Plus: Russian hackers are trying to steal US nuclear scientists’ emails, the State Department bans known scammers from entering the United States, and more.
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 6:40 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
Latest
Monday, July 27
Dysphoria, an Internet of Things (IoT) botnet line tracked by CNCERT and XLab, has adopted blockchain-based name services and infected-device relays after a March law-enforcement operation against JackSkid infrastructure. The researchers say the design makes the botnet harder to disrupt. CNCERT, China's national computer emergency response team, and XLab, the threat-intelligence lab of Chinese
BrainDrain: A Chrome extension that collects your AI prompts without you ever opening it and has 100k users, 9 AI platforms
"Prompt Optimizer - SecondBrain" ([aajjgdpofhhcjmjoombjdfepplndhgcp](https://chromewebstore.google.com/detail/prompt-optimizer-secondbr/aajjgdpofhhcjmjoombjdfepplndhgcp), v2.3.1). The prompt rewriting works fine. Alongside it a capture engine runs at `document_start` on 9 AI sites and POSTs prompts and replies to the vendor's ingest endpoint. No interaction with the extension required. Reproduced on a clean profile, with the service worker devtools open: 1. Installed the extension. Never opened it. 2. Browsed to an unrelated site. The extension pulled its configuration from the server and wrote a userId and credentials into extension storage. 3. Opened ChatGPT and asked a question. Once the reply finished, a POST to `/context` went out carrying both the prompt and the response, encrypted with the credentials issued in step 2. **At no point was the extension opened or clicked.** Store privacy declaration: "The developer has disclosed that it will not collect or use your data." Write-up, IOCs and decryption script: [https://malext.io/reports/BrainDrain/](https://malext.io/reports/BrainDrain/)
Public exploit details released on July 27 show how an unauthenticated request can reach PHP's eval() function inside vBulletin and execute code on an unpatched forum server. The attack requires no account, administrative access, or interaction from another user. SSD Secure Disclosure lists vBulletin 6.2.1 and earlier, and 6.1.6 and earlier, as affected, but does not give a lower version
Monday starts with the usual promise that everything is under control. Then the logs wake up. This week, trusted tools crossed lines, old flaws found new work, exposed systems stayed exposed, and attackers kept hiding inside normal-looking services. Nothing looked strange at first. That helped. That is the mood. Here is the full recap. ⚡ Threat of the Week OpenAI Says Its AI Agent Went Rogue
CVE-2026-61511 - a critical vulnerability in vBulletin that allows an unauthenticated attacker to execute arbitrary code on a remote server.
n8n has patched a high-severity expression-sandbox escape that could let an authenticated workflow editor execute operating-system commands on the server running the automation platform. Security Joes found the flaw while probing n8n's February fix for CVE-2026-27577 for another bypass. The affected ranges are =2.32.0,
Debugging privacy-preserving protocols is hard. Oblivious HTTP has several different steps across four different parties, not to mention binary HTTP encoding and details spread across many draft RFCs. We've taken what we've learned operating protocols like Oblivious HTTP at the scale of millions of requests per second, and wrapped it up in a nice, clean CLI tool — that we are open-sourcing today. We call it our privacy-client , or pvcli . We’re releasing it under the Apache-2.0 License, and it is open for contributions . Here’s a single line of code that executes a full Oblivious HTTP request with a relay, gateway and origin. Don't worry if you don't know what that means, we'll cover it below. We’ll explain why we built this tool, and show just how handy it can be. Why privacy protocols can be hard to debug Let’s take a closer look at our motivation for creating pvcli. Over time, the Privacy team’s product suite and customer base grew. We added products like Privacy Proxy and Privacy Gateway, which power Apple’s Private Relay , Microsoft’s Edge Secure Network VPN , Flo Health’s Anonymous Mode , and more. With it came an increasing amount of special customer requirements, domain knowledge, and complexity. As a result, we saw increased friction in development and incident response. To see this in action, let’s look at how one of our products implements
Cybersecurity researchers have flagged a Microsoft Teams-themed phishing campaign that employs "secure document" lures to deliver legitimate remote monitoring and management (RMM) tools. "The victim was directed through compromised web infrastructure to a counterfeit Microsoft Store page claiming that Microsoft Teams had to be updated before the shared document could be opened," ZeroBEC said in
The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has been utilized by various unrelated cybercriminal threat clusters to deliver a wide array of remote
Cybersecurity researchers have flagged fresh malicious cyber activity by a threat actor with ties to East Asia targeting government entities in the Middle East. The intrusions have resulted in the deployment of previously unreported malware families dubbed TELESHIM, MIXEDKEY, and BINDCLOAK, according to Zscaler ThreatLabz. The cybersecurity firm said it detected the campaign earlier this month.
