Ruby Central hired Trail of Bits to complete a security assessment and a competitive analysis of RubyGems.org, the official package management system for Ruby applications. With over 184+ billion downloads to date, RubyGems.org is critical infrastructure for the Ruby language ecosystem. This is a joint post with the Ruby Central team; read their announcement here! […]  ( 12 min )

Credential Guard in Windows Server 2025 enhances security by isolating credentials using Virtualization-Based Security (VBS). To enable Credential Guard with PowerShell or Group Policy, ensure your systems meet the hardware and firmware requirements. After enabling Credential Guard, you can use PowerShell to verify its activation. Source  ( 17 min )

TL;DR Access cards can be cloned There are practical measures to make card cloning difficult Practical guidance on how these systems work and why you should make sure they’re configured […] How easily access cards can be cloned and why your PACS might be vulnerable first appeared on Pen Test Partners.  ( 13 min )

Blog outlining the SANS Cloud Security Curriculum offerings and resources.  ( 18 min )

A blog summarizing the US Government’s OIG report on CISA’s Automated Indicator Sharing program  ( 18 min )

I asked myself what tangible artifacts present on a file system can immediately tell us that the server system in place is a Domain Controller and/or DNS server. I decided to run a simple experiment. I installed a test version … Continue reading →  ( 2 min )

Wells Fargo announces its public bug bounty program after several years of engaging the HackerOne community.  ( 4 min )

Learn how Deribit uses its HackerOne bug bounty program for its proactive security strategy.  ( 5 min )

Learn about administrative access and Remote Code Execution (RCE) exploitation from a recent Web Application Pentest. The post From Informational to Critical: Chaining & Elevating Web Vulnerabilities appeared first on NetSPI.  ( 12 min )

We have made it to the end of the year and the final Patch Tuesday of 2024. As expected, Microsoft and Adobe have released what (hopefully) will be their last patches of the year. Take a break from your holiday preparations and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for December 2024 For December, Adobe released a monstrous 16 patches addressing a whopping 167 CVEs in Adobe Experience Manager, Acrobat and Reader, Media Encoder, Illustrator, After Effects, Animate, InDesign, Adobe PDFL Software Development Kit (SDK), Connect, Substance 3D Sampler, Photoshop, Substance 3D Modeler, Bridge, Premiere Pro, Substance 3D Painter, and FrameMaker. The largest of…

Praetorian's open-source secrets detection tool, Nosey Parker, was released two years ago. Learn more about updates Nosey Parker and importance in today's environment. The post Nosey Parker Turns Two: Celebrating Two Years of Open-Source Secrets Discovery  appeared first on Praetorian.  ( 16 min )

The latest GA release of NAKIVO Backup and Replication v11 includes agentless backup support for a new hypervisor that has garnered significant interest: Proxmox. Let’s explore this and other new features in NAKIVO Backup and Replication v11. Source  ( 17 min )

Author: Lance B. Cain  ( 13 min )

Threat actors abused Visual Studio Code and Microsoft Azure infrastructure to target large business-to-business IT service providers in Southern Europe.  ( 36 min )

You just had your first encounter with the "Headless Chicken Effect" during a security incident, like we mentioned in our last blog post. Maybe you like to be prepared against any possible scenario because you know that it's not a matter of 'if', but rather a matter of 'when'? In this second blogpost in our "Ransomware Readiness" series, we'll look into how you can better prepare yourself to face such incidents in the future, whether it's through planning, documentation, or testing.  ( 14 min )

私がいつも言っている通り、「攻撃者は怠け者」です。要は、彼らは常に最も抵抗の少ない道を進むのです。防御側が彼らの戦術、技術、手順を習得するにつれ、攻撃能力と防御能力の非対称的なギャップは縮小し、攻撃者は戦場、戦略の変更を余儀なくされ、何度も繰り返されるゲームは延々と続くことになります。  ( 10 min )

This year, SANS hosted 13 Summits from OSINT, ICS, Ransomware, DFIR to HackFest. Here were the top-rated talks of the year.  ( 16 min )

