This is a relatively new API (EtwCheckCoverage) that may be of interest. It is being used by a couple of DLLs and executables in Windows 11 and here’s a list of known parameters it takes: comdlg32.dllShell_Picker_ShowShell_Picker_FinishShell_Picker_Cancel dafBth.dllBluetooth_Pairing_CancelledBluetooth_Pairing_SucceededBluetooth_Pairing_FailedBluetooth_Pairing_StartedBluetooth_Pairing_Deleted diagtrack.dllUTC_OsEvents_AbnormalShutdown dwmcore.dllDwm_EnergyReporter_DataDropped_QueuingDwm_EnergyReporter_DataDropped_MaxEntriesDwm_EnergyReporter_DataDropped_WorkerRunning Faultrep.dllWER_Report_AppCrash … Continue reading →  ( 2 min )

Multihashing is one of those cryptographic tasks that’s easy not to think about too much. This is unfortunate, because multihashing is a common stumbling point when cryptographers try to use hashes. As part of our goal to “fix software, not bugs,” Trail of Bits is introducing SequenceHash and its sister function SequenceMAC, a pair of related hash constructions that bring secure multihashing to developers using hash functions other than Keccak. We hope SequenceHash and SequenceMAC will help cryptographers avoid attacks that take advantage of ambiguous input encodings. The specification is open source, and is now a part of the Community Cryptography Specification Project (C2SP). SequenceHash and SequenceMAC behave similarly to NIST’s TupleHash, but have the advantage of not being tied to a …  ( 11 min )

Synack was named a Leader in G2's Fall 2026 Grid® and Enterprise Grid® Reports for Penetration Testing. The reviews show what customers value in a pentesting partner: visibility into testing, access to experts, findings they can fix and verify, and a partner that acts on feedback. The post What Customers Value in a Penetration Testing Partner: Insights from G2 Reviews appeared first on Synack.  ( 18 min )

A few years ago, a friend stayed at my place during Ruxcon and gave me a bottle of rum called Inner Circle as a thank-you. I liked the name. To be fair, at 75.9%, I am surprised I still remember it. But over the years, security has started to feel a bit like that. At Unprompted Australia two weeks ago, I ran into at least two people I had originally met in Prague. Different conference, different country, almost the other side of the world, and somehow the same people. The year before, at an OWASP meetup in Krakow, I met people who were working with one of my former coworkers from Fitbit in San Francisco. Let's call him Spiderboy. #innerjoke. You travel halfway across the world, walk into a meetup in Poland, start talking …  ( 4 min )

Here is an overview of content I published in September: Blog posts: b’Update: search-for-compression.py Version 0.0.8′ SANS ISC Diary entries: YARA 4.5.0 Release TerminalFix: PNG Steganography Wireshark 4.6.9 Released  ( 11 min )

Before you build an AI pentesting agent, run it through 5 tests for production readiness. Mark Kuhr breaks down what separates a prototype from a system. The post Build or Buy AI Pentesting? 5 Tests to Judge Production Readiness appeared first on Synack.  ( 17 min )

An unauthenticated attacker who can reach TCP 19009 on a Check Point management server can take it over completely. Bishop Fox reproduced the full root RCE chain on R81.10 and R82.10, breaks down all three vulnerabilities the patch actually closes, and shares a safe detection tool for defenders.  ( 15 min )

Details on bypassing Apple's original rootpipe patch  ( 42 min )

Our annual report on all the Mac malware of the year - including samples for download, infection vectors, persistence mechanisms, payloads and more!  ( 41 min )

Announcing the release of DHS; a tool to help detect (dylib) hijackers  ( 42 min )

Why BlockBlock needs a kext (hint: process monitoring), and how the kext was created  ( 42 min )

How to build HackingTeam's OS X implant in Xcode  ( 42 min )

How to remotely kernel-debug a OS X 10.11 VM  ( 42 min )

A deeper dive into 'MacInstaller' and the adware it installs  ( 42 min )

Exploiting RootPipe on OS X 10.10.3  ( 42 min )

NSLog(@"Hello World"); objective-see.org is alive!  ( 42 min )

How reversing Apple's 'RootPipe' patch provided the means to secure TaskExplorer's XPC service  ( 42 min )

Let's look at all the mac malware from 2017, for each - discussing their infection vector, persistence mechanism, features & goals.  ( 40 min )

Does Shazam's Mac App keep recording even when you turn the app off? ...yes :/  ( 8 min )

I uncovered a new cross-platform backdoor that provides remote attackers persistent access to infected systems  ( 12 min )

CVE-2017-7170 was a local priv-esc vulnerability that affected OSX/macOS for over a decade! Here (for the first time!), we dive into the technical details of finding the bug, the core flaw, and exploitation.  ( 10 min )

Analysis of OSX/Proton.B reveals some interesting tricks plus a command file that can be decrypted to reveal the malware's capabilities  ( 10 min )

The APT group WindShift has been targeting Middle Eastern governments with Mac implants. Let's (continue to) analyze their 1st-stage macOS implant: OSX.WindTail!  ( 8 min )

Looks like somebody on the 'dark web' is offering 'Ransomware as a Service'...that's designed to infect Macs!  ( 6 min )

Let's analyse the malware that appeared in 2016, discussing the infection vector, persistence mechanism, feature, and disinfection for each.  ( 12 min )

HackingTeam using native OS X crypto to protect malware -neat! New blog w/ sample + decryptions/dumpings/detections  ( 5 min )

Learn how a Finder Sync can 'extend' Finder.app and how this could be abused for persistence  ( 5 min )

Recently, an attacker targeted (Mac) users via a Firefox 0day. In this second post, we fully reverse OSX.NetWire.A, revealing (for the first time!), its inner workings and complex capabilities.  ( 12 min )

Today we uncover two (local) security flaws in Zoom's latest macOS client. First, a privilege escalation vulnerability, and second, a method to surreptitiously access a user's webcam and microphone (via Zoom).  ( 12 min )

Apple's App Translocation broke several of my tools, but we can locally undo it to restore broken functionality!  ( 11 min )

@CodeColorist continues writing about bugs, such as CVE-2019-8521 and CVE-2019-8565 that provide a mechanism to elevate privileges to root on macOS.  ( 4 min )

A new macOS backdoor written by the infamous Lazarus APT group needs analyzing. Here, we examine it's infection vector, method of persistence, capabilities, and more!  ( 10 min )

Some undetected adware named "Mughthesec" is infecting Macs...let's check it out!  ( 5 min )

In macOS Mojave apps, to have to obtain user permission before using the Mac camera & microphone. We'll illustrate how this is trivial to bypass (at least in the current beta).  ( 4 min )

If you can programmatically generate synthetic mouse clicks, you can break macOS! Approving kernel extensions, dismissing privacy alerts, and much more more...  ( 8 min )

A new Mac malware targets the cryptocurrency community. In this post, we dive into the malware and illustrate how Objective-See's tools can generically thwart this new threat at every step of the way.

