Cybersecurity News and Vulnerability Aggregator

r/cybersecurity • Just now

New

Hi all! I posted here recently looking for participants and the response was genuinely brilliant, thank you to everyone who took part. 🙏 I'm now just a handful of responses short of my target, so I'm putting out one last call. If you missed it: it's a short study for my MSc Cyber Security dissertation at the University of Gloucestershire. You review a series of network security alerts one at a time and decide whether you'd confirm, dismiss, or escalate each one, plus how confident you feel. No security background needed, the interface explains everything. ⏱️ \~10–15 minutes · 💻 desktop or phone · 🔒 anonymous, ethics-approved, 18+ 👉 [http://dissertation-explainids.uogs.co.uk](http://dissertation-explainids.uogs.co.uk) Every single response makes a real difference at this stage. Thank you so much!

The Hacker News • 1h ago

New

Phishing

Device code phishing - the abuse of the OAuth 2.0 device authorization grant to steal access tokens - has evolved from a niche red-team technique to an industrial-scale threat in under six months. Designed for input-constrained devices like smart TVs, printers, and so on, the device authorization login flow has been adopted by a wide range of apps and use-cases that it wasn't originally

r/cybersecurity • 1h ago

New

Hello Everyone I published a short guide about transforming raw logs into detection-ready data. It covers the log-processing pipeline, common log formats, normalization, and more.. I’d appreciate any feedback or suggestions from you all : [https://medium.com/@0xzyadelzyat/log-parsing-for-security-engineers-building-the-foundation-for-reliable-threat-detection-c34e71b01b9a](https://medium.com/@0xzyadelzyat/log-parsing-for-security-engineers-building-the-foundation-for-reliable-threat-detection-c34e71b01b9a)

The Hacker News • 1h ago

New

CVEAPT

Palo Alto Networks' Unit 42 says a Chinese-speaking threat actor used DeepSeek through the open-source Hermes Agent framework to launch attacks autonomously. After an initial Telegram instruction, the agent found internet-facing systems and selected public exploits. The researchers recovered no further operator input in the session. The operator, tracked through the aliases knaithe and KnYuan,

WIRED • 3h ago

New

CVE

Created by legendary hardware hacker Andrew “bunnie” Huang, the badges for this year’s famed security conference aim to push the boundaries of security and transparency.

The Hacker News • 6h ago

New

Phishing

Anthropic on Thursday became the latest artificial intelligence (AI) company to reveal that three of its models, including Claude Opus 4.7, Mythos 5, and an unnamed research model, had breached three unnamed organizations during cybersecurity testing without its knowledge. The AI firm said the earliest incidents date back to April 2026, adding it made the discoveries after launching a "

Anthropic Says Claude Hacked 3 Organizations During Cybersecurity Tests

WIRED • 11h ago

r/Malware • 8h ago

New

CVEMalwareAIPhishing

In April, I documented a StealC v2 campaign distributed through 19 GitHub typosquat repositories, including one impersonating my own open-source project. The delivery chain was: ```text GitHub typosquat -> Python dropper -> api.nailproxy.space -> encrypted Windows loader -> StealC v2 DLL -> spellmarketplace.club / 62.60.226.113:6673 ``` GitHub later removed all 19 repositories. The backend infrastructure remained a separate problem. I reported the domains, IP, malware routes, and hashes to the relevant registrars, Cloudflare, the hosting provider, CERT-Bund, GitHub Security Lab, ThreatFox, and AlienVault OTX. Then Operation Endgame disrupted infrastructure associated with SocGholish, Amadey, and StealC. Europol reported 326 servers and 142 domains actioned. Microsoft separately said it moved against more than 200 malicious Amadey and StealC C2 domains and IPs. Three months after my original disclosure, I checked the known infrastructure again using only minimal unauthenticated GET and HEAD requests. The documented malware-specific routes still behave differently from an arbitrary control path: ```text GET /api/v1/auth/session -> 405 Method Not Allowed GET /api/v1/data/sync -> 405 Method Not Allowed GET /foo/bar/baz -> 404 Not Found ``` HEAD returns the same status codes for all three paths. This does not prove that payload delivery, authentication, or exfiltration still works. I deliberately did not send the HMAC handshake, trigger Stage 2, or interact with the malware protocol. It does show that the known application routes remain registered and reachable. The evidence also has limitations: - The monitoring cron produced only 18 measurements over 69 days. - There were gaps of up to 20 days. - The endpoints briefly became unreachable in late May. - GET and HEAD return different status codes on the root paths of `spellmarketplace.club` and the bare IP, so I do not treat those checks as proof that the complete backend is operational. The point is not that Operation Endgame failed. It clearly disrupted a large amount of criminal infrastructure. The narrower lesson is that both of these statements can be true: > Hundreds of malicious systems were disrupted. > A specific previously reported backend still exposes its documented malware routes. Full technical write-up, including the original kill chain, abuse-report timeline, ThreatFox/OTX submissions, current probe results, and evidence limitations: https://blog.technopathy.club/operation-endgame-stealc-backend-still-responds I would be interested in how other analysts verify whether previously reported C2 infrastructure was actually included in a large takedown without actively engaging the malware protocol.

