65 results for “TLS”

What you seeeverything

All types65 Write-ups23 Articles14 Papers11 Repos9 Advisories6 Courses1 Threads1

status.bunny.netadvisory🛡️ Security

Bunny CDN Security Incident

Bunny CDN status-page notice, posted 28 October 2026, about unauthorized access at an infrastructure provider that hosted one bunny.net CDN node in Armenia. Traffic was stopped within 20 minutes and the server wiped. No access to the node was found, but cached content, Pull Zone configs and TLS certificates could have been exposed, so all platform certificates were reissued. Customers with their own certificates should rotate them with new private keys.

Bunny CDNTLS

bunny.netb-cdn.netbunny.run

Threat Intel, Cloud & Infra· Added 31 Oct 2026, published 30 Oct 2026

securityweek.comarticle🛡️ Security

TLS Flaws Found in GoAhead Web Server Used in Hundreds of Millions of Devices

FoxIO disclosed three TLS flaws in the GoAhead embedded web server from EmbedThis, used on hundreds of millions of IoT, OT and network devices. CVE-2026-115881 (CVSS 9.1) leaves revoked client certificates accepted under mTLS with OpenSSL; CVE-2026-115884 (7.4) bypasses chain-length limits with LibreSSL; a third Mbed TLS bug (5.9, no CVE) weakens TLS 1.2 DHE. GoAhead 6.1.1 fixes the OpenSSL and Mbed TLS issues, and FoxIO released PoC code and fingerprints.

GoAheadOpenSSLMbed TLS+2

CVE-2026-115881CVE-2026-115884FoxIO+4

Hardware & RF, AppSec· Published and added 28 Oct 2026

aws.amazon.comarticle🛡️ Security

Introducing Route 53 Resolved IP Validation for AWS Network Firewall

Route 53 Resolved IP Validation for AWS Network Firewall, launched 21 October 2026 at no extra charge, has Route 53 Resolver share the IP addresses it returns per domain with Network Firewall, which checks each new outbound connection against them. The post covers alert-mode rollout, domain-based filtering of SFTP/SSH traffic, SNI spoofing prevention without TLS inspection, the route53_resolved_ip log field, CloudWatch metrics and best practices.

AWS Network FirewallAmazon Route 53 ResolverRoute 53 Resolver DNS Firewall+3

SNI spoofingRoute 53 Resolved IP ValidationDNS tunneling

Cloud & Infra, Blue Team & Detection· Added 28 Oct 2026, published 27 Oct 2026

ethresear.charticle🛡️ Security

Inventory of PQ P2P Migrations in the Consensus Layer

Inventory of post-quantum migration work for Ethereum consensus-layer networking, by adust09 of Nyx Foundation. It maps three targets: Discovery v5/ENR signatures and key exchange, TLS 1.3 key agreement in QUIC, and libp2p TLS identity binding and CertificateVerify. It covers the 300-byte ENR and 1,280-byte packet limits, why hybrid KEMs do not authenticate peers, and downgrade and DoS concerns. It selects no algorithm or schedule.

Ethereumlibp2pQUIC+3

ML-KEMECDSAFIPS 203+8

other· Published and added 27 Oct 2026

hackers-arise.comarticle🛡️ Security

Adaptix C2 Architecture: Configuring Command & Control Listeners

AdaptixC2 listener configuration guide, second in a Hackers-Arise series. It walks through the fields for BeaconDNS, Beacon HTTP, Beacon SMB, Beacon TCP and Gopher TCP listeners, including DNS burst mode, HTTP URIs, User-Agents and redirector callback addresses, SMB named pipes, TCP prepend data, and mTLS. It also explains external versus internal listeners for lateral movement.

AdaptixC2Windows

Hackers Ariseredirectormutual TLS+1

Offensive Security, Learning· Published and added 26 Oct 2026

eprint.iacr.orgpaper🛡️ Security

LINE-Break: Cryptanalysis and Reverse Engineering of Letter Sealing

LINE-Break is a security analysis of Letter Sealing v2, the custom end-to-end encryption protocol in the LINE messenger. A TLS man-in-the-middle attacker or malicious server can replay, reorder and block messages undetected, and colluding users can forge message authorship in one-to-one and group chats. Stickers and URL previews leak plaintext. The attacks were verified on the real iOS app and an independent implementation.

LINEiOS

Letter SealingLetter Sealing v2Diego F. Aranha+1

Mobile Security, Offensive Security· Published and added 26 Oct 2026

unit42.paloaltonetworks.comadvisory🛡️ Security

EMudhra Intermediate CA Certificates Compromised

Unit 42 advisory on the compromise of eight intermediate CA private keys belonging to Indian CA eMudhra Limited. The keys were generated with insufficient randomness, so attackers could derive them from the public certificates and sign rogue TLS certificates for MitM attacks. eMudhra has revoked the certificates and browser and OS vendors have untrusted them. Interim guidance covers PKI and trust store audits, reissuance, strict CRL/OCSP checking, log hunting, CT monitoring and CAA records.

Prisma BrowserJavaDocker+2

eMudhraUnit 42Palo Alto Networks Next-Gen Trust Security+1

Threat Intel, Blue Team & Detection· Added 30 Oct 2026, published 22 Oct 2026

x.comthread🛡️ Security

Paul Dragoonis (@dr4goonis) on X

Social post summarising emergency patches for Node.js (4 high CVEs), PHP (2 critical) and nginx (3 critical). Node.js flaws include a Brotli decoder out-of-bounds write, a DNS truncation bug and two TLS hostname-verification bypasses. PHP has use-after-free and heap corruption bugs, and nginx has alias-rewrite and map-regex heap overflows plus an SSI-AIO use-after-free. It lists the fixed versions for each product.

Node.jsPHPnginx

CVE-2026-111497CVE-2026-105482CVE-2026-105483+8

AppSec· Added 23 Oct 2026, published 22 Oct 2026

blog.talosintelligence.comadvisory🛡️ Security

Compromised eMudhra intermediate certificates

Cisco Talos describes eight eMudhra intermediate CA certificates (six TLS, two code signing) whose P-384 private keys were trivially recoverable because a flaw in an April 30, 2025 key generation ceremony produced weak keys with only 3 to 8 bytes of entropy. The post lists certificate SHA-256 hashes and serials, browser and Microsoft blocks, and the Go fix (CVE-2026-111943, Go 1.27.3 and 1.26.10) that filters chains by SPKI hash. It covers impact on VPNs, CI/CD and embedded devices, and Snort SIDs 67363 to 67374.