GitHub has announced a new cooldown mechanism in Dependabot, allowing the tool to wait at least three days after a release is published before opening a pull request. "The cooldown configuration option in the dependabot.yml still controls the behavior, though, so you can choose a different cooldown parameter that fits your project," the Microsoft-owned subsidiary said. According to GitHub, the
To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the [Reverse Engineering StackExchange](http://reverseengineering.stackexchange.com/). See also /r/AskReverseEngineering.
The editors at CISO Series present this AMA. This ongoing collaboration between r/cybersecurity and CISO Series brings together security leaders to discuss real-world challenges and lessons learned in the field. For this edition, we're focusing on the paths into cybersecurity that don't run through what is perceived as a "traditional" route, such as degrees in computer science or cybersecurity. Ask anything about breaking in without the "standard" credentials, what actually got them hired, and what they wish someone had told them earlier. This week's participants are: * David Cross, (u/MrPKI), CISO, Atlassian * Adam Arellano, (u/AdamTalksTheCybers), field CTO, Traceable AI * Krista Arndt, (u/thedrivermod), associate CISO, St. Luke's University Health Network * Mathew Biby, (u/RelativeWolf), director of cybersecurity, TixTrack * Russell Spitler, (u/Extra-Grand-1543), CEO and co-founder, Nudge Security * Mary Carmichael, (u/TheCyberAuditor), field CISO, western Canada, Bell Cyber [Proof photos](https://imgur.com/a/i-came-into-cybersecurity-with-no-degree-no-traditional-background-ask-me-anything-id6PCt1) This AMA will run all week from 07-26-2026 to 07-31-2026. Our participants will check in throughout the week to answer your questions. All AMA participants were selected by the editors at CISO Series (/r/CISOSeries), a media network of five shows focused on cybersecurity. Check out our podcasts and weekly Friday event, Super Cyber Friday, at cisoseries.com.
We analyze how VoidLink, LinkPro, and Atomic Arch abuse eBPF helpers to hide from defenders, and show how to detect them at load time, before they can act.
Sunday, July 26
Just wanted to pay it forward to those out of work looking for jobs. I know how bad it is out there [https://www.paycomonline.net/v4/ats/web.php/portal/28E300FE8563259A10C761C992C39668/jobs/207845](https://www.paycomonline.net/v4/ats/web.php/portal/28E300FE8563259A10C761C992C39668/jobs/207845)
I have gotten messages like this five times when I try to submit my report to the IC3 from different browsers, networks, and incognito. What is wrong and what can I do? Hmmm... can't reach this page It looks like [complaint.ic3.gov](http://complaint.ic3.gov) closed the connection. Try: \+ Checking the connection = Checking the proxy and the firewall ERR\_COMNMECTION\_CLOSED Check your Internet connection Check your network cables, modem, and routers. Allow Microsoft Edge to access the network in your firewall or antivirus settings. If it's already listed as a program allowed to access the network, try removing it from the list. and adding it again. If you use a proxy server: Go to the Microsoft Edge menu > Settings > System > Open your computer's proxy settings > LAN Settings and deselect the "Use a proxy server for your LAN" checkbox.
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite The Origin Energy breach down here in Aus is all over the news this week, and as with many breaches, it's multi-faceted. You've got them leading with "don't worry, your credit card is fine", the hacker leading with "they didn't respond when I tried to report it", and now news that the two parties have "come to an agreement". Maybe money was paid, or maybe Origin made some promises to restrain the hounds if commitments about data deletion were made. But both outcomes, of course, provide no guarantee that data has been nuked, so now they get to spend perpetuity waiting for the data that maybe - just maybe - it leaks. And we all should be working on precisely that assumption, just like we did with Optus and Medibank and Latitude and Ticketek and Qantas...