r/netsec • 10h ago

New

CVEAIPhishingSupply Chain

When a compromised AI Agent holds valid credentials (such as OAuth tokens or DB keys), traditional perimeter defenses like WAFs, EDRs, and LLM prompt firewalls often become ineffective. Recently, I've been researching a approach to bring runtime governance down to the C-ABI (Application Binary Interface) system call layer to enforce deterministic execution boundaries for local agentic workflows. Key Architectural Considerations I'm testing: \- Deterministic Binary Gate: Pre-compiled permissions mapped to immutable O(1) bitmaps, causing illegal syscalls to physically fail with <500ns panic latency. \- Cryptographic Identity Binding: A 3-Tier PKI Certificate Authority architecture coupled with identity tokens (DIT) to resolve OS-level execution context loss. \- B2B Multi-Enterprise Supply Chain Defense: Simulating agentic supply chain execution vectors (e.g., automated workload interactions with untrusted external repos). I'd love to hear feedback from the netsec community on deterministic runtime bounds and sandbox isolation models for autonomous agents. Is pushing governance down to the C-ABI layer practical in your agentic environments, or are there edge cases in execution context tracking that I might be overlooking?

r/blueteamsec • 13h ago

New

CVEAPT

Hi Everyone, I'm a cybersecurity practitioner of 7 years and I recently took the initiative to start an internal purple team / gap analysis program at my company. When I went to research existing platforms to help facilitate this, I found that they largely consisted of enterprise solutions geared toward heavy, complex SaaS deployments, while the open-source alternatives featured dated UIs and clunky workflows that weren't particularly inviting to newcomers. Since this was an independent initiative, I didn't want to deal with bloated workflows or massive infrastructure just to validate our controls. I needed something sleeker and more lightweight to track our defensive posture and manage the gap analysis lifecycle. So, I built Control Drift. Control Drift is an open-source, AI-augmented continuous validation platform designed to empower security professionals of all experience levels to execute precise threat simulations, map their defensive coverage, and manage gaps without the friction of enterprise bloat. **TL;DR on what makes it cool:** * **Lightweight Design** Runs completely in-browser (via `localStorage`) by default. Clone it and `npm run dev` to try it instantly, with a swappable DB adapter to scale for enterprise deployment later. * **Pessimistic Scoring:** If 1 out of 10 payload variations bypasses your EDR, it forcefully caps that MITRE technique's coverage score at "Partial" instead of "Optimal", eliminating false sense of security. * **Plug-and-play AI:** Connect local models or any OpenAI-compatible API endpoints to augment the simulation workflow, map attack paths, generate detection rules, and interact with a global assistant. * **Not Boring UI:** Built with React and u/react-three`/fiber` for a 3D globe MITRE ATT&CK heatmap. Control Drift was molded from own industry experiences and perspectives, so I would greatly appreciate any recommendations or general feedback from the community here! **Repo:** [`https://github.com/Control-Drift/Control-Drift`](https://github.com/Control-Drift/Control-Drift)

WIRED • 15h ago

New

A memo obtained by WIRED, issued by the water utilities information sharing group WaterISAC, links dozens of cyberattacks against Minnesota water utilities to Tehran.

Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline

The Hacker News • Jul 29

Synack • 16h ago

New

Craig Rosewarne, Managing Director of Wolfpack Information Risk, explains why continuous, AI-enabled validation, paired with human-verified exploitability, gives security leaders a real-time view of what's actually at risk. The post Guest Blog: The Annual Pentest Is No Longer Enough appeared first on Synack .

Ars Technica • 17h ago

New

AICloudPhishing

With Chrome, Google pioneered the rapid release model for browser security. Now, Google says updates may need to change in the face of AI security analysis. According to the company, the number of bug fixes in Chrome releases has skyrocketed in recent months because AI is detecting so many flaws . We could be looking at more frequent updates soon, but Google is also working on ways to get those updates rolled out without bothering you as much. Google has released two major Chrome milestone builds recently—Chrome 149 in early June and Chrome 150 just a few weeks later. These two updates had a total of 1,072 bug fixes, which is more than the previous 23 releases combined. Such is the impact of giant cybersecurity AI models that can probe software for vulnerabilities at light speed. Some of these vulnerabilities were serious, too, with one bug hiding in the Chrome codebase for 13 years. If it had been exploited, an attacker could have bypassed the Chrome sandbox to make the browser access local files.