GoChromeVPN+3

CVE-2026-111943eMudhraemSign Root TLS CA - G3+8

Threat Intel, Cloud & Infra· Published and added 21 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Verifiable Post-Quantum TLS Handshake: Recognizing Implementation Errors of Cryptographic Verification Steps

PQCD-TLS is a post-quantum TLS handshake that binds confirmation codes into chained key derivation, so a faulty signature or KEM verification step causes a key mismatch and handshake failure. The authors build confirmation-code frameworks for ML-DSA and Falcon signatures and for ML-KEM, HQC and DAWN, with unpredictability proofs. Across 48 configurations, handshake latency overhead stays below 1%.

TLSML-DSAML-KEM

goto failPQCD-TLSFalcon+3

AppSec· Added 24 Oct 2026, published 21 Oct 2026

blog.cloudflare.comwriteup🛡️ Security

8 eMudhra certificates are compromised. Here's what you need to know

Cloudflare's incident post on the compromise of private keys for eight eMudhra intermediate certificates, disclosed 19 October 2026. The weak keys let an attacker forge certificates for any domain. It describes Cloudflare's patching of trust stores, WARP and cloudflared, tells developers to update the underlying TLS verifier and not disable verification, and points to Dennis Jackson's test site and revocation systems such as CRLSets and upki.

CloudflareCloudflare TunnelWARP+2

eMudhraDennis Jacksonupki+1

Cloud & Infra, Blue Team & Detection· Added 29 Oct 2026, published 20 Oct 2026

blog.cloudflare.comarticle🛡️ Security

Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities

Cloudflare's guidance on protecting Citrix NetScaler Gateway after the actively exploited CVE-2026-88771 (unauthenticated command execution) and CVE-2026-88772 (DTLS). It recommends putting Zero Trust access policies in front of the login page, locking the origin down with Tunnel, dedicated egress IPs, authenticated origin pulls or Access JWT validation, and adding WAF inspection. It ends with a four-step test list to confirm the boundary holds.

Citrix NetScalerCloudflareCloudflare Access+1

CVE-2026-88771CVE-2026-88772CISA+5

Cloud & Infra, Identity & Access· Added 29 Oct 2026, published 19 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Post-Quantum Certificate-Based PSK Provisioning for WireGuard via Mutual TLS, DTLS, and QUIC: Design and Performance Study

The paper proposes a post-quantum architecture for WireGuard that leaves the core protocol unchanged. A mutually authenticated TLS 1.3 control channel runs over TCP, UDP (DTLS) or QUIC and uses ML-KEM key establishment, with X.509 certificates from a PKI signed with ML-DSA. A shared secret derived from the session's exported keying material is injected into WireGuard's native PSK interface. A Tamarin model of the TLS–WireGuard composition layer checks secrecy, binding and provisioning-order properties and identifies the conditions needed for secure deployment. The authors benchmark handshake latency and CPU time for classical, pure-PQ and hybrid key establishment across the three transports, and compare against the Rosenpass PQ WireGuard baseline.

WireGuardVPN

ML-KEMML-DSARosenpass+5

other· Added 15 Oct 2026, published 14 Oct 2026

aws.amazon.comarticle🛡️ Security

Quantum-resistant signing on AWS, Part 2: Enforce your ML-DSA algorithm policy with SCPs and IAM

Explains how to turn a cryptographic algorithm policy (approve ML-DSA-65/87, exclude ML-DSA-44) into enforceable AWS controls using SCPs, IAM policies, permission boundaries and KMS key policies. The key lever is the kms:KeySpec condition key (kms:SigningAlgorithm can't distinguish variants, since all use ML_DSA_SHAKE_256), applied to CreateKey, ReplicateKey, Sign, Verify and GetPublicKey. It also covers surfaces without algorithm condition keys (AWS Private CA, ACM import, IAM server certificate upload, ELB TLS) via provisioning pipelines plus CloudTrail and AWS Config drift detection, and the default-allow risk of deny-lists.

AWSAWS KMSAWS IAM+3

ML-DSAFIPS 204NIST+2

Cloud & Infra, GRC· Published and added 12 Oct 2026

microsoft.comarticle🛡️ Security

Post-quantum authentication: Why organizations should start testing certificate ecosystems now

Microsoft Security Blog post arguing that post-quantum cryptography planning must extend beyond encrypted-data confidentiality to authentication and certificate ecosystems, since larger PQC certificate chains and new algorithms like ML-DSA-87 can break PKI workflows, HSMs, and legacy infrastructure. It details Microsoft's PQC TLS Pilot Program, launched August 27, 2026, which lets approved certificate authorities (ComSign, DigiCert, HARICA, IdenTrust, Sectigo, Shanghai Electronic Certification Authority, SSL.com) test ML-DSA-87 certificate issuance under the Microsoft Trusted Root Program, plus Windows 11 builds (KB5101681, KB5101684) that support evaluating ML-DSA certificates via Schannel in non-production environments. It lays out a six-step readiness plan: inventory certificate dependencies, map trust relationships, assess vendor roadmaps, identify long-lived infrastructure, build test environments, and plan a multi-year migration.

WindowsSchannelTLS

ML-DSAML-DSA-87PQC TLS Pilot Program+8

Identity & Access, GRC· Published and added 8 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Reverse-Bleichenbacher: Bleichenbacher Attacks are Practical Again

Presents Reverse-Bleichenbacher, a variant of the Bleichenbacher RSA PKCS#1 v1.5 padding-oracle attack that recovers the least significant bytes first and stops once the TLS PreMasterSecret is found. With improved trimmers and coverage-optimized search, median oracle queries against a 2048-bit key drop from 11,428 to 1,801, and 68.3% of runs finish within a 30s timeout under single-server conditions. The authors find 640 vulnerable domains in the Tranco Top 1M (many behind Alibaba Cloud load balancers) and demonstrate MITM malicious update injection leading to remote code execution.

TLSRSAPKCS#1 v1.5

Reverse-BleichenbacherBleichenbacher attackPreMasterSecret+3

Offensive Security· Added 11 Oct 2026, published 8 Oct 2026

hackers-arise.comarticle🛡️ Security

Bypass Web Application Firewall (WAF) with EvilWAF

Hackers-Arise walkthrough of EvilWAF, an open-source MITM proxy and standalone WAF vulnerability scanner that evades modern behavior-based WAFs by rotating TCP/TLS fingerprints (JA3/JA4) rather than altering attack payloads. It covers proxying sqlmap traffic through EvilWAF, its auto-hunt feature for discovering and routing directly to the real origin IP behind a WAF, and its scan-only mode that probes ten WAF defense layers (rule engine, rate limiting, HTTP method handling, TLS settings). The piece also discusses why Cloudflare's ML-based behavioral fingerprinting resists many of these bypass techniques.

