Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday. One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 6:40 am
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker who strikes at the right moment can run code on the server. The researcher advises blocking web access to the
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian. The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled,
OpenAI on Thursday unveiled GPT‑6 Cyber, which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment. The new model is "more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set," OpenAI said. It has classified the model as
Cloud penetration testing focuses on identity, configuration, and service-layer attack paths within the customer's side of the shared responsibility model, rather than the network perimeter a traditional test targets. Each major cloud provider sets its own rules for what testing is permitted without prior approval. Scope should be defined by accounts, identities, and services rather than IP ranges, since that is how risk concentrates in a cloud environment. In US government cloud environments, the provider's rules are only the first gate. Testing must also fit the system's authorization boundary and the agency's own rules of engagement. The post Cloud Penetration Testing Services for Enterprise AWS, Azure, and GCP Environments appeared first on Synack .
Latest
Sunday, November 8
As AI exposes flaws in IT systems and geopolitics plays out on the cyber frontline, some experts say the events of recent weeks could soon be a common occurence Alex Pearce was doing the morning rounds at his fruit and vegetable wholesale business in London on Monday last week when he noticed something odd. The defrost light on refrigeration unit 2 was on, and the panel reading was 150C. Unit 4 was the same. Continue reading...
Has anyone heard of this? [https://blog.gitguardian.com/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets-right-now/](https://blog.gitguardian.com/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets-right-now/)
Has anyone heard anything about ARTEX being abused to grab leaked GitHub secrets? Info here from Microsoft: [https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/](https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/) And GitGuardian: [https://blog.gitguardian.com/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets-right-now/](https://blog.gitguardian.com/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets-right-now/)
I spent countless nights digging into PHP2Shell. Here's a deep dive into how it actually works, from memory to PHP internals to a real exploit.
When the PHP vulnerabilities were first announced, I spent a HUGE amount of time trying to figure out the logic behind them. As many others who tried investigating them probably noticed, there was barely any technical information available at the time. We had a few basic hints: something related to `PHP_SESSION_UPLOAD_PROGRESS`, some kind of Out of Memory condition, and, of course, that video Calif published showing a dancing girl with a shell running the exploit in the background. 😂 I found that pretty funny, especially considering the scale of the vulnerabilities and how many servers around the world could potentially be affected. Anyway, that was pretty much all we had to work with! Even AI assistants weren't particularly helpful. At the time, they were heavily restricted when it came to this subject. A simple technical question about an internal PHP function could get flagged just because you mentioned PHP and something technical in the same sentence. For those of us without access to a more cybersecurity-focused model, even asking basic questions and using AI to help investigate things was practically impossible. So I started digging into the PHP codebase myself (I was honestly getting a little mentally insane by that point). I spent countless hours going through the source code, tracing functions, setting up experiments, debugging, and trying to understand exactly what was happening behind the scenes. There were long days and endless nights spent following one thing after another, trying to connect all the pieces until things finally started making sense. The more I investigated, the more I realized that I wanted to put everything together somewhere. Not just the final explanation, but the entire process: the PHP internals behind the vulnerabilities, what's happening in memory, why certain things happen the way they do, and how all of this eventually leads to a working exploit. That's how this research project started. I structured the write-up to start from the basics and gradually build up to the actual exploitation. Each part builds on what came before, with the explanations becoming progressively more technical until we get to the real thing. I wanted someone with little or no experience in low-level memory exploitation to be able to follow along and understand how all the pieces fit together. The write-up also goes through the actual exploit code used to solve the "Steal My Bitcoin" challenge, breaking it down step by step rather than simply showing the final result. Everything is based on my own research, local experiments, and understanding of the PHP engine. I'm not claiming this is an official analysis or that everything is necessarily correct. I'm still learning, and there might be mistakes or things I've misunderstood. And honestly, I was getting tired of explanations that only scratched the surface without actually showing what was happening internally. I wanted to do something different: a proper, in-depth technical walkthrough covering the entire process, examining the important details and explaining not just WHAT happens, but WHY and HOW it happens. You can read the full write-up here: [**PHP2Shell: From Memory to C Internals to Real Exploit Code**](https://djad04.github.io/php2shell-deep-dive/) And here's the GitHub repository, which also includes the project files and the backstory behind the research: [**GitHub Repository**](https://github.com/djad04/php2shell-deep-dive)
