SAP has released patches to address a maximum-severity security flaw impacting Commerce Cloud (Data Hub Adapter) that could result in arbitrary code execution. The vulnerability, assigned the CVE identifier CVE-2026-58231, is rated 10.0 on the CVSS scoring system. It has been described as a case of insufficient authorization checks and input validation. "SAP Commerce Cloud allows an
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 11:40 am
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
The security researcher going by the name Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has released a proof-of-concept (PoC) for a new Microsoft zero-day called ShieldBreak. The vulnerability, rooted in Microsoft Defender for Windows, demonstrates a patch bypass for CVE-2026-50656 (CVSS score: 7.8), otherwise known as RoguePlanet. RoguePlanet has been described
Every Signal chat starts the same way: the client asks the Signal server for the public key associated with your contact’s phone number. But how do you know the server gave you the right key? A compromised server could provide a false public key, allowing the client to encrypt messages to an attacker rather than the intended recipient. Until now, the only way to detect such malfeasance was to verify safety numbers with your contact in person or over a trusted channel. Signal recently launched an alternative: Automatic Key Verification , a feature that helps validate that your chats are secure without requiring direct safety number comparison . Trail of Bits built and operates one of the three auditors that make this system trustworthy. Our auditor, which is an independent implementation written from scratch, continuously checks that the Automatic Key Verification system behaves honestly. How key verification works Automatic Key Verification is a form of “key transparency” that makes mismatch attacks harder to hide by creating a globally consistent view of the set of public keys associated with each phone number. The Signal app now performs a periodic self-check to ensure that all keys stored in the global map for your account belong to your devices. If the app is unable to verify the log, or finds that not all keys are expected, the user is presented with a warning that “Automatic Key Verification is currently unavailable for your device.” Automatic Key Verification may also be unavailable for other reasons, as outlined in Signal’s documentation
Mozilla has scrapped the cryptographic key behind Firefox and Thunderbird downloads for Linux after an unencrypted copy of it was committed by mistake to one of the company's own private code repositories. That key is how a user, or a Linux distribution packaging the browser, confirms a downloaded Firefox tarball came from Mozilla and was not tampered with. That decision carries a cost for
Security researchers invented a cryptocurrency startup, advertised developer jobs, and hired three people they believe were North Korean operatives. Every virtual machine the company issued was recording. The onboarding paperwork is the part hiring teams can use. The first hire claimed to live in Pasadena, Texas, then sent a California driver's license and a New York bank account. The
Latest
Wednesday, August 12
Adobe has shipped updates to address multiple critical security vulnerabilities impacting ColdFusion, Commerce, and Campaign Classic that, if successfully exploited, could result in arbitrary code execution and privilege escalation. The most severe of the flaws are listed below - CVE-2026-48362 (CVSS score: 10.0) - An operating system command injection vulnerability in ColdFusion that could
Experts allege that two recent incidents in California show the extreme lengths that criminal organizations are willing to go to to steal servers and other gear meant for data centers.
Chaining 3 CVEs to exfiltrate sensitive ERP data.