High Sierra suffered from a nasty bug (CVE-2017-7149) that afforded local attackers access to the contents of encrypted APFS volumes.  ( 12 min )

The macOS sandbox is seeks to prevent malicious applications from surreptitiously spy on unsuspecting users. Turns out, it's trivial to sidestep some of these protections, resulting in significant privacy implications!  ( 7 min )

Did you know on macOS, notifications are stored in a unencrypted database? Which means that even 'disappearing' messages from apps such as Signal - may not really disappear. Yikes!  ( 4 min )

In Objective-See's first guest blog post, Amit Serper presents his detailed analysis of OSX/Pirrit  ( 10 min )

Turns out that writing security tools is a great way to inadvertently uncover bugs in macOS. How about a crash in Apple's 'Security' framework ... that can't be good!?  ( 7 min )

Today is our 2nd birthday! Let's look at our past, present, and future.  ( 2 min )

Learn how to leverage Apple's new Endpoint Security Framework to create a comprehensive (user-mode) Process Monitor for macOS 10.15!  ( 14 min )

Our annual report on all the Mac malware of the year - including samples for download, infection vectors, persistence mechanisms, payloads and more!  ( 26 min )

Dissecting string obfuscations, junk code insertions, and anti-debugging logic of InstallCore  ( 5 min )

A massively popular iOS application turns out to be a government spy tool! Here, we analyze the app; decrypting its binary and studying its network traffic.  ( 12 min )

In this guest blog post @CodeColorist writes about a neat macOS vulnerability. Ironically, by abusing security mechanisms such as sandboxing, macOS can be coerced to load an untrusted library, into a SIP-entitled process!

Process monitoring via the KAuth Subsystem (and some limitations)  ( 5 min )

Recently, an attacker targeted (Mac) users via a Firefox 0day. In this third post, we analyze a second backdoor used in the attack, detailing its persistence, capabilities, and ultimate identify it a new variant of the cross-platform Mokes malware!  ( 6 min )

Turns out the innocuously named "Calendar 2" app, found on the official Mac App Store, was surreptitiously turning Mac into cryptocurrency miners!  ( 4 min )

A sophisticated Lazarus Group implant has arrived on macOS. In this post, we deconstruct the Mac variant of a OSX.Dacls, detailing its install logic, persistence, and capabilities.  ( 11 min )

By monitoring file I/O events and detecting the rapid creation of encrypted files by untrusted processes, can ransomware be generically detected?  ( 26 min )

Here, we reverse, then 'extend' a popular macOS anti-virus engine. With the creation of a new anti-virus signature, classified documents will be automatically detected!  ( 14 min )

In this guest blog post, "Objective by the Sea" speaker, Csaba Fitzl writes about an interesting way to get root via Apps from the official Mac App Store!  ( 17 min )

A 0day logic flaw in Microsoft Excel leads to 'remote' code execution on macOS, via malicious macros.  ( 6 min )

Recently, the popular MacUpdate website was subverted to distribute a new macOS cryptominer; OSX/CreativeUpdater.  ( 5 min )

Getting process creation notifcations from kernel-mode to user-mode, via the undocumented kev_msg_post function  ( 8 min )

Let's tear apart a persistent piece of adware, decompiling, decoding, and decompressing it's code to uncover its methods and capabilities.  ( 8 min )

Analyzing code within the macOS kernel audit subsystem uncovered an exploitable heap overflow.  ( 5 min )

OSX/MaMi (the first Mac malware of 2018) hijacks infected users' DNS settings and installs a malicious certificate into the System keychain, in order to give remote attackers 'access' to all network traffic  ( 9 min )

A massively popular app from the official Mac App Store, surreptitiously steals your browsing history! By fully reversing the application, we can fully expose its functionality and rather shady capabilities.  ( 13 min )

Apple's 'fix' for a macOS kernel panic, fixes nothing and worse, introduces a new bug.  ( 13 min )

A new 'security' feature in macOS 10.13, is trivial to bypass.  ( 5 min )

Imagine you've gained remote code execution on a Mac via a malicious Word document. Turns out, you're still stuck in a sandbox. However, via a faulty regex, you can escape and persist!  ( 5 min )

How to verify that an application came from the official Mac App Store, via receipt validation  ( 7 min )

A malicious Word document targeting macOS users, was recently uncovered. Let's extract the embedded macros, decode an embedded downloader, and retrieve the 2nd-stage payload!  ( 5 min )

Reverse-engineering a 'Russian' implant reveals HackingTeam's code!?  ( 10 min )

The macOS kernel had an (intentional?) off-by-one bug that could trigger a kernel panic.  ( 13 min )

The EFF/Lookout discovered a cross-platform implant, named CrossRat with ties to nationstate operators. Here, we tear it apart; analyzing its persistence mechanisms, features, and network communications.  ( 13 min )

Are full paths and preview thumbnails for files even on encrypted containers and removable usb devices really persistently stored? ...yes :( Apple's 'QuickLook' cache is to blame.  ( 7 min )

A Word document targets Mac users with malicious macros and an open-source payload.  ( 4 min )

The rather infamous APT group, "Lazarus", continues to evolve their macOS capabilities. Today, we tear apart their latest 1st-stage implant that supports remote download & in-memory execution of secondary payloads!  ( 9 min )

The website of a popular application was hacked, and the application trojaned with a new variant of osx/proton.  ( 3 min )

Read how an attacker can bypass Apple's SIP, via the local OS upgrade process  ( 11 min )

The 'Mac File Opener' adware is fairly normal, except for it how it persists via registered document handlers  ( 9 min )

Apple wrote code to appease the Chinese government ...it was buggy. In certain configurations, iOS devices were vulnerable a "emoji-related" flaw that could be triggered remotely!

In part one of a guest blog post, @CodeColorist writes about several neat macOS vulnerabilities.  ( 4 min )

Yet another a massive security flaw affects the latest version of macOS (High Sierra), allowing anybody to log into the root account with a blank, or password, of their choosing!  ( 7 min )

The APT group WindShift has been targeting Middle Eastern governments with Mac implants. Let's analyze their 1st-stage macOS implant: OSX.WindTail!  ( 7 min )

In this guest blog post my friend Mikhail Sosonkin reverses Apple's screencapture utility, discusses Mac malware that captures desktop images, and suggests methods for screen-capture detection!  ( 11 min )

After the success of #OBTS v1.0, we decided to go international and plan #OBTS v2.0 in Europe! In this blog post, we re-live the highlights (from Monaco!) of "Objective by the Sea" v2.0.  ( 3 min )

Apple recently updated the way login items are stored by the OS. In this post, we'll illustrate how to parse the (new) login item files to detect persistence

A core Mojave utility is rather disastrously broken - causing a full-system lockup. Let's find out why!  ( 6 min )

On my flight to ShmooCon, I managed to panic my fully-patched MacBook. Here we analyze the kernel panic report, finding that Apple's AMDRadeonX4150 kext is responsible for the crash.  ( 7 min )

The Lazarus group's latest implant/loader supports in-memory loading of 2nd-stage payloads. In this post we describe exactly how to repurposing this 1st-stage loader to execute *our* custom 'fileless' payloads!  ( 14 min )

Recently, an attacker targeted (Mac) users via a Firefox 0day. In this first post, we triage and identify the malware (OSX.NetWire.A) utilized in this attack, identifying its methods of persistence, and more!  ( 6 min )

The WINDSHIFT APT group is successfully infecting Macs with a novel infection mechanism. By abusing custom URL scheme handlers and minimal user interaction, Macs can be remotely compromised!  ( 8 min )

Learn how to leverage Apple's new Endpoint Security Framework to create a comprehensive (user-mode) File Monitor for macOS 10.15!  ( 10 min )

Two weeks back I presented at BlueHat Asia 2026 about my research on Microsoft’s Copilot in SSMS, the SQL Server Management Studio. This post is a write up about the talk, which covered CVE-2026-65669, a SQL Server Elevation of Privilege Vulnerability rated critical by Microsoft. So, make sure your installations are up-to-date. The slides of the presentation can be found here. BlueHat Asia 2026 in Singapore First, a few words about the conference. I have spoken at BlueHat before, sometime back in 2017, and also two years ago. Both times at Microsoft’s Redmond Campus.  ( 6 min )

