Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
Cisco disclosed vulnerabilities (CVE-2025-20188) in IOS XE for Catalyst Wireless Controllers and APs. The vendor indicated that a hard-coded JSON Web Token (JWT) allows unauthenticated remote attackers to upload files, perform path traversal, and execute commands with root privileges. CVE-2025-20188 is only dangerous if the 'Out-of-Band AP Image Download' feature is enabled on the Wireless Controllers.
The Interlock ransomware group has deployed a Remote Access Trojan (RAT) called NodeSnake in attacks on two UK universities over two months. NodeSnake enables attackers to control infected computers, access files, monitor activity, and install additional malware while remaining undetected. It emerged in September 2024 and previously targeted large organizations in North America and Europe. Interlock now focuses on educational institutions and local governments, possibly to steal intellectual property and test new attack methods.
Two race condition vulnerabilities (CVE-2025-5054 and CVE-2025-4598) in Linux dump handlers enable local attackers to steal password hashes and sensitive data from crashed privileged processes. These flaws affect apport in Ubuntu and systemd-coredump in Red Hat and Fedora, allowing attackers to exploit SUID programs via timing attacks that replace crashed processes with malicious ones to access core dumps. Organizations can mitigate risk by disabling core dumps for SUID binaries with "echo 0 > /proc/sys/fs/suid_dumpable" until patches are applied.
Nix enables secure software supply chains by providing verifiable proofs of the sources that produced a final product, removing the need for restrictive air-gapped environments. It tracks all dependencies to their source code through fixed-output derivations and exports these sources, typically a few GB, to an offline system for integrity proof by rebuilding everything from scratch. This method lets developers use modern tools and workflows while ensuring the cryptographic supply chain verification needed by agencies like CISA, BSI, and ANSSI for critical systems.
U.S. authorities have dismantled DanaBot, a Russian malware operation that infected 300,000+ systems and caused $50+ million in damage. The takedown showcased agentic AI's cybersecurity capabilities. Autonomous threat detection and real-time analysis were used to accelerate investigations and enable swift law enforcement action against sophisticated cyber threats.
Even well-configured enterprise Wi-Fi networks that use EAP-TLS can be compromised via wireless pivots targeting trusted devices connecting to untrusted networks outside the corporate perimeter. Attackers capture probe requests from corporate devices, set up rogue access points mimicking home networks (like Thomson routers), crack Wi-Fi passwords via WPA handshake captures, and use tools like Responder to intercept NetNTLM hashes from mDNS/LLMNR broadcasts. Once cracked, these hashes provide internal credentials for accessing cloud services like Office 365, illustrating that the security boundary extends beyond the corporate network to any location where trusted devices connect.
Sponsored
Industrial environments—such as critical infrastructure and manufacturing—face unique threats that IT security training doesn't address. Watch the video [11] to see why specific ICS/OT training is a must. Ready to start? SANS offers hands-on labs with real equipment and instructors who are active in the field today. See available
Envilder is a CLI that securely centralizes your environment variables from AWS SSM as a single source of truth.
PromptMe is an educational project that showcases security vulnerabilities in large language models and their web integrations. It includes 10 hands-on challenges inspired by the OWASP LLM Top 10, demonstrating how these vulnerabilities can be discovered and exploited in real-world scenarios.
Unbound's AI Gateway product connects to commonly used AI tools to surface usage patterns and provide model routing, real-time protection, and usage analytics.
International law enforcement seized AVCheck, one of the largest counter-antivirus services cybercriminals used to test whether their malware could evade commercial antivirus software before deployment. The operation, which involved U.S., Dutch, and other agencies, also took down related crypting services Cryptor.biz and Crypt.guru that helped obfuscate malware to make it undetectable. The takedown was part of Operation Endgame and disrupted a key component of the cybercriminal ecosystem that allowed ransomware groups to refine their attacks against security systems.
German police have identified "Stern," the enigmatic leader of the notorious Trickbot cybercrime cartel, as 36-year-old Russian Vitaly Kovalev. Trickbot attacked thousands of victims, including hospitals, stealing hundreds of millions over six years. Kovalev was previously sanctioned under different aliases, but his connection to "Stern" remained hidden until now.
Meta disrupted propaganda campaigns from Iran, China, and Romania that misled users with fake accounts and AI-generated images.
93.7 billion stolen cookies are for sale online, with 7-9% still active and exploitable by cybercriminals for account access.
