A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations. "Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector," ESET researcher
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 7:00 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running
Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines. A report from the Google Threat Intelligence Group (GTIG) said Google has severed ties with Videostrong Technology Co. , a TV box manufacturer in China that GTIG and other industry experts concluded was responsible for including malware that enrolled more than 1.3 million set-top boxes in a botnet dubbed “ XCPE ” (named after one of the malware’s core code components). The global distribution of XCPE botnet infections. Image: Google Threat Intelligence Group. The report said the XCPE botnet loaded the user’s device with software that makes their Internet address available for resale by multiple “residential proxy” services, which allow customers to rent Internet addresses
Blockchain infrastructure provider Chainstack on Tuesday disclosed that it was targeted in a cyber attack that allowed an unauthorized party to gain access to some parts of its infrastructure. The incident is assessed to be part of a large-scale, artificial intelligence (AI)-powered attack campaign that came to light last week. "An external attacker gained unauthorized access to part of
Continuous automated penetration and attack testing uses tooling to run real attack techniques against an environment on an ongoing schedule, rather than during one scheduled engagement. It trades the depth of a fully human-led test for broad, repeatable coverage that runs continuously. The category has a real ceiling: findings that depend on business logic or multi-step reasoning still need a human tester to catch. Treat it as one layer of a testing program, not a replacement for the whole thing. The post What Is Continuous Automated Penetration and Attack Testing? appeared first on Synack .
Latest
Tuesday, November 3
Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords, resetting two-factor authentication (2FA), and removing passkeys. The warning came in an email sent on November 3 in the name of developer mSeven Software. It says the company recently learned of suspicious activity linked to the app but
Blockchain infrastructure provider Chainstack on Tuesday disclosed that it was targeted in a cyber attack that allowed an unauthorized party to gain access to some parts of its infrastructure. The incident is assessed to be part of a large-scale, artificial intelligence (AI)-powered attack campaign that came to light last week. "An external attacker gained unauthorized access to part of
They have informed us that there is a critical security vulnerability in its Omnissa UAG. I’m intentionally not providing any details, but think of the recent Netscaler vulnerabilities as a comparison. The latest version includes the fix. The vulnerability isn’t being discussed yet because it hasn’t been publicly disclosed, and they want to give partners time to apply the fix. I can’t provide any more information than “Trust me, bro.” Even if you don't believe me: Patching isn't a bad option. [https://docs.omnissa.com/UnifiedAccessGatewayReleaseNotes-V2609/unified-access-gateway-release-notes](https://docs.omnissa.com/UnifiedAccessGatewayReleaseNotes-V2609/unified-access-gateway-release-notes)
Continuous automated penetration and attack testing uses tooling to run real attack techniques against an environment on an ongoing schedule, rather than during one scheduled engagement. It trades the depth of a fully human-led test for broad, repeatable coverage that runs continuously. The category has a real ceiling: findings that depend on business logic or multi-step reasoning still need a human tester to catch. Treat it as one layer of a testing program, not a replacement for the whole thing. The post What Is Continuous Automated Penetration and Attack Testing? appeared first on Synack .
Google's Threat Intelligence Group says it has shut down a massive botnet called x.cpe. At its height, x.cpe ran on more than 1.3 million Android TV devices, and unusually, these were Google-certified boxes. Google says its screening process missed the malware due to "obfuscation techniques" employed by Shenzhen-based Videostrong Technology. In a detailed blog post , the Threat Intelligence Group explains how the x.cpe botnet evolved quickly from a single-stage dropper into a modular three-stage malware platform that sold access to third parties. Manufacturers must have their devices certified if they want access to Google apps and branding, a process that is supposed to catch threats like this. However, Videostrong's compromised boxes, mostly sold under the MECOOL brand, evaded detection by using a backdoor to remotely install the malware after the devices were set up and online. After devices appeared online, a stub application called x.cpe or com.oemservice would phone home. This package did not have any malicious capabilities of its own, but it had the system-level permissions necessary to install malware modules at the operator's behest. It also disabled Play Protect, which would have otherwise flagged the silently installed packages as malicious. Read full article Comments ]]>
Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targeting two of its engineers. "It was not a single isolated breach or a simple phishing incident,"
apkscope: stateless APK xrefs that return the Java line, plus a from-scratch decompiler (Rust, no JVM)
Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device. The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3)
Overview Multiple vulnerabilities have been identified in the Android application, BaseChat – Audio Dating App, version 9.8.1, which ultimately compromise the privacy of users’ personal data and activity. Description BaseChat is an online dating platform built in Flutter and targeted toward users over 18. It facilitates anonymous, voice-first interaction between users. Three distinct vulnerabilities have been identified within the shipped Android application. VU#124705.1: The application fails open when validating TLS server certificates for connections to its backend API host. The application allows any self-signed certificate to bypass standard TLS security checks. VU#124705.2: Paid user accounts are mapped to a third-party RevenueCat subscriber database using raw MSISDNs (phone numbers), which are a guessable public identifier. Because the RevenueCat Software Development Kit (SDK) includes a public API key within the application’s Android Package Kit (APK), an attacker can query the RevenueCat’s API using predictable identifiers to retrieve individual user metadata. VU#124705.3: The application writes Personally Identifiable Information (PII) to Android system logs in its production build. During voice calls, the application logs the remote party’s MSISDN through unstripped debug statements, which allows an attacker to recovery phone numbers of callers who are intended to remain anonymous. Impact Impacts of successful exploitation vary by vulnerability. VU#124705.1: A network-positioned attacker can intercept and modify API communication, potentially leading to account takeover via session credential theft. VU#124705.2:
You run security at your organization. It’s 7:00 am, and you’re having breakfast. You receive a ping: a new critical vulnerability has been disclosed. Your team scrambles to compare vendor advisories, read technical research, check which systems run the affected software, and answer familiar questions from the business: are we affected, and what are we doing about it? Another disclosure arrives before that work is finished. AI is changing both the volume and speed of critical vulnerability discovery. It can analyze large codebases at scale and surface deeply nested flaws that may have existed for years without being found through human review. That discovery momentum will put more pressure on security teams to understand the impact of each disclosure on their infrastructure. To help security teams prepare, today we’re introducing Zero Wire : a public vulnerability intelligence feed on Cloudflare Radar, bringing the clarity of a news wire service to critical security developments. It helps security leaders and practitioners understand significant vulnerabilities and decide what to do next. How it works Zero Wire lives inside Cloudflare Radar under the security section. Each briefing brings together a plain-language explanation of the vulnerability, who should investigate it, recommended actions, and links to the evidence and vendor guidance. The format is deliberately simple: an index card with what you need to know, without the drama. A CISO should be able to understand the issue quickly and ask the right questions. An engineer should be able to follow the same briefing to the technical guidance needed to investigate and remediate it. We also offer a pre-compiled prompt you can use with your agent to assess the impact on your infrastructure. Cloudflare contributes security research, observations from our network, and p
As millions of Americans vote in today’s U.S. midterms, most will use paper ballots, which are protected by strict chain-of-custody protocols and, in some cases, statistical audits. You may wonder why we still use paper for our elections and voting systems when tasks like banking, tax filing, and document signing have moved away from paper-based legacy systems and become fully electronic. The short answer: security. That may come as a surprise to some. After all, cryptography and other security advancements have enabled secure electronic systems for many applications. In fact, cryptography can be used to provide two essential safeguards in elections: keeping (1) individual votes secret while (2) making the final tally independently verifiable. This is exactly the approach of cryptographic protocols like Helios and ElectionGuard . However, Helios intentionally targets lower-risk and lower-coercion settings rather than high-stakes public elections. ElectionGuard, by contrast, is intended for public elections, but not as a replacement for a paper-based system; it is used as a cryptographic layer integrated with traditional voting infrastructure. In this blog post, we’ll explain how cryptographic techniques can help protect ballot secrecy and prevent manipulation in electronic voting systems, and explore the limitations of these systems. Although cryptography can strengthen election verifiability and have other strong security properties, it cannot fully replace the security and trust of existing paper ballot systems in general elections. The challenges of electronic voting The National Academy of Sciences’ excellent 2018 report on election security concludes that el
Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can
Your team is remediating more vulnerabilities than ever, yet your breach risk has barely changed. You’re spending too much time and effort on exposures attackers may never exploit, while higher-risk exposures sit, waiting in the queue. Gartner®’s report on exposure prioritization states that fewer than 10% of vulnerabilities are exploited, yet most are treated as urgent. The report also argues
A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations. "Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector," ESET researcher
**tl:dr;** * Contrary to popular belief among vendors, system integrators, and asset owners: network authentication in TETRA mission-critical radio networks **does** ***not*** **provide authenticity & integrity** guarantees at the individual message level. * To make matters worse: **base stations don't require a re-authentication whenever a radio is roaming from one cell tower to the next.** * This allows for traffic injection attacks: both voice and data. The latter is particularly worrying for SCADA WAN scenarios or where voice & alarming functionality can disrupt operations at such as at airports, harbors, railway operators, and civil defense siren systems. * The 2026 attack on Taiwan High Speed Rail's TETRA network, leading to the emergency stop of several trains, shows a mild example of possible impact: [https://www.midnightblue.nl/blog/analyzing-the-taiwan-high-speed-rail-thsr-tetra-cyber-incident-part-1](https://www.midnightblue.nl/blog/analyzing-the-taiwan-high-speed-rail-thsr-tetra-cyber-incident-part-1)
With AI agents now running in many Microsoft 365 tenants, monitoring their activity has become part of the security team’s job. Microsoft Defender XDR monitors AI agents through its integration with Microsoft Agent 365, the control plane for agents in your tenant. This post covers what to enable, where the data lands, and how to respond when an agent goes wrong. We will also show you some interesting log sources, where useful information about the behavior of agents can be found.. The features listed in this article may not be visible or available without the proper license. You may need the “Agent 365” add-on for you actual license, or the new E7 license plan which includes everything (Agent 365, Microsoft 365 Copilot). Which agents Defender XDR can see Defender’s threat detection uses observability data from different cloud agent sources, plus agents running locally on endpoints. Agent type Examples Copilot Studio agents Low-code custom agents built by users Microsoft Foundry agents Pro-code agents in Azure Copilot Agent Builder agents Declarative agents built in Microsoft 365 Copilot Non-Microsoft agents Agents built with the Agent 365 SDK Local agents Coding and desktop agents on devices Each managed agent also gets a Microsoft Entra Agent ID : a directory identity with owners, sign-in logs and risk scoring. That identity i
Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers. No chain reported more than several dozen affected stores, and some had to throw away chilled and frozen food or take it off the shelf. Danfoss, a Danish maker of refrigeration controls, 
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running
GitHub - rjzak/malware-modeler-rs: Generate training data and ML models for benign vs. malicious files plus related tools.
Something I've been working on for a while: training lightweight machine learning models to determine if a file is benign or malicious based on raw byte sequences (n-grams). The goal is for anyone working with malware (and has goodware samples too) can train their own models, and this could be useful for resource-constrained environments of if you want a model for older systems not supported by typical AV vendors.
Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines. A report from the Google Threat Intelligence Group (GTIG) said Google has severed ties with Videostrong Technology Co. , a TV box manufacturer in China that GTIG and other industry experts concluded was responsible for including malware that enrolled more than 1.3 million set-top boxes in a botnet dubbed “ XCPE ” (named after one of the malware’s core code components). The global distribution of XCPE botnet infections. Image: Google Threat Intelligence Group. The report said the XCPE botnet loaded the user’s device with software that makes their Internet address available for resale by multiple “residential proxy” services, which allow customers to rent Internet addresses
National Cyber Security Centre expects attacks on critical facilities such as power stations, airports and hospitals AI-powered malicious software is “highly likely” to be used in hacking attacks against the UK’s power stations, airports and hospitals by 2028, according to the state cybersecurity body. The National Cyber Security Centre (NCSC) said AI will probably enable a ransomware attack against critical national infrastructure [CNI] between now and 2028. The UK’s definition of CNI covers a range of facilities and services across sectors including energy, transport, defence, food, health and finance. Continue reading...
