Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and Patchstack, are listed below - CVE-2026-76581 (CVSS score: 9.8) - An authentication bypass flaw in
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 5:01 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
The boring parts caused most of the trouble. A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional. Elsewhere, fake apps, helpful support calls, cheap banking kits, exposed systems, and weak defaults kept
Threat actors associated with Aurora (aka Aur0ra) ransomware have been observed using SpaceX's artificial intelligence (AI)-powered coding assistant Cursor to break into target networks, according to findings from CloudSEK and Gambit Security. The two independent analyses are based on exposed infrastructure associated with the Russian-speaking cybercrime group, leading to the discovery of its
A security researcher discovered nine vulnerabilities impacting ATM encryption and authentication software. But the problems extend far beyond your local cash machine.
Berlin's state government has confirmed that it is the target of an extortion attempt following the August compromise of the city's state administrative network, and said it will not meet the extortionists' demands. The same statement disclosed that forensic work had found further data outflows in the portfolio of the Senate Department for Mobility, Transport, Climate Protection and Environment
Latest
Monday, August 31
One example teaches a class when the fix is a rule over the line, or when the correct value already lives somewhere in your repo — fluidfix mines the candidates and your tests judge them. It refuses only what your repo genuinely doesn't contain: new algorithms, outside facts.
What questions do you have about securing Al systems (or breaking them)? Black Hat 2026 speaker is answering them.
“I'm Netanel Rubin, co-founder of Rein Security. My team and I find and exploit vulnerabilities in the AI systems companies are rushing to deploy. At Black Hat this year we presented "[Bye Bye AI](https://blackhat.com/us-26/briefings/schedule/#bye-bye-ai-how-we-hacked-the-ai-shopping-assistant-of-a-top-3-us-retailer-53360)," where we broke the AI shopping assistant of a top-3 US retailer, chaining flaws to move from the assistant into systems it was never meant to touch. It's a look at what actually happens when a large company wires an LLM into its real infrastructure. Ask me anything about: * How we broke the retailer's AI shopping assistant * Turning AI features into attack surface * What breaks when LLMs get wired into real business systems * Finding and exploiting vulnerabilities in deployed AI * Where AI and offensive security are heading * Getting into AI security research * Anything else on hacking AI I'll be here live on Monday, Aug 31 from 12 PM to 1 PM ET (7 PM my time in Tel Aviv) answering your questions in real time. Feel free to leave questions in advance, and I'll get to them when I go live. Looking forward to your questions.” **Ask your questions below and we’ll get them answered!**
The boring parts caused most of the trouble. A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional. Elsewhere, fake apps, helpful support calls, cheap banking kits, exposed systems, and weak defaults kept
Modern bot threats are increasingly driven by determined, sophisticated attackers. Often it is not even one person, but a group trading techniques with each other or a commercial service sold to anyone willing to pay. For many of them, getting past bot detection is a full-time job they genuinely enjoy. Block them and they get to work, finding a workaround. AI has simplified this further, making it even easier to set up complex configurations for attackers, lowering the overhead of an attack. This shift puts defenders at an economic disadvantage. Responding and adapting to new attacks takes care, evidence, and effort to ensure efforts to block attackers don’t impact real users on the way. Attackers have no such concerns and are primarily constrained by their time and their pool of proxies, and ensuring their infrastructure providers don’t shut down their accounts. Their advantage is the cost of adaptation. Attackers can adapt as often and continuously as they need, while most defenses are deployed in discrete, managed releases. Cloudflare analyzes more than a trillion requests a day for signs of automated abuse, so we see how fast attackers change tactics. That gap in responsiveness is widening. The inconvenient truth: bot detection across the industry often rests on a hopeful assumption that if you make the wall tall enough, attackers stay out. In reality, a determined attack always finds a way through. The question is not whether a determined attacker can get through. They will. The question is what happens when they do. Today we are launching Adaptive Intelligence, a new bot detection engine that starts from the opposite idea. Rather than betting on a wall that keeps every attacker out, Adaptive Intelligence makes getting through so slow and costly that the attack stops being worth running. We believe that no other bot detection works this way. One attacker, many disguises Not every attack is obvious
The threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application, running the malware under a trusted process to slip past users who add such software to their antivirus exclusions. Russian cybersecurity vendor Kaspersky said the attackers built the disguise around QN Wallpaper, a genuine Chinese desktop-wallpaper tool
(DEFCON) How much of our Bluetooth firmware reverse engineering work can now be automated with LLMs?