Victoria's Secret responded to a cybersecurity incident that disrupted its website and online orders by shutting down its website, pausing some in-store services, and collaborating with third-party experts to restore operations.
UChicago Medicine released a statement that the data of 38K patients may have been exposed in a July 2024 breach. The data breach was caused by a third-party debt collector's system breach. The exposed data may include SSNs, addresses, dates of birth, medical information, and financial account information.
Threat actors are exploiting Google Apps Script to create phishing pages that mimic legitimate sites, enhancing their credibility. This tactic reduces the likelihood of detection by security tools. As a result, users may be more easily deceived into providing sensitive information.
Cisco Talos has discovered three malware families—CyberLock ransomware, Lucky_Gh0$t ransomware, and Numero malware—that disguise themselves as legitimate AI tool installers for ChatGPT, InVideo AI, and NovaLeadsAI. These threats spread through SEO poisoning, social media, and messaging platforms, specifically targeting sales, technology, and marketing businesses. CyberLock demands $50,000 in Monero cryptocurrency, Lucky_Gh0$t encrypts files under 1.2GB while destroying larger ones, and Numero renders Windows systems unusable by interfering with the graphical interface.
Detection-in-depth is a detection engineering concept modeled after the principle of defense-in-depth, in which security teams create detections to catch an attacker at every step of the attack chain. Detections (including out-of-the-box detections that come with a platform) must be fine-tuned to the specific environment to reduce false positives. They should be tested using threat emulation tools such as Atomic Red Team and penetration testing activities.
In a recent engagement, a penetration tester from Neodyme tested a tool that converted HTML to PDF. The tester's first instinct was to attempt Server-Side Request Forgery (SSRF), which they succeeded in doing in a test environment. They then discovered that they could enumerate information about the engine and local files. The tester then found an exploit against the outdated Chromium browser used by the converter to render the HTML and adapted it to obtain shellcode execution on the server.
NETSCOUT analyzed TCP SYN segments from honeypots to identify network security patterns, examining source addresses, IPv4 TTL values, and TCP header lengths. The study found no source address spoofing despite expectations, discovered that TTL values varied widely from the same sources due to path diversity, and identified that many anomalies correlated with crafted packets from suspicious networks. The research demonstrates that analyzing TCP header patterns can effectively distinguish legitimate traffic from potential threats, with 20-byte headers and zero sequence numbers as strong indicators of malicious activity.
Sponsored
A leaked password gave an attacker access to an internal tool—with permissions that reached all the way to production. The root cause? No fine-grained access control. Explore what went wrong—and how to prevent it—with Oso's Nightmares of Authorization series [11].
The SOC Assessment Tool provides a comprehensive assessment tool to evaluate the maturity of a Security Operations Center (SOC). It provides actionable insights upon completion of the assessment.
A LinkedIn post by Ti3rius about 10 “hidden gem” burp extensions he commonly uses, which are not in the top 30 most popular in the BApp Store.
Monkey365 is an open-source security tool designed for conducting security configuration reviews of Microsoft 365, Azure subscriptions, and Microsoft Entra ID. It simplifies the process by eliminating the need to learn complex APIs or admin panels. The tool identifies security gaps and offers recommendations for optimal configuration to enhance the security and effectiveness of your Microsoft 365 tenant or Azure subscription.
This guide shows how to build an internal cheat for the AssaultCube game by injecting a custom DLL into the game's memory. It explains how to hook into game functions like damage and add advanced features such as aimbot and wallhacks. The project is intended to be a technical learning tool for understanding game memory and function hooking.
The U.S. Treasury Department has sanctioned Funnull Technology, a Philippines-based company facilitating numerous malicious websites. These sites are connected to cyber scams that have resulted in over $200 million in losses for Americans. The sanctions aim to disrupt the operations of this company and its role in cybercrime.
Google's Threat Intelligence Group discovered APT41 using the "TOUGHPROGRESS" malware, which exploits Google Calendar for command and control communications. The malware is delivered through spear-phishing emails containing ZIP archives hosted on compromised government websites. To evade detection, the malware uses a three-stage infection chain (PLUSDROP, PLUSINJECT, and TOUGHPROGRESS) with advanced obfuscation techniques, including 64-bit register overflow and control flow obfuscation. Google disrupted the campaign by developing custom detection signatures, terminating attacker-controlled Calendar accounts and Workspace projects, and adding malicious domains to Safe Browsing blocklists.
Microsoft Authenticator will discontinue its password autofill feature in July, prompting users to either export their passwords or switch to Microsoft Edge.