The U.S. government has embraced HackerOne's recommendations for the new federal AI procurements guidance.  ( 5 min )

By Matt Schwager and Travis Peters We are publishing another set of custom Semgrep rules, bringing our total number of public rules to 115. This blog post will briefly cover the new rules, then explore two Semgrep features in depth: regex mode (especially how it compares against generic mode), and HCL language support for technologies […]  ( 15 min )

Microsoft’s new AI Shell integrates AI into command-line workflows, featuring the Azure OpenAI Agent and Copilot in Azure Agent for tasks like PowerShell scripting and cloud automation. You can install AI Shell (aish.exe) as a standalone app or PowerShell module to streamline coding, error resolution, and resource management on Windows, macOS, or Linux. Source  ( 16 min )

Bishop Fox ASM team gives customers a 24-hour head start against critical PAN-OS vulnerability  ( 7 min )

Your door access control system (aka a physical access control system or PACS), also referred to as RFID cards or ‘swipe’ cards often have a poor reputation for being vulnerable […] Making sure your door access control system is secure: Top 5 things to check first appeared on Pen Test Partners.  ( 6 min )

A blog about the EU's new financial sector cybersecurity regulations, DORA and TIBER-EU  ( 20 min )

This old series is not very exciting. Decompiling goodware installation scripts will never lead us to newsworthy discoveries – feel free to stop reading now. Many installers copy files, add/change registry keys and values, install services, drivers, and do all … Continue reading →  ( 2 min )

No content preview  ( 4 min )

If you have ASRock Polychrome RGB installed on your system you may find this interesting executable in one of its subfolders: c:\Program Files (x86)\ASRock Utility\ASRRGBLED\HAL\ExecCmd64.exe It is signed: Verified: SignedSigning date: 2:11 AM 3/16/2023Publisher: ASROCK INC.Company: n/aDescription: n/aProduct: n/aProd version: … Continue reading →  ( 2 min )

Last week Leon Derczynski described how LLMs can output ANSI escape codes. These codes, also known as control characters, are interpreted by terminal emulators and modify behavior. This discovery resonates with areas I had been exploring, so I took some time to apply, and build upon, these newly uncovered insights. ANSI Terminal Emulator Escape Codes Here is a simple example that shows how to render blinking, colorful text using control characters.  ( 6 min )

Active Directory is a core element of most lab environments, and it’s often essential to populate it with realistic data, especially for user accounts. These accounts should feature values for key attributes to reflect a functional directory. Fake user data is available in CSV format, but you'll need to clean it before importing into the directory. Source  ( 18 min )

This is a blog post by Erik Szinai, who worked with us as an intern during the last couple of months. We hope our readers will find his contribution to the Burp Suite ecosystem useful!  ( 8 min )

A blog about the EU's new financial sector cybersecurity regulations, DORA and TIBER-EU  ( 19 min )

No content preview  ( 5 min )

Windows Server 2025 introduces significant improvements for Active Directory, including increased scalability thanks to the Jet database's 32K pages. New Server 2025 forests can immediately leverage this feature, whereas existing domains must be raised to the new functional level before you can enable the 32K database. Source  ( 17 min )

TL;DR Secure boot ensures only authentic firmware can run on a device and should form part of a layered defence strategy. Sub-systems often lack secure boot capabilities, limiting protection for non-critical […] Is secure boot on the main application processor enough? first appeared on Pen Test Partners.  ( 7 min )

A blog about analyzing user data in virtual address descriptors.  ( 32 min )

AWS has launched a feature that allows a single security group to be associated with multiple VPCs and shared across AWS accounts within the same organization. These updates facilitate the centralized management of security group rules, ensuring consistent traffic control across various VPCs and accounts. Source  ( 17 min )

HTTP cookies often control critical website features, but their long and convoluted history exposes them to parser discrepancy vulnerabilities. In this post, I'll explore some dangerous, lesser-known  ( 5 min )

