Ipset Hash is full, cannot add more elements

Supply Chain Security Harm Reduction with 3TOFU

Ghidra training classes from NSA

An intro to automated evasion and compilation of .NET offensive tools

Phrack #71: Call For Paper

NIST Releases Version 2.0 of Landmark Cybersecurity Framework

Hacking Terraform state to gain code execution and privilege escalation

Data Scientists Targeted by Malicious Hugging Face ML Models with Silent Backdoor

New Server Side Prototype Pollution Gadgets Scanner from Doyensec

It's now possible to find the AWS Account ID for any S3 Bucket (private or public)

“SubdoMailing” — Thousands of Hijacked Major-Brand Subdomains Found Bombarding Users With Millions of Malicious Emails

SEO Poisoning to Domain Control: The Gootloader Saga Continues

Code injection or backdoor: A new look at Ivanti's CVE-2021-44529

Python Risk Identification Tool for generative AI (PyRIT)

New TP-Link authentication Bypass!

Optum / Change Healthcare Breach

Ongoing Malware Laced Developer Job Interviews

Lockbit Ransomeware global taketown

GitHub - mlcsec/FormThief: Spoofing desktop login applications with WinForms and WPF

Ivanti Connect Secure Under Attack: Uncovering Five Exploitable CVEs - XXE

Analysis of Mirai variant leveraging CVE-2023-1389

Exploiting Unsynchronised Clocks

Snap Trap: The Hidden Dangers Within Ubuntu's Package Suggestion System

Decrypted: Rhysida Ransomware - "we are now publicly releasing our decryptor for download to all victims of the Rhysida ransomware"

Breach Analysis: APT29’s Attack on Microsoft - Password Spray & OAuth abuse.

Troy Hunt: How Spoutible’s Leaky API Spurted out a Deluge of Personal Data

JSON Smuggling: A far-fetched intrusion detection evasion technique

Shellcode evasion using Wasm/Wat and Rust

ShmooCon 2024 Videos are up!

apk.sh makes reverse engineering Android apps easier, automating some repetitive tasks like pulling, decoding, rebuilding and patching an APK.

Trends in Phishing, Fraud, 'Dark AI Models', and how to better protect yourself.

How I Hacked My Air Purifier to Remove Cloud Dependency [Detailed Write-Up]

Deluder: Python utility for intercepting traffic of applications. Deluder can be used as an alternative for EchoMirage. It supports OpenSSL, GnuTLS, SChannel, WinSock and Linux Sockets out of the b...

AnyDesk Incident Response 2-2-2024

Your Security Program Is Shit

Frog4Shell — FritzFrog Botnet Adds One-Days to Its Arsenal

Leaky Vessels: Docker and runc Container Breakout Vulnerabilities - January 2024

CVE-2023-6246: Heap-based buffer overflow in the glibc's syslog()

New Visual Studio Code plugin for IaC security (plus collaboration, semgrep integration)

Hunting for (Un)authenticated n-days in Asus Routers - Shielder

Your Firewalls and Proxies are about to be blind to real TLS destinations: Learn about Encrypted Client Hello

“Scammers Paradise” —Exploring Telegram’s Dark Markets, Breeding Ground for Modern Phishing Operations

NMAP-formatter: convert NMAP results to HTML, CSV, JSON, graphviz (dot), SQLite

Microsoft, HPE hacks by Russia are just the tip of the iceberg - Microsoft said late Thursday that it had found more victims and was in the process of notifying them.

How I hacked chess.com

CVE-2024-23897 Jenkins CLI PoC

New Zyxel RCE Vulnerability allows remote attackes execute commands as root!