<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
  <title>AllSec.sh — Cybersecurity News Aggregator</title>
  <link>https://allsec.sh</link>
  <description>Real-time aggregator of cybersecurity news, vulnerability disclosures, and research.</description>
  <language>en-us</language>
  <lastBuildDate>Sun, 05 Apr 2026 16:00:34 GMT</lastBuildDate>
  <atom:link href="https://allsec.sh/rss.xml" rel="self" type="application/rss+xml" />
  
  <item>
    <title><![CDATA[Your Email Gateway Has a Blind Spot. APTs Already Know About It.]]></title>
    <link>https://allsec.sh/story/15cc18b1817f4c</link>
    <guid isPermaLink="false">15cc18b1817f4c</guid>
    <pubDate>Sun, 05 Apr 2026 15:50:11 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://mgx0.bearblog.dev/your-email-gateway-has-a-blind-spot-apts-already-know-about-it/">r/cybersecurity</source>
  </item>
  <item>
    <title><![CDATA[syd doing a full exploit]]></title>
    <link>https://allsec.sh/story/1d747b7f8279ce</link>
    <guid isPermaLink="false">1d747b7f8279ce</guid>
    <pubDate>Sun, 05 Apr 2026 15:29:14 GMT</pubDate>
    <description><![CDATA[We've all been there you run a Nmap scan, get 200 lines of output, then spend 20 minutes cross-referencing CVEs, writing up findings, and figuring out your next move. Multiply that across Nessus exports, Volatility dumps, BloodHound data, PCAP captures, and NetExec results and you're spending more time on analysis than actual testing.

Syd takes all of that off your plate. Paste in your output from any tool Tenable/Nessus scan results, Nmap output, memory dumps, whatever and Syd extracts the facts, identifies the critical findings, maps attack paths, and gives you actionable next steps. What used to take 30-40 minutes of manual analysis takes seconds.

What's in the box:

Syd V3 Pro 6 tools: Nmap, Volatility, BloodHound, YARA, NetExec, PCAP

Syd Enterprise Pro + full Metasploit integration (module browser, exploit launcher with live msfconsole, AI analysis of session output)

Works with output from external tools (Tenable, Nessus, Qualys, etc.) just paste it in

Anti-hallucination pipeline deterministic fact extraction before LLM ever touches the data

RAG-powered knowledge base for each tool

Runs 100% airgapped designed for secure environments

Where Syd really shines is the workflow integration. Run your Tenable scan, export the results, paste them into Syd's Nmap page, and within seconds you've got a prioritised breakdown of every host, service, and vulnerability with recommended next steps and exploit suggestions. Same with BloodHound paste your enumeration data and Syd maps out the AD attack paths for you. It doesn't replace your tools, it makes the time between running them and writing your report almost zero.

More tools coming for Enterprise: Sliver, Responder, Impacket, Burp Suite, Hashcat and so on.Happy to answer any questions or do a walkthrough if anyone's interested.



  📧 [info@sydsec.co.uk](mailto:info@sydsec.co.uk)

