Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two
Cybersecurity News and Vulnerability Aggregator
Cybersecurity news aggregator
Updated: 4:40 pm
J/K Navigate / Search S Save V Open Link
— or
treemd <(curl -sL https://allsec.sh/md) (as Markdown) Top Cybersecurity Stories Today
Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts." In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26 and 27, released yesterday, do not list a fix. A researcher who goes by forcequit released the escape, called worse_query, on Sunday, a
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails. According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for
Cloud penetration testing focuses on identity, configuration, and service-layer attack paths within the customer's side of the shared responsibility model, rather than the network perimeter a traditional test targets. Each major cloud provider sets its own rules for what testing is permitted without prior approval. Scope should be defined by accounts, identities, and services rather than IP ranges, since that is how risk concentrates in a cloud environment. In US government cloud environments, the provider's rules are only the first gate. Testing must also fit the system's authorization boundary and the agency's own rules of engagement. The post Cloud Penetration Testing Services for Enterprise AWS, Azure, and GCP Environments appeared first on Synack .
Latest
Tuesday, November 10
Hey everybody. Been a member here for a while, but haven't posted in a bit. There is a new report out today on SOC readiness released by Cyberbit. It has some interesting research findings around SOC performance based on a huge cache of cloud cyber range data from both Cyberbit and RangeForce (Cyberbit acquired them last year). **Full disclosure, I work at Cyberbit, but was not very involved in the making of the report.** I just thought the folks here might find it useful. [https://www.cyberbit.com/readiness-report/](https://www.cyberbit.com/readiness-report/) FYI, the report IS gated and I don't have an ungated version. Mods: I hope this doesn't come off as too promotional. Happy to make edits, if necessary. Not trying to get banned! LOL
Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two
Ask an AI pentesting vendor to prove what was tested, what its findings demonstrate, where human experts contribute, how testing is controlled and what supports its performance claims. The answers should help you decide whether the testing will produce evidence your security team can use. As a CMO, I believe we have a responsibility to […] The post AI Pentesting: What Buyers Should Ask Vendors to Prove appeared first on Synack .
The threat actor known as Blind Eagle has resurfaced with a new campaign targeting organizations in Latin America through judicial and administrative-themed phishing lures to deliver a remote access trojan (RAT) that shares its lineage with AsyncRAT and DCRat. "The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings, and
Fireworks AI disclosed on Monday that its investigation into a security incident first reported early last month uncovered further malicious activity, affecting account and billing information, alongside secrets, datasets, and incomplete models for a "limited set of accounts." In a notice published on October 10, 2026, the company said it detected unauthorized use of internal Fireworks
An iOS sandbox escape published on GitHub lets an app read other apps' files on iPhones running iOS 26 and 27. That puts seed phrases, private keys, and login credentials at risk of exposure to malicious apps, Binance warned today. Apple's updates for iOS 26 and 27, released yesterday, do not list a fix. A researcher who goes by forcequit released the escape, called worse_query, on Sunday, a
At some point your security will fail. This isn’t pessimism. It’s not because your team and tools aren’t sophisticated enough. It’s the reason we have detections in the first place. And, it’s why once we accept that prevention has its limits, we arrive at an interdiction strategy: finding and disrupting what got in. After the alert The alert tells you something happened. However, gaining
Many Electron apps auto-update without verifying signatures. Many also still trust the compromised eMudhra certificates. Together, that lets an attacker on your network install malware on your machine. I've compiled a list of notable Electron apps, installed them in a lab, and test which still trust the eMudhra certs, compared to whether they verify update signatures. You can find the full table of apps on my post.
An iMessage flaw could let a remote attacker join a group chat and receive its messages, Apple said yesterday, and it released updates to fix it. The updates also fix a separate iMessage flaw that could let someone added to a group access messages sent before they joined. As of today, other updates released yesterday for the iPhone XS, XS Max and XR, the iPad (7th generation) and some Apple
The Russia-aligned state-sponsored threat actor known as Turla (aka Snake) is wielding a previously undocumented cyber espionage toolset called Cereal that's used to break into victims' Microsoft Exchange servers with an aim to surreptitiously collect emails. According to an ESET report shared with The Hacker News ahead of publication, the sophisticated and modular tool is designed for
Four flaws that attackers could exploit without logging in were fixed today as part of SAP's monthly Security Patch Day—the vendor rates all four 10.0, the maximum CVSS score. Three are in the SAP NetWeaver application server, the software SAP systems run on, and one is in the Web Dispatcher, which receives web requests from the internet and passes them on to that server. The flaws in the Web
An October cyberattack on refrigeration controllers at about 700 French retail sites was carried out by a cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), the French government said yesterday. The attackers broke into controllers on the night of October 11 and changed their defrost settings to high temperatures. That caused food losses and, in at least 15 cases, fires. The unit
Anthropic on Monday released Claude Fable 5.2 and Claude Mythos 5.2 models, which it said exhibit improvements in coding, reasoning, and vision. During pre-release training, the large language models (LLMs) helped its engineers "complete otherwise-infeasible software migrations, designed three working electronic devices from scratch, solved two open problems in the physics of black holes, made
A researcher’s trawl through publicly available code found private information was at risk across multiple departments.