Threat actors associated with Aurora (aka Aur0ra) ransomware have been observed using SpaceX's artificial intelligence (AI)-powered coding assistant Cursor to break into target networks, according to findings from CloudSEK and Gambit Security. The two independent analyses are based on exposed infrastructure associated with the Russian-speaking cybercrime group, leading to the discovery of its
Claude Code reads files, runs shell commands, invokes MCP tools, and acts through the credentials available on a developer’s machine. Anthropic’s new Compliance API endpoints give security teams their clearest view yet into that activity. They also expose a larger problem: activity logs alone cannot tell you whether an agent’s access is legitimate. AI has moved from the browser tab to the
A security researcher discovered nine vulnerabilities impacting ATM encryption and authentication software. But the problems extend far beyond your local cash machine.
Red Clippy is a tool for keeping track of pentest engagement records such as targets, scope, findings, and evidence while an AI coding agent performs the testing. It is **not an automated AI pentesting framework**. It is mainly aimed at pentesters who know what they are doing and want to use tools like Claude Code, Codex CLI, or any other MCP-compatible client alongside their normal workflow. You can define the target and scope from the panel, or let the LLM add them for you. From there, you can guide the LLM however you want. The LLM performs the testing and records the work and findings in Red Clippy. It can be useful for things like: * keeping track of what has already been tested * checking the same finding across multiple domains or assets * keeping engagement history for periodic retesting * not relying on the LLM to remember everything across sessions or keeping it all in text files [https://github.com/CSPF-Founder/red-clippy](https://github.com/CSPF-Founder/red-clippy) [](https://www.reddit.com/submit/?source_id=t3_1w369t9&composer_entry=crosspost_prompt)
A China-nexus cyber espionage actor tracked as Fire Ant has expanded a long-running campaign beyond VMware hypervisors to compromise Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) servers, and Linux management hosts used to route, authenticate, and manage high-value networks. Sygnia, the incident response firm that investigated the intrusion, said the actor
The U.S. Department of Justice (DoJ) on Friday corrected a previously issued press statement that several of its agencies were victims of attacks carried out by Chinese threat actors, instead now pointing out that they were among those targeted. Last week, the DoJ said the National Aeronautics and Space Administration, Federal Reserve, Department of Energy, Department of Justice, Department
To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the [Reverse Engineering StackExchange](http://reverseengineering.stackexchange.com/). See also /r/AskReverseEngineering.
Datadog Security Research observed a password spraying campaign attempting to authenticate as the AWS root user across more than 150 organizations.
GreyNoise + CrowdStrike: Real-Time Edge Intelligence in Falcon Next-Gen SIEM and Charlotte Agentic SOAR
Today we’re announcing an expanded integration between GreyNoise and the CrowdStrike Falcon® platform, with new content for CrowdStrike Falcon® Next-Gen SIEM and CrowdStrike Charlotte Agentic SOAR. The expanded integration includes a purpose-built Falcon Next-Gen SIEM dashboard, correlation rules that detect allowed inbound traffic from malicious infrastructure, and SOAR playbooks that bring GreyNoise threat context into automated response workflows.
Sunday, August 30
Hey everyone, I recently finished a write-up on **CVE-2026-68820**, the Windows AFD.sys vulnerability exploited by Lazarus. I tried to explain the attack chain from start to finish — starting with the fake recruiter/job offer, moving through the initial malware execution, the AFD.sys use-after-free vulnerability, and finally how **FudModule 3.1** was used after gaining SYSTEM-level access. I also covered some of the things I found interesting while researching it, especially how the rootkit interfered with Windows telemetry and how AFD.sys has been targeted by Lazarus before. The goal was to make it understandable even if you’re still learning Windows internals, while keeping enough technical detail for people working with threat hunting, DFIR, or malware analysis. **Write-up:** https://medium.com/@R00tPi/inside-cve-2026-68820-how-lazarus-turned-a-core-windows-networking-driver-into-a-system-level-216656703750 Would be interested to hear what you think, especially if you spot anything I could improve or explain better.