Security tool developers like Outflank can expose capabilities to AI agents using the Model Context Protocol (MCP). On the surface, this seems easy: define your tools, write short descriptions, and return some JSON. It seems to work fine, but sometimes an agent can’t find a tool, ignores your constraints, or misses an important tool output. Debugging the server with MCP Inspector yields no obvious bugs. What went wrong? The MCP specification defines how clients and servers communicate, but it leaves many decisions about what the model actually sees up to the client. Popular MCP clients like Codex and Claude Code make their own choices about what the model sees, and they don’t always document those choices or make them predictable. This post details the MCP client implementations of Codex 0.157.1 and Claude Code 2.1.283. Tags: AI Read full post The post MCP Beyond the Spec: Inside Codex and Claude Code appeared first on Outflank.  ( 13 min )

Security tool developers like Outflank can expose capabilities to AI agents using the Model Context Protocol (MCP). On the surface, this seems easy: define your tools, write short descriptions, and return some JSON. It seems to work fine, but sometimes an agent can’t find a tool, ignores your constraints, or misses an important tool output. Debugging the server with MCP Inspector yields no obvious bugs. What went wrong? The MCP specification defines how clients and servers communicate, but it leaves many decisions about what the model actually sees up to the client. Popular MCP clients like Codex and Claude Code make their own choices about what the model sees, and they don’t always document those choices or make them predictable. This post details the MCP client implementations of Codex 0.157.1 and Claude Code 2.1.283. Tags: AI Read full post The post MCP Beyond the Spec: Inside Codex and Claude Code appeared first on Outflank.  ( 13 min )

Secure your Kubernetes supply chain with WizOS Helm Charts. Eliminate hidden CI/CD risks and unmaintained dependencies with hardened, signed, and CVE-scanned charts for seamless Kubernetes deployment.  ( 78 min )

TL;DR What systems are needed for the safe operation of a vessel? Most people in shipping can answer that without pausing. The fire pumps, the steering gear, the main engine, the power management system, and many more. Everyone agrees on those. The rules are built around them, they are certified and surveyed, and crews drill […] The post Safe, but sailing nowhere. Can you stop a fleet of ships? appeared first on Pen Test Partners.  ( 12 min )

AI-assisted research is flooding the CVE pipeline with bugs that score critical but depend on configurations almost nobody runs. Bishop Fox tested four high-profile Nginx CVEs in the lab, measured real-world prevalence, and explains how to separate actual risk from well-marketed noise.  ( 16 min )

TL;DR: Adversary Intelligence: LLM Tradecraft is a new on-demand course covering how modern LLMs and agentic systems work, how they can be exploited, and how to secure them in practice.  In July of this year, we released our first on-demand courses as part of the SpecterOps Tradecraft Academy. Today, we’re excited to introduce our new […] The post Introducing Adversary Intelligence: LLM Tradecraft appeared first on SpecterOps.  ( 17 min )

Why Pentest Proposals Never Seem to Match A compliance officer receives a request for a penetration test, contacts several providers, and receives proposals that appear to describe completely different services. One covers external IP addresses, another includes applications and APIs, and a third promises audit-ready evidence without explaining what was tested. This guide to penetration […] The post Penetration Testing for Compliance Officers: A Non-Technical Buyer’s Guide appeared first on Synack.  ( 24 min )

I’ve noticed when a zlib compressed chunk of data is followed by other data, search-for-compression.py will not always be able to detect the compressed chunk. This is caused by the fact that the other data generates a decompression error, and the complete chunk is disregarded. I’ve added a new option to try to solve this: […]  ( 11 min )

﷽  ( 9 min )

Part 1 of this week's saga can be found here. This research is a glimpse into the capabilities that power our Preemptive Exposure Management solution, enabling organizations to rapidly react to emerging threats: the watchTowr Platform. What Is A Citrix NetScaler? NetScaler, from Citrix (now under Cloud  ( 10 min )

Two vulnerabilities in Zilliz Attu 2.6.5 chain into something serious. Missing authentication lets anyone proxy requests unauthenticated, and a regex bypass defeats the private IP block. Bishop Fox turned both into full Kubernetes namespace takeover in a cloud deployment. Update to 3.0.0 now.  ( 17 min )

Why Two “Penetration Testing” Quotes Rarely Mean the Same Thing Most comparisons of penetration testing vendors begin too late. Buyers shortlist several providers, collect proposals, and then try to compare services that were never equivalent in the first place. One vendor may quote for a single application and a final report, while another may include […] The post Penetration Testing Vendor Comparison: What Enterprises Should Compare appeared first on Synack.  ( 25 min )

See how the Blue Agent investigated a multi-platform attack in minutes, following evidence across AWS and GitHub to uncover compromised credentials, stolen source code, and custom data exfiltration tooling  ( 74 min )

Elastic InfoSec runs Linux endpoint management through Elastic Defend with a scheduled workflow that gets Cursor and Codex config onto new laptops without piling up duplicate actions on offline hosts, and it works for other config too.  ( 85 min )

Empowering managed services partners to deliver world-class cloud and AI security at scale  ( 72 min )

God damn it, we're back in the room again. Yes, that sound in your ears is screaming. The footgun has gone off again, shockingly, and we are yet again dealing with a situation where the entire world apparently knew about Citrix NetScaler CVEs before Citrix had woken up  ( 10 min )

The native Sublime Security integration sends email detections into Elastic Security, where phishing incident response can tie a quarantined email to what happens next on the endpoint and pull the threat from every mailbox it reached.  ( 74 min )

When you run (from admin account): rundll32 aidd.dll, AiddRunTask a lot of interesting things are happening. There are at least 2 files of interest being created: c:\Windows\appcompat\AIDD\AIDDProcessLoadedDllListDBdump.txtc:\Windows\appcompat\AIDD\ProcessLoadedDllList.db They include a textual and SQLite-based list of executables running and DLLs loaded. … Continue reading →  ( 2 min )

The WinCsFlags.exe program accepts an undocumented command line argument “-w”. When you invoke it like this: WinCsFlags.exe -w it will go into a never-ending loop waiting for the debugger to be attached.  ( 2 min )

When you run UIEOrchestratorStub.exe it executes UIEOrchestrator.exe program located here: %SystemRoot%\uus\\UIEOrchestrator.exe So, changing the SystemRoot environment variable to point to your chosen path will lead to execution by proxy. On a 64-bit Windows 11 26H2, we can try this: set … Continue reading →  ( 2 min )

Jamf Threat Labs uncovers CloudSyncD, a fake Zoom installer disguised as a legitimate application that uses a phished login password to launch an embedded backdoor while concealing the credential inside a decoy configuration file.  ( 19 min )

Catch up on JNUC 2026 Day 3: top session themes, the 10 best-attended breakouts, EDU SOTU highlights and more.  ( 6 min )

Wiz Research analyzes NordStellar data to map the credentials targeted by infostealer families and assess their potential impact across cloud, code, and AI environments.  ( 92 min )

A hardcoded authentication secret ships with every SolarWinds Access Rights Manager install, and reaching TCP 55555 is enough to hit a .NET deserialization sink. Bishop Fox confirmed SYSTEM-level code execution, breaks down the root cause, and shares a safe detection tool for defenders.  ( 13 min )

Threshold signature schemes, a form of multi-party computation (MPC) that lets a set of parties sign together without any one of them holding the key, are increasingly deployed inside trusted execution environments (TEEs). The combination is intended to amplify security for sensitive computations: MPC distributes trust across multiple independent parties, while TEEs root trust in the hardware manufacturer and its attestation infrastructure. But subtle issues can arise when running an MPC protocol inside a TEE without accounting for the untrusted host: for example, a malicious host could roll back the filesystem state after a threshold signer deletes a used pre-signature, causing the signer to reuse their nonce share and disclose their private key share. So is this combination worth it? Pro…  ( 10 min )

Catch up on JNUC 2026 Day 2: top session themes, the 10 best-attended breakouts, EDU SOTU highlights and more.  ( 7 min )

