulnerability.
A comprehensive student database from Ravin Academy, a US Treasury-designated MOIS front organization used to recruit cyber operatives, has been leaked just days before its annual Tech Olympics event in Tehran. The exposed records contain complete personal information of trainees enrolled in what appears to be legitimate cybersecurity education, but serves as a talent pipeline for Iranian state-sponsored cyber operations against foreign governments and domestic dissidents. Organizations should monitor for individuals with Ravin Academy connections and note that the operational security failure demonstrates vulnerabilities in Iranian intelligence recruitment infrastructure.
LinkedIn will soon collect public profile data from users in the EU, UK, Canada, Switzerland, the EEA, and Hong Kong to train AI models and share it with Microsoft affiliates for ad targeting. Users in these regions have until October 27 to opt out, or their details—including posts and activity—will be included, except for private messages.
While most organizations focus on blocking USB devices, attackers and insiders can just as easily steal data through network shares, cloud storage, or even local folder access. You need visibility and control over ALL storage access points.
Microsoft issued urgent out-of-band patches to fully address CVE-2025-59287, a critical vulnerability in WSUS that allows remote code execution with SYSTEM privileges, following active exploitation after the release of a proof-of-concept and the initial patch on October 14 proved inadequate.
Explore security tools built specifically for AWS environments [5]. Deploy and test advanced solutions in minutes with free trials and pay-as-you-go pricing. From next-gen firewalls to automated compliance tools. Browse the complete collection and start your free trial today.
Toys “R” Us Canada has sent notices to customers of a security incident in which threat actors leaked data they stole from its systems. The breached data includes full names, physical addresses, email addresses, and phone numbers.
Endpoint security firm Koi Security uncovered a new self-spreading malware targeting developers, embedded in VS Code and OpenVSX extensions. The malware was pushed via hidden code in compromised extensions, which downloaded an infostealer that stole cryptocurrency wallet data and credentials for GitHub, npm, and OpenVSX accounts. The malware also attempts to infect any extensions it gains access to to self-propagate.
DataDog Security Labs identified a new phishing method exploiting Microsoft's Copilot Studio chatbots. Attackers can tailor the Login topic to create convincing phishing pages hosted on copilotstudio.microsoft.com. The attack involves administrators approving permission requests from the application, which can be a “demo website” that does not need Microsoft's verification.
Agentic browsers like OpenAI Atlas are vulnerable to exploitation if input boundaries are not strictly enforced. Attackers can create strings that look like URLs but contain natural-language commands, which the omnibox might interpret as user intent. This can allow malicious actors to override user commands, leading to unintended or harmful actions, such as opening phishing sites or executing destructive instructions.
File hashes, IP addresses, and domains are usually seen as indicators of compromise (IoCs), but they have limited value in investigations because adversaries can easily alter them. These IoCs can be more insightful if supplemented with additional contextual data like fuzzy hashes, GeoIP information, and domain reputation. As AI enhances malware developers' abilities, IoCs will no longer serve as standalone alerts but will evolve into data points that help build a comprehensive understanding of a threat actor's behavior.
This post demonstrates how to use LLMs with Model Context Protocol (MCP) servers integrated into IDA Pro and Ghidra to accelerate malware reverse engineering through automated function analysis, code documentation, and variable renaming. Testing on IcedID malware compared cloud-based Claude Sonnet 3.7 ($2.91-$13.24 per analysis, 18-11 minutes) against local Ollama/Devstral models ($0 cost, 22-46 minutes), with cloud models providing more thorough analysis but at a higher expense. Key limitations include token costs escalating with file complexity, context window truncation causing local models to forget instructions mid-analysis, and security risks from prompt injection, tool poisoning, and potential data exfiltration when using untrusted MCP servers.
2025.10.27·
blog.talosintelligence.com·10 min read·TLDR InfoSec
Learn how to defend cloud control planes, adapt endpoint detection mindsets to cloud environments, and find the right balance in detection rules. Datadog Detect [13] (October 30, 12PM ET) [13] brings together security researchers from Red Canary, Corelight, and Datadog to share practical approaches for building scalable detection and
Maigret collects a dossier on a person by username alone, checking accounts across a vast number of sites and gathering all available information from web pages. No API keys are required. Maigret is an easy-to-use and powerful fork of Sherlock.
AI-powered browsers promise convenience but can unintentionally follow dangerous instructions hidden in web content, risking user security. Comet's recent vulnerability exposed how easily AIs can be manipulated. They are like naive assistants who often cannot distinguish malicious commands from user input. A simple hidden command can hijack and send private data to a thief.
A federal judge issued a permanent injunction against NSO, banning it from using Pegasus spyware on WhatsApp users and requiring it to delete illegally obtained data. The ruling, from Meta's lawsuit, revealed that Pegasus infected activists', diplomats', and journalists' devices. Punitive damages were reduced, but the case sets a precedent that enhances privacy protections and makes attacks on encrypted platforms like WhatsApp riskier.
Attackers used phishing to compromise npm maintainer accounts in September, injecting malicious code into 18 popular packages with over 2 billion weekly downloads to steal cryptocurrency and credentials from CI/CD pipelines. Cloudflare's Page Shield, using ML-based analysis of 3.5 billion scripts daily, detected all compromised packages with 98% precision and 90% recall by identifying obfuscated code and changes to wallet interfaces. Organizations should audit dependencies, rotate credentials, pin safe versions, and consider Cloudflare's Client-Side Risk Assessment for supply chain security.