EvilWAFsqlmapCloudflare+2

JA3JA4

Offensive Security, AppSec· Published and added 8 Oct 2026

decrypt.coarticle🛡️ Security

Europol Warns Crypto Wallets Are 'Primary Risk' for Quantum Attacks

Decrypt covers two Europol reports — "Quantum Computing and Cryptocurrencies" (European Cybercrime Centre) and "Harvest Now, Decrypt Later" (with University Carlos III of Madrid) — warning that exposed wallet public keys, not blockchain hash functions, are the primary quantum attack surface for crypto, and that TLS, SSH, and OpenPGP are susceptible to retrospective decryption once quantum computers mature. It details a "just-in-time" attack where a quantum computer derives a private key during the brief window between a transaction broadcasting its public key and confirmation, cites NIST's post-quantum deprecation schedule (phase out classical public-key crypto by 2035), and notes ~30% of BTC supply already has exposed public keys with pre-emptive migration as the only remedy.

BitcoinTLSSSH+2

EuropolEuropean Cybercrime CentreUniversity Carlos III of Madrid+7

Blockchain, GRC· Published and added 7 Oct 2026

decrypt.coarticle🧠 AI

Someone Scraped 5.6 Billion TikTok Videos and Put the Data on Hugging Face for Free

A developer using the handle "hashfunction" published a 460GB Hugging Face dataset of metadata (captions, hashtags, sound IDs, engagement counts, AI-generation flags) for roughly 5.6 billion public TikTok videos spanning July 2014 to October 2026, released under CC BY-NC 4.0. The data was reportedly pulled from TikTok's private mobile API using spoofed device identities and TLS handshakes rather than TikTok's official, application-gated Research Tools, in apparent violation of TikTok's terms of service; commercial access, creator profiles, daily updates, and the $1,699 scraper source code are sold via datasocial.ai. The piece situates this alongside other scraped TikTok-metadata dumps on Hugging Face and ongoing litigation (Reddit v. Perplexity/SerpApi) over large-scale AI training-data scraping.

Hugging Face

TikTokhashfunctiondatasocial.ai+4

training, ai-policy· Published and added 6 Oct 2026

decrypt.coarticle🛡️ Security

Someone Scraped 5.6 Billion TikTok Videos and Put the Data on Hugging Face for Free

Decrypt reports that a developer going by "hashfunction," operating under the datasocial account, published a 460GB Parquet dataset of metadata for ~5.6 billion public TikTok videos (captions, hashtags, sound IDs, engagement counts, AI-generated flags) on Hugging Face under CC BY-NC 4.0. The data was obtained by hitting TikTok's private mobile API using generated Android device identities, reverse-engineered request signatures, and a spoofed TLS handshake, bypassing the ToS clause that bars automated scraping; datasocial.ai sells the scraper's source code for $1,699 and offers commercial access, creator profiles, and daily updates. The piece situates this against TikTok's gated official Research Tools and the ongoing Reddit v. Perplexity/SerpApi scraping lawsuit.

TikTokHugging FaceAndroid+1

hashfunctiondatasocial.aiReddit+4

Offensive Security· Published and added 6 Oct 2026

theravenfile.comwriteup🛡️ Security

CITRIX 0-DAY EXPLOITS: CVE-2026–88771 & CVE-2026–88772 IN THE WILD

An incident-response style deep dive into active in-the-wild exploitation of Citrix NetScaler ADC/Gateway via CVE-2026-88771 (unauthenticated RCE through log-poisoning of ns_monuploadd_err.pl) and CVE-2026-88772 (DTLS memory overflow), part of 8 CVEs disclosed by Citrix on September 27, 2026. The author reverse-engineers the full post-exploitation toolkit dropped after root is obtained: SLAPSHOT (a Perl/Python loopback TCP tunneler/pivot), WHIPSHOT (a disguised PHP web shell served via fake CSS paths), the Platypus C2 agent, and a Perl "Pitboss" dropper script (with full decoded source and an embedded SHA-256-protected PHP web shell) that creates a rogue superuser, SUIDs /bin/sh, exfiltrates NetScaler config, and patches httpd.conf for persistence. It closes with extensive IOCs (C2 IPs, file hashes, paths, credentials) and patch guidance for affected NetScaler builds.

Citrix NetScalerPHPPython+2

CVE-2026-88771CVE-2026-88772CVE-2026-88773+10

Threat Intel, Malware & RE· Published and added 6 Oct 2026

eprint.iacr.orgpaper🛡️ Security

PoP! Goes the VOLE: Shorter Proofs of Possession for KEM Certificates

This IACR ePrint paper proposes and benchmarks a non-interactive Proof of Possession (PoP) for the code-based post-quantum KEM HQC, built using the VOLE-in-the-Head (VOLEitH) zero-knowledge paradigm, to solve the practical problem of issuing KEM-based certificates needed by protocols like KEMTLS. The authors integrate their HQC PoP into the ACME certificate-issuance protocol and compare it against existing PoP schemes for Kyber and FrodoKEM, showing Kyber issues certificates faster but at the cost of protocol or NIST-standard compatibility, while their HQC-based PoP keeps compatibility and achieves smaller proof sizes, which matters under unstable-network conditions due to larger KEM-based CSRs.

ACMEHQCKyber+2

Identity & Access· Added 8 Oct 2026, published 6 Oct 2026

opensourcemalware.comwriteup🛡️ Security

Malicious Crypto Shell Packages Target RubyGems

OpenSourceMalware's analysis of over 40 typosquatted RubyGems packages (e.g. rubygems-btc-shell) published by a user calling themselves "Ghost Dev," targeting crypto/web3 developers. The packages ship a delayed-execution payload hidden in extconf.rb that evades sandboxes before either opening a reverse shell to 45.138.12.177:8090 or deploying a full theft kit (inject_proxy.py, _grab.py, a browser extension, and a rogue root CA) that MITMs TLS traffic to 28+ crypto exchanges, swaps withdrawal addresses, hijacks the clipboard, and harvests wallet files, seed phrases, and private keys. The writeup includes full IOCs, SHA-256 hashes, attacker wallet addresses, and C2 endpoints.

RubyGemsPythonBitcoin+2

Ghost Devreqthrottle_3474rubygems-btc-shell+2

Supply Chain, Malware & RE, Blockchain· Published and added 5 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Role-Specific Signature Placement in TLS 1.3: Cost Propagation and PQC Migration

An IACR eprint paper evaluating all 13-cubed ways to assign 13 post-quantum/traditional signature parameter sets across the Root, Intermediate and Leaf roles of a TLS 1.3 certificate chain, holding the algorithm set fixed and varying only placement. Across 286 three-algorithm groups, median max/min ratios reach 2.085x for TLS handshake latency, 4.310x for certificate body size and 4.551x for path-validation cost purely from role order, with Leaf placement mattering far more than Root/Intermediate swaps. It also shows that looking only at Certificate-message size can misrank candidates such as ML-DSA-65 versus SLH-DSA-SHAKE-192s once the Leaf signature in CertificateVerify and full authentication-path cost are included, arguing PQC certificate-chain design must account for role-specific cost under real network/load conditions.