Saturday, November 7
I've spent about the last year building relift and today I'm finally releasing it. I'm really proud of how it turned out so I wanted to share it here. relift is a workbench for analyzing and triaging Go malware. If you've ever opened a Go binary in Ghidra you know the pain. A few lines of Go turn into hundreds of lines of C pseudo-code buried in runtime noise. I always hated that, and that's what our reconstruction engine is built to fix. It turns each function back into short, readable Go and keeps the matching assembly right next to it. Since relift is made for malware analysis, I added something the usual tools don't have, a Findings tab that pulls together what matters in a sample, like network indicators and decoded strings, so the obvious stuff shows up right away. The Lab is where the magic happens though. relift has its own emulator that can run a single function in a sandbox and show you what it returns. Point it at a string decoder or a config decryptor and you get the plaintext without ever running the sample. It also recovers names in garble-obfuscated binaries, works on Windows, Linux and macOS binaries (64 and 32-bit x86), and comes with a command-line tool if you want to script your triage. It's free for non-commercial use. and the free version already includes all of the features along with access to the CLI This is the very first release so I'd really appreciate it if you gave it a shot on a real sample. Any feedback is more than welcome, bugs, missing features, or a function it got wrong. That's exactly what will help me keep improving relift. You can get it at [https://www.riven-labs.com/relift](https://www.riven-labs.com/relift) [Relift in action analyzing a real-world sample](https://preview.redd.it/v7868li2r90i1.png?width=1919&format=png&auto=webp&s=f6ede94b04141d60972306a4720b0cf8d2898bbc)
I built Ceplin to cut out the tab-hopping in an investigation: copy an indicator into AbuseIPDB, then urlscan, then WHOIS, then back again. You type an artifact and see all the pivots it has available, then you can pick a field from one report and pass it to the next verb: >>> "suspicious-domain.com".urlscan()[final_url] Here it returns only the final URL from the most recent public urlscan.io scan of that domain. >>> "suspicious-domain.com".urlscan()[final_url].dns()[a] Here the final URL domain's DNS A record is returned. [APIs](https://ceplang.org/verbs.html) include AbuseIPDB, urlscan.io, AlienVault OTX, Cert Spotter and crt.sh, IP2Location.io, RDAP (WHOIS), RIPEstat, Team Cymru, MalwareBazaar and CIRCL hashlookup (and you can also others by yourself) It can also perform local [decoding](https://ceplang.org/verbs.html#decode) as well as [identifying suspicious commands](https://ceplang.org/verbs.html#identify) without an LLM to explaining the binary, its flags, matching Sigma rules and ATT&CK techniques from directly from references only. You use your own API keys, read from environment variables; Output is defanged by default; No install required, runs as one binary. Try it here: [https://github.com/ceplinhq/ceplin-cli-releases/releases/tag/v0.61](https://github.com/ceplinhq/ceplin-cli-releases/releases/tag/v0.61) ...read more about it: [https://ceplang.org/](https://ceplang.org/) ...or see a video demo: [https://www.youtube.com/watch?v=bzGGigpeiXg](https://www.youtube.com/watch?v=bzGGigpeiXg)
Built a hybrid network monitoring tool (C++ & Python) for zero-day threat detection – Looking for technical feedback / code review!
Hi everyone, Over the past few weeks, I’ve been working on an open-source defensive cybersecurity project called Zero-Day Radar. The goal is to build a high-performance network monitoring and threat detection framework. I decided to use a hybrid architecture: C++ Core Engine (88.1%): Handles the low-level heavy lifting — fast network packet capture, process monitoring, and minimal overhead execution. Python Analytical Layer (11.9%): Parses telemetry data, aggregates log records, and integrates with threat intelligence feeds. Key components in the repo: radar\_core.cpp - Low-level monitoring engine zeroday\_radar.py - Log parser & analytical engine rules.txt & radar.conf - Custom detection logic The source code is available here: https://github.com/aouamchawki-3A/zero-day-radar I would really appreciate any feedback from the community regarding the C++ performance, IPC mechanisms between C++ and Python, or suggestions for additional detection capabilities!
Three stories with practical takeaways: 1. **OpenSSH needs a restart:** Alpine warns that installing its patched package does not replace the running SSH service. Restart sshd after updating affected systems, or disable password authentication until patched. 2. **WordPress needs protection during patching:** Some sites remain exposed while installing the fix for an exploited core flaw. Deny web access to `wp-content/upgrade/` before starting the update. 3. **Security tools are malware lures:** Dr.Web found fake scanning and log-analysis projects delivering malware through GitHub. The broader campaign has infected more than 2,000 PCs. Review build scripts and dependencies before running unfamiliar projects. Read the full recap on CyberRecaps.
Sekoia researchers documented a watering-hole campaign in which compromised legitimate websites and convincing imitation portals delivered device-specific exploit chains. Some attacks could run without additional user interaction after a vulnerable device visited a malicious page. The campaign targeted known vulnerabilities in iOS and Chrome for Android, potentially exposing browser cookies, credentials, messages, and other sensitive information. Researchers attributed the activity to APT29 with moderate-to-high confidence. Even a legitimate website can become dangerous if compromised. Apple and Google have patched the vulnerabilities identified in this campaign, making updates especially important.
