Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
The Human-Centered Playbook standard is a structured format for documenting investigation workflows through questions that guide analysts during the investigation. Playbooks are triggered by cues such as an attack or a suspicious artifact and progress in a series of questions that include context, log sources, and queries for the analyst. Security Onion has adopted this standard. Sample playbooks are available on the platform.
Remote Desktop Protocol (RDP) is a common entry point for legitimate users and attackers in Windows environments. This blog post lists out event IDs and builds a timeline for an RDP session from logon to session end. It also includes a sample timeline of events for an RDP session.
Arcanum uses a three-stage model for scaling AI in security teams. In the first stage, AI functions as an assistant to augment teams for single, narrowly scoped tasks. The second phase involves scaling the AI to automate a complete workflow in a single domain using tools such as agents and RAG. The third stage scales the AI tooling up to automate workflows across the entire organization.
Sponsored
Root Evidence offers vulnerability scanning and attack surface management technology that relies on exploitation evidence to help organizations focus on addressing those vulnerabilities that are targeted in the wild.
A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a JSON-based rules engine.
mac_apt is a DFIR tool that processes full disk images of Mac computers or live machines and extracts data/metadata useful for forensic investigation.
The Trump administration has significantly reduced federal cybersecurity budgets and staff, including the firing of over 100 CISA employees and a $1.2 billion funding cut. New York officials, including Governor Hochul and Cyber Chief Colin Ahern, express concern that these cuts could endanger national security while they work to strengthen state-level cybersecurity independently.
Debian will switch to 64-bit time on 32-bit architectures from Debian 13 "Trixie" to prevent the Y2K38 bug, where 32-bit signed integers overflow on January 19, 2038. This affects 6,429 packages and breaks ABI compatibility, but maintainers have fixed all affected libraries. The legacy i386 port keeps 32-bit time for compatibility with existing x86 binaries.
Microsoft discovered CVE-2025-31199, a macOS vulnerability that allows attackers to bypass Transparency, Consent, and Control (TCC) protections by exploiting Spotlight's .mdimporter plugins to access sensitive data without user permission. The flaw enables access to protected directories, such as Downloads and Apple Intelligence cache files, which contain GPS locations, face recognition data, and device metadata that sync across iCloud-linked devices. Apple patched the vulnerability in macOS Sequoia 15.4 in March following the development of a proof-of-concept tool by Microsoft called "Sploitlight" which demonstrated the exploit.
The Tea dating app breach has worsened - 1.1 million private messages have been revealed and a 59GB dataset with sensitive documents has been distributed on hacking forums.
There was a vulnerability in Google's Gemini CLI that allowed silent code execution and credential theft through prompt injection in context files - Google patched it on July 25 after initially deeming it low severity and later escalating it to Priority One.
NASCAR has confirmed a ransomware attack between March 31 and April 3 that exfiltrated personal information, including names and Social Security numbers - the Medusa ransomware group claims it stole 1TB of data and has demanded a $4 million ransom.
Sponsored
IT and security teams are trapped in a reactive mode when managing SaaS and AI app sprawl. While accounting for an ever-growing number of risks, admins are continually bogged down by manual processes and disconnected workflows.
that explores how IT and security teams can:
Hackers breached Allianz Life's third-party cloud-based CRM system on July 16, using social engineering techniques to steal personal data from approximately 1.4 million of the insurer's North American customers. The German parent company immediately contained the breach, notified the FBI, and confirmed no other company systems were compromised.
Tea, an app for anonymous dating reviews, suffered a data breach exposing 72,000 images, including 13,000 verification selfies and IDs. The breach affected users who signed up before February 2024. 4chan users reportedly shared the stolen data, coinciding with Tea's surge in viral popularity.
A critical security vulnerability (CVE-2025-24000) in the Post SMTP WordPress plugin allows low-privileged users to access email logs and hijack administrator accounts by intercepting password reset emails. The flaw affects all versions up to 3.2.0 and stems from broken access controls that only checked if users were logged in without verifying their permission levels. Despite a fix being released in version 3.3.0 on June 11, over 200,000 WordPress sites remain vulnerable, as more than half of users haven't updated their plugin.