TLS 1.3X.509ML-DSA

ML-DSA-65SLH-DSA-SHAKE-192s

AppSec· Added 8 Oct 2026, published 5 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Deploying Native-Rust KpqC: Pluggable Post-Quantum KEMs and Signatures across TLS, Space Links, and the OQS Ecosystem

This IACR ePrint paper presents a native-Rust, memory-safe implementation of the Korean KpqC competition's standardized post-quantum schemes — KEMs NTRU+ and SMAUG-T, and signatures HAETAE and AIMer — replacing the reference memory-unsafe C code. The authors expose all seven KEM parameter sets and four signature modes through a single pluggable provider demonstrated across three real deployment front-ends: a rustls TLS 1.3 key-exchange group, an OQS/liboqs-compatible C ABI, and an analytical CCSDS/SDLS satellite constrained-link model, showing SMAUG-T variants are smaller/faster than ML-KEM-768 on constrained space links and a memory-optimized NTRU+ build cuts peak stack by up to 25% at negligible latency cost.

RustCOpen Quantum Safe

KpqCNTRU+SMAUG-T+5

other· Added 8 Oct 2026, published 5 Oct 2026

eprint.iacr.orgpaper🛡️ Security

Measuring Parallel Execution of Classical–PQC Component Pairs in Hybrid TLS 1.3

An IACR ePrint paper benchmarks whether running the classical and post-quantum components of hybrid TLS 1.3 key exchange (ECDHE–ML-KEM) and Composite ML-DSA signatures in parallel on separate pthread worker threads reduces handshake latency versus sequential execution. Across three RFC 10024 ECDHE–ML-KEM groups with server and mutual authentication, parallelism sped up all six tested conditions on a standard ARM and x86 system (1.04×–1.28×), with the largest gains in signature stages where component times are balanced, but slowed every condition on a low-power x86 system (0.80×–0.92×) because thread wake/wait overhead outweighed savings. The authors conclude that component independence alone doesn't guarantee a speedup and that parallelization decisions must be validated per target environment.

TLS 1.3pthread

ML-KEMML-DSAECDHE+1

other· Added 8 Oct 2026, published 5 Oct 2026

github.comwriteup🛡️ Security

Xray-core concealed a certificate verification bypass vulnerability

A security researcher's first-person disclosure describing a certificate verification bypass in Xray-core (a popular censorship-circumvention proxy): when its pinnedPeerCertSha256 option skips regular TLS verification, a MITM attacker can insert a leaf certificate anywhere in the certificate chain and have the custom pinning logic incorrectly validate it, effectively eliminating certificate verification. The writeup also documents how the vulnerability was silently fixed with a misleading "simplify the code" commit message and left undisclosed to users for nearly half a year until the reporter filed a GitHub Security Advisory.

Xray-core

pinnedPeerCertificateChainSha256pinnedPeerCertSha256allowInsecure+1

AppSec· Added 5 Oct 2026, published 4 Oct 2026

hackers-arise.comwriteup🛡️ Security

Pentesting: Managing Compromised Machines with Platypus

Walkthrough of Platypus, an open-source C2-style host management platform (github.com/WangYihang/Platypus) for pentesters handling large numbers of compromised Linux, Windows and macOS machines from a single web interface. Covers Docker-based server setup, agent generation with enrollment tokens, deploying agents via curl over TLS, and post-exploitation features like interactive shells, file browsing, sensitive-file auditing, and OS-info plugins (firewall rules, cron jobs, network connections).

DockerLinuxWindows+4

Red Team Operator

Offensive Security· Added 7 Oct 2026, published 2 Oct 2026

unit42.paloaltonetworks.comadvisory🛡️ Security

Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild (Updated September 30)

Unit 42 threat brief on CVE-2026-88771 (unauthenticated command injection) and CVE-2026-88772 (DTLS memory overflow) in NetScaler ADC and Gateway, both CVSS v4.0 9.5 and exploited as zero-days from August 2026. It details version fingerprinting, .deb and PHP web shells, a three-stage log-poisoning chain through ns_monuploadd_err.pl, httpd.conf persistence, IOCs, and 50,277 exposed instances as of 27 September 2026.

Citrix NetScalerPHPApache+2

CVE-2026-88771CVE-2026-88772CVE-2026-88773+9

Threat Intel, Blue Team & Detection· Added 30 Oct 2026, published 30 Sep 2026

x.comcourse🛡️ Security

The DevSec Blueprint (DSB) (@devsecblueprint) on X

The DevSec Blueprint released Kubernetes Security Engineering, a free nine lesson course covering cluster security boundaries, least privilege RBAC and service accounts, Pod Security Standards, NetworkPolicies and mTLS, admission control, secrets and workload identity replacing static cloud credentials with short lived access, and runtime defense via audit logs. It includes a hands on Cluster Hardening Mission to secure a workload and gather evidence the controls work. The course is free; referenced walkthroughs require signing up as a DSB Builder.

Kubernetes

Learning, Cloud & Infra· Published and added 30 Sep 2026

iacr.orgpaper🛡️ Security

zkPoPE: A Transport-Agnostic Security Model for zkTLS (Reclaim Protocol)

This IACR ePrint paper introduces zkPoPE (Zero-Knowledge Proof of Protocol Execution), the first transport-agnostic security model for zkTLS, formalized as a UC ideal functionality that separates "proof of an actual protocol execution occurred" from a plain NIZK over input-output pairs. The authors formally analyze the Reclaim Protocol, showing it UC-realizes zkPoPE under a deployment-aligned trust model, and introduce Distributed-AEAD, a new three-party authenticated-encryption primitive enabling Reclaim to attest a 1200kB TLS response on a lower-mid-range phone in 7.28s — two orders of magnitude larger than previously benchmarked zkTLS schemes. It matters because it gives zkTLS constructions (used for privacy-preserving web attestations) a common, construction-independent security definition to be proven against, rather than each scheme inventing its own.

Reclaim Protocol

zkPoPEDistributed-AEADF_zkpope

other· Added 29 Sep 2026

orca.securityadvisory🛡️ Security

Critical Citrix NetScaler Zero-Days Under Active Exploitation

Analysis of two CVSS 9.5 Citrix NetScaler ADC/Gateway zero-days, CVE-2026-88771 (unauthenticated RCE through improper input validation in the management interface, affecting default deployments) and CVE-2026-88772 (memory overflow in DTLS, enabled by default on VPN virtual servers). It lists six more high-severity flaws patched in advisory CTX697096, the affected and fixed versions, and the CISA KEV listing with a federal deadline of 2026-09-30. It advises checking for compromise before patching, since patching can destroy forensic evidence, and gives response steps: isolate, revoke credentials, rebuild firmware, rotate keys and certificates.

