Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors. The vast majority of the targets are located in Brazil, Bolivia, China, Canada, and Vietnam. Details of the threat activity came to light following the discovery of an open
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 12:41 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
Latest
Monday, August 24
More than 200 vulnerabilities have been patched to date this year, compared to only 16 in 2025 and 22 in 2024. [https://www.securityweek.com/91-vulnerabilities-patched-in-spring-application-framework/](https://www.securityweek.com/91-vulnerabilities-patched-in-spring-application-framework/)
If your developers are using AI coding tools, you are probably already seeing the upside: faster development, more code, and less time spent on routine work. The harder part is what comes after. AI can also introduce open-source packages at a pace your security team was never built to handle. More dependencies mean more vulnerabilities to review, more remediation work, and a backlog that can
Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. The vulnerability, assigned the CVE identifier CVE-2026-18963, is rated 9.1 on the CVSS scoring system by Red Hat, which acts as
Cybersecurity researchers have flagged a cyber espionage campaign targeting Myanmar that uses graduation ceremony invitation lures to deliver a Go backdoor called QUICAgent. The campaign, codenamed Operation QUICSILVER, has been found to target government and information technology sectors, per Seqrite Labs. The activity is assessed to be the work of a China-nexus threat actor with moderate
Big security risks come in small packages. While enterprise security teams focus on policing the proliferation of employees using ChatGPT and Claude for quick drafting tasks, a more urgent threat is posed by a handful of AI super-adopters who are quietly hardcoding unvetted tools into critical business operations. According to new research published by Akamai, the top 5% of enterprise power
This one static-analysis flag ("ENPT unsorted") predicts a *real* runtime failure -GetProcAddress returning "not found" for a function that's actually there
**TL;DR:** An export whose name-pointer table is out of order will `LoadLibrary` fine, show up in your tools, and still fail `GetProcAddress` **by name** with `ERROR_PROC_NOT_FOUND (127)`, while resolving perfectly **by ordinal**. Most PE tools won't warn you. IOCX's `export_name_pointer_table_unsorted` flag does, and I can show it maps 1:1 to the runtime break. Tested on Win10 LTSC 26200 x64. # The setup The PE Export Name Pointer Table (ENPT) is required by the PE/COFF spec to be sorted *specifically so* `GetProcAddress` can binary-search it. The spec says names are compared as **byte sequences**, however Windows doesn't *enforce* that ordering when it maps a DLL. The image loads, tools list the exports and everything looks normal. But `GetProcAddress` name lookup is a **byte-wise binary search with no linear fallback**. If a name is in the wrong slot, the search walks straight past it and returns NULL. The function is physically present in the file - you can still reach it by ordinal - but it's **unreachable by name**. That's a dangerous gap for defenders: static tools say "here are the exports," dynamic-by-name resolution says "doesn't exist," and the two disagree on a file that loads cleanly. # The exact fixture Minimal DLL, three exports, ENPT bytes rotated so on-disk order is `gamma, alpha, beta` (mapping preserved; gamma is still ordinal 3). `dumpbin /exports` confirms the physical order: ordinal hint RVA name 3 0 00001020 gamma 1 1 00001000 alpha 2 2 00001010 beta All three present, their ordinals intact, the table is unsorted. # The runtime result LoadLibraryEx: OK (module mapped) by name alpha : OK (...1000) by name beta : OK (...1010) by name gamma : FAIL GetLastError=127 <-- ERROR_PROC_NOT_FOUND by ordinal #3 : OK (...1020) <-- same gamma, resolved by ordinal `gamma` is right there in the file: * By name → 127 * By ordinal → resolves fine. The binary search for "gamma" probes index 1 (`alpha`) then index 2 (`beta`), both sort lower, and it never looks at index 0 where `gamma` actually sits. # Which tools catch it I ran four PE tools + the loader against single-anomaly fixtures. Only **one** flags the ordering: * **dumpbin**: faithfully echoes the unsorted order, no warning. Great as an order oracle, limited as a validator. * **pefile**: didn't even reach the export dir on these (separate `NumberOfRvaAndSizes` quirk); no ordering signal. * **Ghidra**: parses fine, but its symbol model lists exports in *address* order, so the ENPT ordering is discarded before you ever see it. The anomaly is invisible unless you walk `AddressOfNames` yourself. * **IOCX (v0.7.5)**: the only tool in the pool that actually validates ENPT ordering. Its `export_name_pointer_table_unsorted` heuristic flagged exactly the fixtures that break at runtime and cleared the ones that don't. **This is the one to add to your pipeline** if you want this class of malformation surfaced automatically. # IOCX predicts the runtime failure I proved IOCX is applying the *same comparison rule as the loader* using a matched pair of fixtures engineered to disagree; each is sorted under one comparison rule and unsorted under the other: * `alpha, Beta, gamma`: unsorted **byte-wise** (capital B, 0x42, sorts before lowercase a, 0x61), but sorted if you case-fold. * `Zeta, alpha`: sorted **byte-wise** (Z, 0x5A, sorts before a, 0x61), but unsorted if you case-fold. That gives a clean truth table: the two rules produce **opposite** verdicts on each fixture, so a tool's answers on just these two files uniquely identify its comparison rule. IOCX flagged the first and cleared the second, therefore it's **byte-wise**, ruling out case-folding. The loader breaks on the first and not the second; **also byte-wise**. Same rule, so IOCX's flag is a genuine predictor: **the fixtures it flags are exactly the ones where** `GetProcAddress` **fails by name.** # Detection / hardening takeaways * **Add ENPT-sortedness (byte-wise) to your PE triage; IOCX (v0.7.5) does this out of the box** via its `export_name_pointer_table_unsorted` heuristic. If you'd rather build it into your own tooling, it's a \~15-line check (below): walk `AddressOfNames`, `memcmp` adjacent name strings, flag the first descending pair. * **Treat "loads + lists exports" as insufficient.** A file can map, enumerate cleanly, and still have name-unreachable exports. Cross-check name resolution against ordinal resolution if you're validating. * **Watch for the evasion angle:** an unsorted ENPT can make a specific dangerous export invisible to naive name-based static hooks while the loader still resolves it by ordinal. If your instrumentation keys on export *names*, that's a blind spot. * **Don't trust the disassembler's export list for ordering questions.** Address-ordered symbol models (e.g. Ghidra) discard the on-disk ENPT order; you have to walk the raw table. # Roll-your-own version (if you can't drop IOCX into a given pipeline) This walks the export name table **in on-disk order** and flags the first pair that's out of order under a byte-wise compare; the same rule IOCX and the loader use. \~15 lines, `pefile` only: #!/usr/bin/env python3 # Byte-wise ENPT-sortedness check: flags exports that may fail GetProcAddress by name. # Usage: python enpt_check.py suspect.dll [more.dll ...] (pip install pefile) import sys, pefile def check_enpt(path): pe = pefile.PE(path, fast_load=True) pe.parse_data_directories( directories=[pefile.DIRECTORY_ENTRY['IMAGE_DIRECTORY_ENTRY_EXPORT']]) if not hasattr(pe, "DIRECTORY_ENTRY_EXPORT"): print(f"{path}: no export directory"); return # Names in physical ENPT order (as the loader binary-searches them). # NOTE: use the export symbol order here, NOT an address-sorted view. names = [s.name for s in pe.DIRECTORY_ENTRY_EXPORT.symbols if s.name] for i in range(1, len(names)): if names[i-1] > names[i]: # bytes compare == unsigned/byte-wise print(f"{path}: ENPT UNSORTED at #{i}: " f"{names[i-1].decode()!r} > {names[i].decode()!r} " f"-> GetProcAddress may fail by name (ordinal still works)") return print(f"{path}: ENPT sorted (byte-wise) OK") if __name__ == "__main__": for p in sys.argv[1:]: check_enpt(p) **Two things that matter for correctness:** * **Compare** `bytes`, not `str`. In Python, comparing `bytes` objects is an unsigned byte-wise compare, exactly `memcmp`/`strcmp` semantics, which is what the loader does. If you decode to `str` first and your runtime does locale/Unicode-aware comparison, you can silently reproduce the *case-folding* bug you're trying to detect. Keep it in bytes. * **Don't feed it an address-sorted export list.** Some tooling hands you exports in address order (Ghidra's symbol model does). That throws away the on-disk ENPT order and this check becomes meaningless. Walk the name-pointer table as-is. **C equivalent** (if you're checking in a loader/agent context), the core is just: // prev, cur = consecutive export name strings in ENPT order if (strcmp(prev, cur) > 0) { // ENPT unsorted at this pair -> GetProcAddress may fail by name } Verified against the fixture set: flags `149 (gamma,alpha,beta)` and `150 (alpha,Beta,gamma)`, clears the control and `151 (Zeta,alpha)`; i.e. it lights up on exactly the files where name resolution actually breaks at runtime, and stays quiet on the byte-wise-sorted ones. One thing to note for hostile-file