194 results for “Expo”

List Grid

What you seeeverything

Recent Oldest Added A–Z

All types543 Articles194 Repos100 Papers74 Write-ups74 Advisories48

More types5

Threads29 Tools19 Other2 Videos2 Courses1

📄 Articles “Expo”Clear all

theblock.coarticle🛡️ Security

Binance says hackers used fake job interview, internal AI tool in $6.3 billion breach

The Block reports Binance's initial incident report, published 3 November 2026, on a theft of more than $6.3 billion. Binance says a fake job interview compromised an employee and an internal AI tool exposed wallet-signing systems. Binance says it froze or intercepted about $2.85 billion and replenished 98% of impacted assets. Withdrawals reopened in phases from 4 a.m. UTC across BSC, Ethereum, Solana and other networks. The FBI links the attack to North Korea, which denies it. The available text gives no deeper technical detail.

EthereumSolanaBNB Smart Chain

BinanceFBIDPRK+1

Blockchain, Threat Intel· Published and added 3 Nov 2026

hackers-arise.comarticle🛡️ Security

Open-Source Intelligence (OSINT): Doing GeoOSINT and Finding Locations with Azimut

Azimut is a local, open-source GeoOSINT tool (v0.3.3, Linux, Windows, macOS) that keeps case evidence in one folder and runs in the browser at 127.0.0.1:8477. The walkthrough tests a Yosemite photo from Wikimedia using the Horizon 3D skyline overlay, the beta Find mode (hand-drawn skyline, search area up to 10,000 km2), sun path display and exportable proof collages. Results need manual verification.

AzimutKali Linux

Hackers AriseOsintMeThatWikimedia+1

OSINT, Learning· Published and added 3 Nov 2026

blog.cloudflare.comarticle🛡️ Security

Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities

Zero Wire is a public vulnerability intelligence feed in the security section of Cloudflare Radar. Each briefing covers one critical CVE in Internet-facing software: who should investigate, what to do, evidence links such as the CISA Known Exploited Vulnerabilities catalog, and WAF context. Briefings include a prompt for an AI agent to run a read-only exposure assessment; the first example covers php2shell.

Cloudflare RadarCloudflareCISA KEV+1

PHP2Shell

Threat Intel, Blue Team & Detection· Published and added 3 Nov 2026

blog.trailofbits.comarticle🛡️ Security

The cryptography behind electronic voting (and why paper ballots are still essential)

Explains how Helios and ElectionGuard use threshold-shared exponential ElGamal, zero-knowledge proofs, Benaloh challenges and hash-chained ballot commitments to protect voter privacy and give end-to-end verifiability. It covers compromised voting clients and backends, software independence, and the 2018 National Academies report against internet voting. It concludes that cryptography supplements, but cannot replace, paper ballots in general elections.

HeliosElectionGuardElGamal

Benaloh challengeend-to-end verifiabilitysoftware independence+4

other, Learning· Published and added 3 Nov 2026

bleepingcomputer.comarticle🛡️ Security

Harvard University data breach exposed info of 851,000 accounts

Harvard University's Alumni Affairs and Development systems were breached in November 2025, and Have I Been Pwned confirmed 850,500 accounts exposed. ShinyHunters claimed the attack and leaked a 1.1GB archive in February 2026 after Harvard refused to pay. Exposed data includes names, emails, birth dates, phone numbers, addresses and donation details, but no SSNs, passwords or payment data. The article also notes a separate Clop claim using an Oracle E-Business Suite zero-day.

Oracle E-Business Suite

ShinyHuntersClopHarvard University+5

Threat Intel· Published and added 3 Nov 2026

securityweek.comarticle🛡️ Security

Over 100 European Stores Hit as Supermarket Fridge Attacks Return

Over 100 stores in Belgium, Estonia, Ireland, Luxembourg, the Netherlands and Sweden had fridges forced into defrost mode overnight on 2 to 3 November 2026, after about 700 French supermarkets were hit on 11 to 12 October. Targets were internet-exposed, often end-of-life Danfoss AK-SM/AK-SC and Copeland controllers. Censys counted about 1,000 exposed StoreView interfaces. Lupovis saw default-credential probing from 20 October.

