Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Their Cyber Hero Team pre-tests every single update in a controlled environment [4]. You get the security benefits of up-to-date software, without the hassle. And you're always in control with Centralized management across all endpoints and policy based-deployment.
VoidProxy is a new Phishing-as-a-Service platform that uses Adversary-in-the-Middle attacks to bypass multi-factor authentication on Microsoft and Google accounts by intercepting login credentials and session cookies in real-time. The platform leverages compromised email accounts from legitimate providers like Constant Contact to evade spam filters, then redirects victims to perfect clones of login pages where all authentication data is stolen. VoidProxy operates with a sophisticated two-part infrastructure that features disposable front-ends and resilient back-ends, along with anti-analysis features including Cloudflare CAPTCHA protection, making it difficult for security teams to detect and track.
A stable authenticated 0-click remote code execution exploit against Linux's kernel SMB3 daemon (ksmbd) chains two existing CVEs: CVE-2023-52440 for controlled heap overflow, and CVE-2023-4130 for memory leakage, targeting Linux 6.1.45 with full mitigations enabled. The exploit leverages NTLM authentication flaws to overflow a 512-byte SLUB allocation, then uses an arbitrary free primitive to corrupt a 1KB ksmbd_conn object and hijack a vtable pointer to achieve ROP-based code execution via call_usermodehelper. The technique demonstrates how N-day vulnerabilities can be chained together for reliable exploitation despite modern kernel protections, though it requires authenticated SMB access and is limited by the relative rarity of ksmbd deployments in production environments.
Nearly 700,000 FinWise Bank customers are being notified after a former employee may have accessed or taken personal data post-employment. The breach, detected over a year after it happened, involved customers from American First Finance. FinWise is offering affected individuals free credit monitoring. The case highlights ongoing risks posed by insider threats within financial and tech organizations.
A red team researcher demonstrated how to bypass LSASS memory protections on Windows 11 by exploiting a vulnerable version of WerFaultSecure.exe from Windows 8.1, which runs with the highest Protected Process Light (PPL) level and can access protected LSASS memory that normal processes cannot touch. The technique uses undocumented parameters to trigger unencrypted crash dumps of the LSASS process, then disguises the output file with PNG magic headers to evade antivirus detection. The attack requires deploying the older vulnerable WerFaultSecure.exe binary alongside a custom loader that launches the tool with proper PPL protections, demonstrating how legacy Windows components can be weaponized against modern security controls.
This is the first part of a three-part series on hacking the Xbox 360 hypervisor. It provides a comprehensive system overview of the console's security architecture, including the custom Xenon PowerPC CPU with on-die security features like 768 eFuses, 64KB secure RAM, hardware encryption, and protected memory pathways that use per-boot encryption keys and CRC checksums. The hypervisor operates as a 256KB protected process that manages all executable memory allocation and code authentication, with only one known exploit in its history - the "4548 system call handler bug," which was likely caused by a compiler optimization error rather than intentional code changes. In the console's robust security model, where Microsoft must sign all code, hypervisor memory is protected with both encryption and integrity checks. The system uses multiple privilege levels with strict validation to prevent software-only hacks.
HTTP/2 CONNECT is an upgrade over the original HTTP/1 CONNECT method, shifting from tunneling entire TCP connections to multiplexing multiple streams within a single connection. This evolution enables more efficient proxying and port scanning by allowing numerous tunnels without the overhead of opening many separate TCP sessions. The protocol's design incorporates features like HPACK header compression and support for modern proxy use cases—including WebSocket, UDP, and raw IP proxying—making it highly relevant for security research and next-generation proxy infrastructure.
Sponsored
Custom CTFs are a great exercise - and you now have a fast and effortless way to run them. TryHackMe is offering exclusive, ready-to-run private events [12] covering web, crypto, forensics, and more. Deploy in one day with zero setup. Includes a beginner-friendly security awareness CTF for non-technical staff. Plan your team's
Raw Disk Parser is a proof-of-concept Python script that dumps sensitive or restricted files without triggering alerts. It works by reading directly from the disk, then analyzing NTFS filesystem structures to find and read files. This method doesn't use standard Windows file APIs, so it effectively bypasses file access controls, locks, and some EDR/AV monitoring features that rely on hooking high-level file I/O operations.
Security Onion is a free and open platform built by defenders for defenders. It includes features like network visibility, host visibility, intrusion detection honeypots, log management, and case management. In the latest 2.4 release, there are new features like SOC for UniFi dashboard, JA4 support, and many bugfixes.
Geordie provides enterprises with real-time visibility and alerts for AI agents, helping organizations track agent actions, detect unexpected behaviors, and securely manage AI agent adoption and risks.
