A radiology college started 'sending' me traffic. In reality, it wasn't. Unpicking a headless crawler with a fake referrer, rotating proxies and a ByteDance-shaped fingerprint, and blocking it with a single Cloudflare rule.

A radiology college started 'sending' me traffic. In reality, it wasn't. Unpicking a headless crawler with a fake referrer, rotating proxies and a ByteDance-shaped fingerprint, and blocking it with a single Cloudflare rule.

Believe it or not, even wireless earbuds can present security issues. Read on to find out how.  ( 14 min )

TL;DR: App registrations are an app’s blueprint and hold its credentials in one home tenant. Service principals (what you see under Enterprise applications) are the identities that hold permissions in every tenant that uses the app, which is why one stolen credential in the ConnectWise Cloud Backup incident reached 100+ tenants. What are we talking […] The post Principal Problems: App Registrations, Service Principals, and the Hidden Risk of Multi-Tenant Apps appeared first on SpecterOps.  ( 34 min )

Binance’s October 2026 security incident raises an operational question for every organization holding user funds: Can your security controls recognize when a valid signature grants an attacker wallet authority? If an organization only monitors transfers and ownership changes, it may miss the shift in wallet authority until assets move. Binance’s initial update about the incident suggested that a compromised DevOps laptop allowed an attacker to access a service container and submit unauthorized withdrawals. Its second update reported additional breaches but no evidence that wallet private keys had leaked. In its November 3 report, Binance described a broader attack involving social engineering, misuse of an internal AI tool, stolen credentials, and unauthorized access to its wallet-signing…  ( 4 min )

Yes, that's right! Today we're at the aquarium. Welcome back to yet another watchTowr Labs blog post. You can begin preparing your comments now. What Is A Barracuda, And Why? Must We? Barracuda’s Email Security Gateway solution (ESG) is no stranger to love, for  ( 10 min )

Two AI security tools can use the same model and produce very different results. The difference is the harness. This post explains what an agent harness is, how its execution loop works, and why design choices around context, verification, and scope matter for AI-powered penetration testing.  ( 10 min )

Cloud penetration testing focuses on identity, configuration, and service-layer attack paths within the customer's side of the shared responsibility model, rather than the network perimeter a traditional test targets. Each major cloud provider sets its own rules for what testing is permitted without prior approval. Scope should be defined by accounts, identities, and services rather than IP ranges, since that is how risk concentrates in a cloud environment. In US government cloud environments, the provider's rules are only the first gate. Testing must also fit the system's authorization boundary and the agency's own rules of engagement. The post Cloud Penetration Testing Services for Enterprise AWS, Azure, and GCP Environments appeared first on Synack.  ( 22 min )

Generative AI removed the old phishing tells, and social engineering now reaches K-12 staff by text, QR code and trusted accounts. This post gives IT admins three checks to close the gaps.  ( 7 min )

TL;DR –  Enumerating the right connection strings lets you impersonate an iSCSI initiator and access whatever is stored on a shared virtual hard disk. Acknowledgments As always, I want to acknowledge the prior work done by peers:  Himanshu Dwivedi – Who gave a talk at BlackHat back in 2005 (!!) on iSCSI Andrew Tierney – […] The post Mi Scusi, My SCSI: Abusing iSCSI Target Server appeared first on SpecterOps.  ( 19 min )

Discover how threat actors leverage Microsoft Graph API Change Notifications and Rich Notifications for stealthy post-exploitation data exfiltration of Outlook emails and Teams messages. The post You’ve Got (Graph) Mail – Leveraging Microsoft Graph API Change Notifications for Data Exfiltration appeared first on NetSPI.  ( 24 min )

TL;DR  Why WPA2-PSK is a corporate liability  Walk into a small to medium-sized office and there’s a good chance everyone is using the same Wi-Fi password. Staff know it, contractors might know it and sometimes it’s even written on a sign in reception. Convenient, certainly. But there’s a problem with giving everyone the same password. […] The post The problem with shared Wi-Fi passwords at work  appeared first on Pen Test Partners.  ( 12 min )

You can now escalate HTTP header injection to a CRLF-Powered Desync and exploit it to serve random users a redirect to your collaborator, in a single prompt. We’ve just introduced a new scan check for  ( 6 min )

LLM reverse engineering scales only if analysis stays inspectable. A new standard and its open-source IDA Pro implementation tie annotations to evidence.

LLM reverse engineering scales only if analysis stays inspectable. A new standard and its open-source IDA Pro implementation tie annotations to evidence.

I tested vector search on 7,454 turns of my own agent sessions. One in seven sessions needed review, the agent’s reasoning carried more signal than the prompt, and the stored vectors answer questions nobody thought to ask at ingest.  ( 114 min )

The newest threats, etc report details how adversaries are weaponizing trust across the entire enterprise stack, abusing everything from AI assistants and npm supply chains to identity flows and legitimate management tools.

Moving to Detection-as-Code starts with making existing detection data reliable and machine-readable. In Part 2, we explain how we validated documents, built deployment tooling, scripted the migration, and used dry runs to verify that generated artefacts matched the existing setup.  ( 15 min )

﷽  ( 20 min )

I have been tracking the rollout of Device Bound Session Credentials (DBSC) for a while now. It is the latest industry attempt to solve the perennial problem of session hijacking. If you are regularly testing authentication flows, you have likely come across documentation or headers related to this.

Continuous automated penetration and attack testing uses tooling to run real attack techniques against an environment on an ongoing schedule, rather than during one scheduled engagement. It trades the depth of a fully human-led test for broad, repeatable coverage that runs continuously. The category has a real ceiling: findings that depend on business logic or multi-step reasoning still need a human tester to catch. Treat it as one layer of a testing program, not a replacement for the whole thing. The post What Is Continuous Automated Penetration and Attack Testing? appeared first on Synack.  ( 18 min )

Store fridges and freezers warmed overnight in six countries on November 2-3. Russian-aligned groups are credible suspects, but attribution remains open.

Store fridges and freezers warmed overnight in six countries on November 2-3. Russian-aligned groups are credible suspects, but attribution remains open.