Google on Monday released updates to patch nine security vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, assigned the CVE identifier CVE-2026-125350 (CVSS score: N/A), has been described as a use-after-free bug in the XML component. Use-after-free bugs typically occur when a program attempts to access a memory location after
N-able said it has taken N-central Hosted Environments offline and is urging on-premises customers to shut down their servers until further notice following the public disclosure of over 30 vulnerabilities collectively tracked as Able2Shell. "As a precautionary measure, we are temporarily taking our Hosted N-central environment offline while we take the necessary actions to secure the
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-123218 (CVSS score: 9.8) - An incorrect authorization vulnerability
DeepMind researchers were able to formally verify that the widely used encryption protocol works as intended. Their stretch goal? Do the same for “all the software of the world.”
I built this over the last few weeks and released it on 8 Nov. It’s a beta. The idea: when someone gets into a network, the next thing they do is hunt for saved passwords. Lure plants fake ones where they look (a passwords spreadsheet, an RDP file, .git-credentials, a VPN profile, a QR code on a helpdesk notice, a DNS name for a backup server that doesn’t exist). The files only point at a listener machine you control.
Does this not create an increased risk for threat actors to gain access to Mythos? I'm confused as to how this is a good idea with "end users" (not specified if it's developers or public) gaining access to this?
Presently sponsored by: Not every rogue agent is an attack. In a live webinar on Nov 17, Researcher Tyler Holmwood walks through cases of agents going off course. The kids-and-social-media discussion is just dumb. It's not the premise of delaying their access until 16, but the inability of those who should know better to grasp where the responsibility for enforcement lies. Here's our PM's explainer after the laws passed down here a couple of years ago: The onus won't be on parents or young people. There will be no penalties for users. And it's been expressed many times since, in similar terms, always to the effect of placing responsibility for implementation and enforcement on the social media platforms. Inevitably, there are some massive holes in their implementation, along with major privacy and social concerns. But as I say this week (and have said on many previous occasions), it doesn't have to be perfect; over the long run, it will gradually change social norms, and the kids in that shoulder age bracket right now will have a different set of expectations than those who come after them. But hopefully, in the interim, the whole "onus won't be on parents" mantra will be respected more than it has been to date.
Monday, November 9
Corsair MM800 RGB Mousepad Custom Firmware for Persistent default colors and custom JSON-defined default animations
3x GPU's are monitoring 450+ unsecured cameras around the world constantly looking for one person with red-and-white stripes. On the website you can find the results. The server is using the opensource model Qwen3-VL.
Three security updates with practical follow-up: 1. **LNbits shutdown notice:** Operators were told to shut down servers after attacks, while developers prepared security fixes. The notice covers LNbits deployments, not every Lightning node or Bitcoin wallet. 2. **Keplr private-key exposure:** Some wallets created through Google or Apple login were affected by the Web3Auth incident. Recovery transfers complicate theft estimates. Avoid funding affected wallets and use official recovery guidance. 3. **Plex requires more than patching:** QNAP says vulnerable Plex installations previously exposed to the internet should be treated as potentially compromised. Update Plex and follow its clean-reinstallation and credential-reset guidance. Read the full recap on CyberRecaps.
