Cyberbro v0.10.2 Released | GUI enhancements, MCP, Threat Intel tool | Open Source Security Atlas
https://ift.tt/92GXnQg
Submitted January 13, 2026 at 09:51PM by stan_frbd
via reddit https://ift.tt/8TnojNZ
https://ift.tt/92GXnQg
Submitted January 13, 2026 at 09:51PM by stan_frbd
via reddit https://ift.tt/8TnojNZ
Opensecatlas
Open Source Security Atlas | Free Security Tools Directory & Newsletter
The largest free directory of open source security tools. Join 2,600+ professionals who get a weekly, expert-curated newsletter of the best tools.
CVE-2025-64155: 3 Years of Remotely Rooting the Fortinet FortiSIEM
https://ift.tt/Dzurex6
Submitted January 14, 2026 at 12:02AM by scopedsecurity
via reddit https://ift.tt/eu1yOK7
https://ift.tt/Dzurex6
Submitted January 14, 2026 at 12:02AM by scopedsecurity
via reddit https://ift.tt/eu1yOK7
Horizon3.ai
CVE-2025-64155: 3 Years of Remotely Rooting the FortiSIEM
Horizon3.ai details CVE-2025-64155, revealing chained FortiSIEM vulnerabilities enabling remote code execution and root access, analysis of the root cause, and indicators of compromise.
Fortinet Forticlient EMS RCE CVE-2025-59922 and one IMG tag to rule them all
https://ift.tt/HPJmOQa
Submitted January 14, 2026 at 03:00PM by security_aaudit
via reddit https://ift.tt/gSJyLip
https://ift.tt/HPJmOQa
Submitted January 14, 2026 at 03:00PM by security_aaudit
via reddit https://ift.tt/gSJyLip
baldur.dk
BALDUR. - Security Consultancy
Fortinet EMS Remote Code Execution. How one tiny img tag was all we needed to escalate our access to a full remote code execution.
Bad Vibes: Comparing the Secure Coding Capabilities of Popular Coding Agents
https://ift.tt/rBftWLw
Submitted January 14, 2026 at 06:35PM by oridavid1231
via reddit https://ift.tt/benxQZu
https://ift.tt/rBftWLw
Submitted January 14, 2026 at 06:35PM by oridavid1231
via reddit https://ift.tt/benxQZu
Tenzai Research
We analyzed the security of AI coding agents. The result: broken auth, SSRF, and missing defenses.
Tenzai researchers tested Cursor, Claude Code, Codex, Replit, and Devin. Every AI coding agent shipped vulnerable code. Here’s what broke - and why it matters.
I'm The Captain Now: Hijacking a global ocean supply chain network
https://ift.tt/cHBRzQI
Submitted January 14, 2026 at 08:48PM by EatonZ
via reddit https://ift.tt/D9RwGOj
https://ift.tt/cHBRzQI
Submitted January 14, 2026 at 08:48PM by EatonZ
via reddit https://ift.tt/D9RwGOj
Eaton-Works
I’m The Captain Now: Hijacking a global ocean supply chain network
Exploring security blunders in Bluspark Global’s BLUVOYIX, an ocean logistics / supply chain platform used by hundreds of the world’s largest companies.
Multiple XSS in Meta Conversion API Gateway Leading to Zero-Click Account Takeover
https://ift.tt/za7ou1S
Submitted January 14, 2026 at 08:43PM by smaury
via reddit https://ift.tt/kgPwb16
https://ift.tt/za7ou1S
Submitted January 14, 2026 at 08:43PM by smaury
via reddit https://ift.tt/kgPwb16
Youssef Sammouda (sam0) personal blog
Multiple XSS in Meta Conversion API Gateway Leading to Zero-Click Account Takeover
Introduction
I built a security engine that runs investigations end-to-end, and I need serious reviewers
https://ift.tt/wlLqfEg
Submitted January 15, 2026 at 12:13AM by JBase16
via reddit https://ift.tt/FNb6w10
https://ift.tt/wlLqfEg
Submitted January 15, 2026 at 12:13AM by JBase16
via reddit https://ift.tt/FNb6w10
Go Big or GO HOME!