A vulnerability in Apple's Safari browser allows attackers to exploit a fullscreen trick to illicitly acquire user account credentials, prompting users to be cautious with sensitive data entry.
Two parties involved in an AI-generated robocall that mimicked then-President Joe Biden and discouraged voting in the New Hampshire Democratic primary have agreed to settle a civil lawsuit filed by voting groups.
Sponsored
🚨 The industry's average time before a breach is detected is 196 days. Modern threats slip past EDR, EPP, SIEM, and vulnerability scanners by targeting configuration and system changes these tools miss.
* Block tampering—even from admin-level accounts * Rapidly identify Zero-Day Attacks and Advanced Persistent Threats * Maintain continuous, audit-ready compliance (PCI, SOC2, ISO 27001, NIST CSF, & more)
Pakistan's National Cyber Emergency Response Team (NCERT) issued a critical warning urging citizens to change their passwords following a massive global data breach that exposed 184M unique account credentials. NCERT has issued this warning regarding an infostealer database uncovered last week.
Tiffany & Co. confirmed a data breach affecting customers in South Korea after notifying affected customers via email. This attack involved unauthorized access to a vendor platform using customers' data. The exposed data includes names, addresses, phone numbers, email addresses, internal customer ID numbers, and purchase data.
LexisNexis Risk Solutions disclosed a data breach that affected over 364,000 people after a hacker accessed their GitHub account on December 25. Stolen data includes names, Social Security numbers, and driver's license information. The data broker, which profits from collecting consumer information for fraud detection and risk assessment, was notified of the breach on April 1.
AWS honey tokens are AWS Access Keys strategically placed across a system and used as a digital tripwire to determine when an attack has breached the system. The Canarytokens project by Thinkst is an open-source implementation that utilizes two Lambda functions to create a honey token system that notifies users via CloudWatch of any token usage. This project has two drawbacks: it uses an easily identifiable naming scheme for generating tokens, and it only appends a timestamp when the event is received by CloudWatch, which will have a delay that can hamper event correlation.
As proven by the Anthropic report on the malicious uses of Claude, threat actors are increasingly using LLMs to aid in their activities. Prompts should be classified as IoCs, or LLM TTPs. Prompts can be used to construct NOVA threat hunting rules based on possible prompts for the scenarios identified in the Anthropic report.
This post dives into how consulting firms are changing and creating Shadow AI tools to keep up with demand. Consulting firms are experiencing AI-driven layoffs, cutting thousands of jobs, and fearful employees are creating unauthorized "shadow AI" apps using Python and various AI APIs to stay relevant. An estimated 74,500+ shadow AI tools now exist across consulting firms, creating security risks and governance challenges for IT departments.
Cerby automates identity workflows across over 2,000 applications and is used by organizations across sectors such as healthcare, manufacturing, online collaboration, retail, SaaS, streaming, telecommunications, and workplace training.
The NOVA framework is an open-source prompt pattern matching system combining keyword detection, semantic similarity, and LLM-based evaluation to analyze and detect prompt content.
woodpecker is a modular red teaming tool focused on AI and cloud apps. The tool is designed to discover security weaknesses by experimentation.
Following the major breach on South Korea's SK Telecom, the South Korean government has investigated potential hacking attempts targeting major domestic platform service providers. The government had initially asked these companies to conduct voluntary self-assessments after news of the SK Telecom breach first surfaced. However, the Korea Internet & Security Agency will now take over the investigations.
Cybersecurity researchers discovered a flaw in Microsoft's OneDrive File Picker that could allow websites to access users' entire cloud storage instead of just selected files. The issue affects apps like ChatGPT, Slack, and Trello due to overly broad OAuth permissions and vague consent screens. Microsoft acknowledged the problem but hasn't provided a fix yet.
BeyondTrust researchers found that guest users in Microsoft Azure can create and transfer Azure subscriptions, gaining "Owner" privileges without admin approval. Guests with billing authority can use Microsoft's transfer feature to move subscriptions, bypassing normal access controls. Microsoft states this supports multi-tenant scenarios, but enabling it by default poses significant security risks that organizations need to address with subscription policies and guest account audits.
US healthcare conglomerate Kaiser Permanente announced on Wednesday that its systems were experiencing intermittent outages that affected various patient services, including electronic health records.
Pakistan authorities arrested 21 people linked to “Heartsender,” a notorious spam and malware service that aided organized crime for over a decade.