The Hacker News • 19h ago

New

MalwareAPT

Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of the long-running Contagious Interview campaign. The defining aspect of the attack is that bogus macOS software update screen stealthily

CERT/CC • 19h ago

New

CVEAIPhishingAPT

Overview Six vulnerabilities have been discovered within the SGLang project, including remote code execution (RCE), server-side request forgery (SSRF), local file read, credential leakage, and model weight exfiltration on a target server. Exploitation does not require authentication in most cases, and some vulnerabilities require only network access with no API keys or user credentials. At the time of publication, no patches are available from the project maintainers, and coordination attempts have been unsuccessful. Description SGLang is an open-source framework for serving large language models (LLMs) and multimodal AI models, supporting models such as Qwen, DeepSeek, Mistral, and Skywork, and is compatible with OpenAI APIs. Six vulnerabilities have been discovered within the tool and are tracked as follows: CVE-2026-15969 SGLang contains unauthenticated RCE in /load_lora_adapter_from_tensors by bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads. CVE-2026-15971 SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, which allows for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on inference requests. CVE-2026-15974 SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions because image_url input is unsanitized, allowing access to internal metadata, secrets, and services. CVE-2026-15976 SGLang contains a RCE vulnerability when attempting to load model weights f

Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data

The Hacker News • Jul 30

VU#305509: OPeNDAP Hyrax is vulnerable to SSRF and Credential Disclosure

CERT/CC • Jul 29

WIRED • 20h ago

New

The two Chrome updates in June patched more bugs than the 23 updates before them. Now, Google is ramping up its patching schedule thanks to AI-assisted vulnerability discovery.

Krebs on Security • 20h ago

New

Security experts have been sounding the alarm for years about the risks of using generic TV boxes that promise unlimited content streaming for a one-time fee, warning that they secretly rent the user’s Internet connection out to strangers. But a groundbreaking new analysis finds these devices also routinely spoof themselves as mobile phones clicking ads on AI-generated websites as part of a sprawling operation that seeks to defraud online merchants and advertising networks. Pedro Falé is a threat researcher with the security firm Bitsight . Falé told KrebsOnSecurity he was able to peer inside a vast and complex ad fraud network by registering an expired domain name that was used to coordinate fake ad clicks across a particularly popular brand of these streaming devices known as H96 . An H96 TV streaming device currently advertised for sale on Amazon. Falé said the domain he scooped up was previously used for telemetry, periodically collecting full hardware information and the entire list of installed apps from tens of thousands of H96 streaming sticks plugged into television sets around the globe. But upon inspecting the traffic being funneled to the domain, he discovered nearly all of the TV boxes transmitting data claimed to be mobile phone models from a variety of ma

The Hacker News • 21h ago

New

Cloud

A lot of security still comes down to trusting the wrong screen. This week, that screen might be a login page, an install guide, a recruiter call, or a familiar service behaving slightly wrong. Behind it: reused credentials, exposed systems, quiet loaders, abused trust, and exploit paths that should have been harder. Some defenses improved. The loose parts still got found first. Anyway,

CERT/CC • 22h ago

New

CVE

Overview Two vulnerabilities in the REST API were found in Golf Compete foreUP. The first exposes the merchant, Finix, API credentials directly in customer record responses, allowing any user to obtain and use the payment processor account. The second is a missing object-level authorization check, which lets a user retrieve any other customer's full profile, payment token, and transaction history by changing the golfer_id in the request path. Description Golf Compete foreUP provides cloud-based golf course management software to over 2,000 golf courses. They offer tools that allow the management of customers, inventory, tee times, food &amp; beverages, marketing, billing, etc. The vulnerabilities identified are listed below. CVE-2026-15657 A vulnerability in the foreUP customer REST API exposes merchant credentials. Each customer record response includes the facility’s merchant API credentials in cleartext, exposing the following details: finix_username finix_password finix_merchant_id Merchant credentials are identical across for customers at the same facility and are actively used by the backend to register new payment instruments. Any authenticated customer can obtain the facility’s merchant credentials when querying own record. Combined with the second vulnerability described below, an attacker can retrieve merchant credentials from any customer record at the facility. CVE-2026-15658 A missing object-level authorization also known as BOLA (Broken Object Level Authorization) and IDOR (Insecure Direct Object References) in the REST API endpoint returns the record identified by golfer_id without verifying ownersh

VU#141367: AT&T's Arris BGW210-700 gateway contains authentication bypass vulnerability in LAN-side management interface

CERT/CC • Jul 28

The Hacker News • 23h ago

New

Cloud

A now-patched vulnerability in Azure Cosmos DB could have let an attacker escape the service's Gremlin query sandbox and obtain full read and write access to databases across customer tenants, according to Wiz. Wiz, which codenamed the chain CosmosEscape, said the exploit chain began with a crafted query against a Gremlin database controlled by the attacker. From there, code execution on a

Russian Hackers Exploit Microsoft OWA Flaw to Keep Mailbox Access After Credential Rotation

