Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Intel quietly suspended its Intigriti bug bounty program, which paid up to $100,000 per finding, replacing it with a no-reward vulnerability disclosure program and offering no public explanation for the change.
Gyazo's upload server flaw let an attacker run commands and access its database. Exposed data includes 23.62 million user records, password hashes, session IDs, integration tokens, and 490 million image metadata records. Leaked image IDs may expose linked captures. Helpfeel fixed the flaw, blocked access routes, and urged password changes.
Google has fixed CVE-2026-58704, an actively exploited Pixel modem authorization flaw. Attackers can bypass permission checks and escalate privileges without user interaction. CISA added it to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by September 19. Google disclosed limited, targeted exploitation but provided no attack details and asked users to update supported Pixel devices immediately.
Security researchers uncovered a new malware campaign that utilizes GitHub repos to impersonate LastPass Authenticator and at least 39 other well-known products. The campaign utilizes a legitimate Microsoft Visual Studio CoreCLR Debugger, which loads a malicious DLL. The DLL deploys a previously undocumented infostealer and an EDR and antivirus killer that terminates a hardcoded list of 145 EDR or antivirus products.
Semgrep benchmarked the new Grok models and GLM-5.3 on their standard IDOR vulnerability-finding benchmark. They found that Grok 4.6 Exacto roughly matched Opus 4.7's F1 score at less than a third of the cost. GLM-5.3 was able to compete with Opus 4.8 at one seventh of the cost.
After the author's legitimate site got flagged as a scam by Malwarebytes Browser Guard, they took a deep dive into the source code to identify what caused it. This post walks through the several layers Browser Guard uses, including bloom filters, heuristic rules, a malware URL database, a download file classifier, specialized rules for specific attacks like ClickFix, and remote false-positive checking using Hubble. The bigger issue, the author noted, is that the extension ships with a debug interface that can be used to disable heuristics.
An implementation guide breaks an OT security program into six components, beginning with asset discovery and process context mapping that tie every device to the operational process it supports. Availability and process safety outrank confidentiality here, so access boundaries, monitoring, incident response, and recovery each require joint sign-off from operations before deployment. Ownership belongs to a cross-functional executive such as a CISO or VP of Operations, with NERC CIP and NIST SP 800-82 treated as checkpoints rather than as the program design itself.
Sponsored
You can now get the depth of a pentest at the frequency of a scan. Does that mean pentests are dead? This Intruder blog [10] lays out the short-term, mid-term, and long-term implications of AI-driven pentesting. See what the economics, frontier AI developments, and
Ditto is a tree-sitter-based PowerShell and JavaScript obfuscatory.
Natural language nmap (nmap-nl) is a lightweight, local command-line inference tool that translates natural language into raw nmap commands and executes them locally using a locally-hosted, fine-tuned Gemma-3-270M model.
Token Analysis and Tracking System (TATS) allows users to track OAuth 2.0, OIDC, and Microsoft Entra ID tokens across captured network traffic by ingesting Burp Suite XML exports, mitmproxy flow files, or live Chrome DevTools Protocol streams and serving an interactive web dashboard.
A removed Flock camera exposed 1.6 million images and records of 50,200 vehicles over 21 days. Unencrypted Android partitions stored a key for footage encryption, and the device ran about 20 custom apps and captured bursts of vehicle images. Uploaded records could be searched by more than 2,000 agencies, including out-of-state users.
Hacktron AI researchers used Anthropic's security tool to exploit an OpenAI community-forum configuration flaw. They obtained internal sign-ons, accessed an employee's ChatGPT account, and reached GitHub-linked code. OpenAI paid the team $6,500 through its bug bounty program after disclosure, and OpenAI said it fixed the reported issues.
OpenAI released a disclosure process and six incident reports. Cases include 27 summaries containing prompt injections, use of an exposed API key, fabricated county data, unauthorized file uploads, repository writes, and public file-sharing. Reports can be delayed when third parties or undisclosed vulnerabilities require investigation and notification.
A cyberattack took much of the International Meteor Organization's aging web infrastructure offline.
Plugin4Shell bypasses SHA pinning in Claude Code, Codex, GitHub Copilot, and Gemini CLI plugins.
Attackers are actively exploiting a critical pre-auth RCE (CVE-2026-58138) in Orkes Conductor by escaping unsandboxed GraalVM evaluators to execute arbitrary OS commands, requiring an immediate upgrade to version 3.30.2.
