A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2. The flaw is in Active Storage, the part of Rails that handles file uploads. Some apps store
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 3:40 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code
Suspected North Korean attackers duped an engineer with a fake job interview and a malicious download to gain a foothold in the crypto firm’s system and steal billions, according to Binance.
The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker. "The injected JavaScript code collects browser and device attributes," Sekoia researchers Amaury-Jacques Garçon and
A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin. The flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with security patch level 2026-11-01 or later, which phone makers and carriers send on their own schedules. As of November 4, Google's bulletin did not report
Latest
Wednesday, November 4
Aegis Latent Core: a tamper-evident evidence chain for AI traffic. Does this help a blue team, or is it just another log source?
**Disclosure:** I am the author. Personal project. Source-available, not OSI open source. Not selling anything in this post. I am here because r/blueteamsec is where detection engineering and log integrity get taken seriously, and I want to know if what I built is operationally useful or just architecturally cute. # The blue team problem I am trying to address Your SIEM ingests logs from endpoints, identity providers, proxies, and SaaS. If an attacker with privileged access wants to erase a trace, the classic move is **T1565.001 (Stored Data Manipulation)** applied to the audit trail itself: mutate an event, delete one, reorder them, or roll back to an earlier state. You already know this. The standard mitigations are off-host collection, append-only storage, and hash-chaining with periodic root digests. Aegis Latent Core is not a SIEM and not a log shipper. It is an **evidence layer that sits in front of AI traffic** (web UI via browser extension, API via proxy, local models via gateway) and produces a per-interaction hash-chained, signed receipt before the response is delivered. The question for this community is narrower than "is it secure": **does a per-interaction evidence chain for AI traffic give a blue team a detection signal or an investigative artifact that it does not already get from its existing log pipeline?** # What the chain actually gives you (and what it does not) The design is deliberately close to the audit-chain pattern you already know. Each event is canonicalized, hashed, linked to the previous event in the stream, and signed. The chain detects: * **In-place mutation** of an event after it was recorded (hash mismatch at the affected sequence). * **Deletion** of an event (gap at the missing sequence). * **Reordering** (out-of-order sequence). * **Rollback** to an earlier chain head (boundary shift). This is the same integrity model as a per-tenant audit chain that forwards to a SIEM, and the same scope limitations apply: **the chain starts at the collector**. If an attacker controls the client before the event reaches the collector, the chain will faithfully record whatever the client emitted. It is not producer attestation. It does not prove the client was honest. For a blue team, that means the chain is useful for **post-collection integrity** and **investigative artifact preservation**, not for **pre-collection detection of a compromised endpoint**. I want to be explicit about that distinction because it is the difference between "this helps your IR" and "this replaces your EDR". # Where this might actually be operationally useful I have three hypotheses. I would like you to tell me which one is wrong. # 1. Detection of evidence tampering during an AI-related incident If an incident involves an employee exfiltrating data through an AI tool, the first question in the post-incident review is often "what did they actually send, and can we prove it?" The chain gives you a signed, ordered record of what reached the collector, with a receipt that a third party can verify without trusting the gateway. That is a **DFIR artifact**, not a detection rule. But if the attacker's objective includes cleaning up the AI interaction history, the chain gives you a way to detect **post-hoc modification of the collected record**, which is one layer below the endpoint. **Question for you:** in your experience, does a per-interaction receipt like this survive contact with legal or HR, or does it get dismissed because the client is untrusted? # 2. A log source for "AI interaction anomalies" that your SIEM can correlate The events are structured metadata by default (hashes, timestamps, surface, user/device identifiers), not message bodies. That makes them cheap to ship to a SIEM and correlate with DLP, CASB, or identity logs. The signal is not "the model said something bad"; the signal is "this user's AI interaction pattern changed, and the chain shows no tampering in the record of that change." **Question for you:** would you actually onboard a new log source for AI interactions, or would you rather have this folded into an existing CASB/DLP feed? # 3. Evidence preservation for AI Act Article 12 traceability Article 12 of Regulation (EU) 2024/1689 requires high-risk AI systems to technically allow automatic recording of events over the lifetime of the system, with traceability appropriate to the intended purpose. The obligations for Annex III employment-related systems take full effect on **2 August 2026**. The operational reading for a blue team is that you will soon be asked to **produce and defend a traceability record**, not just retain logs. A hash-chained, signed per-interaction record is closer to that requirement than a plain log line, because it is verifiable after the fact. **Question for you:** if your organization deploys high-risk AI in employment or critical infrastructure, is Article 12 traceability on your roadmap yet, or is it still a legal team problem that has not reached detection engineering? # What I am not claiming * **Not tamper-proof.** Tamper-evident. * **Not producer attestation.** The chain starts at the collector; a compromised client can emit fabricated events that the chain will faithfully record. * **Not a completeness guarantee.** Unenrolled devices, uncovered browsers, and user-initiated pauses are recorded as gaps, not eliminated. * **Not a SIEM replacement.** It is one more source, with a specific integrity property. * **Not a compliance certification.** It can help an operator produce Article 12-style traceability, but it is not a conformity assessment. # The questions I actually need answered 1. **Signal vs. noise:** if this showed up as a new log source in your pipeline, what would make you keep it versus mute it after a week? 2. **Chain design:** for blue team purposes, is per-interaction hash chaining enough, or do you need periodic root digests anchored off-host (WORM bucket, RFC 3161 timestamp) before you would treat it as evidence? 3. **Client trust:** is there any realistic way to get from "tamper-evident record of what the collector received" to "trustworthy record of the interaction" without a TEE on the endpoint, or should I stop trying and scope the claim to server-side observation only? 4. **DFIR workflow:** would a per-interaction receipt be useful during an investigation, or does it add a verification step that analysts will skip under time pressure? 5. **The "just use X" question:** if you already hash-chain audit logs in your pipeline (the Cordum pattern, or an equivalent), what would justify a **separate** evidence layer for AI traffic instead of extending the existing chain to cover AI events? # Links * Repository: [`github.com/JuanLunaIA/aegis-latent-core`](http://github.com/JuanLunaIA/aegis-latent-core) * Project page: [`aegislatent.com`](http://aegislatent.com) (README is the source of truth if the page is down) * License: `LICENSE` in the repo root (`LicenseRef-Aegis-Commercial-1.0`, source-available, not OSI open source) If this is operationally useless to you, say why. That is more valuable to me than a polite "interesting project".
