Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Hackers, including those working for North Korea, are distributing malware using Ethereum and BNB blockchains, making it immune to takedowns and almost impossible to trace. By embedding malicious code in blockchain smart contracts, attackers can bypass traditional security measures, easily update payloads, and use job scams to lure developers into running these contracts as part of the interview process.
Sponsored
Cloud security focuses on keeping attackers out_ - _but outbound attack paths can be a blind spot. The network flow approach can be a useful monitoring alternative. Read the blog by Intrusion [18].
A 19-year-old college student received a four-year prison sentence and $14 million restitution order for breaching PowerSchool's systems using stolen subcontractor credentials.
Chinese threat group Jewelbug conducted a five-month intrusion into a Russian IT service provider from January to May.
Sotheby's experienced a cyberattack in July.
Sponsored
Phishing has gone beyond email. Today's attackers use AI-generated voices, videos, and interactive deepfakes of company executives. They can fool anyone - including you and your coworkers.
Eclypsium researchers discovered that Microsoft-signed UEFI shells on approximately 200,000 Framework laptops contain dangerous "mm" (memory modify) commands that can completely bypass Secure Boot protections by overwriting security handler pointers in memory. The attack leverages the implicit trust model, where signed components are automatically trusted, allowing attackers to disable signature verification and load arbitrary malicious code while the system still reports Secure Boot as enabled. Security professionals should prioritize updating UEFI revocation lists (DBX), implementing BIOS passwords, and conducting firmware vulnerability assessments, as commercial cheat providers are already exploiting this technique and could be weaponized by nation-state actors for pre-OS persistence.
F5 Networks revealed that government-backed hackers accessed its systems for an extended period, stealing source code and customer data. The intrusion impacted key product development areas and exposed sensitive customer configurations. While F5 acted to contain the breach and released security patches, over 1,000 companies, including many Fortune 500 firms, may be at risk.
Reliaquest researchers uncovered a Chinese hacking campaign that targeted critical infrastructure across Asia and North America. The attackers used spear phishing to access the networks, then downloaded geo-mapping malware that disguised itself as a software component. The malware masked its network traffic to blend in with routine traffic and managed to avoid detection for at least 12 months.
Mario Candela used Beelzebub's LLM network honeypot to detect cryptojacking malware that collected system data, then stopped other miners and started XMR mining via c3pool. The operation earned around $4,126 from 20 XMR across 95 servers. Attackers used 'validator/qwerty' credentials for initial access, then changed root passwords and established persistence. Security experts should note the value of LLM honeypots for behavioral analysis and coordinated disruption, as the author neutralized the threat by reporting the wallet to c3pool, which removed all infected miners.
Adversis developed grpc-scan to automate service discovery on gRPC endpoints when reflection is disabled and documentation is minimal, exploiting how different gRPC implementations return distinct error codes (UNIMPLEMENTED vs NOT_FOUND) to differentiate between non-existent services and valid services with invalid methods. The tool systematically tests thousands of service/method combinations using common naming patterns and leverages HTTP/2 multiplexing for efficient scanning, revealing common security anti-patterns like legacy services with weaker authentication, method proliferation where newer methods bypass security checks, and "internal" services exposed on public endpoints. Security professionals should recognize that gRPC's opacity often creates a false sense of security through obscurity, and should implement proper service inventory management, consistent authentication across all service versions, and network segmentation rather than relying on undocumented APIs for protection.
Pliny the Liberator is a well-known LLM jailbreaker who shares their jailbreaking prompts on GitHub. Pliny's prompts make use of several techniques to effectively jailbreak LLMs, such as instruction prioritization, obfuscation and redirection, guardrail negation, cognitive overload, contextual misdirection, task tunneling, tonal misdirection, and output quantity bias. This post steps through each technique and showcases how the prompt utilizes it.
Sponsored
The Cloud Security Alliance partnered with Dropzone AI to measure what actually happens when SOC analysts use AI assistance [12]. Real analysts. Real alerts. Real results. No vendor spin. Get the independent data your board needs to make informed AI investment decisions.
trdl (which stands for "true delivery") is an open-source solution providing a secure channel for delivering updates from the Git repository to the end user.
