The biggest risk in cloud development is not recognizing the differences between cloud and traditional definitions of common architecture terms. For example, imagine a system that is completely “firewalled off”—a firewall prevents any inbound or outbound…

Posted in r/netsec by u/mmmds • 67 points and 2 comments

Mitigating OT security risk is an ongoing process, so operational security teams need to automate vulnerability assessments and risk calculations.

Application security issues found by Assetnote

A (best-effort) weekly newsletter that will make you understand Cybersecurity better. Click to read Cybersecurity Tips, by Nuno, a Substack publication with hundreds of readers.

Our latest Cymulate blog provides quick and easy ways to expand on your IoC list to leverage immediate threats simulations.

POC for CVE-2022-1388. Contribute to horizon3ai/CVE-2022-1388 development by creating an account on GitHub.

CVE-2022-1388 is a critical vulnerability (CVSS 9.8) in the management interface of F5 Networks’ BIG-IP solution.

Microsoft coined the term “human-operated ransomware” to clearly define a class of attack driven by expert human intelligence at every step of the attack chain and culminate in intentional business disruption and extortion. In this blog, we explain the ransomware…

Go on a journey with Oddvar Moe as he uses his legacy knowledge to abuse pre-created computer accounts that could potentially let you escalate privileges.

Continuing to walk down Linux Kernel exploitation lane. This time around with an unanticipated topic: DirtyPipe as it actually nicely fits the series as an example.

In this blog post, we’ll dive into a recently patched Active Directory Domain Privilege Escalation vulnerability that I reported through…

A new underground phishing-as-a-service (PaaS) called "Frappo" has been detected on the dark web by security researchers at Resecurity Hunter.

SaaS vanity URLs can be spoofed and used for phishing campaigns and other attacks. In this article, we’ll showcase two Box link types, two Zoom link types, and two Google Docs link type that we were able to spoof.

Comprehensive Performance Testing Platform. Available on CLI, Self-Hosted, and Cloud - https://ddosify.com 🚀 - GitHub - ddosify/ddosify: Comprehensive Performance Testing Platform. Available on CLI...

Rapid7 discovered and reported a vulnerability that affects Zyxel firewalls supporting Zero Touch Provisioning (ZTP), identified as CVE-2022-30525.

Do you ever wonder about the vulnerabilities you've missed? Why didn't they show themselves - and will they be discovered by somebody else later? Certain vulnerabilities have a knack for evading audit

Three major trends, Kubernetes security, cloud security, and supply chain attacks, keep on the rise and on everyone's radar at Blackhat.