New to cybersecurity? Start with the ABCs of Cybersecurity—a simple, beginner-friendly guide that breaks down key concepts like authentication, backups, and cloud security. From Active Defense to Zero Knowledge, learn the basics and prepare yourself for a successful journey in cybersecurity with this essential resource.  ( 13 min )

A blog about the EU's new financial sector cybersecurity regulations, DORA and TIBER-EU  ( 24 min )

Hai, HackerOne's AI copilot has 3 new capabilities: Hai analytics, contextual conversations, and an enhanced user experience.  ( 5 min )

The WolfBox E40 is a Level 2 electric vehicle charge station designed for residential home use. Its hardware has a minimal user interface, providing a Bluetooth Low Energy (BLE) interface for configuration and an NFC reader for user authentication. Typical for this class of devices, the appliance employs a mobile application for the owner's installation and regular operation of the equipment. At the moment of writing, the software versions were reported as follows: ·      Main module: 3.1.17 ·      MCU module: 1.2.6 ·      Mobile application: 1.0.3 WolfBox EV Mobile Application The manufacturer distributes one application to configure and maintain the device. The application, named WolfBox EV, is available for both Android and iOS users. Figure 1 - Application Start Screen Interestingly, t…

Binarly’s Alex Matrosov and Fabio Pagani present PKfail, a firmware supply-chain security issue affecting major device vendors and hundreds of device models.  ( 23 min )

A warning is circulating on social media regarding Microsoft utilizing customer data from its Microsoft 365 applications—such as Word, Excel, and Outlook—for training its AI models. Microsoft has addressed these concerns on X and Bluesky, which seems to have reassured most journalists who reported on the incident across various news platforms. Nonetheless, I highly advise disabling all "connected experiences that analyze your content" in your Office apps or for your entire organization via Group Policy. Source  ( 18 min )

The post CloudGoat Official Walkthrough Series: ‘sqs_flag_shop’ appeared first on Rhino Security Labs.  ( 5 min )

Introduction On a recent Red Team for a particularly hardened client, we were looking to escalate our privileges in order to move off the endpoint and pivot into the server... The post Extracting Account Connectivity Credentials (ACCs) from Symantec Management Agent (aka Altiris) appeared first on MDSec.  ( 21 min )

Or, “Yet another ransomware blog post?” “Yet another ransomware blog post?” I hear you asking. Well, yes! Besides, Ransomware attacks have been on the rise again costing affected organizations and industries more than ever. Let’s dive into some numbers to set the stage: According to IBM and Ponemon institute, in 2024, the average cost of a … Continue reading Building Cyber Resilience Against Ransomware Attacks →  ( 16 min )

Introduction When a breach happens, it’s not just technical defences that matter. Preparation in non-technical areas, like having key documents printed or emergency contacts accessible, can make all the difference. […] 6 non tech things you wish you had done before being breached first appeared on Pen Test Partners.  ( 7 min )

This is a bug fix version. 1768_v0_0_22.zip (http)MD5: 6446F5C09BF70FAFBB3171734844B350SHA256: 4716A4A72FB4C0265CAF541D5FF709615B9CB4129C20C98F1BBA535AA5D40717  ( 11 min )

A blog about the major updates to the SOF-ELK digital forensics and incident response tool.  ( 19 min )

Doyensec’s Maxence Schmitt recently built a playground to go with his CSPT research. In this blog post, we will demonstrate how to find and exploit CSPT bugs with Eval Villain. For this purpose, we will leverage the second challenge of Maxence’s playground. A step-by-step intro to CSPT with Eval Villain The next image shows what this methodology yields. We’ve added some boxes and arrows in orange to better illustrate the current situation. First, Eval Villain saw that part of the page’s path is being used in a fetch request. There, you can plainly see the asdf%2f.. was being URL decoded. Or if you prefer, you can expanded the “Encoder function” group to check. Either way, Eval Villain had discovered the CSPT sink. The second square is on top of a debug statement from evSourcer. This was…  ( 7 min )

Is your organization ready for a bug bounty program? These 5 questions will help assess your security program's bug bounty readiness.