This post presents three Rust-based IDA Pro 9.2 plugins that leverage Binarly's idalib bindings for automated vulnerability research. rhabdomancer identifies potentially insecure API function calls with severity tiers, haruspex extracts decompiled pseudocode for static analysis tools like Semgrep, and augur organizes string-related code for analysis. The tactical approach focuses on scale and automation, with these headless tools achieving blazing-fast analysis (processing 350KB binaries in under 3 seconds) while integrating with existing vulnerability research workflows through IDE compatibility and static analysis tool chains. Security researchers should adopt this methodology of combining reverse engineering automation with static analysis pipelines.
Oneleet combines attack surface management with code scanning to identify forgotten assets, expose services, and uncover vulnerabilities before they enter production.
Third-party provider 5CA has publicly denied responsibility for the Discord breach that exposed 5.5 million users' data, including over 70,000 government IDs, contradicting Discord's initial claims that blamed 5CA's Zendesk systems. The breach was carried out by Scattered LAPSUS$ Hunters who gained 58 hours of access starting September 20, stealing 1.6TB of data, including support tickets and partial payment information for 580,000 users. Security professionals should note the discrepancy between the hacker group's claim of 521,000 age-verification tickets versus Discord's reported 70,000 exposed government IDs, highlighting the importance of independent breach assessments and avoiding premature attribution in incident response.
Unit 42 assisted a manufacturer targeted by Ignoble Scorpius (BlackSuit ransomware) after attackers used voice phishing to steal VPN credentials, then executed DCSync attacks to compromise domain controllers and exfiltrate 400GB of data before deploying ransomware across 60 VMware ESXi hosts. The incident response strategy involved rapidly expanding Cortex XDR visibility from 250 to 17,000 endpoints and using automated containment through Cortex XSOAR to stop lateral movement, while implementing critical defenses including MFA enforcement, network segmentation, and EFSRPC blocking. Security professionals should prioritize proactive multi-layered defenses, including robust endpoint visibility, automated response capabilities, and strict access controls, as this case demonstrates how a single compromised credential can escalate to a $20 million ransom demand without proper preventive measures.
Over 550 sensitive secrets, including AWS and GitHub tokens, were exposed in public VSCode extensions. This was primarily due to insecure file handling, which attackers could exploit to push malicious updates and launch supply chain attacks. In response, platforms revoked compromised tokens, notified publishers, and improved scanning.
Sponsored
Malware monsters. Defender superheroes. Epic battles for your data. Veeam is making cybersecurity as entertaining as your favorite Halloween movie. Real lessons, zero boredom [20]. October 30th, 2-3pm
Capita was fined £14 million for a cyberattack in 2023 that exposed the data of 6.6 million people, caused a 58-hour response delay, and involved significant security failures affecting hundreds of organizations.
Sponsored
Doxxing. Deepfakes. Targeted harassment. Executives are prime targets [4] for cyber and physical attacks—are you equipped to protect them?
In early 2025, a cyberattack at SimonMed Imaging exposed the data of over 1.27 million patients, including medical and personal information, with the ransomware group Medusa claiming responsibility. Medusa likely received a ransom to prevent data release. SimonMed responded with improved security measures and offered credit monitoring and identity theft protection to impacted people.
Sensitive personal, corporate, and military data is being transmitted unencrypted via about half of Earth's geostationary satellites, according to researchers. Using a basic satellite receiver, they accessed voice calls, texts, and critical infrastructure communications, exposing serious privacy and security risks.
“Pixnapping” is an advanced attack where a malicious Android app can secretly steal individual pixels from your device's screen—enabling it to extract sensitive data like 2FA codes, even from supposedly secure apps. The attack exploits Android's app messaging system and nearly invisible overlays.
Signal Messenger has rolled out a major upgrade to its encryption protocol, making it resistant to future quantum computer attacks. This technical overhaul adds a third layer—a quantum-safe ratchet—to its already-robust system to ensure strong privacy even if classical encryption breaks. Thanks to clever use of chunking methods and erasure codes, Signal's triple ratchet protects users' messaging by combining classic and quantum-safe security mechanisms, all without impacting everyday use.