Threat actors have begun to actively exploit a recently patched critical security flaw in Broadcom VMware vCenter, according to new findings from QUIRSO. The vulnerability in question is CVE-2026-59310 (CVSS score: 9.8), a directory-traversal vulnerability in the VMware vCenter server that a malicious actor with network access can exploit to execute arbitrary code. Patches for the flaw were
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite A little wind noise, a little connectivity flakiness, and a little lip-sync issues from YouTube, but look at that view! 朗 Back to business, it's the Brinks Home FAQ I found most interesting this week. I mean, how do you write your own FAQ then fail to actually answer most of the questions?! Being conscious that they're the target of criminal extortion and are genuinely the victims here, I still struggle to grasp how simple incident response questions can be so lawyer-speaked as to remove all sensible meaning from the responses. But this is how these things tend to play out these days (speaking generically, yet to be seen fully for Brinks): hacker gets data by just calling up and asking for it (vishing -> OAuth), hacker demands money, hacker gets no money so dumps the data, company gets a gazillion class actions overnight and lawyers up to the hilt, customers get notified "where legally required" (which it usually isn't) 路♂️
Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them. Threat intelligence firm CloudSEK now says a dataset it obtained, built from roughly 434,000 files the attackers captured, maps potential exposure to more
SAP has released patches to address a maximum-severity security flaw impacting Commerce Cloud (Data Hub Adapter) that could result in arbitrary code execution. The vulnerability, assigned the CVE identifier CVE-2026-58231, is rated 10.0 on the CVSS scoring system. It has been described as a case of insufficient authorization checks and input validation. "SAP Commerce Cloud allows an
The security researcher going by the name Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) has released a proof-of-concept (PoC) for a new Microsoft zero-day called ShieldBreak. The vulnerability, rooted in Microsoft Defender for Windows, demonstrates a patch bypass for CVE-2026-50656 (CVSS score: 7.8), otherwise known as RoguePlanet. RoguePlanet has been described
Cisco has warned that a new vulnerability impacting Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software has been exploited in the wild. The high-severity flaw, tracked as CVE-2026-20349 (CVSS score: 8.6), is a case of insufficient error checking when processing HTTP requests that could allow an unauthenticated, remote attacker to trigger
Tuesday, August 11
Microsoft today released updates to remedy at least 398 security vulnerabilities in its Windows operating systems and supported software, including one weakness that is already being actively exploited and two others that were publicly detailed prior to today. Image: Shutterstock, Mallika Home Studio. August’s overstuffed bundle of patch joy from Microsoft did not eclipse its recording breaking release of more than 570 security updates last month , but it is double June’s then-record batch of nearly 200 fixes . Microsoft has attributed the recent patch deluge to vulnerability discoveries aided by artificial intelligence, and experts roundly agree that Windows users should get used to the idea of Patch Tuesdays (the second Tuesday of each month) covering hundreds of newly discovered security flaws. Fully 42 of the 398 flaws that Microsoft patched today earned Redmond’s most-dire “critical” rating, meaning they are severe enough that malware or malcontents could exploit them to gain remote control over a Windows computer with little to no help from the user. The sole known 
I registered an expired DMARC reporting domain (gca-emailauth\[.\]org) for $10. It had been published as the aggregate-reporting address in Global Cyber Alliance DMARC training docs going back to a 2019 bootcamp, and at some point it lapsed. Shortly after registration, aggregate DMARC reports for 86 domains across 20+ organizations started arriving. 56 belonged to The Toro Company (NYSE-listed), including myturf\[.\]com, their distributor platform, which sits at p=none. The rest - University of Wisconsin–Stevens Point (14 subdomains), the North Carolina School of Science and Mathematics, Ennis ISD (Texas), Great Prairie AEA (an Iowa education agency serving 35,000 students), two county governments, and several commercial domains. For most of these it was a second rua address sitting behind a working commercial processor (Proofpoint, in Toro's case). Reports still arrived at the primary. GCA's engineers later traced it to a former partner who'd held the domain and let it lapse - the dependency was never written down. As of my last sweep, 65 of the 86 still publish the endpoint. We disclosed to everyone whose reports we were receiving; only 21 domains stopped publishing the endpoint, and almost nobody replied. After 8 months of owning the domain, we coordinated a transfer back to GCA.