AI can produce a plausible vulnerability report in seconds, but proving it is real still takes expert judgment. This post explores the economics of false positives, why they burden your most senior people, and why accountability stays human.  ( 9 min )

Learn how Fireblocks, Rogo, and project44 used Green Agent to eliminate cross-team blockers and accelerate critical risk resolution.  ( 87 min )

As millions of Americans vote in today’s U.S. midterms, most will use paper ballots, which are protected by strict chain-of-custody protocols and, in some cases, statistical audits. You may wonder why we still use paper for our elections and voting systems when tasks like banking, tax filing, and document signing have moved away from paper-based legacy systems and become fully electronic. The short answer: security. That may come as a surprise to some. After all, cryptography and other security advancements have enabled secure electronic systems for many applications. In fact, cryptography can be used to provide two essential safeguards in elections: keeping (1) individual votes secret while (2) making the final tally independently verifiable. This is exactly the approach of cryptographic …  ( 10 min )

From the Banana equivalent dose article in Wikipedia: The major natural source of radioactivity in plant tissue is potassium: 0.0117% of the naturally occurring potassium is the unstable isotope potassium-40. This isotope decays with a half-life of about 1.25 billion years (4×1016 seconds), and therefore the radioactivity of natural potassium is about 31 becquerel/gram (Bq/g), […]  ( 11 min )

While researching the inner workings of Geiger-Müller counters, I stumbled upon Rad Pro. It’s an open-source project developing firmware for cheap GM meters. You get yourself a GM meter and replace its firmware with Rad Pro. For some meters (like FNIRSI), it’s as simple as mounting the meter as a USB storage device and copying […]  ( 10 min )

Red Agent gives SOC teams validated pre-breach alerts, while Blue Agent investigates active threats at machine speed, helping teams stay ahead in the AI threat era.  ( 87 min )

Stable Linux releases lack existing security fixes because backporting them is time-consuming and often thankless work. We’re using Codex to reduce the backporting process time from days to hours per fix, empowering human patch reviewers to rapidly submit fixes for critical software like Ubuntu Long Term Support, Fedora, and the Linux kernel. By October 29, our project helped deliver fixes for 149 distinct CVEs into stable Linux kernel releases, and several fixes to Fedora and Ubuntu packages. Deploying fixes to older software requires multiple steps, including adapting fixes to older code, checking dependencies, and ensuring the fix did not introduce new bugs. A single task (like tracking down a bug in a bad commit) can take a week or more of effort that no one sees or appreciates. Our Co…  ( 5 min )

Several months ago, I discovered and fixed an interesting Linux kernel vulnerability CVE-2026-31695, which was caused by a logical bug in network device management. This vulnerability had been present in the kernel code for nearly 5 years. In this article, I will describe the exploit for this vulnerability providing local privilege escalation (LPE) on Fedora 44 Server for the x86_64 architecture. I will demonstrate how to bypass the security hardening mechanisms and gain full control over the operating system by spoofing a struct device. Moreover, I will explain how to make the attack absolutely stable, despite the elusive race condition during the exploitation of CVE-2026-31695. Let's go 🚀

﷽  ( 15 min )

PHP, Brotli and the Linux kernel, I think we are going to have a lot of patching to do over the next few years. People are calling it the "vulnpocalypse", and if we keep getting weeks like this, many organisations are going to struggle to keep up. Frequency Reduces Difficulty: "If it hurts, do it more often". vulnerabilities are cattle, not pets, I would rather spend time making updates easier than repeatedly debating which bugs deserve fixing. Agents can prepare upgrades, review changes and investigate failures in isolated environments without production credentials. Use cooldowns for routine updates, with a faster route for urgent fixes. Verify that the fixed build and bundled dependencies are actually running, including any necessary restarts. …  ( 4 min )

Exploiting RootPipe on OS X 10.10.3  ( 43 min )

A deeper dive into 'MacInstaller' and the adware it installs  ( 43 min )

NSLog(@"Hello World"); objective-see.org is alive!  ( 43 min )

Announcing the release of DHS; a tool to help detect (dylib) hijackers  ( 43 min )

Why BlockBlock needs a kext (hint: process monitoring), and how the kext was created  ( 43 min )

How reversing Apple's 'RootPipe' patch provided the means to secure TaskExplorer's XPC service  ( 43 min )

How to remotely kernel-debug a OS X 10.11 VM  ( 43 min )

How to build HackingTeam's OS X implant in Xcode  ( 43 min )

Details on bypassing Apple's original rootpipe patch  ( 43 min )

By monitoring file I/O events and detecting the rapid creation of encrypted files by untrusted processes, can ransomware be generically detected?  ( 26 min )

Getting process creation notifcations from kernel-mode to user-mode, via the undocumented kev_msg_post function  ( 8 min )

Dissecting string obfuscations, junk code insertions, and anti-debugging logic of InstallCore  ( 5 min )

Process monitoring via the KAuth Subsystem (and some limitations)  ( 5 min )

Apple's App Translocation broke several of my tools, but we can locally undo it to restore broken functionality!  ( 11 min )

Read how an attacker can bypass Apple's SIP, via the local OS upgrade process  ( 11 min )

Learn how a Finder Sync can 'extend' Finder.app and how this could be abused for persistence  ( 5 min )

How to verify that an application came from the official Mac App Store, via receipt validation  ( 7 min )

The 'Mac File Opener' adware is fairly normal, except for it how it persists via registered document handlers  ( 9 min )

Does Shazam's Mac App keep recording even when you turn the app off? ...yes :/  ( 8 min )

A Word document targets Mac users with malicious macros and an open-source payload.  ( 4 min )

HackingTeam using native OS X crypto to protect malware -neat! New blog w/ sample + decryptions/dumpings/detections  ( 5 min )

In Objective-See's first guest blog post, Amit Serper presents his detailed analysis of OSX/Pirrit  ( 10 min )

The macOS kernel had an (intentional?) off-by-one bug that could trigger a kernel panic.  ( 13 min )

Let's analyse the malware that appeared in 2016, discussing the infection vector, persistence mechanism, feature, and disinfection for each.  ( 12 min )

Today is our 2nd birthday! Let's look at our past, present, and future.  ( 2 min )

Reverse-engineering a 'Russian' implant reveals HackingTeam's code!?  ( 10 min )

Apple's 'fix' for a macOS kernel panic, fixes nothing and worse, introduces a new bug.  ( 13 min )

Analyzing code within the macOS kernel audit subsystem uncovered an exploitable heap overflow.  ( 5 min )

Analysis of OSX/Proton.B reveals some interesting tricks plus a command file that can be decrypted to reveal the malware's capabilities  ( 10 min )

Let's look at all the mac malware from 2017, for each - discussing their infection vector, persistence mechanism, features & goals.  ( 40 min )

The website of a popular application was hacked, and the application trojaned with a new variant of osx/proton.  ( 3 min )

Some undetected adware named "Mughthesec" is infecting Macs...let's check it out!  ( 5 min )

Looks like somebody on the 'dark web' is offering 'Ransomware as a Service'...that's designed to infect Macs!  ( 6 min )

Yet another a massive security flaw affects the latest version of macOS (High Sierra), allowing anybody to log into the root account with a blank, or password, of their choosing!  ( 7 min )