Escalating hacks affecting blood labs and grocery stores show the very real risks to critical infrastructure that come from basic security lapses involving internet-connected devices.
grep /var/log/messages for "Accepted password for" on an account with no password, like alpine or root, then check doas use, new users and authorized\_keys. are the samples miners or ddos bots so far? [https://x.com/MilesBuilds/status/2118693578046308779?a=dwk33s-1CIFo8j4LAPs&s=20](https://x.com/MilesBuilds/status/2118693578046308779?a=dwk33s-1CIFo8j4LAPs&s=20)
Passwords and API keys that developers typed into commands they approved in Claude Code are sitting in public GitHub repositories, where anyone can read them. When a user selects "Yes, and don't ask again," Anthropic's AI coding assistant can save the command, word-for-word, including the secret, in a project settings file. Software security company Apiiro said yesterday that 1,122 public
i built native imessage for windows. no mac, no iphone, no relay. the pc itself pretends to be a mac
Help me collect data about ransomware for my PhD. I'm a CISSP, CISM, Sec+, OG engineer, & doctoral candidate at Capitol Technology University, MD. I'm researching which security controls actually enable recovery and resilience, compared to cyber frameworks. Takes 15–25 minutes. Anonymous. No compensation. IRB-approved. Would deeply appreciate your help. Please share. Thank you! https://techstudy.limesurvey.net/748327?lang=en&newtest=Y (Safe link: Survey is USA hosted on Limesurvey dot net. It's open source, used by Ubuntu, GNOME, OpenOffice, and many universities. I went this route since our Uni doesn't use Qualtrics, and it's affordable.)
Friday, November 6
Separate actions also take place outside fence and across Europe in backlash against impact of AI boom Activists have stormed the site of a Microsoft datacentre being built in Amsterdam, as the backlash to the social and environmental harms of the AI boom spreads across Europe. Protesters from Geef Tegengas, a Dutch direct action group, clashed with police while breaking into a construction site at Westpoort, Amsterdam, where some members climbed a crane, lit flares and tied helium balloons to equipment. Continue reading...
An experiment in which AI models were asked to break into simulated networks showed the hacking skills of DeepSeek and GLM to be not far behind OpenAI’s most advanced cyber model, which isn’t public.
The Port That Does Not Exist - Port 0 is the port you are not supposed to use, so nobody looks there. So we put an IRC network on it. Then I got curious if anyone else had, & scanned all of IPv4 for port 0. Turns out we weren't alone, & some of our neighbors really shouldn't be there.
Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker who strikes at the right moment can run code on the server. The researcher advises blocking web access to the
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian. The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled,
OpenAI on Thursday unveiled GPT‑6 Cyber, which it described as a major step forward in security research that brings together stronger cybersecurity capabilities with a step-change improvement in model alignment. The new model is "more capable at finding and fixing vulnerabilities, and far more reliable staying within the boundaries researchers set," OpenAI said. It has classified the model as
The highest priorities for the transition to post-quantum cryptography are the basic building blocks of authenticated key-agreement protocols such as TLS. Without these building blocks in place, secure communication on the Internet will not be possible once cryptographically relevant quantum computers come online. However, today we rely on quantum-vulnerable cryptography for much more than TLS. Privacy Pass is a protocol used by site operators like Cloudflare to help protect applications from abuse. One way we do this is by rate limiting individual clients so that no one client consumes too many of the site's resources. Normally this involves some combination of friction or loss of privacy for users: CAPTCHAs or other challenges to moderate traffic, along with accounts and fingerprinting to identify traffic.Privacy Pass was designed to avoid this tradeoff between friction and privacy. The basic idea is that a client gets issued a number of tokens , which they can redeem in exchange for access to the site. Crucially, each token is unlinkable to the client it was issued to, ensuring the client can use the site as they always had without sacrificing privacy. With 10 years of deployment experience under our belts — using Privacy Pass for applications such as privacy proxies (like iCloud Private Relay) and relays (like Privacy Gateway) — we, along with others , are collaborating to bring the next generation of this technology to the web. One of our goals is to develop more sophisticated tools for managing agentic traffic that would otherwise consume too many resources and degrade performance for human visitors. Another goal is to foster a more open ecosystem by making it easier
A fix for CVE-2026-83844, a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates. The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today. The flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft rates
A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test. The attack needs Dispatch, a Claude feature that lets people send tasks from their phone to Claude Desktop. The flaw that makes this possible can still be exploited, the researchers said earlier this
Binance’s October 2026 security incident raises an operational question for every organization holding user funds: Can your security controls recognize when a valid signature grants an attacker wallet authority? If an organization only monitors transfers and ownership changes, it may miss the shift in wallet authority until assets move. Binance’s initial update about the incident suggested that a compromised DevOps laptop allowed an attacker to access a service container and submit unauthorized withdrawals. Its second update reported additional breaches but no evidence that wallet private keys had leaked. In its November 3 report , Binance described a broader attack involving social engineering, misuse of an internal AI tool, stolen credentials, and unauthorized access to its wallet-signing service. The attacker nevertheless obtained valid signatures, illustrating a major risk: a compromised server with permission to request signatures can misuse a protected key without extracting it. The attacker used an EIP-7702 delegation that allows a wallet to sign a standing instruction: “Use this code when my account is called.” Ethereum keeps that instruction in place until it is changed or cleared using the wallet’s key. That enabled repeated transfers , including funds d
An update on Athena, and some unsolicited predictions on what's coming next On Saturday, Dario Amodei published We Must Pace the Frontier. I agree with him. Go read it if you haven't. I've spent the summer looking at what these models find, and the gap he describes between what they can do and what the rest of us are ready for is the one I've been staring at since May. The hardest piece of his
Many common web frameworks like Spring and Ruby on Rails trust the RFC 7239 Forwarded header by default, even though most proxies don't actually have any support for it. This makes apps vulnerable to request hostname or client IP address spoofing in the default configurations. I've been researching how the Forwarded header is supported across frameworks and proxies. [Rails](https://github.com/rails/rails/security/advisories/GHSA-2gff-2mmg-m73p) and [Spring](https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-4.2.0-M1-Release-Notes#forward-http-headers-behavior-change) recently shipped fixes following my research. There are still other frameworks that need application configuration changes to be secure.