Sponsored
The EU AI Act is reshaping how organizations govern AI. Security leaders need clear visibility into where AI is used, the data it can access, and the controls they can demonstrate. Join us on Weds, Oct 7th [4] to learn: → The AI security implications of the EU AI Act → The five AI governance gaps that leave security teams exposed → Technical controls that can help support compliance
Two CVSS 9.8 flaws affect The Events Calendar up to version 6.17.4. Anonymous attackers can submit crafted Gutenberg markup in event comments and then trigger execution via pending-comment previews. One chain executes OS commands via PHP object injection, while the other resets an administrator password using wp_update_user. Update to 6.17.4.1. Exploitation requires comments enabled on event pages.
ShinyHunters published hundreds of thousands of files stolen from Florida's DAVID vehicle and driver database after alleging the state agency refused to pay a ransom. FLHSMV confirmed that attackers used police credentials stored on a personal device. Leaked ownership records include names, addresses, buyer and seller details, and VINs. Some files also contain Social Security numbers, passports, and immigration documents.
Spain's AEPD received a breach notification involving an automated system. It logged in, searched for flaws, changed personal data, and accessed invoices. Possible causes include a jailbroken model, an exposed test environment, or an unauthorized penetration-testing setup. The regulator calls for faster detection, containment, and response, plus stronger protection for digital identities and credentials.
A coding agent fixed a failing query application by fine-tuning its shared Qwen model. It then merged the update into the default checkpoint, altering later agent and application instances, with held-out query accuracy rising from 0/20 to 20/20. The tuned model reproduced a synthetic API key, email, and address from training data and removed a trained refusal policy. Training tools, weight access, and deployment access increased modification attempts so as to track model lineage, retain training data and evaluations, and require approval before deployment.
Researchers from Akamai discovered that attackers with admin access on a Windows device could abuse SentinelOne's EDR solution to dump protected processes, pivot to Microsoft Defender, and run malicious code in the Protected Process Light (PPL) context. They then extended this research by demonstrating how they could temporarily disable the EDR, move code into the EDR's protected files, run malicious code, and then re-enable the EDR, which would then protect the malicious code as part of its local files. Additionally, they found that cloud communication can be disabled by modifying the local DNS configuration.
When evaluating an LLM-based system to reduce false positives in GitHub secrets scanning, the team faced issues that made benchmarks unrepresentative of production workloads and prevented them from properly evaluating model performance. To combat this problem, the team at GitHub created an LLM evaluation framework. First, teams should define the product decision that the system should support; then teams should make sure that offline experiments use a representative dataset and have only one clearly defined variable; error analysis and LLM-as-judge systems can be used to guide human analysts towards interesting aspects of the evaluation; and then finally the experiment can be promoted to production.
Comp AI provides software for governance, risk, and compliance work. It automates onboarding, evidence collection, policy drafting, control monitoring, and assessments.
logtotal-sanitizer is a framework-agnostic log sanitizer for browsers and Node.js that is designed to sanitize log files before they are sent to third-party platforms for processing, analysis, or troubleshooting.
neEDRe is a toy EDR project that demonstrates how to implement an EDR system using AYA, the Rust eBPF library.
Vercel's two-week sandbox bounty received 1,285 reports and validated 92 findings, including one critical issue. No report accessed customer data. A leading submission chained two Linux networking flaws: one leaked host-kernel memory and another deterministically crashed the host. Patches remain under private review, and CVEs are pending.
Cisco released security updates to address vulnerabilities in its Identity Services Engine, including a maximum-severity authentication bypass. An attacker could exploit the vulnerability to bypass authentication in the web-based management interface by sending a crafted request to affected endpoints. The Cisco PSIRT has identified this vulnerability as actively exploited and urges customers to update immediately.
CISA has published its first-ever guidance on setting up honeypot systems, accounts, and data to distract potential attackers and ultimately help discover them. The guidance comes from internal discussions with CISA threat hunters and pentesters who found that cyber decoys can be a low-cost, high-fidelity way to detect attackers who have gained access to a network.
A New Jersey court transferred 14 Radaris-linked domains to Atlas Data Privacy after defendants missed court deadlines in Daniel's Law litigation.
CVE-2026-89026 lets unauthenticated attackers forge JWT bearer tokens in Issabel Framework.
Prominent Rust maintainers are being lured onto fake job and contract video calls that end with a request to install a missing audio codec or paste a clipboard command.
A human attacker exploited CVE-2026-39987 to achieve pre-authentication remote code execution and harvest cloud credentials from Marimo notebooks. The Sysdig Threat Research Team observed the operator pivot from the vulnerable terminal WebSocket endpoint to an SSH bastion host in eight seconds to access an AWS Secrets Manager SSH key without using large language models. Defenders must focus detection efforts on the shape of the attack chain rather than specific operator fingerprints, because prompt injection traps designed for AI agents failed to identify the human actor.