Saturday, July 25
A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base instead of serving one complete malicious file from a fixed URL. Confiant, which detailed the campaign on July 23, 2026, said it has operated since late 2024 and impersonated TradingView, Solana, and Luno to target retail traders and
Security firms ThreatBook and Imperva say attackers are targeting a critical flaw in Fastjson, Alibaba's JSON library for Java. In affected Spring Boot applications, a malicious JSON request can execute code without authentication, with the privileges of the Java process. Tracked as CVE-2026-16723, the vulnerability carries an Alibaba-assigned CVSS score of 9.0. The confirmed chain requires
Plus: Russian hackers are trying to steal US nuclear scientists’ emails, the State Department bans known scammers from entering the United States, and more.
Security researchers at depthfirst published working exploit code on July 24 for a GitLab flaw that GitLab patched six weeks earlier, on June 10. It runs commands as git on any self-managed 18.11.3 server that has not taken the update. Any authenticated user who can push to a project can run it. The attacker commits a crafted Jupyter notebook and opens its commit diff, which leaks a heap
For years, phishing campaigns targeting financial institutions followed the same playbook. Victims were tricked into entering usernames and passwords, attackers collected the credentials, and accounts were compromised later when an opportunity arose. That model is changing. Recent investigations into insurance-focused phishing operations reveal a more immediate approach. Instead of harvesting
Threat actors linked to the Cl0p (aka Chubby Scorpius, FIN11, Graceful Spider, and Lace Tempest) ransomware campaign are exploiting flaws in internet-exposed PTC Windmill and FlexPLM deployments as part of a new data extortion campaign. "Attackers chain a pre-authentication information disclosure in the FlexPLM WSDL endpoint with a server-side flaw in the Windchill login servlet, enabling
The operators of the DevMan ransomware-as-a-service (RaaS) scheme are maintaining a dedicated web platform that offers affiliates the ability to build payloads, oversee earnings, and manage various aspects related to victims. Swiss cybersecurity company PRODAFT is tracking the centrally administered RaaS operation under the name Funky Mantis. "The portal combined build generation, finance,
Friday, July 24
Border Gateway Protocol ( BGP ) is the de facto routing protocol of the Internet. It offers built-in mechanisms to allow entities, represented by Autonomous Systems (ASes), to express how they want to send and receive traffic on the Internet. One such mechanism is path attributes , which carry essential routing information and metadata for their associated route. The path selection algorithm processes some of these path attributes in a deterministic sequence to calculate the best path for this specific prefix. Using our unique position on the Internet, we took an investigative look at one of the well-known mandatory attributes in BGP, the ORIGIN attribute. ORIGIN must be present in every BGP prefix announcement and should not be modified by any router after being set by the originating one. What we found through our own experiments was a dramatic ~70% of observed paths in numerous vantage points have a different ORIGIN value compared to what was set by the originating Autonomous System. This ORIGIN attribute manipulation has a significant impact on the way traffic is forwarded on the Internet, as we’ll explore in this post. BGP ORIGIN and its operational history The ORIGIN attribute indicates how a route was injected into BGP — not to be confused with the origin AS that ind
Iberia Cards CISO José Manuel Rivera García explains why he's stuck with Synack's PTaaS model across multiple organizations, and how running Sara AI Pentest alongside human researchers helps him balance regulatory compliance with real risk reduction. He also shares candid advice for other CISOs on avoiding the false sense of security that comes from infrequent testing and over-reliance on perimeter controls. The post How Iberia Cards Uses Sara AI Pentesting to Stay Ahead of Modern Threats appeared first on Synack .
The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate an active phishing kit to impersonate the videoconferencing platforms in social engineering campaigns designed to deliver malware. "BlueNoroff has operationalised trust abuse by combining compromised industry contacts, social engineering, wallet
Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24 that lets a low-privileged Active Directory user obtain a certificate for a Domain Controller and authenticate as that machine. They codenamed the flaw Certighost. Because Domain Controller accounts carry directory replication rights, the resulting Kerberos credential can retrieve the krbtgt secret through DCSync.