Trying to decide if you should use a managed detection and response (MDR) service, or build your own security operations centre (SOC)? Our MDR vs SOC comparison will help you decide which is best for you. It’s an age-old question. Should your business outsource a function to external experts, or should you build your own […] The post MDR vs SOC: How to choose the right option for your organisation appeared first on Heimdal Security Blog .
Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users. "While we investigated, we removed access to Reactor and Data Solutions," the company said. "At this time we continue to have no evidence that any investigations data has been accessed
A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server.
Two flaws in Barracuda's Email Security Gateway, an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday. One flaw, CVE-2026-116606, is an authorization bypass. An unauthenticated attacker can use it to restore a
Thursday, November 5
Every VPN says it’s the best, but only some of them are telling the truth.
AI Agents now act on the web for millions of people. To a Site, an Agent can take many forms. It may be indistinguishable from a human user carrying out a task, or it might look like one visitor carrying many Users. This removes the ability for the Site to recognize, serve, and hold accountable the user or users behind the Agent, and causes the Site to face the costs when something goes wrong. This post argues that in order for Sites to maximize the access they provide to Agents, the ecosystem must develop new mechanisms to preserve the relationship between Sites and Users. Traditionally, in Security and Fraud Prevention, that requires three things: Identity, Reputation, and Accountability, allowing Sites to answer: Is the person acting being truthful about who they are? Is that person trustworthy? And who answers for the action? “Personal AI Agents” (“Agents” for short) are automations that take instructions from a human (“User”) and pursue a goal by controlling a cloud computer or browser. They are usually hosted and maintained by an “Operator” as part of a managed service or consumer offering. Examples include Muse from Meta and dots from OpenAI, and more are launching all the time. Agents can potentially take any action online that their User could, without the limits that hold humans back. They don't tire, they run around the clock, they act in parallel, and they put up with friction no person would. Much of the web, from how Sites plan capacity to how they make money, assumes those limits. Fundamentally, remotely hosted Agents are intermediaries . An intermediary is anything that sits between a User and a Site, so the Site sees it instead of the User. Agents are the newest kind of intermediary, but intermediaries have existed for a long time. Cloud browsers (hosted browsers that software controls on a User's behalf) and Proxies (services that relay a User's traffic, including VPNs) are intermediaries too. What has
Cybersecurity researchers have disclosed details of a now-patched vulnerability that could be exploited to bypass Lockdown Mode protections in OpenAI ChatGPT. Lockdown Mode was introduced by the artificial intelligence (AI) company in June 2026 as an optional setting to minimize data exfiltration risks arising from prompt injections. "The flaw could enable silent chat data theft, phishing,
How much damage can someone do without breaking much? Quite a lot, it seems. A stolen login can open doors across several systems. A trusted setting can be used to lock people out. Even a simple file copy can reach places it shouldn't. And while new tools are helping find security holes faster, some important systems are still taking months, sometimes over a year, to get patched. Not exactly a
Cloud penetration testing focuses on identity, configuration, and service-layer attack paths within the customer's side of the shared responsibility model, rather than the network perimeter a traditional test targets. Each major cloud provider sets its own rules for what testing is permitted without prior approval. Scope should be defined by accounts, identities, and services rather than IP ranges, since that is how risk concentrates in a cloud environment. In US government cloud environments, the provider's rules are only the first gate. Testing must also fit the system's authorization boundary and the agency's own rules of engagement. The post Cloud Penetration Testing Services for Enterprise AWS, Azure, and GCP Environments appeared first on Synack .