Citrix NetScalerVPN

CVE-2026-88771CVE-2026-88772CVE-2026-88773+7

Cloud & Infra, Threat Intel· Published and added 29 Sep 2026

cloud.google.comwriteup🛡️ Security

Defending Against Active Exploitation of Citrix NetScaler ADC and Gateway Appliances

Mandiant and GTIG report on exploitation of the Citrix NetScaler ADC and Gateway zero-day CVE-2026-88772, active since early September 2026, alongside CVE-2026-88771. It covers the DTLS-triggered NSPPE crash, httpd.conf persistence via .deb and .sig handlers, SUID /bin/sh, and the WHIPSHOT web shell and SLAPSHOT tunneler. It gives hunting commands, log artifacts, YARA rules, patched builds and containment steps.

Citrix NetScalerPHPPython+3

CVE-2026-88772CVE-2026-88771WHIPSHOT+6

Threat Intel, Blue Team & Detection, Malware & RE· Added 29 Oct 2026, published 29 Sep 2026

labs.watchtowr.comwriteup🛡️ Security

Citrix NetScaler CVE-2026-88772 — DTLS preauth memory overflow

watchTowr Labs reverse-engineers CVE-2026-88772, a preauth DTLS memory overflow in Citrix NetScaler ADC/Gateway's nsppe binary, exploited in the wild as a zero-day and fixed in Citrix bulletin CTX697096. The writeup walks through patch diffing between build 14.1-73.30 and 14.1-73.37, crafting malicious DTLS handshake fragments that trick NetScaler's reassembly logic into copying about 174KB of NSB chain data into a 35,840-byte scratch buffer, and the full exploitation path from crash to a fake-vtable hijack, ROP-based mprotect call, and shellcode execution, plus a public detection artefact generator.

Citrix NetScalerGDB

CVE-2026-88772CTX697096Sina Kheirkhah

Offensive Security, Malware & RE· Added 1 Oct 2026, published 29 Sep 2026

watchtowr.comadvisory🛡️ Security

watchTowr: CVE-2026-88771 Citrix NetScaler ADC/Gateway unauthenticated RCE

watchTowr details CVE-2026-88771 (unauthenticated command execution via improper input validation, affecting every NetScaler ADC/Gateway deployment by default) and CVE-2026-88772 (DTLS memory overflow leading to RCE/DoS, exploitable since DTLS is on by default for VPN virtual servers). Both are confirmed exploited in the wild as zero-days, were pre-notified by NCSC-NL, and CVE-2026-88771 was added to the CISA KEV catalog on September 27, 2026; Citrix's bulletin CTX697096 also fixes six related issues (CVE-2026-88773 through CVE-2026-88778). The writeup gives prioritization guidance, IOC-checking steps, and warns that patching may destroy forensic evidence if done before evidence capture.

Citrix NetScalerCVSSCISA KEV

CVE-2026-88771CVE-2026-88772CVE-2026-88773+8

Threat Intel, Offensive Security· Added 5 Oct 2026, published 27 Sep 2026

arxiv.orgpaper🛡️ Security

HoF-Bench: Rediscovering Real AI-Discovered CVEs Without Frontier Models

HoF-Bench is a benchmark of 95 real, publicly disclosed CVEs originally found by AISLE's LLM-based vulnerability analyzer (280+ CVEs across 78 projects including OpenSSL, curl, and GnuTLS), repackaged into eight repositories pinned at vulnerable commits. Analyzers get source/target-file scope but no CVE ID, description, fix, or expected mechanism, and a detector-blinded frontier-model judge only credits findings that match the same code path, root cause, attack condition, and impact. Testing ten non-frontier backbones (open-weight 21B-284B and proprietary "flash"-tier models) in a fixed multi-pass scaffold, a minimal analyzer rediscovers up to 68% of the CVEs, with misses concentrated in C infrastructure code — showing small/cheap models can approximate frontier-level vulnerability discovery on known bug classes.

cURLOpenSSLGnuTLS+2

AI Security, AppSec· Added 26 Sep 2026

arxiv.orgpaper🛡️ Security

AgentLSD: Evaluating AI Security Agents Under Adversarial Task Contamination

AgentLSD is a research framework that evaluates AI security agents on web CTF challenges under "adversarial task contamination" — injected trap artifacts like fake flags, misleading hints, decoy endpoints, and hidden cues that go beyond classic prompt injection by including non-instructional deceptive evidence. Testing six models on 11 web CTF challenges, the authors found agents solve 41% of flags cleanly, but contamination inflates turns (+20) and reasoning tokens (+2k) even on successful runs, and some model-challenge pairs get misled into following decoys or submitting wrong flags. The paper releases the framework, trap specifications, configurations, and raw traces as a reproducible benchmark for studying agent deception resilience.

AgentLSD

AI Security· Added 17 Sep 2026, published 16 Sep 2026

ethresear.charticle🛡️ Security

Post-Quantum: Lattice or Hash-Based (one question, two right answers)

A deep-dive field guide to choosing between lattice-based (ML-DSA/FN-DSA) and hash-based (SLH-DSA) post-quantum signatures, built from interviews with the designers and implementers behind both NIST standards and their deployments. It walks through Mosca's-inequality-style migration timing, CNSA 2.0's split between lattice signatures and stateful hash-based LMS/XMSS for firmware, the stateful-signature "footgun," and why the broader internet (TLS/WebPKI, via Merkle Tree Certificates) is converging on lattices while Ethereum's post-quantum consensus roadmap (leanXMSS, EIP-8292, EIP-8288 aggregation) and Algorand's live Falcon-1024 state proofs lean hash-based or scheme-neutral because of aggregation and on-chain storage constraints. It closes with a decision framework and a rundown of NIST's round-3 "onramp" signature candidates (MAYO, SQIsign, HAWK, etc.).

EthereumBitcoinAlgorand+3

ML-DSASLH-DSAFN-DSA+16

Blockchain, other· Added 3 Oct 2026, published 15 Sep 2026

github.comrepo🛡️ Security

DeathShotXD/0xCr0ssCrush

Research project on two signed vulnerable Windows drivers, DCRCVDrv.sys (MOCOMSYS) and Alinubx.sys (CnCrypt), abused by the Cruciferra MaaS loader to kill AV/EDR processes. It documents their devices, IOCTLs (0x2205C0, 0x222024) and the termination chain (ObOpenObjectByPointer -> ZwTerminateProcess), and gives annotated disassembly, hash-level sample provenance and blocklist-status snapshots. It includes a Rust lab harness with hash validation and dry-run, plus Sigma, YARA and telemetry guidance. Findings carry evidence labels, and the test matrix is limited to Windows 11 24H2 with HVCI disabled.