Catch up on JNUC 2026 Day 1: top session themes, the 10 best-attended breakouts, Keynote and SOTU highlights and more.  ( 7 min )

Forrester’s Proactive Security Platforms evaluation rated Wiz with top scores across eight areas, reflecting our commitment to securing the AI era  ( 74 min )

New initiative partners with under-resourced organizations to uncover, remediate exploitable risk at scale.  ( 78 min )

Companies frequently ask SpecterOps some version of the same question: How are you using AI in offensive security, and how can we begin using it too? They want practical guidance. Which parts of an assessment are improving now? Where does the technology still fail? What should a team learn or build first?  Demystifying adversary tradecraft is part of SpecterOps’s core purpose. Through GhostWorks, we apply that purpose to AI by testing […] The post AI for Offensive Security: What Works, What Does Not, and How to Adopt It  appeared first on SpecterOps.  ( 23 min )

.NET MAUI lets developers write once and ship to both platforms. From an attacker's perspective, that means reverse-engineer once and break everywhere. This post walks through extracting readable assemblies from MAUI apps and the high-impact vulnerability patterns that consistently appear.  ( 12 min )

Well, well, well, well, well, well, well, well, well, well, well, well, well, well, well. We're back. Sorry. We've been watching the onslaught of vulnerabilities flood the internet. Every man, dog, and their grandmas (apparently?) are now using LLMs to find and reproduce vulnerabilities - it’  ( 8 min )

TL;DR While testing deep links in Chrome for iOS, we noticed a small but important difference. Opening a third-party app through a custom URL scheme normally produced a confirmation prompt. Shortcuts were an exception. As they’re handled by a native Apple app, Chrome allowed shortcuts:// and its legacy workflow:// alias to open without showing the same prompt. At first, this looked like a minor inconsistency. It became more interesting once we looked at Shortcuts’ callback support. A webpage could send the user to Shortcuts and provide a second URL for Shortcuts to open afterwards. That second URL could be tel:. Although Chrome protected direct tel: navigations with user-interaction checks, it never saw the callback coming from Shortcuts. A single click on a webpage could therefore reach t…  ( 5 min )

The education landscape has changed quite a bit this year. At the 2026 JNUC State of the Union, attendees discovered what new features Jamf has to offer educators and admins to meet new challenges and how to use them to keep the focus on what matters: learning.  ( 13 min )

Learn about the new upcoming Jamf platform features announced at the JNUC 2026 Platform State of the Union.  ( 9 min )

With Pwn2Own Ireland 2026 coming up, I wanted to share an unreleased blog post from my time as a Pwn2Own contestant. This post covers the discovery and exploitation of CVE-2024-0244, which is an unauthenticated heap-based buffer overflow leading to an arbitrary free() in the Canon MF753Cdw printer featured in Pwn2Own Toronto 2023. This blog post gives an overview of the vulnerability and the exploitation techniques used. Figure 1 - MF753Cdw printer Figure 1 - MF753Cdw printer Previously, I had exploited the very similarly named MF743Cdw at Pwn2Own Toronto 2022 using a classic stack buffer overflow, so I had a solid baseline understanding of this family of printers and their quirks. Starting Point Over the years at Pwn2Own, the Canon family of printe…

Security testing and exposure management have run on separate tracks for years, leaving a blind spot between what a scanner flags and what an attacker can exploit. Synack's new integration with Wiz closes that disconnect, feeding continuously validated pentest findings directly into Wiz's exposure management view. The post Unifying Security Testing and Exposure Management: Introducing the Synack and Wiz Integration appeared first on Synack.  ( 17 min )

Most penetration testing RFPs ask vendors to price "one web application" or "an annual pentest" and leave the rest open to interpretation. This guide gives you a complete penetration testing scope-of-work template, a standard vendor response format, a weighted scorecard, and a pass/fail checklist, so every proposal answers the same questions and gets measured against the same bar. The post Penetration Testing RFP: What to Include and How to Evaluate Responses appeared first on Synack.  ( 23 min )

Autonomous penetration testing in the Praetorian Guard Platform has changed shape. Hannibal started as a hunt agent for external and cloud attack surfaces. Today, it’s something your security team can run entirely on its own terms. Web applications and LLM endpoints are now first-class attack surfaces. Hunts can authenticate into applications, test what a real […] The post Hannibal Puts Autonomous Penetration Testing Under Your Control appeared first on Praetorian.  ( 13 min )

How many bugs have you missed because you didn’t send quite enough HTTP requests? Turbo Intruder now supports HTTP/3, can comfortably exceed 100,000 requests per second over Wi-Fi, and auto-tunes for  ( 6 min )

﷽  ( 10 min )

Part 2 of Jamf's agentic security series moves from containing code execution to constraining enterprise authority. Learn about scoping agent identities and credentials, governing MCP servers and tools, and enforcing authorization outside the model.  ( 13 min )

Support tickets are a late signal. Real device visibility helps IT spot friction and act before employees feel it.  ( 7 min )

TL;DR: Ghostwriter Skills is a new collection of portable Agent Skills for common Ghostwriter workflows. The initial release includes skills for creating and reviewing report templates, checking whether a report is ready for final reporting steps, and drafting an executive summary from an existing Ghostwriter report. Introduction We recently introduced SpecterOps Skills, our public repository […] The post Introducing Ghostwriter Skills appeared first on SpecterOps.  ( 16 min )

Discover how a single DNS request can chain a stored Cross-Site Scripting (XSS) vulnerability into Remote Code Execution (RCE) on pfSense firewalls. Read the full technical breakdown of CVE-2026-78902 affecting the popular pfBlockerNG package. The post CVE-2026-78902: XSS to RCE in pfSense with one DNS request appeared first on NetSPI.  ( 15 min )

Penetration testing for third-party risk works best as a deeper assurance layer for suppliers whose compromise would meaningfully affect the enterprise, not as a blanket requirement. Tier vendors by data access, system access, operational weight, and external exposure, then match testing depth and cadence to that tier. Combine vendor-supplied reports, enterprise-commissioned tests, and shared platforms depending on the relationship. Get written authorization first, scope the test to the product and integration that matter, and feed validated findings into remediation plans and risk scores. The post Penetration Testing for Third-Party Risk Management Programs appeared first on Synack.  ( 24 min )

WINning AI with AI: How the Wiz MCP for WIN partners accelerates a connected ecosystem  ( 65 min )

Jamf Threat Labs investigates a newer variant of PamStealer, the third known variant of the family, distributed as a fake application installer that uses a purpose-built decryption utility to ensure the payload cannot be recovered without server cooperation.  ( 22 min )

Small tech interruptions like slow apps and device issues quietly compound into a real productivity and IT workload problem for growing organizations.  ( 7 min )

Born out of academia and raised in corporate IT departments, the Security Assertion Markup Language (SAML) authentication protocol continues to be a staple in these organizations. However, it’s time for it to retire. With the rise of software-as-a-service (SaaS) companies in the late aughts, IT departments needed a way for users to authenticate to many new web services. SAML and the burgeoning single sign-on (SSO) industry fulfilled this need. However, SAML is being crushed under the weight of its own complexity. It’s time to deprecate it and move on to modern alternatives like OpenID Connect (OIDC). In this post, I will explore the design-by-committee origin of SAML, its progression through the ranks in academic and corporate environments, its slow disintegration at the hands of the secur…  ( 9 min )

This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in Windows, CVE-2026-66804, that I and 14 others reported. This issue is an incomplete fix for CVE-2026-50343, a bug dubbed “Dark Elevator” by Calif. The root cause of the bug was a dangling COM object registration for the CrossDevice COM object with the CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}. A COM registration typically needs two parts: a server executable, which for in-process components is a DLL and a CLSID entry under the HKEY_CLASSES_ROOT registry key which points to that DLL.  ( 6 min )

Cloud threat emulation is more than detonation. A plan-first methodology for cloud detection engineering: scope, victim model, telemetry, coverage, cleanup. Learn how to properly leverage AI to automate your emulations.  ( 123 min )

A practical guide to red team planning, risk management, rules of engagement, scoping, communication and operational safety for better assurance.