A critical finding can move through several security tools and still leave the organization exposed. The vulnerability has a severity score, and a ticket has reached the queue. Progress then depends on information the finding may lack: who owns the system, whether attackers can reach it, what protection exists, and how a change could affect the business. Each missing detail creates
October 2026 brought another wave of cyber threats targeting US businesses, with attackers exploiting trusted platforms, legitimate authentication processes, and everyday business workflows. For enterprises, these campaigns raise the stakes beyond individual security incidents, increasing the risk of financial losses, data breaches, and costly operational disruption. Below, we examine five
Apple has revealed that it plans to start checking public iCloud links for harmful content starting with iOS 27.3, iPadOS 27.3, macOS 27.3, and visionOS 27.3. The change specifically applies to scenarios where users share iCloud content, such as photos in iCloud Photos or files in iCloud Drive, by sharing a link and making it accessible to "Anyone with the link." When users choose this option,
Zyxel GS1900 network switches that received the vendor's earlier fix for an actively exploited flaw are still open to the exploit attackers used, researchers at Binarly found. The exploit lets anyone who can reach a switch's web management interface run commands on it without logging in. Zyxel has released new firmware for 10 GS1900 models that closes the hole. The earlier fix is the 2.90
Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016. The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President ( AS2650 ). Layer3 said the proxy activity was relatively persistent between October 5 to November 3, and that a review of the proxies available from AS2650 showed they exited from the White House network 236 times during that period. The proxy tracking company Synthient said on Twitter/X that the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica , a proxy program that is often integrated into “free” mobile and desktop applications . Infatica’s founder Vladimir Fomenko is a Russian man whose hosting firm King Servers was home to six of the eight internet addresses used by Russia’s state security services to compromise databases for election systems in Arizona and Illinois in 2016.
Wednesday, November 4
“Most of the risk is actually created by a couple of players building behind closed doors,” Clément Delangue said of the need for open source AI.
Black Ops II recompiled ahead of time from x86 to ARM64: Remill lifting, custom LLVM passes, D3D11 on Metal
Personal agents are the intermediary between humans and the Internet, turning a person’s instructions into requests and actions on websites. A customer might ask a personal agent to compare products across your site, find support articles, or complete a purchase. To a site owner, all three interactions show up as automated traffic — and without a clear view of which agents are visiting and what they are doing, it can be difficult to know whether that traffic is helping your business or creating risk. Blocking agents altogether can feel like the safest choice, but it can mean losing customers. Better visibility into agent activity allows you to decide what access makes sense for your site. Today, we’re launching new analytics to help you understand how personal agents access your site on behalf of humans, along with more granular access policies to put those decisions into practice. Together, they let you welcome agents on your own terms, and in ways that support your business. See how agents access your site Knowing which agent is behind a request turns unexplained automated traffic into traffic you can act on with confidence. Cloudflare maintains the largest verified bot directory in the world, and we are now bringing that intelligence into your traffic details. In Security Analytics, the Bot Analysis chart now shows Personal Assistants as a new category, next to Verified Bot, Likely Human, Likely Automated, and Automated. Security teams can select it to see only personal agent traffic over time. In Top statistics, a new Personal Assistants widget lists which agents are visiting your site and how many requests each one sends. Filter on one agent and every other widget updates to show only its traffic details: the paths it requests, the status codes it receives, and the networks it comes from. At a gla
I created this repo so you can automatically share your WASM game, and any other folders you’d like, with AI
Tuesday, November 3
Suspected North Korean attackers duped an engineer with a fake job interview and a malicious download to gain a foothold in the crypto firm’s system and steal billions, according to Binance.
Google's Threat Intelligence Group says it has shut down a massive botnet called x.cpe. At its height, x.cpe ran on more than 1.3 million Android TV devices, and unusually, these were Google-certified boxes. Google says its screening process missed the malware due to "obfuscation techniques" employed by Shenzhen-based Videostrong Technology. In a detailed blog post , the Threat Intelligence Group explains how the x.cpe botnet evolved quickly from a single-stage dropper into a modular three-stage malware platform that sold access to third parties. Manufacturers must have their devices certified if they want access to Google apps and branding, a process that is supposed to catch threats like this. However, Videostrong's compromised boxes, mostly sold under the MECOOL brand, evaded detection by using a backdoor to remotely install the malware after the devices were set up and online. After devices appeared online, a stub application called x.cpe or com.oemservice would phone home. This package did not have any malicious capabilities of its own, but it had the system-level permissions necessary to install malware modules at the operator's behest. It also disabled Play Protect, which would have otherwise flagged the silently installed packages as malicious. Read full article Comments ]]>
Overview Multiple vulnerabilities have been identified in the Android application, BaseChat – Audio Dating App, version 9.8.1, which ultimately compromise the privacy of users’ personal data and activity. Description BaseChat is an online dating platform built in Flutter and targeted toward users over 18. It facilitates anonymous, voice-first interaction between users. Three distinct vulnerabilities have been identified within the shipped Android application. VU#124705.1: The application fails open when validating TLS server certificates for connections to its backend API host. The application allows any self-signed certificate to bypass standard TLS security checks. VU#124705.2: Paid user accounts are mapped to a third-party RevenueCat subscriber database using raw MSISDNs (phone numbers), which are a guessable public identifier. Because the RevenueCat Software Development Kit (SDK) includes a public API key within the application’s Android Package Kit (APK), an attacker can query the RevenueCat’s API using predictable identifiers to retrieve individual user metadata. VU#124705.3: The application writes Personally Identifiable Information (PII) to Android system logs in its production build. During voice calls, the application logs the remote party’s MSISDN through unstripped debug statements, which allows an attacker to recovery phone numbers of callers who are intended to remain anonymous. Impact Impacts of successful exploitation vary by vulnerability. VU#124705.1: A network-positioned attacker can intercept and modify API communication, potentially leading to account takeover via session credential theft. VU#124705.2:
TL;DR: Our research team at Era uncovered **Greeter**, an attack framework targeting Flowise, an AI development platform with 55,000+ GitHub stars. We deployed seven honeypots and captured **4,972 "hello" messages**, each carrying malicious JavaScript through Flowise's `overrideConfig` parameter. The interesting part? **The malicious code never appeared in the saved workflow.** We reconstructed 4,000+ commands revealing: * Host reconnaissance and privilege checks * Searches for credentials, SSH keys, and secrets * AWS, Azure, and GCP metadata probing * Persistence attempts and fileless execution preparation We also identified **4,372 internet-exposed Flowise instances**, including 46 unauthenticated instances that appeared to match our vulnerable setup. The bigger concern is how a compromised AI application can become an entry point into the broader cloud environment. **Full technical breakdown:** [https://era.security/blog/greeter-flowise-ai-infrastructure-attack](https://era.security/blog/greeter-flowise-ai-infrastructure-attack)
You run security at your organization. It’s 7:00 am, and you’re having breakfast. You receive a ping: a new critical vulnerability has been disclosed. Your team scrambles to compare vendor advisories, read technical research, check which systems run the affected software, and answer familiar questions from the business: are we affected, and what are we doing about it? Another disclosure arrives before that work is finished. AI is changing both the volume and speed of critical vulnerability discovery. It can analyze large codebases at scale and surface deeply nested flaws that may have existed for years without being found through human review. That discovery momentum will put more pressure on security teams to understand the impact of each disclosure on their infrastructure. To help security teams prepare, today we’re introducing Zero Wire : a public vulnerability intelligence feed on Cloudflare Radar, bringing the clarity of a news wire service to critical security developments. It helps security leaders and practitioners understand significant vulnerabilities and decide what to do next. How it works Zero Wire lives inside Cloudflare Radar under the security section. Each briefing brings together a plain-language explanation of the vulnerability, who should investigate it, recommended actions, and links to the evidence and vendor guidance. The format is deliberately simple: an index card with what you need to know, without the drama. A CISO should be able to understand the issue quickly and ask the right questions. An engineer should be able to follow the same briefing to the technical guidance needed to investigate and remediate it. We also offer a pre-compiled prompt you can use with your agent to assess the impact on your infrastructure. Cloudflare contributes security research, observations from our network, and p
As millions of Americans vote in today’s U.S. midterms, most will use paper ballots, which are protected by strict chain-of-custody protocols and, in some cases, statistical audits. You may wonder why we still use paper for our elections and voting systems when tasks like banking, tax filing, and document signing have moved away from paper-based legacy systems and become fully electronic. The short answer: security. That may come as a surprise to some. After all, cryptography and other security advancements have enabled secure electronic systems for many applications. In fact, cryptography can be used to provide two essential safeguards in elections: keeping (1) individual votes secret while (2) making the final tally independently verifiable. This is exactly the approach of cryptographic protocols like Helios and ElectionGuard . However, Helios intentionally targets lower-risk and lower-coercion settings rather than high-stakes public elections. ElectionGuard, by contrast, is intended for public elections, but not as a replacement for a paper-based system; it is used as a cryptographic layer integrated with traditional voting infrastructure. In this blog post, we’ll explain how cryptographic techniques can help protect ballot secrecy and prevent manipulation in electronic voting systems, and explore the limitations of these systems. Although cryptography can strengthen election verifiability and have other strong security properties, it cannot fully replace the security and trust of existing paper ballot systems in general elections. The challenges of electronic voting The National Academy of Sciences’ excellent 2018 report on election security concludes that el
**tl:dr;** * Contrary to popular belief among vendors, system integrators, and asset owners: network authentication in TETRA mission-critical radio networks **does** ***not*** **provide authenticity & integrity** guarantees at the individual message level. * To make matters worse: **base stations don't require a re-authentication whenever a radio is roaming from one cell tower to the next.** * This allows for traffic injection attacks: both voice and data. The latter is particularly worrying for SCADA WAN scenarios or where voice & alarming functionality can disrupt operations at such as at airports, harbors, railway operators, and civil defense siren systems. * The 2026 attack on Taiwan High Speed Rail's TETRA network, leading to the emergency stop of several trains, shows a mild example of possible impact: [https://www.midnightblue.nl/blog/analyzing-the-taiwan-high-speed-rail-thsr-tetra-cyber-incident-part-1](https://www.midnightblue.nl/blog/analyzing-the-taiwan-high-speed-rail-thsr-tetra-cyber-incident-part-1)
With AI agents now running in many Microsoft 365 tenants, monitoring their activity has become part of the security team’s job. Microsoft Defender XDR monitors AI agents through its integration with Microsoft Agent 365, the control plane for agents in your tenant. This post covers what to enable, where the data lands, and how to respond when an agent goes wrong. We will also show you some interesting log sources, where useful information about the behavior of agents can be found.. The features listed in this article may not be visible or available without the proper license. You may need the “Agent 365” add-on for you actual license, or the new E7 license plan which includes everything (Agent 365, Microsoft 365 Copilot). Which agents Defender XDR can see Defender’s threat detection uses observability data from different cloud agent sources, plus agents running locally on endpoints. Agent type Examples Copilot Studio agents Low-code custom agents built by users Microsoft Foundry agents Pro-code agents in Azure Copilot Agent Builder agents Declarative agents built in Microsoft 365 Copilot Non-Microsoft agents Agents built with the Agent 365 SDK Local agents Coding and desktop agents on devices Each managed agent also gets a Microsoft Entra Agent ID : a directory identity with owners, sign-in logs and risk scoring. That identity i
GitHub - rjzak/malware-modeler-rs: Generate training data and ML models for benign vs. malicious files plus related tools.