Cybersecurity researchers have discovered a new version of the Kimwolf/AISURU Android and Internet of Things (IoT) botnet that comes with significant improvements to improve its operational resilience and conduct distributed denial-of-service (DDoS) attacks. The new version, tracked as Kimwolf v7, was discovered by Palo Alto Networks Unit 42 in February 2026. "Kimwolf v7 adds an HTTP/2-based
Anyone sharing their screen on a Zoom call could have taken over the computers of everyone watching, and anyone watching could have taken over the presenter's. The flaw sat in the annotation tool, the feature that lets participants draw and type on a shared screen, and it asked nothing of the victim beyond being in the meeting. No click, no download, no prompt, and nothing on screen to show it
The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new social engineering campaign orchestrated by Russian nation-state threat actors targeting IT workers in the country by masquerading as recruiters to trick them into installing malware. CERT-UA pinned the activity on a threat cluster it tracks as UAC-0145, which is a subgroup within Sandworm (aka APT44,
Every Signal chat starts the same way: the client asks the Signal server for the public key associated with your contact’s phone number. But how do you know the server gave you the right key? A compromised server could provide a false public key, allowing the client to encrypt messages to an attacker rather than the intended recipient. Until now, the only way to detect such malfeasance was to verify safety numbers with your contact in person or over a trusted channel. Signal recently launched an alternative: Automatic Key Verification , a feature that helps validate that your chats are secure without requiring direct safety number comparison . Trail of Bits built and operates one of the three auditors that make this system trustworthy. Our auditor, which is an independent implementation written from scratch, continuously checks that the Automatic Key Verification system behaves honestly. How key verification works Automatic Key Verification is a form of “key transparency” that makes mismatch attacks harder to hide by creating a globally consistent view of the set of public keys associated with each phone number. The Signal app now performs a periodic self-check to ensure that all keys stored in the global map for your account belong to your devices. If the app is unable to verify the log, or finds that not all keys are expected, the user is presented with a warning that “Automatic Key Verification is currently unavailable for your device.” Automatic Key Verification may also be unavailable for other reasons, as outlined in Signal’s documentation
Security researchers found a way to enter Microsoft SharePoint servers as any user, including an administrator, with no valid account. A significant part of the work that found it was done through an AI agent. The flaw, tracked as CVE-2026-55040 (CVSS 9.1), affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Microsoft's
The ransomware group known as DeadLock has been observed using decentralized infrastructure to facilitate victim communications and data leak operations in a bid to improve operational resilience. "Its recovery ecosystem combines the Session messaging network with blockchain-backed services that store and deliver resources used throughout the extortion process," the Microsoft Threat
[Tool/Writeup] ALPC-Enumerator: A dynamic, userland C++ tool to enumerate ALPC ports and detect ALPC spoofing
Hey everyone For some time now, I've been digging into ALPC, it's a fascinating and deliberately under documented corner of Windows internals. I originally built this userland enumerator to mitigate userland restrictions, but it’s structured as a simple C++ program that can easily be chained to enhance other reverse engineering workflows. To ensure it runs effectively across different Windows builds, I made it completely dynamic, resolving structures at runtime rather than relying on hardcoded offsets. One specific angle that fascinated me during this research was ALPC spoofing. A malicious process can easily spoof its name and path over ALPC, but it *cannot* spoof the type and a signer. This mismatch becomes a highly reliable detection signal for defensive purposes. I've verified the output and every angle using WinDbg, and both logs are available in the GitHub repo. I put together a full technical breakdown detailing the dynamic PPL-aware enumeration approach and the spoofing detection mechanics here:[**https://medium.com/@sphinx\_321/userland-alpc-enumeration-dynamic-ppl-aware-approach-283541194102**](https://medium.com/@sphinx_321/userland-alpc-enumeration-dynamic-ppl-aware-approach-283541194102) I'm planning to broaden this research next to map out the local RPC/ALPC attack surface, so I might drop more tools regarding this soon. I’d love to hear your thoughts or feedback on the implementation!
Author here. We discovered a vulnerability in `docker cp` that allows a malicious container to create or overwrite files on the machine running the Docker CLI. The exploit combines a filesystem race in Docker’s archive creation with unsafe symlink handling during extraction. Depending on the CLI user’s privileges, this can lead to developer-account compromise or root code execution. Docker confirmed that `sbx cp` was also affected. Fixed versions: * Docker Engine/CLI 29.7.2+ * Docker Desktop 4.86.0+ * Docker Sandboxes 0.38.0+ Happy to answer technical questions.