A practical guide to red team planning, risk management, rules of engagement, scoping, communication and operational safety for better assurance.

Hello again, I’m back after a bit of a break from blogging (only 6 years mind… life got in the way, and insert other excuses here). I thought I’d pay attention to this site again as writing posts is a good way for me to keep up with the latest changes in information security. Here goes…  ( 2 min )

2026 Free CarPlay and Android Auto activation on Audi MMI. Covers compatibility across Audi models, firmware decoding. No dealer visit required.

2026 Free CarPlay and Android Auto activation on Audi MMI. Covers compatibility across Audi models, firmware decoding. No dealer visit required.

North Korean operators built a foothold on a DevOps engineer's Mac in a campaign whose job interview lures deliver malware via Terraform lock files.  ( 34 min )

North Korean operators built a foothold on a DevOps engineer's Mac in a campaign whose job interview lures deliver malware via Terraform lock files.  ( 34 min )

Ravenna's AI agents use Jamf Pro data and your team's runbooks to resolve Mac issues right in Slack.  ( 5 min )

What breaks first when IT scales? Usually, whatever one person quietly held together from memory.  ( 5 min )

Forking an existing C2 agent sounds faster than building from scratch. Bishop Fox learned otherwise. This post documents what happened when they forked Apollo, built a custom obfuscation pipeline to defeat EDR detection, and spent months fighting an architecture that was never designed for it.  ( 15 min )

Introduction Talkie Toaster is a character in the BBC sci-fi comedy Red Dwarf. He is an AI Toaster whose purpose in life is to be your cheerful breakfast companion and to provide you with all your toasting needs, only he is a little too obsessed with toasting. While only appearing in 4 episodes, he became […] The post Is AI toast? Building an AI Talkie Toaster appeared first on Pen Test Partners.  ( 17 min )

Security firms have published numerous blog posts describing how they pointed their agent harness at a codebase and found dozens of bugs (we’re one of them). However, these posts tend to focus on agentic code review, which is just one aspect of how we use AI in our security reviews. We want to give a different perspective: before code review even starts, agents now allow us to build custom tooling and formal models that improve the quality and depth of our reviews. We recently reviewed the Miden VM, a new zero-knowledge VM with its own custom assembly language and almost no developer tooling. To prepare, we spent six months having our agents build an LSP server, a decompiler, a static analysis engine, and a Lean model of the VM executor from scratch. These tools found real security issues,…  ( 8 min )

We linked one Elastic Security project to 100 others and ran the full prebuilt detection catalog from the origin, with all the ingest landing in the linked projects. It held up, and where it deliberately does not reach is the interesting part.  ( 74 min )

On September 23, 2026, Jamf Nation met in Kansas City, Mo., known for its legendary BBQ, live jazz and warm hospitality. Read on for a summary of the keynote featuring — for the first time — CEO Beth Tschida.  ( 17 min )

A preview of Serval's sponsor session at JNUC 2026.  ( 5 min )

TLDR: CiliumHound is a BloodHound OpenGraph extension for auditing Cilium network policies. It ingests a folder of JSON or YAML policies and creates a searchable, Kubernetes namespace-scoped graph. Introduction On some recent assessments, I’ve had to review large, complex Cilium network policies in a Kubernetes cluster, looking for ways in or out of isolated namespaces. […] The post CiliumHound: Graphing Kubernetes Network Policies appeared first on SpecterOps.  ( 21 min )

This post will explore what this new concept does, how it works with the new Account Access capability, and why a strong security posture still requires upgrading out of the sandbox.  ( 69 min )

Analyzing model input and output logs in an AI-native detection pipeline to understand and uncover malicious AI agent behavior  ( 73 min )

Attackers were exploiting MikroTik routers before fixes went public. Bishop Fox reproduced the full unauthenticated takeover chain, found persistence artifacts on real compromised devices, and breaks down what defenders need to investigate beyond patching to confirm they are actually clean.  ( 11 min )

How Brutus grew into an engine that finds your identities, tests them everywhere they’re accepted, and remembers what it confirms. An attacker rarely needs a novel exploit when a valid username and password pair is sitting in a breach dump, reused across a dozen internal services, or left at a vendor default nobody changed. Brutus […] The post Credentials Are Still the Shortest Path In appeared first on Praetorian.  ( 10 min )

TLDR: Exploit. This is a deterministic local privilege escalation affecting the default install of the latest Arch, Fedora, Debian, Amazon Linux and RHEL distributions, having unprivileged user namespaces enabled, openvswitch auto-loading, and a stock kernel carrying the Fragnesia fix. The issue has been public since 08/13/2026 on netdev, and the fix landed in mainline and shipped in stable on 09/04/2026. Introduction Earlier this year a small family of Linux kernel bugs appeared, starting with Copy Fail. Unlike standard memory corruption, their defining feature was that an unprivileged user could overwrite read-only memory mappings simply through legitimate operations, without any race condition or strict timing. That made privilege escalation to root relatively trivial. Copy Fail was fol…  ( 16 min )

Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs. For the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn’t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that tru…

A penetration testing scope defines the assurance an enterprise needs, not just the assets a vendor will touch. Start with the business or compliance objective, then map the system boundary before counting assets. List applications, APIs, infrastructure, roles and integrations separately, specify authenticated and unauthenticated testing, and clarify whether production, staging or both will be […] The post How to Scope an Enterprise Penetration Test: Free Scope-of-Work Template appeared first on Synack.  ( 32 min )

AI agents have legitimate access to your systems and the ability to act on them. Learn how to keep your data protected with four AI controls.  ( 12 min )

TL;DR: The upcoming Ghostwriter v7.3.0 release brings a major UI refresh to nearly every part of the application. The new design is easier on the eyes, more accessible, and better organized, with a new engagement bar, customizable sidebar with pinned work, a completely redesigned dashboard, and a plethora of other changes. Introduction As it is […] The post Ghostwriter v7.3.0: A Fresh New Look appeared first on SpecterOps.  ( 14 min )

Two Hugging Face accounts reveal that OpenAI's agents staged relay code, internal probes and ChatGPT account registration beyond the published timeline.  ( 35 min )

Two Hugging Face accounts reveal that OpenAI's agents staged relay code, internal probes and ChatGPT account registration beyond the published timeline.  ( 35 min )

Amazon's same-day delivery works because its AI is governed. This AWS session at JNUC 2026 shows how to bring that same control to enterprise AI on Amazon Bedrock.  ( 5 min )

The post Multiple Vulnerabilities in Frappe LMS Leading to Remote Code Execution appeared first on Rhino Security Labs.  ( 6 min )

Third-party penetration testing means two different things: testing your own organization through an independent provider, and testing or reviewing testing on a supplier, partner, or acquisition target. This guide focuses on the second use case. It works best as a governed risk process, not a document request, built on clear authorization, risk-based scope, defensible evidence, and contractual follow-up. The post Third-Party Penetration Testing: What Security and Procurement Teams Need to Know appeared first on Synack.  ( 23 min )

Continuing to deepen the integration between Wiz Defend and Google Security Operations, helping teams work faster wherever they choose to investigate  ( 64 min )