Cybersecurity researchers have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents that could have allowed a single phishing link to stealthily build, authorize, and deploy an autonomous artificial intelligence (AI) agent inside a victim's organization. The vulnerability has been codenamed AgentForger by Zenity Labs. The issue has since been addressed by OpenAI as of June 8,
A crafted SVG submitted to Bing's image search ran commands as NT AUTHORITY\SYSTEM on Microsoft's production image-processing workers, and as root on the Linux machines in the same fleet. XBOW's testing got the same result on workers across different hosts and network ranges, so the problem sat in Bing's image tier, not on one bad machine. Microsoft issued two critical CVEs, CVE-2026-32194 and
AI agent security is moving through a familiar maturity curve: adoption, then visibility, and finally, control. But what we've collectively discovered is that enforcing least privilege for AI agents is harder than we ever imagined. This is why there are so many approaches, from prompt filtering to identity-layer access controls. Where we've collectively landed is that understanding the intent of
Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection. The agent then worked through the ministry's network on its own, checking hosts for ways to gain root access, hunting through file systems, and
Analysis of satellite images of Myanmar shows dozens of alleged scam compounds have appeared in recent months, despite a purported crackdown on the criminal organizations.
Thursday, July 23
Getting locked out of an account is no fun. Google has a few ways to help you regain access if you happen to forget your password or lose an authenticator, including recovery contacts and backup codes. Now, Google has a completely new option: your face . You can now give Google a video record of your face and sign into your account with a selfie, which sounds like something people are going to just love. You will have to set this feature up ahead of time if you want the option of regaining account access with a selfie later on. To get started, verify your account type is supported. You won't be able to configure selfie sign-ins for Workspace accounts, child accounts, or any account enrolled in Google's Advanced Protection Program. Configuring selfie sign-in requires you to record a video, which Google will store on its servers. Google's selfie sign-in landing page includes the typical disclaimers about privacy and data access, promising that the company will keep the video encrypted and won't use it for any other purposes unless you opt in. Read full article Comments ]]>
Today we’re excited to announce Cache Response Rules. These are a new rule type that runs after an origin server replies but before Cloudflare caches the content. If you've ever been irked watching something that should easily sail out of cache get dragged back to the origin by a stray Set-Cookie or wrong Cache-Control , headers that are sometimes hard or impossible to strip or change on the origin itself, then Cache Response Rules is that fix, applied at exactly the right moment. When and how caching decisions are made A CDN cache and an origin server work as a pair. Their goal is to answer from the cache whenever possible and only go back to the origin when the edge can’t respond. Every point of cache hit ratio comes from getting that division of labor right. Check the cache when we shouldn't, and we waste a lookup that was always going to miss. Check it too rarely, the origin serves traffic the edge should have absorbed, and the performance win evaporates. Importantly, the origin guides the cache. When it returns a cacheable asset, its response headers tell Cloudflare how long it’s OK to serve it, when and how to revalidate, and even whether to cache it at all. The cache is only ever as efficient as the origin allows. If the origin gets it wrong, cache becomes decoration while the origin infrastructure costs skyrocket. Most cache eligibility problems are not decided at request time. They manifest after the origin replies. A visitor asks for /static/app.js . Cloudflare checks cache, it misses, and forwards the request to the origin. The origin returns the file. Somewhere in those response headers, quietly, is a Set-Cookie header. The asset that should have been cached at every Cloudflare data center is now uncacheable. Multiply that by every visitor, on every site, with the same accidental header, and you have a
MSG’s sprawling surveillance system can monitor guests down to the second. Its owners made an exception for the pop star’s rehearsal dinner.