Monday, November 2
Had a subscription in the past with them and received the following e-mail: Doesn't look like many sites have have picked up on this: >Dear cPGuard customers and partners, >An unidentified attacker targeted OPSSHIELD, gained unauthorized access to our licensing and update systems, and distributed a malicious script through the cPGuard update channel. \*\*We have stopped further distribution of the script and released cPGuard 5.88.25 to remove the known backdoor and files left by the script.\*\* >The script sent data to an endpoint on our licensing server under a compromised account. We secured that account as soon as we identified the breach and cleared our infrastructure credentials. We are investigating how the attacker gained access, which customer servers ran the script, and what data the attacker accessed. >\*\*Please take the following actions immediately.\*\* >1. \*\*Update every cPGuard server.\*\* Run \`cpgcli update --start\`. The corrective update removes the backdoor shell at \`/var/tmp/.cpg91511\_sh\` and the collection directory \`/var/tmp/.cpg91511\`, including the password hashes and credential archive (\`loot.tgz\`) staged there. 2. \*\*Verify the installed version.\*\* After the update completes, run \`cpgcli --version\` on each server and confirm it reports \*\*5.88.25\*\*. If the update fails or the server still reports an older version (between 5.88.12 and 5.88.19), contact OPSSHIELD Support immediately. 3. \*\*If you know or suspect the malicious script ran, reset passwords and revoke exposed credentials.\*\* The script targeted \`/etc/shadow\`. Reset passwords for root and all other password-enabled local accounts from a trusted recovery environment. From a trusted device, change any passwords reused elsewhere and rotate affected database passwords, S3 access keys, DigitalOcean tokens, and secrets recorded in root's shell history. Replace SSH private keys stored under \`/root/.ssh\` and remove the corresponding old public keys from every system that trusts them. Complete this step even if the update succeeds, because credentials copied before cleanup may still be usable. >We are sorry that this breach put your systems at risk. If you need help assessing a server, please contact OPSSHIELD Support through your usual support channel. We will share further findings as we verify them. >The OPSSHIELD Team
Follow-up reporting identifies Palo Alto Networks firewalls as targets in the PHP2Shell exploit-chain investigation. Researchers describe attackers combining PHP vulnerabilities with a Linux kernel privilege-escalation flaw to obtain root access. This adds important product-specific context to the Dream Research findings we've discussed. Administrators of exposed firewall management interfaces should review vendor advisories and investigate possible compromise. Palo Alto acknowledges limited exploitation affecting customers. The suspected China-linked attribution remains a research assessment, not independently established fact.
AI makes it easier to build your own web applications, but handling sensitive data still requires special care. We examined 159,041 Lovable projects and found many cases where personal and confidential information was accessible without logging in.
Mirage2FA AiTM kit steals M365 session cookies after MFA (ANY.RUN: 4,561 cookie theft events): SIEM detection rules and phishing-resistant hardening guide
Author here. Detection rules (UTMStack, Entra ID audit actions) and hardening steps validated in a hybrid lab (Entra Connect + on-prem AD + WS2025). Corrections welcome.
The Capytistas, a secretive group claiming more than $1.2 million in backing, started with Elon Musk and Tesla’s board. Members argue that those who buy political power deserve the scrutiny they’ll impose.
Recently came across two exposed attacker servers that gave us an interesting look at how AI is being used in real-world offensive operations. Both servers were exposing their working directories over HTTP. In total, huntback recovered 1,304 files (193 MB), including shell histories, AI agent logs, pentest reports, credentials and other tooling. Here's what we found: * 25 organisations targeted across Europe and beyond, including hosting providers, marketplaces, cloud infrastructure, a bank and a national telecom operator. * 31 runs of pentestcode, an open-source autonomous pentesting agent, mostly powered by DeepSeek Flash. * 63 agent sessions and 16,616 logged steps across just two days of activity. * 10 engagements with reported breaches, including claims of 168 compromised hosts, 1,770 findings and 1,256 credentials recovered across nine reports. * The operator repeatedly used essentially the same prompt, instructing the AI to pursue domain admin, database access and deeper network compromise. The interesting part is how little sophistication was needed to orchestrate the activity. An open-source agent, an inexpensive model and a reusable prompt were enough to automate substantial reconnaissance and exploitation attempts. The exposed directories also contained credential-checking tools, account creation automation, database dumps, hash-cracking infrastructure and residential proxy configurations. For defenders, the bigger takeaway is that autonomous offensive tooling is no longer just a theoretical capability. We can now observe operators incorporating these agents into real targeting workflows.
Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026. According to a report published by Dream Research Labs, the campaign has led to the compromise of a high-profile individual in Israel, along with additional compromises affecting a government cloud
When I last wrote about our DNS propagation pipeline in 2022 , the Zone Builder received about 250 DNS record changes per second. Today it receives about 700, nearly three times as many, plus about 100 other events, such as zone setting changes. However, the number of events was never the real problem. The problem was the kind of work some of those events needed, and how that work grows with the size of a zone. Some zones now hold more than 20 million records, and we expect them to keep growing toward hundreds of millions. Each event starts a clock that measures how long it takes us to turn that change into data our authoritative DNS servers can use. We call that work a build. A build reads the current database state, converts it into the format used at the edge, and writes any changes to Quicksilver . In 2022, per-record builds were 150 times faster than full builds on average. On a test zone with one million records, per-record builds were 4,250 times faster. We ended that post with the obvious next step: do the same thing for zone settings. Why doesn't the Zone Builder just rebuild the setting that changed? It should, and that is where we ended up. However, proving when it was safe took most of the work. A record event identifies what changed. A zone event can come from many Cloudflare products, may not say why the zone changed, and can alter data shared by several zones with the same name. Choosing too much work wastes capacity. Choosing too little can leave stale or incorrect DNS data at the edge. We built a targeted
Stable Linux releases lack existing security fixes because backporting them is time-consuming and often thankless work. We’re using Codex to reduce the backporting process time from days to hours per fix, empowering human patch reviewers to rapidly submit fixes for critical software like Ubuntu Long Term Support, Fedora, and the Linux kernel. By October 29, our project helped deliver fixes for 149 distinct CVEs into stable Linux kernel releases, and several fixes to Fedora and Ubuntu packages. Deploying fixes to older software requires multiple steps, including adapting fixes to older code, checking dependencies, and ensuring the fix did not introduce new bugs. A single task (like tracking down a bug in a bad commit) can take a week or more of effort that no one sees or appreciates. Our Codex workflow has reduced the human effort required to prepare and review fixes. Excluding project-specific initial setup, preparing and reviewing a straightforward backport takes about 30 minutes of human attention; a more involved case can take around three hours. The workflow’s approach is twofold: agents perform activities like identifying missing fixes, adapting patches, assembling validation evidence, running tests, and preparing submission packets, while engineers review the patches and submit them to maintainers. Those estimates only cover patch preparation and review; regression testing and maintainer acceptance remain essential. But the reduced human commitment makes a substantial class of neglected security work practical to undertake. The patch backlog is large, but we now
Forty percent of security teams now use AI every day, and another 56% are testing it. Only 4% have no plans to adopt it, according to Prophet Security's State of AI in Security Operations 2026 survey of more than 250 CISOs, SOC leaders and practitioners. For the teams still testing, the next decision is whether their own SOC is ready. AI SOC readiness has two parts: whether a SOC has the
Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller. Microsoft said in a report that it investigated two such intrusions, one of which resulted in company
I’ve gotten nearly 2,000 campaign fundraising texts that were meant for someone else. I tried to find out why—and uncovered a labyrinth of politicians, data brokers, and shady tactics.
WIRED uncovered some 400 apps and websites linked to Chinese-language developers that look like regular AI tools but had secret features that let users create violent AI-generated images and video.
(May 2026) TL;DR: - an email address like atouch${IFS}/tmp/savane-rce-proof@attacker.example gave any registered user code execution on its backend. - From there, we made our account a superuser, - impersonated Bash’s maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository. - An unpatched kernel gave us root access and access to a GNU backup server. We reported it to the FSF on May 11, 2026. FSF incident report: https://static.fsf.org/nosvn/security/savannah-20260807.pdf
To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the [Reverse Engineering StackExchange](http://reverseengineering.stackexchange.com/). See also /r/AskReverseEngineering.
I built an IDM-style download manager in Rust (egui): split downloads, queues, scheduler, browser add-on
Sunday, November 1
Adding onto the post "Archived malware I found over the years pt1" BY: "u/Fickle_Plan_208" Effort post!!!!! read description.