The Hacker News • Jul 30

Cloudflare • Jul 30

New

CVE

As of June 23, 2026, cdnjs, one of the Internet's busiest open-source CDNs, is running exclusively on Cloudflare’s Developer Platform . Along the way, cdnjs surfaced limits in the platform, and the platform grew to meet them. cdnjs is a free, open-source content delivery network for JavaScript and CSS libraries. Instead of using a bundler or self-hosting jQuery, Bootstrap, or Lodash, you drop a tag pointing to cdnjs.cloudflare.com and the library loads from Cloudflare's edge, instantly, anywhere in the world, with no signup, no API keys, and no rate limits. It's the infrastructure behind a significant portion of “intro to JavaScript” tutorials, CodePen demos, and Stack Overflow answers. Community-driven, cdnjs is used on roughly 12% of all websites , a 48.3% share of the JavaScript CDN market. It serves an average of 108,000 requests per second, 9 billion per day, across more than 330 Cloudflare data centers , with a 98.6% cache hit rate. Pretty cool, Internet! In 2011, when bundlers were exotic, npm was barely a year old, and "just drop a tag" was how the web shipped JavaScript, Ryan Kirkman and Thomas Davis built cdnjs as a free, community-run mirror of every popular open-source library. Cloudflare stepped in to host it free of charge months later , and took over project maintenance

Heimdal Security • Jul 30

New

London, UK, 30 July 2026 – New data from Heimdal’s telemetry measures the gap between execution of the MediaArena adware and the completion of quarantine. The same pattern has been confirmed across more than 40 client environments. MediaArena is a browser-modifier adware family that Microsoft has tracked since 2023. It is low-severity, and that is […] The post Heimdal data reveals MediaArena adware completes persistence before antivirus quarantine finishes appeared first on Heimdal Security Blog .

MediaArena malvertising: why a quarantine isn’t the end of the incident

Heimdal Security • Jul 30

The Hacker News • Jul 30

New

Hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report, then copy the same instructions into the finished file. Håkon Måløy disclosed the technique on July 28, 144 days after reporting it to Microsoft. In his proof of concept, the internally generated file triggered the same behavior when it was used in a second Copilot drafting session. Måløy's

The Hacker News • Jul 30

New

AIPhishing

Network firewalls are the workhorses of modern cybersecurity. They are trusted to protect the network, blocking malicious traffic and preventing intrusions and breaches. And for decades, network security teams have built controls around a relatively stable model: users connect to applications, applications exchange data, and security tools inspect packets, protocols, and destinations. Firewalls

r/blueteamsec • Jul 30

New

CVEAPT

I want to share an open-source research prototype I’ve been building called GraphGulo. It's a temporal graph engine designed specifically for analyzing massive network traffic captures and flow logs for lateral movement, without needing a massive server cluster. **The Threat Hunting Bottleneck:** Tracing lateral movement through a network requires "time-respecting" graph traversals. For example, if an attacker compromises Host A at `T=10`, a path to Host C through Host B is only a valid attack path if `A -> B` happens *before* `B -> C`. Trying to map this out using traditional Python graph libraries like NetworkX is practically impossible at scale. If you try to load a 14GB PCAP (about 109.6 million packets/edges) into NetworkX, it creates a massive web of dictionary objects, easily eating up 15GB+ of RAM and causing OOM crashes on a standard SOC analyst's laptop before the file even finishes loading. Using heavy disk-based databases like Neo4j is an option, but query times often take minutes for complex multi-hop temporal traversals. **How GraphGulo solves this:** I wanted to see if I could brute-force this entirely in RAM on a consumer laptop. I bypassed Python’s object model completely and pushed all the heavy lifting to native C-memory and Rust: 1. **Zero-Copy PCAP Ingestion:** The engine uses a custom Rust PCAP parser that pipes directly into flat NumPy arrays. The physical size of a 109M-edge graph in memory drops to just **1.49 GB** (though the Python/PyArrow wrapper uses around 4.5 GB total while keeping decompression buffers alive). 2. **Adaptive 5-Tier Storage:** Instead of treating all network nodes equally, the engine classifies them by degree. "Hot" nodes (like your Domain Controllers or DNS servers with >10k connections) are routed to a Scipy CSR matrix, while "Cool" endpoints use contiguous NumPy blocks. 3. **Temporal Dijkstra & BFS in Rust:** The actual graph traversals are written in Rust (via PyO3 FFI) utilizing Rayon for parallel dense/sparse phase switching and AVX2 SIMD for massive edge counting. **The Benchmarks (Intel Core i7, 16GB RAM):** * **Dataset:** 14GB PCAP -> 109.6M edges across 21.3M unique IPs * **Graph Build / Index Time:** \~100 seconds * **Graph Data Footprint:** 1.49 GB * **15-minute Temporal Window Query:** \~15ms * **Temporal Dijkstra (Finding the exact shortest time-respecting path across 16 hops):** 1.4 seconds It's currently a V1 prototype (graphs are immutable after building, so no real-time streaming ingest yet), but the core engine is strictly validated for mathematical correctness against NetworkX and igraph I’d love to hear your thoughts or see what kind of massive datasets you can break it with!