triage: on files with the `NumberOfRvaAndSizes` quirk mentioned above, `pefile` may not populate `DIRECTORY_ENTRY_EXPORT` at all, so "no export directory" isn't always "no exports," it can be "parser bailed early." For adversarial input you'd want a raw directory walk rather than trusting the library. # Caveats * None of the *loader* behaviour here is new, it's spec-implied and long known to RE folks; the no-fallback consequence I measured directly rather than read in docs (the `GetProcAddress` docs are actually silent on name-lookup and I've raised a PR with Microsoft to address this gap). * The detection isn't novel either: **IOCX already ships the** `export_name_pointer_table_unsorted` **heuristic**; the contribution is showing that flag *predicts a real* `GetProcAddress` *name-resolution failure* via the matched discriminator pair, rather than just correlating with "something looks off." * Results are on one OS build (Win10 LTSC 26200); a future loader *could* add a fallback without breaking spec. * By-ordinal resolution works throughout, so the export isn't "gone," it's specifically **name-unreachable**. That distinction matters if you're writing detections. Happy to share the minimal repro (stock MSVC + a tiny post-link ENPT patcher) if there's interest. It rebuilds the whole thing in three commands. [Github: IOCX v0.7.5](https://github.com/iocx-dev/iocx/tree/v0.7.5)
Proofpoint catches malicious traffic and blocks data exfiltration well, with solid coverage for business email compromise, phishing, and malware. But it’s built for the enterprise, and it shows. G2 reviewers flagged a steep learning curve and steep pricing, and suggested Proofpoint’s support would need improving. The platform’s also in flux. Proofpoint closed a $1.8 billion […] The post 9 Proofpoint alternatives. Pros & cons of the leading options appeared first on Heimdal Security Blog .
Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that's targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors. The vast majority of the targets are located in Brazil, Bolivia, China, Canada, and Vietnam. Details of the threat activity came to light following the discovery of an open
To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the [Reverse Engineering StackExchange](http://reverseengineering.stackexchange.com/). See also /r/AskReverseEngineering.
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite I genuinely think I've nailed the IoT door lock situation! Well, Ubiquiti has, but I think I've worked out how to put it all into a residential house and have it make sense. There are a few basic tenets: Main power (never have to rely on batteries) Fail-secure (needs to remain locked on power outage) Local control (no cloud latency to contend with) Manual override ("the house is on fire, let me out") Which is exactly what we have here in this week's vid (and sorry about the section of rubbish audio; the camera mic started capturing it for a short period there). There are some edge cases I want to validate the impact of, namely the inability to keep the door both closed and unlocked, and some of the assumptions I've made around access methods. The laundry will be our low-impact test case; then, if that's all good, I'll start rolling this approach out much more seriously across the house. Stay tuned, I think this will actually be pretty awesome.
I need critical evaluation . Look at this project tell me what he need , what i should remove ......
Sunday, August 23
Got tired of rebuilding the same bookmarks every time I needed a specific category (recon, wireless, forensics, RE, etc.), so I put it all in one indexed repo instead. Organized by phase, short blurb per tool, links back to original maintainers — not hosting anything myself. Still adding stuff, so if something's missing or miscategorized let me know. [https://git.projectnightcrawler.dev/Ori0nRi3el/Researcher-Tools-kit](https://git.projectnightcrawler.dev/Ori0nRi3el/Researcher-Tools-kit)
Head Mare transforma servidores TrueConf em plataformas de distribuição de malware; campanha HelloNet abusa do ViPNet
Recent attacks reveal a problem that goes far beyond a vulnerability: when a company's legitimate infrastructure starts distributing the attacker's code, the trust chain itself turns into a weapon. [Head Mare transforma servidores TrueConf em plataformas de distribuição de malware; campanha HelloNet abusa do ViPNet – setupraiz.com.br](https://setupraiz.com.br/head-mare-transforma-servidores-trueconf-em-plataformas-de-distribuicao-de-malware-campanha-hellonet-abusa-do-vipnet/)
A Linux system-call monitoring and behavioral security analysis tool combining ptrace-based tracing, lightweight namespace isolation, and machine learning classification.