1Password’s FLAWED report, published on August 6, 2026, gives defenders a misleading picture of AI patching. Its headline says models produced clean fixes only 26% of the time. That figure includes experiments that deliberately instructed agents to apply the wrong fix, along with experiments in which agents could not compile or test their patches. The report risks making defenders less effective by discouraging them from using technology that could help them fix more vulnerabilities. Teams that take its headline at face value may leave repairable vulnerabilities unaddressed. We want our work to help defenders fix more vulnerabilities. This post shares real-world data on human and agent patch quality from our consulting projects and Patch the Planet. We’re also releasing two agent skills: p…  ( 9 min )

﷽  ( 2 min )

Attackers taking notes, garbage hidden in JSON, sandbox escapes and Ruby back in the news for the wrong reasons. 🏭 Countering misuse of AI: September 2026 / Anthropic 👍 0 This is a big report, and I think it's worth taking the time to read it. We spend a lot of time discussing whether AI can find vulnerabilities. Meanwhile, the attackers described here are using it to do much more: understand applications, use stolen credentials, write tools, and steal data. One detail I found particularly interesting is how they keep notes and reuse what they learn. They have agents working on different tasks, testing exploits in labs, and continuing the work while the humans are away. A lot of the ideas we discuss for building better AppSec workflows are already being used by attackers. And then the…  ( 6 min )

In my older post I covered Procmon findings for Win11_24H2 build. The 26H2 introduces 2 additional phantom DLL libraries:  ( 2 min )

OS 27 advances identity, autonomous management and visibility, plus family-focused tools shaping the future of education technology.  ( 7 min )

Apple's OS 27 release brings declarative management, new identity tools and real-time fleet visibility to IT admins.  ( 8 min )

This is a write-up of a bug chain in the IBM Db2 Mirror for i web interface. The chain starts without authentication, reaches arbitrary Java/JSP execution in the Liberty application server, and can then cross into QSECOFR on the local IBM i system.  ( 14 min )

Elastic Security Labs tracked this malicious browser extension across seven campaigns and 15 months, through Brazilian bank lures and the Ethereum smart contracts that hold its C2 configuration.  ( 141 min )

Synack's reporting experience now scopes to individual assets, generates AI-written executive summaries, and lets teams preview, save and share reports without leaving the platform. The post Executive-Ready Reporting Is Here: What’s New in the Synack Platform appeared first on Synack.  ( 17 min )

A misconfigured cluster join key in JFrog Artifactory's default install lets unauthenticated attackers mint a permanent admin token in one request. Bishop Fox reproduced the full chain, confirmed in-the-wild exploitation, and shares a non-invasive detection check and remediation guidance.  ( 10 min )

Seven of the thirteen Linux privilege escalation CVEs we tracked in 2026 turned out to be the same copy-on-write bug pointed at different kernel interfaces. We ran the public proof-of-concept for eleven exploits and two misconfigurations, and noted which rules fired.  ( 141 min )

School IT teams don't write math curriculum, but the way they deploy, configure and secure devices shapes whether a numeracy program succeeds. Learn more.  ( 6 min )

Wiz Research has identified active, in-the-wild exploitation of three critical and high-severity vulnerabilities impacting JFrog Artifactory (CVE-2026-42016, CVE-2026-42018 & CVE-2026-82329). Attackers are chaining these vulnerabilities to bypass authentication and gain administrative control.  ( 69 min )

Delivering unified cloud security and accelerating secure modernization to protect citizen data and critical infrastructure.  ( 62 min )

TL;DR: Executing applications instead of scripts via SCCM’s deploy application feature will generate different artifacts due to the fundamental differences in the execution flow. While existing detection tools can catch script-based execution, they often miss stealthier methods. This post covers how to detect the more evasive SCCM application execution. Introduction: During BlackHat 2025’s offering of […] The post Unmasking SCCM Application Execution appeared first on SpecterOps.  ( 31 min )

A single unauthenticated request bypasses authentication on NetScaler Gateway and AAA virtual servers. Whether that means a dead-end session, a proxy into the internal network, or root on the appliance depends entirely on configuration. Bishop Fox maps every branch and shares a safe detection tool.  ( 15 min )

Change of Plan 9+ months. One unresolved vulnerability. One disclosure published today. Following a last-minute request from the affected vendor, we’ve temporarily taken the technical details offline and agreed to provide one final, limited window for remediation. We believe responsible disclosure goes both ways. The clock is running again ⏰  ( 2 min )

Before you sign with a penetration testing vendor, ask precise questions that turn marketing claims into measurable commitments. Confirm exact scope, learn which work is automated, AI-led, or human-led, and require that findings get reproduced and validated before they reach a report. Ask who can access your environment, how testers are vetted, and what the rules of engagement and stop conditions look like. Review sample reports, confirm remediation and retesting terms, and normalize every cost. Place every material promise in the contract rather than a slide deck. The post Questions to Ask a Penetration Testing Vendor Before You Sign appeared first on Synack.  ( 24 min )

How default keys, unauthenticated MCP sessions, and custom code guardrails expose cloud AI infrastructure to root-level remote code execution and IAM theft.  ( 76 min )

TL;DR Introduction Default printer configurations are common to find in internal infrastructure engagements. These configurations are usually insecure, exposing outdated protocols like SNMPv1 and web interfaces without requiring authentication. For an unauthenticated, internal attacker, this can be a treasure trove of information for later exploitation, sometimes including usernames, email addresses and file names: However, the […] The post Passing the bucks $$$: Passback attacks explained appeared first on Pen Test Partners.  ( 8 min )

Jamf lets you extend infrastructure as code to Apple endpoint management. With Terraform providers across Jamf Pro, Jamf Protect, Jamf School, and Jamf Security Cloud and backed by a unified Platform API Gateway, you can declare your entire Jamf environment in code, ship peer-reviewed changes through a pipeline and roll back with a single Git command.  ( 8 min )

Fermat famously claimed to have a “truly marvelous proof” of his Last Theorem, but he never wrote it down, insisting the margin of his page was too narrow to contain it. A few centuries later, Anthropic announced a complete formalization of Fermat’s Last Theorem using 13 million lines of Lean code (clearly not what Fermat intended). Luckily, we found a wonderfully cursed Lean bug, shown below, that suggests the proof may have fit the margin after all. The issue affects all stable versions of Lean up to 4.33.1, and the patch is incorporated in v4.34.0-rc1. A “checked” proof of Fermat’s Last Theorem using Lean 4.33.1 The blue checkmarks in the screenshot above would suggest that Lean considers this proof correct. This seems odd given the amount of work Sir Andrew Wiles put into this probl…  ( 2 min )

Agentic AI SOCs differ from copilot-only models by autonomously prioritizing attacks over alerts, executing closed-loop containment, and providing traceable reasoning for every decision, allowing analysts to focus on high-value investigations.  ( 111 min )

Jamf is named a Customers’ Choice in Gartner Peer Insights™ 2026 Voice of the Customer for Endpoint Management Tools.  ( 6 min )

Whelp, here we are. Deep into the new normal. With nearly 1,000 CVEs coming out from Microsoft and a healthy release from Adobe as well, there’s a phrase from my military days that comes to mind: embrace the suck. Take an extended break from your regularly scheduled activities as we take a look at the latest security patches from Adobe and Microsoft. If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for September 2026 For the first part of the August release, Adobe released 10 bulletins addressing 172 unique CVEs in Adobe ColdFusion, Acrobat Reader, Commerce (two bulletins), Campaign Classic, Experience Manager, Photoshop, Illustrator, Animate, and Adobe Photoshop Mobile. A total of 22 of these were submitted through the ZDI pr…

TL;DR: Tracking OAuth tokens is hard, but Token Analysis and Tracking System (TATS) can help. TATS will collect, store, decode, analyze and provide visual tracking for OAuth token exchanges. It was built to account for known OAuth deviations in the Microsoft ecosystem and will work with any OAuth implementation. This blog explores functionality along with […] The post Token Analysis and Tracking System (TATS) appeared first on SpecterOps.  ( 17 min )

