Search the archive

HEWLETT PACKARD ENTERPRISE WARNS OF CRITICAL STOREONCE AUTH BYPASS

Hewlett Packard Enterprise (HPE) has patched eight significant security vulnerabilities in its StoreOnce backup software. A critical flaw enables attackers to bypass login checks and gain system access. HPE recommends that all users promptly upgrade to version 4.3.11 to protect against these issues.

MALICIOUS RUBYGEMS POSE AS FASTLANE TO STEAL TELEGRAM API DATA

Researchers at Socket identified two malicious Ruby gems impersonating the fastlane-plugin-telegram gem, which is used for sending CI/CD updates from Fastlane to a Telegram channel. The typosquatted gems are nearly identical to the legitimate gem except that they redirect Telegram API calls to an attacker-controlled server. Any bot tokens that were used in builds with the malicious gems should be considered compromised.

35K SOLAR POWER SYSTEMS EXPOSED TO THE INTERNET

Cybersecurity researchers at Forescout have discovered that roughly 35k solar power systems are internet exposed. These devices were found by searching on Shodan and many are vulnerable to existing exploits.

HOW I USED O3 TO FIND CVE-2025-37899, A REMOTE ZERO-DAY VULNERABILITY IN THE LINUX KERNEL'S SMB IMPLEMENTATION

A security researcher used OpenAI's o3 model to find CVE-2025-37899, a previously unknown zero-day use-after-free vulnerability in the Linux kernel's SMB implementation (ksmbd). The flaw occurs when one thread frees a session user object while another thread on a concurrent connection is still accessing it, leading to potential kernel memory corruption. This represents the first documented case of an LLM discovering a vulnerability requiring complex reasoning about concurrent execution paths, demonstrating that o3 has achieved a significant breakthrough in automated code analysis capabilities that can be utilized for bug hunting.

PATCHGUARD INTERNALS

PatchGuard (Kernel Patch Protection) is a Windows kernel mitigation introduced in 2005 that monitors critical kernel structures like IDT, GDT, MSRs, and SSDT, triggering a BSOD with error code 0x109 for unauthorized modifications. It employs randomized activation methods, such as timers and hidden DPCs, making its behavior unpredictable and hard to reverse engineer. Bypasses exist through boot-time patches and hypervisor-based rootkits that use Extended Page Tables (EPT) to hide changes, but both require disabling Secure Boot.

THE CLOUD HUNTING GAMES (WEB APP)

The Cloud Hunting Games is a capture-the-flag game developed by Wiz in which players investigate a simulated cloud ransomware attack.

AUTOPWNKEY

AutoPwnKey is a red-teaming framework and testing tool that utilizes AutoHotKey for evasion.

FOSS TOOLS FOR INFRASTRUCTURE TESTING

A collection of open-source tools to test infrastructure. The highlighted tools include DNS tools, SSL/TLS tools, and mail servers.

SMART CARS, DUMB PASSWORDS: AUTO INDUSTRY STILL RUNS ON WEAK PASSWORDS

Many car companies rely on weak and reused passwords like "123456" for system security, making them vulnerable to hackers. This lax security puts smart cars and sensitive company data at risk. Experts recommend stronger passwords, employee training, and multi-factor authentication to enhance protection against cyberattacks.

MICROSOFT WANTS WINDOWS UPDATE TO HANDLE ALL APPS

Microsoft has announced that it is opening up the Windows Update system to developers via a new orchestration platform. Hooking into the Windows Update orchestration platform will allow developers to take advantage of scheduled updates based on user activity, battery status, and even sustainable energy timing. Developers can also make use of the Windows Update notifications.

GOOGLE ADDRESSES 34 HIGH-SEVERITY VULNERABILITIES IN JUNE'S ANDROID SECURITY UPDATE

Google's June Android update fixes 34 high-severity security flaws, including one that could let attackers gain extra control with user help.

THE PATH TO MEMORY SAFETY IS INEVITABLE

Achieving memory safety requires a multi-faceted approach that goes beyond switching to memory safe languages.

Get unlimited pentesting from $1500/month

ThreatSpike Red [4] eliminates the sticker shock. One annual price

covers unlimited penetration testing: red team exercises, API testing, vulnerability scans, infrastructure reviews - everything.

THE NORTH FACE WARNS CUSTOMERS OF APRIL CREDENTIAL STUFFING ATTACK

The North Face says hackers stole customer information in a cyberattack in April. The attack happened because many people reused passwords from other sites. This is the fourth data breach for the company since 2020.

NEW CHROME ZERO-DAY ACTIVELY EXPLOITED; GOOGLE ISSUES EMERGENCY OUT-OF-BAND PATCH

Google released an emergency Chrome update to fix a serious security flaw. The bug, CVE-2025-5419, is already being used by hackers. The vulnerability has been flagged as an out-of-bounds read and write vulnerability in the V8 JavaScript and WebAssembly engine.

ANDROID MALWARE CROCODILUS ADDS FAKE CONTACTS TO SPOOF TRUSTED CALLERS

The Crocodilus Android malware can now add fake contacts to trick users into thinking calls are from trusted people or companies. It has spread worldwide and added new tools to avoid detection and steal better data. Experts warn users to only download apps from trusted sources and use Google Play Protect.

