109 results for “certifi”

XCPE is an Android TV box botnet of more than 1.3 million devices, which Google's Threat Intelligence Group attributes with high confidence to manufacturer Videostrong Technology, who preinstalled a system-level backdoor in firmware. The backdoor (x.cpe, com.oemservice) used an MQTT broker for commands and loaded ad fraud and residential proxy modules. Google took down C2 servers tied to 10 million more devices and banned Videostrong from certified Android devices.

bleepingcomputer.comarticlePublished and added 2 Nov 2026🛡️ Security

Bunny CDN status-page notice, posted 28 October 2026, about unauthorized access at an infrastructure provider that hosted one bunny.net CDN node in Armenia. Traffic was stopped within 20 minutes and the server wiped. No access to the node was found, but cached content, Pull Zone configs and TLS certificates could have been exposed, so all platform certificates were reissued. Customers with their own certificates should rotate them with new private keys.

status.bunny.netadvisoryAdded 31 Oct 2026, published 30 Oct 2026🛡️ Security

Cloudflare's follow-up on eMudhra's eight trivially recoverable intermediate CA keys (such as 4, 56 and 66), disclosed 19 October 2026. Pingora logging showed about 22,000 handshakes with the weak keys, including about 160 forged certificates made within hours of disclosure. Probes on 50 million challenge pages show many bots, old browsers and Android WebView still trust the chain.

blog.cloudflare.comwriteupPublished and added 30 Oct 2026🛡️ Security

Microsoft Threat Intelligence analysis of two human-operated intrusions that began with Teams help desk impersonation and Quick Assist sessions, then diverged at AD CS. Case 1 abused an ESC1 template for privileged certificates and DCSync, with an excluded account later used for Rclone exfiltration. Case 2 used PetitPotam and ESC8 relay to get a domain controller certificate and PKINIT. Includes investigation steps, AD CS hardening and KQL hunting queries.

microsoft.comwriteupPublished and added 30 Oct 2026🛡️ Security

ai-engineering-from-scratch is a free, MIT-licensed curriculum of 542 lessons in 20 phases, from math and deep learning through transformers, LLM engineering, MCP, agents and capstones. Code is in Python, TypeScript, Rust and Julia. It includes three graded projects (retrieval evaluation, agent trace debugger, tool call firewall), installable tutor skills for Claude Code and Codex, and certification prep tracks.

github.comcourseAdded 29 Oct 2026🧠 AI

SecurityWeek article examining US election security through a cybersecurity lens. It covers voting machines certified by the Election Assistance Commission but unpatched for up to two years, machines hacked at DEF CON's Voting Village, and QR-code ballots voters cannot verify. Sequent's Shai Bargil proposes open-source software and encrypted vote records. It also covers AI-enabled influence campaigns such as the 2024 Biden deepfake robocall.

securityweek.comarticlePublished and added 29 Oct 2026🛡️ Security

FoxIO disclosed three TLS flaws in the GoAhead embedded web server from EmbedThis, used on hundreds of millions of IoT, OT and network devices. CVE-2026-115881 (CVSS 9.1) leaves revoked client certificates accepted under mTLS with OpenSSL; CVE-2026-115884 (7.4) bypasses chain-length limits with LibreSSL; a third Mbed TLS bug (5.9, no CVE) weakens TLS 1.2 DHE. GoAhead 6.1.1 fixes the OpenSSL and Mbed TLS issues, and FoxIO released PoC code and fingerprints.

securityweek.comarticlePublished and added 28 Oct 2026🛡️ Security

Decrypt reports that OpenAI published a 67-page paper (dated 17 October 2026, revised 25 October) claiming its AI found a deterministic subexponential-time algorithm for counting 3-SAT solutions, which would refute the Exponential Time Hypothesis. The proof was formalized in Lean. Impagliazzo, Paturi and Ryan Williams are reviewing it independently and say this is not certification. Anthropic posted a Claude-credited 3-SAT paper on 26 October.

decrypt.coarticlePublished and added 27 Oct 2026🧠 AI

The ViktorUJ/cks course is an open-source, community-maintained preparation course for the CKS (Certified Kubernetes Security Specialist) exam. It has 33 chapters grouped by CKS domain: cluster setup, hardening, system hardening, microservice vulnerabilities, supply chain, and runtime security. It also has 15 labs with automatic checks (labs 101-114), mock exams and Killer.sh guidance. Core labs target Kubernetes v1.36.

github.comcourseAdded 27 Oct 2026🛡️ Security

Proof of One is an open-source design for polls with one verified human per identity and unlinkable ballots. Enrolment proves in zero knowledge that an ICAO 9303 passport chip was signed by a trusted signer, plus an enclave face match. Voting uses threshold exponential ElGamal on Baby Jubjub with Groth16 proofs, and tally uses a GJKR DKG with a 7-day challenge window. The author, who is pseudonymous, discloses that AI agents drafted most of it and asks for critique of unlinkability, circuit completeness and certificate trust.

ethresear.chthreadPublished and added 27 Oct 2026🛡️ Security

Inventory of post-quantum migration work for Ethereum consensus-layer networking, by adust09 of Nyx Foundation. It maps three targets: Discovery v5/ENR signatures and key exchange, TLS 1.3 key agreement in QUIC, and libp2p TLS identity binding and CertificateVerify. It covers the 300-byte ENR and 1,280-byte packet limits, why hybrid KEMs do not authenticate peers, and downgrade and DoS concerns. It selects no algorithm or schedule.

ethresear.charticlePublished and added 27 Oct 2026🛡️ Security

Poly2MsgLeaks is a profiled chosen-ciphertext power-analysis attack on the SMAUG-T (TiMER parameter set) post-quantum KEM that recovers the full 512-coefficient PKE secret from six traces on an STM32F415. It recovers 999 of 1,000 unseen secrets and proves an incorrect key is released with probability at most 2^-2095.6. Single-write message assembly and a two-share masked P2M resisted the evaluated six-execution attack.

eprint.iacr.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

Socket post on why fixing the eMudhra weak-key intermediate CA incident (October 2026) and Brotli memory corruption CVE-2026-111497 takes more than updating Node.js. Bundled Brotli copies in Bun, Python Requests and .NET, Go binaries needing rebuilds, and per-program certificate stores all leave stale copies. It lists steps: track bundled components, keep a rebuild path, use workarounds, and verify the shipped artifact.

socket.devarticlePublished and added 26 Oct 2026🛡️ Security

This IACR ePrint 2026/2632 paper by Demirtaş and Yayla analyses the Crites–Stewart adaptive forgery attack on threshold Schnorr signatures, which needs one call to a sparse linear search oracle (bounded distance decoding of a scaled Reed–Solomon code). It shows that choosing the commitment coefficient vector does not help much: a wrapper adversary with Q challenges succeeds with probability at most QM/p, even if its solvers decode every witness for free. For the six original (N, τ) pairs, M stays below 2^24, so the bound is under 2^-100 after 2^128 challenges at p = 2^252.

eprint.iacr.orgpaperAdded 26 Oct 2026, published 24 Oct 2026🛡️ Security

Intervention-Certified Amplification (ICA) is a validity gate for sigma-weighted hybrid SFT/RL post-training. The paper shows that DIAA, a per-sample sigma-weighted hybrid, emits unexecuted tool-integrated reasoning on 29% of MATH-500 prompts (three times vanilla GRPO) even with Python fences removed from its anchor. ICA gates sigma with paired-rollout evidence, cutting TIR to 13.8% (frozen) and 11.2% (online) and raising accuracy from 47.5% to 48.7% and 49.3%. It transfers to GSM8K.

arxiv.orgpaperAdded 27 Oct 2026, published 24 Oct 2026🧠 AI

The paper formalizes elliptic-curve semiprimality certificates by adapting the Goldwasser-Kilian primality criterion. For certificates built with complex multiplication, a norm-lattice reconstruction factors N from (N, S, D) alone in expected polynomial time. The author uses it, plus public-point and quadratic-twist attacks, to factor Reble's 1084-digit and Broadhurst's 5061-digit moduli, and shows that hidden-cofactor, withheld-CM-map and private-isogeny repairs also fail.

eprint.iacr.orgpaperAdded 26 Oct 2026, published 24 Oct 2026🛡️ Security

Endor Labs roundup of the 20 to 21 October 2026 patch wave: eMudhra certificate authority keys that anyone can recover, PHP2Shell (CVE-2026-109618, CVE-2026-109619), Node2Shell (CVE-2026-111497) and malware in LiteLLM 1.107.0. It lists fixed versions (PHP 8.2.35 to 8.5.12, Node.js 22.23.4, 24.22.1, 26.12.1, LiteLLM back to 1.106.2) and explains why many separate trust-store copies each need updating. It closes with advice on triage, remediation and SBOM/VEX reporting.

endorlabs.comarticlePublished and added 24 Oct 2026🛡️ Security

Guidance on the October 2026 eMudhra / emSign CA incident, where eight intermediate CA certificates had private keys generated with insufficient randomness. It explains why updating certifi alone does not fix pip's vendored bundle, and lists fixed versions (certifi 2026.10.19, pip 26.2.2, Python 3.15.1, 3.14.9, 3.13.17). StepSecurity's OpenSSL 4.0.3 tests showed the older bundle accepted seven emSign paths, while both corrected bundles rejected all fourteen.

stepsecurity.ioarticlePublished and added 22 Oct 2026🛡️ Security

Balsamic is a complete homomorphic Unbalanced Oil and Vinegar (UOV) signer, used to build one-round threshold UOV signatures from a packed discrete-CKKS FHE circuit. A paired-pivot linear solver and pivot-success certificates allow encrypted retry selection. In 2-out-of-3 semihonest signing, each online partial signature takes 10.7 s on an RTX 6000 Ada and 7.77 s on a GB300, with 5.25 MB per response.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 22 Oct 2026🛡️ Security

Unit 42 advisory on the compromise of eight intermediate CA private keys belonging to Indian CA eMudhra Limited. The keys were generated with insufficient randomness, so attackers could derive them from the public certificates and sign rogue TLS certificates for MitM attacks. eMudhra has revoked the certificates and browser and OS vendors have untrusted them. Interim guidance covers PKI and trust store audits, reissuance, strict CRL/OCSP checking, log hunting, CT monitoring and CAA records.

unit42.paloaltonetworks.comadvisoryAdded 30 Oct 2026, published 22 Oct 2026🛡️ Security

Cloudflare's account of obtaining South Korea's ISMS-P certification after a ten-day KISA audit of 80 controls and a preparation period of about a year and a half. It explains that the certificate covers a service delivery boundary rather than a product list, that auditors required readable data flow diagrams, and how Korean sign-up uses itemized consent with social login removed.

blog.cloudflare.comarticleAdded 29 Oct 2026, published 22 Oct 2026🛡️ Security

eMudhra's eight intermediate CA certificates, chaining to emSign ECC Root CA - G3, had private keys below 256 (one is 4), disclosed on 17 October 2026 by a researcher known as Wayne. Browsers and Microsoft blocked them via revocation pushes, but curl, git, containers, language runtimes and IoT may still trust them. The post gives patched ca-certificates versions, test commands and the timeline.

aikido.devarticlePublished and added 22 Oct 2026🛡️ Security

CyberForge CVE of the Day #084 analyses CVE-2026-76466, a CVSS 9.8 flaw in clustered Cisco Expressway-C and Expressway-E. Persistent database cookies and weak client-certificate validation allow root OS command execution over the network. The fix is X15.5.20 (X14 and earlier must migrate), with no workaround. It adds a per-peer SOC investigation trail, reachability checks and exposure status from CISA SSVC, KEV and EPSS.

x.comadvisoryAdded 24 Oct 2026, published 22 Oct 2026🛡️ Security

Oracle Security Alert for CVE-2026-91403 ships Java SE updates that distrust a set of intermediate CA certificates tied to eMudhra. It contains one new patch for Oracle Java SE, described as remotely exploitable without authentication. Customers are told to update Java or apply mitigations listed at ops.java/emudhra and in the Patch Availability Document. No reporter is credited and the page gives no CVSS score or technical detail.

oracle.comadvisoryAdded 23 Oct 2026, published 21 Oct 2026🛡️ Security

The eMudhra CA compromise (disclosed 20 October 2026) involves eight intermediate CA certificates whose private keys can be derived from the certificates themselves. They chain to AAA Certificate Services and three other roots. Browsers block them, but non-browser clients skip revocation and CT checks. Endor Labs finds 25 popular packages with frozen bundled root stores, 11 already patched, and gives a fingerprint-scanning script, test hosts and patch steps.

endorlabs.comarticlePublished and added 21 Oct 2026🛡️ Security

Cisco Talos describes eight eMudhra intermediate CA certificates (six TLS, two code signing) whose P-384 private keys were trivially recoverable because a flaw in an April 30, 2025 key generation ceremony produced weak keys with only 3 to 8 bytes of entropy. The post lists certificate SHA-256 hashes and serials, browser and Microsoft blocks, and the Go fix (CVE-2026-111943, Go 1.27.3 and 1.26.10) that filters chains by SPKI hash. It covers impact on VPNs, CI/CD and embedded devices, and Snort SIDs 67363 to 67374.

blog.talosintelligence.comadvisoryPublished and added 21 Oct 2026🛡️ Security

Best practices for integrating AWS IAM Roles Anywhere with an external PKI so non-AWS workloads get temporary credentials via X.509 certificates. Covers trust anchor placement, certificate attributes (CN, issuer, SAN) in trust policy conditions, short-lived versus just-in-time certificates, and private key protection with PKCS #11, TPM 2.0 and OS certificate stores. Includes credential helper modes (serve, update), expiry monitoring, blue/green trust anchor rotation and a sample CloudFormation template.

aws.amazon.comarticlePublished and added 21 Oct 2026🛡️ Security

Analysis of the eMudhra intermediate CA compromise disclosed 20 October 2026, in which eight intermediate CA private keys were weak P-384 keys (top 376 bits zero, one key equal to 4) and publicly accessible. It explains web PKI chains and why browsers enforcing Certificate Transparency were not exposed. It argues MCU firmware that bundles only the single root it needs, as in Zephyr's HTTP GET sample, is likely safe unless it trusts an eMudhra or Sectigo cross-signing root.

danielmangum.comarticleAdded 22 Oct 2026, published 21 Oct 2026🛡️ Security

Eight intermediate CA certificates issued by Indian CA eMudhra in April 2025 had private keys generated with weak entropy, effectively all zeroes except the last byte, so they could be recovered almost instantly with baby-step giant-step. Mozilla and Google blocked them on 17 October 2026, Apple on 19 October and Microsoft on 20 October. eMudhra blamed a key ceremony script flaw that created a second, weaker key pair.

securityweek.comarticlePublished and added 21 Oct 2026🛡️ Security

PQ-Vault is a custody design for unmodified Ethereum against quantum key recovery. It combines a quantum-safe vault contract, a proof-of-stake sidechain with compact certificates, and an optimistic dispute protocol. The paper proves that compact certificates with classically chosen parameters fall from 128 to about 60 bits against quantum attackers, and bounds a seed-update stake-steering attack. For 65,536 validators a certificate is 0.8 MB and verifies in about 20 ms, and the vault accepts a checkpoint for about 420,000 gas.

arxiv.orgpaperAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

eMudhra, an Indian certificate authority with over 60 million issued certificates, had eight CA private keys that were tiny integers such as 4, 56 and 237. Researcher Scott Helme recovered all eight from public certificates in under a second, and the keys were exposed from April 2025. Mozilla, Chrome, Apple and Microsoft blocked them between 17 and 20 October 2026, but curl, Python, Node.js, Go and Java accepted a forged Stripe API certificate because they skip revocation checks.

coindesk.comarticlePublished and added 21 Oct 2026🛡️ Security

eMudhra Intermediate CA Compromise is a 20 October 2026 link-blog post reporting that private keys of eight eMudhra intermediate CA certificates were compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome programs. Software bundling trust lists needs updating: Linux distros must update ca-certificates, and uv 0.13.4, pip 26.2.2 and certifi 2026.10.19 ship new lists. The post does not describe how the keys were compromised.

simonwillison.netarticleAdded 21 Oct 2026, published 20 Oct 2026🛡️ Security

Cloudflare's incident post on the compromise of private keys for eight eMudhra intermediate certificates, disclosed 19 October 2026. The weak keys let an attacker forge certificates for any domain. It describes Cloudflare's patching of trust stores, WARP and cloudflared, tells developers to update the underlying TLS verifier and not disable verification, and points to Dennis Jackson's test site and revocation systems such as CRLSets and upki.

blog.cloudflare.comwriteupAdded 29 Oct 2026, published 20 Oct 2026🛡️ Security

GetSubDomains is an open-source tool by yogsec that enumerates subdomains by querying crt.sh certificate transparency logs. It is aimed at the reconnaissance step of penetration tests and bug bounty work. The source is a short tweet pointing to a GitHub repository, so usage details and options are not given.

x.comrepoAdded 21 Oct 2026, published 19 Oct 2026🛡️ Security

SecurityWeek covers ThreatFabric's findings on Hirudo, an Android banking trojan/RAT delivered via droppers hidden in fake shopping, adult video and short drama apps. It replaces eight Indonesian banking apps with modified copies containing a hooking engine that spoofs signing certificates and hides Accessibility services, screen capture and Play Integrity checks, while providing WebRTC screen viewing, camera access and SMS theft. ThreatFabric advises banks to enforce Play Integrity server-side, use behavioral analytics, treat Accessibility signals as risk inputs, and keep backend transaction-risk controls.

securityweek.comarticlePublished and added 15 Oct 2026🛡️ Security

The paper proposes a post-quantum architecture for WireGuard that leaves the core protocol unchanged. A mutually authenticated TLS 1.3 control channel runs over TCP, UDP (DTLS) or QUIC and uses ML-KEM key establishment, with X.509 certificates from a PKI signed with ML-DSA. A shared secret derived from the session's exported keying material is injected into WireGuard's native PSK interface. A Tamarin model of the TLS–WireGuard composition layer checks secrecy, binding and provisioning-order properties and identifies the conditions needed for secure deployment. The authors benchmark handshake latency and CPU time for classical, pure-PQ and hybrid key establishment across the three transports, and compare against the Rosenpass PQ WireGuard baseline.

eprint.iacr.orgpaperAdded 15 Oct 2026, published 14 Oct 2026🛡️ Security

Token Security's "Agentic Universe" is a free learning hub for security and identity teams securing AI agents. It sits between shallow video-only overviews and long certifications, with short concept videos, technical deep dives written by practitioners, checklists to run against your own environment, and free tools. The fetched page is a landing blurb that doesn't list the modules or the specific tools, so the depth of the content is unconfirmed.

token.securitycourseAdded 14 Oct 2026🛡️ Security

Presents the first blind signature in which the issuer runs unmodified NIST-standardized ML-DSA, so it works with certified secure elements. Issuance is an ML-DSA signature on a commitment. The blind signature is a VOLE-in-the-head zero-knowledge proof of knowledge of that signature, about 1 MB, under 1 s to produce and 0.5 s to verify. Security reduces to ML-DSA EUF-CMA and the proof system. Issuer-hiding and selective disclosure add a few tens of KB. The paper also introduces edaBitE, a batch consistency check between binary and prime-field commitments that replaces the costly edaBits checks.

eprint.iacr.orgpaperPublished and added 14 Oct 2026🛡️ Security

Explains how to turn a cryptographic algorithm policy (approve ML-DSA-65/87, exclude ML-DSA-44) into enforceable AWS controls using SCPs, IAM policies, permission boundaries and KMS key policies. The key lever is the kms:KeySpec condition key (kms:SigningAlgorithm can't distinguish variants, since all use ML_DSA_SHAKE_256), applied to CreateKey, ReplicateKey, Sign, Verify and GetPublicKey. It also covers surfaces without algorithm condition keys (AWS Private CA, ACM import, IAM server certificate upload, ELB TLS) via provisioning pipelines plus CloudTrail and AWS Config drift detection, and the default-allow risk of deny-lists.

aws.amazon.comarticlePublished and added 12 Oct 2026🛡️ Security

The paper introduces verifiable reconstructible straightline codes (VRSCs) as an abstraction for compiling zkSNARKs into Universally Composable (UC) secure protocols. It shows that the witness-succinct UC compiler of Ganesh et al. (EUROCRYPT 2023) is missing a security requirement: permuting previously revealed evaluation openings yields a fresh accepting proof, which invalidates the claimed simulation argument. The fix uses verifier-enforced disjoint evaluation domains and a pairing-based Fischlin-style instantiation with structured Reed-Solomon codes and jointly computed KZG openings. This brings certificate generation to O(n log n) with constant extra proof size and verification work.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 12 Oct 2026🛡️ Security

Let's Encrypt will issue 64-day certificates by default from February 10, 2027, as a step toward 45-day lifetimes planned for 2028, in line with CA/Browser Forum Baseline Requirements. The last 90-day certificate is expected to expire May 11, 2027, and 64-day certificates are available in staging for testing. Automated clients that support ACME Renewal Info (ARI) need no change. Hardcoded renewal schedules should renew at about two-thirds of the lifetime. Authorization reuse drops to 10 days next year and 7 hours in 2028, which removes the need for CAA rechecking.

securityweek.comarticlePublished and added 12 Oct 2026🛡️ Security

Google disclosed that attackers hijacked the authoritative DNS of three ccTLDs (.gh for Ghana, .sl for Sierra Leone, .as for American Samoa) and used control of those domains to obtain unauthorized HTTPS certificates covering several Google domains and domains of other organizations. Google blocked the fraudulent certificates in Chrome, worked with issuing CAs to revoke them, and used Certificate Transparency log analysis to find other affected brands, some of which it proactively notified. Google is urging domain owners to monitor CT logs and publish restrictive CAA records after regaining DNS control, since CAs may cache and reuse prior domain-control-validation checks, letting attackers mint new certs even after the hijack ends.

securityweek.comarticlePublished and added 9 Oct 2026🛡️ Security

Microsoft Security Blog post arguing that post-quantum cryptography planning must extend beyond encrypted-data confidentiality to authentication and certificate ecosystems, since larger PQC certificate chains and new algorithms like ML-DSA-87 can break PKI workflows, HSMs, and legacy infrastructure. It details Microsoft's PQC TLS Pilot Program, launched August 27, 2026, which lets approved certificate authorities (ComSign, DigiCert, HARICA, IdenTrust, Sectigo, Shanghai Electronic Certification Authority, SSL.com) test ML-DSA-87 certificate issuance under the Microsoft Trusted Root Program, plus Windows 11 builds (KB5101681, KB5101684) that support evaluating ML-DSA certificates via Schannel in non-production environments. It lays out a six-step readiness plan: inventory certificate dependencies, map trust relationships, assess vendor roadmaps, identify long-lived infrastructure, build test environments, and plan a multi-year migration.

microsoft.comarticlePublished and added 8 Oct 2026🛡️ Security

Unchained explains how hardware wallets generate entropy for bitcoin keys, covering PRNG vs TRNG theory, physical TRNG mechanisms (ring oscillator jitter, diode avalanche noise, radio static reuse), and NIST SP 800-90B / BSI AIS-31 certification. It compares entropy sourcing and secure-element chip suppliers (STMicroelectronics, Microchip, Infineon, Espressif, Silicon Labs) across Trezor, Ledger, Coldcard, BitBox02, Foundation Passport, Blockstream Jade and Block Bitkey, and walks through the July 2026 Coldcard firmware bug that silently bypassed its hardware TRNG for five years, causing real bitcoin losses. It also covers manual dice/coin entropy generation for BIP39 seed phrases, the Dark Skippy nonce-leakage attack, and multisig as the primary mitigation against single-device key-generation failures.

unchained.comarticleAdded 8 Oct 2026, published 7 Oct 2026🛡️ Security

AWS Security Blog walkthrough on hardening SPIRE (the SPIFFE Runtime Environment) in production by replacing its default self-managed components with AWS managed services: AWS KMS for SVID signing keys, Amazon Aurora PostgreSQL as the datastore, AWS Private CA as the upstream certificate authority, Amazon S3/CloudFront for trust bundle distribution, AWS Secrets Manager for delivering SVIDs to serverless/container workloads, and Amazon Verified Permissions (Cedar policies) for fine-grained SPIFFE-ID-based authorization. It addresses operational concerns like key custody, datastore resiliency, PKI integration, and offline identity validation, and links to a GitHub reference deployment and a SPIFFE/SPIRE-on-AWS workshop.

aws.amazon.comarticleAdded 7 Oct 2026, published 6 Oct 2026🛡️ Security

Google describes a series of registry-level hijacks affecting the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) ccTLDs, in which attackers modified authoritative DNS records to obtain unauthorized HTTPS certificates for Google domains and, via Certificate Transparency monitoring, several other major organizations. Chrome mitigated impact by blocking the fraudulent certificates through CRLSets and coordinating revocation with issuing CAs, then urges domain owners to continuously monitor CT logs and publish restrictive CAA records with ACME account bindings, since cached domain-control-validation state can let attackers mint new certs even after DNS control is restored.

blog.googlearticleAdded 7 Oct 2026, published 6 Oct 2026🛡️ Security

This IACR ePrint paper proposes and benchmarks a non-interactive Proof of Possession (PoP) for the code-based post-quantum KEM HQC, built using the VOLE-in-the-Head (VOLEitH) zero-knowledge paradigm, to solve the practical problem of issuing KEM-based certificates needed by protocols like KEMTLS. The authors integrate their HQC PoP into the ACME certificate-issuance protocol and compare it against existing PoP schemes for Kyber and FrodoKEM, showing Kyber issues certificates faster but at the cost of protocol or NIST-standard compatibility, while their HQC-based PoP keeps compatibility and achieves smaller proof sizes, which matters under unstable-network conditions due to larger KEM-based CSRs.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 6 Oct 2026🛡️ Security

An IACR eprint paper evaluating all 13-cubed ways to assign 13 post-quantum/traditional signature parameter sets across the Root, Intermediate and Leaf roles of a TLS 1.3 certificate chain, holding the algorithm set fixed and varying only placement. Across 286 three-algorithm groups, median max/min ratios reach 2.085x for TLS handshake latency, 4.310x for certificate body size and 4.551x for path-validation cost purely from role order, with Leaf placement mattering far more than Root/Intermediate swaps. It also shows that looking only at Certificate-message size can misrank candidates such as ML-DSA-65 versus SLH-DSA-SHAKE-192s once the Leaf signature in CertificateVerify and full authentication-path cost are included, arguing PQC certificate-chain design must account for role-specific cost under real network/load conditions.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 5 Oct 2026🛡️ Security

A security researcher's first-person disclosure describing a certificate verification bypass in Xray-core (a popular censorship-circumvention proxy): when its pinnedPeerCertSha256 option skips regular TLS verification, a MITM attacker can insert a leaf certificate anywhere in the certificate chain and have the custom pinning logic incorrectly validate it, effectively eliminating certificate verification. The writeup also documents how the vulnerability was silently fixed with a misleading "simplify the code" commit message and left undisclosed to users for nearly half a year until the reporter filed a GitHub Security Advisory.

github.comwriteupAdded 5 Oct 2026, published 4 Oct 2026🛡️ Security

Analysis of two CVSS 9.5 Citrix NetScaler ADC/Gateway zero-days, CVE-2026-88771 (unauthenticated RCE through improper input validation in the management interface, affecting default deployments) and CVE-2026-88772 (memory overflow in DTLS, enabled by default on VPN virtual servers). It lists six more high-severity flaws patched in advisory CTX697096, the affected and fixed versions, and the CISA KEV listing with a federal deadline of 2026-09-30. It advises checking for compromise before patching, since patching can destroy forensic evidence, and gives response steps: isolate, revoke credentials, rebuild firmware, rotate keys and certificates.

orca.securityadvisoryPublished and added 29 Sep 2026🛡️ Security

This arXiv paper proposes a certifier for structured, privileged agent actions such as paying an invoice, assembled from potentially corrupted documents and tool outputs, formalizing when multi-source corroboration can be trusted under indirect prompt injection. It uses a corruption-radius rule counted via minimum hitting sets over corruption-distinct evidence classes so laundered or re-published copies cannot fake a quorum, plus deterministic reconciliation and trusted anchors for single-sourced fields. Evaluated on 70,966 sanctions entities and 450 software-supply-chain provenance records, and against five LLM agents where a realistic injection fools all but one model and existing action-gating or provenance baselines are broken while the certifier admits no unsafe action.

arxiv.orgpaperAdded 2 Oct 2026, published 28 Sep 2026🛡️ Security

CISA added four vulnerabilities to the Known Exploited Vulnerabilities catalog on 2026-09-22 based on evidence of active exploitation: two Check Point multi-product flaws (improper certificate validation CVE-2026-85102, path traversal CVE-2026-93616), an Arista VeloCloud Orchestrator improper input validation bug (CVE-2026-93952), and an F5 BIG-IP APM heap-based buffer overflow (CVE-2026-94127). The alert ties the additions to BOD 26-04, which has FCEB agencies prioritize remediation of KEV CVEs on publicly exposed assets that give total control, and to checking for prior compromise before patching.

cisa.govadvisoryAdded 26 Sep 2026🛡️ Security

This arXiv paper studies persistent memory for frozen-model LLM agents, showing that matching retrieval scope to certification scope prevents locally-valid skill edits from interfering with unrelated task families. Using ORC (Orthogonal Regression Control), an execution-grounded gate for accepting persistent skill edits, on a 12-round code-repair benchmark (ProcStream-RSI), the authors show Scoped-ORC raises mean trajectory utility from 0.713 (global memory) to 0.816 and eliminates harmful deployments (from 6/8 to 0), while accepting far more updates (63 vs 12) with zero harmful acceptances across 27 paired streams.

arxiv.orgpaperAdded 26 Sep 2026🧠 AI

A weekly congressional tracker detailing multiple new AI bills: a Casar/Sanders proposal to create a Department of Artificial Intelligence and pause advanced AI development pending a ban on artificial superintelligence; Markey's Cybersecurity and AI Board of Investigations modeled on the NTSB to probe AI-driven cyberattacks (citing an OpenAI system breaching Hugging Face and an Australian health database); Bennet/Welch's Federal Digital Commission expansion for frontier model pre-certification and civil penalties; AI 'kill switch' mandates from Kean and Kennedy; Kelly's AI Horizon Fund taxing tech profits to fund worker transition programs; a bipartisan FTC transparency bill from Coons, Britt, Schatz and Lankford; Bonamici's education/workforce AI framework; and two Barrett bills on VA AI transparency and human review of AI-assisted disability claims.

nextgov.comarticleAdded 26 Sep 2026, published 25 Sep 2026🧠 AI

This arXiv paper proposes a blockchain-anchored agentic AI framework for securing the software development lifecycle: specialized LLM-backed agents handle source integrity, SBOM/dependency analysis, CI configuration auditing, artifact verification, and runtime policy evaluation, each producing a cryptographically signed attestation recorded on a permissioned blockchain via smart contracts (agent registry, immutable attestation log, release-policy module). Agent-to-agent and agent-to-blockchain communication is secured through a consortium-operated certificate authority, and a sequence flow illustrates a source-code security agent anchoring its attestation on-chain to trigger an allow/block deployment decision. It's a conceptual architecture paper rather than an evaluated deployment, aiming to give decentralized, tamper-resistant provenance for agentic AI monitoring the software supply chain.

arxiv.orgpaperAdded 2 Oct 2026, published 25 Sep 2026🛡️ Security

AWS Security Blog walkthrough of building a secure, production-ready landing zone in the new AWS European Sovereign Cloud (aws-eusc partition), covering multi-account governance via AWS Control Tower/AFT, IAM Identity Center federation as Terraform code, centralized logging into a Log Archive and Security Tooling account, network perimeter design with dedicated Direct Connect PoPs and VPC endpoints, KMS/External Key Store data protection, and partition-aware CI/CD for pushing container images, AMIs, and artifacts across the partition boundary. It maps design decisions to the AWS Security Reference Architecture and Well-Architected Framework, distinguishes hard partition boundaries from configurable choices, and references BSI C5:2020, SOC 2, and ISO 27001/27017/27018/27701 certifications for EUSC.

aws.amazon.comarticleAdded 7 Oct 2026, published 16 Sep 2026🛡️ Security

Latent Space interview with Rune Kvist, cofounder of AIUC (AI Underwriting Company), on its $40M Series A and AIUC-1 — a quarterly-updated standard for agent security, safety and reliability that pairs technical controls with third-party testing (jailbreak resistance, hallucination rates, data leakage) and real Lloyd's of London-backed insurance. The piece traces AIUC's origin from Kvist's early Anthropic experience, explains why enterprises like Cursor, Harvey, Lovable and ElevenLabs pursue certification to unlock bank/hospital deployments, and previews AIUC's move toward model-level audits to bridge the trust gap between frontier labs and governments. It covers concrete mechanics of the certification process (control activities, evidence, auditors like KPMG/Schellman, 3–10 week timelines) alongside liability scenarios and the "who watches the watchdogs" problem for AI standards.

latent.spacewriteupAdded 29 Sep 2026, published 16 Sep 2026🧠 AI

A deep-dive field guide to choosing between lattice-based (ML-DSA/FN-DSA) and hash-based (SLH-DSA) post-quantum signatures, built from interviews with the designers and implementers behind both NIST standards and their deployments. It walks through Mosca's-inequality-style migration timing, CNSA 2.0's split between lattice signatures and stateful hash-based LMS/XMSS for firmware, the stateful-signature "footgun," and why the broader internet (TLS/WebPKI, via Merkle Tree Certificates) is converging on lattices while Ethereum's post-quantum consensus roadmap (leanXMSS, EIP-8292, EIP-8288 aggregation) and Algorand's live Falcon-1024 state proofs lean hash-based or scheme-neutral because of aggregation and on-chain storage constraints. It closes with a decision framework and a rundown of NIST's round-3 "onramp" signature candidates (MAYO, SQIsign, HAWK, etc.).

ethresear.charticleAdded 3 Oct 2026, published 15 Sep 2026🛡️ Security

Huntress SOC analysts Ryan Dowd and Jon Semon tore apart a live social-engineering campaign that began with a fake CoinDesk marketing exec DMing a researcher a Google Doc containing a container-bound Apps Script sidebar. The script ran client-side without OAuth consent, exfiltrated victim IP/geolocation/wallet presence via the Telegram API, then routed macOS users to a piped zsh/DMG AMOS stealer chain and Windows users through ClickOnce and PowerShell loaders using three stolen or fraudulent code-signing certificates (a Norwegian company, Discord, and Lenovo). The Windows chain culminated in NetSupport Manager RMM abuse, a Ledger wallet implant, and a self-generated rogue root certificate authority (spoofing Google Trust Services) installed via MsBuild.exe hollowing to silently intercept HTTPS traffic, which the authors flag as the artifact most likely to survive incident remediation short of full reimaging.

huntress.comwriteupAdded 11 Sep 2026, published 15 Sep 2026🛡️ Security

Part 2 of a Huntress series on AD RMS shows how any Service Group member can export the deployment's root SLC private key via the admin SOAP surface's Trusted Publishing Domain (TPD) operation, then use it to offline-decrypt any document the cluster has ever protected — no server contact required. The author goes further, forging XrML Rights Account Certificates signed with the stolen SLC key to trick a live AD RMS server into issuing genuine use licenses for arbitrary/impersonated identities (a "hybrid" of a Golden Ticket and Silver Ticket), and releases the SharpRMS tool that implements extraction, decryption, and RAC forgery. Because the SLC key has a 255-year certificate and no rotation mechanism, the compromise is permanent for all previously protected content, unlike KRBTGT which can be reset to invalidate forged Kerberos tickets.

huntress.comwriteupAdded 11 Sep 2026, published 10 Sep 2026🛡️ Security

Part 1 of a Huntress research series on Active Directory Rights Management Services (AD RMS), explaining its PKI-based trust model (Server Licensor Certificate signing content keys), why it's still deployed despite Microsoft's deprecation push toward Azure Information Protection, and how to fingerprint and enumerate a cluster from an unprivileged domain account. It introduces SharpRMS, a custom C# tool that speaks the AD RMS SOAP protocol to enumerate clusters and rights-policy templates, and shows how local AD RMS Service Group membership (not Domain Admin) gates the administrative surface where the SLC private key can eventually be reached — setting up Part 2's key extraction and offline decryption.

huntress.comarticlePublished and added 8 Sep 2026🛡️ Security

Huntress blog post clarifying that DoD's July 13 "strategic pause" only suspended CMMC Phase 2 third-party certification requirements (for solicitations after Nov 2026), while Phase 1 self-assessments, SPRS scoring, and DFARS 252.204-7012's 72-hour CUI incident reporting remain fully in force and now face closer DIBCAC/DOJ False Claims Act scrutiny. It also flags the FAR Council's June 23 proposed CUI rule (part of the Revolutionary FAR Overhaul), which would extend 72-hour breach reporting and a NIST 800-171 Rev 3 baseline to all FAR-based federal contractors, not just the defense industrial base, creating a temporary split between CMMC's Rev 2 and the FAR's Rev 3. It closes with a breakdown of 32 CFR 170.21's strict POA&M limits (no POA&M at Level 1, minimum 88/110 score and only 1-point requirements eligible at Level 2) and practical questions MSPs should ask clients about federal contract exposure.

huntress.comarticleAdded 8 Sep 2026, published 2 Sep 2026🛡️ Security

Blackpoint's Adversary Pursuit Group details Miraak, a novel modular post-exploitation framework discovered through proactive hunting of exposed open web directories. The writeup covers trojanized hostfxr.dll loaders that masquerade as legitimate .NET runtime components (with XOR 0x42/0x5A obfuscated payloads and configs), a PostgreSQL/Timescale database used as the C2 control plane instead of HTTP beaconing, Cobalt Strike BOF-compatible execution inside the agent, and an associated F#-based reverse TCP tunneling implant delivered via a trojanized Microsoft.DocAsCode.Common.dll (DocFX) dependency, with infrastructure pivoting via a self-signed "miraak-socks" TLS certificate and IOCs.

blackpointcyber.comwriteupAdded 26 Sep 2026, published 26 Aug 2026🛡️ Security

crockTail is a passive OSINT tool that, given a domain, aggregates DNS records, IP/ASN ownership, TLS certificate details, WHOIS data, and crt.sh certificate-transparency history into a single report. It layers analysis on top of the raw data: plain-language warning/info observations (near-expiry or expired certs, recently registered domains, unusual reissuance, historical subdomains from CT logs), multi-resolver (Google vs Cloudflare) DNS cross-verification to flag possible tampering, and a 0-100 confidence score per scan based on module success and cross-check agreement. It supports batch domain queries and query logging, and is explicitly limited to passive lookups and a standard TLS handshake, no port scanning or active probing.

github.comrepoAdded 30 Sep 2026, published 25 Aug 2026🛡️ Security

crt.name is a free subdomain index and API that returns every subdomain on file for a given apex domain plus first-seen dates, built by continuously parsing SAN hostnames from Certificate Transparency logs (Static CT sources like Let's Encrypt Sunlight, Geomys, Cloudflare Raio, plus legacy RFC 6962 logs like Google Argon, Sectigo, DigiCert), supplemented by Internet Archive CT replays, Common Crawl, ICANN CZDS zone files, ProjectDiscovery Chaos, HaGeZi DNS blocklists, and an active hostname prober. It offers a no-token REST API (100 req/IP/day), a Streamable HTTP MCP server exposing a single search tool for agent clients, and is the default crt source in the subfaster CLI subdomain enumerator.

crt.nametoolAdded 3 Sep 2026, published 21 Aug 2026🛡️ Security

A GitHub repo of hands-on cybersecurity build projects with full source code, organized into Foundations (pre-beginner, heavily commented single-file Python teaching projects), Beginner, Intermediate, and Advanced tiers, including a work-in-progress DDoS mitigation tool. It also bundles 10 certification/career roadmaps (SOC Analyst, Pentester, Security Engineer, GRC Analyst, etc.) and a curated list of learning tools, courses, and communities, cross-promoting the author's CertGames platform for guided versions of the same projects.

github.comrepoPublished and added 21 Aug 2026🛡️ Security

Huntress researchers document a phishing campaign targeting Black Hat/DEF CON attendees via X DMs impersonating a CoinDesk exec, luring victims into opening a weaponized Google Doc with a custom Google Apps Script sidebar that runs a fake "decryption" flow before delivering ClickFix-style commands or a manual "update" that drops malware. On macOS this delivers AMOS infostealer plus a LaunchDaemon-based polling backdoor with SOCKS5 proxy capability; a follow-up fake DocSend/Dropbox installer delivers a ClickOnce/NSIS loader chain on Windows that installs NetSupport RAT, a process-hollowed rogue Certificate Authority that MITMs VirusTotal traffic, and an incomplete Ledger wallet-targeting implant. The piece includes deep technical detail on the loader's C2 protocol, stolen/fraudulent code-signing certificates, and infrastructure patterns (multi-branded loader domains), plus mitigation guidance and a link to published IOCs.

huntress.comwriteupAdded 3 Sep 2026, published 19 Aug 2026🛡️ Security

FOSSA blog post breaking down how the EU Cyber Resilience Act (Regulation 2024/2847) classifies products with digital elements into four risk tiers — Default, Important Class I, Important Class II, and Critical — each with different conformity assessment paths (self-assessment vs. notified-body third-party assessment vs. European cybersecurity certification). It enumerates the specific product categories named in Annex III (e.g. password managers, VPNs, routers, operating systems, SIEM, browsers) and Annex IV (secure cryptoprocessing hardware, smart meter gateways, smartcards), explains scope exclusions (pure SaaS under NIS2, medical devices, defense products, non-commercial OSS), and gives a four-question decision process for classifying a product ahead of the December 2027 full-compliance deadline.

fossa.comarticlePublished and added 18 Aug 2026🛡️ Security

XM Cyber researchers detail a four-stage exploit chain in Microsoft SCCM (Configuration Manager) that lets any unprivileged domain user achieve SYSTEM-level remote code execution on the primary site server: a missing authorization check on the AdminService UploadExtensionInChunks endpoint (CVE-2026-47301), a weak code-signing check that accepts any commercial certificate, a "CabSlip" Zip-Slip-style path traversal in CAB extraction giving arbitrary file write, and DLL hijacking of adsource.dll loaded by the SYSTEM-level SMS Executive service. Microsoft patched the RBAC bypass in July 2026, but the rest of the chain remains exploitable via the built-in Operations Administrator role until a full fix in ConfigMgr 2609 (October 2026); the article also gives log-based detection guidance (AdminService.log DirectoryNotFoundException/HTTP 500 patterns) and interim mitigations.

xmcyber.comwriteupAdded 3 Sep 2026, published 13 Aug 2026🛡️ Security

SiberKapan is a Turkey-focused, community-driven open-source threat intelligence platform that aggregates data from FortiGate webhooks, an 11-service honeypot (HoneypotKapan), nginx/Fail2ban log watchers, and external feeds, publishing it as STIX 2.1/TAXII 2.1, a MISP default feed, Sigma/Suricata/Wazuh exports, and REST blocklists. It also runs a real-time phishing/domain-squatting detector via Certificate Transparency log monitoring with fuzzy typosquat and Punycode/IDN decoding, and safely fingerprints SSH-honeypot malware downloads with SSRF-protected, never-executed hashing enriched via MalwareBazaar. The write-up details concrete anti-abuse safeguards: time-based IP score decay, CDN/cloud-proxy allowlisting, UDP-spoofing exclusion, RFC1918 rejection, and manual review gating for weak phishing signals.

github.comrepoPublished and added 8 Aug 2026🛡️ Security

A reviewer's first-person writeup of the Advanced Red Team Operations Certification (ARTOC) by White Knight Labs, covering a full red team engagement curriculum: building C2 infrastructure with Cobalt Strike and Adaptix, cloud redirectors across AWS, Azure and GCP via CDNs and serverless functions, Active Directory and ADCS exploitation, and kernel and user mode EDR evasion, tested against real enterprise EDR products. The exam is a 48-hour infrastructure build and compromise exercise followed by a 48-hour red team report. The post is a positive testimonial encouraging enrollment rather than a technical walkthrough of any attack.

kuwaitist.github.ioarticleAdded 2 Oct 2026, published 6 Aug 2026🛡️ Security

Collection of 28 skill files for coding agents to run OSINT investigations covering domains, emails, usernames, photos, and companies, using techniques like WHOIS, certificate transparency, reverse image search, and breach lookups.

github.comrepoAdded 30 Sep 2026, published 2 Aug 2026🛡️ Security

UseOSINT/Skills is a GitHub repo of 28 SKILL.md files that let Cursor, Claude, and other coding agents run open-source-intelligence investigations — 10 end-to-end workflows (e.g. find-anyone, x-ray-a-company, recon-a-domain-passively) built on 18 reusable technique skills (WHOIS, certificate transparency, reverse image search, breach lookups, chronolocation). Each skill ships with reference material (query cookbooks, indicator guides, registry catalogues) and an install script that symlinks the whole set into ~/.cursor/skills, illustrating a chained, workflow-plus-technique pattern for structuring and routing large agent skill libraries. The repo also documents scope/authorization gating and passive-by-default behavior as part of the skill design.

github.comrepoAdded 30 Sep 2026, published 2 Aug 2026🧠 AI

FinalRecon is a Python-based OSINT/reconnaissance tool for web targets, gathering header info, whois data, SSL certificate details, crawling, DNS enumeration, subdomain discovery, port scanning, and directory search in a single utility. It's commonly used during the recon phase of web application pentests to consolidate multiple footprinting techniques into one CLI tool.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

Beetle is an offline-first mobile application security platform that statically analyzes Android APKs and iOS IPAs (including Flutter and React Native apps), combining decompilation, taint analysis, secret/endpoint extraction, certificate and native-binary hardening checks, and CVE enrichment with explainable 'intelligence engines' (ownership, confidence, evidence selection, finding fusion) that correlate findings into evidence-backed attack chains. It maps results to OWASP MASVS/Mobile Top 10, provides source-level navigation, and exports SARIF, CycloneDX SBOM, and PDF reports, with optional (non-scanning) AI assistance via Claude, OpenAI, Gemini, DeepSeek, or local Ollama for explaining findings.

github.comrepoPublished and added 31 Jul 2026🛡️ Security

FOFA (fofa.info) is a Chinese cyberspace search engine that indexes internet-facing hosts, services, and devices by banner, header, certificate, and icon fingerprints, letting researchers query for exposed assets much like Shodan or Censys. It supports a custom query syntax, icon/favicon-hash search, batch search, and an API for programmatic recon, making it a common tool for attack-surface discovery, threat hunting, and OSINT investigations.

en.fofa.infotoolAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

A deep-dive, self-paced manual on Mimikatz and Windows identity internals by Carlos Perez (DarkOperator), refined with input from Benjamin Delpy (Mimikatz's author). It covers LSASS credential dumping, Kerberos ticket forgery/roasting/delegation abuse, PKI/smart card and certificate abuse, DCSync/DCShadow domain persistence, and DPAPI secrets, alongside blue team detection strategies and event log signatures.

github.comrepoAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

recons101x (shodan_reconsx) is a passive-by-default Python CLI that enumerates hostnames published to certificate transparency logs via ctl.shodan.io, requiring no Shodan API key. It supports optional active features — DNS resolution, TCP/HTTP reachability probing on ports 443/80, bounded live scans, and certificate metadata enrichment — with status states (DNS_ONLY, TCP_REACHABLE, HTTP_REACHABLE, STALE), JSON/TXT output, and safeguards like --max-time, --active-only, and explicit warnings to only scan authorized domains.

github.comrepoAdded 30 Sep 2026, published 29 Jul 2026🛡️ Security

Nuxt 4.5.1/3.21.10 and @nuxt/devtools 3.3.1 patch eight GitHub Security Advisories, the most severe being GHSA-9473-5f9j-94wq, a server-side RCE via server island props reaching Vue's dynamic component resolution when vue.runtimeCompiler is enabled, plus a related unauthorized component instantiation bug (GHSA-48hr-524c-v5w3), a route-rule authz bypass, DoS issues, cross-user payload cache disclosure, and a critical dev-only RCE in Nuxt DevTools. Socket released free Certified Patches for the two highest-severity issues (installable via `socket patch add`) as an interim fix for teams that can't immediately upgrade, and is preparing patches for the rest.

socket.devadvisoryPublished and added 28 Jul 2026🛡️ Security

Certighost is a Python PoC for CVE-2026-54121, an Active Directory Certificate Services attack that spins up rogue SMB/LSA and LDAP listeners to intercept the CA's NetLogon-based identity resolution during certificate enrollment. By impersonating a low-privileged computer account and redirecting the CA's lookups to the target Domain Controller's identity, the tool causes the CA to issue a valid certificate for the DC, then uses PKINIT with that certificate to retrieve the DC's Kerberos TGT/ccache and NT hash — a full domain-compromise chain from a single low-privileged account. The repo includes fixes for an in-the-wild NetLogon trust-account error (STATUS_NOLOGON_SERVER_TRUST_ACCOUNT) and a SAN-spoofing bypass for CAs enforcing ESC6-style EDITF_ATTRIBUTESUBJECTALTNAME2 protections.

github.comrepoAdded 5 Oct 2026, published 23 Jul 2026🛡️ Security

Wiz details how its Agentless Workload Detection extends EDR-like visibility to FortiGate firewalls by parsing local FortiOS logs (log IDs like 32001/32002/44547/41987) to hunt for credential stuffing, rogue admin account creation, certificate manipulation, NAT/port-forwarding abuse, and FortiManager script abuse. It maps these techniques to real-world campaigns including the FortiBleed credential-compromise campaign, active exploitation of CVE-2026-24858, and UNC3886's use of CVE-2022-41328 to deploy the CASTLETAP backdoor, plus Salt Typhoon's exploitation of CVE-2023-48788 against FortiClient EMS.

wiz.iowriteupAdded 3 Sep 2026, published 22 Jul 2026🛡️ Security

A GitHub repository (also published as a GitBook) of study notes compiled while pursuing the Hack The Box CPTS certification, structured to double as OSCP prep material. It covers networking fundamentals, enumeration, privilege escalation, Active Directory attacks, and pivoting with hands-on methodologies and tool usage rather than just theory.

github.comrepoAdded 3 Sep 2026, published 18 Jul 2026🛡️ Security

A GitHub repository compiling personal study notes and cheatsheets for HackTheBox's CPTS (Certified Penetration Testing Specialist) certification, organized by module: network enumeration (Nmap), web footprinting, file transfers, shells/payloads, Metasploit, password attacks, pivoting/tunnelling, Active Directory enumeration and attacks, web app attacks (SQLi, SQLMap, XSS, LFI, file upload, command injection, Ffuf), and Linux/Windows privilege escalation. It functions as a reference guide mirroring the official HTB Academy course structure rather than original research.

github.comrepoPublished and added 18 Jul 2026🛡️ Security

Adversarial Robustness Toolbox (ART) is a Python library, hosted by the Linux Foundation AI & Data Foundation, for evaluating and defending machine learning models against adversarial threats: evasion, poisoning, extraction, and inference attacks. It supports major ML frameworks (TensorFlow, Keras, PyTorch, scikit-learn, XGBoost, LightGBM, CatBoost) across data types (images, tables, audio, video) and tasks (classification, object detection, speech recognition, certification), and was developed with DARPA support.

github.comrepoPublished and added 14 Jul 2026🛡️ Security

Huntress incident writeup detailing how a threat actor exploited a SonicWall VPN vulnerability to gain initial access, deployed Akira ransomware, and found a plaintext file of Huntress MFA recovery codes on a security engineer's desktop. The attacker used those codes to bypass MFA, log into the victim's Huntress portal from IP 104.238.221.69, close active incident reports, and uninstall EDR agents to blind defenses — while also exporting a certificate via certutil for potential persistence. The piece frames this as a case study for why plaintext password/recovery-code storage is dangerous and recommends hashing (Argon2/bcrypt), salting, and password managers instead.

huntress.comwriteupAdded 3 Sep 2026, published 6 Jul 2026🛡️ Security

StepSecurity details a coordinated supply chain attack in which 15 fake AI-powered JetBrains plugins (published across 7 vendor accounts from October 2025 to June 2026) exfiltrated developer AI provider API keys in plaintext to a hardcoded Alibaba Cloud C2 server at 39.107.60.51. The plugins genuinely worked (code review, test generation, DeepSeek/OpenAI chat) but their save() methods intercepted valid-looking sk- API keys, disabled TLS certificate validation warnings JVM-wide, and POSTed the keys over unencrypted HTTP; a "donation wall" also resold stolen keys back to other victims. JetBrains banned the accounts and kill-switched the plugins on June 17, 2026, but StepSecurity confirmed the C2 server was still live two days later, and provides code snippets, network IOCs, and remediation/rotation steps.

stepsecurity.iowriteupAdded 3 Sep 2026, published 1 Jul 2026🛡️ Security

A Huntress blog post (authored by DEFCERT's Ryan Bonner) gives MSPs and MSSPs a concrete methodology for spotting clients that are secretly part of the DoD Industrial Base and subject to DFARS 252.204-7012/-7021, CMMC, and NIST 800-171 obligations. It covers public research signals (USASpending.gov contract lookups, ITAR/DDTC registration, AS9100 certification, Nadcap accreditation, contract vehicles like IDIQ/GWAC/BPA/OTA) and direct screening questions (FAR/DFARS flow-down clauses, DoD distribution-statement-marked technical data, PIEE/SPRS/WAWF account access) to determine whether a company handles Controlled Unclassified Information. It closes with a pitch for Huntress's CMMC Level 2 control coverage.

huntress.comarticleAdded 3 Sep 2026, published 25 Jun 2026🛡️ Security

8kSec's AI/LLM Exploitation Labs is a set of hands-on CTF-style challenges covering real attack classes against AI systems: prompt-injection to manipulate an LLM essay grader and a workspace assistant into granting admin access, crafting adversarial images to bypass an MNIST-based ML authentication vault, extracting a "secret" encryption key from an n8n/OpenAI chatbot via conversation alone, exploiting a remote MCP server (via Cursor) for path traversal to read /etc/passwd, poisoning a training CSV to backdoor a spam classifier, detecting neural network backdoors in CIFAR-10 models, spotting a malicious MCP skill with a data-exfiltration payload, and identifying "ghost record" membership-inference leakage in a supply-chain-compromised model. Each challenge maps to a distinct AI security technique (prompt injection, adversarial examples, model/data poisoning, MCP tool abuse, membership inference) and offers a free certification on completion.

academy.8ksec.iocoursePublished and added 21 Jun 2026🛡️ Security

Snyk details how a dormant, never-revoked npm contributor account (ehindero) was used to republish the entire @mastra scope (142+ packages, ~4M monthly downloads for @mastra/core alone) with an injected dependency, easy-day-js, a byte-for-byte dayjs impersonator. The postinstall hook in easy-day-js@1.11.22 disables TLS verification, pulls a second-stage payload from a raw IP, and drops a cross-platform cryptocurrency wallet stealer plus a RAT with OS-specific persistence (LaunchAgent, systemd unit, PowerShell staging) that beacons every 10 minutes over a self-signed wolfSSL certificate. The piece covers detection steps, the Snyk advisory (SNYK-JS-EASYDAYJS-17353313), and draws parallels to the earlier Axios npm compromise attributed by Microsoft to Sapphire Sleet (BlueNoroff).

snyk.iowriteupAdded 3 Sep 2026, published 16 Jun 2026🛡️ Security

mthcht/awesome-lists is a large, continually updated GitHub collection of threat-hunting IOC lists: suspicious named pipes, Windows services/tasks/firewall rules/ports, user-agents, mutex names, hostnames, MAC addresses, USB IDs, phishing/sinkholed/dyndns domains, HijackLibs, TOR node lists, LOLDrivers hashes, malicious bootloaders and SSL certificates, VPN provider IP ranges, YARA rules, offensive/greyware tool keyword detection patterns, Microsoft Defender/ClamAV signature lists, and RMM detection artifacts. It also links out to DFIR/threat-hunting courses, labs, and CTF-style datasets (SANS FOR500/FOR508, TheDFIRReport labs, Splunk BOTS, Xintra APT emulation) useful for blue teams building detections or hunting.

github.comrepoAdded 3 Sep 2026, published 10 Jun 2026🛡️ Security

Huntress SOC dissects a multi-stage infection chain that begins with a malspam HTML attachment routed through a legitimate Google DoubleClick tracking link to evade reputation filters, before landing on a self-personalizing phishing kit and dropping a ZIP with a heavily obfuscated JScript loader. The chain cascades through PowerShell droppers into a .NET stager that performs extensive anti-analysis/anti-sandbox checks, disables Windows Defender, patches AMSI (via NtManageHotPatch on Windows 11 24H2) and ETW at the native API level, and uses RunPE process hollowing into InstallUtil.exe or MSBuild.exe to run a final loader that communicates over AES/RSA-encrypted, protobuf-serialized TCP C2 with certificate pinning. The writeup includes GPU-fingerprinting behavior, persistence via registry Run keys and randomized scheduled tasks, and concrete detection/hardening recommendations.

huntress.comwriteupAdded 3 Sep 2026, published 3 Jun 2026🛡️ Security

Socket researchers found Sicoob.Sdk, a NuGet package impersonating an official C# SDK for Sicoob (a major Brazilian cooperative bank), which in versions 2.0.0-2.0.4 exfiltrates client IDs, PFX passwords, and base64-encoded PFX mTLS certificate archives via a hardcoded Sentry telemetry endpoint. The associated GitHub organization (Sicoob-Cooperativa) served as a clean-source façade, with the malicious logic only present in the compiled DLL, and the same publisher account distributed 11 other Sicoob-branded packages as dependencies of the malicious wrapper. NuGet blocked the package after Socket's abuse report.

socket.devwriteupPublished and added 29 May 2026🛡️ Security

Wiz's follow-up PQC research post quantifies real-world adoption of post-quantum key exchange (ML-KEM/X25519MLKEM768) and digital signatures (ML-DSA, SLH-DSA, pending FN-DSA) across AWS, Azure, and GCP APIs, OpenSSH/OpenSSL versions, and Go's crypto/tls. It finds stark gaps: Azure API servers show no PQC key-exchange support while GCP is universal and AWS sits at 13%, only 15% of TLS 1.3 connections observed use PQC-compliant key exchange, under 15% of OpenSSL instances support PQC, and less than 1% of companies use AWS KMS ML-DSA signing keys. The piece also covers the shift in PQC priority from key exchange (mitigating Harvest-Now-Decrypt-Later attacks) to digital signature migration, and the coming move to Merkle Tree Certificates to keep PQC certificate chains manageable.

wiz.ioarticleAdded 5 Sep 2026, published 28 May 2026🛡️ Security

Anthropic's one-month progress report on Project Glasswing, where ~50 critical-infrastructure partners used Claude "Mythos Preview" to find over 10,000 high/critical-severity vulnerabilities, including a certificate-forgery flaw in wolfSSL (CVE-2026-5194). The post details disclosure statistics for 1,000+ scanned open-source projects (6,202 estimated high/critical bugs, 90.6% true-positive rate on triaged findings), benchmark results (UK AISI cyber ranges solved end-to-end, Mozilla finding 271 Firefox bugs, XBOW and ExploitBench/ExploitGym scores), and new defender tooling (Claude Security public beta, a Cyber Verification Program, threat-model-builder harness) aimed at addressing the growing gap between AI-accelerated bug discovery and human patch capacity.

anthropic.comarticleAdded 3 Sep 2026, published 27 May 2026🛡️ Security

Orca analysis of CVE-2026-46354 (CVSS 9.1) in the Coder remote development platform. azureidentity.Validate() checks that the PKCS#7 signer certificate chains to a trusted Azure CA but never verifies the signature on the envelope. An unauthenticated attacker can send a forged envelope, using a public Azure IMDS certificate and a known vmId, to POST /api/v2/workspaceagents/azure-instance-identity. This yields workspace agent session tokens, and through them Git SSH keys and OAuth tokens. The post lists the affected v2 and v1 versions, the patched releases (v2.33.3, v2.32.2, v2.31.12, v2.30.8, v2.29.13, v2.24.5) and the workaround of disabling Azure instance identity auth. Coder v1 has no patch.

orca.securityadvisoryPublished and added 22 May 2026🛡️ Security

JFrog previews its 2026 Software Supply Chain Security State of the Union report, drawing on 18.2 billion analyzed artifacts and a 1,508-person survey to describe an "illusion of mastery" gap between claimed governance and actual pipeline enforcement. It cites specific findings: 495 malicious models found on Hugging Face despite 97% of orgs claiming certified AI model governance, 171,592 malicious npm packages detected in 2025 (up 451%) with malicious-package detection flat at 40%, 96% of NVD-Critical CVEs downgraded on real-world exploitability, only 28% of orgs running secrets detection despite 17,637 exposed tokens found (3,260 still active), a CVSS 9.6 RCE in mcp-remote, 56 malicious OpenVSX IDE extensions, and references to the GlassWorm and s1ngularity supply-chain attacks.

jfrog.comarticlePublished and added 21 May 2026🛡️ Security

Huntress breaks down the DoD's CMMC final rule, effective November 10, 2025, which replaces contractor self-attestation with mandatory third-party (C3PAO) verification for handling Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). It explains the three certification levels (Level 1 self-assessment against FAR 52.204-21, Level 2 aligned to NIST SP 800-171's 110 controls, Level 3 adding NIST SP 800-172 controls), the flow-down requirement forcing subcontractors to certify before prime contractors will award work, and the scoring/documentation burden (SSP, policies, procedures) needed to pass a Level 2 assessment.

huntress.comarticleAdded 3 Sep 2026, published 14 May 2026🛡️ Security

CyberSleuth is an open-source MCP server that exposes 34 OSINT/cyber-investigation capabilities to Claude Desktop or Claude Code via natural language, covering infrastructure analysis (DNS, WHOIS, reverse DNS, AS/hosting intel), certificate transparency (CertSpotter/Censys), threat intel correlation (Shodan, VirusTotal, URLScan.io), tech-stack and ATS/GitHub org recon, and privacy/jurisdiction compliance analysis (GDPR/CCPA/LGPD/PIPL/PIPEDA). It also includes an LLM/AI surface reconnaissance module that passively fingerprints LLM-powered apps and runs authorization-gated OWASP LLM Top 10 probes. All external API keys are optional, with graceful degradation when unset.​

github.comrepoPublished and added 14 May 2026🛡️ Security

Socket disclosed that a critical sandbox escape in vm2 (GHSA-ffh4-j6h5-pg66, CVE-2026-26956), which lets attacker-controlled JavaScript passed to VM.run() escape isolation and execute arbitrary OS commands via WebAssembly.JSTag, affects far more than the officially listed vm2 3.10.4/Node 25 scope. Socket's testing showed 66 vm2 releases from 0.2.2 through 3.10.4 are exploitable on Node.js 24.15.0, and any Node runtime exposing WebAssembly.JSTag is vulnerable, meaning downstream SCA/scanner tools using the narrower advisory data would miss real exposure. Socket is releasing free Certified Patches (via `socket patch add`) for the issue alongside upgrade guidance to vm2 3.10.5+.

socket.devadvisoryPublished and added 8 May 2026🛡️ Security

Huntress documents a malspam campaign, active since February 27, that uses fake "service agreement" document lures behind a CloudFlare CAPTCHA to trick targets into installing Tiflux, a lesser-known Brazil-based commercial RMM, before pivoting to UltraVNC, Splashtop, and ScreenConnect for persistent remote access. The Tiflux installer bundles suspicious extras beyond the legitimate agent: a decade-old UltraVNC build with hardcoded plaintext-recoverable passwords, an expired UltraVNC code-signing cert, registry files that stage a hidden TightVNC service (enabled even in Safe Mode) and a passwordless PuTTY SSH key to a peopleone[.]com[.]br server, registry tweaks that suppress Windows Secure Attention Sequence consent prompts, and a known vulnerable HwRwDrv.sys driver linked to privilege escalation with a revoked signing certificate. Huntress frames this as another entry in the ongoing "LOLRMM" pattern of attackers abusing legitimate commercial RMM tools for stealthy access and persistence.

huntress.comwriteupAdded 3 Sep 2026, published 7 May 2026🛡️ Security

Somerset Recon details Quacc++, a proof-of-concept automated bug hunter that queries grep.app's regex-based index of public GitHub repos to find candidate vulnerable code, downloads matching repositories, and runs Semgrep taint-analysis rules to confirm exploitable patterns. Using a search for strcpy(buf, argv[ paired with a custom Semgrep taint rule, the authors discovered an unbounded strcpy stack buffer overflow in GetArgumentFiles() in Google DeepMind's Lab repository (engine/code/bspc/bspc.c), confirmed with AddressSanitizer and pwntools/GDB to give full RIP control at offset 1080. The post also walks through Semgrep rules for SQL injection (CWE-89), hardcoded API keys (CWE-798), and disabled TLS certificate validation (CWE-295) across curl/wget/requests/Node/Go.

somersetrecon.comwriteupPublished and added 7 May 2026🛡️ Security

A vendor guide from Applus Laboratories explaining the EU Cyber Resilience Act (CRA): its scope over 'products with digital elements', the three risk-based classes (Default, Important Class I/II, Critical) with their differing conformity assessment routes (self-assessment vs third-party vs EUCC), key deadlines (Art. 69 reporting obligations from Sept 2026, full application Dec 2027), and exclusions for sectors like medical devices and motor vehicles. It also clarifies how CRA interacts with adjacent frameworks — NIS2, DORA, EU AI Act, RED, ISO 27001/9001, and EUCC/Common Criteria certification.

appluslaboratories.comarticlePublished and added 6 May 2026🛡️ Security

Huntress details a February 2026 intrusion beginning with compromised SonicWall SSLVPN credentials, where the attacker deployed an EDR killer that decodes and drops a legitimate but revoked 2006-era EnCase forensic driver (EnPortv.sys, service name OemHwUpd) to terminate 59 different EDR/AV processes from kernel mode via a single IOCTL (KillProc). The write-up explains the driver's novel wordlist-substitution-cipher payload encoding (evading entropy and string-based detection), FNV-1a process-name hashing for fast target matching, timestomping/persistence tricks, and why Windows Driver Signature Enforcement still trusts the expired/revoked certificate due to pre-2015 signing and timestamp exceptions. It closes with concrete mitigations: MFA on VPN, HVCI/Memory Integrity, WDAC vulnerable-driver blocklist rules, and the ASR rule blocking vulnerable signed drivers.

huntress.comwriteupAdded 3 Sep 2026, published 4 Feb 2026🛡️ Security

Part three of Huntress's LDAP/Active Directory detection series explains the SDFlags LDAP control (bitmask values 0x1/0x2/0x4/0x8 for Owner/Group/DACL/SACL) that SharpHound must use when querying the nTSecurityDescriptor attribute to avoid failing silently due to SACL read permissions. The author shows via lab testing and Event ID 1644 log analysis that legitimate admin tools almost never use SDFlags, while SharpHound consistently sets SDFlags=0x4 for general object enumeration and 0x5 (Owner+DACL) for group and certificate template enumeration, making the combination of mass enumeration + nTSecurityDescriptor + SDFlags a high-fidelity signal for BloodHound-style attack-path discovery. It concludes with a Sigma detection rule (ECS field names) targeting SDFlags=0x5 group enumeration and references SharpHoundCommon's LdapConnectionPool.cs source code confirming the behavior.

huntress.comarticleAdded 3 Sep 2026, published 15 Jan 2026🛡️ Security

A personal review of Hack The Box's Certified Defensive Security Analyst (CDSA) certification, an entry-level SOC analyst / incident responder credential under HTB's SOC Analyst Job-Role Path. The author details the 15-module course covering SIEM/SOC fundamentals, network analysis, Active Directory attack & defense, and ELK/Splunk labs, critiques several technical errors in the material, and describes the 7-day practical exam involving two incidents with 20 flags and a mandatory incident report.

bencteux.frwriteupAdded 3 Sep 2026, published 18 Dec 2025🛡️ Security

DFIR.ch analyzed 250 PingCastle audit reports collected from real incident response and compromise assessment engagements to quantify common Active Directory misconfigurations, mapping each finding to The Ten AD Commandments. It covers ADCS certificate template abuse (ENROLLEE_SUPPLIES_SUBJECT, referencing SpecterOps Certify tool and the Certified Pre-Owned research), Kerberoastable and over-privileged service accounts, weak or non-expiring passwords, missing LAPS and PowerShell script block logging, and unrestricted MachineAccountQuota, each with concrete affected-domain statistics from real-world cases.

dfir.chwriteupAdded 3 Sep 2026, published 19 Jan 2025🛡️ Security

A personal review of Zero-point Security's Red Team Ops II course, which prepares students for the Certified Red Team Lead (CRTL) certification focused on advanced red team operations, C2 tradecraft, and evasion techniques. The post likely covers course structure, lab content, exam experience, and recommendations for prospective students.

bencteux.frarticleAdded 3 Sep 2026, published 19 Oct 2022🛡️ Security

A former eCIR holder reviews INE/eLearnSecurity's eCTHPv2 (Certified Threat Hunting Professional) certification, breaking down its three modules (intro to threat hunting, network hunting, endpoint hunting) and the practical labs covering YARA rule writing, Redline and Volatility memory analysis, Zeek/Rita and Netminer network analysis, and SIEM (Splunk/ELK) log hunting. It also details the 48-hour hands-on exam format and notes recent course updates covering AMSI bypass, Cobalt Strike execute-assembly, and reflective DLL loading detection, while flagging weak lab infrastructure (laggy RDP, slow Splunk labs) and thin network-hunting coverage relative to the endpoint module.

bencteux.frarticleAdded 3 Sep 2026, published 10 Jul 2022🛡️ Security

A personal review of the eLearnSecurity Certified Incident Responder (eCIR) course, assessing its coverage of network traffic analysis, Suricata/Zeek/Snort rule writing, Windows/Linux post-exploitation, and SOC/SIEM analysis using Splunk and ELK labs. The author, an experienced IR practitioner, finds the course a solid but shallow introduction — outdated tool versions, weak Linux TTP coverage, unrealistic "baseline" guidance — and describes the practical 48-hour incident-response exam as the most realistic blue-team exam they've encountered.

bencteux.frarticleAdded 3 Sep 2026, published 8 Aug 2021🛡️ Security