LINK TO THEIR POST: [link.](https://www.reddit.com/r/malwares/comments/1tdfrsy/archived_malware_i_found_over_the_years_pt1/) LINK TO MY OTHER POST ON THIS: [Link](https://www.reddit.com/r/ExtremeArchive/s/CCzXpSShV3) All malware I found on the GitHub user LEMZzip and links to archived malware they made if found plus info and updated file! This post also includes a screenshot of their GitHub page at the bottom! SCAN LINKS IN ANYRUN: (:[SCAN 1](https://app.any.run/tasks/1b3a66c7-54c0-46c9-a944-e3012ff76d46/): [SCAN 2](https://app.any.run/tasks/381650b8-c79b-4992-9e59-8f0ec40eca68/):) VIRUS TOTAL SCAN LINKS I FOUND: (:[Love.exe](https://www.virustotal.com/gui/file/e63cc912240af3b0e958f0617372876a3f0221e27c45ae5362963d72185e5d81), [Browser setup 1.2.exe](https://www.virustotal.com/gui/file/207b53a4aa0a36fbc52b0557c5b747640cb79dde37ea02c85240984065779a60):) MALWARE NAMES THAT WERE ARCHIVED: "tripop CD Defender Antivirus, Roblox Setup, Rec room modded, Recroom-white-main, DSBN wifi bypass!, love. Browser setup 1.2" MALWARE NAMES THAT AS OF NOW CAN'T BE ARCHIVED: "Recroom modded (NEW), blackhole, train-way! Setup, rusty., admin turnoff, makerpen, ultralemzx, spazz, Xholder. " (Note: There may have been more I forgot to include!.") Possible same accounts on github: ([LEMZzip](https://github.com/Callmelemon82), [LEMZzipV2](https://github.com/LEMZzipV2)) Possible same user on reddit: ([LEMZzip](https://www.reddit.com/user/LEMZzip/)) Possible same user on archive web: ([LEMZzip](https://archive.org/details/@LEMZzip)) The website URL some of their malware opened I had to remove because if I did not my post would keep getting taken down! LEMZzip Malware archive V1.1: [Download!](https://www.mediafire.com/file/0jphz06ge3rgd5x/LEMZzip_Malware_archive_V1.1.zip/file) Inside it also has a description on what the malware does! Note: I will try to update this unlike them! Archived software I could not include but archived: "LEMZzip Trojan maker 1.1!" Screenshot below as well! *Processing img qkcfmlqp16zh1...* *Processing img wswxb9b5s4zh1...*
MalChela v4.4 adds Unpack, a static unpacker for PE, ELF, and Mach-O; maps findings across the toolkit to MITRE ATT\&CK v20 with an interactive Enterprise matrix; and moves every tool to the embedded YARA-X engine, removing the system YARA dependency. Also new: YARA Scan and IP reputation with GreyNoise.
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite By pure timing coincidence, the Proton CEO's AI @ Proton, Engineering Manifesto made headlines around the same time as this week's video. The guy's management style and choice of language have really rubbed a lot of people up the wrong way, and deservedly so, IMHO. However... this section of his screed really resonated with me: Your job has fundamentally changed. It is no longer to write code, and LLMs are not here to help you write better code faster. Your job is to help the LLM write better code faster. Dev jobs as we know them are gone. Dead. And if you disagree, you're in for a shock in the very near future. But at the same time: I don't remember the last time tech has been this exciting. It's white hot right now. Anyone who loves technology and computers is probably having a great time right now. — Jack Rhysider ☠️ (@JackRhysider) October 30, 2026 Yes! This! Not handwriting code "old school" isn't something to lament; rather, our unprecedented ability to innovate, create and build things that are meaning
Using a fake DOB or leaving the field blank when making an online account can offer protection from identity theft You get a call from your bank saying there has been suspicious activity on your account. They read out your name, address and date of birth so you are happy it is a legitimate caller. But you are talking to criminals who have used your date of birth as part of a web of verifying information to convince you they are someone else. Continue reading...
Saturday, October 31
Named Volta-Autodoxer, the recently uncovered malware uses AI tools to collect troves of data about victims, from login credentials and credit card numbers to Discord sessions and UberEats receipts.
Friday, October 30
Thanks to a lucky break, flawed code in a tainted Claude extension prevented the attacker from fully worming their way into some 5,000 developer machines.
Shared ASLR-bypass kit byte-identical across four hosts, a custom heap exploit with a log cleaner, cloned public PoCs, and a PAN-OS-focused repackaging (panos\_rce\_poc.py, prce.py) exposed at 130.94.67\[.\]235. File-level detail and hashes in the post.
On October 19, 2026, we learned about eMudhra’s eight shockingly weak keys: where eMudhra was trusted to pick a 115-digit number for their virtual combination lock protecting the Internet, they picked the number 4. Not even four digits, just the number 4. The other seven keys were similarly weak: 56, 66, 115, 155, 156, 230 and 237. The next day, we wrote a blog post on the immediate action we took to mitigate this leak, and what customers needed to do on their end to stay secure. Now, we are sharing a more in-depth follow up on the evidence we’ve seen of exploitation, and the progress seen on visitors patching their systems. Let's start with the scale of the problem. A certificate authority (CA) with weak keys this serious is unprecedented, and the potential consequences are significant. While there have been plenty of compromised certification authorities in the past (such as DigiNotar , TÜRKTRUST , and TrustWave ), access to their keys has always been contained to a degree; these incidents gave a limited set of attackers or organizations the ability to issue fraudulent certificates. The eMudhra incident is fundamentally different; the affected intermediate private keys could be recovered almost instantly by anyone from the public certificates themse
David Gibson says the problem is that details of the flaw were revealed before it was fixed, while Charles MacKinnon notes that we are at the mercy of technology we don’t understand Chris Stokel-Walker may be right ( The internet has broken – again. Shouldn’t the tech firms that make billions from it pay to fix it?, 22 October ), but the real issue lies elsewhere. The bugs in the PHP programming language that were recently found by an AI tool have been present for a long time without anybody noticing and without any harm being done – they are extremely obscure. They were not found by hackers – they were found because an AI tool was used to check the PHP source code, which is a good use of AI. Continue reading...