We extended the public ARTEX reporting (CrowdStrike, Genians) on the South Korean bank breaches. We found a second open directory on the Hong Kong jump server (23.248.226\[.\]250), not in their reporting, that exposed the operator's whole setup. The headline: ARTEX, an autonomous pentest framework, was running on a Claude Code harness rerouted to a DeepSeek backend through the xcai\[.\]pro reseller, with GLM and Grok as backups. Alongside it, 19 custom agent skills, a proxy pool that showed 79 exit IPs across 100 identities, a staged JNDI/LDAP RCE rig, and an Impacket SMB kit. Pivoting on the ARTEX cert, malware tag and console title tied 1,303 candidate IPs and 280 linked open directories. For detection: watch for unexpected LDAP/JNDI activity and DNS callbacks (the rig used DNSLog OOB confirmation), reverse SSH tunnels and sshpass root sessions, remote script download-and-execute, SMB auth from an unfamiliar machine account, and outbound traffic to model gateways or reseller endpoints you don't expect. The post has the HuntSQL queries, the ATT&CK mapping and the IOC table.
The Russia-linked threat actor known as APT29 is said to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving a Ukrainian web analytics service called Plerdy SEO Tracker. "The injected JavaScript code collects browser and device attributes," Sekoia researchers Amaury-Jacques Garçon and
Personal agents are the intermediary between humans and the Internet, turning a person’s instructions into requests and actions on websites. A customer might ask a personal agent to compare products across your site, find support articles, or complete a purchase. To a site owner, all three interactions show up as automated traffic — and without a clear view of which agents are visiting and what they are doing, it can be difficult to know whether that traffic is helping your business or creating risk. Blocking agents altogether can feel like the safest choice, but it can mean losing customers. Better visibility into agent activity allows you to decide what access makes sense for your site. Today, we’re launching new analytics to help you understand how personal agents access your site on behalf of humans, along with more granular access policies to put those decisions into practice. Together, they let you welcome agents on your own terms, and in ways that support your business. See how agents access your site Knowing which agent is behind a request turns unexplained automated traffic into traffic you can act on with confidence. Cloudflare maintains the largest verified bot directory in the world, and we are now bringing that intelligence into your traffic details. In Security Analytics, the Bot Analysis chart now shows Personal Assistants as a new category, next to Verified Bot, Likely Human, Likely Automated, and Automated. Security teams can select it to see only personal agent traffic over time. In Top statistics, a new Personal Assistants widget lists which agents are visiting your site and how many requests each one sends. Filter on one agent and every other widget updates to show only its traffic details: the paths it requests, the status codes it receives, and the networks it comes from. At a gla
Help me collect data about ransomware for my PhD. I'm a CISSP, CISM, Sec+, & doctoral candidate at Capitol Technology University, MD. I'm researching which security controls actually enable recovery and resilience, compared to cyber frameworks. Takes 15–25 minutes. Anonymous. No compensation. IRB-approved. Would deeply appreciate your help. Please share. Thank you! https://techstudy.limesurvey.net/748327?lang=en&newtest=Y (Safe link: I built the survey on Limesurvey dot net. It's open source, cloud hosted in the US, used by Ubuntu, GNOME, OpenOffice, and many universities. I went this route since our Uni doesn't use Qualtrics, and it's affordable.)
