A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 3:20 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations. "Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector," ESET researcher
The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI),
Some attacks this week didn't need much of a trick. A fake support call, a trusted extension, a shared link, or a device with no password. Small things that people barely think about. Yet each was enough to cause serious trouble. Then there were the bigger messes. Billions stolen, hidden networks of hacked devices, poisoned software, and attackers finding new ways to turn normal tools against
Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026. According to a report published by Dream Research Labs, the campaign has led to the compromise of a high-profile individual in Israel, along with additional compromises affecting a government cloud
Latest
Tuesday, November 3
Disclosure: I work at Bitdefender, and this is our research. We investigated a 3AM (ThreeAM) affiliate intrusion where the hands-on phase looked like a hybrid: some activity at human pace, and other parts behaving like an agentic loop. **This is IMHO a more realistic preview of real attacks that we can expect than the headline cases.** It didn’t cost millions or need first-class infrastructure, and an attack like this is easily executable with a local model. It follows the standard ransomware sequence, with a model doing part of the hands-on work, and we expect to see more hybrid attacks like this in 2027. Some details we found useful: * **It’s slow, not “machine speed”.** Retries came every 40 to 100 seconds, whether the change was nothing, one flag or a full rewrite in another tool. Moving on to a new task took minutes. * **It’s not clever.** Built-in Windows tools, a few public ones, and a commodity encryptor. One call to the backup software’s API used the wrong port and login method, which is typical of a model writing from memory. Interestingly, there was a confusion about using Windows commands with Linux syntax. * **It’s noisy.** Identical commands re-run, numbered scripts, and probe files like `test123` and `psexec-ok` left on disk. * **Domains and trusts are the clearest example of mechanical work.** To move laterally between the schools’ separate Active Directory domains, the attacker joined them with two-way trusts (`netdom` and `dnscmd`) in about three hours, followed by diagnostic probes and a Netlogon restart. Creating a trust needs admin rights in each domain, and the attacker had created the same backdoor account in at least three of them after taking credentials from the backup servers. Limits: we couldn’t access the attacker’s machine, so we can’t say which model was used, or whether a person was copy-pasting between a shell and a chat window. We describe the behavior, not the mechanism. Happy to answer questions. The full research: [https://www.bitdefender.com/en-us/blog/businessinsights/3am-ransomware-hybrid-ai-attack](https://www.bitdefender.com/en-us/blog/businessinsights/3am-ransomware-hybrid-ai-attack). IOCs: [https://github.com/bitdefender/malware-ioc/blob/master/2026\_11-3am-iocs.csv](https://github.com/bitdefender/malware-ioc/blob/master/2026_11-3am-iocs.csv)
You run security at your organization. It’s 7:00 am, and you’re having breakfast. You receive a ping: a new critical vulnerability has been disclosed. Your team scrambles to compare vendor advisories, read technical research, check which systems run the affected software, and answer familiar questions from the business: are we affected, and what are we doing about it? Another disclosure arrives before that work is finished. AI is changing both the volume and speed of critical vulnerability discovery. It can analyze large codebases at scale and surface deeply nested flaws that may have existed for years without being found through human review. That discovery momentum will put more pressure on security teams to understand the impact of each disclosure on their infrastructure. To help security teams prepare, today we’re introducing Zero Wire : a public vulnerability intelligence feed on Cloudflare Radar, bringing the clarity of a news wire service to critical security developments. It helps security leaders and practitioners understand significant vulnerabilities and decide what to do next. How it works Zero Wire lives inside Cloudflare Radar under the security section. Each briefing brings together a plain-language explanation of the vulnerability, who should investigate it, recommended actions, and links to the evidence and vendor guidance. The format is deliberately simple: an index card with what you need to know, without the drama. A CISO should be able to understand the issue quickly and ask the right questions. An engineer should be able to follow the same briefing to the technical guidance needed to investigate and remediate it. We also offer a pre-compiled prompt you can use with your agent to assess the impact on your infrastructure. Cloudflare contributes security research, observations from our network, and p
Pass-ta-key Golden Attack: Stealing Google Password Manager Synced Passkeys for Offline Account Takeover
As millions of Americans vote in today’s U.S. midterms, most will use paper ballots, which are protected by strict chain-of-custody protocols and, in some cases, statistical audits. You may wonder why we still use paper for our elections and voting systems when tasks like banking, tax filing, and document signing have moved away from paper-based legacy systems and become fully electronic. The short answer: security. That may come as a surprise to some. After all, cryptography and other security advancements have enabled secure electronic systems for many applications. In fact, cryptography can be used to provide two essential safeguards in elections: keeping (1) individual votes secret while (2) making the final tally independently verifiable. This is exactly the approach of cryptographic protocols like Helios and ElectionGuard . However, Helios intentionally targets lower-risk and lower-coercion settings rather than high-stakes public elections. ElectionGuard, by contrast, is intended for public elections, but not as a replacement for a paper-based system; it is used as a cryptographic layer integrated with traditional voting infrastructure. In this blog post, we’ll explain how cryptographic techniques can help protect ballot secrecy and prevent manipulation in electronic voting systems, and explore the limitations of these systems. Although cryptography can strengthen election verifiability and have other strong security properties, it cannot fully replace the security and trust of existing paper ballot systems in general elections. The challenges of electronic voting The National Academy of Sciences’ excellent 2018 report on election security concludes that el