WindowsRustSigma+2

BYOVDCruciferraDCRCVDrv.sys+7

Malware & RE, Blue Team & Detection, Offensive Security· Added 11 Oct 2026, published 14 Sep 2026

github.comrepo🛡️ Security

vibecheck

vibecheck is a free, open-source, client-side scanner that checks apps built with AI code generators (Lovable, Bolt, v0, Cursor, Claude Code) for common security holes: exposed Supabase Row Level Security / Firebase rules, secrets embedded in the client bundle (Stripe/AWS/DB keys), missing security headers, exposed .env/.git/source maps, unauthenticated LLM proxy or MCP endpoints, and email/TLS misconfigurations. It also scans public repos for cross-tenant IDOR patterns, committed secrets, an OSV.dev supply-chain check, a Dockerfile lint, and generates a CycloneDX SBOM; a companion CLI (tenant-guard) adds a live Postgres cross-tenant isolation test as a CI gate. The project cites CVE-2025-48757 (170+ Lovable apps found with RLS disabled) as motivation.

SupabaseFirebaseOSV+3

CVE-2025-48757IDOR

AppSec, Supply Chain, Mobile Security· Published and added 27 Aug 2026

blackpointcyber.comwriteup🛡️ Security

Built to Blend: Miraak's Modular Post-Exploitation Framework

Blackpoint's Adversary Pursuit Group details Miraak, a novel modular post-exploitation framework discovered through proactive hunting of exposed open web directories. The writeup covers trojanized hostfxr.dll loaders that masquerade as legitimate .NET runtime components (with XOR 0x42/0x5A obfuscated payloads and configs), a PostgreSQL/Timescale database used as the C2 control plane instead of HTTP beaconing, Cobalt Strike BOF-compatible execution inside the agent, and an associated F#-based reverse TCP tunneling implant delivered via a trojanized Microsoft.DocAsCode.Common.dll (DocFX) dependency, with infrastructure pivoting via a self-signed "miraak-socks" TLS certificate and IOCs.

PostgreSQL.NETCobalt Strike+2

MiraakBlackpoint Adversary Pursuit Groupmiraak-socks+4

Malware & RE, Offensive Security, Threat Intel· Added 26 Sep 2026, published 26 Aug 2026

github.comrepo🛡️ Security

Ashmmmm/crockTail

crockTail is a passive OSINT tool that, given a domain, aggregates DNS records, IP/ASN ownership, TLS certificate details, WHOIS data, and crt.sh certificate-transparency history into a single report. It layers analysis on top of the raw data: plain-language warning/info observations (near-expiry or expired certs, recently registered domains, unusual reissuance, historical subdomains from CT logs), multi-resolver (Google vs Cloudflare) DNS cross-verification to flag possible tampering, and a 0-100 confidence score per scan based on module success and cross-check agreement. It supports batch domain queries and query logging, and is explicitly limited to passive lookups and a standard TLS handshake, no port scanning or active probing.

JavaMavenVue+1

OSINT· Added 30 Sep 2026, published 25 Aug 2026

github.comrepo🛡️ Security

Orbien

Orbien is a lightweight (~5MB binary) NAT traversal / intranet penetration tool written in Rust with Tokio, supporting tunnel protocols (TCP, UDP, HTTP, HTTPS, SOCKS5) over multiple transports (TCP, KCP, WebSocket, QUIC). It provides token-based tunnel authentication and TLS/mTLS encryption, positioning it as a secure, high-performance alternative to frp for exposing internal services or pivoting through NAT.

RustTokioQUIC+2

frp

Offensive Security· Added 3 Sep 2026, published 21 Aug 2026

wiz.iowriteup🛡️ Security

Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns

Wiz researchers found that malicious versions of the Rust crates arrayref, internment, and append-only-vec were published to crates.io, each pulling in a typosquatted build-dependency (proc-macro1, mimicking proc-macro2) whose build.rs executes a remote payload at compile time. The payload beacons to a C2 endpoint (/49890878) shared with the Mastra campaign, disables TLS validation, enumerates Chrome/Brave/Edge saved logins via their SQLite stores, persists via Registry Run keys/LaunchAgents/systemd, and falls back to a DGA — with C2 infrastructure and SSL-issuer overlap tying it to DPRK/Sapphire Sleet activity previously seen in the Mastra and axios supply chain attacks. arrayref is used in roughly 75% of Rust environments, making this a high-impact build-time compromise.

RustCargocrates.io+3

arrayrefinternmentappend-only-vec+5

Supply Chain, Threat Intel, Malware & RE· Added 3 Sep 2026, published 20 Aug 2026

huntress.comwriteup🛡️ Security

MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer

Huntress SOC analysts reverse-engineer MacSync, a macOS infostealer/RAT distributed via a sponsored Google Ads link to a fake "Apple Support"-branded claude.ai shared conversation that uses ClickFix to trick victims into pasting a curl/zsh loader into Terminal. The six-stage chain runs a polymorphic gzip/Base64 loader, an in-memory AppleScript stealer that harvests Chromium Safe Storage keys, keychain secrets, Telegram/SSH/cloud credentials, abuses TCC (Full Disk Access and Screen Recording) prompts, drops a Mach-O RAT with WebSocket/TLS C2 and an XOR-obfuscated fallback domain, and trojanizes 84 crypto wallet extensions/apps to phish seed phrases. The piece also compares it to prior AMOS Stealer and SectopRAT ClickFix campaigns and offers behavior-based detection guidance.

macOSAppleScriptzsh+3

MacSyncClickFixSectopRAT+2

Malware & RE, Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 17 Aug 2026

blog.trailofbits.comwriteup🛡️ Security

A few notes on AWS Nitro Enclaves: KMS integration

Third in Trail of Bits' Nitro Enclaves series, this post catalogs threats to the enclave-KMS communication channel: passive attackers who can swap ciphertext/data-key pairs when encryption context is missing, active attackers who can hijack unauthenticated requests without enclave-initiated TLS, and operational risks like CMK deletion, key rotation, and IAM policy misconfiguration. It provides concrete checklists covering encryption context usage, ARN vs. alias pinning, PCR0/PCR3/PCR8-based key policy authorization, immutable key policies for end-to-end verifiability, and warns against the vulnerable aws-nitro-enclaves-sdk-c in favor of aws-nitro-enclaves-nsm-api and Boto3.