A critical flaw in Ruby on Rails could allow an unauthenticated attacker to write arbitrary files on an app's server by uploading a crafted file if the app processes uploads using ImageMagick. The Rails project disclosed the flaw in an advisory and fixed it in versions 8.1.4.1 and 8.0.5.2. The flaw is in Active Storage, the part of Rails that handles file uploads. Some apps store
Nearly every agent security pitch now ends on the same promise: the product stops the bad action in real time. The promise holds for one kind of agent, the kind whose traffic passes through a gateway the enterprise owns. Most agents never touch one. One recent case shows what that gap looks like in practice. An employee asked an AI assistant to trigger a mass-email automation. The automation
Trying to root a TCL Android TV: the IR remote runs at 56 kHz, not 38 — reversing the stack from LED to kernel key table
So basically our college professor want us to have at least 25 people sign up for a form for our project. Which is cybersecurity related so your feedback might help a lot. Thanks
Russian authorities have arrested three suspected members of a threat group known as VasyGrek and dismantled its criminal infrastructure. Also known as Fluffy Wolf, the threat actor has a history of targeting Russian and international companies since 2016. The Ministry of Internal Affairs of the Russian Federation (MVD) said members of the group are "suspected of embezzling funds from the
A critical Android flaw could allow an attacker to run code on a phone without any user action remotely, Google said in its November security bulletin. The flaw, CVE-2026-58868, affects Android 14 through 17. Phones get the fix with security patch level 2026-11-01 or later, which phone makers and carriers send on their own schedules. As of November 4, Google's bulletin did not report
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code
I created this repo so you can automatically share your WASM game, and any other folders you’d like, with AI
Tuesday, November 3
Suspected North Korean attackers duped an engineer with a fake job interview and a malicious download to gain a foothold in the crypto firm’s system and steal billions, according to Binance.
Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords, resetting two-factor authentication (2FA), and removing passkeys. The warning came in an email sent on November 3 in the name of developer mSeven Software. It says the company recently learned of suspicious activity linked to the app but
Blockchain infrastructure provider Chainstack on Tuesday disclosed that it was targeted in a cyber attack that allowed an unauthorized party to gain access to some parts of its infrastructure. The incident is assessed to be part of a large-scale, artificial intelligence (AI)-powered attack campaign that came to light last week. "An external attacker gained unauthorized access to part of
Continuous automated penetration and attack testing uses tooling to run real attack techniques against an environment on an ongoing schedule, rather than during one scheduled engagement. It trades the depth of a fully human-led test for broad, repeatable coverage that runs continuously. The category has a real ceiling: findings that depend on business logic or multi-step reasoning still need a human tester to catch. Treat it as one layer of a testing program, not a replacement for the whole thing. The post What Is Continuous Automated Penetration and Attack Testing? appeared first on Synack .
Google's Threat Intelligence Group says it has shut down a massive botnet called x.cpe. At its height, x.cpe ran on more than 1.3 million Android TV devices, and unusually, these were Google-certified boxes. Google says its screening process missed the malware due to "obfuscation techniques" employed by Shenzhen-based Videostrong Technology. In a detailed blog post , the Threat Intelligence Group explains how the x.cpe botnet evolved quickly from a single-stage dropper into a modular three-stage malware platform that sold access to third parties. Manufacturers must have their devices certified if they want access to Google apps and branding, a process that is supposed to catch threats like this. However, Videostrong's compromised boxes, mostly sold under the MECOOL brand, evaded detection by using a backdoor to remotely install the malware after the devices were set up and online. After devices appeared online, a stub application called x.cpe or com.oemservice would phone home. This package did not have any malicious capabilities of its own, but it had the system-level permissions necessary to install malware modules at the operator's behest. It also disabled Play Protect, which would have otherwise flagged the silently installed packages as malicious. Read full article Comments ]]>
apkscope: stateless APK xrefs that return the Java line, plus a from-scratch decompiler (Rust, no JVM)
Overview Multiple vulnerabilities have been identified in the Android application, BaseChat – Audio Dating App, version 9.8.1, which ultimately compromise the privacy of users’ personal data and activity. Description BaseChat is an online dating platform built in Flutter and targeted toward users over 18. It facilitates anonymous, voice-first interaction between users. Three distinct vulnerabilities have been identified within the shipped Android application. VU#124705.1: The application fails open when validating TLS server certificates for connections to its backend API host. The application allows any self-signed certificate to bypass standard TLS security checks. VU#124705.2: Paid user accounts are mapped to a third-party RevenueCat subscriber database using raw MSISDNs (phone numbers), which are a guessable public identifier. Because the RevenueCat Software Development Kit (SDK) includes a public API key within the application’s Android Package Kit (APK), an attacker can query the RevenueCat’s API using predictable identifiers to retrieve individual user metadata. VU#124705.3: The application writes Personally Identifiable Information (PII) to Android system logs in its production build. During voice calls, the application logs the remote party’s MSISDN through unstripped debug statements, which allows an attacker to recovery phone numbers of callers who are intended to remain anonymous. Impact Impacts of successful exploitation vary by vulnerability. VU#124705.1: A network-positioned attacker can intercept and modify API communication, potentially leading to account takeover via session credential theft. VU#124705.2:
Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services. The tactic is called LLMjacking, a form of resource hijacking adapted for the LLM era, where an attacker obtains an API key through phishing, source code leaks, misconfigured environments, or exposed client-side code
An attacker broke into the update system of the cPGuard security tool on November 2 and used it to send a malicious script to customers' Linux servers. The script installed a backdoor and collected password hashes and other sensitive files from servers that ran it, cPGuard maker OPSSHIELD said in an advisory. The attacker has since taken some of that data. cPGuard 5.88.25 and later versions
