Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Security researchers utilized CyberChef to deobfuscate a Nanocore VBS loader, which encoded ASCII characters using mathematical operations and hexadecimal values. They utilized subsection tools and flow control to isolate operators, convert hex, perform calculations, and decode ASCII, demonstrating how advanced techniques can reverse complex obfuscations.
Sponsored
Cyberattackers are waging war on training data and AI models, but your Windows 10 fleet can't detect threats below the OS. Dell AI PCs [11]detect BIOS tampering and supply chain attacks at the hardware level, while integrated CrowdStrike and Absolute software enforce zero-trust model access controls. Learn what makes Dell AI PCs the
Cloudflare Radar added two features: regional traffic insights showing sub-national Internet patterns via administrative divisions, and comprehensive Certificate Transparency (CT) data expanding on the Merkle Town dashboard. The regional insights reveal localized traffic trends, such as mobile vs. desktop usage, and the impacts of weather or infrastructure issues. The CT data provides analysis of certificate issuance, CA activity, and log metrics. These features enhance Radar's goal of detailed Internet health and security visibility through dashboards, APIs, and Radar's Data Explorer.
OmniProx is a command-line tool designed for security professionals to deploy and manage HTTP proxies across various cloud providers, including Azure, GCP, Cloudflare, and Alibaba Cloud, through a single interface. It offers IP and header rotation for web scraping, reconnaissance, or privacy, and is designed to utilize free tiers for cost efficiency. However, security teams should be aware that it could be misused for malicious activities such as bypassing rate limits, evading detection, or unauthorized reconnaissance.
WerDump is a Beacon Object File (BOF) for Havoc and Cobalt Strike that allows dumping Process Protected Lsass using WerFaultSecure.
Two 17-year-old Dutch teens were arrested near Europol, Eurojust, and the Canadian embassy in The Hague for allegedly using WiFi sniffing devices to spy for Russia. Recruited via Telegram, they were detained after a Dutch intelligence tip, with one arrest occurring at home while the suspect was doing homework, unaware of their activities. Europol confirmed the incident but said its systems weren't compromised, marking a shift from Russian youth recruitment for vandalism to espionage.
Cybercriminals are distributing XWorm RAT through fake Spanish invoice emails containing malicious .xlam Office files that appear blank when opened but execute hidden shellcode to download additional payloads. The attack chain employs reflective DLL injection and process injection techniques to embed the malware within legitimate processes, thereby enabling complete remote system control, including keystroke logging and file theft, while establishing a connection to a C2 server at 158.94.209.180. This represents a continuation of XWorm campaigns that have compromised over 18,000 devices globally this year, with attackers increasingly leveraging trusted platforms, such as AWS S3, for payload distribution.
The Medusa ransomware group claims to have exfiltrated 834.4 GB of data from Comcast Corporation and is demanding $1.2 million either as ransom for deletion or as a sale price to interested buyers. As proof, the attackers posted approximately 20 screenshots of alleged internal files, along with a listing of 167,121 file entries containing actuarial reports, insurance modeling scripts, claim analytics, and product management data, including files such as Python and SQL scripts related to auto premium analysis. Comcast has not confirmed or denied the breach. It experienced a credential leak in 2015 that affected over 200,000 users. The breach was attributed to credential aggregation and not a system breach.
Sponsored
AI-driven cyberattacks are rewriting the rules. Join Morgan Stanley's Rachel Wilson at CTRL/ACT to learn why visibility isn't enough and how actionability, automation, and resilience are the new imperatives.
Microsoft is investigating a bug that prevents classic Outlook users from opening OMEv2-encrypted emails from external organizations.
The European Commission launched a formal investigation into SAP for allegedly abusing its dominant market position by forcing customers to purchase uniform support packages, blocking the termination of unused licenses, extending mandatory support periods, and charging substantial reinstatement fees that restrict competition from third-party ERP support providers.
Wiz now has FedRAMP High authorization, allowing federal agencies and contractors to use its full cloud security features across major cloud providers to protect sensitive government workloads.
Sponsored
AI is fast transforming every aspect of security and compliance—and no aspect of GRC will be left unchanged.
Cisco has released security updates for CVE-2025-20352, a high-severity zero-day vulnerability in IOS and IOS XE software that's being actively exploited in the wild. The flaw stems from a stack-based buffer overflow in the SNMP subsystem, allowing authenticated attackers to trigger DoS conditions or achieve root-level code execution on vulnerable devices. Cisco strongly recommends upgrading to patched versions immediately, as no workarounds exist beyond limiting SNMP access to trusted users.
Libraesva has patched CVE-2025-59689, a command injection vulnerability in its Email Security Gateway with a CVSS score of 6.1, after discovering state-sponsored threat actors were actively exploiting it. The flaw can be triggered by malicious emails, allowing attackers to execute commands on the affected system. Organizations using Libraesva ESG should immediately apply the available security update to prevent exploitation.