Bit of a lighter one but still pretty on brand for security culture. Wiz put together a literal bus for the dogs its security team brings to work and called them the threat sniffers. Not quite the infosec news in the usual breach/CVE sense but a pretty funny look at how some security teams build culture around the work
Microsoft has disclosed details of a new ClickFix variant, dubbed TerminalFix, that aims to trick users into running a malicious command in Windows Terminal or PowerShell. "While traditional ClickFix campaigns direct victims to the Windows Run dialog, TerminalFix campaigns apply the same technique but direct users to Windows Terminal or PowerShell instead, increasing the likelihood that complex
Saturday, August 29
Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and Patchstack, are listed below - CVE-2026-76581 (CVSS score: 9.8) - An authentication bypass flaw in
Carhartt breach looked like nearly 25M email addresses until millions of synthetic retail test records were removed
ShinyHunters published data allegedly stolen from Carhartt after claiming the company refused a $3.3 million ransom demand. There’s an interesting wrinkle in determining how many people were actually exposed. HIBP’s Email Address Extractor initially found **24,876,077 unique addresses** in the raw dataset. Analysis later showed that millions of records came from **TPC-DS**, an industry-standard synthetic dataset used to simulate retail analytics. Those records don’t correspond to real people, so they were removed from the breach count. HIBP ultimately loaded **12,933,413 unique email addresses** associated with the incident. The remaining leaked records reportedly contain names, phone numbers, and physical addresses. Researchers also found 15,057 genuine carhartt.com employee addresses, while Troy Hunt traced the data to Carhartt’s customer analytics warehouse in Databricks. Another interesting data point: about 83% of the confirmed addresses had already appeared in previous breaches loaded into HIBP. This seems like a good example of why raw record counts from breach dumps can be misleading. A dataset can be enormous without every row representing a distinct real-world victim. For anyone interested in the dataset analysis rather than just the final breach number, TechNadu’s report explains how the count dropped from almost 24.9 million extracted addresses to roughly 12.9 million confirmed ones, what TPC-DS contributed to the dump, and what personal information remained: [https://www.technadu.com/carhartts-shinyhunters-breach-was-almost-half-what-it-first-looked-like-exposing-13-million-emails-heres-why/633894/](https://www.technadu.com/carhartts-shinyhunters-breach-was-almost-half-what-it-first-looked-like-exposing-13-million-emails-heres-why/633894/) For people working with breach intelligence, how do you validate victim counts when a dump contains synthetic, duplicate, historical, or aggregated data? #
Plus: Hackers target over 100 US water systems, ICE puts in an order for robot dogs, and you’ll never guess what “MrChildPorn” was arrested for.
Friday, August 28
Berlin's state government has confirmed that it is the target of an extortion attempt following the August compromise of the city's state administrative network, and said it will not meet the extortionists' demands. The same statement disclosed that forensic work had found further data outflows in the portfolio of the Senate Department for Mobility, Transport, Climate Protection and Environment
Cosmos Labs has warned that a critical balance-handling flaw in the shared Cosmos EVM module was exploited to drain funds from six blockchains between August 20 and August 25, 2026. The vulnerability, designated GHSA-7g4w-cg88-2cq2, is rated Critical by Cosmos Labs and was published without a CVE identifier, a weakness classification, or a CVSS score. Affected versions are =
Fraudsters are exploiting enterprise chat apps like Teams and Webex to trick Chinese victims into transferring large sums of money, fueling a wave of complaints.
Google on Thursday announced new network security protections in Android 17 to bolster connection privacy, address cellular vulnerabilities, and safeguard the privacy of users' home networks. Topping the list is support for Encrypted Client Hello (ECH), a privacy standard that prevents networks from eavesdropping on which websites a user is visiting. "This new privacy standard works in tandem
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added a critical security flaw impacting ownCloud to its Known Exploited Vulnerabilities (KEV) catalog following reports that a Chinese-speaking threat actor weaponized the vulnerability to target a nuclear research body in the Philippines. The vulnerability, tracked as CVE-2023-49105 (CVSS score: 9.8), is a case of
Cybersecurity researchers have discovered a cluster of 18 Google Chrome and one Microsoft Edge extensions that were published over the last six months and harbored wallet secret stealing and cryptocurrency draining capabilities. The extensions, per Socket security researcher Karlo Zanki, share similarities in code and tradecraft, with evidence indicating that the campaign may have been active
Last month, on our second Content Independence Day, we announced a couple of features designed to give website owners more visibility and control over automated traffic: BotBase added a searchable directory of known bots to the Cloudflare dashboard, while Business Insights helped owners understand how crawlers interact with their content. We know that the ecosystem of bots is vast, making it all the more important for site owners to be able to manage bot traffic sustainably. But this ecosystem goes both ways. While website owners need to decide which automated traffic they allow, bot operators need a clear way to identify themselves, explain what their bots do, and keep that information current. BotBase works best when both sides can participate. When we launched BotBase, we said we would build tools to bring bot operators into this ecosystem. Until now, their experience largely ended at submission. After pressing submit, an operator had no easy way to check the submission's status, understand why it was rejected, or update an existing entry. Today, we start to change that with the launch of BotBase for Operators, tackling what bot operators need first: transparency. A new home for bot submissions Imagine you’re a bot operator looking to submit your bot to BotBase . Where on the dashboard would you look for such a submission form? Previously, the form lived under Manage Account → Config
There are a few reasons that MSPs start looking for ThreatLocker alternatives. You might have had enough of the friction with end users. The high levels of admin required to set policies for your different customers. Or that, while powerful, it can only handle certain kinds of security risks. If so, we wrote this guide […] The post 6 ThreatLocker alternatives that should make your shortlist appeared first on Heimdal Security Blog .
Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting the Unitree G1 EDU, including a Bluetooth Low Energy (BLE) path that can reach root on the robot's Locomotion PC. The flaws are tracked as CVE-2026-76639 and CVE-2026-76640, with the first involving a network-adjacent path through chat_go and bashrunner and the
An Identity Fabric knits fragmented identity systems into a coherent layer that observes how identities behave across applications, APIs, and infrastructure. As enterprise access spans more cloud services and automated workloads, identity security depends less on static configuration and more on runtime visibility. This article covers the architecture, the risks of unmanaged identities, and
VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices. The implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.
Alpharetta, Georgia, cops share data with thousands of Flock users, ranging from federal agencies to a fish and wildlife commission. The reasons why show how vast—and invasive—the network has become.
PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. The company has released an emergency patch for v25 and v26 to address the issue. It said it's "aware of confirmed customer incidents and is treating this matter with the highest priority." An
GreyNoise is observing automated scanners posing as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies, using forged user agents while requesting the files where misconfigured web servers frequently leak secrets and credentials.
Thursday, August 27
After an affair with a fellow police officer ended, a Georgia cop used Flock to track her movements—and those of a man whose vehicle often showed up near hers, internal investigation records show.
Big Pineapple , the platform behind 1.1.1.1 , Gateway DNS , DNS Firewall , AS112 , and several other Cloudflare DNS services, stores over 250 billion DNS cache entries at any given time. At that scale, wasting a single byte per entry costs more than 250 gigabytes of memory across our fleet. Five successive changes to how cache entries are stored in memory cut the per-entry footprint by over 50%. Across our fleet, these changes freed up roughly 100 terabytes of memory, equivalent to the amount of RAM in 130 of our Gen 13 servers . The cache also got faster. Insert throughput rose 43% and lookup latency dropped 19%, as fewer allocations and better memory locality meant we did not trade speed for space. What we cache On cold start, Big Pineapple starts out with an empty cache. As DNS queries arrive, the cache fills until it hits its maximum entry count, at which point we evict older or less popular items to make room. The exact cache size varies by data center. When EDNS Client Subnet (ECS) is in use, authoritative servers return different answers depending on the client's network, so we cache multiple versions of the same query. This increases both the number of entries and the memory each one
In 2026, insider threats are probably a bigger risk than you think. In fact, they could cost your organization $19.5 million a year. But it’s not really a problem with hackers, spies, or malicious employees. Instead, it’s about negligence, training, and IT privileges. Often, the most expensive mistake is a stolen credential doing exactly what […] The post 50+ insider threat statistics for 2026 appeared first on Heimdal Security Blog .