By Luca Ginex Overview This post discusses CVE-2024-38193, a use-after-free vulnerability in the afd.sys Windows driver. Specifically, the vulnerability is in the Registered I/O extension for Windows sockets. The vulnerability was patched in the August 2024 Patch Tuesday. This post describes the exploitation process for the vulnerability. First, we give a general overview of the ... Read more Windows Sockets: From Registered I/O to SYSTEM Privileges The post Windows Sockets: From Registered I/O to SYSTEM Privileges appeared first on Exodus Intelligence.  ( 11 min )

Hotpatching in Windows Server 2025 allows admins to apply critical updates without restarting the system. Hotpatching is available in the Standard and Datacenter editions of Windows Server 2025. It can be used in on-premises environments, the Azure cloud, or virtual servers with VMware or Hyper-V, provided that Virtualization-Based Security (VBS) is supported. Source  ( 16 min )

Discover Bishop Fox in-depth analysis of SonicWall firewalls, revealing critical insights into firmware security and vulnerability.  ( 9 min )

Here is an overview of content I published in November: Blog posts: Update: pdfid.py Version 0.2.9 Update: pdf-parser.py Version 0.7.10 Update: xmldump.py Version 0.0.9 Update: strings.py Version 0.0.10 Quickpost: The Electric Energy Consumption Of A Wired Doorbell Update: base64dump.py Version 0.0.26 Quickpost: The Electric Energy Consumption Of A Soundbar Interfacing With A Cheap Geiger Counter […]  ( 11 min )

The ShellExec_RunDLL API is now exposed by both shell32.dll and windows.storage.dll. It is not the only curiosity about this function. Analysing its code one can discover that is accepts a secret command line argument. If we provide a question mark … Continue reading →  ( 2 min )

About two weeks ago, DeepSeek released a new AI reasoning model, DeepSeek-R1-Lite. The news quickly gained attention and interest across the AI community due to the reasoning capabilities the Chinese lab announced. However, whenever there is a new AI I have ideas… Apps That Hack Themselves - The 10x Hacker There are some cool tests that can be done when pentesting LLM-powered web apps, I usually try some quick fun prompts like this one:  ( 3 min )

In my last post I have shown that some of the shell32.dll functions are now mapped to windows.storage.dll. This sort of API mapping, as well as blatant code redundancy present in many Windows binaries is not new, and we have … Continue reading →  ( 2 min )

Microsoft announced the public preview of VM watch, a new in-VM service designed for Azure Virtual Machines (VMs) and Virtual Machine Scale Sets (VMSS). This service aims to enhance VM health monitoring by offering standardized, lightweight, and flexible in-VM health checks that connect seamlessly with Azure's monitoring and AIOps systems. Source

This is a bit surprising, but the recent versions of windows.storage.dll export a number of functions identical with shell32.dll. In fact, shell32.dll imports these windows.storage.dll functions and is basically forwarding the execution to them, and just acting as a proxy. … Continue reading →  ( 2 min )

This a weird post; it doesn’t give many answers and it pretty much focuses on describing results of a simple task of data hoarding… When people think of a ‘browser’ they usually think of a software like Chrome, Safari, Firefox, … Continue reading →  ( 3 min )

In an earlier post, I explored the features introduced in Docker Desktop 4.34. Here, I’ll delve into what’s new in Docker Desktop 4.35. Source

Security leaders at REI, AS Watson, and Mercado Libre explain why retail and e-commerce organizations trust security researchers.  ( 6 min )

With Windows 11 23H2, the Local Administrator Password Solution (LAPS) became integrated into the OS, and 24H2 brings several interesting new features. These features include the automatic management of local admin accounts, the implementation of passphrases, and the automatic generation of a new password following a computer reset. Source

Explore concerns around API security, its unique vulnerabilities, and the need for tailored protection against evolving threats in an API-driven world.  ( 8 min )

TL;DR Take lessons learned from investigation, such as reviewing how emails evaded existing phishing controls to update anti-malware policies.   Configure Defender for Office and Defender for Cloud Apps threat and […] BEC-ware the Phish (part 3): Detect and Prevent Incidents in M365 first appeared on Pen Test Partners.  ( 10 min )

