A few weeks back I encountered an obfuscated piece of code. Reversing it seemed very tedious.

Hunters' research team discovers obfuscation technique using AWS VPC feature. Attackers could change the IP address written to AWS CloudTrail logs.

Posted by pathetiq - No votes and no comments

CloudFormation, Terraform, and AWS CLI Templates: Configuration templates to deploy an AWS Route53 Resolver Firewall and related settings including firewall rule groups, custom domain lists, and VPC associations. This configuration can be used to block DNS…

SonarSource builds world-class Code Quality & Code Security tools. Our products, SonarLint, SonarQube, and SonarCloud are trusted by 200k+ organizations globally.

In this post, we cover the technical details of CVE-2021-28091, the vulnerability impacting Akamai's Enterprise Application Access (EAA) platform.

Posted in r/netsec by u/hardenedvault • 11 points and 1 comment

A comprehensive analysis revealing two new critical vulnerabilities discovered in a popular Realtek Wi Fi module by Vdoo’s automated product security platform, including a demonstration of the exploitation.

Contribute to CriticalSecurity/welock development by creating an account on GitHub.

When we were developing the ghidra nodejs module for Ghidra, we realized that it was not always possible to correctly implement V8 (JavaScript engine that is used by Node.js) opcodes in SLEIGH. In such runtime environments as V8 and JVM, a single opcode might…

In this post we will examine a vulnerability in the WebAssembly subsystem of JavaScriptCore, the JavaScript engine used in WebKit and Apple Safari. The issue...

On 13th May 2021, WordPress released WordPress 5.7.2, which was a security release fixing one vulnerability that affected versions 3.7 to 5.7. This vulnerability is a PHP Object Injection vulnerability in PHPMailer (CVE-2020-36326, CVE-2018-19296) that occurs…

Job Opening: Us Courts Penetration Tester at Security Innovation in Seattle .

Learn about password hashing, salting, and key derivation functions in Python.

Introduction

Unexpected “Expected” Behavior

This report will review an intrusion where the threat actor took advantage of a WebLogic remote code execution vulnerability (CVE-2020–14882) to gain initial access to the system before installing a coin miner (XMRig).

At @ConfiantIntel we had some “luck” finding a new malware targeting the new Apple flagship M1 computers. I put “luck” between quotes, as…