Cybercriminals are to blame for the current crisis. But renting out study space will not lead to recovery It holds two copies of Magna Carta , the charter that set limits on royal power in 1215. It has the sole surviving manuscript of the Anglo-Saxon epic Beowulf and notebooks by some of the most beloved authors in the English language: Jane Austen, William Blake, Virginia Woolf. Also in the British Library’s red-brick London building is the original, illustrated version of Alice’s Adventures in Wonderland – given as an early Christmas gift to Alice Liddell in 1864. On handwritten drafts of Wilfred Owen’s tragic poem Dulce et Decorum est, visitors can see suggestions made by his friend Siegfried Sassoon. But neither display cases filled with treasures such as these nor vast digital archives, basement storage rooms, six cafes and a shop have been sufficient to arm the library against a sea of troubles that first threatened it three years ago, when hackers raided its computers for personal data and demanded a £600,000 ransom. Its long-serving chief executive, Roly Keating, took the decision to step down once the worst of the cyber-attack – one of the most serious in the UK’s history – had been dealt with. His replacement, Rebecca Lawrence, lasted less than a year before resigning in the middle of a strike over pay. Now, a new row has broken out over
usb-rea: label your clicks in a vendor app, get the USB protocol (with frame-level evidence) and a pyusb driver
I run a small email security consultancy and this is our research. A typo of AmazonSES in US government DNS whitelisted 32,066 IPs to pass DMARC p=quarantine as milivcounty\[.\]gov, with the IP set rotating every 3-8 days. Attackers are snowshoeing the IPs, and once they get listed by Abusix and Spamhaus, they rotate the SPF include chain. Other AmazonSES typos in gov SPF are amasonses\[.\]com under pikevilleky\[.\]gov and amazones\[.\]com under townofkirkwood\[.\]gov. There are also 40 other US Gov domains with dangling & abused NS (domain takeover), MX (mail interception), and DMARC (telemetry hijack) records. Our team has registered 17 of these typos and expired domains, including one that had been in use for 20 years and only expired in August. DNS vulnerabilities have been around for decades, but many US government orgs decided to skip the security guardrails when they had the chance, and now those old gaps are being exploited by the same technologies they missed.
Overview Multiple vulnerabilities in the FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) may allow remote code execution, unauthorized access to onboard sensors, disclosure of sensitive information, and full compromise of affected devices. Exploitation may enable an attacker to remotely control the rover, access audiovisual streams, or pivot into the user’s network. Description The FrodoBots EarthRover Mini+ is a compact, internet‑connected mobile robot used in educational and consumer environments. The device includes a camera, microphone, motor controllers, and multiple onboard services. Multiple vulnerabilities in the EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) can allow remote code execution, unauthorized access to onboard sensors, exposure of sensitive data, and complete device compromise. An attacker could potentially take remote control of the rover, access its audio and video streams, or use it to gain a foothold in its network. CVE-2026-121685 : The firmware contains several sets of hard-coded, fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM (Amazon Web Services Identity and Access Management) access keys, Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) credentials, and a Slack incoming webhook URL. Agora Token Service is an open source server that generates secure, time‑limited authentication tokens for use with Agora.io’s RTC (Real‑Time Communication) and RTM (Real‑Time Messaging) services. A Slack incoming webhook URL is a unique endpoint that lets external systems send messages into a Slack channel without the need for a full Slack application. These are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware
Overview PrestaShop's back-office Performance > Debug mode functionality contains a PHP code injection vulnerability. An authenticated attacker with permission to modify debug-mode configuration can submit crafted cookie configuration values that are written into an executable PHP configuration file. Successful exploitation could allow arbitrary code execution with the privileges of the PHP process. Description PrestaShop is an open-source e-commerce platform for creating and managing online stores. Its back-office Performance configuration includes a Debug mode for developers, which is enabled based on a specified cookie name and value. PrestaShop's debug-mode configuration code inserts the user-controlled values debug_cookie_name and debug_cookie_value into a PHP expression without adequately escaping or sanitizing them for use in PHP source code. The application writes this expression into the PHP define() statement in config/defines.inc.php or config/defines_custom.inc.php . A crafted value can terminate the intended string and introduce attacker-controlled PHP statements. The modified configuration file is loaded during application initialization, causing the injected code to execute on a subsequent request. Exploitation requires an authenticated back-office account with permission to modify debug mode settings and a configuration file writable by the PHP process. Root or operating-system administrator privileges are not required. Cross-site request forgery (CSRF) protection helps prevent unauthorized requests made through another user's session, but does not prevent exploitation by an attacker controlling an account with the required permissions. Injected code executes with the privileges of t
Sometimes you can't upload a file to an online scanner, for example when it comes from a client or contains private data. I made binkeep for that. You open the page, drop the file in, and see what's inside: suspicious imports, strings like URLs and IPs, packer detection, signature check, YARA rules and disassembly. It never runs the file and never sends it anywhere. Everything happens in your browser, and files up to 512 MB work. Try it: [https://kano92-dir.github.io/binkeep/](https://kano92-dir.github.io/binkeep/) Code: [https://github.com/kano92-dir/binkeep](https://github.com/kano92-dir/binkeep) It's free and open source. Feedback is welcome, especially on what's missing for your workflow.