Learn about the new NIS2 Directive requirements and how to achieve compliance through pentesting, VDP, and bug bounty.  ( 7 min )

Dr. Cristina Cifuentes, known as the Mother of Decompilation, reflects on three decades of innovation in reverse engineering in her LABScon 2024 keynote.  ( 23 min )

In May 2024, Microsoft introduced the Windows Recall, which captures screenshots of user activity. Following significant criticism over privacy and security concerns, its rollout faced multiple delays. Microsoft has now reintroduced Recall in the latest Windows 11 Insider Preview, making it available to Windows Insiders in the Dev Channel who use Copilot Plus PCs equipped with Qualcomm’s Snapdragon X series processors. Its reinstatement raises fresh concerns about whether such intrusive technology should exist at all, given its potential for misuse and privacy concerns. Source

Many enterprise laptops use BitLocker to provide full disk encryption (FDE) to protect sensitive data from exposure if the laptop were stolen. But how adequate is the default implementation of BitLocker to protect data at rest in this scenario? The security of all encryption relies on protection of the key material. A common assumption is … Continue reading Wake up and Smell the BitLocker Keys →  ( 12 min )

In the world of wireless communications, security vulnerabilities in implemented protocols canremain hidden behind layers of complexity. What appears secure due to the intricate nature ofRF communications may harbor fundamental weaknesses. Let’s dive into a fascinating casethat reveals how a seemingly minor cryptographic weakness in frequency hopping algorithmscan compromise an entire wireless communication stream. Understanding […] The post RF Fortune Telling: Frequency Hopping Predictability appeared first on Praetorian.  ( 16 min )

A blog about the new SANS course, SEC545: GenAI and LLM Application Security  ( 12 min )

This blog post features a list of 17 of the best cybersecurity podcasts, covering everything from hacking and malware to data breaches and privacy. Whether you're a security professional or just someone who wants to learn more about cybersecurity, these podcasts are sure to keep you informed and engaged.  ( 14 min )

Read the top 5 learnings attendees gained by joining one of our Security@ 2024 World Tour events.  ( 5 min )

Microsoft is enhancing Windows 11’s authentication capabilities by updating the Web Authentication API (WebAuthn) to support third-party passkey providers, which can work alongside Windows Hello to leverage biometric methods and public key cryptography, aligning with the FIDO2 standard for passwordless authentication. Source

A loose collective of mostly low-skilled actors, CyberVolk absorbs and adapts a wide array of destructive malware for use against political targets.  ( 31 min )

There’s always plenty of news on cyber threats to discuss, and this month was no exception.  ( 13 min )

When all items are selected with -s A and option -d from this new version on, items are decoded and dumped to stdout en separated by end-of-line character(s). base64dump_V0_0_27.zip (http)MD5: 6C3AE99A7FA0C525FF17B938A632AE53SHA256: CDD84F574E25C93675BC0C14D954B59799B1FFEECC253A906B72A6DD669BDF4C  ( 11 min )

Many people believe that native Windows programs are so deeply integrated with OS that there is no way to move them between these different OS versions. And it’s fair to say that at first this belief was reinforced by that … Continue reading →  ( 3 min )

Debugging Service Processes on Windows is a bit tricky – the old IFO / Debugger trick doesn’t work anymore, because services run in their own session. Also, when you attempt to debug a service process by attaching your debugger to … Continue reading →  ( 4 min )

Microsoft Entra Private Access aims to replace traditional Virtual Private Networks (VPNs) while significantly enhancing security. Employing conditional access policies provides a more secure way to access private resources, ensuring only authorized users can connect to sensitive data and applications. In this blog, you will learn the critical features of Entra Private Access, how to configure it, and how to implement it together with conditional access policies. Source

I got a cheap Geiger counter from Aliexpress: This picture was taken on an airplane: you have more radiation (cosmic rays) at high altitude. I figured out how to interface with this counter in Python to log real time data:  ( 13 min )

Gain insights into injection vulnerabilities, the different classifications, and potential security bypass techniques.  ( 12 min )

