Full-text search across article titles and summaries. Refine with sector, year, content type, and reading-time filters.
A botnet named "AyySSHush" has compromised over 9,000 ASUS routers by exploiting CVE-2023-39780 to install persistent SSH backdoors that survive firmware updates, targeting multiple brands like Cisco, D-Link, and Linksys.
Sponsored
Threats against high-profile individuals often start online — but if they go unnoticed, they can escalate into real-world harassment or even physical harm. This threat is growing more urgent at a time when:
MathWorks, creator of MATLAB computing platform, disclosed a ransomware attack that began May 18 that affected customer-facing applications and internal systems. The company has been gradually restoring services with cybersecurity experts' help and has notified federal authorities, but it hasn't revealed which ransomware group was responsible or whether data was stolen.
Adidas disclosed that an unauthorized person stole customer contact information from a third-party customer service provider. The data included names and email addresses of customers who previously contacted support, but excluded passwords and payment information. The company is notifying affected customers and authorities while investigating the breach.
A critical vulnerability in GitHub's MCP integration allows attackers to use prompt injection in public issues to trick coding agents (e.g., Claude) into leaking data from private repositories. This exploit, termed a "toxic agent flow," does not rely on compromised tools but exploits trusted agents' interactions with untrusted external content. The issue requires system-level mitigations—like runtime guardrails and continuous MCP traffic monitoring—since model-level alignment is insufficient to prevent such context-driven attacks.
ReliaQuest has discovered a campaign that uses SEO poisoning to target employee mobile devices for payroll fraud. Attackers create fake company login pages that appear in search results, steal credentials when employees access them, and then redirect paychecks to attacker-controlled accounts. This post dives into the campaign, the attacks, and how they keep evading detection.
RedisRaider is a new Linux malware campaign that scans the internet for public Redis servers running on Linux and then abuses the Redis SET command to inject a cron job. The cron job downloads the RedisRaider binary to /tmp/mysql, makes it executable, and then executes it using nohup. The RedisRaider binary is a heavily obfuscated dropper for a modified version of the XMRig cryptominer that uses a custom packer to further complicate reversing and forensic analysis.
Tailscale can use ACLs to provide zero-trust network access to internal resources. This guide presents and walks through a sample Enterprise ACL and then deep-dives into how ACLs can be written and modified for some common use cases, such as RBAC, secure device access, hybrid infrastructure, and SSH auditing.
secator is a task and workflow runner used for security assessments. It supports dozens of well-known security tools and is designed to improve productivity for pentesters and security researchers.
The top five tools for hacking Active Directory domains are PingCastle, ldapdomaindump, BloodHound & PlumHound, Responder, and HashCat.
azurevelo deploys a Velociraptor container on Azure App Service to aid incident responders.
"Laundry Bear," a Russian state-backed hacker group, breached Dutch police systems in September, accessing all officers' contact details. The group targets Western nations supporting Ukraine, seeking military equipment information.
Two new content-process exploits were demonstrated against Firefox at Pwn2Own 2025, but neither bypassed the browser's sandbox. Mozilla released patched versions the same day and urged users to update immediately. These results reflect recent architectural hardening and reinforce Firefox's security resilience.
macOS's TCC framework blocks unauthorized access to sensitive data, even for malware with root access, but many third-party apps expose vulnerabilities that bypass these protections. A flaw in Cursor.app shows how malware can inherit TCC permissions and access protected files without user knowledge. Developers and vendors often ignore these issues, despite their real threat to user privacy and system integrity.
Zscaler announced its intention to acquire Red Canary, known for Managed Detection and Response (MDR) services, to enhance its integration of artificial intelligence, automation, and human expertise into security.
Cloudflare CEO Matthew Prince warned that LaLiga's broad anti-piracy IP blocks, which target Cloudflare infrastructure, are causing significant collateral damage by disrupting access to critical and legitimate websites, including emergency services in Spain.
An Iranian man has confessed to his involvement in the Robbinhood ransomware attacks that targeted U.S. cities and organizations from 2019 to 2024, stealing data and demanding Bitcoin ransoms.
Sponsored
Have you been handed an IT environment with security gaps you could drive a truck through?
Security researcher Jeremiah Fowler discovered a publicly exposed database that was unencrypted and not password protected, which included over 184M unique logins and passwords. The database contained legitimate credentials for various services such as email providers, Microsoft products, social media accounts, and financial accounts. Fowler contacted the hosting provider, and the database has since been removed.
Socket's threat research team discovered 60 packages on NPM that collect sensitive information about a device and send it to Discord. The malicious packages contain a post-install script that collects hostnames, internal IPs, user home directories, current working directories, usernames, and system DNS servers. Socket did not detect any additional payloads, but reported the packages for removal.
A serious security flaw, CVE-2025-32756, is being used by hackers to attack Fortinet products like FortiMail and FortiCamera. This bug lets attackers run harmful code without logging in by tricking the system with special data.
This AWS blog post explains how to automate incident response for Amazon EKS clusters, highlighting key differences from EC2 response procedures. It covers EKS-specific challenges like pod-to-process mapping, network isolation using cordoning and network policies, and presents a customized automated forensics solution that handles acquisition, isolation, investigation, and reporting for EKS security events.
Neural networks can crack human-chosen passwords by learning from password distributions, making traditional "strong" passwords vulnerable. The solution: abandon human-chosen passwords entirely and use password managers with randomly generated passwords to maintain security.