Something I've been working on for a while: training lightweight machine learning models to determine if a file is benign or malicious based on raw byte sequences (n-grams). The goal is for anyone working with malware (and has goodware samples too) can train their own models, and this could be useful for resource-constrained environments of if you want a model for older systems not supported by typical AV vendors.
National Cyber Security Centre expects attacks on critical facilities such as power stations, airports and hospitals AI-powered malicious software is “highly likely” to be used in hacking attacks against the UK’s power stations, airports and hospitals by 2028, according to the state cybersecurity body. The National Cyber Security Centre (NCSC) said AI will probably enable a ransomware attack against critical national infrastructure [CNI] between now and 2028. The UK’s definition of CNI covers a range of facilities and services across sectors including energy, transport, defence, food, health and finance. Continue reading...
Monday, November 2
The Capytistas, a secretive group claiming more than $1.2 million in backing, started with Elon Musk and Tesla’s board. Members argue that those who buy political power deserve the scrutiny they’ll impose.
When I last wrote about our DNS propagation pipeline in 2022 , the Zone Builder received about 250 DNS record changes per second. Today it receives about 700, nearly three times as many, plus about 100 other events, such as zone setting changes. However, the number of events was never the real problem. The problem was the kind of work some of those events needed, and how that work grows with the size of a zone. Some zones now hold more than 20 million records, and we expect them to keep growing toward hundreds of millions. Each event starts a clock that measures how long it takes us to turn that change into data our authoritative DNS servers can use. We call that work a build. A build reads the current database state, converts it into the format used at the edge, and writes any changes to Quicksilver . In 2022, per-record builds were 150 times faster than full builds on average. On a test zone with one million records, per-record builds were 4,250 times faster. We ended that post with the obvious next step: do the same thing for zone settings. Why doesn't the Zone Builder just rebuild the setting that changed? It should, and that is where we ended up. However, proving when it was safe took most of the work. A record event identifies what changed. A zone event can come from many Cloudflare products, may not say why the zone changed, and can alter data shared by several zones with the same name. Choosing too much work wastes capacity. Choosing too little can leave stale or incorrect DNS data at the edge. We built a targeted
Stable Linux releases lack existing security fixes because backporting them is time-consuming and often thankless work. We’re using Codex to reduce the backporting process time from days to hours per fix, empowering human patch reviewers to rapidly submit fixes for critical software like Ubuntu Long Term Support, Fedora, and the Linux kernel. By October 29, our project helped deliver fixes for 149 distinct CVEs into stable Linux kernel releases, and several fixes to Fedora and Ubuntu packages. Deploying fixes to older software requires multiple steps, including adapting fixes to older code, checking dependencies, and ensuring the fix did not introduce new bugs. A single task (like tracking down a bug in a bad commit) can take a week or more of effort that no one sees or appreciates. Our Codex workflow has reduced the human effort required to prepare and review fixes. Excluding project-specific initial setup, preparing and reviewing a straightforward backport takes about 30 minutes of human attention; a more involved case can take around three hours. The workflow’s approach is twofold: agents perform activities like identifying missing fixes, adapting patches, assembling validation evidence, running tests, and preparing submission packets, while engineers review the patches and submit them to maintainers. Those estimates only cover patch preparation and review; regression testing and maintainer acceptance remain essential. But the reduced human commitment makes a substantial class of neglected security work practical to undertake. The patch backlog is large, but we now
I’ve gotten nearly 2,000 campaign fundraising texts that were meant for someone else. I tried to find out why—and uncovered a labyrinth of politicians, data brokers, and shady tactics.
WIRED uncovered some 400 apps and websites linked to Chinese-language developers that look like regular AI tools but had secret features that let users create violent AI-generated images and video.