TL;DR: Our research team at Era uncovered **Greeter**, an attack framework targeting Flowise, an AI development platform with 55,000+ GitHub stars. We deployed seven honeypots and captured **4,972 "hello" messages**, each carrying malicious JavaScript through Flowise's `overrideConfig` parameter. The interesting part? **The malicious code never appeared in the saved workflow.** We reconstructed 4,000+ commands revealing: * Host reconnaissance and privilege checks * Searches for credentials, SSH keys, and secrets * AWS, Azure, and GCP metadata probing * Persistence attempts and fileless execution preparation We also identified **4,372 internet-exposed Flowise instances**, including 46 unauthenticated instances that appeared to match our vulnerable setup. The bigger concern is how a compromised AI application can become an entry point into the broader cloud environment. **Full technical breakdown:** [https://era.security/blog/greeter-flowise-ai-infrastructure-attack](https://era.security/blog/greeter-flowise-ai-infrastructure-attack)
You run security at your organization. It’s 7:00 am, and you’re having breakfast. You receive a ping: a new critical vulnerability has been disclosed. Your team scrambles to compare vendor advisories, read technical research, check which systems run the affected software, and answer familiar questions from the business: are we affected, and what are we doing about it? Another disclosure arrives before that work is finished. AI is changing both the volume and speed of critical vulnerability discovery. It can analyze large codebases at scale and surface deeply nested flaws that may have existed for years without being found through human review. That discovery momentum will put more pressure on security teams to understand the impact of each disclosure on their infrastructure. To help security teams prepare, today we’re introducing Zero Wire : a public vulnerability intelligence feed on Cloudflare Radar, bringing the clarity of a news wire service to critical security developments. It helps security leaders and practitioners understand significant vulnerabilities and decide what to do next. How it works Zero Wire lives inside Cloudflare Radar under the security section. Each briefing brings together a plain-language explanation of the vulnerability, who should investigate it, recommended actions, and links to the evidence and vendor guidance. The format is deliberately simple: an index card with what you need to know, without the drama. A CISO should be able to understand the issue quickly and ask the right questions. An engineer should be able to follow the same briefing to the technical guidance needed to investigate and remediate it. We also offer a pre-compiled prompt you can use with your agent to assess the impact on your infrastructure. Cloudflare contributes security research, observations from our network, and p
As millions of Americans vote in today’s U.S. midterms, most will use paper ballots, which are protected by strict chain-of-custody protocols and, in some cases, statistical audits. You may wonder why we still use paper for our elections and voting systems when tasks like banking, tax filing, and document signing have moved away from paper-based legacy systems and become fully electronic. The short answer: security. That may come as a surprise to some. After all, cryptography and other security advancements have enabled secure electronic systems for many applications. In fact, cryptography can be used to provide two essential safeguards in elections: keeping (1) individual votes secret while (2) making the final tally independently verifiable. This is exactly the approach of cryptographic protocols like Helios and ElectionGuard . However, Helios intentionally targets lower-risk and lower-coercion settings rather than high-stakes public elections. ElectionGuard, by contrast, is intended for public elections, but not as a replacement for a paper-based system; it is used as a cryptographic layer integrated with traditional voting infrastructure. In this blog post, we’ll explain how cryptographic techniques can help protect ballot secrecy and prevent manipulation in electronic voting systems, and explore the limitations of these systems. Although cryptography can strengthen election verifiability and have other strong security properties, it cannot fully replace the security and trust of existing paper ballot systems in general elections. The challenges of electronic voting The National Academy of Sciences’ excellent 2018 report on election security concludes that el
Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can
Your team is remediating more vulnerabilities than ever, yet your breach risk has barely changed. You’re spending too much time and effort on exposures attackers may never exploit, while higher-risk exposures sit, waiting in the queue. Gartner®’s report on exposure prioritization states that fewer than 10% of vulnerabilities are exploited, yet most are treated as urgent. The report also argues
**tl:dr;** * Contrary to popular belief among vendors, system integrators, and asset owners: network authentication in TETRA mission-critical radio networks **does** ***not*** **provide authenticity & integrity** guarantees at the individual message level. * To make matters worse: **base stations don't require a re-authentication whenever a radio is roaming from one cell tower to the next.** * This allows for traffic injection attacks: both voice and data. The latter is particularly worrying for SCADA WAN scenarios or where voice & alarming functionality can disrupt operations at such as at airports, harbors, railway operators, and civil defense siren systems. * The 2026 attack on Taiwan High Speed Rail's TETRA network, leading to the emergency stop of several trains, shows a mild example of possible impact: [https://www.midnightblue.nl/blog/analyzing-the-taiwan-high-speed-rail-thsr-tetra-cyber-incident-part-1](https://www.midnightblue.nl/blog/analyzing-the-taiwan-high-speed-rail-thsr-tetra-cyber-incident-part-1)
With AI agents now running in many Microsoft 365 tenants, monitoring their activity has become part of the security team’s job. Microsoft Defender XDR monitors AI agents through its integration with Microsoft Agent 365, the control plane for agents in your tenant. This post covers what to enable, where the data lands, and how to respond when an agent goes wrong. We will also show you some interesting log sources, where useful information about the behavior of agents can be found.. The features listed in this article may not be visible or available without the proper license. You may need the “Agent 365” add-on for you actual license, or the new E7 license plan which includes everything (Agent 365, Microsoft 365 Copilot). Which agents Defender XDR can see Defender’s threat detection uses observability data from different cloud agent sources, plus agents running locally on endpoints. Agent type Examples Copilot Studio agents Low-code custom agents built by users Microsoft Foundry agents Pro-code agents in Azure Copilot Agent Builder agents Declarative agents built in Microsoft 365 Copilot Non-Microsoft agents Agents built with the Agent 365 SDK Local agents Coding and desktop agents on devices Each managed agent also gets a Microsoft Entra Agent ID : a directory identity with owners, sign-in logs and risk scoring. That identity i
Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers. No chain reported more than several dozen affected stores, and some had to throw away chilled and frozen food or take it off the shelf. Danfoss, a Danish maker of refrigeration controls, 
GitHub - rjzak/malware-modeler-rs: Generate training data and ML models for benign vs. malicious files plus related tools.