Trail of Bits • Jul 30

New

Uniswap v4 hooks let developers add custom behavior to pools, including dynamic fees, custom accounting, and external integrations. This flexibility moves some security responsibilities into application and hook code. The Cork and Bunni exploits are two app-level incidents that show what can go wrong in that code. Together, they account for more than $20M in losses. Neither incident stemmed from a flaw in the Uniswap v4 core protocol or the PoolManager; both arose from application-specific authorization and accounting logic built around hooks. After analyzing dozens of findings from Trail of Bits audits (including our Uniswap v4-core security review ), public reports from other firms, and the Solodit database, I&rsquo;ve identified seven recurring failure patterns in application and hook code, including missing caller checks and accounting bugs that still satisfy the PoolManager&rsquo;s settlement invariant. Builders can use these patterns as a secure-development checklist; auditors can use them to focus their review. What the PoolManager guarantees If you&rsquo;re familiar with Uniswap v3, where each pool was a separate contract, v4 inverts the model. All pool state now lives in a singleton PoolManager contract, with each pool represented in its storage. Uniswap v4 adds hooks: independent contracts that execute custom logic at specific points in the swap and liquidity lifecycle.

The Hacker News • Jul 30

New

MalwareAPT

South Korean authorities and four security firms have disclosed a state-sponsored campaign that compromised trusted domestic websites. The attackers used those sites to exploit locally installed financial-security software and infect targeted visitors with SIGNBT or COPPERHEDGE backdoors. A compromised page could infect a system running a vulnerable AnySign4PC version without a prompt or

The Hacker News • Jul 30

New

The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver (BYOVD) attacks targeting a Japanese organization in the industrial manufacturing sector to ultimately deliver ValleyRAT (aka Winos 4.0) for persistent remote access. "In this campaign, the group combines new vulnerable-driver abuse, newly observed abuse of legitimate

WIRED • Jul 30

New

If the generative AI giant had followed well-known security best practices, it’s likely that its AI agent would never have escaped to the open internet and hacked multiple companies.

WIRED • Jul 30

New

Drone warfare is making the skies more dangerous, even for airplanes far from the battlefield.

WIRED • Jul 30

New

Researchers pitted a person against a Claude agent and found that, after a week of texting, the AI chatbot was more effective at creating “exploitable trust” with others.

Heimdal Security • Jul 30

New

CVE

Heimdal did not start as a traditional cybersecurity company. It started with two Danish cybersecurity researchers, a piece of innovative technology and a challenge. Could they create something that could identify vulnerabilities, intercept malicious activity and help protect machines before threats could take hold? That technology went on to compete at the Defcon CTF world […] The post How Heimdal grew from a bold idea into a global cybersecurity platform appeared first on Heimdal Security Blog .

The Hacker News • Jul 30

New

The Federal Communications Commission (FCC) added foreign-produced mobile robots and networked power inverters to its Covered List on July 28. The move generally prevents new models from receiving the equipment authorization required for import, marketing, or sale in the US. Previously authorized models can still be sold, and devices people already own are unaffected. Federal purchases and use

The Hacker News • Jul 30

New

Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than 2 billion weekly downloads between them. The original Aikido and Wiz reports did not attribute the

r/netsec • Jul 29

New

This is another post in my series on the Chinese Wool farmers underground. This time we are dissecting their public github repos, trying to figure out how it all fits together!

The Guardian • Jul 29

New

Details of parents and staff, including email addresses and phone numbers, are among data taken by cybercriminals The Department for Education and a police database have been targeted by a cyber-attack, exposing more than 740,000 pieces of data. Details of government officials, senior school leaders, university staff, police officers and members of the public have been taken by hackers. Continue reading...

Synack • Jul 29

New

PolicyAI

Europe regulates AI through risk tiers and conformity checks. America accelerates AI through deregulation and infrastructure speed. Both models ask different questions but land on the same gap: neither tells you whether a live AI system actually holds up against real attacks. Enterprise AI security depends on evidence, not paperwork or policy. Continuous, human-validated offensive testing is the layer that both regulatory philosophies are missing and that every organization operating across borders actually needs. The post Europe Is Regulating AI. America Is Accelerating AI. Both Need Offensive Security Validation. appeared first on Synack .

The Hacker News • Jul 29

New

CVE

Ruby on Rails has released fixes for a critical Active Storage vulnerability that could let unauthenticated attackers read arbitrary files from application servers through crafted image uploads. Tracked as CVE-2026-66066 (CVSS score: 9.5), the flaw can expose the Rails process environment and secrets such as secret_key_base, the Rails master key, database passwords, cloud storage credentials,

CERT/CC • Jul 29

New

Phishing

Overview A vulnerability in the zipx.Unzip extraction routine of Develar’s app-builder allows an attacker to overwrite arbitrary files on macOS using Apple File System (APFS). The issue arises from a combination of Unicode normalization collisions and unsafe symlink-following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths. Description Develar’s app-builder is a command‑line build tool used heavily in the Electron ecosystem to package, sign, notarize, and produce distributable application bundles for macOS, Windows, and Linux. It is popular because it is a transitive dependency of electron-builder, one of the most widely used packaging tools for Electron apps. The vulnerability arises from how the zipx.Unzip routine handles Unicode‑equivalent filenames and symbolic links during ZIP extraction. APFS treats certain Unicode representations as identical (e.g., ß and ss), but app-builder does not perform canonical normalization before validating output paths. As a result, an attacker can craft ZIP archives that combine Unicode normalization collisions with malicious symlinks to redirect writes outside the intended extraction directory. The GitHub Pull Request addresses the symlink-following variant of this vulnerability (CWE‑22 and CWE‑59) by rejecting any symlink whose resolved target escapes the intended output directory and by adding O_NOFOLLOW to regular file writes. Without these protections, an attacker can craft ZIP archives containing malicious symlinks and Unicode-colliding filenames to overwrite arbitrary files on APFS-backed systems. Impact Exploitation of this vulnerabi