A new 'security' feature in macOS 10.13, is trivial to bypass.  ( 5 min )

High Sierra suffered from a nasty bug (CVE-2017-7149) that afforded local attackers access to the contents of encrypted APFS volumes.  ( 12 min )

Here, we reverse, then 'extend' a popular macOS anti-virus engine. With the creation of a new anti-virus signature, classified documents will be automatically detected!  ( 14 min )

Turns out the innocuously named "Calendar 2" app, found on the official Mac App Store, was surreptitiously turning Mac into cryptocurrency miners!  ( 4 min )

Recently, the popular MacUpdate website was subverted to distribute a new macOS cryptominer; OSX/CreativeUpdater.  ( 5 min )

Did you know on macOS, notifications are stored in a unencrypted database? Which means that even 'disappearing' messages from apps such as Signal - may not really disappear. Yikes!  ( 4 min )

On my flight to ShmooCon, I managed to panic my fully-patched MacBook. Here we analyze the kernel panic report, finding that Apple's AMDRadeonX4150 kext is responsible for the crash.  ( 7 min )

Imagine you've gained remote code execution on a Mac via a malicious Word document. Turns out, you're still stuck in a sandbox. However, via a faulty regex, you can escape and persist!  ( 5 min )

Are full paths and preview thumbnails for files even on encrypted containers and removable usb devices really persistently stored? ...yes :( Apple's 'QuickLook' cache is to blame.  ( 7 min )

If you can programmatically generate synthetic mouse clicks, you can break macOS! Approving kernel extensions, dismissing privacy alerts, and much more more...  ( 8 min )

I uncovered a new cross-platform backdoor that provides remote attackers persistent access to infected systems  ( 12 min )

In this guest blog post my friend Mikhail Sosonkin reverses Apple's screencapture utility, discusses Mac malware that captures desktop images, and suggests methods for screen-capture detection!  ( 11 min )

OSX/MaMi (the first Mac malware of 2018) hijacks infected users' DNS settings and installs a malicious certificate into the System keychain, in order to give remote attackers 'access' to all network traffic  ( 9 min )

In macOS Mojave apps, to have to obtain user permission before using the Mac camera & microphone. We'll illustrate how this is trivial to bypass (at least in the current beta).  ( 4 min )

Turns out that writing security tools is a great way to inadvertently uncover bugs in macOS. How about a crash in Apple's 'Security' framework ... that can't be good!?  ( 7 min )

The EFF/Lookout discovered a cross-platform implant, named CrossRat with ties to nationstate operators. Here, we tear it apart; analyzing its persistence mechanisms, features, and network communications.  ( 13 min )

A new Mac malware targets the cryptocurrency community. In this post, we dive into the malware and illustrate how Objective-See's tools can generically thwart this new threat at every step of the way.

Apple wrote code to appease the Chinese government ...it was buggy. In certain configurations, iOS devices were vulnerable a "emoji-related" flaw that could be triggered remotely!

In this guest blog post @CodeColorist writes about a neat macOS vulnerability. Ironically, by abusing security mechanisms such as sandboxing, macOS can be coerced to load an untrusted library, into a SIP-entitled process!

Apple recently updated the way login items are stored by the OS. In this post, we'll illustrate how to parse the (new) login item files to detect persistence

Let's tear apart a persistent piece of adware, decompiling, decoding, and decompressing it's code to uncover its methods and capabilities.  ( 8 min )

The WINDSHIFT APT group is successfully infecting Macs with a novel infection mechanism. By abusing custom URL scheme handlers and minimal user interaction, Macs can be remotely compromised!  ( 8 min )

Our annual report on all the Mac malware of the year - including samples for download, infection vectors, persistence mechanisms, payloads and more!  ( 26 min )

Learn how to leverage Apple's new Endpoint Security Framework to create a comprehensive (user-mode) Process Monitor for macOS 10.15!  ( 14 min )

A malicious Word document targeting macOS users, was recently uncovered. Let's extract the embedded macros, decode an embedded downloader, and retrieve the 2nd-stage payload!  ( 5 min )

@CodeColorist continues writing about bugs, such as CVE-2019-8521 and CVE-2019-8565 that provide a mechanism to elevate privileges to root on macOS.  ( 4 min )

Recently, an attacker targeted (Mac) users via a Firefox 0day. In this second post, we fully reverse OSX.NetWire.A, revealing (for the first time!), its inner workings and complex capabilities.  ( 12 min )

A massively popular app from the official Mac App Store, surreptitiously steals your browsing history! By fully reversing the application, we can fully expose its functionality and rather shady capabilities.  ( 13 min )

The macOS sandbox is seeks to prevent malicious applications from surreptitiously spy on unsuspecting users. Turns out, it's trivial to sidestep some of these protections, resulting in significant privacy implications!  ( 7 min )

The APT group WindShift has been targeting Middle Eastern governments with Mac implants. Let's analyze their 1st-stage macOS implant: OSX.WindTail!  ( 7 min )

The APT group WindShift has been targeting Middle Eastern governments with Mac implants. Let's (continue to) analyze their 1st-stage macOS implant: OSX.WindTail!  ( 8 min )

In part one of a guest blog post, @CodeColorist writes about several neat macOS vulnerabilities.  ( 4 min )

A core Mojave utility is rather disastrously broken - causing a full-system lockup. Let's find out why!  ( 6 min )

Recently, an attacker targeted (Mac) users via a Firefox 0day. In this first post, we triage and identify the malware (OSX.NetWire.A) utilized in this attack, identifying its methods of persistence, and more!  ( 6 min )

After the success of #OBTS v1.0, we decided to go international and plan #OBTS v2.0 in Europe! In this blog post, we re-live the highlights (from Monaco!) of "Objective by the Sea" v2.0.  ( 3 min )

Recently, an attacker targeted (Mac) users via a Firefox 0day. In this third post, we analyze a second backdoor used in the attack, detailing its persistence, capabilities, and ultimate identify it a new variant of the cross-platform Mokes malware!  ( 6 min )

In this guest blog post, "Objective by the Sea" speaker, Csaba Fitzl writes about an interesting way to get root via Apps from the official Mac App Store!  ( 17 min )

Learn how to leverage Apple's new Endpoint Security Framework to create a comprehensive (user-mode) File Monitor for macOS 10.15!  ( 10 min )

Our annual report on all the Mac malware of the year - including samples for download, infection vectors, persistence mechanisms, payloads and more!  ( 41 min )

The rather infamous APT group, "Lazarus", continues to evolve their macOS capabilities. Today, we tear apart their latest 1st-stage implant that supports remote download & in-memory execution of secondary payloads!  ( 9 min )

A new macOS backdoor written by the infamous Lazarus APT group needs analyzing. Here, we examine it's infection vector, method of persistence, capabilities, and more!  ( 10 min )