Something I've been working on for a while: training lightweight machine learning models to determine if a file is benign or malicious based on raw byte sequences (n-grams). The goal is for anyone working with malware (and has goodware samples too) can train their own models, and this could be useful for resource-constrained environments of if you want a model for older systems not supported by typical AV vendors.
Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines. A report from the Google Threat Intelligence Group (GTIG) said Google has severed ties with Videostrong Technology Co. , a TV box manufacturer in China that GTIG and other industry experts concluded was responsible for including malware that enrolled more than 1.3 million set-top boxes in a botnet dubbed “ XCPE ” (named after one of the malware’s core code components). The global distribution of XCPE botnet infections. Image: Google Threat Intelligence Group. The report said the XCPE botnet loaded the user’s device with software that makes their Internet address available for resale by multiple “residential proxy” services, which allow customers to rent Internet addresses
National Cyber Security Centre expects attacks on critical facilities such as power stations, airports and hospitals AI-powered malicious software is “highly likely” to be used in hacking attacks against the UK’s power stations, airports and hospitals by 2028, according to the state cybersecurity body. The National Cyber Security Centre (NCSC) said AI will probably enable a ransomware attack against critical national infrastructure [CNI] between now and 2028. The UK’s definition of CNI covers a range of facilities and services across sectors including energy, transport, defence, food, health and finance. Continue reading...
Monday, November 2
Had a subscription in the past with them and received the following e-mail: Doesn't look like many sites have have picked up on this: >Dear cPGuard customers and partners, >An unidentified attacker targeted OPSSHIELD, gained unauthorized access to our licensing and update systems, and distributed a malicious script through the cPGuard update channel. \*\*We have stopped further distribution of the script and released cPGuard 5.88.25 to remove the known backdoor and files left by the script.\*\* >The script sent data to an endpoint on our licensing server under a compromised account. We secured that account as soon as we identified the breach and cleared our infrastructure credentials. We are investigating how the attacker gained access, which customer servers ran the script, and what data the attacker accessed. >\*\*Please take the following actions immediately.\*\* >1. \*\*Update every cPGuard server.\*\* Run \`cpgcli update --start\`. The corrective update removes the backdoor shell at \`/var/tmp/.cpg91511\_sh\` and the collection directory \`/var/tmp/.cpg91511\`, including the password hashes and credential archive (\`loot.tgz\`) staged there. 2. \*\*Verify the installed version.\*\* After the update completes, run \`cpgcli --version\` on each server and confirm it reports \*\*5.88.25\*\*. If the update fails or the server still reports an older version (between 5.88.12 and 5.88.19), contact OPSSHIELD Support immediately. 3. \*\*If you know or suspect the malicious script ran, reset passwords and revoke exposed credentials.\*\* The script targeted \`/etc/shadow\`. Reset passwords for root and all other password-enabled local accounts from a trusted recovery environment. From a trusted device, change any passwords reused elsewhere and rotate affected database passwords, S3 access keys, DigitalOcean tokens, and secrets recorded in root's shell history. Replace SSH private keys stored under \`/root/.ssh\` and remove the corresponding old public keys from every system that trusts them. Complete this step even if the update succeeds, because credentials copied before cleanup may still be usable. >We are sorry that this breach put your systems at risk. If you need help assessing a server, please contact OPSSHIELD Support through your usual support channel. We will share further findings as we verify them. >The OPSSHIELD Team
Mirage2FA AiTM kit steals M365 session cookies after MFA (ANY.RUN: 4,561 cookie theft events): SIEM detection rules and phishing-resistant hardening guide
Author here. Detection rules (UTMStack, Entra ID audit actions) and hardening steps validated in a hybrid lab (Entra Connect + on-prem AD + WS2025). Corrections welcome.
The Capytistas, a secretive group claiming more than $1.2 million in backing, started with Elon Musk and Tesla’s board. Members argue that those who buy political power deserve the scrutiny they’ll impose.