Danfoss AK-SMDanfoss AK-SCDanfoss StoreView+2

CERT-FRANSSICensys+3

Threat Intel, Hardware & RF· Published and added 3 Nov 2026

alignment.openai.comarticle🧠 AI

Training activation classifiers for safety and alignment

Training activation classifiers for safety and alignment describes how OpenAI trains lightweight probes on a model's residual stream activations to flag misaligned or policy-violating completions. Probes use an MLP plus QV-attention architecture with an exponential moving average and a rolling softmax objective. They run in streaming mode on the inference engine, have run on all assistant completions since GPT-5.6, and transfer well across post-training checkpoints but less across pre-training checkpoints.

activation probesattention probesMultiMax probe+3

OpenAIGPT-5.6

ai-safety, research· Published and added 2 Nov 2026

bleepingcomputer.comarticle🛡️ Security

BTCPay Server warns of hot wallet thefts targeting outdated instances

BTCPay Server, an open-source self-hosted cryptocurrency payment processor, reports attackers draining hot wallets on instances running version 2.4.1 (July 23, 2026) or earlier. Attackers logged in as administrators on versions older than 2.4.2. Users should update to 2.4.7; the exploited flaw is not disclosed. An October 29 critical vulnerability found by Anthropic's Frontier OSS scanner prompted 2.4.7. The August 7 release 2.4.2 had already warned of an exploited LND credential exposure.

BTCPay ServerBitcoinLightning Network+2

Nicolas DorierAnthropicBleepingComputer

Blockchain, Threat Intel, AppSec· Published and added 2 Nov 2026

securityweek.comarticle🛡️ Security

Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk

The Florida Department of Education (FLDOE) disclosed a breach of its Florida Student Financial Aid website (FloridaStudentFinancialAidSG.org), discovered on 19 October and potentially affecting about 4.9 million people. Exposed data may include names, Social Security numbers, dates of birth, addresses, phone numbers and emails. The entry vector and actor are undisclosed. The article links it to the September FLHSMV driver database breach, which came from compromised police credentials.

Florida Department of EducationFlorida Department of Highway Safety and Motor VehiclesFlorida Digital Service+2

Threat Intel· Published and added 2 Nov 2026

bleepingcomputer.comarticle🛡️ Security

Over 1,000 GitLab servers vulnerable to ongoing RCE attacks

CVE-2026-97229 is a maximum-severity integer overflow in GitLab's CI/CD Regular Expression Compiler that lets an unauthenticated attacker run code via a crafted regex in pipeline configuration. GitLab patched it on 12 October 2026 in versions 19.4.2, 19.3.5 and 19.2.8. CISA added it to KEV, and Shadowserver tracks over 1,000 unpatched servers, plus 11,300 exposed to the related CVE-2026-110264.

GitLab

CVE-2026-97229CVE-2026-110264CVE-2026-85706+6

AppSec, DevSecOps, Threat Intel· Published and added 2 Nov 2026

theguardian.comarticle🛡️ Security

Supermarket freezers across Europe hit by second suspected cyber-attack

Guardian report from 2 November 2026 on a second suspected cyber-attack on supermarket refrigeration in Belgium, Estonia, Ireland, Finland, Luxembourg, the Netherlands and Sweden, with temperatures set to 50C. It recaps the earlier French attack on up to 700 shops, which hit mostly Danfoss controllers. SentinelOne and Tributech say the attacks point to sabotage and that many controllers remain internet-exposed and unpatched.

DanfossSentinelOneTributech+5

Threat Intel, Hardware & RF· Added 3 Nov 2026, published 2 Nov 2026

bleepingcomputer.comarticle🛡️ Security

Synology warns of C3RB3R ransomware attacks targeting NAS devices

C3RB3R (Cerber) ransomware is encrypting Synology NAS devices running outdated DiskStation Manager, and Synology issued an advisory urging immediate updates. The attacks exploit a vulnerability patched in December 2024, likely among CVE-2024-10441, CVE-2024-50629 and CVE-2024-10445 from a November 2024 advisory. Victims get a read-me3.txt note and .L0CK3D extension. Shadowserver tracks over 380,000 exposed Synology NAS devices.