Reddit sued AI startup Perplexity, Lithuanian firm Oxylabs, SerpApi, and Russian company AWMProxy for allegedly circumventing platform protections by scraping Reddit content from Google search results to train AI models and resell data to companies like OpenAI and Meta.
Scammers increase their odds by going after people are at their most vulnerable. This makes job seekers a perfect target for offers that are too good to be true. The easiest way to keep yourself safe is by knowing the signs of a scam and having an email security solution – like Sublime – that keeps them out of your inbox. You can't be fooled by a message you never see. Learn about a recent Google Careers scam [4] with convincing brand imitation and indications of attack iteration, both signals of cutting edge attacks.
Threat actors are actively exploiting CVE-2025-54236 (SessionReaper, CVSS 9.1), a critical nested deserialization vulnerability in Adobe Commerce and Magento that enables remote code execution and customer account takeover via the Commerce REST API, with over 250 attacks recorded in 24 hours. Attackers from five known IP addresses are deploying PHP webshells through ‘/customer/address_file/upload' and probing phpinfo, while 62% of Magento stores remain unpatched six weeks after Adobe's fix was released. Security teams must immediately patch all Adobe Commerce and Magento instances, block the listed attacker IPs (34.227.25.4, 44.212.43.34, 54.205.171.35, 155.117.84.134, and 159.89.12.166), and monitor for unauthorized file uploads, as this is the second critical deserialization flaw in these platforms within two years following CosmicSting (CVE-2024-34102).
Security researchers discovered a critical path traversal vulnerability in Smithery.ai, a popular MCP server hosting service. The researchers discovered that they could exploit a path traversal vulnerability in the dockerBuildPath configuration value to read files outside of their project. The researchers used this vulnerability to find a fly.io API token that granted root access to more than 3k applications.
LG Uplus, one of South Korea's major mobile carriers, reported a data breach. The announcement follows a report from Phrack that a threat actor infiltrated LG Uplus' internal network and seized data from nearly 9k servers, including data of 42,256 accounts and 167 employees.
Organizations are transitioning from static secrets (API keys, passwords, and tokens) to managed identities, achieving a 95% reduction in credential management time and a 75% reduction in learning platform-specific authentication. Major cloud providers (AWS IAM Roles, Azure Managed Identities, and GCP Service Accounts) now offer automated, short-lived credential provisioning that eliminates manual rotation and leakage risks. However, legacy systems and third-party APIs still require traditional secret management. Security teams should prioritize discovering existing credentials using NHI (Non-Human Identity) platforms before migration, aiming to reduce their secret footprint by 70-80% while maintaining robust secret management for remaining use cases.
Frida enables powerful mobile app modifications by injecting custom agents into running processes. However, distributing these modifications for use by others—especially on non-rooted Android devices—requires embedding Frida's gadget library directly inside the APK. Using a demo app, this post walks through preparing an agent script that always rolls a 'one' in a dice app, compiling it, and patching the APK to include Frida's gadget for autonomous script execution.
Unified logs are a forensic resource for iOS that includes granular background activity that can't be obtained in any other forensic artifact. The logs can be collected manually on a Mac via libimobiledevice or automatically using a script written by the author. The author provides suggestions for commercial and open-source tools to read the .logarchive, a structured bundle containing binary .tracev3 files.
Join IAM and cyber experts at Gartner IAM Summit 2025 [12]. With 80+ expert-led sessions on everything from agentic AI to IAM data management, this is your chance to make career-building connections with global pros. Plus, secure a 1:1 with a Gartner expert to get guidance tailored to your challenges. >> Use code IAM20P3 to save $345 on the standard rate [13].
ssh-audit is an open-source Python tool that audits SSH server and client configurations by analyzing cryptographic algorithms, key exchanges, host keys, ciphers, and MACs against security best practices, with support for policy compliance testing and vulnerability detection, including Terrapin (CVE-2023-48795) and DHEat (CVE-2002-20001). The tool provides comprehensive analysis, including RSA/DH key length testing, algorithm recommendations, multi-threaded scanning, and built-in hardening guides for OpenSSH, Ubuntu, Debian, and Rocky Linux platforms. It now flags SHA-1 algorithms as failures, warns about quantum computing resistance, and includes built-in policies accessible via -L/--list-policies with custom policy creation via -M/--make-policy.
Keycard provides an identity and access management platform for AI agents, enabling organizations to assign, track, and control AI agent permissions using cryptography, dynamic tokens, and runtime contextual access policies for secure, scalable agent deployment and visibility.
Meta introduced enhanced scam protections for WhatsApp and Messenger, including screen-sharing warnings during video calls with unknown contacts and on-device behavioral analysis to flag suspicious messages, with optional cloud-based AI review that breaks end-to-end encryption. The company removed over 21,000 fake customer support Facebook pages targeting users through comment monitoring on legitimate airline, travel agency, and bank accounts, part of broader scam trends targeting seniors with fake home remodeling and government debt relief schemes. Security teams should educate users, especially vulnerable populations, about enabling these protections, including Passkeys and Security Checkup features, while noting that cloud-based AI analysis compromises message encryption.