VU#431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks
Overview Two vulnerabilities have been identified in the Trusted Platform Module (TPM) 2.0 reference implementation: CVE-2026-6726 – Information leakage via falsified TPM keys. CVE-2026-6727 – A timing side-channel vulnerability in RSA OAEP decryption. An attacker with privileged access to a TPM command interface may be able to exploit these vulnerabilities by sending specially crafted TPM commands. Successful exploitation could allow the attacker to decrypt ciphertexts encrypted to affected TPM-managed RSA keys, including the RSA Endorsement Key (EK), or obtain credentials for falsified TPM keys, enabling forged TPM 2.0 attestations. These vulnerabilities are also documented by the Trusted Computing Group (TCG) in advisories - TCGVRT010 and TCGVRT0011 : Description Trusted Platform Module (TPM) technology provides hardware-backed cryptographic services for modern computing platforms. TPMs are designed to resist tampering and may be implemented as discrete chips, integrated hardware, firmware-based TPMs (fTPMs), or software implementations used in cloud and virtualized environments. The Trusted Computing Group (TCG) maintains the TPM specifications and publishes a reference implementation to assist vendors in developing TPM-compliant products. Two vulnerabilities were identified in the TPM 2.0 reference implementation. CVE-2026-6727 A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differ
OpenAI on Monday unveiled a new cybersecurity-focused model called GPT‑5.6‑Cyber that it said is focused on vulnerability research, penetration testing, and incident response. "Built on GPT‑5.6 Sol, it is trained to improve capabilities on several specialized cybersecurity tasks (e.g., finding zero-day vulnerabilities and developing exploit chains) and to reduce refusals for certain higher-risk
Researchers say it took fewer than 20 prompts for a public AI tool to find a flaw (now fixed) allowing anyone on a Zoom call to hijack another participants’ device.
Mozilla has scrapped the cryptographic key behind Firefox and Thunderbird downloads for Linux after an unencrypted copy of it was committed by mistake to one of the company's own private code repositories. That key is how a user, or a Linux distribution packaging the browser, confirms a downloaded Firefox tarball came from Mozilla and was not tampered with. That decision carries a cost for
Security researchers invented a cryptocurrency startup, advertised developer jobs, and hired three people they believe were North Korean operatives. Every virtual machine the company issued was recording. The onboarding paperwork is the part hiring teams can use. The first hire claimed to live in Pasadena, Texas, then sent a California driver's license and a New York bank account. The
RSModsPlus: Digital drop pedal and speaker mode for Rocksmith 2014 which shifts the song to match your guitar's tuning
Windows Plug and Play can be abused to fetch signed vendor software for an emulated USB device and execute privileged installation components that researchers chained to SYSTEM access on a fully updated Windows 11 machine. The same PnP path can be triggered over Remote Desktop without physical hardware when supported Plug and Play or low-level USB redirection is enabled; Microsoft says that
SMAP is Pre-Disarmed: How a Stack Pivot That Shouldn't Work Revealed a Kernel-Wide Design Compromise
While working through a kernel exploit chain on Windows 11, I noticed that a stack pivot into user-mode memory didn't trigger SMAP. I wrote up three experiments to figure out why. Short version: the normal syscall entry path arrives with RFLAGS.AC=1. SMAP is effectively disabled for any code reached through a standard IOCTL dispatch. This aligns with what MSRC documented back in 2020 (the Windows kernel simply wasn't built with SMAP in mind, and retrofitting it would touch \~2,900 locations: [here](https://github.com/microsoft/MSRC-Security-Research/blob/master/papers/2020/Evaluating%20the%20feasibility%20of%20enabling%20SMAP%20for%20the%20Windows%20kernel.pdf)) My conclusion isn't novel here. It's just an experimental confirmation of the architectural compromise on current builds. I just wanted to shine the light on this blind spot.