Synology DiskStation ManagerConfluenceGitLab

CVE-2024-10441CVE-2024-50629CVE-2024-10445+7

Threat Intel· Published and added 2 Nov 2026

securityweek.comarticle🛡️ Security

Chainalysis Discloses Data Breach Following AI-Driven Cyberattack

Chainalysis disclosed a data breach in which an external actor used offensive agentic techniques to access its systems and internal tools. Exposed data was non-sensitive customer data: user IDs, full names, email addresses and organization role labels. Investigation content, query results and credentials were not compromised. The company says the incident is unrelated to the $6.36 billion Binance heist, and advises users to enable MFA and watch for password reset prompts. Scope and victim count are undisclosed.

LLM

ChainalysisBinanceDPRK

Threat Intel, AI Security· Published and added 2 Nov 2026

bleepingcomputer.comarticle🛡️ Security

Ivanti patches two more Connect Secure zero-days chained in attacks

Ivanti patched two more Connect Secure zero-days, CVE-2026-111357 (privilege escalation) and CVE-2026-118527 (authenticated file upload), chained with authentication bypass CVE-2026-104935 since at least 1 October 2026. Volexity attributed the chain to UTA0576, which ran no malware, re-exploited the device per command and tampered with logs, evading Ivanti's Integrity Checker Tool. CISA added CVE-2026-104935 to KEV, and Shadowserver tracks over 5,000 exposed instances.

Ivanti Connect SecureVPN

CVE-2026-111357CVE-2026-118527CVE-2026-104935+12

Threat Intel, Offensive Security· Published and added 2 Nov 2026

en.cryptonomist.charticle🛡️ Security

Chainalysis security breach exposed customer data and raised phishing risk

Chainalysis confirmed on 30 October 2026 that an external actor accessed its systems and internal tools earlier in October, using what it called "offensive agentic techniques". Exposed data covers some customers' names, emails, job titles, user IDs and role labels. Chainalysis says it has found no access to passwords, session tokens or investigation content so far, and customers should expect targeted phishing. Affected-customer counts and the exploited vulnerabilities are not disclosed.

Chainalysisoffensive agentic techniquesphishing+1

Threat Intel· Published and added 31 Oct 2026

bleepingcomputer.comarticle🛡️ Security

Chainalysis discloses data breach from "offensive agentic techniques"

Chainalysis disclosed a security incident in which an external actor used "offensive agentic techniques" to access internal systems and tools earlier in the month. Exposed customer data includes user IDs, names, email addresses and organizational role labels. The company reports no evidence of access to investigation content, credentials or session tokens, and has shared no details on the vulnerabilities, tools or dwell time. The article also lists other incidents from the same week.

ChainalysisBinanceARTEX+3

Threat Intel, AI Security· Published and added 31 Oct 2026

securityweek.comarticle🛡️ Security

PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) has been exploited for over a week. A China-linked group chained it with the Fragnesia Linux kernel privilege escalation to root at least 25 Palo Alto Networks PAN-OS firewalls with exposed management interfaces. Defiant had seen no confirmed WordPress compromise by 28 October 2026 despite 77,000 requests, and Cato and watchTowr report few successful attackers.

PAN-OSPHPWordPress+2

CVE-2026-109618CVE-2026-109619PHP2Shell+8

Threat Intel, AppSec· Published and added 30 Oct 2026

bleepingcomputer.comarticle🛡️ Security

CISA says max severity GitLab flaw now exploited in the wild

CVE-2026-97229 is a maximum-severity GitLab flaw in the CI/CD Regular Expression Compiler, caused by an integer overflow, that lets unauthenticated attackers run code via a crafted regular expression. CISA added it to the KEV Catalog and ordered federal agencies to patch under BOD 26-04. GitLab fixed it in CE/EE 19.4.2, 19.3.5 and 19.2.8, and Shadowserver tracks about 2,800 exposed CE instances.