CAs found 17% of their own incidents in 2026 so far, down from 29% last year and 59% in 2022. Researchers, root programs, and other outsiders found the rest. That's from a dataset we built of every TLS incident in Mozilla's CA program since 2017 (1,581 as of November 7). 2026 is already the busiest year, with 338. Only 11 incidents in the whole set are critical, and eMudhra's computable keys are the only one where a CA lost control of its own keys. [https://www.certkit.io/ca-report](https://www.certkit.io/ca-report)
🚀 It's time for a new 13Cubed episode! Ever wondered how ShellBags Explorer determines whether a folder has been explored? We'll dig into the "Has Explored" column, explain the importance of NodeSlot values, and show how they influence the interpretation of ShellBag artifacts. ▶️ [https://www.youtube.com/watch?v=kN2JIt60Sco](https://www.youtube.com/watch?v=kN2JIt60Sco) \#DFIR #DigitalForensics
A system doesn't always need a complicated bug to let someone in. Sometimes, a blank password is enough. That's one of the bigger stories this week. And it gets worse when the tools meant to keep systems updated or running safely become part of the attack. Elsewhere, attackers are hiding inside normal web traffic, stealing credentials from network devices, and finding new uses for exposed
Cloudflare is distributing the first $301,300 of the Vite Ecosystem Fund to 44 projects and maintainers across the Vite ecosystem. When VoidZero joined Cloudflare, we committed $1 million to strengthen the open source ecosystem around Vite. This round is just the start. Sponsoring open source has always mattered, but now AI has made funding urgent. AI is changing open source AI has made open source more valuable while triggering more maintainer burnout. Previously, contributing to a project through either an issue or pull request meant you cared about it. In return, maintainers would review and provide feedback. AI changed the social contract of open source. Anyone can now create and submit AI-authored pull requests. The most visible result is the influx of pull requests. As the number of PRs has gone up, the number of maintainers reviewing them has stayed constant. So each maintainer’s workload has grown. During reviews, maintainers often find themselves speaking with an agent and not a person like they used to. If that’s the case, then why not cut out the middleman? Maintainers now have their own agents they can prompt to produce better results since they have more knowledge of the codebase. AI has raised the pressure to produce . It’s made it easier for maintainers to ship features, performance improvements, and bug fixes that would not have been done otherwise. But it’s also made it easy for other projects to do the same. When another project adds overlapping features using AI, maintainers feel a need to keep up using AI. It can become a grinding cycle, where each project pushes the other to move faster. Along the way, some projects have grown in scope and lost sight of their original goals. Maintainer burnout and sustainability have alway
The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine. Both apps signed customers in through ForgeRock, an identity platform now part of Ping Identity, and on those servers the researchers reached an
Behavioral LOLBins detection engine with sequential correlation, PE masquerading checks, and Sysmon integration
I built a behavioral detection engine focused on Living-off-the-Land binaries on Windows and wanted to share it with the community for feedback. **Problem it tries to solve** Traditional signature/hash-based detection struggles with LOLBins because they are legitimate, signed Microsoft binaries. Attackers also rename them, obfuscate command lines, and chain multiple utilities across time. Single-event rules often miss the broader operational context. **What the tool does** * Collects process telemetry (prefers Sysmon Event ID 1, falls back to psutil) * Single-event behavioral rules for common LOLBins (certutil, bitsadmin, mshta, regsvr32, rundll32, powershell, wmic, etc.) * Sequential multi-stage correlation (download → execute, LOLBin → encoded PowerShell, process cascades) * Binary masquerading detection via PE OriginalFileName * PPID spoofing anomaly checks * Command-line obfuscation heuristics (carets, backticks, Base64 blocks, environment variable slicing) * False-positive suppression + de-duplication * Timeline reconstruction (±5–10 min window) + process lineage * Local web dashboard for triage * Automated Markdown incident reports + webhook support (Slack/Discord/SIEM) **Architecture highlights** * Modular pipeline: collector → correlation state machine → detection engine → timeline reconstructor → dispatcher * Rules can be written in YAML (declarative) or pure Python * Built-in threat emulation test harness (11 scenarios currently) **Current limitations** * psutil mode has polling latency (can miss very short-lived processes) * Still user-mode only (no kernel/ETW consumer yet) * Needs more real-world tuning of suppression rules **GitHub**: [https://github.com/nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-System](https://github.com/nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-System) Would love feedback on: * Rule coverage / false positive rates you’ve seen with similar approaches * Missing high-value sequential chains * Whether the dashboard and timeline reconstruction are useful in practice * Any other LOLBins or techniques I should prioritize Happy to answer technical questions or discuss design decisions.
Everyone running LNbits, a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday. It has several security fixes to release and asked operators to be careful until they are out. One operator said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could
Homeland Security Investigations estimates that it has sent out more administrative subpoenas since January 2025 than it did in more than six and a half years between 2016 and mid-August 2022.
To reduce the amount of noise from questions, we have disabled self-posts in favor of a unified questions thread every week. Feel free to ask any question about reverse engineering here. If your question is about how to use a specific tool, or is specific to some particular target, you will have better luck on the [Reverse Engineering StackExchange](http://reverseengineering.stackexchange.com/). See also /r/AskReverseEngineering.