A massively popular iOS application turns out to be a government spy tool! Here, we analyze the app; decrypting its binary and studying its network traffic.  ( 12 min )

A 0day logic flaw in Microsoft Excel leads to 'remote' code execution on macOS, via malicious macros.  ( 6 min )

The Lazarus group's latest implant/loader supports in-memory loading of 2nd-stage payloads. In this post we describe exactly how to repurposing this 1st-stage loader to execute *our* custom 'fileless' payloads!  ( 14 min )

Today we uncover two (local) security flaws in Zoom's latest macOS client. First, a privilege escalation vulnerability, and second, a method to surreptitiously access a user's webcam and microphone (via Zoom).  ( 12 min )

CVE-2017-7170 was a local priv-esc vulnerability that affected OSX/macOS for over a decade! Here (for the first time!), we dive into the technical details of finding the bug, the core flaw, and exploitation.  ( 10 min )

A sophisticated Lazarus Group implant has arrived on macOS. In this post, we deconstruct the Mac variant of a OSX.Dacls, detailing its install logic, persistence, and capabilities.  ( 11 min )

Here is an overview of content I published in October: Blog posts: Update: onedump.py Version 0.0.3 Quickpost: Uranium Glass A Ring Tone That I Cannot Hear – Twenty Years Later Quickpost: Ghost USB-C Quickpost: WT20 Welding Electrodes & Radiation SANS ISC Diary entries: YARA-X 1.21.0 Release User Agent Strings Curiosities Orphaned VBA Projects Inside DWG […]  ( 9 min )

I found another material that I can buy freely and test with my Radiacode 103 radiation detector: WT20 Welding Electrodes. These are tungsten welding electrodes with 2% thorium. Thorium is a little bit radioactive and shows up in the spectrum that I measured over a period of 3 hours with a Radiacode 103 device: Quickpost […]  ( 10 min )

You’ve probably encountered devices that are powered via a USB-C connector, but that don’t work when you connect them to a USB-C charger or powerbank. They only work with a USB-A to USB-C cable, not with a USB-C to USB-C cable. I used to encounter such devices regularly a couple of years ago, but far […]  ( 11 min )

A series of agentic attacks on AI Developer Platforms has been leading to LLMJacking at scale.  ( 90 min )

Key benchmark findings on shadow AI, orchestration risks, and the imperative for an AI-against-AI defensive model.  ( 85 min )

Jamf’s ALME engine uses Apple’s declarative device management to keep third-party Mac apps current, without repackaging or manual deployment.  ( 5 min )

Learn about the DPRK-associated attack that cost Binance $6.4 billion in cryptocurrency.  ( 7 min )

How do you introduce Detection-as-Code into an environment where detections are already being developed and deployed? This customer case study examines the technical challenges and migration steps involved in improving detection engineering while keeping existing operations running.  ( 13 min )

My first post for this blog was in June 2006, 20 years ago: A Ring Tone That I Cannot Hear. Back then, I tested my hearing with Audacity, and I could hear a tone up to 14 kHz. 20 years later, I do the test again, and I can hear a tone up to 8 […]  ( 9 min )

A complete API penetration test should cover discovery, authentication, authorization across every role and tenant, data exposure, injection, abuse and rate limiting, business logic, and configuration, backed by reproducible evidence and a defined retest. The checklist below is written as buyer requirements: statements a security team can check a vendor's proposal or final report against, not instructions for performing the test yourself. The post API Penetration Testing Checklist: What Enterprise Security Teams Should Require appeared first on Synack.  ( 19 min )

AI agents are changing how attackers operate. Explore real-world cases of agentic attacks, learn how to identify their fingerprints, and discover what they mean for the future of cybersecurity.  ( 104 min )

The Rijndael key builder in Part 1 worked for the first set of samples, but its split-buffer model was wrong. QSYS/QZLSRTPW builds one 32-byte value, 00×5 ‖ des_plaintext_16 ‖ format_byte ‖ username_cp037_10, and insertion-sorts all 32 bytes in ascending order. I tested the corrected decoder against almost 900 QSYRUPWD API output buffers, which IBM i calls receiver variables. The decoder decrypted the 192-byte QZLS ciphertext field in every receiver that contained it and reproduced its embedded username.  ( 9 min )

What started as a question about Claude’s sandbox turned into a connected investigation of container internals, process memory, and authorization tokens. Bishop Fox researcher Chris Davis documents what Claude revealed, what it handed over, and what that means for defense in depth.  ( 14 min )

I got the opportunity to measure the radiation emitted by uranium glass. Uranium glass is glass with uranium added to the glass mix for coloration. My Bosean FS-5000 meter did not detect any radiation from the uranium glass. The counts per second (CPS) value was around the same on the uranium glass and away from […]  ( 12 min )

Join us at booth G14 on 5–6 November at the Hyatt Regency San Francisco. We’re a Gold sponsor, with live Burp AT demos, conversations about your AppSec programme, and something new to share. OWASP is  ( 4 min )

Harvard Professor James Mickens weighs the promises of AI against its potential harms, arguing for hardware-based mechanisms to isolate frontier models.  ( 10 min )

Harvard Professor James Mickens weighs the promises of AI against its potential harms, arguing for hardware-based mechanisms to isolate frontier models.  ( 10 min )

TL;DR  Introduction  We spend a lot of time in industrial environments. Power stations, water treatment works, gas distribution networks, ships. One type of environment that gets far less attention from a security perspective is the automated warehouse.  These are not simple buildings with shelves and forklifts. A modern automated fulfilment centre is a dense, tightly […] The post Automated warehouses: 8 third parties, one network and no owner  appeared first on Pen Test Partners.  ( 13 min )

﷽  ( 20 min )

Cutting Through the php2shell Noise On October 20, details of php2shell, two pre-auth RCE vulnerabilities in the PHP core discovered by Calif (CVE-2026-109618 and CVE-2026-109619), leaked ahead of coordinated disclosure. Advisories listing affected versions followed quickly, along with a flood of PoCs, many AI-generated and non-functional. We waited until we had our own data. This […] The post php2shell in Practice: Exploitable, Conditional, and Hard to Mass-Exploit appeared first on Praetorian.  ( 25 min )

On September 25, 2026, Mandiant released a report regarding continued mass exploitation of CVE-2026-35273 by the ShinyHunters group. TrendAI’s Zero Day Initiative first reported this CVE to Oracle on June 10, 2026, following an investigation I conducted with Minh Giang and Lucas Miller of TrendAI Research. Although Oracle issued a patch under a single CVE, we reported three distinct vulnerabilities across multiple PeopleSoft components. We are coordinating with Oracle to assign separate CVEs for each issue. In this blog post, we will walk through each of these vulnerabilities, starting with a Server-Side Request Forgery (SSRF) vulnerability. We will also review the validateClient method that Oracle introduced to allow PeopleSoft system administrators to restrict access to certain functiona…