Fixed kernels for a use-after-free vulnerability in the Linux kernel's IPv4 TCP code are now available for Red Hat Enterprise Linux 8, 9, and 10, while Ubuntu's fixes for its three newest long-term-support releases remain in its opt-in testing channel with no date for a regular update. The flaw, tracked as CVE-2026-98432, can be reached by a remote, unauthenticated attacker and can
Your team is remediating more vulnerabilities than ever, yet your breach risk has barely changed. You’re spending too much time and effort on exposures attackers may never exploit, while higher-risk exposures sit, waiting in the queue. Gartner®’s report on exposure prioritization states that fewer than 10% of vulnerabilities are exploited, yet most are treated as urgent. The report also argues
A Russia-aligned threat actor known as Gorbag has been observed using simple information stealer malware in attacks targeting Ukrainian organizations. "Active since at least February 2025, the group has focused exclusively on Ukrainian targets, with a clear preference for law enforcement and justice entities, local administrations near the front line, and the defense sector," ESET researcher
**tl:dr;** * Contrary to popular belief among vendors, system integrators, and asset owners: network authentication in TETRA mission-critical radio networks **does** ***not*** **provide authenticity & integrity** guarantees at the individual message level. * To make matters worse: **base stations don't require a re-authentication whenever a radio is roaming from one cell tower to the next.** * This allows for traffic injection attacks: both voice and data. The latter is particularly worrying for SCADA WAN scenarios or where voice & alarming functionality can disrupt operations at such as at airports, harbors, railway operators, and civil defense siren systems. * The 2026 attack on Taiwan High Speed Rail's TETRA network, leading to the emergency stop of several trains, shows a mild example of possible impact: [https://www.midnightblue.nl/blog/analyzing-the-taiwan-high-speed-rail-thsr-tetra-cyber-incident-part-1](https://www.midnightblue.nl/blog/analyzing-the-taiwan-high-speed-rail-thsr-tetra-cyber-incident-part-1)
With AI agents now running in many Microsoft 365 tenants, monitoring their activity has become part of the security team’s job. Microsoft Defender XDR monitors AI agents through its integration with Microsoft Agent 365, the control plane for agents in your tenant. This post covers what to enable, where the data lands, and how to respond when an agent goes wrong. We will also show you some interesting log sources, where useful information about the behavior of agents can be found.. The features listed in this article may not be visible or available without the proper license. You may need the “Agent 365” add-on for you actual license, or the new E7 license plan which includes everything (Agent 365, Microsoft 365 Copilot). Which agents Defender XDR can see Defender’s threat detection uses observability data from different cloud agent sources, plus agents running locally on endpoints. Agent type Examples Copilot Studio agents Low-code custom agents built by users Microsoft Foundry agents Pro-code agents in Azure Copilot Agent Builder agents Declarative agents built in Microsoft 365 Copilot Non-Microsoft agents Agents built with the Agent 365 SDK Local agents Coding and desktop agents on devices Each managed agent also gets a Microsoft Entra Agent ID : a directory identity with owners, sign-in logs and risk scoring. That identity i
Synology is urging customers to update the DiskStation Manager (DSM) software powering its Network Attached Storage (NAS) devices following ransomware attacks. The Taiwanese vendor said it observed threat actors exploiting a vulnerability patched in December 2024 to target devices running outdated versions of DSM. "These attacks aim to encrypt data and extort ransom," it said in a statement
Attackers remotely changed the settings on refrigeration controls at supermarkets in Belgium, Sweden, Estonia and other European countries overnight into Monday, November 2, warming fridges and freezers. No chain reported more than several dozen affected stores, and some had to throw away chilled and frozen food or take it off the shelf. Danfoss, a Danish maker of refrigeration controls, 
A maximum-severity security flaw impacting Siemens SIMATIC IoT2050 Advanced devices has come under active exploitation, VulnCheck has revealed. The vulnerability, tracked as CVE-2026-58115 (CVSS score: 10.0), is a case of missing authentication for a critical function that could be exploited by an unauthenticated remote attacker to run arbitrary code. "SIMATIC IoT2050 Advanced devices running
GitHub - rjzak/malware-modeler-rs: Generate training data and ML models for benign vs. malicious files plus related tools.
Something I've been working on for a while: training lightweight machine learning models to determine if a file is benign or malicious based on raw byte sequences (n-grams). The goal is for anyone working with malware (and has goodware samples too) can train their own models, and this could be useful for resource-constrained environments of if you want a model for older systems not supported by typical AV vendors.