Attackers created fraudulent GitHub Pages impersonating over 100 companies (including LastPass, 1Password, financial institutions, and tech firms) using SEO to rank high in search results and trick Mac users into downloading fake software installers. The malicious sites redirect victims through multiple layers to ultimately execute a terminal command that downloads Atomic Stealer malware, which harvests credentials and sensitive data from infected systems. The campaign leverages trusted GitHub infrastructure and creates multiple backup repositories under different usernames to evade takedown efforts while targeting a broad range of high-value software applications.
Researchers have discovered a new regular expression (regex) injection method that exploits MySQL's Full-Text Search (FTS) boolean mode operators to bypass input sanitization. This technique utilizes characters like * and +, which have different meanings in FTS versus regex. The attack extracts sensitive data without breaking SQL syntax, demonstrated in CVE-2025-48941 in myBB, where attackers could enumerate deleted thread titles by observing search redirects instead of error messages. This is risky because FTS functions are often unsanitized, as developers don't view them as regular expressions, and the payloads can evade WAFs and security scanners.
L1TF Reloaded is a complex attack chain that uses half-Spectre gadgets to load data into L1 cache and L1 Terminal Fault to read cross-VM secrets via kernel data structures, breaking KASLR and extracting TLS keys. Google responded with Address Space Isolation (ASI), removing sensitive memory from kernel space during VM execution and mapping it during controlled transitions with buffer clearing. The attack highlights how speculative execution vulnerabilities can bypass privilege boundaries in virtualized environments, emphasizing the need for comprehensive architectural defenses beyond piecemeal mitigations.
Palo Alto Networks' Unit 42 linked the Bookworm malware family to the Chinese APT group Stately Taurus by analyzing shared artifacts, including PDB paths, infrastructure, and targeting of Southeast Asian governments. Using the Admiralty System, they scored evidence reliability, reaching a confidence score of 58.4 based on toolsets, victim profiles, timelines from 2015-2022, and environment fingerprints. This case shows how structured attribution enables evidence-based threat actor identification, improving cybersecurity intelligence.
Sponsored
Legacy PAM can't enforce in-session commands, and developers bypass controls that block productivity. Meanwhile, attackers exploit these gaps to escalate privileges and move laterally. StrongDM delivers continuous action-layer authorization [11] across cloud-native and ephemeral environments. Zero standing privilege, protocol-native coverage of 100+ resource types, and just-in-time access that doesn't
ZAPISEC WAF-Copilot is an AI-driven security framework for web applications. It offers a highly configurable and streamlined vulnerability assessment process using AI engines, CVE data correlation and organization, continuous monitoring supported by a database, and a simple, intuitive user interface.
This tool allows server access via WinRM or PowerShell Remoting, with features for capture the flag and penetration testing. It was developed to address limitations in tools like Evil-WinRM and to contribute to open-source security. Devious-WinRM, built on PowerShell Remoting Protocol, uses WinRM but needs fewer permissions, especially in basic Active Directory environments.
Kali Linux 2025.3 introduces ten new security tools, including Caido web security auditing toolkit, krbrelayx Kerberos exploitation framework, and AI-powered tools like Gemini CLI and llm-tools-nmap for LLM-based network scanning. The release adds Nexmon firmware patching framework support for enhanced Wi-Fi capabilities on Raspberry Pi devices, including Pi 5, enabling monitor mode and frame injection for wireless security testing. Additional updates include Kali NetHunter improvements with Samsung S10 support, CARsenal car hacking features with new UI, and experimental Magisk kernel module installation capabilities.
China-nexus threat actor UNC5221 uses BRICKSTORM backdoors on network appliances and VMware infrastructure to maintain persistent access, averaging 393 days undetected. The actor employs sophisticated tactics, including VM cloning to extract credentials offline, credential harvesting via BRICKSTEAL servlet filters, and legitimate tool abuse to access M365 mailboxes and secret vaults. Organizations should inventory unmonitored appliances, hunt for unusual internet traffic from management interfaces, and monitor for VM cloning activities and suspicious SSH enablement on virtualization platforms.
Attackers exploited CVE-2024-36401, a critical GeoServer RCE vulnerability, to breach a US federal agency. They maintained access for three weeks before detection. The threat actors deployed China Chopper webshells, moved laterally to web and SQL servers, and used brute force techniques for privilege escalation and credential harvesting. Organizations should prioritize patching critical vulnerabilities in CISA's KEV catalog and ensure continuous EDR monitoring, as over 16,000 GeoServer instances remain exposed online.
SolarWinds issued a third patch for the critical Java deserialization vulnerability in Web Help Desk, CVE-2025-26399 bypasses CVE-2024-28988, which bypassed the original CVE-2024-28986 flaw. This CVE affects the AjaxProxy component, allowing unauthenticated remote code execution. Trend Micro researchers found each patch bypass. Experts warn that patch bypasses are common with blacklist approaches and predict that this could be exploited, given its history of active exploitation.
CISA issued an alert with eight remediation tips after the Shai-Hulud worm compromised 500+ NPM packages by stealing GitHub tokens and cloud credentials. GitHub responded by enforcing stricter authentication, including mandatory 2FA for publishing and switching to trusted methods with short-lived tokens.