Reverse engineered WoW 3.3.5a's client binary to raise the 25-quest-log cap to 50 — full writeup + patch
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite Today, we welcome the 48th government onboarded to Have I Been Pwned’s free gov service: Sri Lanka. Sri Lanka CERT now has access to monitor Sri Lankan government domains against the data in HIBP, helping identify exposed government accounts and respond when they appear in new data breaches. As with the other governments already using the service, this is about using breach data for good: giving national cyber teams practical visibility into their public sector exposure and supporting their work to protect government services.
Saturday, August 22
The U.S. Department of Justice (DoJ) announced on Friday that ByteDance-owned TikTok will pay $400 million to settle a 2024 lawsuit accusing the company of violating child privacy laws in the country. As part of the settlement, the social media platform will pay $300 million immediately, and an additional $100 million "upon entry of an order vacating a prior consent decree entered against
Plus: Apple sends out an “unprecedented” number of spyware warnings, Ukraine hits a Russian ecommerce giant with cyber and drone attacks, and more.
Friday, August 21
We’re constantly building for the different goals of our customers. Some customers want to optimize for discovery, while others want to protect their content with the strictest security policy. Among these differing policies, there are multiple ways to mitigate bot traffic. Some mechanisms simply state your preference, assuming best intent from crawlers, and other approaches actually lock down content by outright blocking with a Bot Management solution. We recognize that it's cumbersome to maintain multiple layers of protection on your website. For example, there are cases in which your robots.txt states that a crawler is Disallowed from accessing your website, while your enforcement rules actually don’t block that crawler. When your stated preferences and your enforced rules disagree, some crawlers treat it as a basis to disregard your preferences or try to bypass your enforced rules. A couple of years ago, Cloudflare announced an easier way to disallow AI training on your website by tackling two of these layers: a managed value of robots.txt that told a fixed list of major Training crawlers not to train on your content, along with edge-enforced blocks to Training crawlers. On July 1, 2026, we launched easier options to manage different kinds of AI traffic use cases. You can say what you want to do about Search, Agent, and Training traffic on your website. We're announcing Bot Preference Sync , available to all customers from the Free tier to Enterprise. Bot Preference Sync reflects what you've set in your AI bot configuration by updating corresponding preferences to your robots.txt, and it can be turned on or off at any time. No more static file for one use case: we'll help you tailor your robots.txt to reflect what you’ve already configured for different AI bot categories . New questions facing the Internet For years, the most pressing question in this space was: "
Reverse-engineered a gaming mouse’s HID protocol to bring it to Linux (beta out, some pieces still unsolved)
Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4.0. "When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process," TrendAI, Trend Micro's
Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine. The driver, BTR.sys (Boot Time Removal Tool), is a
Cybersecurity researchers have flagged a new malware family that's specifically designed to infect Android-based vehicle head unit firmware developed by DoFun. Kaspersky, which discovered the threat in June 2026, said the end goal of the malware is to serve a multi-stage downloader to enable ad fraud and creation of a proxy botnet. "The malware spread through the built-in updaters of
Overview The Calix GS7 XGS GS5239XG router running firmware EXOS/6.6.47 contains a missing authentication vulnerability that exposes its UPnP (Universal Plug and Play) WANIPConnection service on the public WAN interface. Description Calix GS7 XGS GS5239XG is a residential gateway that provides routing, NAT, and firewall functionality for home networks. The device includes the Universal Plug and Play (UPnP) service implemented via MiniUPnPd 2.3.7, a lightweight software program that provides features such as automatic port forwarding for applications and devices on the LAN. By default, the UPnP service is exposed on the device’s WAN interface and does not require authentication. CVE-2026-75501 In affected firmware versions, the router binds its UPnP WANIPConnection SOAP service to the public WAN interface on TCP port 5000. Because the service does not require authentication when accepting SOAP requests, a remote attacker can obtain full access to the router’s critical UPnP functions including adding, deleting, and enumerating NAT port mappings. Impact CVE-2026-75501 enables an unauthenticated, remote attacker to remotely query and manipulate existing NAT mappings. By exploiting this vulnerability to create arbitrary port-forwarding rules on the router, an attacker can bypass NAT and firewall protections, exposing internal LAN devices to the public internet. Because the Calix router is typically provisioned with its default UPnP-enabled configuration, this issue poses significant risk to residential users with network-connected internal devices such as security cameras, network-attached storage (NAS), and other IoT appliances. Solution Unfortunately, the CERT/CC was
Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns hidden within large datasets, and support faster decision-making. Cybersecurity has experienced a similar transformation. While attackers employ AI to automate
Cisco has published another round of security updates for Crosswork platforms and Secure Workload Software as part of a continued comprehensive internal security review. Four of the security vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning, regardless of the device configuration. A brief description of each of the flaws is below -
A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-19478 (CVSS score: 9.4), a case of code injection that allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite their data under certain conditions without requiring
Update: The story was updated after publication to note that the vulnerability has not been exploited. Although the security bulletin originally marked the "Exploited" field under the Exploitability Assessment table as "Yes," on August 21, 2026, Microsoft corrected the "Exploited" status to "No" after The Hacker News contacted the company for comment. It also noted, "this vulnerability was not
Thursday, August 20
The Rust Project has deleted malicious versions of three widely used Rust crates from crates.io after a compromised maintainer account published releases that added a typosquatted dependency whose build script downloaded and executed a remote payload during compilation. The affected releases are arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, all published from the same owner
This week on “Uncanny Valley,” Andy Greenberg discusses sitting in on a war game simulating a cyberattack from the Chinese hacking group Volt Typhoon
Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S. These clusters include UNC6293, UNC7005, and UNC5976. "These clusters engage in persistent, adaptive
A lot of this week’s trouble starts with something trusted doing exactly what it was allowed to do. Signed drivers get turned against defenses. Legitimate apps help malware blend in. A weak header check opens a path to code execution. Elsewhere, exposed systems, old bugs, odd hiding tricks, and AI-assisted exploit research keep lowering the effort needed to cause damage. Nothing here needs
Since June, developers have created thousands of third-party OAuth apps on Cloudflare , with more than a million authorizations since. OAuth makes delegated access possible. It lets applications act on a user’s behalf without asking them to handle long-lived credentials or hand over a password. That model works well when an application can describe its access needs with a small set of scopes. Developers use OAuth for SaaS integrations, internal tools, CLIs, and agents. Our permission model has become more granular over time to support better scoping of these different workflows. That is great for security, but it makes a purely all-or-nothing consent screen hard to justify. Cloudflare OAuth already allows clients to request a subset of their configured scopes. But once the client made that request, the user could not narrow it any further on the consent screen. For the user on the consent screen, the experience was still an all-or-nothing one. If an application requested more access than a user was comfortable granting, their only options were to approve the full request, or deny outright. MCP servers are a good example of this. An MCP server might request a broad set of permissions, because in theory an agent could use all of them. But most users would not want an agent to have that much access. Before this feature, the only way to handle this was for the app developer to build a custom scope selection screen before sending the user to our consent flow. Today, we’re introducing OAuth scope customization. Client owners can mark specific scopes as optional when configuring an OAuth client, giving users the ability to grant a narrower subset of an application’s requested access at authorization time. The OAuth spec already allows authorization servers to grant a narrower set of scopes than wh
The U.S. government on Wednesday warned of an "active threat" targeting critical infrastructure organizations in the country using artificial intelligence (AI)-generated exploit scripts. The activity is targeting Siemens S7 SeriesProgrammable Logic Controllers (PLCs) to conduct reconnaissance and capability development using AI-generated scripts disguised as legitimate monitoring tools. That
Adversa AI has disclosed an attack technique that it says can cause xAI's Grok chatbot to send a user's name, approximate location, subscription tier, and the prompts from the ongoing conversation to an attacker-controlled server after the user asks it to summarize an ordinary web page. The AI security company, which has codenamed the technique "Cryptographic Context Injection," said the
Most enterprises should treat annual penetration testing as a baseline, not a complete answer. PCI DSS is the one framework with an explicit annual and change-triggered mandate. SOC 2, the current HIPAA Security Rule, and ISO 27001 all expect testing to follow the organization's own risk assessment and control design, not one fixed calendar date. HHS has proposed an annual HIPAA pentesting requirement, but that rule has not been finalized. Enterprises that combine a formal annual assessment with change-triggered and continuous validation stay ahead of frameworks that were never designed around a single testing frequency. The post How Often Should Enterprises Run a Penetration Test? appeared first on Synack .