  🌐 [https://sydsec.co.uk](https://sydsec.co.uk)]]></description>
    <source url="https://youtu.be/adJPoaNp3rg">r/cybersecurity</source>
  </item>
  <item>
    <title><![CDATA[Hackers exploit React2Shell in automated credential theft campaign]]></title>
    <link>https://allsec.sh/story/14b8c4479d4140</link>
    <guid isPermaLink="false">14b8c4479d4140</guid>
    <pubDate>Sun, 05 Apr 2026 14:17:23 GMT</pubDate>
    <description><![CDATA[Hackers are running a large-scale campaign to steal credentials in an automated way after exploiting React2Shell (CVE-2025-55182) in vulnerable Next.js apps. [...]]]></description>
    <source url="https://www.bleepingcomputer.com/news/security/hackers-exploit-react2shell-in-automated-credential-theft-campaign/">Bleeping Computer</source>
  </item>
  <item>
    <title><![CDATA[Researchers didn’t want to glamorize cybercrims. So they roasted them]]></title>
    <link>https://allsec.sh/story/13dff947f99753</link>
    <guid isPermaLink="false">13dff947f99753</guid>
    <pubDate>Sun, 05 Apr 2026 13:00:13 GMT</pubDate>
    <description><![CDATA[True-crime tales of criminals making fools of themselves interview Cybercrime crews have become almost mystical entities, with security vendors assigning them names like Wizard Spider and Velvet Tempest.…]]></description>
    <source url="https://go.theregister.com/feed/www.theregister.com/2026/04/05/trellix_john_fokker_roasting_crims/">The Register</source>
  </item>
  <item>
    <title><![CDATA[Installing modified APK with Frida Gadget on Android? Testing on my own Android device, I embed Frida Gadget into an APK (Instagram). After modification, install fails or app crashes. What methods allow installing modified APKs? Which Android protections block this? Any tips for test setups?]]></title>
    <link>https://allsec.sh/story/06ea16f40d2c95</link>
    <guid isPermaLink="false">06ea16f40d2c95</guid>
    <pubDate>Sun, 05 Apr 2026 12:39:53 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://frida.re/docs/gadget/">r/ReverseEngineering</source>
  </item>
  <item>
    <title><![CDATA[Inside WannaCry: Exploit, Worming, and TOR Communication Explained]]></title>
    <link>https://allsec.sh/story/017851075c44c4</link>
    <guid isPermaLink="false">017851075c44c4</guid>
    <pubDate>Sun, 05 Apr 2026 12:26:22 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://iss4cf0ng.github.io/2026/04/05/2026-4-5-WannaCryProtocol/">r/ReverseEngineering</source>
  </item>
  <item>
    <title><![CDATA[Built a tool to stop the pain of manual EVTX triage]]></title>
    <link>https://allsec.sh/story/1a7d7e8654a5cc</link>
    <guid isPermaLink="false">1a7d7e8654a5cc</guid>
    <pubDate>Sun, 05 Apr 2026 12:04:57 GMT</pubDate>
    <description><![CDATA[Manual EVTX analysis in Event Viewer is a nightmare during a live incident. I built Sentinel Thread Pro to automate the noise-to-signal process using the Hayabusa engine and a Streamlit UI. It generates a clean, MITRE-mapped forensic timeline in seconds.  
  
It’s completely open source, and I’m looking for feedback from the community to improve the data normalization and detection logic.  
  
GitHub Repo: [https://github.com/Adham504/SentinelThread-Forensics](https://github.com/Adham504/SentinelThread-Forensics)]]></description>
    <source url="https://www.reddit.com/r/cybersecurity/comments/1sd1wh3/built_a_tool_to_stop_the_pain_of_manual_evtx/">r/cybersecurity</source>
  </item>
  <item>
    <title><![CDATA[Block One ASN, Kill Sixteen Malware Families: Mapping OMEGATECH, a Three-Month-Old Bulletproof Hosting Network Running 67 C2 Servers on a Single Subnet]]></title>
    <link>https://allsec.sh/story/1941b50355c8ea</link>
    <guid isPermaLink="false">1941b50355c8ea</guid>
    <pubDate>Sun, 05 Apr 2026 11:27:54 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://intel.breakglass.tech/post/omegatech-bph-as202412-67-c2-servers-16-malware-families-one-subnet">r/blueteamsec</source>
  </item>
  <item>
    <title><![CDATA[GPUBreach: Privilege Escalation Attacks on GPUs using Rowhammer]]></title>
    <link>https://allsec.sh/story/1e6517a1aa47bc</link>
    <guid isPermaLink="false">1e6517a1aa47bc</guid>
    <pubDate>Sun, 05 Apr 2026 11:01:15 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://gpubreach.ca">r/blueteamsec</source>
  </item>
  <item>
    <title><![CDATA[Deployed GOAD-Light on VirtualBox (Ubuntu 24.04) - sharing my guide with the real errors I hit]]></title>
    <link>https://allsec.sh/story/1255cef0adec33</link>
    <guid isPermaLink="false">1255cef0adec33</guid>
    <pubDate>Sun, 05 Apr 2026 10:59:57 GMT</pubDate>
    <description><![CDATA[For those who don't know it, GOAD (Game of Active Directory) is an open-source project by \*\*Orange Cyberdefense\*\* that provisions a fully functional but intentionally vulnerable AD environment: multiple domains, trust relationships, misconfigured delegations, weak ACLs, and more. It's essentially a legal, controlled playground for practicing AD attack chains (Kerberoasting, Pass-the-Hash, DCSync, lateral movement...) and building detection coverage against them.

GOAD-Light is the lightweight version: 3 VMs (DC01, DC02, SRV02) across two domains with a bidirectional trust, running on Windows Server 2016. Manageable on a decent laptop.

I deployed it on VirtualBox + Ubuntu 24.04 and figured I'd document the process properly since the official docs, while solid, can be a bit overwhelming when you're hitting errors at 1am.