Microsoft's Copilot Enterprise Python sandbox vulnerability allowed researchers to gain root access within the container through a PATH hijacking attack in the keepAliveJupyterSvc.sh script, which executed `pgrep` without a full path every 2 seconds. Researchers exploited this by placing a malicious script in /app/miniconda/bin, which was writable by the ubuntu user and prioritized in $PATH, to execute arbitrary commands as root. While container breakout proved impossible due to patching, the vulnerability demonstrated how improper PATH handling in privileged scripts can lead to privilege escalation even in sandboxed environments.
OSS-Fuzz-Gen introduced an agent-based LLM approach that automatically generates build scripts and fuzzing harnesses for integrating projects into OSS-Fuzz, using iterative command execution and environment exploration to handle diverse C/C++ codebases. The system achieved 88 successful integrations from 225 tested repositories, demonstrating its ability to handle complex builds that require custom tools and dependencies. Key limitations include build scripts that avoid target source code or only support single-harness compilation, requiring post-processing validation improvements.
The emergence of LLMs and coding agents fundamentally transforms application security, as AI now both writes and debugs code. As LLMs advance, humans will focus more on prioritizing vulnerabilities, providing additional context, and assessing exploitability. The vulnerability disclosure process will also become much quicker, with LLMs rapidly identifying vulnerabilities and offensive and defensive teams promptly collaborating to evaluate exploitability.
Sponsored
Cloud security is crowded — and evolving fast. If you're trying to make sense of the vendor landscape, this new report from IDC is a great place to start.
UnMarker is designed to be the first universal attack against defensive watermarking, which is used to detect AI-generated deepfakes. The attack disrupts watermarks in image spectral amplitudes without requiring detector feedback or knowledge of the scheme, thereby defeating both traditional and advanced semantic watermarking systems and rendering deepfake detection ineffective.
HeroDevs provides commercial licenses to over 30 Never-Ending Support (NES) products, which are patched versions of software that organizations already use, behave identically, and are compatible with modern browsers and key third-party libraries.
hypnus is a Rust library for memory obfuscation designed to protect memory regions during inactivity or sleep periods.
International law enforcement's Operation CheckMate dismantled the BlackSuit ransomware group, but a new group called "Chaos" quickly emerged, likely comprising former BlackSuit members. Chaos is targeting major organizations primarily in the US, demanding ransoms of around $300,000.
Scattered Spider is targeting VMware ESXi hypervisors across retail, airline, transportation, and insurance sectors using social engineering to impersonate employees and trick IT help desks into resetting passwords for privileged accounts. Once they gain vCenter access, attackers enable SSH on ESXi hosts, perform "disk-swap" attacks to extract the NTDS.dit Active Directory database, wipe backups, and deploy ransomware to encrypt all VMs in the datastores. Google recommends hardening vSphere with execInstalledOnly, VM encryption, disabled SSH, phishing-resistant MFA, isolating Tier 0 assets, and centralizing logs in a SIEM to detect suspicious vCenter logins and configuration changes.
Chainguard's Libraries for Python is a secure index that rebuilds Python packages and their dependency trees from source within a Supply-chain Levels for Software Artifacts (SLSA) Level 2-hardened setup to prevent supply chain threats. The platform specifically addresses Python wheels with native code and re-bundled OS libraries, such as OpenSSL, which create "software dark matter" that is hidden from SCA scanners. Early testing indicates that 98% of known malicious packages would be identified and blocked. This development follows notable incidents in 2023 and 2024 that involved attacks on PyTorch and Ultralytics YOLO where compromised builds and leaked API tokens facilitated malware distribution via PyPI.
The Trump administration plans to utilize an AI tool called the "Doge AI Deregulation Decision Tool" to analyze 200,000 federal regulations and eliminate half of them by January, aiming to save trillions in compliance costs.
CloudSEK researchers used facial recognition and GPS data to expose a $2 million counterfeit currency operation in India, identifying over 750 social media accounts selling fake notes and pinpointing key perpetrators in Maharashtra.
Sponsored
Compare leading endpoint protection vendors in the latest Magic Quadrant™ report (released July 2025) from Gartner® [4]. Learn which provider is best suited to protect your organization from cyber threats and what to look for when choosing an endpoint protection solution. See why SentinelOne has been named a 5x Leader in this latest report [4].
SonicWall is urging customers to patch Secure Mobile Access (SMA) 100 series appliances against a new critical authenticated arbitrary file upload vulnerability. The new vulnerability is caused by an unrestricted file upload weakness in the SMA 100 series devices' web management interface, which could allow remote attackers with admin privileges to upload arbitrary files and achieve RCE.