The J Group ransomware gang claims to have breached FAI Aviation Group, a German charter operator, stealing nearly 3TB of sensitive data, including patient records, employee documents, audit files, CVs, and passport copies, and threatening to sell the data after failed ransom talks.
The Department of Homeland Security (DHS) made a viral video with Pokémon images, music, and the "Gotta Catch 'Em All" slogan to promote ICE raids, showing detained immigrants as Pokémon cards and outraging fans who called on Nintendo to sue for unauthorized use.
Sponsored
ShadowLeak is a zero-click vulnerability in OpenAI's ChatGPT Deep Research agent that utilized invisible, indirect prompt injection commands hidden in emails to exfiltrate Gmail data without user knowledge. The attack operated entirely on OpenAI's servers using the agent's browser.open() function call to send stolen data encoded in Base64 to attacker-controlled URLs, achieving a 100% success rate. OpenAI fixed the vulnerability in August after receiving a responsible disclosure, but researchers warn that the technique could also be used on other connected services, such as Google Drive, Microsoft Teams, and GitHub.
There is a malware campaign that uses GitHub repositories to deliver fraudulent password managers. The fake software delivers the Atomic (AMOS) InfoStealer to infected macOS devices. LastPass says that aside from its product, over 100 different softwares are being used, such as 1Password and Notion.
Binarly researchers found they could bypass Supermicro's patch for CVE-2024-10237, a firmware flaw allowing malicious updates, prompting a new CVE (CVE-2025-7937) and fix. They also discovered CVE-2025-6198, a flaw that bypasses the Root of Trust. Both enable attackers to control the BMC and OS. These flaws show firmware validation's fragility, risking persistent BMC code execution with major enterprise security implications.
AWS tags offer a way to attach metadata to a resource, either automatically (like the Name tag) or manually. Several services provide API calls such as ListTags or GetTags, enabling efficient enumeration of resources accessible by an identity. TagNabIt is a tool designed for tag-based brute-force enumeration.
GrapheneOS features a hardened malloc, a memory allocator that uses ARM Memory Tagging Extension (MTE) to assign tags to memory regions and detect corruption, effectively preventing heap overflows and use-after-free attacks. Its two-stage quarantine system, which involves randomized and FIFO queues, makes exploiting freed memory difficult by requiring attackers to perform thousands of free operations. Large allocations are secured through guard pages, address space randomization, and the separation of metadata from user data, all of which enhance security.
External Attack Surface Management (EASM) tools automate the discovery and continuous monitoring of internet-facing assets, providing organizations with an attacker's perspective of their vulnerabilities across domains, IP addresses, and exposed services. The strategic value lies in combining automated asset discovery with risk prioritization—EASM products excel at identifying shadow IT, abandoned subdomains, and misconfigurations that traditional internal scanning misses. Organizations should select EASM solutions based on their specific needs: small businesses require clear remediation guidance, SMEs need robust subdomain discovery to prevent takeovers, and enterprises benefit from large-scale IP scanning with export capabilities for distributed security teams.
Sponsored
78% of developers use AI coding tools, yet half of functionally correct AI-generated code is insecure. SCW Trust Agent: AI [11] gives leaders visibility and governance to manage this risk - spotting “shadow AI,” mapping vulnerabilities to skill level, and enforcing
MSIXBuilder is a PowerShell tool for creating MSIX packages with embedded test applications.
LLM4Decompile is an open-source LLM dedicated to decompilation.
Firezone is an open source platform for secure remote access, suitable for organizations of any size. Unlike most VPNs, it uses a granular, least-privileged approach with group-based policies to control access to applications, subnets, and more.
A vulnerability in the American Archive of Public Broadcasting website, which has been exploited since at least 2021, allowed unauthorized downloading of protected and private media through an insecure direct object reference (IDOR) flaw that bypassed access controls by manipulating media ID parameters. The exploit circulated in Discord preservation communities and "data hoarder" groups, leading to leaks of protected content, including a banned Sesame Street episode featuring the Wicked Witch of the West. AAPB fixed the vulnerability within 48 hours after being notified. The extent of accessed content during the years-long exploitation remains unknown.
The US Secret Service (USSS) dismantled a network of over 300 co-located SIM servers and 100,000 SIM cards positioned within 35 miles of the UN General Assembly in New York that were used to conduct telecommunications-related threats against senior US government officials. The devices were capable of performing multiple attack vectors, including disabling cell phone towers, facilitating denial of service attacks, and enabling anonymous encrypted communications between nation-state threat actors and criminal enterprises. Early forensic analysis revealed cellular communications between nation-state threat actors and individuals known to federal law enforcement, representing an imminent threat to protective operations during the high-profile international gathering.
A researcher at Carnegie Mellon University demonstrated that an LLM can coordinate a system of agents to recreate real-world attacks. As part of his PhD, Brian Singer recreated the network environment of the 2017 Equifax data breach and observed that an LLM could replicate the attack. These capabilities allow smaller organizations to use LLMs as dedicated red teamers.
Microsoft has removed a compatibility hold that prevented devices with integrated cameras from installing Windows 11 24H2 due to a face detection bug that caused app freezes when using the Camera app, Windows Hello facial recognition, and other camera-utilizing applications.