The guide covers the full deployment with Ansible, but more importantly it documents the actual errors I ran into:

\\- \\\`NS\\\_ERROR\\\_FAILURE\\\` on Vagrant launch (vboxusers group not reloaded after install)

\\- \\\`couldn't resolve module ansible.windows\\\` (Ansible Galaxy dependency and how to bypass it entirely)

\\- \\\`unreachable=1\\\` on DC01 mid-provisioning (DC rebooting after domain promotion, not a real error, just needs patience)

\\- VM conflicts from previous installs and how to clean them up cleanly

Repo: \[https://github.com/Kjean13/goad-light-deployment\](https://github.com/Kjean13/goad-light-deployment)]]></description>
    <source url="https://www.reddit.com/r/cybersecurity/comments/1sd0qbj/deployed_goadlight_on_virtualbox_ubuntu_2404/">r/cybersecurity</source>
  </item>
  <item>
    <title><![CDATA[Image or Malware? Read until the end and answer in comments :)]]></title>
    <link>https://allsec.sh/story/1f36b3ab944744</link>
    <guid isPermaLink="false">1f36b3ab944744</guid>
    <pubDate>Sun, 05 Apr 2026 10:06:48 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://securityaffairs.com/190358/hacking/image-or-malware-read-until-the-end-and-answer-in-comments.html">r/InfoSecNews</source>
  </item>
  <item>
    <title><![CDATA[Reverse engineering PerimeterX’s new VM]]></title>
    <link>https://allsec.sh/story/10b3a38567553f</link>
    <guid isPermaLink="false">10b3a38567553f</guid>
    <pubDate>Sun, 05 Apr 2026 09:04:14 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://github.com/B9ph0met/px-vm">r/ReverseEngineering</source>
  </item>
  <item>
    <title><![CDATA[The Hack That Exposed Syria’s Sweeping Security Failures]]></title>
    <link>https://allsec.sh/story/05a0e80a4314da</link>
    <guid isPermaLink="false">05a0e80a4314da</guid>
    <pubDate>Sun, 05 Apr 2026 09:00:00 GMT</pubDate>
    <description><![CDATA[When Syrian government accounts were hijacked in March, the breach looked chaotic. But it revealed something more troubling: a state struggling with the most basic layer of cybersecurity.]]></description>
    <source url="https://www.wired.com/story/inside-the-hack-that-exposed-syrias-security-failures/">WIRED</source>
  </item>
  <item>
    <title><![CDATA[The Visible Key — A New Way to Verify Source]]></title>
    <link>https://allsec.sh/story/1b127748a6fe4f</link>
    <guid isPermaLink="false">1b127748a6fe4f</guid>
    <pubDate>Sun, 05 Apr 2026 06:45:42 GMT</pubDate>
    <description><![CDATA[https://open.substack.com/pub/aperceptualdrifter/p/the-visible-key?r=7x5h5j]]></description>
    <source url="https://www.reddit.com/r/cybersecurity/comments/1scwnd9/the_visible_key_a_new_way_to_verify_source/">r/cybersecurity</source>
  </item>
  <item>
    <title><![CDATA[36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants]]></title>
    <link>https://allsec.sh/story/0f1c21d26623ac</link>
    <guid isPermaLink="false">0f1c21d26623ac</guid>
    <pubDate>Sun, 05 Apr 2026 05:07:00 GMT</pubDate>
    <description><![CDATA[Cybersecurity researchers have discovered 36 malicious packages in the npm registry that are disguised as Strapi CMS plugins but come with different payloads to facilitate Redis and PostgreSQL exploitation, deploy reverse shells, harvest credentials, and drop a persistent implant. "Every package contains three files (package.json, index.js, postinstall.js), has no description, repository,]]></description>
    <source url="https://thehackernews.com/2026/04/36-malicious-npm-packages-exploited.html">The Hacker News</source>
  </item>
  <item>
    <title><![CDATA[Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS]]></title>
    <link>https://allsec.sh/story/17f9408163d363</link>
    <guid isPermaLink="false">17f9408163d363</guid>
    <pubDate>Sun, 05 Apr 2026 04:32:00 GMT</pubDate>
    <description><![CDATA[Fortinet has released out-of-band patches for a critical security flaw impacting FortiClient EMS that it said has been exploited in the wild. The vulnerability, tracked as CVE-2026-35616 (CVSS score: 9.1), has been described as a pre-authentication API access bypass leading to privilege escalation. "An improper access control vulnerability [CWE-284] in FortiClient EMS may allow an]]></description>
    <source url="https://thehackernews.com/2026/04/fortinet-patches-actively-exploited-cve.html">The Hacker News</source>
  </item>
  <item>
    <title><![CDATA[Leveraging Wazuh detection and alerting with Clickdetect | Anomaly Detection | Multiple Source Correlation | by Vinicius Morais]]></title>
    <link>https://allsec.sh/story/195eae22d91234</link>
    <guid isPermaLink="false">195eae22d91234</guid>
    <pubDate>Sun, 05 Apr 2026 03:29:10 GMT</pubDate>
    <description><![CDATA[Hello Blueteamsec community! 