@import url(https://themes.googleusercontent.com/fonts/css?kit=4mNYFHt_IKFsPe52toizH4mR01TXY79of1zCqFsVTVk);.lst-kix_sm5qq1cfkkfw-5>li:before{content:"" counter(lst-ctn-kix_sm5qq1cfkkfw-5,lower-roman) ". "}.lst-kix_novl1in5rjiw-1>li:before{content:"- "}.lst-kix_sm5qq1cfkkfw-3>li:before{content:"" counter(lst-ctn-kix_sm5qq1cfkkfw-3,decimal) ". "}.lst-kix_sm5qq1cfkkfw-4>li:before{content:"" counter(lst-ctn-kix_sm5qq1cfkkfw-4,lower-latin) ". "}.lst-kix_sm5qq1cfkkfw-2>li:before{content:"" counter(lst-ctn-kix_sm5qq1cfkkfw-2,lower-roman) ". "}.lst-kix_novl1in5rjiw-0>li:before{content:"- "}ol.lst-kix_sm5qq1cfkkfw-0.start{counter-reset:lst-ctn-kix_sm5qq1cfkkfw-0 0}.lst-kix_sm5qq1cfkkfw-0>li:before{content:"" counter(lst-ctn-kix_sm5qq1cfkkfw-0,decimal) ". "}.lst-kix_sm5qq1cfkkfw-1>li:before{conte…  ( 18 min )

In our previous Kenwood DMX958XR blog post, we detailed the internals of the Kenwood in-vehicle infotainment (IVI) head unit and provided annotated pictures of each PCB. In this post, we aim to outline the attack surface of the DMX958XR in the hopes of providing inspiration for vulnerability research. We will cover the main supported technologies that present potential attack surfaces, such as USB, Bluetooth, Android Auto, Apple CarPlay, Kenwood apps, and more. We also provide a list of the open-source components the DMX958XR claims to use. All information has been obtained through reverse engineering, experimenting, and combing through the following resources: ·      Kenwood DMX958XR Product Page ·      Kenwood DMX958XR Instruction Manual [PDF] ·      Kenwood DMX958XR Quick Start Guid…

Azure Copilot, now in preview, introduces AI capabilities to streamline tasks across the Azure platform. Given that Copilot can execute substantial actions within Azure, limiting access to authorized administrators is essential. This responsibility mainly falls on Global Administrators (GAs) in Microsoft Entra ID. The following is a step-by-step guide for managing Azure Copilot access through PowerShell to ensure secure and controlled usage. Source

SentinelLabs has identified multiple deceptive websites linked to businesses in China fronting for North Korea's fake IT workers scheme.  ( 29 min )

I have a Samsung Neo QLED 65 inch TV. Its standby power consumption is pretty good: 1,3 Watt. It comes with a soundbar, and its standby power consumption is pretty awful: 5,5 Watt! Quickpost info  ( 11 min )

This is a bugfix version. base64dump_V0_0_26.zip (http)MD5: CD4370499288015C7EE13B59CB062129SHA256: 3EEB76875ECCA782293D4486286F8155D1BB04DF23E3D3433E36C6373389B81D  ( 11 min )

Learn how inadequate authentication logic led to an MFA bypass, plus 11 authentication best practices to prevent vulnerabilities like these.  ( 8 min )

No content preview  ( 5 min )

This post details the existing and new functions in BARK that support Azure Key Vault tradecraft research  ( 9 min )

Microsoft has recently enhanced Windows Sandbox, a feature that allows users to run applications in an isolated environment which enables you to safely test applications. Source

For the upcoming Pwn2Own Automotive contest, a total of four in-vehicle infotainment (IVI) head units have been selected as targets. One of these is the double DIN Kenwood DMX958XR. This unit offers a variety of functionality, such as wired and wireless Android Auto and Apple CarPlay, as well as USB media playback, wireless mirroring, and more. This blog post presents internal photos of the DMX958XR boards and highlights each of the interesting components. A hidden debugging interface is also detailed which can be leveraged to obtain a root shell. Internals The DMX958XR is a compact unit that contains multiple interconnected boards. Fortunately, the most interesting board is at the top of the unit and can be easily accessed by removing a few screws and metal plates. The topside of the mai…