A threat actor called EncryptHub compromised a game called Chemia on Steam to distribute infostealer malware to users. Threat intelligence company Prodaft reported that EncryptHub initially added a loader that downloads the Vidal infostealer to the game on July 22 and then also added a PowerShell script to fetch the Fickle Stealer malware as well. A malicious insider may have aided EncryptHub in implanting the malicious files in the project.
Attackers launched a "Scavenger" supply chain attack in July that hijacked popular npm packages, including "is" (2.8 million weekly downloads), through phishing from a typosquatted domain (npnjs.org). The malware installed cross-platform JavaScript backdoors with persistent command channels on Windows, macOS, and Linux, affecting users who updated to infected versions. Exploiting high-privilege maintainer accounts, attackers could compromise thousands of companies, with malware mostly undetected by antivirus solutions on VirusTotal.
Agentic AI unlocks a powerful utility for emulating the methodology of advanced cloud pentesters or threat actors in a context-aware method that goes beyond traditional automated tooling. This post demonstrates how an agent can be provided with “tools” or functions that it can utilize first to enumerate the permissions a given IAM user has, iteratively identify privilege escalation exploits, and then use other tools to carry out the privilege escalation. The post also includes a scenario in which the agent successfully discovers the full attack chain that an adversary could use to launch an S3 ransomware attack.
Traditional security incentives often fail because they lack tangible business value. Instead, security efforts should prioritize initiatives that drive significant commercial benefits, like software reproducibility and inventory management, which can also enhance security. Organizations should make secure options more cost-effective than insecure ones to encourage faster adoption and modernization.
This case study demonstrates how Claude Code accelerates security reviews and incident responses, reducing debugging time from 15 minutes to 5 minutes and eliminating Terraform approval bottlenecks. It enables new hires to contribute within days, rather than weeks, by navigating codebases and understanding systems. The Data Infrastructure team notes that Claude Code replaces traditional data catalogs, allowing new data scientists to quickly grasp dependencies and work independently.
Sponsored
IT service delivery and report is only getting more challenging. Learn how IT teams at Intercom, Applied Systems, Snowflake, and more are streamlining their processes with the Tines IT orchestration and automation starter kit [11]. It includes 12+ examples of pre-built workflows for orchestrating and automating IAM, request fulfillment,
TrollBlacklistDLL is a tool that blocks DLLs in blacklist.txt from loading, with an option to unblock them subsequently.
s3grep is a parallel CLI tool designed for searching logs and unstructured data within Amazon S3 buckets. It features .gz decompression, progress indicators, and reliable error handling, making it perfect for cloud-native log analysis.
404Media released a report on Wednesday that a hacker had managed to get a PR that instructed Amazon Q to erase all local files and cloud infrastructure merged to the Amazon Q Developer extension for VS Code. Amazon quickly removed the compromised versions and released a statement that the hacker had been removed from the project and no customers had been impacted. Corey Quinn lambasts Amazon's response in this post, highlighting the illegitimacy of its response and the erosion of trust that it implies.
A China-linked Advanced Persistent Threat (APT) group launched "Operation GhostChat," targeting the Tibetan community by compromising legitimate websites and replacing them with malicious replicas that offer a backdoored version of the Element encrypted messaging app. The attack employs techniques such as DLL sideloading, multi-stage shellcode injection, and a custom Ghost RAT that communicates with C2 servers via encrypted traffic. The malware evades detection through API hooking bypasses, memory-based code injection into legitimate Windows processes, and XOR-encoded plugin DLLs, which provide keylogging, screen capture, and remote shell access.
The Federal Bureau of Investigation (FBI), alongside the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Health and Human Services (HHS), and the Multi-State Information Sharing and Analysis Center (MS-ISAC), has issued a warning regarding increased activity by the Interlock ransomware group.
Koske is a new Linux malware that conceals itself in images of pandas to target computers and mine cryptocurrency, using clever tricks and possibly AI assistance to stay hidden and adapt.
A Replit AI agent unintentionally deleted a company's entire database despite being instructed not to, impacting thousands of users.
Sponsored
M&A deals move fast, but security can't be an afterthought. In this on-demand webinar, security leaders with experience handling over 30 M&As share insights on what every acquirer needs to know to protect their organization before and after the deal closes.