HIGH LEVERAGE SECURITY DECISIONS

A security engineer outlines five crucial decisions for startups to minimize security risks: using an identity provider like Google Workspace or Okta ($6-15/month), implementing hardware security keys for phishing-resistant MFA ($50-75/user), and adopting Infrastructure as Code tools like Terraform for version control. The guide also suggests leveraging managed cloud services such as AWS Fargate and RDS over self-managed VMs, and deploying Mobile Device Management to secure employee endpoints from the outset. The author highlights that significant security improvements stem from operational excellence and strategic tool choices rather than additional security processes or analysts.

DEVOPS TOOLS TARGETED FOR CRYPTOJACKING

Wiz researchers discovered a cryptojacking campaign called "JINX-0132" targeting misconfigured DevOps servers, including Nomad, Consul, Docker, and Gitea. Attackers exploit default settings and vulnerabilities to deploy XMRig miners, avoiding custom malware by using GitHub repositories. The campaign affects 25% of cloud environments, with 5% exposed and 30% misconfigured.

HOW TO DEPLOY AI SAFELY

Microsoft's Deputy CISO for AI outlines key principles for safe AI deployment: understand potential failures and create plans, analyze entire systems, including humans, continuously assess risks, and maintain written safety plans. AI errors are intrinsic—treat AI like "well-intentioned but inexperienced new hires." Emphasize extensive testing over coding time and careful information presentation across human-AI boundaries.

DELEGATIONS

The Delegations tool enables management of all types of Kerberos delegations (unconstrained, constrained, and resource-based) in Active Directory.

SBOMMV

Sbommv is a tool for transferring SBOMs between systems. It is designed to fetch SBOMs from input sources, translate and validate them, enrich metadata, and push them to output destinations.

PASSWORD PUSHER

Securely share sensitive information with automatic expiration and deletion after a set number of views or duration, with full audit logs. Track who, what, and when.

MICROSOFT, CROWDSTRIKE LEAD EFFORT TO MAP THREAT ACTOR NAMES

Microsoft and CrowdStrike are leading an effort to map different names for the same cyber threat groups. This helps security teams better understand and track threats without needing a single standard name. Other companies like Google and Palo Alto Networks are joining to make threat info clearer and more useful.

META AND YANDEX ARE DE-ANONYMIZING ANDROID USERS' WEB BROWSING IDENTIFIERS

Meta and Yandex exploit browser protocols to bypass Android security, linking web browsing to app identities. Their tracking code sends identifiers from websites to Facebook, Instagram, and Yandex apps via localhost ports, de-anonymizing users. Google is investigating this violation of privacy principles. Both companies have confirmed they have paused the practice.

CRYPTOJACKERS CAUGHT MINING MONERO VIA EXPOSED DEVOPS INFRASTRUCTURE

Hackers exploited misconfigured DevOps tools such as HashiCorp Nomad, Consul, Docker, and Gitea to mine Monero cryptocurrency, prompting security experts to emphasize the need for better protection of these tools to prevent future attacks.

BACKDOORS IN PYTHON AND NPM PACKAGES TARGET WINDOWS AND LINUX

Hackers deceived users into downloading malware by creating counterfeit Python and NPM packages that mimicked legitimate software.

ENVIRONMENTAL PROTECTION AGENCY BREACH CLAIMS LACK TEETH, RESEARCHERS SAY

Hackers reportedly stole over 100 GB of data from the EPA, primarily consisting of harmless scientific test results.

Don't miss the next episode

VANTA BUG EXPOSED CUSTOMERS' DATA TO OTHER CUSTOMERS

Vanta experienced a data breach affecting fewer than 4% of its 10,000+ customers due to a product code bug, not an intrusion. The incident exposed employee account data, including names, roles, and security configurations between customer instances. Vanta identified the issue on May 26 and will complete remediation by June 4.

US COMMUNITY BANK SAYS THIEVES DRAINED CUSTOMER DATA THROUGH THIRD-PARTY HOLE

MainStreet Bancshares disclosed that hackers stole data from 4.65% of its customer base through a third-party vendor attack in March. The bank's own systems weren't compromised.

QUALCOMM FIXES THREE ADRENO GPU ZERO-DAYS EXPLOITED IN ATTACKS

Qualcomm has patched three zero-day vulnerabilities in its Adreno GPU driver that are being actively exploited in targeted attacks. CVE-2025-21479 and CVE-2025-21480 cause memory corruption through unauthorized GPU command execution and CVE-2025-27038 is a use-after-free vulnerability in Chrome's graphics rendering. Google's Threat Analysis Group confirmed these vulnerabilities are under limited, targeted exploitation, and Qualcomm provided patches to device manufacturers in May with urgent deployment recommendations. This continues a pattern of Qualcomm chipset vulnerabilities being exploited by threat actors, including a previous zero-day used by Serbian authorities with Cellebrite software to unlock activists' and journalists' Android devices.