When I last wrote about our DNS propagation pipeline in 2022 , the Zone Builder received about 250 DNS record changes per second. Today it receives about 700, nearly three times as many, plus about 100 other events, such as zone setting changes. However, the number of events was never the real problem. The problem was the kind of work some of those events needed, and how that work grows with the size of a zone. Some zones now hold more than 20 million records, and we expect them to keep growing toward hundreds of millions. Each event starts a clock that measures how long it takes us to turn that change into data our authoritative DNS servers can use. We call that work a build. A build reads the current database state, converts it into the format used at the edge, and writes any changes to Quicksilver . In 2022, per-record builds were 150 times faster than full builds on average. On a test zone with one million records, per-record builds were 4,250 times faster. We ended that post with the obvious next step: do the same thing for zone settings. Why doesn't the Zone Builder just rebuild the setting that changed? It should, and that is where we ended up. However, proving when it was safe took most of the work. A record event identifies what changed. A zone event can come from many Cloudflare products, may not say why the zone changed, and can alter data shared by several zones with the same name. Choosing too much work wastes capacity. Choosing too little can leave stale or incorrect DNS data at the edge. We built a targeted
Stable Linux releases lack existing security fixes because backporting them is time-consuming and often thankless work. We’re using Codex to reduce the backporting process time from days to hours per fix, empowering human patch reviewers to rapidly submit fixes for critical software like Ubuntu Long Term Support, Fedora, and the Linux kernel. By October 29, our project helped deliver fixes for 149 distinct CVEs into stable Linux kernel releases, and several fixes to Fedora and Ubuntu packages. Deploying fixes to older software requires multiple steps, including adapting fixes to older code, checking dependencies, and ensuring the fix did not introduce new bugs. A single task (like tracking down a bug in a bad commit) can take a week or more of effort that no one sees or appreciates. Our Codex workflow has reduced the human effort required to prepare and review fixes. Excluding project-specific initial setup, preparing and reviewing a straightforward backport takes about 30 minutes of human attention; a more involved case can take around three hours. The workflow’s approach is twofold: agents perform activities like identifying missing fixes, adapting patches, assembling validation evidence, running tests, and preparing submission packets, while engineers review the patches and submit them to maintainers. Those estimates only cover patch preparation and review; regression testing and maintainer acceptance remain essential. But the reduced human commitment makes a substantial class of neglected security work practical to undertake. The patch backlog is large, but we now
I’ve gotten nearly 2,000 campaign fundraising texts that were meant for someone else. I tried to find out why—and uncovered a labyrinth of politicians, data brokers, and shady tactics.
WIRED uncovered some 400 apps and websites linked to Chinese-language developers that look like regular AI tools but had secret features that let users create violent AI-generated images and video.
(May 2026) TL;DR: - an email address like atouch${IFS}/tmp/savane-rce-proof@attacker.example gave any registered user code execution on its backend. - From there, we made our account a superuser, - impersonated Bash’s maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository. - An unpatched kernel gave us root access and access to a GNU backup server. We reported it to the FSF on May 11, 2026. FSF incident report: https://static.fsf.org/nosvn/security/savannah-20260807.pdf
To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the [Reverse Engineering StackExchange](http://reverseengineering.stackexchange.com/). See also /r/AskReverseEngineering.
Sunday, November 1
Adding onto the post "Archived malware I found over the years pt1" BY: "u/Fickle_Plan_208" Effort post!!!!! read description.
LINK TO THEIR POST: [link.](https://www.reddit.com/r/malwares/comments/1tdfrsy/archived_malware_i_found_over_the_years_pt1/) LINK TO MY OTHER POST ON THIS: [Link](https://www.reddit.com/r/ExtremeArchive/s/CCzXpSShV3) All malware I found on the GitHub user LEMZzip and links to archived malware they made if found plus info and updated file! This post also includes a screenshot of their GitHub page at the bottom + other things like screenshot of their website or tools they made! SCAN LINKS IN ANYRUN: (:[SCAN 1](https://app.any.run/tasks/1b3a66c7-54c0-46c9-a944-e3012ff76d46/): [SCAN 2](https://app.any.run/tasks/381650b8-c79b-4992-9e59-8f0ec40eca68/):) VIRUS TOTAL SCAN LINKS I FOUND: (:[Love.exe](https://www.virustotal.com/gui/file/e63cc912240af3b0e958f0617372876a3f0221e27c45ae5362963d72185e5d81), [Browser setup 1.2.exe](https://www.virustotal.com/gui/file/207b53a4aa0a36fbc52b0557c5b747640cb79dde37ea02c85240984065779a60):) MALWARE NAMES THAT WERE ARCHIVED: "tripop CD Defender Antivirus, Roblox Setup, Rec room modded, Recroom-white-main, DSBN wifi bypass!, love. Browser setup 1.2" MALWARE NAMES THAT AS OF NOW CAN'T BE ARCHIVED: "Recroom modded (NEW), blackhole, train-way! Setup, rusty., admin turnoff, makerpen, ultralemzx, spazz, Xholder. LEMZzip trojan maker 1.0" (Note: There may have been more I forgot to include!.") Possible same accounts on github: ([LEMZzip](https://github.com/Callmelemon82), [LEMZzipV2](https://github.com/LEMZzipV2)) Possible same user on reddit: ([LEMZzip](https://www.reddit.com/user/LEMZzip/)) Possible same user on archive web: ([LEMZzip](https://archive.org/details/@LEMZzip)) The website URL some of their malware opened I had to remove because if I did not my post would keep getting taken down! LEMZzip Malware archive V1.1: [Download!](https://www.mediafire.com/file/0jphz06ge3rgd5x/LEMZzip_Malware_archive_V1.1.zip/file) Inside it also has a description on what the malware does! Note: I will try to update this unlike them! Archived software I could not include yet but archived: "LEMZzip Trojan maker 1.1!, Divine Anti-spy V1.0 (Beta)" Screenshot below as well! *Processing img 1gidrwq4rlzh1...* *Processing img 51ro8m3wqlzh1...* *Processing img adnug3b2qlzh1...* *Processing img qkcfmlqp16zh1...* *Processing img wswxb9b5s4zh1...*
MalChela v4.4 adds Unpack, a static unpacker for PE, ELF, and Mach-O; maps findings across the toolkit to MITRE ATT\&CK v20 with an interactive Enterprise matrix; and moves every tool to the embedded YARA-X engine, removing the system YARA dependency. Also new: YARA Scan and IP reputation with GreyNoise.