A malicious tool server connected to an AI coding assistant can quietly walk off with SSH keys, environment secrets, source code, and customer data without ever sending one obviously harmful instruction. The trick can work even after a blunt version of the same theft is refused: split the request into fragments that each look routine, place them in channels the assistant already uses, and let
Cybersecurity and intelligence agencies from South Korea and the U.S. warned of Gunra ransomware attacks targeting critical infrastructure sectors and organizations across the world. Targets of these attacks include healthcare and public health, financial services, government services and facilities, and professional and nonprofit services. "Gunra is another variant in the ongoing trend of
Most security leaders can report what they spent on bug bounty last year. Far fewer can understand the value being delivered by proving what it actually tested. Open programs show which bugs were reported, not which assets received real, skilled attention. Managed bug bounty closes that gap. Researcher-hour and traffic analytics turn testing depth into evidence you can measure, not an assumption you have to trust, giving you coverage you can hand to a board, an auditor, or a compliance team. The post Managed Bug Bounty: Why Provable Coverage Beats Blind Spend appeared first on Synack .
IP sharing has steadily increased over the past decade, with fewer than 0.2% of domains using a unique IPv4 address and up to millions of domains co-located on single IP addresses. On the client side, traffic is similarly skewed: 5% of client IP addresses account for over half of observed requests
Monday, August 10
I recently released NoiseHound, a project that uses BloodHound attack-path data to look at Active Directory from a detection-engineering perspective. BloodHound is very good at answering: **“What paths exist to a high-value objective?”** NoiseHound adds another question: **“Which of those paths currently has the weakest detection coverage, and why?”** NoiseHound maps BloodHound relationships against their expected detection surface, including: * Windows Security event telemetry * Sysmon visibility * EDR / ITDR visibility * MITRE ATT&CK techniques * audit-policy dependencies * environment-specific detection controls The goal is not to assign a universal “detectability score” to an AD technique. Detection varies significantly depending on audit configuration, endpoint tooling, SIEM content, identity monitoring, and SOC maturity. Because of that, NoiseHound supports environment-specific profiles and measured calibration. For example, the same BloodHound path can rank very differently depending on whether an environment has: * appropriate Windows auditing enabled * Sysmon deployed * PowerShell logging configured * Microsoft Defender for Identity * EDR coverage * relevant SIEM detections * custom detection content The part that may be most interesting from the blue-team side is the defensive analysis mode. Instead of simply ranking attack paths, NoiseHound can analyze the quietest viable paths and identify **what makes them quiet**. That includes identifying: * missing telemetry * audit-policy gaps * weakly monitored BloodHound relationships * detection coverage gaps * controls that would increase the detection cost of an attack path It can also ingest Sigma rules and compare their telemetry / ATT&CK coverage against the BloodHound edge corpus to help identify relationships that currently lack corresponding detection coverage. Current functionality includes: * BloodHound CE ZIP / JSON ingestion * direct Neo4j ingestion * environment-aware path scoring * probability-of-detection ranking * Pareto analysis across detection probability, noise, and hop count * AD CS ESC1–8 path synthesis * Sigma rule coverage analysis * lab-based calibration * measured audit / EDR / SIEM profiles * defensive detection-gap analysis * JSON, text, and standalone HTML reporting One of the ideas behind the project is that attack-path analysis can be useful for more than identifying privilege-escalation routes. If BloodHound shows that an attacker can reach Domain Admin through several different paths, defenders should ideally understand not only that those paths exist, but also **which one their current monitoring stack is least likely to see**. That provides a way to prioritize detection engineering around paths that are both viable and poorly instrumented. NoiseHound does not execute techniques against systems. It analyzes existing BloodHound data and models the detection surface around those relationships. GitHub: [https://github.com/warpedatom/noisehound](https://github.com/warpedatom/noisehound) The scoring model and telemetry mappings are intentionally transparent and extensible. I’d be especially interested in feedback from detection engineers and blue-team practitioners around: * edge-to-event mappings * audit-policy assumptions * Sigma coverage analysis * telemetry gaps I'm missing * how useful this type of attack-path prioritization would be in real detection-engineering workflows