I created this post to explain how to improve Wazuh detection using SQL-based detection in Clickhouse (or another compatible data source like loki, victoria logs).

I cover things like Anomaly Detection, Multiple Sources, disconnected agents or agents not sending logs, etc.

I hope you enjoy the post]]></description>
    <source url="https://medium.com/@souzo/leveraging-wazuh-detection-and-alerting-with-clickdetect-anomaly-detection-multple-source-d43f7747bf74">r/blueteamsec</source>
  </item>
  <item>
    <title><![CDATA[Qilin EDR killer infection chain]]></title>
    <link>https://allsec.sh/story/0df350d31be7a6</link>
    <guid isPermaLink="false">0df350d31be7a6</guid>
    <pubDate>Sat, 04 Apr 2026 23:01:43 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://blog.talosintelligence.com/qilin-edr-killer/">r/blueteamsec</source>
  </item>
  <item>
    <title><![CDATA[Autonomous Vulnerability Hunting with MCP]]></title>
    <link>https://allsec.sh/story/1bb112ad3d7e5e</link>
    <guid isPermaLink="false">1bb112ad3d7e5e</guid>
    <pubDate>Sat, 04 Apr 2026 22:49:10 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://blog.zsec.uk/bullyingllms/">r/blueteamsec</source>
  </item>
  <item>
    <title><![CDATA[CTO at NCSC Summary: week ending April 5th]]></title>
    <link>https://allsec.sh/story/1c07ec132dbb1a</link>
    <guid isPermaLink="false">1c07ec132dbb1a</guid>
    <pubDate>Sat, 04 Apr 2026 22:42:16 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-april-36d">r/blueteamsec</source>
  </item>
  <item>
    <title><![CDATA[How I stole AES keys from a microcontroller using power analysis (ChipWhisperer walkthrough)]]></title>
    <link>https://allsec.sh/story/12f0b92d769cbc</link>
    <guid isPermaLink="false">12f0b92d769cbc</guid>
    <pubDate>Sat, 04 Apr 2026 21:48:59 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://iotsec.in/t/the-gap-between-mathematical-security-and-physical-reality/25">r/ReverseEngineering</source>
  </item>
  <item>
    <title><![CDATA[Cisco patched a 9.8/10 CVE yesterday — authentication bypass on IMC that gives full admin access with one HTTP request, no credentials needed]]></title>
    <link>https://allsec.sh/story/1ae253e6e56256</link>
    <guid isPermaLink="false">1ae253e6e56256</guid>
    <pubDate>Sat, 04 Apr 2026 20:41:34 GMT</pubDate>
    <description><![CDATA[CVE-2026-20093 dropped this week and it’s bad.

**Quick breakdown:**

\- Affects Cisco Integrated Management Controller (IMC)—the baseboard management system that runs underneath the OS

\- CVSS 9.8/10: no auth required, remote exploitable, low complexity

\- Attacker sends one crafted HTTP POST to the management interface → resets any user’s password including Admin, leading to full hardware-level control

\- No workarounds exist, firmware update is the only fix

\- No active exploitation confirmed yet but no PoC needed, the attack is trivial

The dangerous part is the attack surface. IMC runs independently of the OS—meaning EDR, SIEM, endpoint hardening are all irrelevant once exploited. Ransomware gangs love BMC-level access because it survives a full OS reinstall.

**Affected:** UCS C-Series M5/M6, E-Series M3/M6, Catalyst 8300, APIC servers, Secure Firewall appliances, Catalyst Center—basically anything built on Cisco UCS.

Audit your IMC user accounts now before patching and if someone already hit you there’ll be a rogue admin account sitting there.