Client-side JavaScript attacks pose a critical blind spot for e-commerce security as 73% of sites load 50+ third-party scripts on checkout pages while only 23% use dedicated client-side monitoring, allowing attackers to steal payment data through browser-based skimmers that bypass WAFs and traditional server-side defenses entirely. Major 2024 attacks, including the Polyfill.io breach affecting over 500,000 websites and Cisco's Magecart incident, demonstrate how compromised third-party scripts and supply chain vulnerabilities enable data theft that often goes undetected for an average of 7.5 months, with incidents costing $2.4 million plus regulatory fines. Security teams should immediately implement Content Security Policy with nonces (avoiding ‘unsafe-inline'), deploy Subresource Integrity tags for third-party scripts, establish comprehensive script inventories with regular audits, and deploy specialized client-side monitoring tools to detect unauthorized data collection, DOM manipulation, and suspicious script behavior before the 2025 holiday shopping season.
Timing attacks that target string comparison work by measuring how long it takes a vulnerable server to verify a string, such as a password or other secret. When a vulnerable function compares two strings, it loops through each character to check for equality, causing the function to take slightly longer to complete with each correct character. The page includes a demo for how this attack works in practice.
Sponsored
Independent reviewers confirm that using Semgrep can cut false positives by over 90% [11] compared to popular alternatives:
Maltrail is a malicious traffic detection system, utilizing publicly available (black)lists containing malicious and/or generally suspicious trails, along with static trails compiled from various AV reports and custom user-defined lists.
Forensic Timeliner is a high-speed forensic processing engine built for DFIR investigations. It can quickly consolidate CSV output from tools to create a mini timeline, with built in filtering, artifact detection, keyword tagging, and deduplication.
MCP Snitch is a macOS application that intercepts and monitors MCP server communications, providing security analysis, access control, and audit logging for AI tool usage.
Starting next year, Texas will require companies to verify the ages of people who use their app stores. Apple has announced that beginning January 1, Texans trying to create a new Apple Account must confirm their age. If they are under 18, they must join a Family Sharing group. Parents and guardians will be required to give their consent to download apps or make in-app purchases, and developers will be required to implement the Declared Age Range API.
Discord reported a breach impacting 70,000 users, claiming a third-party vendor, 5CA, was responsible, but 5CA denies any hacking of its systems or handling of government ID photos. The company argues the incident likely resulted from human error outside its systems, and both parties are conducting ongoing investigations to clarify further responsibility and the extent of affected data.
Japanese beer maker Asahi suffered a ransomware attack in late September that disrupted operations across Japan and may have resulted in unauthorized access to personal information. The ransomware group Qilin claims to have stolen 27 GB of data, including employee and financial records.
Sponsored
Avoid seven-figure legal bills before they happen. BENlabs uses Onna as “insurance” to keep Slack data risks predictable and costs under control. Future-proof your legal ops with Onna.
A large-scale botnet comprising over 100,000 IP addresses is conducting coordinated attacks against Remote Desktop Protocol services in the United States.
The UK's National Cyber Security Centre reported 429 cyberattacks from September 2024 to August 2025, with significant incidents more than doubling from 89 to 204, and highly significant incidents rising nearly 50% to 18, posing severe risks to essential services.
Several divisions of CISA are facing job cuts as part of a government plan to reduce staff during a shutdown, amid criticism from the administration over its work combating misinformation.
Sponsored
Many organizations solve software installation problems by handing out local admin rights. This generally “works” in terms of getting software installed, at the cost of creating a massive security threat.
>> Execute approved software as a local admin without entering credentials
An ongoing smishing campaign impersonates the New York Department of Taxation and Finance to target New Yorkers. The texts prompt victims to enter information on a link or risk losing an “Inflation Refund.” The link requests information such as SSNs, names, and addresses.
A phishing campaign called Payroll Pirate targets university employees by tricking them into giving up credentials for HR platforms like Workday. Attackers use adversary-in-the-middle methods to bypass multi-factor authentication, alter payroll settings and divert paychecks, and hide their tracks by creating inbox rules and adding their recovery phone numbers.
UK trade union Prospect has warned members that sensitive personal data, such as contact details, bank account numbers, and, in some cases, information on sexual orientation or disabilities, was exposed following a cyber incident in June. Members were notified months after the attack, and the union offers a year of credit monitoring.