Google said today it worked with industry partners to dismantle a botnet made up of more than 1.3 million Android TV set-top boxes that ship with malicious software which secretly rents the user’s Internet connection out to strangers and conducts advertising fraud. Experts involved in the takedown say the action is likely to sever the botnet’s access to more than 10 million additional compromised systems, including other Internet of Things (IoT) products such as Android-based healthcare devices and karaoke machines. A report from the Google Threat Intelligence Group (GTIG) said Google has severed ties with Videostrong Technology Co. , a TV box manufacturer in China that GTIG and other industry experts concluded was responsible for including malware that enrolled more than 1.3 million set-top boxes in a botnet dubbed “ XCPE ” (named after one of the malware’s core code components). The global distribution of XCPE botnet infections. Image: Google Threat Intelligence Group. The report said the XCPE botnet loaded the user’s device with software that makes their Internet address available for resale by multiple “residential proxy” services, which allow customers to rent Internet addresses
National Cyber Security Centre expects attacks on critical facilities such as power stations, airports and hospitals AI-powered malicious software is “highly likely” to be used in hacking attacks against the UK’s power stations, airports and hospitals by 2028, according to the state cybersecurity body. The National Cyber Security Centre (NCSC) said AI will probably enable a ransomware attack against critical national infrastructure [CNI] between now and 2028. The UK’s definition of CNI covers a range of facilities and services across sectors including energy, transport, defence, food, health and finance. Continue reading...
Monday, November 2
Had a subscription in the past with them and received the following e-mail: Doesn't look like many sites have have picked up on this: >Dear cPGuard customers and partners, >An unidentified attacker targeted OPSSHIELD, gained unauthorized access to our licensing and update systems, and distributed a malicious script through the cPGuard update channel. \*\*We have stopped further distribution of the script and released cPGuard 5.88.25 to remove the known backdoor and files left by the script.\*\* >The script sent data to an endpoint on our licensing server under a compromised account. We secured that account as soon as we identified the breach and cleared our infrastructure credentials. We are investigating how the attacker gained access, which customer servers ran the script, and what data the attacker accessed. >\*\*Please take the following actions immediately.\*\* >1. \*\*Update every cPGuard server.\*\* Run \`cpgcli update --start\`. The corrective update removes the backdoor shell at \`/var/tmp/.cpg91511\_sh\` and the collection directory \`/var/tmp/.cpg91511\`, including the password hashes and credential archive (\`loot.tgz\`) staged there. 2. \*\*Verify the installed version.\*\* After the update completes, run \`cpgcli --version\` on each server and confirm it reports \*\*5.88.25\*\*. If the update fails or the server still reports an older version (between 5.88.12 and 5.88.19), contact OPSSHIELD Support immediately. 3. \*\*If you know or suspect the malicious script ran, reset passwords and revoke exposed credentials.\*\* The script targeted \`/etc/shadow\`. Reset passwords for root and all other password-enabled local accounts from a trusted recovery environment. From a trusted device, change any passwords reused elsewhere and rotate affected database passwords, S3 access keys, DigitalOcean tokens, and secrets recorded in root's shell history. Replace SSH private keys stored under \`/root/.ssh\` and remove the corresponding old public keys from every system that trusts them. Complete this step even if the update succeeds, because credentials copied before cleanup may still be usable. >We are sorry that this breach put your systems at risk. If you need help assessing a server, please contact OPSSHIELD Support through your usual support channel. We will share further findings as we verify them. >The OPSSHIELD Team
Follow-up reporting identifies Palo Alto Networks firewalls as targets in the PHP2Shell exploit-chain investigation. Researchers describe attackers combining PHP vulnerabilities with a Linux kernel privilege-escalation flaw to obtain root access. This adds important product-specific context to the Dream Research findings we've discussed. Administrators of exposed firewall management interfaces should review vendor advisories and investigate possible compromise. Palo Alto acknowledges limited exploitation affecting customers. The suspected China-linked attribution remains a research assessment, not independently established fact.
I just read about this one. CVE-2026-115881 and CVE-2026-115884: including issues with lack of revocation checking, mTLS validation bypass and a trivial DHE private value usage (this last one doesn’t have a CVE for some reason). https://thehackernews.com/2026/10/goahead-tls-flaws-allow-revoked-client.html The mTLS one seems most serious as that can allow improper authentication. The DHE vulnerability is kind of hilarious, because it uses a single byte for one of its values, making one of the likely scenario of it using… “4”. I found a few articles that mention Palo Alto using the library, but I can find no PA advisory yet. Anyone has info on that?
Supermarket fridges were attacked in Belgium, Sweden, Estonia and Portugal. Our scans still saw many of their control dashboards online.
Hi, I work at IPinfo (former journalist here), and today I ran a few numbers and updates on the supermarket fridge situation. Mostly because of the news that supermarkets in four other European countries reported attacks on their refrigeration. These attacks were in stores in Belgium, Sweden and Estonia, and also in some stores in Portugal. So I gave it a go. Our weekly Internet scans count Danfoss refrigeration dashboards that are open to anyone. France, hit on October 11–12, took most of its offline: 1,331 on October 6–7, 149 on October 27. The countries hit today didn’t move as much, given they hadn’t been attacked before. Between the same dates, Belgium went from 85 to 51 and Sweden from 73 to 64. Portugal dropped from 92 to 37. In Estonia, 3 of the 4 still online were an older model Danfoss no longer updates, but we don’t see many there. So even after France made the news (maybe no surprise), many of these exposed systems in the countries hit next stayed online for weeks. Also, the counts are IP addresses on the ports we scan, so they’re a minimum (keep that in mind). More detail (from a couple of week and regarding France and Europe): [https://ipinfo.io/blog/france-fridges-hack](https://ipinfo.io/blog/france-fridges-hack) And today’s update with the chart: [https://x.com/emot/status/2117232166262251810](https://x.com/emot/status/2117232166262251810)
AI makes it easier to build your own web applications, but handling sensitive data still requires special care. We examined 159,041 Lovable projects and found many cases where personal and confidential information was accessible without logging in.
Mirage2FA AiTM kit steals M365 session cookies after MFA (ANY.RUN: 4,561 cookie theft events): SIEM detection rules and phishing-resistant hardening guide
Author here. Detection rules (UTMStack, Entra ID audit actions) and hardening steps validated in a hybrid lab (Entra Connect + on-prem AD + WS2025). Corrections welcome.
The Capytistas, a secretive group claiming more than $1.2 million in backing, started with Elon Musk and Tesla’s board. Members argue that those who buy political power deserve the scrutiny they’ll impose.
Some attacks this week didn't need much of a trick. A fake support call, a trusted extension, a shared link, or a device with no password. Small things that people barely think about. Yet each was enough to cause serious trouble. Then there were the bigger messes. Billions stolen, hidden networks of hacked devices, poisoned software, and attackers finding new ways to turn normal tools against
Recently came across two exposed attacker servers that gave us an interesting look at how AI is being used in real-world offensive operations. Both servers were exposing their working directories over HTTP. In total, huntback recovered 1,304 files (193 MB), including shell histories, AI agent logs, pentest reports, credentials and other tooling. Here's what we found: * 25 organisations targeted across Europe and beyond, including hosting providers, marketplaces, cloud infrastructure, a bank and a national telecom operator. * 31 runs of pentestcode, an open-source autonomous pentesting agent, mostly powered by DeepSeek Flash. * 63 agent sessions and 16,616 logged steps across just two days of activity. * 10 engagements with reported breaches, including claims of 168 compromised hosts, 1,770 findings and 1,256 credentials recovered across nine reports. * The operator repeatedly used essentially the same prompt, instructing the AI to pursue domain admin, database access and deeper network compromise. The interesting part is how little sophistication was needed to orchestrate the activity. An open-source agent, an inexpensive model and a reusable prompt were enough to automate substantial reconnaissance and exploitation attempts. The exposed directories also contained credential-checking tools, account creation automation, database dumps, hash-cracking infrastructure and residential proxy configurations. For defenders, the bigger takeaway is that autonomous offensive tooling is no longer just a theoretical capability. We can now observe operators incorporating these agents into real targeting workflows.
Overview INFINITT PACS installations using System Manager versions 3.0.11.3 and 3.0.11.5 contain vulnerabilities that may allow an attacker to execute arbitrary code. INFINITT Healthcare has remediated the issues in System Manager versions 3.0.12.3 and 3.0.12.5. Description INFINITT PACS is an enterprise web-based medical imaging platform that stores, retrieves, and displays patient scans. CVE-2026-16305 An improperly protected update manifest may allow a local attacker to execute commands with administrative privileges when an update is approved. SmartExecute.exe reads and runs commands from execlist.txt after an update. Because of insecure file permissions on execlist.txt , a low-privileged attacker can modify the file before it is processed to add arbitrary malicious commands. After SmartUpdate.exe launches, it runs SmartExecute.exe and the user can be prompted by User Account Control (UAC), which can allow the malicious command to execute with administrative privileges. CVE-2026-16306 An unsafe command dispatch through the registered imodular:// URI scheme may result in code execution. A vulnerability in IModular.exe allows an attacker to execute certain application functions by supplying a crafted imodular:// link. The application reads the cmd value from the link and executes the corresponding function without verifying that the command is permitted or safe. By convincing an end user to open a crafted imodular:// link, an attacker can cause IModular.exe t
Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026. According to a report published by Dream Research Labs, the campaign has led to the compromise of a high-profile individual in Israel, along with additional compromises affecting a government cloud
The PHP2Shell Vulnerability Heralds Cybersecurity Hell: AI is forcing us to pay off 40 years of technical debt
“One of the things we’re witnessing now is that all the legacy software that was written by humans over the last 40 years is being exposed.”
When I last wrote about our DNS propagation pipeline in 2022 , the Zone Builder received about 250 DNS record changes per second. Today it receives about 700, nearly three times as many, plus about 100 other events, such as zone setting changes. However, the number of events was never the real problem. The problem was the kind of work some of those events needed, and how that work grows with the size of a zone. Some zones now hold more than 20 million records, and we expect them to keep growing toward hundreds of millions. Each event starts a clock that measures how long it takes us to turn that change into data our authoritative DNS servers can use. We call that work a build. A build reads the current database state, converts it into the format used at the edge, and writes any changes to Quicksilver . In 2022, per-record builds were 150 times faster than full builds on average. On a test zone with one million records, per-record builds were 4,250 times faster. We ended that post with the obvious next step: do the same thing for zone settings. Why doesn't the Zone Builder just rebuild the setting that changed? It should, and that is where we ended up. However, proving when it was safe took most of the work. A record event identifies what changed. A zone event can come from many Cloudflare products, may not say why the zone changed, and can alter data shared by several zones with the same name. Choosing too much work wastes capacity. Choosing too little can leave stale or incorrect DNS data at the edge. We built a targeted
Stable Linux releases lack existing security fixes because backporting them is time-consuming and often thankless work. We’re using Codex to reduce the backporting process time from days to hours per fix, empowering human patch reviewers to rapidly submit fixes for critical software like Ubuntu Long Term Support, Fedora, and the Linux kernel. By October 29, our project helped deliver fixes for 149 distinct CVEs into stable Linux kernel releases, and several fixes to Fedora and Ubuntu packages. Deploying fixes to older software requires multiple steps, including adapting fixes to older code, checking dependencies, and ensuring the fix did not introduce new bugs. A single task (like tracking down a bug in a bad commit) can take a week or more of effort that no one sees or appreciates. Our Codex workflow has reduced the human effort required to prepare and review fixes. Excluding project-specific initial setup, preparing and reviewing a straightforward backport takes about 30 minutes of human attention; a more involved case can take around three hours. The workflow’s approach is twofold: agents perform activities like identifying missing fixes, adapting patches, assembling validation evidence, running tests, and preparing submission packets, while engineers review the patches and submit them to maintainers. Those estimates only cover patch preparation and review; regression testing and maintainer acceptance remain essential. But the reduced human commitment makes a substantial class of neglected security work practical to undertake. The patch backlog is large, but we now
Forty percent of security teams now use AI every day, and another 56% are testing it. Only 4% have no plans to adopt it, according to Prophet Security's State of AI in Security Operations 2026 survey of more than 250 CISOs, SOC leaders and practitioners. For the teams still testing, the next decision is whether their own SOC is ready. AI SOC readiness has two parts: whether a SOC has the
Attackers posing as IT support on Microsoft Teams talked employees into giving them remote control of their PCs. They then used insecure Active Directory Certificate Services (AD CS) settings to obtain login certificates for privileged accounts, including one for a domain controller. Microsoft said in a report that it investigated two such intrusions, one of which resulted in company
I’ve gotten nearly 2,000 campaign fundraising texts that were meant for someone else. I tried to find out why—and uncovered a labyrinth of politicians, data brokers, and shady tactics.
Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where "CL" refers to cluster and "UNK" stands for unknown
WIRED uncovered some 400 apps and websites linked to Chinese-language developers that look like regular AI tools but had secret features that let users create violent AI-generated images and video.
(May 2026) TL;DR: - an email address like atouch${IFS}/tmp/savane-rce-proof@attacker.example gave any registered user code execution on its backend. - From there, we made our account a superuser, - impersonated Bash’s maintainer, and confirmed we could add an SSH key with push access to the upstream Bash repository. - An unpatched kernel gave us root access and access to a GNU backup server. We reported it to the FSF on May 11, 2026. FSF incident report: https://static.fsf.org/nosvn/security/savannah-20260807.pdf
To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the [Reverse Engineering StackExchange](http://reverseengineering.stackexchange.com/). See also /r/AskReverseEngineering.
Cybersecurity researchers have discovered a new Windows infostealer malware called VOLTA-AUTODOXER (aka VOLTA) that makes use of a large language model (LLM) to rank a victim's stolen data by their monetization value. Like other typical stealer families, VOLTA is equipped to harvest passwords and cookies from Chromium-based web browsers; data from Outlook profiles and Slack workspaces;
I built an IDM-style download manager in Rust (egui): split downloads, queues, scheduler, browser add-on
Sunday, November 1
Adding onto the post "Archived malware I found over the years pt1" BY: "u/Fickle_Plan_208" Effort post!!!!! read description.
LINK TO THEIR POST: [link.](https://www.reddit.com/r/malwares/comments/1tdfrsy/archived_malware_i_found_over_the_years_pt1/) LINK TO MY OTHER POST ON THIS: [Link](https://www.reddit.com/r/ExtremeArchive/s/CCzXpSShV3) All malware I found on the GitHub user LEMZzip and links to archived malware they made if found plus info and updated file! This post also includes a screenshot of their GitHub page at the bottom! SCAN LINKS IN ANYRUN: (:[SCAN 1](https://app.any.run/tasks/1b3a66c7-54c0-46c9-a944-e3012ff76d46/): [SCAN 2](https://app.any.run/tasks/381650b8-c79b-4992-9e59-8f0ec40eca68/):) VIRUS TOTAL SCAN LINKS I FOUND: (:[Love.exe](https://www.virustotal.com/gui/file/e63cc912240af3b0e958f0617372876a3f0221e27c45ae5362963d72185e5d81), [Browser setup 1.2.exe](https://www.virustotal.com/gui/file/207b53a4aa0a36fbc52b0557c5b747640cb79dde37ea02c85240984065779a60):) MALWARE NAMES THAT WERE ARCHIVED: "tripop CD Defender Antivirus, Roblox Setup, Rec room modded, Recroom-white-main, DSBN wifi bypass!, love. Browser setup 1.2" MALWARE NAMES THAT AS OF NOW CAN'T BE ARCHIVED: "Recroom modded (NEW), blackhole, train-way! Setup, rusty., admin turnoff, makerpen, ultralemzx, spazz, Xholder. " (Note: There may have been more I forgot to include!.") Possible same accounts on github: ([LEMZzip](https://github.com/Callmelemon82), [LEMZzipV2](https://github.com/LEMZzipV2)) Possible same user on reddit: ([LEMZzip](https://www.reddit.com/user/LEMZzip/)) Possible same user on archive web: ([LEMZzip](https://archive.org/details/@LEMZzip)) The website URL some of their malware opened I had to remove because if I did not my post would keep getting taken down! LEMZzip Malware archive V1.1: [Download!](https://www.mediafire.com/file/0jphz06ge3rgd5x/LEMZzip_Malware_archive_V1.1.zip/file) Inside it also has a description on what the malware does! Note: I will try to update this unlike them! Archived software I could not include but archived: "LEMZzip Trojan maker 1.1!" Screenshot below as well! *Processing img qkcfmlqp16zh1...* *Processing img wswxb9b5s4zh1...*
I’ve been getting questions from friends after the recent Synology security issues and PHPshell discussions: “How do I actually protect my NAS?” Some people go straight to network isolation, but setting up firewall rules isn’t simple, and it’s easy to accidentally cut off essential services. For non-technical users, that’s a rough tradeoff. So we built a whitelist DNS approach: only allow legitimate/useful domains that the NAS actually needs — e.g. Office, Synology sites, Tailscale — and block the rest. The idea is simple: your NAS does **not** need to connect to random domains like `upload. webdisk .com` or `abcxyx-randomhosting .io`. Instead of letting the NAS connect to anything, only let it connect to what it should. It is **not 100% secure**, but it can do 3 things: 1. Block malware downloading tools/payloads 2. Block data uploads to unknown hosts 3. Help detect unusual connections What it does **not** protect against: 1. Malware using pure IP-based communication 2. Exploitation of known vulnerabilities The whitelist DNS is designed for Synology DSM, requires no software install, and takes about 2 minutes to set up. Your NAS only resolves the services it actually uses — DSM updates, backup, time sync, certificate renewal — everything else fails at DNS. If malware tries to “phone home,” the DNS lookup fails and the connection dies. DNS IP is 35.215.165.139 We’ve been running it on our DSM 7.4 NAS for 3+ hours so far and it’s working normally. Details/setup here: [https://www.aplens.co/blog/whitelist-dns-for-nas](https://www.aplens.co/blog/whitelist-dns-for-nas)
MalChela v4.4 adds Unpack, a static unpacker for PE, ELF, and Mach-O; maps findings across the toolkit to MITRE ATT\&CK v20 with an interactive Enterprise matrix; and moves every tool to the embedded YARA-X engine, removing the system YARA dependency. Also new: YARA Scan and IP reputation with GreyNoise.
Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite By pure timing coincidence, the Proton CEO's AI @ Proton, Engineering Manifesto made headlines around the same time as this week's video. The guy's management style and choice of language have really rubbed a lot of people up the wrong way, and deservedly so, IMHO. However... this section of his screed really resonated with me: Your job has fundamentally changed. It is no longer to write code, and LLMs are not here to help you write better code faster. Your job is to help the LLM write better code faster. Dev jobs as we know them are gone. Dead. And if you disagree, you're in for a shock in the very near future. But at the same time: I don't remember the last time tech has been this exciting. It's white hot right now. Anyone who loves technology and computers is probably having a great time right now. — Jack Rhysider ☠️ (@JackRhysider) October 30, 2026 Yes! This! Not handwriting code "old school" isn't something to lament; rather, our unprecedented ability to innovate, create and build things that are meaning
Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $2.7 million to 726 affected wallets. Blockchain records show crypto worth about $2.64 million reached
The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI),
Using a fake DOB or leaving the field blank when making an online account can offer protection from identity theft You get a call from your bank saying there has been suspicious activity on your account. They read out your name, address and date of birth so you are happy it is a legitimate caller. But you are talking to criminals who have used your date of birth as part of a web of verifying information to convince you they are someone else. Continue reading...
Saturday, October 31
BogusMips 2026-10-31 (first version) released: Integrated disassembly and network sniffing for Android apps
Friday, October 30
Thanks to a lucky break, flawed code in a tainted Claude extension prevented the attacker from fully worming their way into some 5,000 developer machines.
Shared ASLR-bypass kit byte-identical across four hosts, a custom heap exploit with a log cleaner, cloned public PoCs, and a PAN-OS-focused repackaging (panos\_rce\_poc.py, prce.py) exposed at 130.94.67\[.\]235. File-level detail and hashes in the post.
On October 19, 2026, we learned about eMudhra’s eight shockingly weak keys: where eMudhra was trusted to pick a 115-digit number for their virtual combination lock protecting the Internet, they picked the number 4. Not even four digits, just the number 4. The other seven keys were similarly weak: 56, 66, 115, 155, 156, 230 and 237. The next day, we wrote a blog post on the immediate action we took to mitigate this leak, and what customers needed to do on their end to stay secure. Now, we are sharing a more in-depth follow up on the evidence we’ve seen of exploitation, and the progress seen on visitors patching their systems. Let's start with the scale of the problem. A certificate authority (CA) with weak keys this serious is unprecedented, and the potential consequences are significant. While there have been plenty of compromised certification authorities in the past (such as DigiNotar , TÜRKTRUST , and TrustWave ), access to their keys has always been contained to a degree; these incidents gave a limited set of attackers or organizations the ability to issue fraudulent certificates. The eMudhra incident is fundamentally different; the affected intermediate private keys could be recovered almost instantly by anyone from the public certificates themse
David Gibson says the problem is that details of the flaw were revealed before it was fixed, while Charles MacKinnon notes that we are at the mercy of technology we don’t understand Chris Stokel-Walker may be right ( The internet has broken – again. Shouldn’t the tech firms that make billions from it pay to fix it?, 22 October ), but the real issue lies elsewhere. The bugs in the PHP programming language that were recently found by an AI tool have been present for a long time without anybody noticing and without any harm being done – they are extremely obscure. They were not found by hackers – they were found because an AI tool was used to check the PHP source code, which is a good use of AI. Continue reading...
Today, Cloudflare services for private origins is generally available. Point a proxied DNS record at a private IP, and Cloudflare reaches the origin over your existing Cloudflare One connection . Your origin stays private, while web application firewall ( WAF ), caching , bot management , and Workers work just as they do for public origins. In June, we launched this capability in closed beta to address a problem we kept hearing from customers: Their internal APIs, AI agent backends, MCP servers, and operational tools weren’t built to face the Internet, but those services still need to accept requests from partners, customers, or agents over the Internet. Before the beta, putting Cloudflare in front of these services meant exposing a public IP, opening a firewall port, or running cloudflared alongside the origin. Those requirements often left private applications without the same protections and controls they used for public applications, including WAF, bot management, rate limiting, caching, traffic acceleration, rewrites, and Workers. What is generally available today During the closed beta, eligible customers requested access through their account team. Today, we’re opening access beyond that beta group. Point a proxied A or AAAA record at
I wanted to figure out just how exploitable php2shell and http2shell were in practice, so I've created two purposely vulnerable web apps: [https://brotli2bitcoin.com](https://brotli2bitcoin.com) & [https://php2bitcoin.com](https://php2bitcoin.com) with a standard production config -- pop an RCE and find the flag to claim the $1K BTC. And to make it interesting, I setup a live stream showing every single attack attempt happening live [https://www.youtube.com/watch?v=w7\_EJWqRzvw](https://www.youtube.com/watch?v=w7_EJWqRzvw) Good luck! ;)
Thursday, October 29
A complete API penetration test should cover discovery, authentication, authorization across every role and tenant, data exposure, injection, abuse and rate limiting, business logic, and configuration, backed by reproducible evidence and a defined retest. The checklist below is written as buyer requirements: statements a security team can check a vendor's proposal or final report against, not instructions for performing the test yourself. The post API Penetration Testing Checklist: What Enterprise Security Teams Should Require appeared first on Synack .
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.
What if a VNC server could make your viewer believe it had a \~4 GB framebuffer… while actually allocating only 128 KB? That’s the core of this TightVNC vulnerability. A malicious server can announce a crafted 32768 × 32769 screen at 32bpp, causing the framebuffer size calculation to overflow. The allocation wraps down to 128 KB, but the viewer continues using the original, much larger dimensions when calculating pixel writes. The result is a server-controlled out-of-bounds write in the viewer. It’s a good example of how a relatively small integer-overflow mistake can become a powerful memory-corruption primitive when different parts of the application disagree about the true size of a buffer.
Welcome to the 26th edition of Cloudflare's DDoS Threat Report. This edition covers the third quarter of 2026 — July, August, and September — and returns the series to its quarterly cadence following the combined H1 2026 volume. The analysis is produced by Cloudforce One , Cloudflare's Threat Intelligence organization, providing a comprehensive analysis of the evolving threat landscape of Distributed Denial of Service (DDoS) attacks based on data from the Cloudflare network . Key insights Short-burst, low-bandwidth attacks lasting under 10 minutes and 1 Gbps surged by 208%. Conversely, hyper-volumetric attacks exceeding 1 Tbps plummeted by nearly 69% from Q2, possibly a reflection of law enforcement actions against four major Internet of Things (IoT) botnets earlier in the year. However, variants continue to emerge, proving that IoT botnets remain a durable, high-volume threat to network infrastructure. Threat actors dramatically shifted their reflection and amplification tactics, abruptly abandoning CLDAP floods, which collapsed by 99.5% quarter-over-quarter. Instead, attackers pivoted heavily toward other connectionless protocols, driving a 215% surge in DNS amplification and a 122% increase in general UDP floods. Attack targets broadened significantly across both industries and geographies, with the United States reclaiming the most-attacked position from China. Canada and Israel experienced sharp spikes in targeted attacks — jumping 10 and 7 spots respectively — while juggling geopolitical tensions, trade disputes, and contentious domestic events. At the same time, the operational focus shifted aw
A vendor gets a call from one of its biggest MSP partners who needs something the vendor can’t supply. The vendor knows a competitor can, so it points them there. That sounds like a good way to lose a partner, but it wasn’t. They stayed, and they spent even more over the next few years. […] The post The best due diligence on a vendor is who they’ve worked with appeared first on Heimdal Security Blog .
Information released by Distributed Denial of Secrets is the third such government data disclosure in the last month Data identifying more than 41,000 employees and contractors for the US Department of Homeland Security (DHS) was released on Wednesday in an unprecedented leak that reveals how the agency is organized. The records, which were made public by the transparency non-profit Distributed Denial of Secrets, reference operation names, surveillance programs and information on undercover initiatives. The DHS did not immediately return a message seeking comment. Continue reading...
We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and other runtimes, and explain how to detect and remediate it.
Wednesday, October 28
The critical flaw in UEFI firmware—used by most server vendors and data centers—allows attackers to execute code early in the boot process.
Rebranded GodPotato + PowerShell stager + Impacket env, left open by an operator who stole 68 GB from a Philippine government agency
Toolkit dump from a captured open directory: a renamed GodPotato (two builds and source), an eight-line PowerShell stager that reassembles the payload in memory, a small Python upload receiver, a full unmodified Impacket environment, and the operator's own transfer and access logs. Hashes, named-pipe path, and the base64 command/fragment paths are all in the post.
ICE’s Homeland Security Investigations is engaged in far-reaching spying against left-wing activists that rivals the FBI and CIA crackdowns on the Civil Rights and anti-war movements.
Tuesday, October 27
Cutting Through the php2shell Noise On October 20, details of php2shell, two pre-auth RCE vulnerabilities in the PHP core discovered by Calif (CVE-2026-109618 and CVE-2026-109619), leaked ahead of coordinated disclosure. Advisories listing affected versions followed quickly, along with a flood of PoCs, many AI-generated and non-functional. We waited until we had our own data. This post covers what we learned building and testing exploits. In short, php2shell is exploitable but more conditional than some coverage suggests. Our analysis indicates that exploitation is heavily version dependent, and that the precise heap layouts required to exploit under the default display_errors=Off setting make it much more difficult than the non-default display_errors=On scenario. We will delve into why this is the case further into the post. Almost all of the public exploits released for php2shell focus on the dangling “PS” session global variables case, which impacts instances of Apache running mod_php or applications serving PHP code using the “php -S” development server like in the Steal My Bitcoin challenge . Our analysis focused heavily on the mod_php exploitation path. However, we’re starting to see early signs of exploits targeting the second vulnerability with the serializer, which affects PHP-FPM, such as kengwang/php2shell-fpm-exp . We haven’t yet had the opportunity to fully analyze that exploitation path and confirm the published exploit works. This article will focus on explaining why the mod_php exploitation scenario is exploitable, where the real-world risk is, and what organizations can do to be better prepared for events like this in the future.