https://ift.tt/goyzKRn
Submitted January 14, 2026 at 11:42PM by kobsoN
via reddit https://ift.tt/E4WXTZo
https://ift.tt/goyzKRn
Submitted January 14, 2026 at 11:42PM by kobsoN
via reddit https://ift.tt/E4WXTZo
Drone Hacking Part 1: Dumping Firmware and Bruteforcing ECC
https://ift.tt/dmNfGl8
Submitted January 15, 2026 at 02:02PM by AlmondOffSec
via reddit https://ift.tt/X1pwN65
https://ift.tt/dmNfGl8
Submitted January 15, 2026 at 02:02PM by AlmondOffSec
via reddit https://ift.tt/X1pwN65
neodyme.io
Drone Hacking Part 1: Dumping Firmware and Bruteforcing ECC
Desoldering a drone's flash chip and reconstructing the firmware from broken data.
Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data
https://ift.tt/PDgVU2s
Submitted January 15, 2026 at 04:24PM by lohacker0
via reddit https://ift.tt/6bDNSBm
https://ift.tt/PDgVU2s
Submitted January 15, 2026 at 04:24PM by lohacker0
via reddit https://ift.tt/6bDNSBm
Varonis
Reprompt: The Single-Click Microsoft Copilot Attack that Silently Steals Your Personal Data
Varonis Threat Labs discovered a way to bypass Copilot’s safety controls, steal users’ darkest secrets, and evade detection.
CVE-2026-20965: Cymulate Research Labs Discovers Token Validation Flaw that Leads to Tenant-Wide RCE in Azure Windows Admin Center
https://ift.tt/lzKJ8ro
Submitted January 15, 2026 at 09:12PM by Fun_Preference1113
via reddit https://ift.tt/Vl7uTyz
https://ift.tt/lzKJ8ro
Submitted January 15, 2026 at 09:12PM by Fun_Preference1113
via reddit https://ift.tt/Vl7uTyz
Cymulate
CVE-2026-20965: Cymulate Research Labs Discovers Token Validation Flaw that Leads to Tenant-Wide RCE in Azure Windows Admin Center
Cymulate Research Labs uncovered CVE-2026-20965, a token validation flaw in Azure Windows Admin Center enabling tenant-wide RCE and lateral movement.
Demonstration: prompt-injection failures in a simulated help-desk LLM
https://ift.tt/WDU5VnC
Submitted January 15, 2026 at 10:24PM by thePROFITking
via reddit https://ift.tt/RWXPKbe
https://ift.tt/WDU5VnC
Submitted January 15, 2026 at 10:24PM by thePROFITking
via reddit https://ift.tt/RWXPKbe
IHackAI
IHackAI - AI Security Training Platform | ihackai.com
IHackAI (ihackai.com) - Master AI security through hands-on challenges. Learn prompt injection, jailbreaking, and defense strategies.
Technical Analysis: ServiceNow AI Agent Vulnerability (CVE Analysis + Prevention)
https://ift.tt/crd8590
Submitted January 15, 2026 at 11:36PM by opena2a
via reddit https://ift.tt/XAm0Pwc
https://ift.tt/crd8590
Submitted January 15, 2026 at 11:36PM by opena2a
via reddit https://ift.tt/XAm0Pwc
OpenA2A
The ServiceNow AI Vulnerability: What Went Wrong
85% of Fortune 500 exposed. Learn how AI agents need purpose-built security, not retrofitted legacy authentication.