Today, Cloudflare services for private origins is generally available. Point a proxied DNS record at a private IP, and Cloudflare reaches the origin over your existing Cloudflare One connection . Your origin stays private, while web application firewall ( WAF ), caching , bot management , and Workers work just as they do for public origins. In June, we launched this capability in closed beta to address a problem we kept hearing from customers: Their internal APIs, AI agent backends, MCP servers, and operational tools weren’t built to face the Internet, but those services still need to accept requests from partners, customers, or agents over the Internet. Before the beta, putting Cloudflare in front of these services meant exposing a public IP, opening a firewall port, or running cloudflared alongside the origin. Those requirements often left private applications without the same protections and controls they used for public applications, including WAF, bot management, rate limiting, caching, traffic acceleration, rewrites, and Workers. What is generally available today During the closed beta, eligible customers requested access through their account team. Today, we’re opening access beyond that beta group. Point a proxied A or AAAA record at
I wanted to figure out just how exploitable php2shell and http2shell were in practice, so I've created two purposely vulnerable web apps: [https://brotli2bitcoin.com](https://brotli2bitcoin.com) & [https://php2bitcoin.com](https://php2bitcoin.com) with a standard production config -- pop an RCE and find the flag to claim the $1K BTC. And to make it interesting, I setup a live stream showing every single attack attempt happening live [https://www.youtube.com/watch?v=w7\_EJWqRzvw](https://www.youtube.com/watch?v=w7_EJWqRzvw) Good luck! ;)
Thursday, October 29
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.
What if a VNC server could make your viewer believe it had a \~4 GB framebuffer… while actually allocating only 128 KB? That’s the core of this TightVNC vulnerability. A malicious server can announce a crafted 32768 × 32769 screen at 32bpp, causing the framebuffer size calculation to overflow. The allocation wraps down to 128 KB, but the viewer continues using the original, much larger dimensions when calculating pixel writes. The result is a server-controlled out-of-bounds write in the viewer. It’s a good example of how a relatively small integer-overflow mistake can become a powerful memory-corruption primitive when different parts of the application disagree about the true size of a buffer.
Welcome to the 26th edition of Cloudflare's DDoS Threat Report. This edition covers the third quarter of 2026 — July, August, and September — and returns the series to its quarterly cadence following the combined H1 2026 volume. The analysis is produced by Cloudforce One , Cloudflare's Threat Intelligence organization, providing a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network . Key insights Short-burst, low-bandwidth attacks lasting under 10 minutes and 1 Gbps surged by 208%. Conversely, hyper-volumetric attacks exceeding 1 Tbps plummeted by nearly 69% from Q2, possibly a reflection of law enforcement actions against four major Internet of Things (IoT) botnets earlier in the year. However, variants continue to emerge, proving that IoT botnets remain a durable, high-volume threat to network infrastructure. Threat actors dramatically shifted their reflection and amplification tactics, abruptly abandoning CLDAP floods, which collapsed by 99.5% quarter-over-quarter. Instead, attackers pivoted heavily toward other connectionless protocols, driving a 215% surge in DNS amplification and a 122% increase in general UDP floods. Attack targets broadened significantly across both industries and geographies, with the United States reclaiming the most-attacked position from China. Canada and Israel experienced sharp spikes in targeted attacks — jumping 10 and 7 spots respectively — while juggling geopolitical tensions, trade disputes, and contentious domestic events. At the same time, the operational focus shifted aw
A vendor gets a call from one of its biggest MSP partners who needs something the vendor can’t supply. The vendor knows a competitor can, so it points them there. That sounds like a good way to lose a partner, but it wasn’t. They stayed, and they spent even more over the next few years. […] The post The best due diligence on a vendor is who they’ve worked with appeared first on Heimdal Security Blog .