(May 2026) TL;DR: - an email address like atouch${IFS}/tmp/savane-rce-proof@attacker.example gave any registered user code execution on its backend. - From there, we made our account a superuser, - impersonated Bash’s maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository. - An unpatched kernel gave us root access and access to a GNU backup server. We reported it to the FSF on May 11, 2026. FSF incident report: https://static.fsf.org/nosvn/security/savannah-20260807.pdf
Sunday, November 1
Adding onto the post "Archived malware I found over the years pt1" BY: "u/Fickle_Plan_208" Effort post!!!!! read description.
LINK TO THEIR POST: [link.](https://www.reddit.com/r/malwares/comments/1tdfrsy/archived_malware_i_found_over_the_years_pt1/) LINK TO MY OTHER POST ON THIS: [Link](https://www.reddit.com/r/ExtremeArchive/s/CCzXpSShV3) All malware I found on the GitHub user LEMZzip and links to archived malware they made if found plus info and updated file! This post also includes a screenshot of their GitHub page at the bottom + other things like screenshot of their website or tools they made! Estimated first account creation for LEMZzip: "Late 2023" SCAN LINKS IN ANYRUN: (:[SCAN 1](https://app.any.run/tasks/1b3a66c7-54c0-46c9-a944-e3012ff76d46/): [SCAN 2](https://app.any.run/tasks/381650b8-c79b-4992-9e59-8f0ec40eca68/):[ SnapMod scan](https://app.any.run/tasks/8dd64177-8b03-49a5-9367-c7b20810f313):) VIRUS TOTAL SCAN LINKS I FOUND: (:[Love.exe](https://www.virustotal.com/gui/file/e63cc912240af3b0e958f0617372876a3f0221e27c45ae5362963d72185e5d81), [Browser setup 1.2.exe](https://www.virustotal.com/gui/file/207b53a4aa0a36fbc52b0557c5b747640cb79dde37ea02c85240984065779a60):) MALWARE NAMES THAT WERE ARCHIVED: "tripop CD Defender Antivirus, Roblox Setup, Rec room modded, Recroom-white-main, DSBN wifi bypass!, love. Browser setup 1.2" MALWARE NAMES THAT AS OF NOW CAN'T BE ARCHIVED: "Recroom modded (NEW), blackhole, train-way! Setup, rusty., admin turnoff, makerpen, ultralemzx, spazz, Xholder. LEMZzip trojan maker 1.0" (Note: There may have been more I forgot to include!.") Possible same accounts on github: ([LEMZzip](https://github.com/Callmelemon82), [LEMZzipV2](https://github.com/LEMZzipV2)) Possible same user on reddit: ([LEMZzip](https://www.reddit.com/user/LEMZzip/)) Possible same user on archive web: ([LEMZzip](https://archive.org/details/@LEMZzip)) The website URL some of their malware opened I had to remove because if I did not my post would keep getting taken down! LEMZzip Malware archive V1.1: [Download!](https://www.mediafire.com/file/0jphz06ge3rgd5x/LEMZzip_Malware_archive_V1.1.zip/file) Inside it also has a description on what the malware does! Note: I will try to update this unlike them! Archived software I could not include yet but archived: "LEMZzip Trojan maker 1.1!, Divine Anti-spy V1.0 (Beta)" Screenshot below as well! *Processing img 1gidrwq4rlzh1...* *Processing img 51ro8m3wqlzh1...* *Processing img adnug3b2qlzh1...* *Processing img qkcfmlqp16zh1...* *Processing img wswxb9b5s4zh1...*
MalChela v4.4 adds Unpack, a static unpacker for PE, ELF, and Mach-O; maps findings across the toolkit to MITRE ATT\&CK v20 with an interactive Enterprise matrix; and moves every tool to the embedded YARA-X engine, removing the system YARA dependency. Also new: YARA Scan and IP reputation with GreyNoise.
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite By pure timing coincidence, the Proton CEO's AI @ Proton, Engineering Manifesto made headlines around the same time as this week's video. The guy's management style and choice of language have really rubbed a lot of people up the wrong way, and deservedly so, IMHO. However... this section of his screed really resonated with me: Your job has fundamentally changed. It is no longer to write code, and LLMs are not here to help you write better code faster. Your job is to help the LLM write better code faster. Dev jobs as we know them are gone. Dead. And if you disagree, you're in for a shock in the very near future. But at the same time: I don't remember the last time tech has been this exciting. It's white hot right now. Anyone who loves technology and computers is probably having a great time right now. — Jack Rhysider ☠️ (@JackRhysider) October 30, 2026 Yes! This! Not handwriting code "old school" isn't something to lament; rather, our unprecedented ability to innovate, create and build things that are meaning
Using a fake DOB or leaving the field blank when making an online account can offer protection from identity theft You get a call from your bank saying there has been suspicious activity on your account. They read out your name, address and date of birth so you are happy it is a legitimate caller. But you are talking to criminals who have used your date of birth as part of a web of verifying information to convince you they are someone else. Continue reading...