Synack • Jul 29

New

CISA's Binding Operational Directive 26-04, issued June 10, 2026, replaces the KEV directive with a four-variable risk model: asset exposure, KEV status, exploit automation, and technical impact. CISA publishes three of the four answers generically per CVE. The two that decide whether prioritization is defensible (real exposure and real impact in your environment) can only be proven by testing the asset the way an adversary would. Continuous, human-validated pentesting is built to produce that evidence. The post BOD 26-04 Makes Exploitability the Priority Signal: Scanners Can’t Measure It appeared first on Synack .

The Hacker News • Jul 29

New

CVE

Cybersecurity researchers have flagged a maximum-severity security flaw in Ruflo, an open-source agent meta-harness for Anthropic Claude Code and OpenAI Codex, that could result in unauthenticated remote code execution. The vulnerability, tracked as CVE-2026-59726 (CVSS score: 10.0), impacts all versions of the project before version 3.16.3. It has been codenamed RufRoot by Noma Security's

The Hacker News • Jul 29

New

CVECloud

Broadcom has released security updates to address multiple security flaws impacting VMware ESX, vCenter, Workstation, and Fusion, three of which have been designated as critical in severity. The first of the three critical-rated flaws is CVE-2026-59309 (CVSS score: 9.8), which has been described as an authentication bypass in VMware vCenter. "A malicious actor with network access to vCenter

The Hacker News • Jul 29

New

APT

Cybersecurity researchers have disclosed details of a large-scale fraud campaign that involves creating lookalike websites of major Russian companies with an aim to siphon funds from international firms for more than nine years. According to Russian cybersecurity vendor F6, the threat actors have set up clone websites of Russian companies across fertilizer manufacturers, petrochemical companies

Cloudflare • Jul 29

New

Cloudflare's Authenticated Origin Pulls and Custom Origin Trust Store now support post-quantum authentication. Here we’ll explain how you can configure fully post-quantum secure mutually authenticated TLS connections to your origin server, dive into the engineering details of how we built it, make a shameful confession, and finally explain how this work fits into our overall post-quantum migration roadmap. Reaching a major milestone Our focus for the past several years has been in deploying post-quantum encryption to protect against harvest-now/decrypt-later attacks, where an attacker quietly stockpiles your encrypted data with the hope of decrypting it in the future with a quantum computer. However, recent breakthroughs in quantum computing and cryptanalysis pulled the timelines for upgrading to post-quantum cryptography forward across industry and government and have caused us to shift our attention to deploying post-quantum authentication , to protect against attackers who will soon be able to use quantum computers to break classical credentials and carry out impersonation attacks. In a previous post, we announced that Cloudflare is

The Hacker News • Jul 29

New

AI is compressing exploit timelines. The real question isn't whether your vulnerability management playbook needs to change, it's which part of it you've been getting wrong all along. The conversation happening in security circles right now goes something like this: Mythos is here. Exploit timelines are collapsing. Does the vulnerability management playbook need to change? The honest answer is

WIRED • Jul 29

New

Cloud

One day after a federal judge ordered an ICE detention center opened to state health inspectors, the agency posted new contract terms that would void state oversight at four facilities.

WIRED • Jul 29

New

In a new disclosure, OpenAI says its agent used exposed logins to gain access to at least four “publicly available services” in its unhinged quest to solve a test.

Hugging Face Has a Deepfake Nudes Problem

WIRED • Jul 28

The OpenAI Models That Hacked Hugging Face Were ‘Active on the Internet’ for Days

WIRED • Jul 25

WIRED • Jul 28

New

How much could a single underscore in a username really matter? Just ask Brandon Klayme, who served 18 months in prison before realizing how authorities arrested, charged, and convicted the wrong man.

Heimdal Security • Jul 28

New

CVE

“Make everyone one percent better and it compounds across the team.” That’s the line Joe Head wrote about his own job and when I read it back to him, he didn’t hesitate. “That is 100% the objective,” he said. Joe runs AI adoption for an 80-person team as the only AI automation specialist in the […] The post Tools Change. Teach People How to Keep Up appeared first on Heimdal Security Blog .

r/netsec • Jul 28

New

CVEPhishing

TL;DR: We identified 36,872 internet-exposed BMCs, and 24,650 of them disclosed password-derived authentication hashes before login because of CVE-2013-4786. More than 30% of the returned hashes were linked to passwords that could be recovered using common wordlists or predictable factory password formats. The exposure affected modern Supermicro and HPE servers, including systems operated by GPU providers. The bigger risk is that a compromised BMC gives an attacker highly privileged access below the operating system. Because BMC management networks are often poorly segmented and lightly monitored, one exposed interface can become a foothold into broader data center infrastructure. We also created an interactive map where you can explore the exposed systems: https://lavahq.io/bmcradar