VU#492466: Logto Identity Platform has authentication and authorization failures in core protocol handling
Overview The Logto platform contains multiple vulnerabilities affecting the identity‑processing pipeline. These flaws reduce the reliability of authentication and authorization decisions and may allow attackers to bypass account‑ownership checks, skip MFA, replay externally issued SSO responses, or submit identity assertions without proper cryptographic or validity checks. Collectively, the issues create several paths for unauthorized access across both local and federated sign‑in flows. Description Developed by Silverhand Inc., Logto is an identity and access management system for software as a service (SaaS) and AI applications. It provides multi‑tenant authentication, single sign-on (SSO), role-based access control (RBAC), support for openId connect (OIDC), open authorization (OAuth) 2.1, and Security Assertion Markup Language (SAML) authentication. Several vulnerabilities have been identified in Logto's authentication and SSO components that weaken core identity‑security protections across these protocols. CVE-2026-15611 Logto allows unverified email-based SSO account linking. If a new SSO login arrives and no existing (issuer, identityId) account is found, Logto searches for a local user by the email address supplied by the identity provider (IdP) and links the SSO identity to that account. Logto does not require the IdP to confirm email_verified before linking, so an attacker who registers the victim's email at a permissive upstream IdP can take over the victim's existing account on first login. CVE-2026-15612 Logto stores a nonce in the connector session at authorization request time and expects the returned id_token to echo it back. The valida
Full report is available at [https://any.run/cybersecurity-blog/banana-rat-evolution-analysis/](https://any.run/cybersecurity-blog/banana-rat-evolution-analysis/) The exposed server at 198\[.\]245\[.\]53\[.\]26 gave a rare opportunity to compare two related Banana RAT branches through live infrastructure, sandbox telemetry, and recovered payloads. The older branch used ETW-themed paths, static Microsoft-looking names, and a typo-based pseudo-Microsoft C2 identity. The newer branch kept the same staging concept but moved to randomized install identifiers, better-structured SYSTEM persistence, and a WebSocket channel built around a hashed `testewin.com` subdomain. IoC: * 198\[.\]245\[.\]53\[.\]26 * [https://app.any.run/tasks/96796146-688f-4b12-894c-236dadab8413](https://app.any.run/tasks/96796146-688f-4b12-894c-236dadab8413)
There are several cybersecurity companies that offer managed EDR services in 2026. Here’s what actually separates them, and who each one suits. Most successful cyber attacks begin with a breached laptop, a smartphone or a server. Over the past 15 years, endpoint detection and response (EDR) has gone from niche to a mainstream security solution. […] The post The 4 best managed EDR service suppliers (and how to choose) appeared first on Heimdal Security Blog .
Hackers access Australian customers’ names, addresses, dates of birth, phone numbers and some bank account details, company says Follow our Australia news live blog for latest updates Get our breaking news email , free app or daily news podcast Origin Energy customers’ addresses, phone numbers and partial bank account data have been accessed in a hack, the company has confirmed. The firm has 4.8m customer accounts in Australia, providing electricity, fossil gas, LPG and internet services to homes and businesses. Continue reading...
Wednesday, July 22
Deep dive into a UAF in the bfs.sys Windows kernel minifilter driver patched in this month's Patch Tuesday.
VU#847406: Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability
Overview Duplicati v2.3.0.1 is vulnerable to arbitrary code execution when installed outside the default C:\Program Files\Duplicati 2\ directory. An attacker with local user privileges who can write files to the Duplicati installation directory can execute arbitrary code by placing malicious files, such as DLLs, in that directory. To mitigate this vulnerability, install Duplicati in the default C:\Program Files\ directory or update to the latest fixed version. Description Duplicati is a free, open-source backup solution that stores data across cloud and local storage platforms. On Windows, Duplicati is distributed as an MSI installer. By default, the installer deploys the application to C:\Program Files\Duplicati 2\ , where the directory inherits the standard protected ACLs provided by Windows. The following vulnerability affects Duplicati v2.3.0.1: CVE-2026-16157 During installation, the MSI registers a LocalSystem service that executes binaries from the Duplicati installation directory. When the default installation path under C:\Program Files\ is used, the directory is protected by the appropriate ACLs. However, if Duplicati is installed to a non-default location, the installer does not apply equivalent permissions to the installation directory. As a result, standard local users may have write access to files within the installation directory, allowing an attacker to place malicious files, such as DLLs, that may be loaded by the LocalSystem service, resulting in arbitrary code execution with elevated privileges. Impact A local attacker with write access to a non-default Duplica
Without the right tools, no security operations centre (SOC) can do its job properly. A SOC platform brings together a range of security technologies that let your analysts rapidly identify threats, investigate them and implement fixes. There are many cybersecurity tools that an SOC can use, and there are many vendors selling comparable products. The […] The post Top 4 Best SOC Platforms 2026 – Provider Comparison appeared first on Heimdal Security Blog .