Found inside camview.tar.gz on an exposed server: a Docker project used to find, exploit, and stream internet-exposed IP cameras in a browser. The operator's own name for it, from the archive and README, is camview. It is not connected to any legitimate app of the same name. * Built with FastAPI and Uvicorn, Python 3.11 image with FFmpeg, nmap, and masscan baked in * FFmpeg transcodes the camera RTSP feed to MJPEG for display; nmap and masscan provide the initial scan layer * The audit feature is where the exploitation happens: cameras are fingerprinted across a dozen-plus brands, queried over ONVIF, tested against known CVEs, then brute-forced over HTTP and RTSP with a 3,811-entry username:password dictionary * Working credentials and stream URL patterns are written to disk and prioritized on later runs, so it improves per vendor * The exploitation itself is not custom. camview wraps Ingram, a public webcam scanner, mounted in from the host * On a second, unrelated directory, scripts named camworm.py and routerworm.py follow a compromise-then-proxy pattern and contain no actual worm functionality despite the naming We rebuilt the UI in a sealed test environment by running it with empty data. Full analysis in the post: [https://hunt.io/blog/russian-speaking-operator-ukrainian-camera-toolkit](https://hunt.io/blog/russian-speaking-operator-ukrainian-camera-toolkit)
Overview The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability. The extension installation process extracts uploaded .zip files then uses the zip entry filenames as filesystem paths, without validating that the resolved path stays inside the intended directory. This vulnerability is tracked as CVE-2026-18412. Description OpenCart is a free, open‑source e‑commerce solution designed to help businesses build and manage online stores. OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extension containing file path traversal sequences, such as ../ . With this vulnerability, an attacker can write files, such as a PHP web shell, into the webroot directory. Impact If a user with valid admininistrator credentials installs a malicious extension, it could allow a user to remotely execute code with the same privileges that OpenCart has on the target server. This includes the potential creation of a web shell, which could further enable remote execution of system-level commands. The vulnerability was confirmed against version 4.2.0.0, but other 4.x versions of OpenCart may be affected. Solution Unfortunately, OpenCart could not be reached to coordinate this vulnerability, and a patch is not available at the time of this writing. The CERT/CC recommends that OpenCart users update to the latest version and avoid installing extensions from unknown or untrusted sources. Additionally, OpenCart should be configured to run
PerspectiveGraph: Attack-path engine that measures how wrong it is - published calibration (Brier/ECE) against recorded red-team verdicts
I designed and built an engine that computes end-to-end routes from internet exposure to sensitive assets, ranking them by a composite priority that weighs what the route can reach and how exposed the entry point is. What that gives you operationally, so far: * Runtime-confirmed routes (Falco): "this route is being walked right now", not in theory. * KEV on path, and MITRE ATT&CK mapping per hop, with each hop's probability. * Closed-loop verification: before you open a ticket, the engine simulates removing the edge and tells you how many routes actually disappear. * Suppression board with reason, owner and expiry: an accepted route has a name against it, and comes back when the acceptance lapses. * OSCAL export for GRC and NDJSON for SIEM. I'm posting it here for one reason in particular, besides looking for contributors, especially on the calibration side, every engine of this kind emits probabilities without telling you how much to trust them. This one grades itself: it records red-team/BAS verdicts on the routes it surfaced, computes Brier and ECE, and draws the reliability diagram, ending on an explicit verdict (underconfident, overconfident, well-calibrated). That is how I found a real false positive of my own. Using AWS iam:SimulatePrincipalPolicy as an oracle, the comparison revealed that the engine had been treating an IAM permission boundary as if it granted permissions. A boundary caps to the intersection and never grants and "bounded" does not mean "safe": a boundary carrying AdministratorAccess does nothing at all. It is not a scanner, nor a CNAPP, and it does not replace either. It is very much under active development, and technical criticism is welcome. Repo: [PerpsectiveGraph - GitHub repository](https://github.com/luiacuaniello/perspectivegraph)
i got tired of switching between windbg ida and x64dbg so i built an orchestrator to control them all
To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the [Reverse Engineering StackExchange](http://reverseengineering.stackexchange.com/). See also /r/AskReverseEngineering.