Attackers can bypass EDR solutions using techniques such as kernel hooking, syscall injections, DLL unhooking, process hollowing, and APC injection to evade detection. Sysmon event IDs 1, 7, 8, 10, 11, and 12 detect these evasion methods by monitoring process creation, DLL loads, thread injection, memory access, file creation, and registry modifications. Combining Sysmon with traditional EDR forms a layered defense, capturing endpoint activities that standard EDRs miss, particularly low-level memory manipulation and kernel-level operations.
SecHub provides a central API to test software with different security tools.
A collection of inspiring lists, manuals, cheatsheets, blogs, hacks, one-liners, cli/web tools, and more.
Micah Lee, a journalist, developed and shared an open-source tool named TeleMessage Explorer to assist journalists in examining leaked data from TeleMessage. This tool processes and visualizes messages, users, and attachments from the compromised dataset. Journalists require special access to the dataset to utilize the tool and reveal significant insights.
American banking groups, led by the ABA, want the SEC to revoke cybersecurity incident disclosure requirements, arguing they conflict with confidential reporting and hinder law enforcement efforts. The groups claim the July 2023 rule creates market confusion and interferes with incident response.
New research from Google Quantum AI indicates that RSA-2048 encryption can be cracked by a quantum computer with one million qubits in one week, needing 20 times fewer qubits than Google's 2019 estimate due to algorithmic improvements. This advancement shortens the timeline for when the current RSA encryption schemes become vulnerable, with experts predicting that quantum computers will break asymmetric cryptography by 2029. Organizations must accelerate post-quantum cryptography adoption immediately, as the multi-year migration timeline means preparation cannot wait, even if quantum attacks are still years away.
Open MPIC is an open-source tool that helps stop BGP hijacking attacks during website certificate checks. It works by checking domain ownership from many places around the world instead of just one. This makes it harder for attackers to trick systems and helps keep internet traffic secure.
Claude 4 helped the Vibe coding tool Lovable reduce syntax errors by 25% and speed up coding by 40%.
YouTube's automated Content ID system has paid $12 billion to rightsholders, with over 90% of copyright claims in 2024 being monetized rather than removed.
Cybercriminals are creating deceptive AI-generated TikTok videos that mislead viewers into executing harmful PowerShell commands, leading to the installation of Vidar or StealC malware instead of legitimate software activation tips.
TLDR readers get $2000 off [4] AND a free custom Arc'teryx jacket.
Sponsored
Is compliance the final boss standing between your startup and the next big enterprise deal?
Hackers broke into Commvault's cloud backup system and stole secret passwords that let them access customers' Microsoft 365 accounts. The attackers used a security flaw to sneak into the system. U.S. cybersecurity officials are helping investigate and have advised companies on how to protect themselves from similar attacks.
Nova Scotia Power confirmed a ransomware attack that started in March affected 280,000 customers. Hackers stole personal data, including names, addresses, billing details, and some bank account numbers, then leaked it online. The power company refused to pay ransom and is offering free credit monitoring to affected customers.
Researchers at DomainTools identified a malware campaign that uses a collection of over 100 malicious websites offering fake VPNs or masquerading as legitimate services to trick users into installing Chrome extensions. The extensions serve different malware variants, such as info stealers and backdoors. DomainTools reported the malicious extensions to Google Chrome, which removed some but not all of them.
This post dives into BadUSB, an attack method introduced in 2014 where hackers reprogram USB device firmware to disguise it as a keyboard. When plugged in, the fake USB device automatically types malicious commands into the computer. Antivirus software cannot detect these attacks since they appear as legitimate keyboard input.
This analysis looks at the macOS "AppleProcessHub" stealer, which was discovered on May 15. It appears as a dynamic library file (libsystd.dylib) but is actually an executable written in Objective-C. The malware employs AES-128 encryption to decrypt hardcoded strings that form the command and control server URL (appleprocesshub[.]com), then downloads and runs a bash script to steal sensitive data like keychain passwords, SSH keys, shell history, and cryptocurrency wallets. The stolen data is compressed and sent to the attacker's server. The malware can run any script on the C2 infrastructure, making it a versatile tool for data exfiltration targeted at macOS users.
This blog post explains how to identify all principals with root-level access in AWS production environments, which organizations rarely audit comprehensively. It provides code snippets to discover AWS accounts, map IAM roles/users with administrative privileges, analyze SSO permissions, and visualize trust relationships that allow privilege escalation through role assumption chains. The analysis reveals that production access often extends beyond intended administrators to include CI/CD pipelines, forgotten legacy roles, and external accounts through overly permissive trust policies, creating massive attack surfaces that most organizations don't realize exist.
Sponsored
AI workloads are tricky for security teams as they often require broader and more flexible permissions. Learn how to enforce fine-grained access control policies for enterprise search, RAG pipelines, and agentic workflows - and why authorization is the
The BreachRx platform is a browser-based workspace for every stakeholder in an organization. It is designed to coordinate and streamline cybersecurity incident response management.
Novops is a cross-platform secret and config manager for development and CI environments.
This ad blocker test site offers three different levels with different categories of ads to test the effectiveness of a browser's ad-blocking protection.
The U.S. government arrested 16 people who created and sold computer viruses called DanaBot. These viruses have stolen passwords and money from over 300,000 computers worldwide since 2018, causing $50 million in damage. The criminals charged $3,000-4,000 monthly for access to their virus software before being caught.
Researchers discovered an alleged Spanish government hacking group called "Careto" that has been secretly spying on other countries since 2007. The hackers mainly targeted Cuba, looking for information about terrorists hiding there. They used very advanced computer viruses to steal passwords, conversations, and government secrets from 31 countries worldwide.