Cybersecurity researchers have disclosed a critical security flaw in isolated-vm, a popular open-source sandbox with more than 2,900 stars and 190 forks on GitHub, that could allow attackers to escape the confines of the isolated environment. The vulnerability ("GHSA-864f-rcv7-6rh4"), which has yet to be assigned a CVE identifier, impacts all versions of the library before and including 7.0.0.
N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it
Datadog Security Research executed a newer N4D Mesh Controller sample in isolated microVMs, uncovering rotated infrastructure, a UPX-packed go-titan agent, MCP tool abuse in action, and direct runtime evidence of multi-service scanning and persistence.
Wednesday, August 19
strip --strip-all a binary and this still names functions by micro-executing them and matching the effect trace against a corpus. spot check: zlib corpus vs a fully stripped O0 build, it named 9 functions and all 9 were right, and it stays quiet on the ones it isn't sure about (no confident garbage on thunks). where byte sigs (FLIRT) die on recompile and CFG diffing gets fragile across opt levels, behavior holds up better. optimized-vs-optimized is still the hard case, i'm honest about that in the numbers. x86-64 only atm. [https://github.com/1rhino2/fnprint](https://github.com/1rhino2/fnprint)
Overview RDK Central RDK-B WebUI version, rdkb-2025q4-kirkstone, contains multiple vulnerabilities involving memory corruption, improper authentication, race conditions, and insufficient input validation. An attacker with network access to an affected WebUI may be able to bypass authentication, obtain administrative access, cause a denial-of-service condition, or corrupt memory within underlying RDK-B processes. Under certain conditions, this memory corruption may potentially be leveraged for arbitrary code execution. Description RDK-B (Reference Design Kit for Broadband) is an open-source software platform used in broadband gateways and related networking devices. The RDK-B WebUI provides a web-based interface for configuring and administering an RDK-B device. Five vulnerabilities have been identified in the RDK-B WebUI. CVE-2026-19505 JWT (JSON Web Token) authentication in javascript-templates/source/jst_functions.c does not correctly verify whether a token's cryptographic signature is valid. The application treats both a valid signature and an invalid signature as successful verification because it incorrectly checks the return value from OpenSSL's EVP_VerifyFinal() function. A remote, unauthenticated attacker can craft a JWT with an invalid signature that is still accepted by the WebUI. Successful exploitation allows the attacker to log in as the privileged user and gain administrative access to the device. CVE-2026-19506 The login process in /usr/www2/check.jst uses a shared value to store the result of password verification. Because this value is shared between multiple requests, the application may return one user's authentication result to another user's session. An unau
In 2021, we assessed remote Spectre attacks against Cloudflare Workers. Based on the results, we shipped a production defense called Dynamic Process Isolation (DyPrIs), which identifies maliciously looking scripts and isolates them into separate processes. Since then, newer techniques in the area of stabilizing Spectre attacks have been discovered. To understand if these techniques posed a threat to our Workers production environment, we decided to internally reassess the remote Spectre attack. Building an updated proof-of-concept on the production environment allowed us to empirically assess the risk of Spectre attacks under production workloads. To mount a successful side-channel attack in production, an external attacker has to overcome additional obstacles such as activity on shared hardware resources, interrupts, context switches, and coarse-grained timers. Our research uncovered a limitation in the implementation of DyPrIs and we managed to demonstrate a remote Spectre attack reliably leaking up to 12 bit/s with a 99% accuracy in the production environment of Cloudflare Workers. As a consequence of this research, we improved DyPrIs, integrated the V8 Sandbox and an in-process isolation mechanism to further reduce the risk of memory disclosure attacks. Today we are publishing a paper describing our findings, co-authored by Albert Pedersen, Haocheng Xiao, Sam Ainsworth, Nigel Topham, and Martin Schwarzl. This paper covers research done in 2024 and early 2025. Note that the presented attack is mitigated alread
AI pentesting works, but building it in-house is the hard part. Synack VP Chris Brown breaks down the reliability, token economics, model dependency and validation costs that come with building versus buying an AI pentesting capability. The post AI Pentesting Works. Building It Yourself Is the Hard Part. appeared first on Synack .
I finally found some time to organize my notes on secure boot, remote attestation, measured boot and in general embedded security. This is not ground breaking zero-day research but I figured some of you might like a good story. Good here is obviously subjective but I felt like it came out quite readable. This blog builds heavily on public research so as already stated at the end of article if you liked some particular section, show the respective person some love :) P.S.: yes I know the image is AI generated please don’t give me shit for that
The people-search tool ClarityCheck says its reverse image search service is “private and secure”—but it left a database containing more than 9 million image files exposed.