Sunday, August 9
HANDLE Duplication internals : What happens behind the scenes when you call kernelbase! DuplicateHandle( )
I am making a Emulator Bypass of a Lame Game "Free Fire" it works perfectly and not give any type of Ban/Blacklist in Casual modes Games but as soon as i start a Ranked match it triggers blacklist ! I have a Safe Bypass DLL ! I have attached the DLL link. Someone Recreate it i will pay !
Evil Fonts deceive a viewer by rendering a different letter than is actually on the disk. Evil Fonts can poison HTML, DOCX, PDFs, and anywhere else you can bring your own fonts. Works great in Windows corporate networks for bypassing security tooling, initial access through JavaScript free click fix (beats mitm web security tooling), and leaving traps around the network to harvest shells. Imagine thinking you are copying whoami but what is actually on the disk is rm -rf \\\~ Demos: (Use desktop) https://doctoreww.github.io/EvilFontTool/ For the demos, copy and paste the HTML/DOCX to a notepad to remove the evil fonts. For the AI ones imagine your security tooling inspects the benign text on disk, but shows the obviously malicious extortion to the user. Labs: https://github.com/DoctorEww/EvilFontTool/blob/main/labs%2FREADME.md Lab Walkthrough: https://github.com/DoctorEww/EvilFontTool/blob/main/labs%2Fwalkthrough.md Some evil font uses: Tamper homework to make it so students poison AI queries Poison help desk documentation Bypass email filters Clickfix Beat resume AI filters
Saturday, August 8
I recently analyzed a multi-stage PowerShell payload delivery chain involving heavily obfuscated PowerShell loaders and remotely hosted payloads. The analysis covers PowerShell deobfuscation, hidden execution, Base64/XOR decoding, a decoy “Verification complete!” prompt, payload delivery, and IOCs. Initial indicators: `203[.]188[.]171[.]166` `dorenzaa[.]com`
Plus: A judge rules cell tower dumps unconstitutional, water utility hacks spread to a dozen states, a phishing email opens a missile-parts supplier’s inbox, and a ransomware boss gets 16 years.
Two security researchers bought cheap domains—including noreply.net and deleteduser.com—and set up email listening services. Hundreds of companies are sending them corporate secrets.
Yes, given that the legacy SCT protocol has known security vulnerabilities such as sctphantom, the industry strongly recommends deprecating it and migrating to more secure modern standards to ensure system security.
Friday, August 7
The `meetings`collection has no tenant isolation. Any authenticated tl;dv user can query every meeting across every account on the platform. Each meeting record hands you the creator's email address, the conference ID (which is a joinable Google Meet or Teams room), the provider, the recording status, and timestamps. I queried the Firestore `meetings` collection and saw there were **181,874 meeting records** belonging to **84,312 unique users** across **35,003 email domains**.
ByteRay researchers have published a blog on a set of vulnerabilities they are calling TrustFall, and the findings land hard for any company that treats the Trusted Execution Environment as the part of a device you do not have to worry about. OP-TEE is the walled-off Secure World that phones, TVs, cars, and industrial gear lean on to guard keys, DRM, and identity, and the whole point of paying for that hardware isolation is the promise that even a compromised operating system cannot reach inside. TrustFall shows that promise was not as solid as buyers assumed. The researchers found several flaws that let the untrusted side reach into or knock over the Secure World, which is exactly the outcome the design exists to prevent. The bugs have since been fixed upstream, so patched builds are available, but the uncomfortable takeaway for vendors is that the vault they were told to trust had a way in, and "it runs in the TEE" is no longer an answer on its own.
Thursday, August 6
Security researchers tracked and eavesdropped on a WIRED reporter using vulnerabilities in a pink plastic smartwatch. It’s just one piece of a deeply insecure supply chain of GPS-enabled gadgets.
Abusing the trust boundary in Claude Code for RCE. Trust is never broken and that opens up a few avenues for abuse. Simply opening claude code on a PR can be enough to silently trigger attacker payloads.