I tested eight popular SVG sanitizers and bypassed six of them. In this post, I'll show you how a response header can run JavaScript in Firefox even when the response body is completely harmless XML.  ( 6 min )

Wiz research has been monitoring PHP2Shell exploitation attempts, but none have succeeded so far. We examine the techniques used, what prevented the attacks from completing and how observed exposure has changed since disclosure.  ( 85 min )

On October 21, 2026, the PHP project disclosed two critical memory-corruption vulnerabilities that can allow unauthenticated remote code execution. Both are fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Every PHP install serving web requests is in scope,  ( 10 min )

Enterprise web application penetration testing typically runs on a multi-week cycle covering scoping, testing, reporting, and retest. Cost is driven mainly by application complexity and user role count, not page count or site size. The most common scoping mistake enterprises make is under-counting authenticated user roles, which quietly expands the actual testing effort well beyond what the initial scope assumed. The post Web Application Penetration Testing Services for Enterprises: Scope, Timeline, and Cost appeared first on Synack.  ( 19 min )

Summary Project Zero compared two automated tools used by Google to find vulnerabilities in Chrome’s JavaScript engine, V8, on a regular basis. Fuzzilli is a generative JavaScript engine fuzzer and BigSleep is an LLM-based bug finding system. In the past six months, BigSleep found more vulnerabilities than Fuzzilli (45 versus 37) with a 25% overlap in the specific bugs reported. Since this comparison methodology has a tendency to underestimate overlap, we also performed dedicated experiments to test theoretical overlap in vulnerabilities reported since 2023. These experiments estimated overlap at roughly 60%. Regardless of which value is accurate, a substantial portion of vulnerabilities were discoverable by only LLMs or only fuzzing. While it is extremely promising that LLMs have become able to find so many vulnerabilities so quickly, fuzzing and LLMs are still complementary approaches. We recommend vendors perform both fuzzing and agentic analysis of their code to maximize the number of vulnerabilities that get reported before they impact users.  ( 22 min )

ElectroNG is now free and open source! Today we are releasing both the desktop application and its core analysis engine under the Apache License 2.0, opening up years of Doyensec’s work on Electron application security to the community. Why we are open-sourcing ElectroNG We launched ElectroNG in September 2022 as a commercial static application security testing (SAST) tool for Electron applications. It grew out of our experience auditing Electron apps and developing Electronegativity, with the goal of turning that research into a more capable scanner and an easier workflow for developers and security researchers. We are proud of what we built. However, despite our best efforts, we could not build a customer base large enough to sustain its development, and we stopped selling licenses …  ( 7 min )

NetSPI Salesforce expert Aussan explores how holding identity steady across UI API, GraphQL, and custom @AuraEnabled Apex methods reveals hidden authorization gaps. The post Authorization Differential Testing in Salesforce appeared first on NetSPI.  ( 17 min )

Jamf and sync.blue® automatically sync corporate contacts to every managed iPhone device, delivering caller ID with zero IT effort.  ( 6 min )

GitHub's 2026 Actions changes make pull_request_target attacks harder, but not impossible. Here's the residual attack surface and how to audit for it.  ( 87 min )

Microsoft wants EDR out of the Windows kernel, and the preview binaries show wesp.sys telling a user-mode client that a process is starting, with nothing in its imports to let that client block it.  ( 86 min )

﷽  ( 7 min )

An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.  ( 78 min )

Detect and mitigate CVE-2026-111497, a critical Brotli decoder vulnerability enables remote code execution.  ( 74 min )

This is a lesser known feature of ripgrep that can be used to spawn your own executable via proxy. All you have to do is to run ripgrep with a ‘-z/–search-zip’ flag. Once you do it, any archive file that … Continue reading →  ( 2 min )

I remember that a few years ago, when I still used Twitter, I asked an open-ended question there: what are the most common passwords used for malware archives? This may sound silly, but there are a looooooot of the ‘default’ … Continue reading →  ( 2 min )

PHP2Shell demands prompt patching and evidence that remediation worked. Mark Kuhr explains how exploitability validation and experts working with agentic AI help security teams understand exposure and act with confidence. The post PHP2Shell and the Case for Exploitability Validation appeared first on Synack.  ( 17 min )

For years, we thought LDAP and SMB signing protected us from NTLM relay attacks. However, we found that both protocols could be relay targets through re-authentication on a connection the attacker already owned. Signing was still enforced, just with the attacker known session key. Microsoft fixed SMB quietly in September 2026 and LDAP in October […] The post Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication appeared first on SpecterOps.  ( 28 min )

This public operational guidance for PHP2Shell is provided to customers and published for the benefit of the wider community.  ( 13 min )

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) became the latest vulnerability to grab headlines around the globe. By some estimates, up to 70% of websites run at least some PHP. So if you're respons  ( 6 min )

We reproduced the Zimbra command injection vulnerability and found that several public PoCs write a payload Swatchdog never matches, so a failed test looks like a patched server.  ( 105 min )

Reduce triage times and focus on the risks that matter most by combining context across code, infrastructure, and runtime  ( 78 min )

Wiz Research is tracking an ARTEX-using actor, overlapping with Storm-0940, across multiple targeted software vendors. Learn how the AI agent attacks Okta, Entra, and Cognito, and what it left behind in the logs.  ( 79 min )

Continuous penetration testing is usually priced by subscription or credit model rather than per engagement. Cost depends on attack surface size, testing depth, and retest policy, not a simple asset count. Published price ranges vary widely across the market because providers define "scope" differently, so the pricing model is more useful to understand than any single published number. The post Continuous Penetration Testing Services: What’s Included and How Pricing Works appeared first on Synack.  ( 18 min )

TL;DR  Introduction  On the 20th of October two critical vulnerabilities affecting the PHP engine were publicly disclosed, collectively known as PHP2Shell.  The vulnerabilities were discovered through research involving Wiz, Calif, and OpenAI, with AI playing a significant role in both vulnerability discovery and exploit development.  Unsurprisingly, much of the attention has focused on the AI […] The post PHP2Shell and what the AI headlines are missing  appeared first on Pen Test Partners.  ( 9 min )

Connecting AI to enterprise systems changes what organizations entrust software to do. An agent that can query internal databases or modify business records has operational authority, and the scope of that authority becomes a security decision.  ( 10 min )

Every manual touch in your device deployment is a chance for something to fail. Find the bottlenecks and automate them so IT can focus on more important tasks.  ( 8 min )

