Skip to content

771 results for “SEC”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types1919Articles771Write-ups333Papers265Repos252Advisories122
Threads87Tools27Talks22Other18Courses12Videos10
📄 Articles“SEC”Clear all
en.cryptonomist.charticle🛡️ Security

Chainalysis security breach exposed customer data and raised phishing risk

Chainalysis confirmed on 30 October 2026 that an external actor accessed its systems and internal tools earlier in October, using what it called "offensive agentic techniques". Exposed data covers some customers' names, emails, job titles, user IDs and role labels. Chainalysis says it has found no access to passwords, session tokens or investigation content so far, and customers should expect targeted phishing. Affected-customer counts and the exploited vulnerabilities are not disclosed.

Chainalysisoffensive agentic techniquesphishing+1

Threat Intel· Published and added 31 Oct 2026

bleepingcomputer.comarticle🛡️ Security

Northflank security breach leads to abuse of customers' AI API keys

Northflank, a cloud application hosting platform, disclosed a breach on 30 October 2026 after a Wiz threat alert and told customers to assume all environment variables were decrypted and to rotate secrets. Customers reported unauthorized use of AI API keys. Wiz's "Black October for AI Developer Platforms" report counts at least nine incidents, including Railway, OpenCode, Warp and Lightning AI, and describes LLMJacking, with about 2.5 million Amazon Bedrock calls costing roughly $100,000 in two cases. Northflank has not said how attackers got in.

NorthflankWizAWS Bedrock+3
LLMJackingBlack October for AI Developer PlatformsRailway+2

Threat Intel, AI Security, DevSecOps· Published and added 31 Oct 2026

bleepingcomputer.comarticle🛡️ Security

Chainalysis discloses data breach from "offensive agentic techniques"

Chainalysis disclosed a security incident in which an external actor used "offensive agentic techniques" to access internal systems and tools earlier in the month. Exposed customer data includes user IDs, names, email addresses and organizational role labels. The company reports no evidence of access to investigation content, credentials or session tokens, and has shared no details on the vulnerabilities, tools or dwell time. The article also lists other incidents from the same week.

ChainalysisBinanceARTEX+3

Threat Intel, AI Security· Published and added 31 Oct 2026

stepsecurity.ioarticle🛡️ Security

Binance’s $6.3 Billion Hack Puts Developer Machine Security in Focus

StepSecurity's analysis of Binance's 29 October 2026 incident, which Binance puts at about $6.3 billion in affected assets. It covers Binance's disclosure of a possible DevOps laptop compromise, and TRM Labs and Elliptic findings on 50 EIP-7702 authorizations and a persistent delegation. It links this to the Nx, OVHcloud CLI and Claude Code extension compromises, gives an investigation checklist, then describes StepSecurity products.

EthereumnpmVS Code+3
BinanceTRM LabsElliptic+5

Blockchain, Supply Chain· Published and added 30 Oct 2026

galaxy.comarticle🛡️ Security

Weekly Research Brief: Binance Hacked; Hyperliquid on Wall Street; Prediction Markets’ Brazil ‘Miss’

Galaxy Research's weekly brief of 30 October 2026 opens with the Binance hack: about $6.3b drained across 10 blockchains, attributed by TRM Labs and Chainalysis to TraderTraitor (Lazarus-linked). The attacker used EIP-7702 with 50 pre-signed authorizations on Ethereum, and Binance's preliminary finding is a compromised DevOps laptop reaching a service container. Tether and Circle froze about $2.6b. The other sections cover Hyperliquid and prediction markets.

EthereumBitcoinUSDC+2
TraderTraitorLazarus GroupEIP-7702+7

Blockchain, Threat Intel· Added 30 Oct 2026

bankless.comarticle🛡️ Security

Polymarket Sends $3.9M Back to Traders After Vendor Script Drain

Polymarket's international site was hit on 29 October 2026 when a page-speed monitoring script served from DebugBear's CDN was replaced with a drainer. It hijacked logged-in sessions for about an hour and took $2.7M from 726 wallets via Polymarket's relayer. Scott Helme of Report URI says the CSP allowlisted every domain used and that hash pinning would have blocked the swapped file. Polymarket is repaying $3.9M, and this is its second vendor-script compromise since June.

Polymarket
DebugBearReport URIBitquery+1

Supply Chain, AppSec· Published and added 30 Oct 2026

decrypt.coarticle🛡️ Security

Secret Service, FBI Join Binance Hack Probe as Circle Freezes $823 Million

Decrypt reports that Binance is working with the FBI and U.S. Secret Service after a theft of about $6.4 billion, which TRM Labs and Chainalysis attribute to North Korea's TraderTraitor group, also linked to the February 2025 Bybit hack. Circle froze about $823 million in USDC and Tether froze USDT, though the page gives differing Tether totals. Binance first suspected a compromised DevOps engineer laptop, found more breach points, and saw no evidence of leaked wallet private keys.

USDCTether
TraderTraitorBinanceBybit+10

Blockchain, Threat Intel· Published and added 30 Oct 2026

securityweek.comarticle🛡️ Security

In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak

SecurityWeek's weekly roundup of 30 October 2026 covers CVE-2026-97631, a 16-year-old buffer overflow in TianoCore EDK II that affects PXE network boot on most servers. It also covers a Cloudflare Workers AI cross-tenant leak caused by an SGLang bug, Anthropic's dispute with Cathedral over a bug bounty intrusion, and fake AI bots probing for secrets. Other items include AI-assisted ransomware (Gold Ogre, Aur0ra), the NIK C2 framework, and North Korean IT worker sanctions.

TianoCore EDK IISGLangCloudflare Workers+3
CVE-2026-97631CathedralCequence+9

Threat Intel, AI Security, Hardware & RF· Published and added 30 Oct 2026

21shares.comarticle🛡️ Security

Binance hack: the largest robbery in financial history

Binance hack analysis from 21shares on the 29 October 2026 theft of about $6.3 billion from Binance. Binance's initial finding points to a compromised DevOps engineer's laptop with no sign of a leaked wallet key. Chainalysis attributes it to North Korea with high confidence, and about $3 billion was frozen by Tether, Circle and the Arbitrum Security Council. The attacker also borrowed about $44.6 million of WETH on Aave. Binance says SAFU and company funds will cover all losses.

AaveTetherUSDC+2
BinanceLazarus GroupDPRK+7

Threat Intel, Blockchain· Published and added 30 Oct 2026

aikido.devarticle🛡️ Security

Binance hack: how a compromised developer laptop can lead to a $6.3 billion breach

Aikido Security's analysis of the roughly $6.3 billion Binance incident, which Binance says may have started with a compromised DevOps engineer's laptop. It sets out what is known (no private key leak, TraderTraitor attribution by TRM Labs and Chainalysis, additional breach points) and a plausible chain from laptop credentials to a withdrawal service. It compares the 2025 Bybit theft and lists mitigations.

npmVS CodeAWS+1
BinanceTraderTraitorLazarus Group+9

Blockchain, Threat Intel, Supply Chain· Published and added 30 Oct 2026

decrypt.coarticle🛡️ Security

Binance Finds 'Additional Points of Breach' in $6.3B Hack

Binance estimated the October 2026 security incident at about $6.3 billion and said it found "additional points of breach" beyond the compromised DevOps engineer laptop it first named. The attacker reached a service container and submitted unauthorized withdrawals, with no wallet private key leak found. Arkham counted $6.01 billion taken from hot wallets on nine chains; Tether and Circle froze about $1.8 billion in stablecoins. About $3 billion is frozen onchain; withdrawals stay suspended.

TetherUSDCEthereum+2
BinanceArkhamRichard Teng+4

Threat Intel, Blockchain· Published and added 30 Oct 2026

openai.comarticle🧠 AI

Community safety report and new protections for teens

OpenAI announces a Community Safety Report on violence prevention, with the first edition due early 2027 covering the second half of 2026 and updates every six months. ChatGPT will also give less detail on past mass attacks, respond more conservatively after warning signs, and end chats that fixate on violence. Teen accounts get tighter weapons limits, backed by age prediction, Persona verification and parental alerts.

ChatGPTChatGPT for Teensage prediction
OpenAIPersona

ai-safety, ai-policy· Published and added 30 Oct 2026

en.cryptonomist.charticle🛡️ Security

Anthropic security breach exposed salaries and messages, not model weights

Anthropic security incident in which researchers from the startup Cathedral reached Anthropic's commercial, HR and IT systems through vulnerable third-party administrative applications. Exposed data included salaries, job offers, meeting transcripts and Slack messages; Anthropic says customer prompts, source code and model weights were not accessed. Anthropic cut access the same day and kept the apps disabled until vendors patched. The companies dispute whether Cathedral reported all its activity.

AnthropicSlack
CathedralDOGEExternal Researchers Program

Threat Intel· Published and added 30 Oct 2026

en.cryptonomist.charticle🛡️ Security

Binance probes a suspected cryptocurrency breach: $6.3B affected, about $3B frozen

Binance disclosed a suspected security incident on 29 October 2026, estimating $6.3 billion affected and about $3 billion frozen. Binance's early finding is that a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawals, with no evidence of wallet private-key leakage. TRM Labs suspects TraderTraitor, the group tied to the February 2025 Bybit theft. Tether, Circle and Ripple froze funds.

TetherUSDC
BinanceTraderTraitorLazarus Group+7

Blockchain, Threat Intel· Published and added 30 Oct 2026

penligent.aiarticle🛡️ Security

CVE-2026-98432: Linux TCP Use-After-Free Risk and Patch Validation

CVE-2026-98432 is a use-after-free in the Linux kernel IPv4 TCP handshake path: a request socket's ireq_opt pointer moves to the child socket as inet_opt and is freed with kfree() while a retransmitted-SYN CPU still reads it under RCU. The fix (commit e3f33b0a1d89) uses kfree_rcu(). The page covers CVSS 9.8 versus vendor scores, Anthropic's MPTCP root-exploit lab demo, per-distribution patch checks, MPTCP listener inventory and detection guidance. The page was truncated before its mitigation section.

Linux kernelCVSSGo+3
CVE-2026-98432use-after-freeMultipath TCP+4

Cloud & Infra, Blue Team & Detection· Added 31 Oct 2026, published 30 Oct 2026

depthfirst.comarticle🧠 AI

dfbench — depthfirst

dfbench is depthfirst's held-out benchmark for frontier models on open-ended defensive security work: vulnerability detection, validation of findings, and differential analysis between commits. It reports recall, precision, F1 and cost per task for about 20 models at several thinking levels, split by domain (application, low level, smart contract) and by single or multi-repo scope. Overall detection recall ranges from about 21% to 69%.

LLM
dfbenchdepthfirstGPT-5.6 Sol+16

evals· Added 29 Oct 2026

bleepingcomputer.comarticle🛡️ Security

Hugging Face malware campaign returns to hijack GPUs for crypto mining

A campaign of 31 malicious Hugging Face repositories across seven accounts, found by Pluto Security, posed as small Qwen2 checkpoints and used trust_remote_code to run a cryptominer and reverse shell on GPU inference hosts. The top model reached 28,412 downloads and scanned clean, and a second wave returned within days of takedown. The article also covers a fake Solana starter kit on GitHub that installs NetSupport Manager via a PowerShell one-liner aimed at AI coding agents.

Hugging FaceQwenXinference+3
Pluto SecurityAir Securitytrust_remote_code+9

Supply Chain, AI Security, Threat Intel· Added 30 Oct 2026, published 29 Oct 2026

rekt.newsarticle🛡️ Security

Rekt - News or Hype?

Rekt News piece tracing three AI-security headlines back to their sources. It covers Justin Drake's October 2026 "bunker mode" warning about AI breaking ECDSA, OpenAI's report of a model spending Sepolia test ETH from a default developer mnemonic, and Wiz's "70% of the Internet" claim for PHP CVE-2026-109618 and CVE-2026-109619. It closes with four questions for checking a claim.

OpenAIPHPEthereum+3
CVE-2026-109618CVE-2026-109619Justin Drake+13

AI Security, other· Added 29 Oct 2026

pillar.securityarticle🛡️ Security

SAIL Framework: A Practical Guide for AI Security

The SAIL Framework from Pillar Security is a seven-phase, lifecycle-oriented method for securing AI systems. The phases are AI policy and safe experimentation, AI asset discovery, AI security posture management, AI red teaming, runtime guardrails, sandboxed execution for agents and MCP servers, and AI activity tracing. It argues for a "Shift Up" approach that protects the business logic AI controls, and it is meant to sit on top of existing standards.

Model Context Protocol
SAIL FrameworkPillar Securityprompt injection+3

AI Security, GRC· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

Android security checklist: theft of arbitrary files | Oversecured Blog

Oversecured's Android security checklist on arbitrary file theft from an app's private storage. It covers implicit intents (PICK, GET_CONTENT) returning file:// or content:// URIs, SEND/SEND_MULTIPLE share activities, exported and non-exported FileProviders, path traversal via Uri.getLastPathSegment, WebView, and local NanoHTTPD servers. Each case has vulnerable code, an attacker PoC and fixes such as /proc/self/fd path checks and narrow files-path entries.

AndroidNanoHTTPDFileProvider+2
Oversecuredpath traversalFileUriExposedException+3

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

Content Providers and the potential weak spots they can have | Oversecured Blog

Oversecured's Android security checklist for Content Providers covers insecure FileProvider path configs, path traversal via decoded Uri.getLastPathSegment(), mismatched readPermission/writePermission, proxying requests to more privileged providers, SQL injection across a shared database, and sensitive actions in providers. Each case has vulnerable manifest and Java code, an attacker PoC and remediation. Real cases from Google and Samsung devices are cited. The page text was truncated near the end.

AndroidSQLiteJava
Oversecuredpath traversalSQL injection+5

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

Oversecured Apps Care. Part 1: Vulnerability disclosure of 225 Google apps | Oversecured Blog

Oversecured Apps Care, Part 1 (21 March 2024) publishes scanner results for about 224 Google Android apps, drawn from a wider scan of over 6,000 public APKs from 1,000+ companies. Tables per device image (phone, Wear OS, Android Automotive, Android TV) give package names, three finding counts and report links, including android, com.android.settings, gms and Play Store. It invites researchers to report issues to Google for rewards.

AndroidWear OSAndroid Automotive+1
OversecuredOversecured Apps Care

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

Inside mobile taint analysis: how source-to-sink tracking finds real data-leak paths | Oversecured Blog

Oversecured explains taint analysis for Android and iOS apps and contrasts it with pattern-matching SAST such as MobSF. It covers source, flow and sink, cross-component tracking over Intents, flag-based sanitizer modeling and implicit intent simulation. The case study is an unsafe Class.forName().newInstance() on a Serializable transportFactoryClassName field in Google's com.google.auth.oauth2 credential classes, which Google fixed with a $3,133.70 bounty.

AndroidiOSOversecured+3
intent redirectionpath traversalSSRF+4

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

Android deep link vulnerabilities: how intent filters lead to account takeover | Oversecured Blog

Oversecured's article on Android deep-link vulnerabilities covers five patterns: custom scheme hijacking, open redirect into WebView, limited and full intent redirection, and domain takeover via an expired whitelist entry. It shows bypass payloads, intent selector abuse, and the HierarchicalUri reflection bypass. It also compares what SAST and DAST can find and gives a checklist for pentesters.

AndroidOAuthChrome+1
deep link hijackingcustom scheme hijackingopen redirect+8

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

Vulnerabilities that lead to account takeover in banking and fintech mobile apps | Oversecured Blog

Oversecured guide to eight vulnerability categories that lead to account takeover in mobile banking and fintech apps: WebView JavaScript bridge token leakage, Intent Redirection, hardcoded tokens, deeplink hijacking, insecure token storage, localhost OAuth listeners, AIDL abuse and weak biometric auth. It includes a WebView PoC based on Samsung SmartThings CVE-2022-30746 and maps findings to OWASP MASVS, PCI DSS and PSD2. It argues taint analysis plus dynamic PoC is needed to find multi-component chains.

AndroidiOSOAuth+1
CVE-2022-30746Intent Redirectiondeeplink hijacking+9

Mobile Security, AppSec, Identity & Access· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

SDK security in mobile apps: the attack surface your team didn

Oversecured guide to SDK security in mobile apps, built around Microsoft's April 2026 disclosure of an intent redirection flaw in EngageLab's EngageSDK (50 million installs, fixed in 5.2.1). It covers SDK attack surfaces (exported components, WebViews, deep links, hardcoded secrets, payment crypto), a canhub image cropper file-overwrite example, why source-only SAST misses SDK code, and MASVS and PCI DSS expectations.

AndroidEngageSDKOversecured+3
intent redirectionEngageSDK intent redirectionMTCommonActivity+11

Mobile Security, Supply Chain, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

What changed when mobile security stopped being theoretical

An Oversecured Head of Engineering, coming from 20 years of web work, describes four mobile security risks that became concrete after seeing real production apps. These are old vulnerable binaries that stay installed after a fix, secrets embedded in client code, Keychain/Keystore guarantees that are weaker than assumed with tokens leaking via logs, and deep links or exported components acting as public endpoints. It ends with advice: test the shipped artifact, verify the full data lifecycle, and build server-side containment.

AndroidiOSOversecured
deep linkscustom URL schemesApp Links+5

Mobile Security, AppSec· Added 29 Oct 2026

oversecured.comarticle🛡️ Security

PCI DSS and Mobile Apps: A Simple Guide | Oversecured Blog

Guide to PCI DSS v4.0.1 scope for mobile apps, with a mapping of common Android and iOS finding types to the requirements they break (Req 2, 3, 4, 6, 7). It covers which app behaviors bring an app into scope and gives three anonymized cases: cleartext HTTP in a vendor native library, hardcoded keys in a third-party SDK, and an implicit Intent leaking data. It argues for testing the shipped binary and keeping a current component inventory.

AndroidiOS
PCI DSSPCI Security Standards CouncilQualified Security Assessor+5

Mobile Security, GRC· Added 29 Oct 2026

depthfirst.comarticle🛡️ Security

dfbench — depthfirst

dfbench is a held-out benchmark maintained by depthfirst that scores frontier LLMs on defensive security work: vulnerability detection, validation (precision) and differential analysis between commits. It reports recall, precision, F1 and cost per task by model and thinking level, split by application, low-level and smart-contract code and by single or multi-repo scope. Overall detection recall runs from about 21% to 69%, with the top figure at $99.19 per task for Mythos 5; validation precision mostly falls between 15% and 49%.

LLMKimi K3Grok+3
dfbenchdepthfirstGPT-5.6 Sol+3

AI Security, AppSec· Added 29 Oct 2026

decrypt.coarticle🛡️ Security

Polymarket Pauses Trading as Prediction Market Investigates Security Incident

Polymarket put its exchange in cancel-only mode and paused relayer actions on 29 October 2026 after users reported funds withdrawn without permission. Hudson Rock says a DebugBear-hosted script holds wallet-draining code that sells a logged-in user's positions and hard-codes the suspected attacker's wallet (about $2.65 million in POL, per Arkham) as fallback recipient. Polymarket blames a compromised third-party provider and promises to make users whole. Root cause and victim count are unconfirmed.

DebugBearPolygonRelay
PolymarketHudson RockArkham+2

Supply Chain, Threat Intel· Published and added 29 Oct 2026

Showing 30 of 771

Show more