Fifteen major ransomware gangs, including Scattered Spider, Lapsus, and Shiny Hunters, announced they are "going dark" after claiming they fulfilled their goals and will enjoy their earnings from recent attacks on companies like Jaguar Land Rover, Marks & Spencer, and Salesforce. They posted their farewell on BreachForums, saying they will stop attacking in their name. However, experts doubt this will be permanent, as some members have already been arrested, and the profits of cybercrime may lure them back. The announcement follows a summer campaign where the rebranded "Scattered Lapsus Hunters" targeted over 700 organizations worldwide, mainly through social engineering and data theft rather than ransomware.
The FBI issued a FLASH alert about cybercriminal groups UNC6040 and UNC6395, which target Salesforce to steal data and extort through methods like voice phishing and OAuth token exploitation. UNC6040 has used social engineering since late 2024 to trick call center staff into connecting malicious apps to Salesforce, while UNC6395 exploited OAuth tokens in August to access customer data and credentials. Major companies such as Google, Adidas, Qantas, Cisco, Louis Vuitton, and Tiffany & Co. have been impacted. The threat actors are linked to ShinyHunters and Scattered Spider, who recently announced they are "going dark."
Proton Mail suspended two journalists' accounts after they published research documenting an intrusion into several South Korean government institutions in Phrack. It contacted the researchers via the disclosure account a week after the print release, notifying them that their account was being suspended, citing a policy violation due to a government cybersecurity organization. The company reversed its decision and restored the accounts following a public outcry over privacy.
Sponsored
Stop overwhelming your teams with alerts that don't align with actual risk. Find runtime-verified, exploitable vulnerabilities in
Hackers exploited Nepal protests by masquerading as emergency services and officials to trick people into downloading malware and stealing data.
Fairmont Federal Credit Union has informed over 187,000 individuals about a security breach in 2023 that exposed sensitive information, including financial, medical, and personal data.
Google confirmed hackers from the "Scattered Lapsus$ Hunters" group created a fraudulent account in its Law Enforcement Request System (LERS), used worldwide by police to submit data requests, though no requests were made and no data accessed before the account was disabled.
Sponsored
83% OF IT LEADERS HAVE FACED EMAIL-RELATED SECURITY INCIDENTS, and nearly half saw them happen in just the past year. Phishing and spoofing top the list—making email not just a communication tool, but a frontline risk surface. But despite the risk, ONLY 33% HAVE IMPLEMENTED CORE PROTECTIONS like DMARC, DKIM, or SPF.
The HybridPetya ransomware on VirusTotal echoes the infamous Petya/NotPetya attacks but adds UEFI bootkit capabilities and exploits CVE-2024-7344 to bypass UEFI Secure Boot on outdated systems. Unlike NotPetya, HybridPetya functions as actual ransomware with decryption capabilities, encrypting the Master File Table after compromising EFI partitions and displaying fake CHKDSK status before showing ransom demands. This marks the fourth known UEFI bootkit with Secure Boot bypass capability, joining BlackLotus, BootKitty, and the Hyper-V Backdoor PoC, indicating these sophisticated attacks are becoming more common.
A threat actor named WhiteCobra has been flooding the VSCode marketplace and OpenVSX registry with malicious extensions targeting VSCode, Cursor, and Windsurf users. The extensions contain an extension.js file that is nearly identical to the Hello World example but loads a prompt.js file, which downloads and executes a platform-specific infostealer payload from Cloudflare Pages. An Ethereum core developer reported on X that their wallet was drained after downloading a seemingly legitimate extension with a professional logo, detailed description, and 54K downloads.
Samsung patched a remote code execution vulnerability that impacted Samsung devices running Android 13 or later. The vulnerability arose from an out-of-bounds write in the libimagecodec.quram.so library, which is used for image parsing. Apple patched the relevant vulnerability in its devices last month after it was reported to it by WhatsApp and Meta researchers as well.
Google Project Zero found a fake carrier app exploiting a heap overflow in Apple's DCP firmware on iPhone 12/13. The exploit bypassed kernel protections by targeting the DCP's weaker security, using a fake Vodafone app distributed via enterprise certificates to sideload malware. The vulnerability (CVE-2021-30983) caused memory corruption through an unbounded loop in display code, allowing attackers to gain kernel access by corrupting C++ objects and manipulating memory between the DCP and main system.
The Gentlemen ransomware group has executed sophisticated attacks across 17 countries, focusing on sectors like manufacturing and healthcare. Their operations use custom tools to bypass security measures, exploit privileged accounts, and deploy ransomware with double extortion tactics. The campaign demonstrates a shift to highly tailored, evasive strategies, raising the bar for enterprise defense and incident response recommendations.
This comprehensive guide addresses frequent security pitfalls seen in Supabase deployments, offering precise and practical solutions grounded in recent audits. It covers how components like authentication, database schemas, Edge Functions, storage, and CORS interact from a security perspective and how to secure them with simple, effective policies—such as “read-only by default”, automate audits, and revisit configurations as the platform evolves.