Flock’s surveillance cameras have already sparked outrage. WIRED reconstructed its next-generation AI system, already in use by some police, to confirm it goes much further than tracking license plates.
Three variations on subversive use of DNS by the Agent are documented in Hugging Face's technical writeup of the July 2026 security incident involving OpenAI models. In this article, I discuss what each of these three types of DNS workarounds achieve in practice, the constraints an actor might have faced to attempt a particular one, and additional benefits from choosing each.
We tested Sonnet 5, Composer 2.5, and GPT 5.5 in plan mode and default mode to see whether plan mode produces measurably more secure code.
Tuesday, August 18
The ChatGPT maker says its upcoming Astra model may have reached “critical” cyber capabilities, prompting it to halt a significant number of training runs while it tightens internal safeguards.
An operator left their full working directory exposed on an open HTTP server. [Hunt.io](http://Hunt.io) crawled it, 2,616 files, and rebuilt the campaign from the corpus. * Three exploitation paths in parallel: an asyncio credential brute-forcer, a CVE-2021-33044/33045 auth-bypass chain, and P2P relay abuse reaching cameras by serial number * The relay path never authenticates the connecting party, only the session, via a cloud-issued token obtainable with the fixed SDK credentials in every Dahua client * Two CVE labels in the tooling don't hold up: CVE-2024-39943 is an unrelated Rejetto HFS flaw, and CVE-2025-31702 is a narrower post-auth case, not the unauthenticated relay abuse (that path is a separate non-CVE issue documented by ITRES) * Full PTCP tunnel breakdown, including the Inverted STUN packet and the bind-to-127.0.0.1 technique Neutral attribution throughout, the corpus shows how the operation was built and run, not who ran it. Check the full breakdown, IOCs and mitigation strategies: [https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised](https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised)
Route leaks push traffic down paths it was never meant to take. We have written and spoken publicly in the past about route leaks in Border Gateway Protocol (BGP) , depicting these events as impactful incidents that cause misdirection of traffic through unintended network paths. BGP routing is driven by the relationships between Autonomous Systems (ASes), i.e., customer-provider and peer-peer. Customers pay providers for access to the rest of the Internet, while peers exchange traffic with one another typically under a “settlement-free” arrangement where no money changes hands. These relationships help define routing rules that form plausible paths. For example, the rules form a “valley-free” hierarchy of how routes should propagate: a route learned from a provider or a peer should be announced only downward to customers, never back up to another provider or peer. Rules like this express an intent or expectation about Internet routes. A route leak is what happens when that intent is violated. Historically, each network has had to implement this intent on its own, using complex, error-prone routing policies
One advertisement featured a pornographic video with a deepfake closely resembling a prominent US politician. Apple removed the app from the App Store after an inquiry from WIRED.
Author here. I audited NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, and Airflow and disclosed 14 findings. Every platform inherited the same assumption anyone who can touch a workflow is trusted to run code on the host, which is fine for a dev tool on your laptop but not fine for a multi-tenant HTTP service with an unauthenticated webhook. The chain I'd point people to first is the Flowise one (section 2.2): an unauthenticated request → prompt injection → LLM emits Python → a 38-pattern regex blocklist passes it because the dangerous library was pre-imported before the model was asked anything → RCE. Two vendors closed their reports as working-as-intended, and I tried to represent their position fairly. This research was also presented at DEFCON 34 but now available publicly. Happy to answer questions. Full whitepaper is available here: [https://www.endorlabs.com/learn/how-ai-orchestration-platforms-ship-rce-by-design](https://www.endorlabs.com/learn/how-ai-orchestration-platforms-ship-rce-by-design)
Proton’s CEO is a champion of encryption for everyone. So why is he going all in on un-encryptable AI?
After Noel Pichardo called out his city's embrace of Flock surveillance cameras, he was subjected to five internal affairs investigations in less than two years.
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite The current ransomware situation is a bit of a kludge (deep breath): a lot of ransomware (which often doesn't even involve "ware", it's just extortion) is carried out by kids who successfully make a truckload of money but can't spend it without getting caught and the companies they breach rapidly get piled onto by class action lawyers that keeps them busy fighting and being cautious not to say anyting to customers lest that then gets used against them in litigation. That's mostly it; more in this week's video:
Monday, August 17