AWS KMSAWS Nitro EnclavesAWS IAM+1

Trail of Bits

Cloud & Infra, Identity & Access· Added 3 Sep 2026, published 5 Aug 2026

wiz.iowriteup🛡️ Security

S3 Clones in the Neoclouds

Wiz Research examines S3-compatible object storage offerings from Nebius, Vultr, Lambda Labs, Cloudflare R2, DigitalOcean, and Crusoe, showing how each deviates from AWS S3 security defaults. Findings include providers that expose access/secret keys via list APIs (Vultr), default ACLs that would be public but aren't enforced (Lambda Labs), lack of least-privilege key scoping (Vultr, Crusoe, Lambda Labs), weak or undocumented encryption-at-rest/TLS enforcement, unstructured access-key formats that evade GitHub/secret-scanner detection, and cross-tenant bucket namesquatting risk due to shared global namespaces.

AWSCloudflareDigitalOcean+3

bucket namesquatting

Cloud & Infra· Added 3 Sep 2026, published 31 Jul 2026

github.comrepo🛡️ Security

dstours/OctoC2

OctoC2 is a GitHub-native command-and-control framework built with TypeScript/Bun, featuring a beacon, durable controller, operator dashboard, and CLI. It supports multiple encrypted transports (GitHub Issues/branches/Actions/Gists/Git Notes, HTTPS/WebSocket, gRPC with mTLS, GitHub Actions OIDC, and relayed Codespaces SSH tunnels) with a signed task protocol, Ed25519 beacon identities, exclusive delivery leases, and replay-protected state for authorized red-team and security research engagements.

GitHub ActionsBunTypeScript+2

Offensive Security· Published and added 18 Jul 2026

stepsecurity.iowriteup🛡️ Security

15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers

StepSecurity details a coordinated supply chain attack in which 15 fake AI-powered JetBrains plugins (published across 7 vendor accounts from October 2025 to June 2026) exfiltrated developer AI provider API keys in plaintext to a hardcoded Alibaba Cloud C2 server at 39.107.60.51. The plugins genuinely worked (code review, test generation, DeepSeek/OpenAI chat) but their save() methods intercepted valid-looking sk- API keys, disabled TLS certificate validation warnings JVM-wide, and POSTed the keys over unencrypted HTTP; a "donation wall" also resold stolen keys back to other victims. JetBrains banned the accounts and kill-switched the plugins on June 17, 2026, but StepSecurity confirmed the C2 server was still live two days later, and provides code snippets, network IOCs, and remediation/rotation steps.

JetBrainsDeepSeekOpenAI

Supply Chain, Threat Intel· Added 3 Sep 2026, published 1 Jul 2026

securitylabs.datadoghq.comarticle🛡️ Security

Introducing GuardDog 3.0: new YARA rules engine, risk scoring, and sandboxing

Datadog Security Labs details GuardDog 3.0, an open-source PyPI/npm/Go malicious-package scanner, which replaces its Semgrep-based detections with a YARA rules engine (via yara-python) for better performance at scale, adds a risk-scoring engine that correlates capability rules (e.g., network access) with threat-indicator rules (e.g., suspicious domains, deobfuscation routines) into a 0-10 risk score, and sandboxes the scanning process itself with nono-py to contain vulnerabilities in GuardDog's own extraction/scanning code. The post also covers their continuous evaluation pipeline, which clusters their 27k+ open malicious-package dataset with TLSH before sampling to compute precision, recall, F1, and MCC nightly in CI.

GuardDogYARASemgrep+4

Shai-HuludTLSH

Supply Chain, Blue Team & Detection· Added 14 Sep 2026, published 26 Jun 2026

sentinelone.comwriteup🛡️ Security

macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox

SentinelLABS dissects macOS.Gaslight, a Rust macOS implant (tracked via Apple XProtect's MACOS_BONZAI_COBUCH rule, linked to DPRK-aligned BONZAI/AIRPIPE activity) that uses a Telegram Bot API polling channel with AES-GCM-over-pinned-TLS, self-redacts its bot token from runtime logs, stages a runtime-fetched standalone CPython interpreter to run a Python keychain/browser/history stealer, and persists via a fake com.apple.* LaunchAgent. Its standout feature is a 3.5 KB embedded block of 38 fabricated "system" messages mimicking an LLM triage harness's prompt scaffold, engineered to make an AI-assisted analyst tool abort or refuse analysis rather than evade the sandbox itself.

RustmacOSTelegram+2

DPRKmacOS.GaslightBONZAI+8

Malware & RE, AI Security, Threat Intel· Added 26 Jun 2026, published 23 Jun 2026

socket.devwriteup🛡️ Security

Socket: 141 Mastra npm Packages Compromised via Typosquatted Dependency

Socket's research team documents a supply chain attack in which npm account "ehindero" mass-published 141 malicious versions of @mastra/* packages (including @mastra/core, 918K weekly downloads) that were byte-identical to legitimate code but added a single new dependency: the typosquatted package easy-day-js. That package's postinstall hook (setup.cjs) disables TLS validation, fetches a second-stage cross-platform Node.js implant (protocal.cjs) that installs OS-specific persistence (Windows Run key, macOS LaunchAgent, Linux systemd unit disguised as Node/NVM tooling), inventories 166 cryptocurrency wallet browser extensions, steals Chrome/Edge/Brave history, and accepts arbitrary remote tasking (Node/Shell runners) from a hardcoded C2 over a custom ICAP-style protocol. The writeup includes full IOCs, SHA-256 hashes, and remediation guidance (rotate npm/CI/SSH credentials, treat affected hosts as compromised, disable install scripts).

npmNode.jsdayjs+2

Mastraeasy-day-jsehindero+2

Supply Chain, Malware & RE, Threat Intel· Published and added 20 Jun 2026

stepsecurity.iowriteup🛡️ Security

Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat

StepSecurity documents the Mastra AI framework npm supply-chain attack: attacker sergey2016 published easy-day-js, a typosquat clone of dayjs, then added it as a dependency across 140+ @mastra packages after compromising the org's npm credentials. The malicious 1.11.22 version's postinstall hook ran an obfuscated dropper (setup.cjs) that disabled TLS verification, beaconed the install path, fetched a stage-2 payload from a hardcoded C2, spawned it detached, and self-deleted to erase forensic traces; StepSecurity's Harden Runner blocked the C2 callout in a controlled GitHub Actions test, preventing credential exfiltration of LLM/cloud API keys.

npmNode.jsGitHub Actions+2

Mastraeasy-day-jsMiasma+3

Supply Chain, DevSecOps, Threat Intel· Added 3 Sep 2026, published 18 Jun 2026

opensourcemalware.comwriteup🛡️ Security

Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier

A threat actor took over a dormant maintainer account and republished 140+ packages in the @mastra npm scope (including @mastra/core, ~918K weekly downloads), injecting a typosquat of dayjs called easy-day-js as a new dependency in every manifest. A clean 1.11.21 version was published first, then a weaponized 1.11.22 tagged latest was pulled in via caret-range resolution, delivering a two-stage cross-platform backdoor that disables TLS validation, self-deletes, installs OS-specific persistence disguised as Node/NVM tooling, and steals browser history plus data from 166 crypto-wallet, password-manager (1Password, Bitwarden, LastPass, Dashlane, NordPass, Proton Pass, KeePassXC, Zoho Vault, Kaspersky), MFA-authenticator, and Zapier browser extensions. The report ties the campaign's Hostwinds infrastructure, clean-then-armed typosquat, and TLS-off/detached/self-delete dropper pattern to the same playbook Microsoft attributed to Lazarus Group in the earlier axios npm compromise, and compares its extension targeting to the "HyperHives" ClickFix campaign, noting npm's lack of provenance enforcement (provenance: no on the malicious wave) as the control gap that let it through.