We share in-the-wild activity from ARTEX, an AI-native penetration framework, against AWS environments, including CloudWatch log hunting with compromised access keys and abuse of public Cognito user pools.
Sunday, November 8
Open-source tool that ranks AD fixes by how many users they cut off from Domain Admin, and flags the easy ones first (feedback wanted)
Hi all, I’m a pentester and I kept ending AD engagements with the same client question: “OK, but what do we fix first?” So I’ve been building HorusEye, a free MIT-licensed tool that works on data you already collect (SharpHound/BloodHound CE, Certipy, NetExec) and runs fully offline. What it does: * Counts how many enabled users have a route to Tier-0, and finds the fewest changes that take that to zero * Rates every fix by effort (Low/Medium/High, with the reason, using fixed rules, no AI) and puts Quick Wins first: Critical/High findings with a Low-effort fix, ranked by how many users each one cuts off * Each finding says why it matters, what to do (with an alternative if the obvious fix would break someone’s access), and how to verify it * A status tracker (Open / In progress / Fixed / Accepted risk) you can export and share. On a retest, `--diff` confirms which “Fixed” items are really gone and flags any that came back * CSV export, because most remediation lives in spreadsheets anyway The v2.5 features came from a security engineer who described how he triages audit findings (severity + effort, quick wins first), so I built that in. Live demo on a synthetic 1,245-user lab, nothing to install: [https://omar-tamerr.github.io/HorusEye/exposure-demo.html](https://omar-tamerr.github.io/HorusEye/exposure-demo.html) Repo: [https://github.com/Omar-tamerr/HorusEye](https://github.com/Omar-tamerr/HorusEye) It doesn’t replace BloodHound, it sits after it. Honest limits: it only sees what the collectors capture, and the effort ratings are rules of thumb, so I’d really like to hear where they’re wrong for your environment. What would make something like this actually useful to your team?
As AI exposes flaws in IT systems and geopolitics plays out on the cyber frontline, some experts say the events of recent weeks could soon be a common occurrence Alex Pearce was doing the morning rounds at his fruit and vegetable wholesale business in London on Monday last week when he noticed something odd. The defrost light on refrigeration unit 2 was on, and the panel reading was 150C. Unit 4 was the same. Continue reading...
Has anyone heard of this? [https://blog.gitguardian.com/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets-right-now/](https://blog.gitguardian.com/the-agents-have-now-found-your-secrets-on-github-artex-is-abusing-public-secrets-right-now/)
I spent countless nights digging into PHP2Shell. Here's a deep dive into how it actually works, from memory to PHP internals to a real exploit.
When the PHP vulnerabilities were first announced, I spent a HUGE amount of time trying to figure out the logic behind them. As many others who tried investigating them probably noticed, there was barely any technical information available at the time. We had a few basic hints: something related to PHP\_SESSION\_UPLOAD\_PROGRESS, some kind of Out of Memory condition, and, of course, that video Calif published showing a dancing girl with a shell running the exploit in the background. 😂 I found that pretty funny, especially considering the scale of the vulnerabilities and how many servers around the world could potentially be affected. Anyway, that was pretty much all we had to work with! Even AI assistants weren't particularly helpful. At the time, they were heavily restricted when it came to this subject. A simple technical question about an internal PHP function could get flagged just because you mentioned PHP and something technical in the same sentence. For those of us without access to a more cybersecurity-focused model, even asking basic questions and using AI to help investigate things was practically impossible. So I started digging into the PHP codebase myself (I was honestly getting a little mentally insane by that point). I spent countless hours going through the source code, tracing functions, setting up experiments, debugging, and trying to understand exactly what was happening behind the scenes. There were long days and endless nights spent following one thing after another, trying to connect all the pieces until things finally started making sense (the Steal My Bitcoin challenge helped a lot, thanks to James Pavur, and Jaydip Modhwadia (Killa)). The more I investigated, the more I realized that I wanted to put everything together somewhere. Not just the final explanation, but the entire process: the PHP internals behind the vulnerabilities, what's happening in memory, why certain things happen the way they do, and how all of this eventually leads to a working exploit. That's how this research project started. I structured the write-up to start from the basics and gradually build up to the actual exploitation. Each part builds on what came before, with the explanations becoming progressively more technical until we get to the real thing. I wanted someone with little or no experience in low-level memory exploitation to be able to follow along and understand how all the pieces fit together. The write-up also goes through the actual exploit code used to solve the "Steal My Bitcoin" challenge, breaking it down step by step rather than simply showing the final result. Everything is based on my own research, local experiments, and understanding of the PHP engine. I'm not claiming this is an official analysis or that everything is necessarily correct. I'm still learning, and there might be mistakes or things I've misunderstood. And honestly, I was getting tired of explanations that only scratched the surface without actually showing what was happening internally. I wanted to do something different: a proper, in-depth technical walkthrough covering the entire process, examining the important details and explaining not just WHAT happens, but WHY and HOW it happens. You can read the full write-up here: [**PHP2Shell: From Memory to C Internals to Real Exploit Code**](https://djad04.github.io/php2shell-deep-dive/) And here's the GitHub repository, which also includes the project files and the backstory behind the research: [**GitHub Repository**](https://github.com/djad04/php2shell-deep-dive)
Saturday, November 7