Sponsored
Email attacks are evolving faster than security teams can write rules. Sublime's ADÉ [12] (Autonomous Detection Engineer) fights fire with fire: while hackers automate phishing and social engineering
in response to missed attacks.
GroupPolicyBackdoor is a tool for Group Policy Objects (GPOs) manipulation and exploitation.
Red Access provides an agentless security platform that protects web sessions and assets across browsers and apps, enabling secure access, data loss prevention, and visibility for remote and hybrid enterprise environments.
GarudRecon is an automated reconnaissance framework designed for asset discovery, vulnerability detection, and continuous monitoring.
Hacktivists from Enlace Hacktivista leaked nearly 600 GB of data supposedly from China's Great Firewall, exposing source code, communications, and documents from Geedge Networks and MESA Lab, key to the censorship system. The leak reveals that the Great Firewall operates as a commercial platform called "Tiangou," which has been exported to Myanmar, Pakistan, Ethiopia, Kazakhstan, and other Belt and Road countries for surveillance purposes. The 500 GB archive includes source code, project records, and internal documents revealing how China's censorship functions and spreads globally through public-private partnerships.
A modder connected AI chatbots to the 2002 game Animal Crossing, enabling villagers to discuss their indebtedness and organize against Tom Nook. Using memory hacking and two Python scripts, the mod injects dynamic, AI-generated dialogue into the game, with a writer creating the dialogue and a director adding technical elements.
A security engineer shares their experience preparing for and interviewing for an AppSec role at Amazon. The author walks through their screening interview and three days of onsite interviews, which included scripting and automation questions, a coding challenge, a threat modeling exercise, and other questions. The article wraps up with lessons learned after a rejection and the resources the author used to prepare.
Sponsored
Join Francis Odum and cyber experts from Microsoft and Align for a full day virtual event. Featuring exclusive threat intelligence, AI-driven defense strategies for SMBs, and unfiltered insights.
Qrator Labs thwarted a record Layer 7 DDoS from a botnet of 5.76M compromised IoT devices targeting government infrastructure, a 333% increase since March 2025, mainly from Brazil (1.41M), Vietnam (661K), and the US (647K).
Researchers revealed that Vyro AI's server leaked 116GB of data, exposing user prompts, authentication tokens, and putting over 150 million users' privacy and accounts at risk.
Sponsored
Cybersecurity is a necessity, not a luxury. But other vendors only focus on the businesses with massive budgets and teams, ignoring the 99% without enterprise resources.
Researchers from ETH-Zurich have found a new attack that allows an attacker to leak cryptographic keys from an unmodified QEMU hypervisor process running on modern AMD or Intel CPUs. In the attack, a guest user can influence indirect branch prediction in a host user process to leak arbitrary memory at a rate of 32 bytes/second with a byte-level accuracy of 98.7%. AMD has released a security bulletin about the issue. Linux kernel developers have released patches to mitigate the problem.
Cornwell Quality Tools has disclosed a ransomware-driven data breach that impacts over 100,000 people. Hackers accessed sensitive information like Social Security numbers and financial data in December 2024. The Cactus group claimed responsibility and leaked corporate docs, though it's unclear if all of the data was released.
A cyber-attack on LNER's third-party supplier exposed customers' contact information and some journey records, but no payment or password data. LNER's train services remain unaffected. The company has advised vigilance against suspicious communications and stresses that the breach does not compromise sensitive banking details.
The SalesLoft Drift breach demonstrates the emerging threat of "fourth-party" risk, where organizations are compromised through their vendor's acquired company (Drift) rather than direct vendor relationships. Attackers exploited legacy OAuth tokens that had been dormant for 18 months since SalesLoft's 2024 acquisition of Drift, allowing access to hundreds of Salesforce instances and Google Workspace accounts. This incident highlights how M&A activities can inherit hidden security risks that extend organizations' attack surfaces far beyond what they can directly assess or control through traditional security measures.
Google Pixel 10 is the first smartphone to implement C2PA Content Credentials in its native camera app, automatically attaching cryptographically-signed metadata to all photos that documents their creation and editing history. The feature uses hardware-backed security through Tensor G5 and Titan M2 chips to achieve C2PA Assurance Level 2, ensuring tamper-resistant verification while preserving privacy through anonymous attestation and one-time-use cryptographic keys. Google Photos will display this provenance information to help users distinguish between authentic images and AI-generated or edited content, with the capability rolling out gradually to other Android and iOS devices.
When developing detection rules, assumptions are inevitably made that may lead to false positives. When tuning an alert for false positives, detection engineers may run up against telemetry limitations that force them to reconsider their initial assumptions. These limitations may lead the team to recreate the rule from a different data source, accept some amount of false positives, aggressively filter the rule and accept a certain amount of potential misses, or altogether scrap the rule.