npmNode.jsPowerShell+3

Mastraeasy-day-jsLazarus Group+5

Supply Chain, Malware & RE, Threat Intel· Added 3 Sep 2026, published 18 Jun 2026

snyk.iowriteup🛡️ Security

A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope

Snyk details how a dormant, never-revoked npm contributor account (ehindero) was used to republish the entire @mastra scope (142+ packages, ~4M monthly downloads for @mastra/core alone) with an injected dependency, easy-day-js, a byte-for-byte dayjs impersonator. The postinstall hook in easy-day-js@1.11.22 disables TLS verification, pulls a second-stage payload from a raw IP, and drops a cross-platform cryptocurrency wallet stealer plus a RAT with OS-specific persistence (LaunchAgent, systemd unit, PowerShell staging) that beacons every 10 minutes over a self-signed wolfSSL certificate. The piece covers detection steps, the Snyk advisory (SNYK-JS-EASYDAYJS-17353313), and draws parallels to the earlier Axios npm compromise attributed by Microsoft to Sapphire Sleet (BlueNoroff).

npmNode.jsSnyk+2

Mastraeasy-day-jsSNYK-JS-EASYDAYJS-17353313+4

Supply Chain, Malware & RE, Blue Team & Detection· Added 3 Sep 2026, published 16 Jun 2026

github.comrepo🛡️ Security

VICE

VICE is an open-source (MIT) Node.js security auditing CLI with two modes: a remote black-box scan that crawls a target with a headless browser across 15-16 security modules (headers, TLS, Supabase access controls, subdomains, storage buckets, WebSockets), and a local white-box audit that scans source code for secrets, .env exposure, npm vulnerabilities, missing Supabase RLS policies, SQL injection and XSS. It ships as a GitHub Action that posts PR comments with a security score, uploads SARIF findings to GitHub Code Scanning, gates merges on a minimum score, and maintains a live README badge. Version 3.4.0 adds an AI/RAG security module for testing chat/agent API endpoints for access control, prompt injection, retrieval isolation, and tool-security issues.

Node.jsnpmGitHub Actions+3

AppSec, DevSecOps, AI Security· Published and added 14 Jun 2026

socket.devwriteup🛡️ Security

Socket: Malicious NuGet Package Impersonates Sicoob Banking SDK

Socket researchers found Sicoob.Sdk, a NuGet package impersonating an official C# SDK for Sicoob (a major Brazilian cooperative bank), which in versions 2.0.0-2.0.4 exfiltrates client IDs, PFX passwords, and base64-encoded PFX mTLS certificate archives via a hardcoded Sentry telemetry endpoint. The associated GitHub organization (Sicoob-Cooperativa) served as a clean-source façade, with the malicious logic only present in the compiled DLL, and the same publisher account distributed 11 other Sicoob-branded packages as dependencies of the malicious wrapper. NuGet blocked the package after Socket's abuse report.

NuGet.NETSentry

Sicoob.SdkSicoob-Cooperativajoaobcdev

Supply Chain, Threat Intel· Published and added 29 May 2026

wiz.ioarticle🛡️ Security

State of Post Quantum Cryptography | Wiz Blog

Wiz's follow-up PQC research post quantifies real-world adoption of post-quantum key exchange (ML-KEM/X25519MLKEM768) and digital signatures (ML-DSA, SLH-DSA, pending FN-DSA) across AWS, Azure, and GCP APIs, OpenSSH/OpenSSL versions, and Go's crypto/tls. It finds stark gaps: Azure API servers show no PQC key-exchange support while GCP is universal and AWS sits at 13%, only 15% of TLS 1.3 connections observed use PQC-compliant key exchange, under 15% of OpenSSL instances support PQC, and less than 1% of companies use AWS KMS ML-DSA signing keys. The piece also covers the shift in PQC priority from key exchange (mitigating Harvest-Now-Decrypt-Later attacks) to digital signature migration, and the coming move to Merkle Tree Certificates to keep PQC certificate chains manageable.

AWSAzureGoogle Cloud+3

ML-KEMML-DSASLH-DSA+9

Cloud & Infra, GRC· Added 5 Sep 2026, published 28 May 2026

socket.devwriteup🛡️ Security

Socket: Malicious Postinstall Hook Compromises 8 PHP/Node Packages on Packagist

Socket's AI scanner found a coordinated supply chain campaign in which 8 Packagist (PHP/Composer) packages had their upstream GitHub repos modified to add a malicious postinstall hook — placed in package.json rather than composer.json — that downloads a binary (gvfsd-network) from an attacker GitHub Releases URL to /tmp/.sshd, disables TLS verification, and runs it in the background. The same payload was also found injected into GitHub Actions workflow files (as a step named "Dependency Cache Sync") in forked repos, and a GitHub code search for the attacker account parikhpreyash4 surfaced hundreds of additional references across Node.js projects. Highest real-world risk is concentrated in Laravel starter kits devdojo/wave (~6,400 stars) and devdojo/genesis (~9,100 Packagist installs), since starter-kit repos become the project root where npm install triggers the hook directly.

PackagistComposerPHP+3

parikhpreyash4

Supply Chain, DevSecOps· Published and added 23 May 2026

theravenfile.comwriteup🛡️ Security

GITHUB LEAK: YOUR CODE @ RISK! – THE RAVEN FILE

Analysis of a claimed BreachForums leak by threat actor TeamPCP of ~4K GitHub private repositories, including two leaked Rails controller files (OrganizationsController, PullRequestsController) that the author dissects for internal architecture details — OFAC/trade-compliance gating, CAPTCHA logic, org deletion "danger zone" tokens, database cluster topology, Voltron graceful-timeout feature flags, PR stacking, and JA3-TLS-fingerprint-based anonymous rate limiting. The piece also links TeamPCP to a lookalike domain (git-service.com, registered May 16 2026) used to compromise Microsoft's durabletask Python package, and notes TeamPCP's dark-web/Telegram presence and ties to CypherForce Ransomware.

GitHubRuby

TeamPCPLazarus GroupBlueNoroff+4

Threat Intel, Supply Chain· Added 5 Sep 2026, published 20 May 2026

Showing 60 of 65