Authorities in Australia have arrested two men believed to be members of TeamPCP , a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two men from Western Australia, aged 21 and 23, were arrested in connection with a “sophisticated cybercrime syndicate that allegedly created malicious open-source software to rob thousands of global businesses.” The AFP did not name the defendants, but KrebsOnSecurity learned the 21-year-old suspect’s real identity in June, and has been communicating with him ever since. This story includes interviews with TeamPCP’s self-described spokesperson, and examines clues left behind by the TeamPCP leader that likely led to his undoing. TeamPCP vaulted onto the cybercrime scene in late 2025, embedding malicious code in hundreds of open source software tools and extorting victims for profit. Members of the group made headlines by compromising corporate cloud environments using a self-propagating worm dubbed Shai-Hulud , which added malicious code to open source programs maintained by developers whose credentials at public code repositories like GitHub or NPM were phished or stolen. Writing for Wired , journalist Andy Greenberg described TeamPCP’s core tactic as a kind of cyclical exploitation of software developers. “The hackers gain access to a network where an open source tool commonly used by coders is being developed,” Greenberg wrote in May . “The
Getting PCI DSS Requirement 11.4 Right From the Start Enterprises often know they need PCI compliance penetration testing but remain uncertain about what makes a test compliant. PCI DSS v4.0.1 Requirement 11.4 involves considerably more than scheduling an annual external assessment. Scope, internal and external testing, methodology, tester qualifications, segmentation validation, remediation, retesting, and evidence all influence whether the work will satisfy assessor scrutiny. This guide explains what enterprise security and compliance teams should have in place before their next PCI DSS assessment. Introduction PCI DSS v4.0.1 Requirement 11.4 requires documented internal and external penetration testing, generally at least annually and after significant changes. Segmentation controls need separate testing where segmentation reduces cardholder data environment scope, and service providers face a shorter six-month cycle. Vulnerability scanning does not replace penetration testing, and exploitable findings need correction and retesting. Confirm your exact obligations with your QSA before treating any single testing model as sufficient evidence. The post PCI DSS Penetration Testing Requirements: What Enterprises Actually Need for Compliance appeared first on Synack .
Wednesday, August 26
As part of Patch the Planet , we received preview access to GPT 5.6-Cyber with a simple task: evaluate its cyber capabilities. Recent events inspired me to give it a challenge to work through: escape the VM I’d normally use for sandboxing. The target was a QEMU/KVM VM on my Linux dev machine (Debian Linux 12, AMD Zen3). It escaped the VM three different times. First, it used recently disclosed bugs in my host kernel. When I fully updated, it used disclosed bugs that had not yet reached package maintainers or were not classified as security bugs. When I rebuilt QEMU and dependencies from the latest upstream source, it found several 0-days. It operated autonomously for hours, backtracked from approaches that didn’t work, pulled code and research papers, wrote oracles, made its own minimal examples, and aimed for a reusable, reliable exploit, all with minimal handholding and prompting. My main job was to physically reboot the machine when it hardlocked the host kernel. If it wasn’t clear before, I will state it plainly: you can no longer assume a mere VM will contain a sufficiently advanced AI agent. To use a 2010s term of art, you should treat such agents as an advanced persistent threat. Advancing cybersecurity capabilities Let’s imagine a common situation: you want to run an AI agent, but need its full capabilities, including the ability to download, build and debug software; do research; sift through dependencies; set up fuzzers; triage vulnerabilities; and stand up services under different configurations. The generally accepted solution is to set up a
It’s tempting for MSPs to write off event sponsorship in education as a waste of money. You sponsor an event, hand out flyers, follow up with an email, and hear nothing back. Rick Cowell says you’re judging it on the wrong timescale. Rick spent 20 years as a school network manager, and he founded the […] The post The Planting Seeds philosophy. Selling into schools takes years, not quarters appeared first on Heimdal Security Blog .
Tuesday, August 25
A few years ago, Dow's cyber engineering team made the switch from point-in-time pentesting to continuous coverage for their high-value assets. How'd they do it? By partnering with Synack. And keep in mind this was before the recent wave of AI-powered pentesting solutions. Dow was ahead of the curve. The post How Continuous Pentesting Became Standard Practice at Dow appeared first on Synack .
Overview The Kaltura HTML5 Player V2 Library (mwEmbed / html5lib) contains two vulnerabilities, both involving the same insecure deserialization flaw, that enable arbitrary file read and remote code execution. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases that expose the vulnerable mwEmbedLoader.php endpoint. Notably, only versions of the legacy player (Player V2) are vulnerable; these issues do not affect any versions of the currently supported Kaltura Player V7. Description Kaltura is an AI video platform that provides tools for video management, publishing, playback, and integration with web applications. Kaltura’s HTML5 player library exposes the mwEmbedLoader.php endpoint, which accepts a user-controlled ServiceUrl parameter as the target URL for backend API requests. The KalturaClientBase PHP client library fetches data from this URL and automatically deserializes it using PHP's unserialize() function without validating source, scheme, or content. CVE-2026-19913 results from the combination of this unsafe deserialization flaw and improper error-handling behavior. An attacker can provide the location of a local file to ServiceUrl as a file:// path, and the client will fetch the internal file's contents and attempt to deserialize them. When deserialization fails, the raw bytes are reflected back to the client in the resulting error message, enabling the attacker to read any file accessible to the web-server user. CVE-2026-19912 is caused by insufficient sanitization of the parameter uiconf_id , which is appended to the base cache f
Illinois prosecutors shared defendants’ personal data with federal immigration agents without criminal warrants, public disclosure, or legislative oversight.