TL;DR: The value of a red team engagement doesn’t end when the report lands. This post covers how to read findings for root cause, prioritize remediation, and build the improvement habit that makes each engagement more valuable than the last.  The engagement is complete. The objectives were well-formed, the report has landed, and the outbrief is done. Now what?  Red team results […] The post From Findings to Fixes: Getting Value from Red Team Results appeared first on SpecterOps.  ( 17 min )

Fitting lossless rainbow tables on a 4 TB disk and cracking NetNTLMv1 with WebGPU and ntlmrain. Google’s release of the NetNTLMv1 rainbow tables made it much more practical to recover an NT hash from a NetNTLMv1 response captured with the fixed challenge 1122334455667788, further reducing the needed compute power. NetNTLMv1 cracking is a problem I’ve kept returning to over the past several years. The recent table release prompted me to explore whether the process could be made cheaper, faster and easier to run. This post describes the result: a compact indexed table format, a WebGPU browser client and a native command-line tool. Highlights This post explains a new ntlmrain rainbow table layout. We are publicly releasing a browser tool and command-line client together with the optimized tables. Read full post The post NetNTLMv1 Is Dead. Long Live NetNTLMv1. appeared first on Outflank.  ( 15 min )

Fitting lossless rainbow tables on a 4 TB disk and cracking NetNTLMv1 with WebGPU and ntlmrain. Google’s release of the NetNTLMv1 rainbow tables made it much more practical to recover an NT hash from a NetNTLMv1 response captured with the fixed challenge 1122334455667788, further reducing the needed compute power. NetNTLMv1 cracking is a problem I’ve kept returning to over the past several years. The recent table release prompted me to explore whether the process could be made cheaper, faster and easier to run. This post describes the result: a compact indexed table format, a WebGPU browser client and a native command-line tool. Highlights This post explains a new ntlmrain rainbow table layout. We are publicly releasing a browser tool and command-line client together with the optimized tables. Read full post The post NetNTLMv1 Is Dead. Long Live NetNTLMv1. appeared first on Outflank.  ( 15 min )

Many healthcare organizations have been told that HIPAA requires an annual penetration test. The current rule is more nuanced. Penetration testing for HIPAA compliance is not prescribed as one universal annual obligation, but regulated entities must conduct a comprehensive risk analysis, manage identified risks, and evaluate whether their safeguards remain effective. A well-scoped pentest can provide important evidence supporting those responsibilities. HHS has also proposed making annual penetration testing explicit, although that proposal is not yet binding. The post HIPAA Penetration Testing Requirements for Healthcare Enterprises appeared first on Synack.  ( 26 min )

Many security bugs are race conditions, where multi-threaded execution has to occur with the right interleaving for a negative effect to appear. This creates challenges for several use cases: Confirming bug candidates that have been discovered manually or through static analysis. Regression tests: After fixing a race condition bug, there is often no good way to write a regression test that reliably triggers the bug as part of a test suite. Automatic bug discovery, such as fuzzing: It is hard for a fuzzer to exercise all interesting interleavings of concurrent operations, or reach code paths that are only exercised when operations are racing.  ( 12 min )

JSON Web Tokens (JWTs) are everywhere in modern authentication, and for good reason: they are compact, self-contained and easy to pass around between services. The catch is that a lot of their security depends on how you use them. If you rely on a well-maintained JWT library, the hardest cryptographic parts are handled for you, but a handful of practical decisions are still yours to get right. This post is aimed at developers who use a JWT library rather than write one. We will walk through the practical steps that make the difference between a token you can trust and one an attacker can bend, starting with the single most important one. 1. Always pin the algorithm This is the one to get right before anything else. A JWT carries the algorithm it was signed with in its header, in the alg at…  ( 7 min )

The core components required to move from automated discovery to proven risk now exist: capable models, controlled execution, scalable orchestration, evidence capture and human judgement. The opportunity is to engineer them as one dependable system rather than treat each as a standalone feature. The post AI Can Find Vulnerabilities. Building a System That Proves Risk Is the Hard Part. appeared first on Synack.  ( 17 min )

﷽  ( 13 min )

Some tips for using older models and configs for Claude Code

Some tips for using older models and configs for Claude Code

ServiceNow tradecraft, Claude bitten by a snake, and SAML identities in the wrong database. ❄️ When it Snows it Pours - Anatomy of a ServiceNow Red Team - MDSec 👍 0 Detailed write-ups covering a full ServiceNow engagement are still relatively scarce. MDSec shares a lot here: privilege escalation, persistence, credential extraction, access to internal MID servers and the detection gaps encountered along the way. There are scripts, table names and explanations of how the different features fit together. One example starts with catalog_admin, which allows scripts in catalog access criteria. Those scripts cannot directly grant admin, but they can grant action_designer, which provides system-context scripting. A useful reminder to follow what a role lets you become, as well as what it lets …  ( 5 min )

﷽  ( 14 min )

Read on to learn more about recent updates to Jamf Premium Support, including the introduction of Technical Account Managers (TAM), Training Passes, and more support tiers.  ( 7 min )

Getting data into a security platform is always easy; getting it back out is where vendors add cost, extra tooling, and latency, and it is the part of the evaluation most teams overlook.  ( 89 min )

Azure has been growing rapidly over the past few years As of June 2026, there were over 200 services, 897 built-in Azure RBAC roles, and 22,018 different permissions. The attack surface of Azure has also increased with this growth. There are also a number of new and updated tools that give us insight into the The post Modern Adventures in Azure Privilege Escalation appeared first on NetSPI.  ( 21 min )

Two fields join the Kubernetes API to what ran inside the pod, and one turns up a container escape your process events never recorded.  ( 105 min )

You know what you spent on penetration testing last year. But can you explain what that investment covered between engagements? For many organizations the honest answer is that it covered the weeks the testers were working against a scope agreed before they started. That was a reasonable arrangement when systems changed a few times a year. It is worth revisiting, now that many of them change weekly. The post Offensive Security Is Becoming a Program, Not a Purchase appeared first on Synack.  ( 21 min )

Today, SpecterOps released a new open-source skills marketplace for offensive security research and red team operations. We are proud to have collaborated on this project over the last few weeks and hope more teams will join now that it’s public. The initial release includes plugins for Fortra’s Cobalt Strike and Outflank C2. Get started here: https://github.com/SpecterOps/skills Background I recently reached out to a few red teams we’ve worked with before to discuss developing a public AI marketplace focused on offensive security. I was inspired by the Trail of Bits marketplace and wanted to see a similar project for offensive security. This task was too large to take on alone, so I contacted a few other researchers to discuss a joint effort. Imagine my surprise when SpecterOps told me they were nearly done implementing a similar project! Tags: AI Read full post The post Red Team AI Skills appeared first on Outflank.  ( 6 min )

Azure Fabric Backdoor With A Twist  ( 15 min )

State of the Art of Private Key Security in Blockchain Ops - 4. Approvals and Policies  ( 13 min )

No content preview  ( 7 min )

David Brauchler III delivers a fascinating Black Hat talk on the root cause of AI-based vulnerabilities and why security architecture is the real solution.  ( 7 min )

MCP Bridge Upgrade  ( 7 min )

Black Hole of Trust: SEO Poisoning in Silver Fox’s Space Odyssey  ( 7 min )

State of the Art of Private Key Security in Blockchain Ops - 3. Private Key Storage and Signing Module  ( 12 min )

The Symbols of Operation code data confusion ada lovelace  ( 6 min )

Public Report: AWS EKS Security Claims  ( 7 min )

Public Report: Google Private AI Compute Review  ( 7 min )