By Artem Dinaburg AI-enabled code assistants (like GitHub’s Copilot, Continue.dev, and Tabby) are making software development faster and more productive. Unfortunately, these tools are often bad at Solidity. So we decided to improve them! To make it easier to write, edit, and understand Solidity with AI-enabled tools, we have: Added support for Solidity into Tabby […]  ( 13 min )

Six months ago, Broadcom made VMware Workstation and Fusion available free for private use. Now, the company has extended this offer to include free professional use. However, downloading the software from Broadcom's website remains challenging. Source

In the previous post, we introduced the concept of Third-Party Risk Management (TPRM) and its importance in today’s interconnected world. Now, let us have a look at the practical aspects of building a solid TPRM program and why it is important for your company. 1. Start with a Third-Party Inventory The first step in building … Continue reading The Importance of Establishing a Solid Third Party Risk Management Framework for Risk Mitigation →  ( 13 min )

TL;DR We helped Channel 4 with trying to track down rental scammers. We are not the police so we could only take it so far and any proving guilt or […] How we helped expose a £12 million rental scam first appeared on Pen Test Partners.  ( 9 min )

REI's senior application security engineer discusses their program success, evolving goals, and the value of the security researcher community.  ( 6 min )

Sysinternals Process Monitor is a sophisticated, free Microsoft tool for real-time monitoring of file systems, processes, threat activity, and the registry. It combines the features of two older Sysinternals utilities, Filemon and Regmon while introducing a wide range of enhancements. Microsoft has launched Process Monitor version 4.01, improving the user interface, upgrading performance, adding new functionalities, and fixing bugs. Source

A blog detailing in-depth research into women in Russian-speaking cybercrime.  ( 47 min )

Sometimes ‘research’ means browsing the folders of the ‘installed ‘target’ and… just executing programs present inside these directories to see what they do. During this very engaging and fascinating activity I noticed that the program: c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\OSSLLibs\AdobeFips.exe … Continue reading →  ( 2 min )

The Acrobat Reader is a very popular software installed on millions of computers worldwide. Today I noticed that anytime AcroRd32.exe program starts (tested with the latest version 24.4) it checks the following folder: c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Test_Tools\ looking for … Continue reading →  ( 2 min )

HAQL: HackerOne's simplified query interface for writing performant aggregate queries on tables modeled purposefully for data analysis.  ( 6 min )

View survey results and analysis of how AI in SecOps is impacting red and blue team operations.  ( 5 min )

In my latest article, I demonstrated how to use PowerAutomate to send SMS messages. I briefly mentioned that you can also receive SMS messages in Microsoft Teams, and in this article, I will outline a straightforward method for doing so.

A blog providing an infographic about the advancements in Zero Trust.  ( 9 min )

A blog providing an infographic on innovation in and the future of artificial intelligence.  ( 9 min )

A blog providing an infographic about strategies to help protect supply chains against modern security challenges.  ( 9 min )

Learn how to identify, understand, attack, and remediate SMB shares configured with excessive privilege in active directory environments with the help of new charts, graphs, and LLM capabilities. The post Hunting SMB Shares, Again! Charts, Graphs, Passwords & LLM Magic for PowerHuntShares 2.0 appeared first on NetSPI.  ( 21 min )

Windows Server 2025 introduces new pricing and licensing options, with notable updates to the Standard and Datacenter editions. License fees have increased by 10 to 20 percent.

The Windows Package Manager Winget is now included in Windows Server 2025. In this guide, I will demonstrate how to use Winget to search for, install, update, and uninstall apps on Windows Server 2025.