I've spent about the last year building relift and today I'm finally releasing it. I'm really proud of how it turned out so I wanted to share it here. relift is a workbench for analyzing and triaging Go malware. If you've ever opened a Go binary in Ghidra you know the pain. A few lines of Go turn into hundreds of lines of C pseudo-code buried in runtime noise. I always hated that, and that's what our reconstruction engine is built to fix. It turns each function back into short, readable Go and keeps the matching assembly right next to it. Since relift is made for malware analysis, I added something the usual tools don't have, a Findings tab that pulls together what matters in a sample, like network indicators and decoded strings, so the obvious stuff shows up right away. The Lab is where the magic happens though. relift has its own emulator that can run a single function in a sandbox and show you what it returns. Point it at a string decoder or a config decryptor and you get the plaintext without ever running the sample. It also recovers names in garble-obfuscated binaries, works on Windows, Linux and macOS binaries (64 and 32-bit x86), and comes with a command-line tool if you want to script your triage. It's free for non-commercial use. and the free version already includes all of the features along with access to the CLI This is the very first release so I'd really appreciate it if you gave it a shot on a real sample. Any feedback is more than welcome, bugs, missing features, or a function it got wrong. That's exactly what will help me keep improving relift. You can get it at [https://www.riven-labs.com/relift](https://www.riven-labs.com/relift) [Relift in action analyzing a real-world sample](https://preview.redd.it/v7868li2r90i1.png?width=1919&format=png&auto=webp&s=f6ede94b04141d60972306a4720b0cf8d2898bbc)
Escalating hacks affecting blood labs and grocery stores show the very real risks to critical infrastructure that come from basic security lapses involving internet-connected devices.
i built native imessage for windows. no mac, no iphone, no relay. the pc itself pretends to be a mac
Friday, November 6
Separate actions also take place outside fence and across Europe in backlash against impact of AI boom Activists have stormed the site of a Microsoft datacentre being built in Amsterdam, as the backlash to the social and environmental harms of the AI boom spreads across Europe. Protesters from Geef Tegengas, a Dutch direct action group, clashed with police while breaking into a construction site at Westpoort, Amsterdam, where some members climbed a crane, lit flares and tied helium balloons to equipment. Continue reading...
An experiment in which AI models were asked to break into simulated networks showed the hacking skills of DeepSeek and GLM to be not far behind OpenAI’s most advanced cyber model, which isn’t public.
The highest priorities for the transition to post-quantum cryptography are the basic building blocks of authenticated key-agreement protocols such as TLS. Without these building blocks in place, secure communication on the Internet will not be possible once cryptographically relevant quantum computers come online. However, today we rely on quantum-vulnerable cryptography for much more than TLS. Privacy Pass is a protocol used by site operators like Cloudflare to help protect applications from abuse. One way we do this is by rate limiting individual clients so that no one client consumes too many of the site's resources. Normally this involves some combination of friction or loss of privacy for users: CAPTCHAs or other challenges to moderate traffic, along with accounts and fingerprinting to identify traffic.Privacy Pass was designed to avoid this tradeoff between friction and privacy. The basic idea is that a client gets issued a number of tokens , which they can redeem in exchange for access to the site. Crucially, each token is unlinkable to the client it was issued to, ensuring the client can use the site as they always had without sacrificing privacy. With 10 years of deployment experience under our belts — using Privacy Pass for applications such as privacy proxies (like iCloud Private Relay) and relays (like Privacy Gateway) — we, along with others , are collaborating to bring the next generation of this technology to the web. One of our goals is to develop more sophisticated tools for managing agentic traffic that would otherwise consume too many resources and degrade performance for human visitors. Another goal is to foster a more open ecosystem by making it easier
Binance’s October 2026 security incident raises an operational question for every organization holding user funds: Can your security controls recognize when a valid signature grants an attacker wallet authority? If an organization only monitors transfers and ownership changes, it may miss the shift in wallet authority until assets move. Binance’s initial update about the incident suggested that a compromised DevOps laptop allowed an attacker to access a service container and submit unauthorized withdrawals. Its second update reported additional breaches but no evidence that wallet private keys had leaked. In its November 3 report , Binance described a broader attack involving social engineering, misuse of an internal AI tool, stolen credentials, and unauthorized access to its wallet-signing service. The attacker nevertheless obtained valid signatures, illustrating a major risk: a compromised server with permission to request signatures can misuse a protected key without extracting it. The attacker used an EIP-7702 delegation that allows a wallet to sign a standing instruction: “Use this code when my account is called.” Ethereum keeps that instruction in place until it is changed or cleared using the wallet’s key. That enabled repeated transfers , including funds d
Many common web frameworks like Spring and Ruby on Rails trust the RFC 7239 Forwarded header by default, even though most proxies don't actually have any support for it. This makes apps vulnerable to request hostname or client IP address spoofing in the default configurations. I've been researching how the Forwarded header is supported across frameworks and proxies. [Rails](https://github.com/rails/rails/security/advisories/GHSA-2gff-2mmg-m73p) and [Spring](https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-4.2.0-M1-Release-Notes#forward-http-headers-behavior-change) recently shipped fixes following my research. There are still other frameworks that need application configuration changes to be secure.