We found and reported a bug in Provenance Blockchain, a public proof-of-stake chain built on Cosmos SDK , that lets any user grant themselves admin control over marker accounts without holding a single token. Provenance covers a range of financial services, including on-chain tokenized loans, private equity tokens, bridged assets, and asset registries. Our bug affected 82 markers representing live financial assets on mainnet. We found the bug, which affects versions before 1.28.0, in March 2026, and reported it to Provenance on April 1. It was mitigated in PR #2627 (commit c81fd65 ), which shipped in v1.28.0 on May 1, 2026, and fixed in PR #2734 , which shipped in v1.29.0 on June 8, 2026. What is a marker? The marker module is Provenance’s core primitive for fungible tokens. Chain participants can issue a new asset on Provenance by submitting a MsgAddMarkerRequest transaction; the chain creates a dedicated account for that asset, called a marker. Each marker is a special account type that controls: A denomination (e.g., uusd.trading , cusd.deposit , cguaranteedrateomni ) An access control list governing who can mint, burn, withdraw, deposit, or administer the token A supply field recording the canonical token count An escrow balance (the marke
Some months ago, I performed a web application penetration test on an application that used passkey for authentication. As part of the assessment, I also tested the passkey implementation and noticed some unusual behavior. During the debugging process, I created two short JavaScript helper functions that can be used to hook the browser APIs involved in passkey operations, allowing the passkey configuration to be inspected and manipulated. This gave me the ability to reliably perform some passkey tests and assess the configuration and implementation. “Fishing with a Passkey ”
Hey everyone, Over the last few months, I've been curating and categorizing a massive catalog of malware families designed specifically for incident responders, SOC analysts, and threat hunters. I got tired of having to scrape together fragmented IOCs and CISA advisories every time a new variant popped up, so I built a centralized, open-source dataset. \*\*What's included:\*\* \* \*\*2,800+ Malware Families\*\* categorized by type (Ransomware, InfoStealer, Wiper, etc.) \* \*\*Framework Mapping:\*\* Families are mapped to MITRE ATT&CK techniques, NIST CSF guidelines, and official CISA advisories. \* \*\*Response Playbooks:\*\* Actionable containment steps and "what to avoid" during an active incident. \* \*\*Formats:\*\* Available via a web UI, JSON API, Parquet, and JSONL. It’s completely free and Apache-2.0 licensed. You can browse the catalog here: [https://jordanricky1604-ship-it.github.io/malware-families-catalog/](https://jordanricky1604-ship-it.github.io/malware-families-catalog/) I'd love to hear your feedback on the schema or if there are specific families you think need deeper analysis. I'm actively maintaining and updating this!
Monday, August 24
You likely noticed the recent redesign of the Cloudflare Blog. We added dark mode, modernized the look and feel, and made a lot of other small improvements along the way. What you might not have noticed – well, except for those who are more terminally online – is that the redesign was part of a much bigger migration project. On Wednesday, August 12, we moved the blog to EmDash , a content management system (CMS) built especially to work on Astro and with Cloudflare. We’ll take you into the migration story – what we learned and how EmDash got better – as well as into the benefits we’re already seeing from a new platform. We are Customer Zero At Cloudflare, Cloudflare itself is Customer Zero. This means that we use our products. And – in use – we make them better for ourselves and our customers. This is a very real cultural value at Cloudflare. The burden of proof is on you if you want to use an external vendor. Why can’t that team support you, what gaps are there, why can’t those gaps be filled, and are those “gaps” true requirements? This preference is even enshrined in our internal engineering standards, known as our Codex. We don’t just build products for others; we build them to run Cloudflare itself. We are our own first, most demanding customer. We validate scale, security, and usability on our own massive infrastructure before a paying customer ever touches the product. If a product breaks, it breaks us first. This forces us to fix issues immediately, ensuring that by the time a feature reaches the enterprise, it has already survived the harshest production environment on earth. With the launch of EmDash and some limitations with our
Before dawn on 10 July 2024, one ransomware attack took down ten schools inside the same multi-academy trust at once. Every control that eventually stopped it was something the Department for Education’s own cyber security standard already asked for, well before the attack. That’s a case DfE has published on its own Cyber Security Hub, […] The post What the DfE’s cyber security update means for multi-academy trusts appeared first on Heimdal Security Blog .