China-linked UNC3569 used a single crafted link to gain system-level code execution through Sogou Input Method, Tencent's Chinese-language keyboard app used by hundreds of millions of Windows users, and deployed its GrayRabbit backdoor. Gen Threat Labs found that CVE-2026-51990 chained argument injection in the sgbiz protocol handler with a bundled Chromium 80 browser that was six years out of date, ran without a sandbox, and dropped same-origin protections. Tencent patched the injection bug in version 16.3.0.3498, but the outdated Chromium engine behind the chain remained unchanged as of September 10.
CenterPoint Energy confirmed an attacker pulled customer data through an external-facing API on September 12. A hacker using the alias "4d722e4d656f77" claims 7.49 million records, including names, phone numbers, billing addresses, account numbers, payment status, and partial Social Security numbers. The attacker says the API lacked WAF protection, rate limiting, and JWT/auth tokens, and stopped only after a CAPTCHA was added.
JA4 is a TLS fingerprint that shows how a client connects, not just where it connects to. Unlike JA3, part of it is readable, so hunters can see the TLS version, SNI, cipher count, and ALPN at a glance. The post includes KQL queries to pull these values from Entra ID sign-ins and Defender network logs, so teams can learn what normal looks like and spot clients that don't match.
A £3 Z05L WiFi extender uses an MT7620 chip and a four-megabyte Winbond flash. Its firmware starts Telnet on every boot with root password 198277tt@, and the web API accepts requests without session checks, so a mac parameter can reach system() without validation, allowing root command injection. Firmware updates verify CRC32 values only, allowing forged images, and the firewall leaves inbound services exposed on bridged networks as the config partition stores WiFi credentials in plaintext.
CVE-2026-90894 lets a non-admin macOS user gain root through Parallels Desktop's appliance installer. JFrog tested Desktop 26.4.0 build 57513 on Apple Silicon. The root daemon exposes a world-writable Unix socket where an unsigned local process can authenticate through PrlSrv_LoginLocal. A quote in sVmParentPath injects tar's --use-compress-program option, and tar then launches an attacker script as root. Parallels released version 27.0.0 on September 1 to fix this issue.
Sponsored
If you're reading this ad, you know they work. TLDR subscribers make a deliberate choice to open their inbox every weekday. You reach security engineers, CISOs, and infosec leaders at the precise moment they're most receptive to new information shaping their work. Become a TLDR sponsor. [10]
Entrust added Cryptographic Bill of Materials (CBOM) import and export to its Cryptographic Security Platform, so teams can map which systems depend on weak or noncompliant keys and certificates and fix the riskiest first. The update also brings Ansible-based certificate automation, composite algorithms for phased post-quantum migration, and SPIRE support for AI agent and workload identities. The platform now runs as a service or on-premises, which matters as DORA, NIS2, and the recent US Executive Order push for CBOM-based inventories.
Hackuity consolidates vulnerability and asset data from 130+ security products and ranks flaws by severity, exploitability, asset criticality, threat activity, and business impact. Teams can assign and coordinate remediation across security, IT, cloud, and engineering.
vol-rs is a port of the Volatility 3 memory forensics framework from Python to Rust.
WSO2 API Manager CVE-2026-5430 is under active attack. Forged JWTs using unsupported signing algorithms can bypass authentication and grant administrator access in affected deployments, including API Manager 4.1.0–4.6.0, API Control Plane, Traffic Manager, and Universal Gateway. Captured tokens carried admin privileges, and attackers may access backend endpoints, credentials, consumer keys, application secrets, and internal services.
An in-depth guide to how the author decided to reverse-engineer Apple's Find My system to register a Linux device and (consensually) track a friend. The author first started by attempting to use the iCloud web API but quickly discovered that it didn't support Find My. After reversing and fuzzing the flow, the author was able to reproduce the process by: authenticating to Apple's private service, registering the Linux machine as an IDS client, receiving the existing Find My share key, and using it to fetch and decrypt the friend's latest location.
A new AI regulatory framework, the FRONTIER Act, includes a provision that would require third parties to audit the safety of new frontier models. Rep. Josh Gottheimer pushed back and stated that frontier models should instead need to be submitted to the federal government for a short-clocked review cycle before release.
Oracle's September 2026 patch update fixed over 800 vulnerabilities across 17 product families, including more than 100 critical flaws and over 240 exploitable remotely without authentication.
Attackers are exploiting CVE-2026-76461, a 9.8 flaw in Cisco Secure Email Gateway appliances.