Newly discovered later-stage malware from BlueNoroff APT group targets macOS with characteristics similar to their RustBucket campaign.

Contribute to Aqua-Nautilus/CVE-Half-Day-Watcher development by creating an account on GitHub.

   

Python’s e-mail libraries smtplib, imaplib, and poplib do not verify server certificates unless a proper SSL context is passed to the API. This leads to security problems.

The term SIEM often conjures images of complex configurations and $100k bills leading to inaction. It doesn't have to be that way. In cybersecurity (and often in life), starting somewhere and taking even a small step in the right direction is preferable to…

Become familiar with developing applications for Flipper Zero, which will be capable of activating adult toys all at once or completely inhibit their use for those within your range (i.e. Denial of Pleasure Attack).

API flaw enabled livestreaming of a telecommunications company’s office cameras.

Developer usage patterns with Azure CLI may leak sensitive data in CI/CD logs when used in public repositories, potentially exposing critical information.

In summer 2023 for a graduate program class I worked with an excellent team made up of Elvis Maese, Parth Joshi, Scott Randall, & Chris…

In OpenCart versions 4.0.0.0 to 4.0.2.3, authenticated backend users having common/security access and modify privileges can write arbitrary untrusted data inside config.php and admin/config.php, resulting in remote code execution on the underlying server.

Introduction

VulnCheck finds a new way to exploit ActiveMQ CVE-2023-46604 that allows the attacker to hide in memory and avoid process-based detections.

Report and exploit of CVE-2023-36427. Contribute to tandasat/CVE-2023-36427 development by creating an account on GitHub.

Useful Techniques, Tactics, and Procedures for red teamers and defenders, alike! - RoseSecurity/Red-Teaming-TTPs

Earlier today, AlphV added MeridianLink to their leak site. MeridianLink (MLNK) is the provider of a loan origination system and digital lending platform for...

In our research, Binary Security found a weakness in Azure Kubernetes Service (AKS) that allows Guest users or third-party apps to access the AKS API without getting assigned any specific roles. Microsoft originally responded that it “does not meet the definition…