Today we’re publishing patching-bugs and regression-hunt, two plugins that let engineers delegate patch development and regression checks to agents. Our patching-bugs plugin reproduces reported bugs, develops fixes, and tests them. The regression-hunt plugin checks whether any changes break previously working and supported behavior. Engineers can direct the work and review their results; maintainers can supply their own security assumptions and patching requirements, so the agents work within the project’s rules. We built patching-bugs and regression-hunt through Patch the Planet, our joint initiative with OpenAI, where we’ve co-authored hundreds of security patches for widely used open-source projects. Motivated by our major successes on projects like Scapy, our plugins draw on our analys…  ( 7 min )

Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.  ( 85 min )

In a new incident, a malicious version (1.107.0) of the LiteLLM package was uploaded to PyPI and Docker on October 21. The malicious version includes a credential stealer targeting browser, cloud and AI secrets as well as a dormant C2 capability.  ( 77 min )

TL;DR  A bucketful of photos  There are many services that allow digital photos to be converted to prints. These include a plethora of other printing services so that customer photos may be converted to picture books, mugs, magnetic photo tiles, clothing or even a throw.  With the combination of destination, these services allow photos to […] The post Printerpix and the not so private photo album  appeared first on Pen Test Partners.  ( 8 min )

CVE-2026-109618 and CVE-2026-109619 are critical PHP core RCE flaws that leaked ahead of disclosure. We cover what is verified, why exploitation converges on a web server spawning a shell, and the Elastic detections developed to catch this behavior.  ( 124 min )

Enable native runtime protection for GKE in just one click. The Wiz Runtime Sensor add-on now automates deployment and credential management while delivering predictable, kernel-level eBPF threat detection for your GKE Kubernetes fleets.  ( 78 min )

How a single Google Search ad click leads to credential theft, hijacking of cloud billing account, and hundreds of thousands of dollars incurred in unauthorized AI API usage  ( 78 min )

Identity governance and administration (IGA) controls who can access what, when and for how long across a school or district. This post explains why IGA matters and what to look for in an IGA solution.  ( 8 min )

API penetration testing focuses on authorization, authentication, and business logic at the endpoint level rather than the page-based structure a web application test targets. Scope is defined by endpoints, roles, and protocols rather than pages, and the most common finding class across enterprise APIs is broken object-level authorization. A test that only covers documented endpoints leaves the least-tested part of most API estates untouched. Documentation is where every API test starts; pairing testing with attack surface discovery is how you find the APIs nobody documented. The post API Penetration Testing for Enterprise APIs: Methodology, Scope, and What’s Covered appeared first on Synack.  ( 20 min )

Ein Digispark mag wie ein harmloses USB-Entwicklungsboard aussehen, lässt sich jedoch leicht in ein Gerät zur Tastenanschlag-Injektion verwandeln, das sich wie ein USB Rubber Ducky verhält. In diesem Artikel zeigen wir, wie ein solches Gerät eingerichtet, eingesetzt und forensisch analysiert werden kann, von der Ausführung der Payload auf einem Zielsystem bis hin zur Extraktion der Firmware aus dem ATtiny85-Mikrocontroller.  ( 20 min )

﷽  ( 15 min )

When trusted packages are compromised, malicious code can quickly spread throughout and beyond developer environments. See how Wiz’s supply chain pipeline identifies compromised packages at publication, helping teams detect zero-day supply chain compromises in Wiz Defend before a CVE is published  ( 76 min )

Wiz CIRT responded to AI-driven attacks spanning cloud, Kubernetes, CI/CD, and identity. Learn how these attacks behave and how to detect them.  ( 87 min )

A newly discovered macOS ransomware sample attempts to rewrite, recompile, and replace itself with a metamorphic variant. In this blog post, we analyze Heartbreaker's encryption, persistence, and unusual self-rebuilding logic, then put it to the test against RansomWhere?'s generic ransomware detection.  ( 10 min )

Last updated October 17, 2026  An attacker used a compromised credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to sign in to customers’ Microsoft 365 tenants. The credential belongs to the application itself, so the attacker inherited the permissions granted to it. Here’s what’s known so far and what to check in your own tenant.  […] The post ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant  appeared first on SpecterOps.  ( 16 min )

A Digispark may look like a harmless USB development board, but it can easily be turned into a keystroke injection device that behaves like a USB Rubber Ducky. In this article, we show how such a device can be set up, used, and forensically analyzed, from payload execution on a target system to firmware extraction from the ATtiny85 microcontroller.  ( 20 min )

Simplify your device onboarding with Jamf and Teqtivity.  ( 9 min )

Tim Nordvedt shares the top takeaways from his Dark Reading webinar with KeyCaliber’s Roselle Safran: AI has made finding vulnerabilities cheap, but fixing them still takes limited people, so the real advantage is knowing which exposures matter and showing leadership you’re reducing them. The post Discovery Has Scaled. Remediation Hasn’t: Top Takeaways on Threat Exposure Analytics appeared first on Synack.  ( 19 min )

Testing AI security without clear scoping produces superficial coverage and unaddressed risk. This post breaks down how to define boundaries, select the right assessment type, and align AI penetration testing, red teaming, and architecture reviews to the decisions that actually matter.  ( 9 min )

Launch Burp AT now               Find out more about Burp AT Since we launched Burp AT at Black Hat USA, it's been great to s  ( 5 min )

Integrate your existing code scanners into Wiz for a unified view of application risk across your environment.  ( 77 min )

Wiz AI Agents elevate traditional CNAPP, empowering public sector security teams to accelerate security and innovation.  ( 76 min )

TL;DR: How SpecterOps combined deliberate human engagement, model routing, and specialized tools to overhaul Ghostwriter’s user interface for $815.50 in model spend. Disclosure: SpecterOps participates in OpenAI’s Trusted Access for Cyber and Daybreak programs. Codex is the primary example in this article because it fits our engineering workflow and because of that relationship. The operating […] The post Be the Architect: Intentional AI Engagement for Cybersecurity Engineering appeared first on SpecterOps.  ( 27 min )

CVE-2026-20971 was a use-after-free bug in Samsung's Knox-related PROCA driver, showing how a flaw in a security feature can become an attack surface. Learn more about this already patched vulnerability and how to respond.  ( 7 min )

Closing the door doesn’t make a room secure. Alethe Denis breaks down how physical penetration testing evaluates whether unauthorized people can reach sensitive spaces, interact with equipment, or leave something behind without anyone noticing or reporting it.  ( 10 min )