Cloudflare • Jul 28

New

Cloud

Like most infrastructure, the Internet's fragility is easy to overlook — as long as it's working. When it fails, its complexity comes into full view. Cloudflare is in a unique position to detect and document the moments when one of the interrelated systems the Internet depends on breaks down and connectivity suffers as a result. Each quarter, we summarize the disruptions we detect and annotate on Cloudflare Radar . In Q2 2026, Super Typhoon Sinlaku just north of Guam caused the longest outage, while government-mandated shutdowns during exam periods in Sudan were the most frequent. Iran restored national Internet access, reconnecting its citizens to the global network after an 88-day blackout, even as damage from drone strikes continued to disrupt AWS infrastructure elsewhere in the region. Finally, a cable cut in Saint Lucia and the distribution of faulty DNSSEC signatures in Germany underscored the fragility of Internet infrastructure, but also the remarkable stability these regional and global systems maintain when operating normally. Here we will walk through the most significant Internet disruptions we observed in the second quarter of 2026, drawing on traffic data from Cloudflare Radar to show how each unfolded and what it meant for users on the ground. As always, this is a summary of notable, confirmed disruptions rather than an exhaustive list; a fuller view of detected traffic anomalies is available in the Cloudflare Radar Outage Center . Natural disasters and electricity cause disruptions in Guam, Venezuela, and Tanzania Super Typhoon Sinlaku, the strongest storm of the 2026 Pacific typhoon season so far, tracked through the Mariana Islands in mid-April, passing just north of Guam. Tho

Trail of Bits • Jul 28

New

CVE

Codex’s /goal feature amplifies bug hunting, but getting good results requires the right prompt, the right scope, and the right number of outcomes per run. For Patch the Planet , our joint initiative with OpenAI to find and fix bugs in open-source software, we pointed Codex at some of the most widely used, heavily audited codebases in the world, like Rust, curl, and zlib. One tool came up again and again in our internal bug-report channels: /goal , which hands Codex an open-ended objective and lets it work independently toward a success condition. Here are a few highlights: /goal found every Rust bug we submitted, including a soundness hole and a miscompilation now patched in Rust 1.98, from a single variant-analysis pipeline. It turned every project&rsquo;s past CVEs into Semgrep rules that had to fire on the vulnerable version and stay silent on the patched one, then flagged 11 variant hits across multiple projects. It uncovered two potential high-severity privilege-escalation bugs in Keycloak&rsquo;s SAML component during a discovery run. Over the first few weeks of Patch the Planet, our engineers independently converged on three techniques for using /goal . We found that getting the most out of /goal means treating the prompt as a set of specific success criteria, not a set of instructions. (Note that this blog post uses /goal to refer to goal-based prompting in general. Codex can also set goals for itself through a tool call, and that&rsquo;s how we recommend everyone use it; we rarely type the slash command ourselves.) 1. Let Codex write the goal The art o

Ars Technica • Jul 27

New

Zero-DayAI

Microsoft is introducing new AI tools designed to help customers continuously streamline and automate the process of identifying and reducing their exposure to security risks. The new tools come less than a week after OpenAI lost control of two of its security models when they infiltrated the servers of startup Hugging Face. The hack, Hugging Face added, involved “a swarm of tens of thousands of automated actions” that stole internal Hugging Face credentials. The OpenAI models achieved this feat by exploiting a zero-day flaw in Hugging Face’s data-processing pipeline to run malicious code that escalated the models’ access to the company’s high-value cloud and server clusters. Microsoft’s announcements on Monday made no reference to the event, which OpenAI said was “unprecedented.” The company also didn’t say what would prevent the new tools from similarly going rogue. Read full article Comments ]]>

WIRED • Jul 27

New

The outgoing executive director of the Office of Homeland Security Statistics is one of very few federal officials to speak out against the Trump administration’s immigration crackdown.

WIRED • Jul 27

New

The screwup shows how tricky it can be to stop web crawlers from making ostensibly private conversations with AI chatbots entirely too public.

r/netsec • Jul 27

New

Zero-DayCVE

CVE-2026-61511 - a critical vulnerability in vBulletin that allows an unauthenticated attacker to execute arbitrary code on a remote server.