I found and reported an authentication failure in the WPForms PayPal Commerce webhook, the webhook route being public was not the vulnerability as webhooks have to be publicly reachable so that PayPal can deliver events. The problem was what happened after the request arrived. In affected versions, the handler could process a supported event before establishing that PayPal was actually the sender. In my local lab, a forged event could change the state of a matching payment record. The expected order is: 1. Authenticate the sender 2. Validate the event 3. Change payment state The affected flow effectively performed steps 2 and 3 without first completing step 1. The issue was fixed in WPForms [1.10.0.5](http://1.10.0.5) and is tracked as CVE-2026-4986. Then came the part I found more interesting: triage told me I was reporter #11. That number does not prove exploitation, and it does not tell us the total number of people who found the vulnerability. It does establish a lower bound: at least eleven researchers independently converged on the same trust failure. The write up covers: \- the vulnerable code path \- my local reproduction \- why payload validation was not sender authentication \- the fallback listener \- the patch \- why duplicate reports may be useful rediscovery intelligence Full write-up: [https://blog.himanshuanand.com/2026/07/reporter-11-10-people-found-the-wpforms-paypal-bug-before-me-cve-2026-4986/](https://blog.himanshuanand.com/2026/07/reporter-11-10-people-found-the-wpforms-paypal-bug-before-me-cve-2026-4986/) Testing was limited to my own local environment. I am not claiming original CVE credit; I independently rediscovered and reported the issue. Disclosure: I wrote and performed the research, code review and local reproduction. I used an AI to help copy edit and organize the final article. Should duplicate report volume affect how urgently a vendor treats a vulnerability?
VU#360868: Analog Way Picturall Quad Compact Mark II contains a local privilege escalation vulnerability
Overview Version 3.5.8 of Analog Way's Picturall Quad Compact Mark II server contains a local privilege escalation vulnerability, tracked as CVE-2026-14985, due to improper privilege delegation and insufficient input validation in a maintenance script. Description The Picturall Quad Compact Mark II is a compact, heavy-duty 8K media server developed by Analog Way for video playback and content management in professional audiovisual environments. The core firmware includes a maintenance script called create_local_installer.sh , and the default script permission allows the low-privileged user, picmedia , to execute it as root and without a password. An attacker creates a malicious Ext4 disk image that contains the file, picturall-version.txt , with a directory traversal string and a payload file. create_local_installer.sh reads input from picturall-version.txt when processing these attacker-supplied disk images. This input is not properly sanitized, allowing an attacker to supply directory traversal sequences. As a result, the attacker can manipulate the script to write files outside of the intended extraction directory and execute a malicious payload. Because the script executes with root privileges, this behavior enables arbitrary file writes to sensitive system locations such as `/etc/cron.d, a system directory in Unix/Linux operating system used to store system-wide task scheduling files. An attacker can then leverage this capability to execute arbitrary code with root privileges. Impact By exploiting this path traversal vulnerability, an attacker with local access to the device can write arbitrary files to privileged locations. This access allows modifica
In a recent security assessment, we were unable to intercept the traffic originating from a WebView from an Android application. The application wasn’t using certificate pinning, nor was it configured in any special way that would prevent normal interception. When testing that same application on a different device, the traffic could be intercepted directly, confirming our belief that the issue was the device, not the application. TL;DR: Chromium now enforces
Federal lawyers say anti-mask laws would endanger immigration agents, citing an ICE face-recognition art project that doesn’t actually work.