Bluesky tells WIRED it blocked links to a leaked archive of information on 41,000 ICE, CBP, and other DHS workers because it contains people’s contact information, shared without their authorization.
Information released by Distributed Denial of Secrets is the third such government data disclosure in the last month Data identifying more than 41,000 employees and contractors for the US Department of Homeland Security (DHS) was released on Wednesday in an unprecedented leak that reveals how the agency is organized. The records, which were made public by the transparency non-profit Distributed Denial of Secrets, reference operation names, surveillance programs and information on undercover initiatives. The DHS did not immediately return a message seeking comment. Continue reading...
We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and other runtimes, and explain how to detect and remediate it.
Wednesday, October 28
The critical flaw in UEFI firmware—used by most server vendors and data centers—allows attackers to execute code early in the boot process.
Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracing
If you analyze Android banking trojans, droppers, or spyware, you've probably run into samples where: * `classes*.dex` declares `native` methods, but `lib/*.so` has 0 exported `Java_*` symbols and wiped ELF section headers. * `JNI_OnLoad` constructs strings on the stack (`MOVZ`/`MOVK`), uses an OLLVM `CSEL` \+ `BR X8` state machine, and registers JNI handlers dynamically. * Attaching Frida immediately crashes the app due to `/proc/self/maps` or libc prologue checks. I released **JNISleuth-MCP** (Apache 2.0) to automate this part of Android malware triage: [https://github.com/nighthawkk/JNISleuth-MCP](https://github.com/nighthawkk/JNISleuth-MCP) * Recovers static `JNINativeMethod` triplets from `.rodata` / `.data.rel.ro` (with `PT_LOAD` fallback for section-stripped ELFs). * Extracts `MOVZ`/`MOVK` stack strings and XOR-encoded C2 strings from `JNI_OnLoad` / `.init_array`. * Resolves & patches ARM64 OLLVM `CSEL` \+ `BR X8` indirect branches and `.rodata` jump tables. * Includes a C++/NDK **Dobby** agent that hooks `RegisterNatives` mid-function (`+0x10`) and dumps in-memory DEX payloads from `art::DexFileLoader::OpenCommon` without triggering standard Frida detections. * Syncs all 233 `JNIEnv*` vtable types and C signatures into Ghidra and IDA Pro 9.0, plus includes an MCP/LLM server. Ships with a synthetic dropper APK (`samples/banker_dropper.apk`) so you can test all features offline.
Rebranded GodPotato + PowerShell stager + Impacket env, left open by an operator who stole 68 GB from a Philippine government agency
Toolkit dump from a captured open directory: a renamed GodPotato (two builds and source), an eight-line PowerShell stager that reassembles the payload in memory, a small Python upload receiver, a full unmodified Impacket environment, and the operator's own transfer and access logs. Hashes, named-pipe path, and the base64 command/fragment paths are all in the post.
ICE’s Homeland Security Investigations is engaged in far-reaching spying against left-wing activists that rivals the FBI and CIA crackdowns on the Civil Rights and anti-war movements.
Tuesday, October 27
Cutting Through the php2shell Noise On October 20, details of php2shell, two pre-auth RCE vulnerabilities in the PHP core discovered by Calif (CVE-2026-109618 and CVE-2026-109619), leaked ahead of coordinated disclosure. Advisories listing affected versions followed quickly, along with a flood of PoCs, many AI-generated and non-functional. We waited until we had our own data. This post covers what we learned building and testing exploits. In short, php2shell is exploitable but more conditional than some coverage suggests. Our analysis indicates that exploitation is heavily version dependent, and that the precise heap layouts required to exploit under the default display_errors=Off setting make it much more difficult than the non-default display_errors=On scenario. We will delve into why this is the case further into the post. Almost all of the public exploits released for php2shell focus on the dangling “PS” session global variables case, which impacts instances of Apache running mod_php or applications serving PHP code using the “php -S” development server like in the Steal My Bitcoin challenge . Our analysis focused heavily on the mod_php exploitation path. However, we’re starting to see early signs of exploits targeting the second vulnerability with the serializer, which affects PHP-FPM, such as kengwang/php2shell-fpm-exp . We haven’t yet had the opportunity to fully analyze that exploitation path and confirm the published exploit works. This article will focus on explaining why the mod_php exploitation scenario is exploitable, where the real-world risk is, and what organizations can do to be better prepared for events like this in the future.