NAT has been hacked before. Security researcher Samy Kamkar disclosed NAT Pinning at DEF CON 18 and Black Hat in 2010, an early technique for manipulating NAT port behavior. He returned to the problem a decade later with NAT Slipstreaming,… Read More "NatJack exploits put NAT security assumptions to the test at Black Hat"
Meta has confirmed that one of its AI models exploited a vulnerability in a third-party service during testing, joining OpenAI and Anthropic in reporting similar incidents. Meta said the incident occurred during testing by independent firm Irregular. A misconfiguration by… Read More "Meta Joins OpenAI and Anthropic in Reporting AI Exploit Incident"
Low-code workflow builders have flourished in the AI wave, providing the “shovels and picks” for non-technical users to make AI-powered apps. Flowise is one of those tools and, like others in its category, it has the potential to leak data… Read More "Downstream Data: Investigating AI Data Leaks in Flowise"
In today’s digital age, cybersecurity is more critical than ever, and organizations must prioritize resilience to protect themselves against evolving threats. In this podcast, we share insights from Edna Conway, a recognized leader in cybersecurity and supply chain resilience with… Read More "Podcast: Compliance Won’t Save You: The Future of Cyber Risk with Edna Conway"
An unprivileged Linux program can time a hardware interrupt to land in the gap between a processor sanitizing its branch predictor and the kernel using it, re-poisoning the predictor after the defense has run. MIT CSAIL researchers Daniël Trujillo and… Read More "New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs"
Most security teams don’t suffer from a lack of data. They suffer from a lack of certainty. Vulnerability scanners, annual penetration tests, and compliance assessments can generate thousands of findings. Yet they often fail to answer a simple question: Which… Read More "How a global investment firm reduced security surprises"
A post-exploitation toolkit has been found compiled and stored inside an Oracle database as schema objects, giving attackers command execution on the underlying Windows server from a location conventional endpoint tooling does not inspect. Huntress detected the intrusion on July… Read More "Toolkit Hidden Inside Oracle Database Evades Endpoint Tools"
The modern cybersecurity landscape is being redefined by the human element. With every individual user accessing your network, tools, and sensitive data, managing your human attack surface is growing more critical than ever. Yet, as user autonomy increases and AI… Read More "Solving Human Risk: Close the Visibility Gap"
Connor Riley Moucka has pleaded guilty over his role in a cybercrime campaign that involved hacking into the Snowflake accounts of 165 organizations. The 26-year-old has pleaded guilty to computer fraud, wire fraud, aggravated identity theft, and a related conspiracy,… Read More "Snowflake Hacker Pleads Guilty in US Court"
Coinspect has identified CryptoJS.lib.WordArray.random() as the weak random number generator behind the Ill Bloom wallet drains. Introduced in the JavaScript cryptography library 12 years ago, the function supplied weak entropy that affected wallet apps used to generate recovery phrases. Coinspect’s… Read More "CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps"