GitLab

CVE-2026-97229CVE-2026-0723CVE-2026-110264+10

AppSec, DevSecOps, Threat Intel· Published and added 30 Oct 2026

en.cryptonomist.charticle🛡️ Security

Anthropic security breach exposed salaries and messages, not model weights

Anthropic security incident in which researchers from the startup Cathedral reached Anthropic's commercial, HR and IT systems through vulnerable third-party administrative applications. Exposed data included salaries, job offers, meeting transcripts and Slack messages; Anthropic says customer prompts, source code and model weights were not accessed. Anthropic cut access the same day and kept the apps disabled until vendors patched. The companies dispute whether Cathedral reported all its activity.

AnthropicSlack

CathedralDOGEExternal Researchers Program

Threat Intel· Published and added 30 Oct 2026

bleepingcomputer.comarticle🛡️ Security

Japan Airlines suffers third-party data breach exposing passenger info

Japan Airlines disclosed that unauthorized access to Amadeus's Passenger Service System, between 10 August 2023 and 23 September 2026, exposed data on about 92,000 customers. Roughly 2,000 also had emails, phone and passport numbers exposed. ANA, Asiana Airlines and Korean Air are also reported as affected. Amadeus had announced a booking display vulnerability on 1 October 2026 and has not given the full scope.

Amadeus Passenger Service System

Japan AirlinesAmadeusAll Nippon Airways+3

Threat Intel· Added 30 Oct 2026, published 29 Oct 2026

oversecured.comarticle🛡️ Security

Android security checklist: theft of arbitrary files | Oversecured Blog

Oversecured's Android security checklist on arbitrary file theft from an app's private storage. It covers implicit intents (PICK, GET_CONTENT) returning file:// or content:// URIs, SEND/SEND_MULTIPLE share activities, exported and non-exported FileProviders, path traversal via Uri.getLastPathSegment, WebView, and local NanoHTTPD servers. Each case has vulnerable code, an attacker PoC and fixes such as /proc/self/fd path checks and narrow files-path entries.

AndroidNanoHTTPDFileProvider+2

Oversecuredpath traversalFileUriExposedException+3

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

SDK security in mobile apps: the attack surface your team didn

Oversecured guide to SDK security in mobile apps, built around Microsoft's April 2026 disclosure of an intent redirection flaw in EngageLab's EngageSDK (50 million installs, fixed in 5.2.1). It covers SDK attack surfaces (exported components, WebViews, deep links, hardcoded secrets, payment crypto), a canhub image cropper file-overwrite example, why source-only SAST misses SDK code, and MASVS and PCI DSS expectations.

AndroidEngageSDKOversecured+3

intent redirectionEngageSDK intent redirectionMTCommonActivity+11

Mobile Security, Supply Chain, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

What changed when mobile security stopped being theoretical

An Oversecured Head of Engineering, coming from 20 years of web work, describes four mobile security risks that became concrete after seeing real production apps. These are old vulnerable binaries that stay installed after a fix, secrets embedded in client code, Keychain/Keystore guarantees that are weaker than assumed with tokens leaking via logs, and deep links or exported components acting as public endpoints. It ends with advice: test the shipped artifact, verify the full data lifecycle, and build server-side containment.

AndroidiOSOversecured

deep linkscustom URL schemesApp Links+5

Mobile Security, AppSec· Added 29 Oct 2026

aikido.devarticle🛡️ Security

What are shell vulnerabilities? PHP2Shell, Node2Shell (HTTP2Shell), React2Shell and Log4Shell explained

Explainer on "shell" vulnerabilities, the -Shell naming for RCE flaws that began with Log4Shell (CVE-2021-44228). It compares memory-corruption bugs (PHP2Shell, CVE-2026-109618 and CVE-2026-109619; Node2Shell, CVE-2026-111497, in the Brotli decoder) with design-flaw bugs (Log4Shell, React2Shell, CVE-2025-55182). It covers shared traits, exposure through inherited components, and Brotli patch status across runtimes and distributions.

PHPNode.jsReact+3

CVE-2026-109618CVE-2026-109619CVE-2026-111497+16

AppSec, Learning· Added 30 Oct 2026, published 29 Oct 2026

bleepingcomputer.comarticle🛡️ Security

New Cisco firewall zero-day exploited to crash SSL VPN devices

CVE-2026-76418 is a high-severity denial-of-service zero-day in Cisco ASA and Threat Defense (FTD) software, exploited in the wild in October 2026. Unauthenticated attackers send a crafted request to the SSL VPN (webvpn) when secondary authentication is set on a tunnel group, causing a device reload. Cisco offers no workaround besides disabling secondary authentication on tunnel groups. Shadowserver sees over 51,000 exposed ASA SSL VPN devices.

Cisco ASACisco Firepower Threat DefenseVPN

CVE-2026-76418CVE-2025-20362CVE-2025-20333+10

Threat Intel, Cloud & Infra· Added 30 Oct 2026, published 29 Oct 2026

thedefiant.ioarticle🛡️ Security

Wagyu Confirms Data Leak Exposing Monero Swap Records

Wagyu, a Monero swap service, confirmed a data leak after Hudson Rock found 4,580 orders in exposed records. The records link public-chain deposit transactions to Monero destination addresses and client IP addresses, which undoes the privacy a swap into Monero is meant to give. The fetched page held only the headline and subhead, so the cause, timeline and remediation are not covered.

Monero

WagyuHudson Rock

Threat Intel· Published and added 29 Oct 2026

wired.comarticle🛡️ Security

Leak Exposes 41,000 Homeland Security Workers–Including Undercover ICE Agents

Icepick is a leaked archive of records on more than 41,000 Department of Homeland Security employees and contractors, published by Distributed Denial of Secrets in 2026 and said to come from DHS's Okta login system. WIRED's analysis covers CBP, ICE, HSI, USCIS and CISA staff, plus over 55,000 permission groups that reference undercover programs, Palantir Falcon, PenLink, Signal and Mobile Fortify. Okta says it has no evidence of compromise.

OktaPalantirPenLink+3

IcepickDistributed Denial of SecretsDepartment of Peace+10

Threat Intel, OSINT, Identity & Access· Added 29 Oct 2026, published 28 Oct 2026

decrypt.coarticle🛡️ Security

Bithumb Says Hackers Accessed Internal System, Leaking Personal Data

Bithumb, South Korea's second-largest crypto exchange, said an outside party accessed its internal mobile groupware system and leaked personal data. Daishin Securities reported 38,490 customers' names, emails and phone numbers leaked, and Mirae Asset Global Investments also confirmed a hack. Coinbase vendor Amplitude exposed contact data the same day. Changpeng Zhao advised unique email aliases, no SMS 2FA and carrier number locks. The access method is not disclosed.

BithumbDaishin SecuritiesMirae Asset Global Investments+5

Threat Intel· Published and added 28 Oct 2026

decrypt.coarticle🛡️ Security

Coinbase Customer Data Hit in Analytics Vendor Breach, Funds ‘Not Impacted’

Coinbase said on 28 October 2026 that a security incident at analytics vendor Amplitude exposed contact data of a "small subset" of its customers. Coinbase reports no unauthorized access to its own systems and no impact on funds. It gave no counts, data types or dates. The article recalls the May 2025 bribed-support-agent breach (69,461 customers) and the 2025 Trezor/ShipMonk exposure.

Amplitude

CoinbaseShipMonkTrezor+1

Threat Intel· Published and added 28 Oct 2026

decrypt.coarticle🛡️ Security

Bitcoin Wallet Maker Keystone Pulls Devices as Stolen Key Opens Door to Fakes

Keystone, a Bitcoin hardware wallet maker, will destroy 18,835 unsold devices and has halted shipping after an attacker obtained the permanent WebAuth factory key used to verify genuine hardware, detected October 20, 2026. The key could let counterfeit wallets pass authentication. The breach also exposed 25,964 Shopify buyer records (2024 to 2026) that should have been erased under a 180-day policy; recovery phrases and private keys were not involved.

KeystoneShopifyBitcoin

WebAuth keywrench attacksChainalysis+2

Threat Intel, Hardware & RF· Published and added 27 Oct 2026

Showing 30 of 194