Read the official announcement on the PyPI blog as well! For the past year, we’ve worked with the Python Package Index (PyPI) on a new security feature for the Python ecosystem: index-hosted digital attestations, as specified in PEP 740. These attestations improve on traditional PGP signatures (which have been disabled on PyPI) by providing key […]  ( 14 min )

No content preview  ( 4 min )

Read how HackerOne's internal security team disproved an alleged MFA bypass with a targeted Spot Check.  ( 6 min )

Master cloud security by tackling this free series of workshops.  ( 41 min )

The Praetorian team recently discovered a new vulnerability in Ivanti Endpoint Manager (EPM) which serves as a reminder to be aware of legacy systems - patch regularly and test often. The post Skeletons in the Closet: Legacy Software, Novel Exploits appeared first on Praetorian.  ( 17 min )

By Simone Monica In January, we identified and reported a vulnerability in the Lotus and Venus clients of the Filecoin network that allowed an attacker to remotely crash a node and trigger a denial of service. This issue is caused by an incorrect validation of an index, resulting in an index out-of-range panic. The vulnerability […]  ( 12 min )

It’s not quite the holiday season, despite what some early decorators will have you believe. It is the second Tuesday of the month, and that means Adobe and Microsoft have released their regularly scheduled updates. Take a break from your regular activities and join us as we review the details of their latest security alerts.If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for November 2024 For November, Adobe released eight patches addressing 48 CVEs in Adobe Bridge, Audition, After Effects, Substance 3D Painter, Illustrator, InDesign, Photoshop, and Commerce. The largest of these fixes is for Substance 3D Painter with 22 Critical and Important CVEs. The next largest is the patch for Illustrator, with nine CVEs addressed. The…

Windows Server 2025 comes with SSH pre-installed, making secure remote server management easier for administrators. This is especially helpful when accessing servers from macOS or Linux machines or Windows computers not part of the Active Directory domain, as enabling PowerShell remoting can be complicated in this scenario. By default, SSH on Windows Server 2025 uses password authentication, which you should change to public key authentication for enhanced security.

We’re excited to announce that all of NCC Group’s latest research findings and articles are now hosted on our website at the following link: NCC Group Research Blog. (https://www.nccgroup.com/us/research-blog/) To stay up-to-date with our latest research, you can also subscribe to our RSS feed here: NCC Group Research Blog RSS Feed. (https://www.nccgroup.com/us/research-blog/feed/) Be sure to […]  ( 63 min )

This post explores Windows Side-by-Side (WinSxS) and DLL hijacking, deep-diving some tooling I've written and some of the fun along the way.  ( 10 min )

The term “special relationship,” coined by Winston Churchill, describes the close, longstanding alliance between the United States and the United Kingdom. It has been applied to cooperation during war, to trade and commerce, and even to intelligence sharing. That special relationship has clearly influenced the two nations’ recent policy papers on national cybersecurity. The U.K. […] The post Protecting Critical Infrastructure: A Tale of Two National Cybersecurity Strategies appeared first on Synack.  ( 7 min )

Scoping Adventures is a series of blogs about some of the more interesting penetration tests that the Synack Customer Success teams have worked on over the last few months. Each blog outlines how we engage with the client to achieve the best results from a pentest. Pentesters love colors—red, blue, purple, black, white and grey […] The post Scoping Adventures: How to Get the Most Out of Your Synack Pentesting appeared first on Synack.  ( 11 min )

The Synack Platform & Five Pillars of Strategic Pentesting Why You Need to Think Strategically It’s no great revelation that tactics, techniques, and procedures utilized by nefarious hackers hacking activities are evolving on a daily basis. In 2022, 18,828 common vulnerabilities and exposures (CVEs) were published. At the same time, organization attack surfaces are expanding. […] The post Applying Strategic Thinking in Your Pentesting Program appeared first on Synack.  ( 7 min )

One week ago, the Biden administration unveiled its long-awaited U.S. National Cybersecurity Strategy, with an eye toward centralizing government cyber resources and holding IT vendors more accountable for their digital defenses. Now that the ink is dry on the 35-page document, top officials like Acting National Cyber Director Kemba Walden are busy putting it into […] The post The U.S. has a new cybersecurity strategy. What’s next for CISOs? appeared first on Synack.  ( 7 min )