Closing the Door on Net-NTLMv1: Releasing Rainbow Tables to Accelerate Protocol Deprecation
https://ift.tt/e9jHNiS
Submitted January 15, 2026 at 10:52PM by AlmondOffSec
via reddit https://ift.tt/4epqAOB
https://ift.tt/e9jHNiS
Submitted January 15, 2026 at 10:52PM by AlmondOffSec
via reddit https://ift.tt/4epqAOB
Google Cloud Blog
Releasing Rainbow Tables to Accelerate Protocol Deprecation | Google Cloud Blog
Mandiant aims to lower the barrier for security professionals to demonstrate the insecurity of Net-NTLMv1.
WinBoat: Drive by Client RCE + Sandbox escape.
https://ift.tt/pXIgb6w
Submitted January 16, 2026 at 06:05AM by reddit4matt
via reddit https://ift.tt/a7mIYV8
https://ift.tt/pXIgb6w
Submitted January 16, 2026 at 06:05AM by reddit4matt
via reddit https://ift.tt/a7mIYV8
hack.do
WinBoat: Drive by Client RCE + Sandbox escape.
A remote webpage can abuse an unauthenticated guest HTTP API to compromise the Windows guest container, then feed a malicious app entry leading to Linux host code execution on click.
Multiple cross-site leaks disclosing Facebook users in third-party websites
https://ift.tt/WEtpCaP
Submitted January 16, 2026 at 03:56PM by smaury
via reddit https://ift.tt/o6YUsEA
https://ift.tt/WEtpCaP
Submitted January 16, 2026 at 03:56PM by smaury
via reddit https://ift.tt/o6YUsEA
Youssef Sammouda (sam0) personal blog
Multiple cross-site leaks disclosing Facebook users in third-party websites
Introduction This write-up consolidates several XS-Leak issues discovered across Meta-owned platforms, including Facebook, Workplace, Meta for Work, and internal Meta surfaces.
Instagram account takeover via Meta Pixel noscript abuse
https://ift.tt/h2T41Xx
Submitted January 16, 2026 at 03:56PM by smaury
via reddit https://ift.tt/LOvST2n
https://ift.tt/h2T41Xx
Submitted January 16, 2026 at 03:56PM by smaury
via reddit https://ift.tt/LOvST2n
Youssef Sammouda (sam0) personal blog
Instagram account takeover via Meta Pixel noscript abuse
Introduction Meta’s web ecosystem relies on cross-window messaging between first-party websites. In many cases, the only security control enforced is an origin check validating that messages originate from facebook.com or its subdomains.
Leaking Meta FXAuth Token leading to 2 click Account Takeover
https://ift.tt/9i3Tqer
Submitted January 16, 2026 at 03:56PM by smaury
via reddit https://ift.tt/jyiFQmW
https://ift.tt/9i3Tqer
Submitted January 16, 2026 at 03:56PM by smaury
via reddit https://ift.tt/jyiFQmW
Youssef Sammouda (sam0) personal blog
Leaking Meta FXAuth Token leading to 2 click Account Takeover
Introduction FXAuth is Meta’s shared authentication system used across Facebook, Instagram, and Meta (Horizon / VR). It is used by Accounts Center for account linking, re-authentication, and sensitive action confirmation.
StackWarp: Exploiting Stack Layout Vulnerabilities in Modern Processors
https://ift.tt/79AGbsU
Submitted January 16, 2026 at 08:19PM by YogiBerra88888
via reddit https://ift.tt/8Z5Uvxs
https://ift.tt/79AGbsU
Submitted January 16, 2026 at 08:19PM by YogiBerra88888
via reddit https://ift.tt/8Z5Uvxs
ServiceNow Virtual Agent Auth Bypass → AI Agent Privilege Escalation (85% Fortune 500 affected)
https://ift.tt/crd8590
Submitted January 16, 2026 at 09:52PM by opena2a
via reddit https://ift.tt/GaIBcUg
https://ift.tt/crd8590
Submitted January 16, 2026 at 09:52PM by opena2a
via reddit https://ift.tt/GaIBcUg
OpenA2A
The ServiceNow AI Vulnerability: What Went Wrong
85% of Fortune 500 exposed. Learn how AI agents need purpose-built security, not retrofitted legacy authentication.