Trying to decide if you should use a managed detection and response (MDR) service, or build your own security operations centre (SOC)? Our MDR vs SOC comparison will help you decide which is best for you. It’s an age-old question. Should your business outsource a function to external experts, or should you build your own […] The post MDR vs SOC: How to choose the right option for your organisation appeared first on Heimdal Security Blog .
Thursday, November 5
Every VPN says it’s the best, but only some of them are telling the truth.
Barracuda Networks is your new best friend (Barracuda Email Security Gateway Pre-Auth Remote Root RCE CVE-2026-116606 / CVE-2026-111560)
Yes, that's right! Today we're at the aquarium. Welcome back to yet another watchTowr Labs blog post. You can begin preparing your comments now. What Is A Barracuda, And Why? Must We? Barracuda’s Email Security Gateway solution (ESG) is no stranger to love , for a couple of reasons: For many, it is the appliance that sits in front of an organization's mail and decides which messages are spam, which carry malware, and which are allowed through. For others, it’s the appliance that required physical replacement after UNC4841 (per Mandiant) exploited CVE-2023-2868 as a zero-day. Whoever you are, one thing will be consistent in your experience: it is yet another appliance that lives at the edge, inspects everything, and ru
AI Agents now act on the web for millions of people. To a Site, an Agent can take many forms. It may be indistinguishable from a human user carrying out a task, or it might look like one visitor carrying many Users. This removes the ability for the Site to recognize, serve, and hold accountable the user or users behind the Agent, and causes the Site to face the costs when something goes wrong. This post argues that in order for Sites to maximize the access they provide to Agents, the ecosystem must develop new mechanisms to preserve the relationship between Sites and Users. Traditionally, in Security and Fraud Prevention, that requires three things: Identity, Reputation, and Accountability, allowing Sites to answer: Is the person acting being truthful about who they are? Is that person trustworthy? And who answers for the action? “Personal AI Agents” (“Agents” for short) are automations that take instructions from a human (“User”) and pursue a goal by controlling a cloud computer or browser. They are usually hosted and maintained by an “Operator” as part of a managed service or consumer offering. Examples include Muse from Meta and dots from OpenAI, and more are launching all the time. Agents can potentially take any action online that their User could, without the limits that hold humans back. They don't tire, they run around the clock, they act in parallel, and they put up with friction no person would. Much of the web, from how Sites plan capacity to how they make money, assumes those limits. Fundamentally, remotely hosted Agents are intermediaries . An intermediary is anything that sits between a User and a Site, so the Site sees it instead of the User. Agents are the newest kind of intermediary, but intermediaries have existed for a long time. Cloud browsers (hosted browsers that software controls on a User's behalf) and Proxies (services that relay a User's traffic, including VPNs) are intermediaries too. What has
Cloud penetration testing focuses on identity, configuration, and service-layer attack paths within the customer's side of the shared responsibility model, rather than the network perimeter a traditional test targets. Each major cloud provider sets its own rules for what testing is permitted without prior approval. Scope should be defined by accounts, identities, and services rather than IP ranges, since that is how risk concentrates in a cloud environment. In US government cloud environments, the provider's rules are only the first gate. Testing must also fit the system's authorization boundary and the agency's own rules of engagement. The post Cloud Penetration Testing Services for Enterprise AWS, Azure, and GCP Environments appeared first on Synack .