The home appliance giant LG Electronics USA said this week it plans to suspend any apps built for its smart TVs that turn one’s television into an always-on residential proxy node. The move comes less than a month after researchers found that more than 42 percent of games and other apps available for download on LG’s webOS store allow unknown third-parties to route their Internet traffic through a user’s TV. Proxy SDK prevalence among smart TV apps for LG (webOS) and Samsung (Tizen OS) televisions. Image: Spur.us. On July 2, we featured research by the security firm Spur that examined the prevalence of residential proxy software development kits (SDKs) in smart TV apps. Spur found more than 42 percent of apps available for download on LG smart TVs include SDKs that turn one’s television in a proxy node indefinitely, and that more than a quarter of the apps made for Samsung’s Tizen operating system had similar residential proxy components. Responding to questions about Spur’s research, LG Senior Vice Presid
Tuesday, July 21
Overview The project management tool Plane, versions 1.3.0 and earlier, contains a multi-tenant authorization bypass vulnerability in its asset-management API that allows unauthorized users to access, delete, or duplicate assets that belong to other workspaces. Description Plane is an open-source project management platform that provides multi-tenant workspace isolation for users to track issues, monitor progress, and manage workflows. The platform's API supports uploading, retrieving, deleting, and duplicating files associated with issues and tasks within a workspace. CVE-2026-15342 Plane's asset-management API endpoints accept workspace slugs and asset identifiers as path parameters, but do not verify that the requesting user is authorized to access the specified workspace. As a result, an authenticated user in one workspace can supply the slug and asset ID of a different workspace when sending requests, which enables them to perform unauthorized read, duplicate, or delete actions on the other workspace's assets. To exploit this vulnerability, an attacker must authenticate to any existing Plane workspace, including their own, and know the slug and asset ID belonging to the victim workspace. These identifiers can be obtained from sources such as public or semi-public issue/board URLs, attachment download links, or exported API data. Impact The ability to bypass workspace-level tenant isolation enables an attacker to exfiltrate sensitive files, destroy project data, and create permanent copies of victim assets inside their own workspace. Solution Unfortunately, the CERT/CC was unable to reach Plane to coordinate this vulnerability, and a patch is not yet available.
America's AI Action Plan puts speed at the center of federal AI policy, reducing regulatory friction and accelerating adoption across government and industry. That same speed expands the AI attack surface just as fast, through new agents, APIs, and tool-calling chains shipped every week. Point-in-time pentests and quarterly assessments cannot keep pace with systems that change that often. AI security testing needs to run continuously and be backed by human-validated evidence. The post America’s AI Action Plan Is About Speed: AI Security Needs to Keep Up appeared first on Synack .
A new type of malware can worm deep into AI coding systems to steal data and logins—and can flip a “death switch” to destroy files and keep out real users.
For 96 years, the World Cup has been a global phenomenon, uniting nations and communities through a shared love of sportsmanship. While its popularity is nothing new, what is novel today is how rare a truly collective global experience has become. In an era defined by microtrends and algorithmic bubbles, it is increasingly uncommon for people across most countries to engage in the exact same event. That is precisely the unifying power of the World Cup. Fans from all over the globe reshape their daily routines around these once-in-a-lifetime matchups and storylines — and because Cloudflare operates a global network with 330+ points of presence worldwide, we are in a unique position to see exactly how this global ritual reshaped the world’s online activity throughout June and July 2026. Cloudflare Radar tracks HTTP traffic, DNS, security, and more to highlight global Internet trends. In this blog post we’ll use that data to explore how the World Cup impacted global traffic patterns throughout the tournament’s run. How did the World Cup change our behavior online? To understand how traffic changes throughout a match, we had to establish what it is “normally.” One way to do this is by looking at raw request volumes, or the amount of traffic we see on our network per country. But these amounts vary per country (the amount of daily traffic in the United States is always a larger number than the traffic in Portugal), which makes it difficult to establish a globally applicable baseline. Instead, we defined "normal" using the median traffic of the four preceding weeks: a month-long window that provided a stable, per-minute reference and smoothed out day-to-day noise. We also wanted to know whether traffic rose or fell relative to that baseline, but a plain difference wouldn't let us compare a high-volume country against a low-volume one. Instead, we used the ratio of current to baseline traffic, expressed as a log₂ value
Desktop+ Lockscreen Animated Wallpaper Fully RE of WallpaperExtensionKit.framework private apis (Still Buggy)
Dealerships installed alarms in millions of vehicles—and left them in even if the buyer didn’t want them. Now researchers warn they can be hacked to unlock, track, and disable cars.