TL;DR  Widespread food spoilage across Europe Over the night of the 11th of October 2026, the fridges and freezers in several hundred French supermarkets were made to warm up. Stock was spoiled across Intermarché, Netto, the U cooperative, Carrefour Market and Monoprix, with E.Leclerc also reported. The Paris prosecutor has reported fires. Losses run into […] The post You don’t need a nation state to warm up a fridge  appeared first on Pen Test Partners.  ( 10 min )

I tested 25 of the most popular package managers to check whether they detect a compromised package repository injecting malicious code into legitimate packages. This code integrity problem could be solved using cryptographic hashes or signatures, but many package managers are still vulnerable to this threat. Of the 25 package managers reviewed1, fewer than half used lockfiles that checked for tampering by default, and only two verified the integrity of every package they downloaded. Supply-chain attacks caused by developer compromise are a common story, but imagine what happens if ongoing mitigation attempts, including work by Trail of Bits2, are successful. If developers of popular packages are no longer the easiest targets, attackers will shift their focus to the next weakest link in th…  ( 16 min )

A . is all you need! Today Microsoft shipped the patch for a vulnerability in Visual Studio Copilot that I reported in August. Microsoft classified it as Important severity Remote Code Execution vulnerability. At the root cause it allows Copilot in Visual Studio or SQL Server Management Studio to bypass a path validation check and write to its own settings and configuration files. This allows Copilot to escape containment restrictions and achieve arbitrary command execution.  ( 5 min )

Discover how a permission bypass in Oracle Cloud Infrastructure (OCI) identity domains allowed lower-level administrator roles to create API keys for Identity Domain Administrators, leading to an unauthenticated privilege escalation path. The post Administrating the Administrator, An OCI Identity Domains Permission Bypass appeared first on NetSPI.  ( 31 min )

Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland, because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I can represent the bugs at this level of volume, so let me know if you have ideas. (Seriously – I’m out of ideas). If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for October 2026 For the first part of the October release, Adobe released 11 bulletins addressing 174 unique CVEs in Adobe Dimension, Commerce, Substance 3D Sampler, ColdFusion, Photoshop, FrameMaker, Experience Manager, Substance 3D Stager, Content Credentials SDK, Bridge, and Substance 3D Designer. Here’s this month’s overview table: Adobe Pa…

Continuous penetration testing runs against your live attack surface on an ongoing basis. Annual penetration testing gives you a deep, point-in-time snapshot once a year. Neither model is universally correct. The right choice depends on release velocity, attack surface volatility, and which compliance framework is driving the requirement. Enterprises shipping code weekly typically outgrow annual testing alone. The post Continuous Penetration Testing vs. Annual Pentests: What Enterprises Need to Know appeared first on Synack.  ( 19 min )

Isolation and authorization limit the damage when an AI agent fails, but they can't stop it from misreading inputs. This final part covers how to treat retrieved content as untrusted, log agent activity independently and plan for recovery.  ( 12 min )

A crafted link, one page load, and no clicks required. Bishop Fox found a reflected XSS in Siemens Teamcenter’s login redirect that auto-submits its own form, turning attribute injection into zero-interaction code execution and a silent surrogate delegation change on the victim’s account.  ( 15 min )

It is tempting to think of Windows in terms of a simple model: user mode and kernel mode. If a bug lets a user-mode process gain control of the kernel, it’s game over. Well, for a long time it used to be like that. Protected processes, SMEP, PatchGuard and other mitigations surely raised the bar, but it was Virtualization-Based Security that added another dimension to that model and made the whole design a lot more complex. Some code does not merely cross from user mode to kernel mode. It crosses into another Virtual Trust Level (VTL), where the normal kernel is no longer the most trusted component in the system. From a VTL0 perspective, the call may look like it disappears into a region whose private memory cannot be inspected even with kernel privileges. VBS uses the Windows hypervisor t…  ( 14 min )

I releasing a new version of my beta tool onedump.py to list files embedded inside OneNote files (.one). I had to extract all the embedded files out of a set of .one files. This update adds option –jsonoutput that helps with this problem. Running command “onedump.py –jsonoutput *.one” will create a JSON document containing all […]  ( 9 min )

Intro  ( 21 min )

﷽  ( 13 min )

REF8801 exposes how Apex Accelerator combines convincing Web3 services with malicious npm packages, attacker-controlled AI infrastructure, and cross-platform malware delivery.  ( 140 min )

Regulated red teaming explained: CBEST, TIBER-EU, DORA and more with practical guidance on safe delivery, approvals, evidence and reporting.

Regulated red teaming explained: CBEST, TIBER-EU, DORA and more with practical guidance on safe delivery, approvals, evidence and reporting.

The meaningful differences between web application penetration testing companies rarely show up on the homepage. They show up in who performs the testing, how the methodology is documented, what the retest policy covers, and how scope changes get priced once a contract is signed. Use the eight-criteria scorecard below to evaluate providers on substance rather than marketing language. The post Web Application Penetration Testing Companies: What Enterprise Buyers Should Compare appeared first on Synack.  ( 19 min )

Azure Fabric Backdoor With A Twist  ( 15 min )

State of the Art of Private Key Security in Blockchain Ops - 4. Approvals and Policies  ( 13 min )

No content preview  ( 7 min )

David Brauchler III delivers a fascinating Black Hat talk on the root cause of AI-based vulnerabilities and why security architecture is the real solution.  ( 7 min )

MCP Bridge Upgrade  ( 7 min )

Black Hole of Trust: SEO Poisoning in Silver Fox’s Space Odyssey  ( 7 min )

State of the Art of Private Key Security in Blockchain Ops - 3. Private Key Storage and Signing Module  ( 12 min )

The Symbols of Operation code data confusion ada lovelace  ( 6 min )

Public Report: AWS EKS Security Claims  ( 7 min )

Public Report: Google Private AI Compute Review  ( 7 min )

State of the Art of Private Key Security in Blockchain Ops - 2. Common Custody Solutions Architectures  ( 12 min )

Legacy Technology in Transport: More Than “Old Tech”  ( 7 min )

No content preview  ( 14 min )

Concepts, Types of Wallets and Signing Strategies  ( 12 min )

Bridging the Valley of Death: How Assurance Takes Us from Proof of Concept to Minimum Viable Product  ( 7 min )

Goal-Based Regulation  ( 7 min )

Unmasking Techno Sophists  ( 6 min )

Public Report: VetKeys Cryptography Review  ( 7 min )

Your point of departure for forensic readiness - Digital Forensics Incident Response  ( 10 min )

Euro 7, Anti-tampering, and the Expanding Cybersecurity Landscape  ( 6 min )

Discover how ransomware affects patient care, with insights from NCC Group on clinical vulnerabilities and sector trends.  ( 16 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 8 min )

No content preview  ( 6 min )

No content preview  ( 13 min )