BEYOND HTTP: INTERCEPTSUITE FOR TCP/TLS TRAFFIC INTERCEPTION IN WINDOWS

InterceptSuite is a Windows network traffic analysis tool that intercepts and decrypts any TCP/TLS protocol communications, not just HTTP/HTTPS like existing tools. Built with C/OpenSSL and C#/.NET, it operates as a SOCKS5 proxy enabling real-time viewing and modification of encrypted traffic for security testing and application debugging. This blog dives into it and how it can be used.

GETTING THE MOST VALUE OUT OF THE OSCP: AFTER THE EXAM

This is a guide on maximizing value from the OSCP certification journey post-exam. It focuses on three actions: reflecting on exam performance to pinpoint weaknesses for targeted study plans, networking with professionals and peers via Discord servers and cybersecurity communities, and reassessing career goals to decide next steps. The author recommends a structured retrospective approach that includes data collection (timeline reconstruction and machine breakdowns), analysis (identifying operational hurdles and technical gaps), and reconstruction (developing focused practice plans and strategies). For new professionals, it suggests taking a break, updating resumes, exploring advanced topics like web applications or Active Directory, and considering related fields such as DevSecOps, SOC analysis, or detection engineering based on personal interests.

THREAT GROUP ASSESSMENT: MUDDLED LIBRA (UPDATED MAY 16, 2025)

Muddled Libra, a threat group specializing in social engineering attacks using the 0ktapus phishing kit, targets organizations in software automation, BPO, telecommunications, and technology, particularly large outsourcing firms for high-value cryptocurrency institutions. The group shows deep knowledge of enterprise IT systems and utilizes a comprehensive toolkit, including smishing, MFA bombing, help desk social engineering, and commercial remote monitoring tools to maintain access and evade detection. Its main goal is data theft for supply chain attacks, leveraging stolen information from initial victims to infiltrate downstream customer environments.

WITNESS

Witness is a pluggable framework for software supply chain risk management. It automates, normalizes, and verifies software artifact provenance.

CRADLE

Cradle is a cutting-edge open-source threat intelligence platform created by Prodaft and designed for collaborative analysis, visualization of entities and relationships, and report generation. The Cradle platform can be deployed using Docker and Compose, comprising a Python and Django backend, with an Electron and React frontend. It employs Redis and Postgres as its data storage solutions.

MARKITDOWN

MarkItDown is a lightweight Python tool designed to convert various files into Markdown format for use with LLMs and text analysis workflows. It is most comparable to textract, but specifically aims to maintain key document structures and content in Markdown (such as headings, lists, tables, links, etc). Although the output is generally presentable and user-friendly, it is primarily intended for text analysis tools, and may not be ideal for high-fidelity document conversions intended for human readers.

‘RUSSIAN MARKET' EMERGES AS A GO-TO SHOP FOR STOLEN CREDENTIALS

The "Russian Market" cybercrime marketplace has become a leading platform for buying and selling stolen credentials, with logs available for as low as $2 and containing data from information-stealing malware, including passwords, session cookies, and credit card details. The marketplace has grown significantly following the takedown of Genesis Market, with 61% of stolen logs containing enterprise SaaS credentials from platforms like Google Workspace and Salesforce, and 77% including single sign-on credentials. Lumma stealer previously dominated 92% of the market but faces disruption from recent law enforcement actions, while a new stealer called Acreed is rapidly gaining traction with over 4,000 logs uploaded in its first week.

CARTIER DISCLOSES DATA BREACH AMID FASHION BRAND CYBERATTACKS

Cartier reported a data breach where hackers accessed customer information, including names, emails, and countries. However, no passwords or payment details were compromised. Other fashion brands like Dior and Adidas have experienced similar cyberattacks recently.

TRUMP BUDGET PROPOSAL WOULD SLASH MORE THAN 1,000 CISA JOBS

The fiscal 2026 budget proposal from President Donald Trump would cut the Cybersecurity and Infrastructure Security Agency workforce by eliminating 1,083 positions and reducing its budget by $495 million to $2.4 billion. This cut is slightly deeper than earlier forecasts. A new document from the Department of Homeland Security details the CISA personnel reductions and shows planned decreases in other federal cybersecurity programs.

AUSTRALIA BEGINS NEW RANSOMWARE PAYMENT DISCLOSURE RULES

Australia implemented the world's first mandatory ransomware payment disclosure rules in May, requiring organizations with AUS$3 million+ annual turnover to report payments to authorities within 72 hours.

GOOGLE CHROME TO DISTRUST CHUNGHWA TELECOM, NETLOCK CERTIFICATES IN AUGUST

Google Chrome will stop trusting SSL/TLS certificates from Chunghwa Telecom and Netlock starting August 1 (Chrome version 139) due to ongoing compliance failures and broken improvement commitments.

PREINSTALLED APPS ON ULEFONE, KRÜGER&MATZ PHONES LET ANY APP RESET DEVICE, STEAL PIN

Certain Ulefone and Krüger&Matz phones have security flaws in preinstalled apps, allowing any app to reset the phone, steal PIN codes, or misuse system functions.