Several staffers at the White House are using computers or mobile devices equipped with residential proxy services that render their internet address available for others to rent, security experts warned today. One of the proxy services is a Russian company whose founder’s web hosting business was ground zero for cyberattacks against election systems in Arizona and Illinois in 2016. The security firm Layer3 Intel said it detected multiple residential proxy nodes beaconing out from the internet address network reserved for the Executive Office of the President ( AS2650 ). Layer3 said the proxy activity was relatively persistent between October 5 to November 3, and that a review of the proxies available from AS2650 showed they exited from the White House network 236 times during that period. The proxy tracking company Synthient said on Twitter/X that the activity it saw coming from AS2650 was related to multiple Windows 11 installations of a service called Infatica , a proxy program that is often integrated into “free” mobile and desktop applications . Infatica’s founder Vladimir Fomenko is a Russian man whose hosting firm King Servers was home to six of the eight internet addresses used by Russia’s state security services to compromise databases for election systems in Arizona and Illinois in 2016.
Wednesday, November 4
We just published our research on escaping Firecracker microVMs, coordinated with AWS. The interesting part is how a guest can end up accessing memory belonging to the Firecracker process running outside the VM. **The vulnerability:** When a microVM is restored from a snapshot using the File memory backend, a failed memory remapping operation can leave KVM referencing a stale host virtual address range. Firecracker may subsequently reuse that memory for its own data, while KVM still considers it guest memory. This allows a malicious guest to read or overwrite Firecracker VMM process memory, crossing the VM isolation boundary. Our research demonstrates an exploit chain from guest userspace to controlled code execution in the host. **Affected configurations:** Firecracker 0.23.0 - 1.16.1, when restoring snapshots with the File memory backend and a balloon or virtio-mem device. **Fixed:** Firecracker 1.16.2 and 1.17.0+. AWS advisory: [https://aws.amazon.com/security/security-bulletins/2026-169-aws/](https://aws.amazon.com/security/security-bulletins/2026-169-aws/) The write-up covers the vulnerability, the memory-management behavior behind it, and the exploitation process. We are from Coinspect, the team behind the research. Happy to answer technical questions here.
“Most of the risk is actually created by a couple of players building behind closed doors,” Clément Delangue said of the need for open source AI.
Personal agents are the intermediary between humans and the Internet, turning a person’s instructions into requests and actions on websites. A customer might ask a personal agent to compare products across your site, find support articles, or complete a purchase. To a site owner, all three interactions show up as automated traffic — and without a clear view of which agents are visiting and what they are doing, it can be difficult to know whether that traffic is helping your business or creating risk. Blocking agents altogether can feel like the safest choice, but it can mean losing customers. Better visibility into agent activity allows you to decide what access makes sense for your site. Today, we’re launching new analytics to help you understand how personal agents access your site on behalf of humans, along with more granular access policies to put those decisions into practice. Together, they let you welcome agents on your own terms, and in ways that support your business. See how agents access your site Knowing which agent is behind a request turns unexplained automated traffic into traffic you can act on with confidence. Cloudflare maintains the largest verified bot directory in the world, and we are now bringing that intelligence into your traffic details. In Security Analytics, the Bot Analysis chart now shows Personal Assistants as a new category, next to Verified Bot, Likely Human, Likely Automated, and Automated. Security teams can select it to see only personal agent traffic over time. In Top statistics, a new Personal Assistants widget lists which agents are visiting your site and how many requests each one sends. Filter on one agent and every other widget updates to show only its traffic details: the paths it requests, the status codes it receives, and the networks it comes from. At a gla
Tuesday, November 3
Suspected North Korean attackers duped an engineer with a fake job interview and a malicious download to gain a foothold in the crypto firm’s system and steal billions, according to Binance.
Google's Threat Intelligence Group says it has shut down a massive botnet called x.cpe. At its height, x.cpe ran on more than 1.3 million Android TV devices, and unusually, these were Google-certified boxes. Google says its screening process missed the malware due to "obfuscation techniques" employed by Shenzhen-based Videostrong Technology. In a detailed blog post , the Threat Intelligence Group explains how the x.cpe botnet evolved quickly from a single-stage dropper into a modular three-stage malware platform that sold access to third parties. Manufacturers must have their devices certified if they want access to Google apps and branding, a process that is supposed to catch threats like this. However, Videostrong's compromised boxes, mostly sold under the MECOOL brand, evaded detection by using a backdoor to remotely install the malware after the devices were set up and online. After devices appeared online, a stub application called x.cpe or com.oemservice would phone home. This package did not have any malicious capabilities of its own, but it had the system-level permissions necessary to install malware modules at the operator's behest. It also disabled Play Protect, which would have otherwise flagged the silently installed packages as malicious. Read full article Comments ]]>