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite I reckon this week's video on how Claude is tying together info from UniFi, Home Assistant and the Pi-Hole is an absolute ripper. Or at least the concept is - if ever there was an actual value proposition for AI it's taking lots of noise and converting it into a useful signal. Or, sometimes, it's just helping you see the woods through the trees, and that's exactly what Claude helped me do last night when every Sonos unit in the house refused to connect to any music service. It only took Claude a moment to work out: "you know your Pi-Hole is dead, right?" Uh... I do now! Give it a go, it's pretty awesome (and the Pi-Hole came good with a power cycle on the PoE port).
Automation platforms such as n8n are often introduced as productivity tools: connect a few systems, automate repetitive work, maybe add some AI. Inside a corporate network, however, that framing is incomplete. A self-hosted workflow engine can reach internal systems, execute actions on behalf of users, and hold sensitive credentials. That puts it in the same category as a jump host or a CI/CD runner even though it is usually evaluated and deployed like an ordinary business application. That became very concrete during a recent assessment. A client asked us to pen-test their internal infrastructure, and on the scope list was something I’d only heard about secondhand: n8n, one of those tools that keep surfacing in conversations about AI-powered automation. I’d never touched it before, and I went in without assumptions. That turned out to be the right posture: what surprised me was not what n8n can do for productivity, but the gap between how it is presented and what it means to have one sitting inside a corporate network. That gap matters because the pressure to adopt these tools is real. The past two years have produced a relentless stream of platforms promising to transform how businesses work, and the message is often the same: automate faster, integrate more, add AI, or fall behind. But speed of adoption and depth of security evaluation rarely move together. Tools are integrated into production based on what they promise to enable, not on a clear understanding of what they can reach, execute, or expose. n8n is my worked example here because it is the one I assessed, but the pattern is general. Before deploying any platform of this kind, five questions decide whether it can be operated safely: Which systems can it reach?
With the new Intelligence Dashboard, pin any combination of CVEs, tags, countries, IPs, and GNQL queries into one persistent, always-current view.
Monday, July 20
Starting today, Cloudflare Internal DNS is generally available. Cloudflare Internal DNS provides authoritative and recursive DNS for private networks on the same global network and control plane customers already use for public DNS, Zero Trust, networking, and application services. Internal DNS — sometimes also referred to as private DNS — is one of the last pieces of enterprise infrastructure still managed separately from the rest of the network. Many organizations operate one platform for public DNS, another for internal DNS, and use cloud-native DNS services inside each cloud environment with separate security policies layered on top. None of these systems share a common control plane. Split-horizon DNS adds another layer of complexity, often requiring multiple DNS environments to remain synchronized so internal and external users receive different answers for the same hostname. When those systems drift, outages follow. With Cloudflare Internal DNS, you get a single platform to manage public and private DNS resources, enforcing DNS policies and gaining visibility across your entire DNS stack. For Enterprise customers, this is included with Cloudflare Gateway without any additional charge. Why customers are adopting Internal DNS Consolidate DNS operations . Public and private DNS run on one platform, with one API, one audit trail, and one place to set policy. The appliance refresh cycle and the scaling bottlenecks that came with legacy DNS go away. Simplify split-horizon DNS . Internal and external resolution are defined as separate views over shared zones, managed from a single control plane. There are no parallel systems to keep in sync, so there's
Regulated enterprises evaluating AI pentesting platforms should assess eight capabilities: FedRAMP Moderate authorization or higher, multi-framework compliance support, human-in-the-loop with agentic AI, verified zero-false-positive findings, bidirectional workflow integrations, self-service launch, auditable coverage visibility, and full offensive security platform capabilities. Vendors who can't clearly distinguish their AI from an automated scanner are likely selling exactly that. The post The AI Pentesting Platform Checklist for Regulated Enterprises appeared first on Synack .