This article details a vulnerability in Java Web Start that allows file inclusion through manipulated system properties.  ( 10 min )

No content preview  ( 7 min )

No content preview  ( 9 min )

No content preview  ( 8 min )

No content preview  ( 9 min )

No content preview  ( 7 min )

No content preview  ( 10 min )

Hackproofing Lotus Domino Web Server  ( 6 min )

No content preview  ( 24 min )

No content preview  ( 6 min )

Explore how a command injection flaw in Citrix Access Gateway could allow attackers to execute arbitrary system commands.  ( 9 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 9 min )

No content preview  ( 7 min )

No content preview  ( 10 min )

No content preview  ( 6 min )

No content preview  ( 9 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 11 min )

No content preview  ( 7 min )

No content preview

No content preview  ( 11 min )

No content preview  ( 7 min )

No content preview  ( 11 min )

No content preview

No content preview  ( 30 min )

No content preview  ( 8 min )

No content preview

No content preview

No content preview

No content preview

No content preview

Discover how LDAPFragger uses LDAP attributes to evade network restrictions and exfiltrate data covertly.  ( 15 min )

No content preview

No content preview  ( 11 min )

No content preview  ( 6 min )

No content preview  ( 8 min )

Advanced SQL Injection in SQL Server Applications  ( 6 min )

No content preview  ( 10 min )

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 12 min )

No content preview  ( 7 min )

No content preview  ( 19 min )

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview  ( 7 min )

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview  ( 7 min )

A practical approach to neutralizing Log4j’s JNDI vulnerability without upgrading the entire library.  ( 12 min )

No content preview  ( 20 min )

No content preview  ( 7 min )

No content preview  ( 9 min )

No content preview

No content preview

No content preview

No content preview  ( 8 min )

No content preview  ( 6 min )

No content preview  ( 8 min )

No content preview  ( 6 min )

No content preview  ( 9 min )

No content preview  ( 19 min )

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview  ( 10 min )

No content preview  ( 16 min )

No content preview  ( 17 min )

No content preview  ( 6 min )

No content preview  ( 12 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 10 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 8 min )

No content preview  ( 7 min )

No content preview  ( 9 min )

Explore the introduction to exploiting CVE-2018-8611 in Windows Kernel Transaction Manager (KTM) with NCC Group’s expert analysis.  ( 23 min )

No content preview  ( 12 min )

No content preview  ( 6 min )

No content preview  ( 12 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 9 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 19 min )

No content preview

This post reveals how a simulated attack demonstrated the ease of breaching hospital systems using basic resources.  ( 13 min )

No content preview  ( 17 min )

Learn how anti-fuzzing techniques enhance defence-in-depth strategies and protect applications from fuzzing-based vulnerabilities.  ( 13 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

Explore the remote code execution flaw in ImpressPages CMS and learn best practices for vulnerability remediation.  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 10 min )

Learn how forensic techniques can recover deleted entries from the Windows Registry for investigation and analysis.  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 10 min )

No content preview  ( 7 min )

Discover how multivariate cryptography fits into the future of secure communications and what makes it unique among quantum-safe algorithms.  ( 21 min )

No content preview  ( 11 min )

Understand the mechanics behind SMB hash hijacking and user tracking in MS Outlook. Our advisory covers attack vectors, testing methods, and fixes.  ( 12 min )

No content preview  ( 10 min )

No content preview  ( 14 min )

No content preview  ( 12 min )

No content preview  ( 9 min )

No content preview  ( 18 min )

No content preview  ( 8 min )

No content preview  ( 13 min )

Discover how attackers could exploit memory handling flaws in OpenOffice.org to compromise system integrity and user safety.  ( 9 min )

No content preview  ( 9 min )

No content preview  ( 29 min )

No content preview  ( 7 min )

Explore a detailed breakdown of the Bybit hack, uncovering attack methods, vulnerabilities, and security lessons learned.  ( 15 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

Explore known XML-based attack methods including DTD abuse, schema exploits, and entity expansion vulnerabilities.  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 8 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

Nagios XI Network Monitor is vulnerable to blind SQL injection. Learn the impact, exploitation risks, and mitigation steps.  ( 7 min )

No content preview  ( 6 min )

A technical overview of NFC chip vulnerabilities and protection strategies for secure communication.  ( 15 min )

No content preview  ( 11 min )

Learn why CVE-2021-3156 poses a threat to VMware vCenter and how to protect your infrastructure from attacks.  ( 30 min )

No content preview  ( 9 min )

Explore how Yara can detect Authenticode timestamp anomalies in PE files and enhance malware analysis.  ( 10 min )

No content preview  ( 17 min )

No content preview  ( 7 min )

No content preview  ( 9 min )

No content preview  ( 9 min )

No content preview  ( 18 min )

No content preview  ( 11 min )

No content preview  ( 12 min )

No content preview  ( 12 min )

No content preview  ( 10 min )

No content preview  ( 11 min )

No content preview  ( 25 min )

No content preview  ( 10 min )

No content preview  ( 10 min )

No content preview  ( 16 min )

No content preview  ( 13 min )

No content preview  ( 8 min )

No content preview  ( 9 min )

No content preview  ( 17 min )

No content preview  ( 13 min )

Discover how fuzzing RTSP streams uncovered vulnerabilities in VLC and advanced secure software development.  ( 11 min )

No content preview  ( 15 min )

No content preview  ( 8 min )

No content preview  ( 27 min )

Insights from honeypot research on F5 TMUI RCE vulnerability. Understand attack patterns and steps to strengthen your security posture.  ( 14 min )

Discover how early-stage security planning in hardware and embedded systems can dramatically reduce attack surfaces.  ( 12 min )

No content preview  ( 16 min )

No content preview  ( 15 min )

No content preview

No content preview  ( 10 min )

A brief look at Windows telemetry: CIT aka Customer Interaction Tracker  ( 24 min )

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 9 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 6 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 8 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

NCC Group explains why pen test prerequisites are essential for accurate, efficient, and secure web application assessments.  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 9 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 8 min )

E-mail Spoofing and CDONTS.NEWMAIL  ( 7 min )

No content preview  ( 8 min )

No content preview  ( 6 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 10 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 8 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 11 min )

No content preview  ( 54 min )

Learn about multiple CVEs affecting Nuki Smart Locks and how to mitigate security risks for connected home devices.  ( 21 min )

No content preview  ( 11 min )

This technical advisory details how encoded URLs can be used to inject malicious HTTP headers in Oracle WebLogic Plug-in environments.  ( 12 min )

No content preview  ( 16 min )

No content preview  ( 12 min )

No content preview  ( 16 min )

No content preview  ( 10 min )

No content preview  ( 10 min )

No content preview  ( 11 min )

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview