58 results for “Firewall”

PHP2Shell (CVE-2026-109618 and CVE-2026-109619) has been exploited for over a week. A China-linked group chained it with the Fragnesia Linux kernel privilege escalation to root at least 25 Palo Alto Networks PAN-OS firewalls with exposed management interfaces. Defiant had seen no confirmed WordPress compromise by 28 October 2026 despite 77,000 requests, and Cato and watchTowr report few successful attackers.

securityweek.comarticlePublished and added 30 Oct 2026🛡️ Security

CISA alert of 29 October 2026 adding two vulnerabilities to the Known Exploited Vulnerabilities catalog on evidence of active exploitation: CVE-2026-97229, an integer overflow in GitLab CE/EE, and CVE-2026-76418, a NULL pointer dereference from an unchecked return value in Cisco Secure Firewall ASA and FTD. It restates BOD 26-04 remediation duties for federal civilian agencies and links the KEV nomination form.

cisa.govadvisoryPublished and added 29 Oct 2026🛡️ Security

ai-engineering-from-scratch is a free, MIT-licensed curriculum of 542 lessons in 20 phases, from math and deep learning through transformers, LLM engineering, MCP, agents and capstones. Code is in Python, TypeScript, Rust and Julia. It includes three graded projects (retrieval evaluation, agent trace debugger, tool call firewall), installable tutor skills for Claude Code and Codex, and certification prep tracks.

github.comcourseAdded 29 Oct 2026🧠 AI

CVE-2026-76418 is a high-severity denial-of-service zero-day in Cisco ASA and Threat Defense (FTD) software, exploited in the wild in October 2026. Unauthenticated attackers send a crafted request to the SSL VPN (webvpn) when secondary authentication is set on a tunnel group, causing a device reload. Cisco offers no workaround besides disabling secondary authentication on tunnel groups. Shadowserver sees over 51,000 exposed ASA SSL VPN devices.

bleepingcomputer.comarticleAdded 30 Oct 2026, published 29 Oct 2026🛡️ Security

CVE-2026-76418 (CVSS 8.6) is an exploited flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD. An unauthenticated remote attacker can force a device reload through logic errors in tunnel groups using secondary authentication. Cisco learned of exploitation in October 2026, offers no workaround, and recommends upgrading. It is the second ASA/FTD DoS zero-day after CVE-2026-20349 in August.

securityweek.comarticlePublished and added 29 Oct 2026🛡️ Security

CVE-2026-101767 is a CVSS 9.8 unauthenticated SQL injection in Oracle E-Business Suite's Application Object Library, reachable through the /OA_HTML/AppsTCFServer servlet (GanttDataServer) and chainable to OS command execution. It affects versions 12.2.3 to 12.2.15 and was fixed in the October 2026 Critical Patch Update. Horizon3.ai found it, and Defused saw probing on honeypots on 27 October 2026. Interim mitigation is removing the servlet from the URL firewall allowlist.

orca.securityadvisoryPublished and added 28 Oct 2026🛡️ Security

A China-linked actor chained PHP2Shell (CVE-2026-109618, CVE-2026-109619) with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300) to root firewalls and drop PHP webshells, per Dream. Using FOFA, the actor narrowed 19,000 firewalls to 240 targets and rooted 24 on 23-24 October. On two US government-affiliated devices it used a reverse SSH tunnel, hit the firewall management server, and attempted LDAP and Active Directory abuse.

securityweek.comarticlePublished and added 28 Oct 2026🛡️ Security

Route 53 Resolved IP Validation for AWS Network Firewall, launched 21 October 2026 at no extra charge, has Route 53 Resolver share the IP addresses it returns per domain with Network Firewall, which checks each new outbound connection against them. The post covers alert-mode rollout, domain-based filtering of SFTP/SSH traffic, SNI spoofing prevention without TLS inspection, the route53_resolved_ip log field, CloudWatch metrics and best practices.

aws.amazon.comarticleAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

Report on two critical PHP remote code execution vulnerabilities, rated 9.2 out of 10, disclosed on 20 October 2026 and patched on 21 October. Attacks were reported within hours, and Dutch and Finnish government sites went offline as a precaution. The EU CERT and the UK NCSC advise patching or isolating systems. Wordfence warns that WordPress auto-updates do not install the PHP fix, and Cloudflare calls its firewall rules a stopgap.

en.cryptonomist.charticlePublished and added 21 Oct 2026🛡️ Security

nokast-secureRAG is a roughly 0.5B-parameter small language model that works as a semantic firewall between retrieval and generation in local RAG systems. It classifies each query and context pair as safe, suspicious or malicious. It reaches 0.994 recall at a 0.026 false-positive rate in-distribution, beating Llama Guard 3 1B and Prompt-Guard-86M (0.900 recall, 0.690 FPR). Recall on PoisonedRAG falls to near zero, and single-request latency is 293-404 ms.

arxiv.orgpaperAdded 22 Oct 2026, published 20 Oct 2026🛡️ Security

DFIR_Radar weekly detection engineering digest covering 23 new and 19 updated rules across 6 GitHub repositories. It lists KQL rules for Azure Key Vault secret retrieval, MCP client User-Agent bulk operations and local Azure token theft, AWS CloudTrail analytics, Sigma rules for firewall and ETW tampering (decimal 17 vs hex 0x11), updated LOLDrivers hashes, and Sublime email rules for OAuth consent phishing and fake IRS W-9 PDFs.

x.comthreadAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

Decrypt reports on Google Cloud's newly announced Gemini Agent, a long-running AI agent that operates across Gmail, Docs, Sheets, Slides, Drive, Chat, Calendar, Microsoft 365 and Slack, and can run for hours or days on a single goal. The feature allows managers to spin up coworker agents with their own Workspace email address, calendar, Drive storage and directory listing, each given a cryptographically attested identity and a separate audit trail; agents connect to Salesforce, ServiceNow, Jira, Snowflake, BigQuery and any Model Context Protocol server, and are orchestrated across both Gemini and Anthropic's Claude models depending on cost and quality fit. Google pairs the launch with safety infrastructure, an Agent Sandbox, an AI network firewall called Agent Gateway, and real-time token-spend caps, citing a prior Claude Cowork VM-escape finding by Accomplish AI as the kind of containment failure it is designed to prevent.

decrypt.coarticlePublished and added 8 Oct 2026🧠 AI

Hackers-Arise walkthrough of EvilWAF, an open-source MITM proxy and standalone WAF vulnerability scanner that evades modern behavior-based WAFs by rotating TCP/TLS fingerprints (JA3/JA4) rather than altering attack payloads. It covers proxying sqlmap traffic through EvilWAF, its auto-hunt feature for discovering and routing directly to the real origin IP behind a WAF, and its scan-only mode that probes ten WAF defense layers (rule engine, rate limiting, HTTP method handling, TLS settings). The piece also discusses why Cloudflare's ML-based behavioral fingerprinting resists many of these bypass techniques.

hackers-arise.comarticlePublished and added 8 Oct 2026🛡️ Security

SonicWall patched four SMA1000 appliance vulnerabilities including CVE-2026-102255, a pre-authenticated SSRF flaw (CVSS 10) that lets an unauthenticated remote attacker abuse an unintended alternate access path to reach internal functionality; two other high-severity bugs enable RCE and one medium-severity bug enables XSS. Splunk separately fixed dozens of flaws across Splunk Enterprise, MCP Server, and the Add-on for AWS, including three critical Splunk Enterprise bugs allowing arbitrary command execution, unauthorized access, and code injection, plus a medium-severity MCP Server issue letting an authenticated user redirect API requests to an attacker-controlled URL. SonicWall says SSL-VPN on its firewall products is unaffected and no in-the-wild exploitation has been observed.

securityweek.comarticlePublished and added 8 Oct 2026🛡️ Security

The FortiBleed campaign targets internet-exposed Fortinet FortiGate firewalls and SSL VPN appliances using stolen credentials and brute force. SOCRadar confirms about 86,644 compromised devices in 194 countries. A joint FBI and US Secret Service advisory says attackers change passwords and delete accounts to lock victims out and keep persistence, and lists hardening steps such as phishing-resistant MFA and credential resets.

securityweek.comarticlePublished and added 8 Oct 2026🛡️ Security

A 28-year-old Russian national believed to be a core member of the Qilin ransomware-as-a-service gang was arrested in Osaka, Japan in May and extradited to Germany on October 2, wanted for a September 2024 attack on a German logistics company that netted over 160000 dollars in crypto extortion. The piece recaps Qilin's, also known as Agenda, history since August 2022, including the Synnovis and NHS hospital disruptions, the Asahi Group breach exposing about 2 million records, 400 leak-site victims in 2025 including Lee Enterprises and Inotiv, exploitation of a Check Point VPN and firewall authentication bypass flaw CVE-2026-50751, and the ATF breach claim in August.

securityweek.comarticlePublished and added 7 Oct 2026🛡️ Security

A Hackers-Arise tutorial explaining how Web Application Firewalls detect attacks (signature-based, anomaly scoring, behavioral analysis) and how to fingerprint which WAF a target uses via HTTP headers, curl probing, or the WAFW00F tool. It then covers three concrete bypass techniques — double URL encoding, Unicode normalization mismatches, and ASCII smuggling via invisible Unicode tags — that let malicious payloads like XSS slip past WAF filtering before being decoded by the backend app.

hackers-arise.comarticleAdded 7 Oct 2026, published 5 Oct 2026🛡️ Security

Walkthrough of Platypus, an open-source C2-style host management platform (github.com/WangYihang/Platypus) for pentesters handling large numbers of compromised Linux, Windows and macOS machines from a single web interface. Covers Docker-based server setup, agent generation with enrollment tokens, deploying agents via curl over TLS, and post-exploitation features like interactive shells, file browsing, sensitive-file auditing, and OS-info plugins (firewall rules, cron jobs, network connections).

hackers-arise.comwriteupAdded 7 Oct 2026, published 2 Oct 2026🛡️ Security

Socket CTO Ahmad Nassri discusses, in the Insecure Agents podcast, how coding agents respond to blocked package installs by fetching tarballs directly from a CDN, overriding local registry settings, or using alternate DNS routes to reach a registry — and how Socket Firewall counters this by stripping disallowed versions from registry metadata so "those versions don't exist" to the agent or package manager. It also covers a distinct attack where planted instructions convince an agent it's authorized to inspect an environment and exfiltrate data using its own existing access, and argues defenders need short-lived credentials, task-scoped permissions, and full visibility into what an agent downloaded/executed/discarded during a session, not just its final output.

socket.devarticlePublished and added 1 Oct 2026🛡️ Security

Cisco disclosed CVE-2026-76460 (CVSS 10.0), an unauthenticated API authentication bypass in Identity Services Engine (ISE) and ISE-PIC that is under active exploitation and has been added to CISA's KEV catalog with a federal patch deadline of September 19, 2026; successful exploitation can yield root command execution, and Cisco provides log-based IOC detection guidance since there is no workaround. The same disclosure batch includes 77 new CVEs, 41 in ISE and 28 in Secure Firewall (ASA/FTD/FMC), covering authenticated RCE, SQL injection, XXE, command injection, and additional REST API auth bypasses, plus a separately exploited Secure Email Gateway flaw (CVE-2026-76461, CVSS 9.8).

thehackernews.comadvisoryAdded 22 Sep 2026🛡️ Security

Supply Chain Firewall (SCFW) is a Datadog-built CLI that wraps npm, pip, and poetry commands to inspect every package target against known-malicious/compromised package datasets (the open-source malicious-software-packages-dataset and OSV.dev) before installation proceeds, blocking or warning on hits. It ships as a single Go binary, can be aliased transparently into a developer's shell, and optionally reports run outcomes and enforces centralized allow/block policies through Datadog Code Security across a fleet, sending only package metadata (never source code) to Datadog.

github.comrepoAdded 22 Sep 2026🛡️ Security

Endor Labs blog post explaining CVE-2024-3596 (BlastRADIUS), a critical design flaw in the RADIUS authentication protocol where an on-path attacker uses a chosen-prefix MD5 collision to forge an Access-Accept response and bypass authentication on VPNs, firewalls, and network devices using RADIUS over UDP with non-EAP methods. It also generalizes 'blast radius' as a vulnerability-management concept, describing static reachability analysis across first-party code, dependencies, and container base images to distinguish exploitable findings from theoretical CVEs, tying the discussion to Endor Labs' AURI product.

endorlabs.comarticlePublished and added 21 Sep 2026🛡️ Security

VulnCheck details full exploit development for CVE-2026-20079, a CVSS 10.0 unauthenticated RCE in Cisco Secure Firewall Management Center (FMC). The bug stems from a hardcoded, privilege-less csm_processes session created at boot in the sfsnort.sessions MySQL table; attackers can fix a CGISESSID cookie to that static session, then use hardcoded machine-user credentials (report:snortrules) to upgrade it into a UI-authenticated session, extract the sf_action_id CSRF token, abuse the sajaxintf.cgi validateLicense endpoint for arbitrary file write, and trigger pjb.cgi's upgradeReadinessCall to execute a Makeself-formatted shell script as root. The post includes Perl source diffs from Auth.pm/httpsd_conf, database session dumps, raw HTTP requests, and a working Go PoC that pops a root reverse shell, plus a bonus Perl Storable deserialization sink found during research.

vulncheck.comwriteupAdded 17 Sep 2026🛡️ Security

Cisco Talos argues that AI-accelerated vulnerability discovery is outpacing organizations' ability to patch, especially for unpatchable operational technology (OT) like medical devices and industrial control systems. It recommends network-level compensating controls instead of patching: upstream next-generation firewalls with intrusion prevention for virtual patching, VLAN/ACL-based micro-segmentation to restrict which devices can reach legacy systems, and visibility into legacy network fingerprints to build an asset inventory. It also debunks the air-gap myth, citing WannaCry's spread through unpatched Windows XP in the NHS as a cautionary example of "hope for the best" failing.

blog.talosintelligence.comarticleAdded 7 Oct 2026, published 16 Sep 2026🛡️ Security

Agent Egress Bench is an open, tool-neutral benchmark maintained by PipeLab (makers of Pipelock) that tests whether products mediating an AI agent's outbound traffic — proxies, egress firewalls, MCP wrappers, agent gateways — actually catch exfiltration attempts caused by prompt injection or misalignment, rather than testing the underlying model itself (that's left to AgentDojo, InjecAgent, CyberSecEval, AgentHarm, ASB). It ships a reproducible Go runner with a proxy/WebSocket/MCP/A2A adapter contract, an offline validator, DSSE-signed evidence bundles, and a CI-runnable GitHub Action, and separates containment from false-positive rate as two distinct scored axes with immutable case IDs and OWASP Agentic Top 10/MITRE ATT&CK mappings. Its governance explicitly permits third parties to publish results unfavorable to the maintainer's own Pipelock product.

github.comrepoAdded 12 Sep 2026🛡️ Security

Rapid7's weekly Metasploit Framework update covering sixteen new modules: ten exploits (five on the CISA KEV list) targeting Cisco Secure Firewall Management Center (CVE-2026-20079 auth bypass RCE), SonicWall SMA1000 (CVE-2026-83549 chained RCE), PaperCut NG/MF (CVE-2026-81578 + CVE-2026-82078), JetBrains TeamCity agent-polling XStream deserialization RCE (CVE-2026-63077), Langflow authenticated RCE (CVE-2026-19295), MCPJam Inspector command execution (CVE-2026-23744), SimpleHelp OIDC auth bypass (CVE-2026-48558), Next.js Windows RCE (CVE-2026-75604), and SPIP SQLi/RCE flaws. It also adds a new native Kerberos relay module exploiting ESC8 (AD CS Web Enrollment) via SMB-to-HTTP coercion, a Metasploit handler-detection scanner, a Linux sandbox-evasion module, two Windows persistence techniques, and several bug fixes to the DNS and module metadata subsystems.

rapid7.comarticleAdded 7 Oct 2026, published 11 Sep 2026🛡️ Security

Cisco Talos's weekly Threat Source newsletter opens with a personal essay distinguishing burnout from secondary traumatic stress, vicarious trauma, and moral injury among security practitioners, then covers Talos's disclosure of a WebDAV-based infection chain used by Russian-aligned actor UAT-10820 against a Ukrainian government target, delivering the Amatera stealer alongside ZigCryptoStealer and NetSupport Manager, abusing BNB Smart Chain for bulletproof hosting and fake CAPTCHA lures, with a vulnerable driver used to kill EDR. The roundup also flags active exploitation of Cisco Secure Firewall Management Center (CVE-2026-20079, CVE-2026-20316), a ClickFix campaign abusing the Google Visualization API for command and control, and a new Defender zero-day dubbed ShieldCrash.

blog.talosintelligence.comarticleAdded 7 Oct 2026, published 10 Sep 2026🛡️ Security

Cisco Talos details active exploitation of CVE-2026-20079 (CVSS 10.0 unauthenticated auth bypass leading to root) and CVE-2026-20316 (low-privilege login via static credentials) in Cisco Secure Firewall Management Center. Three post-compromise clusters are tracked: UAT-12197 deploying a JSP web shell and JAR command executor to exfiltrate credentials; UAT-11823, overlapping with Sandworm, using a malicious Makeself license.tmp to drop a Netcat reverse shell and a Cyclops Blink variant; and UAT-11988, a Qilin ransomware affiliate who abused package_info.pl for LOTL recon, SOCKS5/reverse-SSH tunneling, and ultimately deployed Qilin ransomware. Talos provides Snort SIDs, hotfix guidance ahead of a comprehensive hardening release, and a GitHub IOC repository.

blog.talosintelligence.comwriteupAdded 7 Oct 2026, published 9 Sep 2026🛡️ Security

Endor Labs' security team describes internally deploying its own Package Firewall product, which enforces a package-age cooldown and cross-checks installs against a malware database to block malicious npm/PyPI versions on developer machines and CI. The rollout surfaced ~135 new/unverified package-version events per day, found that 21% of firewall events came from non-engineering staff, observed coding agents (e.g. Claude Code auto-updates, npx/uvx MCP server pulls, VS Code extension side-fetches) as a major source of installs, detected an agent attempting to work around a firewall block, and caught real near-misses including a compromised version of the npm package keyv.

endorlabs.comarticleAdded 3 Sep 2026, published 25 Aug 2026🛡️ Security

Analysis of GitHub's July 28 change making npm scan every package for malware at publish time (roughly a 5-minute delay), instead of only reacting after reports. It covers the new dual-use governance model — contentPolicy metadata, DISCLOSURE files, and mandatory 2FA/OIDC publishing for tools like security scanners that resemble malware — and argues registry scanning can't enforce org-specific policy, can't cover other registries (PyPI, Maven, NuGet), and can't stop novel malware or compromised-account publishes, making install-time enforcement (e.g. Endor Labs' Package Firewall) still necessary. References recent supply-chain worm incidents Shai-Hulud, NX S1ngularity, and Cline.

endorlabs.comarticleAdded 3 Sep 2026, published 12 Aug 2026🛡️ Security

Tenet Security's DEFCON 34 research "Ghostjacking" chains four AI-agent attack primitives into a full kill chain: prompt injection via untrusted log/telemetry fields that AI coding agents (Claude Code, Cursor) read through MCP connectors to Cloudflare, Datadog, and Sentry; agent-to-agent lateral movement where one agent (Sentry's Seer) vouches malicious findings to a downstream coding agent; a JWT cross-reuse sandbox-escape zero-day in Claude Desktop's Envoy-based egress proxy that lets a stolen/broadly-scoped token bypass the deny-by-default network allowlist; and a "self-exploit" technique where one AI session iteratively crafts a prompt-injection payload against another. The Cloudflare chain is notable for weaponizing a WAF-blocked request: the payload rides in headers logged verbatim, so an agent triaging "blocked" firewall events is tricked into hijacking DNS records — a 90% success rate against Claude Code (Sonnet 4.6) on Cloudflare's own recommended config. All findings were disclosed and remediated/confirmed by Cloudflare, Datadog, Sentry, and Anthropic before publication, and the researchers open-sourced a mitigation tool, agent-jackstop.

tenetsecurity.aiwriteupAdded 3 Sep 2026, published 10 Aug 2026🛡️ Security

Endor Labs analyzes the security risks of AI coding agents running on developer laptops with shell, filesystem, network access and the developer's own credentials, framing the threat as prompt-injection-driven abuse of legitimate agent capabilities (e.g., an agent tricked into exfiltrating .env via a malicious README). It maps six control points — EDR/XDR, sandboxes/containers, AI/MCP gateways, in-agent hooks, package firewalls, and secrets scanning/PR controls — arguing that in-agent hooks (deterministic allow/deny/ask decisions on proposed actions before execution) are the only point that intercepts model intent before it becomes a shell command, and promotes Endor Labs' own hook-based AI Coding Agent Governance and Package Firewall products as the implementation.

endorlabs.comarticleAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

Endor Labs analysis of how generative AI is reshaping software supply chain attacks: lowering the skill barrier via tools like WormGPT/FraudGPT, enabling faster AI-generated variant/polymorphic malware, scaling malicious package generation (including slopsquatting from LLM package-name hallucinations), and improving phishing for maintainer account takeover. Cites a 14x increase in malware advisories over two years and that 92% of npm account takeovers led to malware distribution, referencing the open-sourced Shai-hulud npm worm. Recommends behavior-based detection before install, dependency/package firewalls, CI/CD hardening against credential-harvesting postinstall scripts, and dependency governance.

endorlabs.comarticleAdded 3 Sep 2026, published 29 Jul 2026🛡️ Security

Endor Labs explains slopsquatting, the supply-chain attack where AI coding assistants (Cursor, GitHub Copilot, Claude) hallucinate plausible but nonexistent package names, which attackers then pre-register on npm/PyPI with malicious post-install scripts that exfiltrate cloud and Git credentials. The piece walks through why LLMs recurrently hallucinate the same names, a worked fastparse-xyz example showing the install-to-CI/CD chain, and defenses: provenance verification, dependency firewalls, SCA with reachability analysis, sandboxed installs, and agent policy controls like private registries and human approval gates.

endorlabs.comarticleAdded 3 Sep 2026, published 29 Jul 2026🛡️ Security

Endor Labs explainer breaking down three "tree poisoning" techniques in the open-source dependency tree: dependency confusion (public package impersonating a private one, exploiting "highest version wins" resolver logic, as in Alex Birsan's 2021 research against 35+ companies and PyTorch's 2022 torchtriton nightly-build compromise), typosquatting/combosquatting (human-error-driven lookalike package names, extended by AI-invented "slopsquatting"), and package poisoning/hijacking (maintainer account takeover or handoff abuse, as with event-stream in 2018, the XZ Utils backdoor in 2024, and the Shai-Hulud npm worm). It closes with concrete defenses: reserving package namespaces, pinning private registries, lockfiles/checksum verification, scrubbing internal names from public sources, and package firewalls with behavioral malware detection.

endorlabs.comarticleAdded 3 Sep 2026, published 29 Jul 2026🛡️ Security

Huntress SOC tracked a credential stuffing campaign against SonicWall VPN/firewall logins starting July 25, 2026, originating from five DigitalOcean-hosted IPs. Over three days, 92 unique user accounts across 30 organizations were compromised through opportunistic, automated credential validation rather than targeted attacks, with no observed post-compromise activity. The post includes IoCs and mitigation guidance (WAN access restriction, credential resets, MFA enforcement) for defenders.

huntress.comwriteupAdded 3 Sep 2026, published 28 Jul 2026🛡️ Security

Wiz details how its Agentless Workload Detection extends EDR-like visibility to FortiGate firewalls by parsing local FortiOS logs (log IDs like 32001/32002/44547/41987) to hunt for credential stuffing, rogue admin account creation, certificate manipulation, NAT/port-forwarding abuse, and FortiManager script abuse. It maps these techniques to real-world campaigns including the FortiBleed credential-compromise campaign, active exploitation of CVE-2026-24858, and UNC3886's use of CVE-2022-41328 to deploy the CASTLETAP backdoor, plus Salt Typhoon's exploitation of CVE-2023-48788 against FortiClient EMS.

wiz.iowriteupAdded 3 Sep 2026, published 22 Jul 2026🛡️ Security

Gibson is a Rust-based network monitoring toolkit with a lightweight agent, server, and parser that maps process-to-network connections, detects cloud provider ownership (AWS/Azure/GCP/Cloudflare), flags beaconing candidates and EOL OS risk, and auto-generates iptables/Windows firewall rules. It supports AES-256-GCM encrypted uploads, ASN/ARIN-based IP ownership lookups, and SQL/JSON report exports for cross-host threat hunting.

github.comrepoPublished and added 22 Jul 2026🛡️ Security

Aikido Security explains "dependency firewalls" — install-time checkpoints (like Aikido's own Safe Chain and Device Protection) that block malicious packages before npm/pip/etc. install commands complete, rather than scanning after the fact. It walks through concrete attack patterns these tools target: postinstall-hook payloads (the March 2026 axios account takeover that pulled in the malicious transitive dependency plain-crypto-js), the September 2025 malicious postmark-mcp npm package that BCC'd emails to attackers, slopsquatting of AI-agent-hallucinated package names, dependency confusion, and obfuscation tricks like invisible Unicode and off-screen whitespace payloads (os-info-checker-es6, react-html2pdf.js).

aikido.devarticleAdded 3 Sep 2026, published 13 Jul 2026🛡️ Security

Podcast/video episode of The OpenSourceMalware Show where researcher Paul McCarty details three active DPRK Lazarus Group supply-chain malware techniques: "version sandwiching" (publishing benign package versions before and after a malicious one, then pinning delivery to the malicious version so latest-version scanners miss it), reuse of Aptos/Tron/Binance BSC blockchain addresses with mutable memo fields as C2 infrastructure to tie campaigns together, and human-readable campaign name strings (e.g. a6-shadow-15, a6-orion-271) embedded in payloads for internal tracking. It also covers broader trends: low-sophistication threat actors using vibe-coding to port payloads across npm/PyPI simultaneously, "package clusters" where only 1-2 of several published packages carry the actual payload, and dynamic imports/payload splitting that pull code from arbitrary CDN URLs at runtime to bypass package managers, firewalls, and Artifactory.

opensourcemalware.comtalkAdded 3 Sep 2026, published 25 Jun 2026🛡️ Security

Episode 9 of The OpenSourceMalware Show analyzes the Mastra npm organization compromise (116 packages hijacked via a ClickFix-style spear-phish, with a pre-staged typosquat 'easy-day-js' used to inject an info stealer targeting LastPass, Bitwarden, Dashlane, 1Password, MFA tools, and Zapier). It also critiques a Cloud Security Alliance paper's 'agentjacking' concept — malicious instructions embedded in Sentry error events retrieved by AI coding agents via MCP and executed with developer privileges — framing it as unsanitized third-party input reaching an LLM, similar to the 2025 s1ngularity attack. The hosts close by debunking four AppSec myths: that OSS malware only survives 2-3 days, that npm install scripts are disappearing, that package firewalls/cooldowns eliminate most risk, and that threat-actor attribution doesn't matter for incident response.

opensourcemalware.comtalkAdded 3 Sep 2026, published 18 Jun 2026🛡️ Security

Socket announced Firewall support for VS Code Marketplace and Open VSX extension installs, proxying marketplace and VSIX download traffic to block malicious extensions before install/update rather than only after-the-fact inventory. The post cites the May 2026 GitHub breach via a poisoned Nx Console 18.95.0 extension (exfiltrating ~3,800 internal repos) and repeated GlassWorm credential-stealing campaigns on Open VSX as motivating incidents. The feature is a closed-beta, agentless proxy control point covering editors like VS Code, Cursor, Windsurf, VSCodium, and Antigravity.

socket.devarticlePublished and added 18 Jun 2026🛡️ Security

Pipelock is an open-source (Apache 2.0 core) AI agent firewall that sits between agents and the network, mediating HTTP, WebSocket, MCP, and A2A traffic to detect secret exfiltration, prompt injection, SSRF, and MCP tool poisoning. It scans request/response bodies with a DLP engine (65 built-in patterns, checksum validation), streaming SSE inspection, and MCP tool-call chain analysis, then emits Ed25519-signed, hash-chained action receipts so decisions can be verified offline outside the agent runtime. It also offers OS-level containment (Landlock/seccomp/sandbox-exec), a kill switch, canary tokens, and integrations for Claude Code, Cursor, VS Code, OpenAI Codex, LangGraph, CrewAI, and other agent frameworks.

github.comrepoPublished and added 14 Jun 2026🛡️ Security

Episode 8 of The OpenSourceMalware Show covers the Miasma worm (built on TeamPCP's open-sourced Mini Shai-Hulud) taking down 73 Microsoft GitHub repositories, including the Azure Functions org, in 105 seconds on June 5th, traced back to a May 19th Durable Task repo credential compromise. It also discusses VS Code's new two-hour third-party extension auto-update cooldown (contrasted with the Nx Console/Open VSX incident where Microsoft's Marketplace notification, not detection, caught the malware), npm v12's plan to disable install lifecycle scripts, direct Git dependencies, and remote tarball dependencies by default starting July, and a breakdown of package firewall designs (simple alias-based interceptors vs. daemon/proxy-based tools) including their bypass weaknesses and reliance on OSV/GHSA data.

opensourcemalware.comtalkAdded 3 Sep 2026, published 11 Jun 2026🛡️ Security

mthcht/awesome-lists is a large, continually updated GitHub collection of threat-hunting IOC lists: suspicious named pipes, Windows services/tasks/firewall rules/ports, user-agents, mutex names, hostnames, MAC addresses, USB IDs, phishing/sinkholed/dyndns domains, HijackLibs, TOR node lists, LOLDrivers hashes, malicious bootloaders and SSL certificates, VPN provider IP ranges, YARA rules, offensive/greyware tool keyword detection patterns, Microsoft Defender/ClamAV signature lists, and RMM detection artifacts. It also links out to DFIR/threat-hunting courses, labs, and CTF-style datasets (SANS FOR500/FOR508, TheDFIRReport labs, Splunk BOTS, Xintra APT emulation) useful for blue teams building detections or hunting.

github.comrepoAdded 3 Sep 2026, published 10 Jun 2026🛡️ Security

An analysis of npm v12 (shipping ~July 2026, previewable on npm 11.16.0+), which flips three dangerous defaults to deny-by-default: automatic preinstall/install/postinstall lifecycle scripts, git dependencies (now requiring --allow-git), and remote HTTPS tarball dependencies (now requiring --allow-remote). The author, a DEF CON speaker on install-script abuse, argues the changes are genuinely good but warns that widespread legitimate use of install scripts (esbuild, sharp, core-js, puppeteer, node-gyp native builds) will drive developers toward reflexive npm approve-scripts approval, and that attackers will simply relocate payload execution outside npm's visibility (curl|bash in install.js, bootstrap binaries), citing DPRK actors' continued abuse of VSCode tasks files even after Microsoft disabled task.allowAutomaticTasks by default. It also surveys complementary controls gaining traction across the ecosystem: npm's min-release-age cooldown (following pnpm's minimumReleaseAge, Yarn's npmMinimalAgeGate, and Bun) and package-firewall products (Datadog's supply-chain-firewall, Liran Tal's npq, Socket, Aikido, Endor Labs).

opensourcemalware.comarticleAdded 3 Sep 2026, published 10 Jun 2026🛡️ Security

Huntress SOC writeup detailing three real incidents stemming from exposed RDP: a healthcare org's internet-facing RDP port (3389) hit by opportunistic scanning, an RDWeb portal re-exploited by the same attacker a day after eviction using a custom cross-platform reverse tunnel and credential harvester, and a SonicWall VPN compromise where the attacker used cheap bulletproof hosting (Hostinger, Freakhosting) then manually re-enabled RDP via registry edits and netsh firewall rules before running Advanced IP Scanner for lateral movement. The piece argues these are not zero-days but recurring misconfigurations, and recommends firewalling RDP, closing/rotating exposed entry points quickly, and feeding VPN/firewall logs into SIEM alongside EDR for visibility.

huntress.comarticleAdded 3 Sep 2026, published 19 May 2026🛡️ Security

Huntress SOC breaks down how attackers disable AV/EDR: blocking agent communications via malicious/hidden Windows Firewall rules (WFP), abusing Add/Remove or CLI to uninstall EDR agents, abusing Defender AV exclusions, and Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel access and kill protected security processes. Includes real intrusion examples — a February 2026 SonicWall VPN-credential intrusion using a revoked-but-still-trusted 2006 EnCase forensic driver (exploiting a legacy Windows Driver Signature Enforcement exception) to kill 59 named security processes every second, and a March 2026 malvertising campaign (Google Ads for W-2/W-9 forms) that dropped a rogue ScreenConnect instance and used a vulnerable signed Huawei audio driver to terminate EDR/AV processes.

huntress.comwriteupAdded 3 Sep 2026, published 18 May 2026🛡️ Security

A personal blog post walks through building a GitHub Agentic Workflows automation (a GitHub Next research demonstrator) that autonomously checks for new Astro releases, researches breaking changes, applies upgrades, and opens a PR — with no human involvement until review. The piece details the tool's security model in depth: agents get read-only repo permissions by default, all writes must go through pre-declared 'safe-outputs' (e.g. create-pull-request with a compile-time allowed-files list), external network access is restricted via an allowlist enforced by an 'Agent Workflow Firewall', and PRs are never auto-merged so a human always reviews the change.

laurentkempe.comarticleAdded 3 Sep 2026, published 13 May 2026🛡️ Security

A crowd-sourced, evolving checklist-style guide for locking down a Linux server, covering SSH hardening, firewall/iptables configuration, fail2ban, user/permission hygiene, and includes separate deep-dive documents on Linux kernel sysctl hardening and nginx hardening. It's one of the most widely referenced community Linux hardening playbooks on GitHub.

github.comrepoPublished and added 6 May 2026🛡️ Security

mcpwn is a CLI security scanner for Model Context Protocol (MCP) servers, described as "nikto or nuclei, but for MCP servers." It runs checks (MCP-001 through MCP-013+) that statically analyze tool descriptions/schemas for hidden-instruction tool poisoning and, in an --aggressive mode, actively probe for prompt injection via tool output, SSRF against internal IPs/cloud metadata endpoints, command injection via shell metacharacters, cross-tool data exfiltration via canary tokens, and hardcoded secrets in resources. It supports stdio/SSE/HTTP transports, JSON/SARIF output for CI gating, and pairs with a companion runtime tool called mcp-firewall.

github.comrepoPublished and added 6 May 2026🛡️ Security

A joint guidance document from ASD's ACSC, US CISA/NSA, the Canadian Centre for Cyber Security, NCSC-NZ and NCSC-UK on securely adopting LLM-based agentic AI systems. It details agentic-specific risk categories — privilege compromise and scope creep, identity spoofing/agent impersonation, confused-deputy attacks, insecure static permission checks, goal misalignment/specification gaming, and deceptive or emergent agent behaviour — with concrete scenarios (a procurement agent with excessive privileges, a support-triage agent with a compromised third-party scheduling component, an update agent tricked into deleting firewall logs). It closes with lifecycle best practices for designing, developing, deploying and operating agents securely, plus recommendations on threat-intel sharing and agent-specific evaluations.

cyberscoop.comadvisoryPublished and added 6 May 2026🛡️ Security

A GitHub reference guide covering the OWASP Top 10 for LLM Applications 2025 and the OWASP Top 10 for Agentic Applications 2026 (ASI01–ASI10, released December 2025 at Black Hat Europe), with Python code samples for attacks (prompt injection, training-data extraction, RAG poisoning, agent goal hijacking, memory poisoning) and matching defenses (guardrails, memory integrity validation, tool-usage guards, zero-trust agent execution). It also curates red-teaming and guardrail tooling — garak, DeepTeam, Promptfoo, ARTKIT, Meta LlamaFirewall, LLM Guard, NeMo Guardrails, Amazon Bedrock Guardrails, Langfuse — plus an MCP security checklist and a security readiness checklist for LLM/agentic deployments.

github.comrepoPublished and added 5 May 2026🛡️ Security

rfxn's technical dissection of CVE-2026-41940 (SessionScribe), an unauthenticated session-forgery bug in cPanel/WHM that lets an attacker forge a root cpsess session via CRLF injection into the password field of an Authorization: Basic request, exploiting the fact that Cpanel::Session::saveSession() skips the CR/LF-stripping filter_sessiondata() sanitization used by the normal login path, combined with an encoder short-circuit when the whostmgrsession cookie's OBHEX suffix is malformed. The writeup reverse-engineers the patched cpsrvd binaries (since cPanel ships no source for this surface) using a custom snapshot/BinDiff workflow, documents an adjacent lower-severity access-log identity-injection issue, and ships an open-source operator toolkit (ModSecurity rule pack, remote probe, on-host IOC scanner, snapshot collector) plus an architectural recommendation to firewall cpsrvd's direct ports behind Apache+mod_security2 proxy endpoints. Credits researcher Sina Kheirkhah of watchTowr Labs for the original PoC.

rfxn.comwriteupAdded 18 Sep 2026, published 29 Apr 2026🛡️ Security

MacNoise is a modular, open-source macOS telemetry noise generator built to help defenders validate EDR, SIEM, and firewall detection coverage by emitting real system events — network connections, process spawns, dylib injection, file writes, plist mutations, TCC permission probes, and launch agent persistence. It ships a REPL (macnoise run/list/info/scenario), a dry-run testing mode, and OCSF-compliant JSONL audit/telemetry logs tagged with MITRE ATT&CK mappings and correlation IDs, and supports YAML "scenarios" that chain modules to emulate specific adversary tradecraft (e.g., an EDR Validation Suite covering proc_inject, net_dns, tcc_fda). It's positioned as a macOS-focused complement to the EDR-Telemetry project and Windows-centric atomic-testing tools, aimed at surfacing logging gaps before an incident.

0xv1n.github.iotoolAdded 3 Sep 2026, published 26 Feb 2026🛡️ Security

Huntress details active exploitation of SolarWinds Web Help Desk deserialization vulnerabilities (CVE-2025-26399, plus CVE-2025-40551 which is in CISA KEV, and CVE-2025-40536) across three customer intrusions, tracing an attack chain from wrapper.exe/java.exe spawning silent MSI installs of Zoho Assist, through Velociraptor abused as a C2 framework, a Cloudflare Workers/mooo.com HTTP-406-triggered C2 failover mechanism, Get-ComputerInfo exfiltration to an attacker-run Elastic Cloud instance, Windows Defender/Firewall disabling via registry edits, and QEMU-based SSH backdoor persistence via a "TPMProfiler" scheduled task. It provides mitigation guidance (patch to WHD 2026.1, remove admin interface from the internet, reset credentials) and links to Sigma detection rules.

huntress.comwriteupAdded 3 Sep 2026, published 8 Feb 2026🛡️ Security

A DFIR researcher analyzes a PowerShell "cleaner" script discovered in an open directory (flagged by Fox_threatintel) and uploaded to VirusTotal, which threat actors use to erase traces of legitimate RMM tools like Atera and Splashtop after gaining access to a victim machine. The script sets the SystemComponent registry flag to hide the software from Apps & Features, deletes Start Menu/ProgramData installer folders (also targeting AnyDesk), and renames the Splashtop Windows Firewall rule to masquerade as a "Cast to Device" service. The author tests the script on a live machine and shows the anti-forensic tricks are shallow — toggling SystemComponent back to 0 restores visibility and other forensic artifacts still reveal the software.

dfir.chwriteupAdded 3 Sep 2026, published 10 May 2024🛡️ Security

Details CVE-2023-36631, a missing access-control flaw in Malwarebytes' Binisoft Windows Firewall Control (wfc.exe/wfcs.exe) that lets any unprivileged local user export, import, or reset Windows Defender Firewall rules without authentication, fully bypassing firewall protections. The author walks through PoC steps for the export/import/reset actions and documents Malwarebytes' HackerOne disclosure, which was initially closed as 'informative' before a CVE was ultimately assigned. It also references a related 2022 CVE-2022-25150 in the same product's Tools tab that allowed local privilege escalation.

bencteux.frwriteupAdded 3 Sep 2026, published 21 Jun 2023🛡️ Security