State of the Art of Private Key Security in Blockchain Ops - 2. Common Custody Solutions Architectures  ( 12 min )

Legacy Technology in Transport: More Than “Old Tech”  ( 7 min )

No content preview  ( 14 min )

Concepts, Types of Wallets and Signing Strategies  ( 12 min )

Bridging the Valley of Death: How Assurance Takes Us from Proof of Concept to Minimum Viable Product  ( 7 min )

Goal-Based Regulation  ( 7 min )

Unmasking Techno Sophists  ( 6 min )

Public Report: VetKeys Cryptography Review  ( 7 min )

Your point of departure for forensic readiness - Digital Forensics Incident Response  ( 10 min )

Euro 7, Anti-tampering, and the Expanding Cybersecurity Landscape  ( 6 min )

Discover how ransomware affects patient care, with insights from NCC Group on clinical vulnerabilities and sector trends.  ( 16 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 8 min )

No content preview  ( 6 min )

No content preview  ( 13 min )

This article details a vulnerability in Java Web Start that allows file inclusion through manipulated system properties.  ( 10 min )

No content preview  ( 7 min )

No content preview  ( 9 min )

No content preview  ( 8 min )

No content preview  ( 9 min )

No content preview  ( 7 min )

No content preview  ( 10 min )

Hackproofing Lotus Domino Web Server  ( 6 min )

No content preview  ( 24 min )

No content preview  ( 6 min )

Explore how a command injection flaw in Citrix Access Gateway could allow attackers to execute arbitrary system commands.  ( 9 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 9 min )

No content preview  ( 7 min )

No content preview  ( 10 min )

No content preview  ( 6 min )

No content preview  ( 9 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 11 min )

No content preview  ( 7 min )

No content preview

No content preview  ( 11 min )

No content preview  ( 7 min )

No content preview  ( 11 min )

No content preview

No content preview  ( 30 min )

No content preview  ( 8 min )

No content preview

No content preview

No content preview

No content preview

No content preview

Discover how LDAPFragger uses LDAP attributes to evade network restrictions and exfiltrate data covertly.  ( 15 min )

No content preview

No content preview  ( 11 min )

No content preview  ( 6 min )

No content preview  ( 8 min )

Advanced SQL Injection in SQL Server Applications  ( 6 min )

No content preview  ( 10 min )

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 12 min )

No content preview  ( 7 min )

No content preview  ( 19 min )

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview  ( 7 min )

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview  ( 7 min )

A practical approach to neutralizing Log4j’s JNDI vulnerability without upgrading the entire library.  ( 12 min )

No content preview  ( 20 min )

No content preview  ( 7 min )

No content preview  ( 9 min )

No content preview

No content preview

No content preview

No content preview  ( 8 min )

No content preview  ( 6 min )

No content preview  ( 8 min )

No content preview  ( 6 min )

No content preview  ( 9 min )

No content preview  ( 19 min )

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview  ( 10 min )

No content preview  ( 16 min )

No content preview  ( 17 min )

No content preview  ( 6 min )

No content preview  ( 12 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 10 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 8 min )

No content preview  ( 7 min )

No content preview  ( 9 min )

Explore the introduction to exploiting CVE-2018-8611 in Windows Kernel Transaction Manager (KTM) with NCC Group’s expert analysis.  ( 23 min )

No content preview  ( 12 min )

No content preview  ( 6 min )

No content preview  ( 12 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 9 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 19 min )

No content preview

This post reveals how a simulated attack demonstrated the ease of breaching hospital systems using basic resources.  ( 13 min )

No content preview  ( 17 min )

Learn how anti-fuzzing techniques enhance defence-in-depth strategies and protect applications from fuzzing-based vulnerabilities.  ( 13 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

Explore the remote code execution flaw in ImpressPages CMS and learn best practices for vulnerability remediation.  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 10 min )

Learn how forensic techniques can recover deleted entries from the Windows Registry for investigation and analysis.  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 10 min )

No content preview  ( 7 min )

Discover how multivariate cryptography fits into the future of secure communications and what makes it unique among quantum-safe algorithms.  ( 21 min )

No content preview  ( 11 min )

Understand the mechanics behind SMB hash hijacking and user tracking in MS Outlook. Our advisory covers attack vectors, testing methods, and fixes.  ( 12 min )

No content preview  ( 10 min )

No content preview  ( 14 min )

No content preview  ( 12 min )

No content preview  ( 9 min )

No content preview  ( 18 min )

No content preview  ( 8 min )

No content preview  ( 13 min )

Discover how attackers could exploit memory handling flaws in OpenOffice.org to compromise system integrity and user safety.  ( 9 min )

No content preview  ( 9 min )

No content preview  ( 29 min )

No content preview  ( 7 min )

Explore a detailed breakdown of the Bybit hack, uncovering attack methods, vulnerabilities, and security lessons learned.  ( 15 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

Explore known XML-based attack methods including DTD abuse, schema exploits, and entity expansion vulnerabilities.  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 8 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

Nagios XI Network Monitor is vulnerable to blind SQL injection. Learn the impact, exploitation risks, and mitigation steps.  ( 7 min )

No content preview  ( 6 min )

A technical overview of NFC chip vulnerabilities and protection strategies for secure communication.  ( 15 min )

No content preview  ( 11 min )

Learn why CVE-2021-3156 poses a threat to VMware vCenter and how to protect your infrastructure from attacks.  ( 30 min )

No content preview  ( 9 min )

Explore how Yara can detect Authenticode timestamp anomalies in PE files and enhance malware analysis.  ( 10 min )

No content preview  ( 17 min )

No content preview  ( 7 min )

No content preview  ( 9 min )

No content preview  ( 9 min )

No content preview  ( 18 min )

No content preview  ( 11 min )

No content preview  ( 12 min )

No content preview  ( 12 min )

No content preview  ( 10 min )

No content preview  ( 11 min )

No content preview  ( 25 min )

No content preview  ( 10 min )

No content preview  ( 10 min )

No content preview  ( 16 min )

No content preview  ( 13 min )

No content preview  ( 8 min )

No content preview  ( 9 min )

No content preview  ( 17 min )

No content preview  ( 13 min )

Discover how fuzzing RTSP streams uncovered vulnerabilities in VLC and advanced secure software development.  ( 11 min )

No content preview  ( 15 min )

No content preview  ( 8 min )

No content preview  ( 27 min )

Insights from honeypot research on F5 TMUI RCE vulnerability. Understand attack patterns and steps to strengthen your security posture.  ( 14 min )

Discover how early-stage security planning in hardware and embedded systems can dramatically reduce attack surfaces.  ( 12 min )

No content preview  ( 16 min )

No content preview  ( 15 min )

No content preview

No content preview  ( 10 min )

A brief look at Windows telemetry: CIT aka Customer Interaction Tracker  ( 24 min )

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 9 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 6 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 8 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

NCC Group explains why pen test prerequisites are essential for accurate, efficient, and secure web application assessments.  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 9 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 8 min )

E-mail Spoofing and CDONTS.NEWMAIL  ( 7 min )

No content preview  ( 8 min )

No content preview  ( 6 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 10 min )

No content preview  ( 7 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 8 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 7 min )

No content preview  ( 6 min )

No content preview  ( 11 min )

No content preview  ( 54 min )

Learn about multiple CVEs affecting Nuki Smart Locks and how to mitigate security risks for connected home devices.  ( 21 min )

No content preview  ( 11 min )

This technical advisory details how encoded URLs can be used to inject malicious HTTP headers in Oracle WebLogic Plug-in environments.  ( 12 min )

No content preview  ( 16 min )

No content preview  ( 12 min )

No content preview  ( 16 min )

No content preview  ( 10 min )

No content preview  ( 10 min )

No content preview  ( 11 min )

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview

No content preview