Cloudflare • Jul 27

New

Debugging privacy-preserving protocols is hard. Oblivious HTTP has several different steps across four different parties, not to mention binary HTTP encoding and details spread across many draft RFCs. We've taken what we've learned operating protocols like Oblivious HTTP at the scale of millions of requests per second, and wrapped it up in a nice, clean CLI tool — that we are open-sourcing today. We call it our privacy-client , or pvcli . We’re releasing it under the Apache-2.0 License, and it is open for contributions . Here’s a single line of code that executes a full Oblivious HTTP request with a relay, gateway and origin. Don't worry if you don't know what that means, we'll cover it below. We’ll explain why we built this tool, and show just how handy it can be. Why privacy protocols can be hard to debug Let’s take a closer look at our motivation for creating pvcli. Over time, the Privacy team’s product suite and customer base grew. We added products like Privacy Proxy and Privacy Gateway, which power Apple’s Private Relay , Microsoft’s Edge Secure Network VPN , Flo Health’s Anonymous Mode , and more. With it came an increasing amount of special customer requirements, domain knowledge, and complexity. As a result, we saw increased friction in development and incident response. To see this in action, let’s look at how one of our products implements

Datadog Security Labs • Jul 27

New

Malware

We analyze how VoidLink, LinkPro, and Atomic Arch abuse eBPF helpers to hide from defenders, and show how to detect them at load time, before they can act.

Troy Hunt • Jul 26

New

Data Breach

Presently sponsored by: Report URI: Guarding you from rogue JavaScript! Don’t get pwned; get real-time alerts & prevent breaches #SecureYourSite The Origin Energy breach down here in Aus is all over the news this week, and as with many breaches, it's multi-faceted. You've got them leading with "don't worry, your credit card is fine", the hacker leading with "they didn't respond when I tried to report it", and now news that the two parties have "come to an agreement". Maybe money was paid, or maybe Origin made some promises to restrain the hounds if commitments about data deletion were made. But both outcomes, of course, provide no guarantee that data has been nuked, so now they get to spend perpetuity waiting for the data that maybe - just maybe - it leaks. And we all should be working on precisely that assumption, just like we did with Optus and Medibank and Latitude and Ticketek and Qantas...

r/Malware • Jul 25

New

While analyzing featured extensions on our beloved chrome web store I landed on Planet Search (`kadaohckdkghfaclhjmkmplebcdcnfnp`), Featured, 2M users, publisher FREE VPN PLANET SRL. https://chromewebstore.google.com/detail/planet-search/kadaohckdkghfaclhjmkmplebcdcnfnp The extensions has a 0-byte background.js with zero permissions. The whole mechanism is one \`chrome\_settings\_overrides\` search provider, so nothing shows up statically. It's all server-side. Declared provider is planet-search[.]com Tracing: planet-search[.]com/search/?q= 301 → sstmaster[.]com/edge/PN1021?q= 302 → nextgeeker[.]com/B151001.php?q=&src=PN1021 nextgeeker[.]com is flagged as a browser hijacker by multiple vendors (pcrisk, gridinsoft, others). Same publisher ships a ~1M-user VPN extension and a few others. Still tracing those, not going to characterize them until I have. Report: https://malext.io/reports/RoguePlanet

r/netsec • Jul 25

New

MalwareAI

I'm helping organize **Après-Cyber Slopes Summit 2027**, and our CFP is now open. We're particularly interested in **technical presentations** and original research involving AI and modern cybersecurity. Topics we're hoping to see include: * AI red teaming * LLM security * Prompt injection research * Agent security * Offensive tooling * Detection engineering * Reverse engineering * Malware analysis * Cloud exploitation and defense * Identity attacks * Threat intelligence * AI-assisted security tooling * Novel attack techniques * Defensive research We especially appreciate talks that include demonstrations, technical depth, or research that attendees can reproduce themselves. Conference: February 24–26, 2027 Location: Park City, Utah CFP: [https://sessionize.com/apres-cyber-slopes-summit-2027](https://sessionize.com/apres-cyber-slopes-summit-2027) Conference website: [https://www.aprescyber.com](https://www.aprescyber.com) Happy to answer questions about the CFP or conference.

Cloudflare • Jul 24

New

Border Gateway Protocol ( BGP ) is the de facto routing protocol of the Internet. It offers built-in mechanisms to allow entities, represented by Autonomous Systems (ASes), to express how they want to send and receive traffic on the Internet. One such mechanism is path attributes , which carry essential routing information and metadata for their associated route. The path selection algorithm processes some of these path attributes in a deterministic sequence to calculate the best path for this specific prefix. Using our unique position on the Internet, we took an investigative look at one of the well-known mandatory attributes in BGP, the ORIGIN attribute. ORIGIN must be present in every BGP prefix announcement and should not be modified by any router after being set by the originating one. What we found through our own experiments was a dramatic ~70% of observed paths in numerous vantage points have a different ORIGIN value compared to what was set by the originating Autonomous System. This ORIGIN attribute manipulation has a significant impact on the way traffic is forwarded on the Internet, as we’ll explore in this post. BGP ORIGIN and its operational history The ORIGIN attribute indicates how a route was injected into BGP — not to be confused with the origin AS that ind

Synack • Jul 24

New

Policy

Iberia Cards CISO José Manuel Rivera García explains why he's stuck with Synack's PTaaS model across multiple organizations, and how running Sara AI Pentest alongside human researchers helps him balance regulatory compliance with real risk reduction. He also shares candid advice for other CISOs on avoiding the false sense of security that comes from infrequent testing and over-reliance on perimeter controls. The post How Iberia Cards Uses Sara AI Pentesting to Stay Ahead of Modern Threats appeared first on Synack .