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite By pure timing coincidence, the Proton CEO's AI @ Proton, Engineering Manifesto made headlines around the same time as this week's video. The guy's management style and choice of language have really rubbed a lot of people up the wrong way, and deservedly so, IMHO. However... this section of his screed really resonated with me: Your job has fundamentally changed. It is no longer to write code, and LLMs are not here to help you write better code faster. Your job is to help the LLM write better code faster. Dev jobs as we know them are gone. Dead. And if you disagree, you're in for a shock in the very near future. But at the same time: I don't remember the last time tech has been this exciting. It's white hot right now. Anyone who loves technology and computers is probably having a great time right now. — Jack Rhysider ☠️ (@JackRhysider) October 30, 2026 Yes! This! Not handwriting code "old school" isn't something to lament; rather, our unprecedented ability to innovate, create and build things that are meaning
Using a fake DOB or leaving the field blank when making an online account can offer protection from identity theft You get a call from your bank saying there has been suspicious activity on your account. They read out your name, address and date of birth so you are happy it is a legitimate caller. But you are talking to criminals who have used your date of birth as part of a web of verifying information to convince you they are someone else. Continue reading...
Saturday, October 31
Named Volta-Autodoxer, the recently uncovered malware uses AI tools to collect troves of data about victims, from login credentials and credit card numbers to Discord sessions and UberEats receipts.
Friday, October 30
Thanks to a lucky break, flawed code in a tainted Claude extension prevented the attacker from fully worming their way into some 5,000 developer machines.
Shared ASLR-bypass kit byte-identical across four hosts, a custom heap exploit with a log cleaner, cloned public PoCs, and a PAN-OS-focused repackaging (panos\_rce\_poc.py, prce.py) exposed at 130.94.67\[.\]235. File-level detail and hashes in the post.
On October 19, 2026, we learned about eMudhra’s eight shockingly weak keys: where eMudhra was trusted to pick a 115-digit number for their virtual combination lock protecting the Internet, they picked the number 4. Not even four digits, just the number 4. The other seven keys were similarly weak: 56, 66, 115, 155, 156, 230 and 237. The next day, we wrote a blog post on the immediate action we took to mitigate this leak, and what customers needed to do on their end to stay secure. Now, we are sharing a more in-depth follow up on the evidence we’ve seen of exploitation, and the progress seen on visitors patching their systems. Let's start with the scale of the problem. A certificate authority (CA) with weak keys this serious is unprecedented, and the potential consequences are significant. While there have been plenty of compromised certification authorities in the past (such as DigiNotar , TÜRKTRUST , and TrustWave ), access to their keys has always been contained to a degree; these incidents gave a limited set of attackers or organizations the ability to issue fraudulent certificates. The eMudhra incident is fundamentally different; the affected intermediate private keys could be recovered almost instantly by anyone from the public certificates themse
David Gibson says the problem is that details of the flaw were revealed before it was fixed, while Charles MacKinnon notes that we are at the mercy of technology we don’t understand Chris Stokel-Walker may be right ( The internet has broken – again. Shouldn’t the tech firms that make billions from it pay to fix it?, 22 October ), but the real issue lies elsewhere. The bugs in the PHP programming language that were recently found by an AI tool have been present for a long time without anybody noticing and without any harm being done – they are extremely obscure. They were not found by hackers – they were found because an AI tool was used to check the PHP source code, which is a good use of AI. Continue reading...
Today, Cloudflare services for private origins is generally available. Point a proxied DNS record at a private IP, and Cloudflare reaches the origin over your existing Cloudflare One connection . Your origin stays private, while web application firewall ( WAF ), caching , bot management , and Workers work just as they do for public origins. In June, we launched this capability in closed beta to address a problem we kept hearing from customers: Their internal APIs, AI agent backends, MCP servers, and operational tools weren’t built to face the Internet, but those services still need to accept requests from partners, customers, or agents over the Internet. Before the beta, putting Cloudflare in front of these services meant exposing a public IP, opening a firewall port, or running cloudflared alongside the origin. Those requirements often left private applications without the same protections and controls they used for public applications, including WAF, bot management, rate limiting, caching, traffic acceleration, rewrites, and Workers. What is generally available today During the closed beta, eligible customers requested access through their account team. Today, we’re opening access beyond that beta group. Point a proxied A or AAAA record at
I wanted to figure out just how exploitable php2shell and http2shell were in practice, so I've created two purposely vulnerable web apps: [https://brotli2bitcoin.com](https://brotli2bitcoin.com) & [https://php2bitcoin.com](https://php2bitcoin.com) with a standard production config -- pop an RCE and find the flag to claim the $1K BTC. And to make it interesting, I setup a live stream showing every single attack attempt happening live [https://www.youtube.com/watch?v=w7\_EJWqRzvw](https://www.youtube.com/watch?v=w7_EJWqRzvw) Good luck! ;)
Thursday, October 29
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.
What if a VNC server could make your viewer believe it had a \~4 GB framebuffer… while actually allocating only 128 KB? That’s the core of this TightVNC vulnerability. A malicious server can announce a crafted 32768 × 32769 screen at 32bpp, causing the framebuffer size calculation to overflow. The allocation wraps down to 128 KB, but the viewer continues using the original, much larger dimensions when calculating pixel writes. The result is a server-controlled out-of-bounds write in the viewer. It’s a good example of how a relatively small integer-overflow mistake can become a powerful memory-corruption primitive when different parts of the application disagree about the true size of a buffer.
Welcome to the 26th edition of Cloudflare's DDoS Threat Report. This edition covers the third quarter of 2026 — July, August, and September — and returns the series to its quarterly cadence following the combined H1 2026 volume. The analysis is produced by Cloudforce One , Cloudflare's Threat Intelligence organization, providing a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network . Key insights Short-burst, low-bandwidth attacks lasting under 10 minutes and 1 Gbps surged by 208%. Conversely, hyper-volumetric attacks exceeding 1 Tbps plummeted by nearly 69% from Q2, possibly a reflection of law enforcement actions against four major Internet of Things (IoT) botnets earlier in the year. However, variants continue to emerge, proving that IoT botnets remain a durable, high-volume threat to network infrastructure. Threat actors dramatically shifted their reflection and amplification tactics, abruptly abandoning CLDAP floods, which collapsed by 99.5% quarter-over-quarter. Instead, attackers pivoted heavily toward other connectionless protocols, driving a 215% surge in DNS amplification and a 122% increase in general UDP floods. Attack targets broadened significantly across both industries and geographies, with the United States reclaiming the most-attacked position from China. Canada and Israel experienced sharp spikes in targeted attacks — jumping 10 and 7 spots respectively — while juggling geopolitical tensions, trade disputes, and contentious domestic events. At the same time, the operational focus shifted aw
A vendor gets a call from one of its biggest MSP partners who needs something the vendor can’t supply. The vendor knows a competitor can, so it points them there. That sounds like a good way to lose a partner, but it wasn’t. They stayed, and they spent even more over the next few years. […] The post The best due diligence on a vendor is who they’ve worked with appeared first on Heimdal Security Blog .
Illicit software on the computers of some of the world’s best online poker players allowed the accused cheater to see what cards were in the victims’ hands—and trounce them at the tables.
Bluesky tells WIRED it blocked links to a leaked archive of information on 41,000 ICE, CBP, and other DHS workers because it contains people’s contact information, shared without their authorization.
Information released by Distributed Denial of Secrets is the third such government data disclosure in the last month Data identifying more than 41,000 employees and contractors for the US Department of Homeland Security (DHS) was released on Wednesday in an unprecedented leak that reveals how the agency is organized. The records, which were made public by the transparency non-profit Distributed Denial of Secrets, reference operation names, surveillance programs and information on undercover initiatives. The DHS did not immediately return a message seeking comment. Continue reading...
We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and other runtimes, and explain how to detect and remediate it.
Wednesday, October 28
Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracing
If you analyze Android banking trojans, droppers, or spyware, you've probably run into samples where: * `classes*.dex` declares `native` methods, but `lib/*.so` has 0 exported `Java_*` symbols and wiped ELF section headers. * `JNI_OnLoad` constructs strings on the stack (`MOVZ`/`MOVK`), uses an OLLVM `CSEL` \+ `BR X8` state machine, and registers JNI handlers dynamically. * Attaching Frida immediately crashes the app due to `/proc/self/maps` or libc prologue checks. I released **JNISleuth-MCP** (Apache 2.0) to automate this part of Android malware triage: [https://github.com/nighthawkk/JNISleuth-MCP](https://github.com/nighthawkk/JNISleuth-MCP) * Recovers static `JNINativeMethod` triplets from `.rodata` / `.data.rel.ro` (with `PT_LOAD` fallback for section-stripped ELFs). * Extracts `MOVZ`/`MOVK` stack strings and XOR-encoded C2 strings from `JNI_OnLoad` / `.init_array`. * Resolves & patches ARM64 OLLVM `CSEL` \+ `BR X8` indirect branches and `.rodata` jump tables. * Includes a C++/NDK **Dobby** agent that hooks `RegisterNatives` mid-function (`+0x10`) and dumps in-memory DEX payloads from `art::DexFileLoader::OpenCommon` without triggering standard Frida detections. * Syncs all 233 `JNIEnv*` vtable types and C signatures into Ghidra and IDA Pro 9.0, plus includes an MCP/LLM server. Ships with a synthetic dropper APK (`samples/banker_dropper.apk`) so you can test all features offline.