VU#487613: Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations
Overview A cross-site scripting (XSS) vulnerability in Alinto SOGo v5.12.7 allows attackers to achieve remote code execution by embedding malicious SVG (Scalable Vector Graphics) objects in ICS (iCalendar) invitations. The vulnerability has been actively exploited in the wild, as confirmed by VirusTotal sightings. Description Alinto SOGo is an open-source webmail and groupware platform for email, calendars, contacts, and shared scheduling. It is primarily used by organizations seeking a self-hosted interface solution for existing mail infrastructure. CVE-2026-8496 The vulnerability exists in SOGo’s handling of ICS files, where the DESCRIPTION field is rendered without proper sanitization or Content Security Policy (CSP) enforcement. When a calendar invite contains an SVG payload, such as <animate onrepeat='...'> , with JavaScript event handlers, the browser executes the script in the context of the SOGo webmail interface. This occurs during normal calendar view rendering (e.g., when a user opens or previews the calendar tab), even without explicit interaction. Impact Once an attacker delivers a malicious ICS file via email, any user who views the calendar will execute the embedded XSS payload, granting the attacker full read access to the victim's mailbox. This enables: Credential theft through forced logout/login phishing Password manager autofill hijacking Full exfiltration of email messages, folder contents, and metadata Extraction of contact lists and calendar data Solution Users are recommended to upgrade to SOGo v5.12.8 or newer. v5.12.8 addresses this
A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud provider Snowflake . Connor Riley Moucka , of Kitchener, Ontario, also admitted to stealing call and text history records of more than 100 million AT&T customers. A surveillance photo of Connor Riley Moucka, a.k.a. “Judische” and “Waifu,” dated Oct 21, 2024, 9 days before Moucka’s arrest. This image was included in an affidavit filed by an investigator with the Royal Canadian Mounted Police (RCMP). The U.S. Justice Department said between February and October 2024, Moucka and co-conspirators used stolen login credentials to steal cloud-hosted data belonging to at least 165 customers of a U.S.-based software-as-a-service company. The hackers targeted stolen credentials for Snowflake customer accounts that did not enforce multi-factor authentication, and extorted or attempted to extort a host of well-known companies, including TicketMaster, Lending Tree, Advance Auto Parts and Neiman Marcus. Snowflake responded to the data thefts by increasing password complexity requirements and enforcing multi-factor authentication.
Most of the cyber incidents landing on our desks these days start with someone believing a lie. It’s not a brilliant piece of code that causes most breaches. A convincing email, a confident phone call, and a fake sense of urgency can make people hand over exactly what the attacker needs. Last week I talked […] The post The risk awareness radar. A superpower every MSP needs to train appeared first on Heimdal Security Blog .
At the Black Hat security conference, the AI giant revealed new details about how its agents went rogue, hacked several other companies—and did it all right under the company’s nose.
Wednesday, August 5
Researchers at security firm Zenity found more than a dozen flaws in AI browsers—and managed to get OpenAI’s Atlas to make an unauthorized Amazon purchase.
Security researcher James Kettle tried to push the limit of AI’s hacking abilities—and discovered how effective it can be when combined with human expertise.
Homeland Security told immigrants that leaving the US would wipe out fines it claims they owe. Now it wants private investigators to find them in their home countries and collect.
More than 50 offending image and video ads were published across Facebook, Instagram, Messenger, or Threads, according to Meta’s ad library data. Some ran as recently as this week.
Synack Red Team researcher Malcolm Stagg takes the stage at Black Hat USA 2026 on August 6 to present three years of independent research on a new class of network infrastructure attacks. Here's who he is and why the talk belongs on your calendar. The post From DARPA to Black Hat: An SRT Researcher’s Next Chapter appeared first on Synack .
To hear both sides of the build vs buy debate around AI pentesting solutions, we spoke with Dow's cyber engineering team lead Dan Lacher and Synack's CTO Mark Kuhr. From Dow's perspective, Synack served as a force multiplier for a small internal red team. Meanwhile, building the Synack Autonomous Red Agent (Sara) from scratch definitely had some trial and error. The post Build vs. Buy AI Pentesting: Why Dow Chose to Partner With Synack appeared first on Synack .