Full breakdown on https://medium.com/@decodingdaily20/cisco-just-patched-a-9-8-10-severity-flaw-that-let-hackers-take-over-servers-without-a-password-7603b0d49271]]></description>
    <source url="https://medium.com/@decodingdaily20/cisco-just-patched-a-9-8-10-severity-flaw-that-let-hackers-take-over-servers-without-a-password-7603b0d49271">r/cybersecurity</source>
  </item>
  <item>
    <title><![CDATA[Axios npm hack used fake Teams error fix to hijack maintainer account]]></title>
    <link>https://allsec.sh/story/0256fcdef79941</link>
    <guid isPermaLink="false">0256fcdef79941</guid>
    <pubDate>Sat, 04 Apr 2026 20:30:42 GMT</pubDate>
    <description><![CDATA[The maintainers of the popular Axios HTTP client have published a detailed post-mortem describing how one of its developers was targeted by a social engineering campaign believed to have been conducted by North Korean threat actors. [...]]]></description>
    <source url="https://www.bleepingcomputer.com/news/security/axios-npm-hack-used-fake-teams-error-fix-to-hijack-maintainer-account/">Bleeping Computer</source>
  </item>
  <item>
    <title><![CDATA[I built a CTF-style AI security game. Looking for feedback from students and professionals]]></title>
    <link>https://allsec.sh/story/0c079641de569a</link>
    <guid isPermaLink="false">0c079641de569a</guid>
    <pubDate>Sat, 04 Apr 2026 20:23:50 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://hack.delphisecurity.ai/">r/ReverseEngineering</source>
  </item>
  <item>
    <title><![CDATA[Analysis of WannaCry]]></title>
    <link>https://allsec.sh/story/0962c054e7a4be</link>
    <guid isPermaLink="false">0962c054e7a4be</guid>
    <pubDate>Sat, 04 Apr 2026 16:26:42 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://iss4cf0ng.github.io/2026/04/03/2026-4-3-WannaCry/">r/ReverseEngineering</source>
  </item>
  <item>
    <title><![CDATA[SERPENTINE#CLOUD returns: ClickFix lure drops five RATs]]></title>
    <link>https://allsec.sh/story/12ed3c18992eeb</link>
    <guid isPermaLink="false">12ed3c18992eeb</guid>
    <pubDate>Sat, 04 Apr 2026 15:27:36 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://www.derp.ca/research/serpentine-cloud-clickfix-return/">r/blueteamsec</source>
  </item>
  <item>
    <title><![CDATA[Segway-Ninebot Mobility App BLE protocol reversing]]></title>
    <link>https://allsec.sh/story/0a506b5449481a</link>
    <guid isPermaLink="false">0a506b5449481a</guid>
    <pubDate>Sat, 04 Apr 2026 14:37:10 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://nootnooot.codeberg.page/segway-ninebot-ble">r/ReverseEngineering</source>
  </item>
  <item>
    <title><![CDATA[Device code phishing attacks surge 37x as new kits spread online]]></title>
    <link>https://allsec.sh/story/0a94985294492b</link>
    <guid isPermaLink="false">0a94985294492b</guid>
    <pubDate>Sat, 04 Apr 2026 14:17:38 GMT</pubDate>
    <description><![CDATA[Device code phishing attacks that abuse the OAuth 2.0 Device Authorization Grant flow to hijack accounts have surged more than 37 times this year. [...]]]></description>
    <source url="https://www.bleepingcomputer.com/news/security/device-code-phishing-attacks-surge-37x-as-new-kits-spread-online/">Bleeping Computer</source>
  </item>
  <item>
    <title><![CDATA[[Fruitfly malware dev] North Royalton hacking suspect released after 9 years in jail]]></title>
    <link>https://allsec.sh/story/11d5d30a6c1749</link>
    <guid isPermaLink="false">11d5d30a6c1749</guid>
    <pubDate>Sat, 04 Apr 2026 14:07:22 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://www.cleveland.com/court-justice/2026/04/north-royalton-hacking-suspect-released-after-9-years-in-jail-awaiting-trial.html">r/blueteamsec</source>
  </item>
  <item>
    <title><![CDATA[Shopee.tw App Reverse Engineer Need]]></title>
    <link>https://allsec.sh/story/133248c46b3753</link>
    <guid isPermaLink="false">133248c46b3753</guid>
    <pubDate>Sat, 04 Apr 2026 13:47:42 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="http://www.shopee.tw">r/ReverseEngineering</source>
  </item>
</channel>
</rss>