Since the end of 2024, we have been continuously monitoring large-scale DDoS attacks orchestrated by an IoT botnet exploiting vulnerable IoT devices such as wireless routers and IP cameras.

By: Joshua Platt, Jason Reaves and Jonathan McCay

Security advisories for vulnerabilities. Contribute to bf/security-advisories development by creating an account on GitHub.

This blog post looks into how 63 malicious extensions circumvent Google’s restrictions of remote code execution in extensions. One group of extensions is associated with the company Phoenix Invicta. The other groups around Netflix Party and Sweet VPN haven’t…

ChatGPT-4o contains security bypass vulnerability through time and search functions called "Time Bandit"

Introduction

Security leaders must ensure there’s more to their defenses than the simplest identity checks

Introduction A counterintuitive truth is that great products are defined by both the features they include, as well as those they don’t. We spend a lot of time pondering potential new features for …

Socket researchers uncovered a backdoored typosquat of BoltDB in the Go ecosystem, exploiting Go Module Proxy caching to persist undetected for years.

Developers are pulling in publicly available ASP.NET keys into their environments, without realizing that cyberattackers can use them for clandestine code injection.

Microsoft Threat Intelligence Center discovered an active and successful device code phishing campaign by a threat actor we track as Storm-2372. Our ongoing investigation indicates that this campaign has been active since August 2024 with the actor creating…

PurpleLab is an efficient and readily deployable lab solution, providing a swift setup for cybersecurity professionals to test detection rules and undertake various security tasks, all accessible ...

Since the Sysdig team discovered LLMjacking in 2024, we have discovered new methods — including rapid expansion to new LLMs, such as DeepSeek.

A new code completion model, GPT-4o Copilot, can now be enabled by VS Code users. This new model based on GPT-4o mini has additional training on over 275,000 high-quality public…

Threat-hunting tool for Linux. Contribute to kunai-project/kunai development by creating an account on GitHub.

Recently, AhnLab SEcurity intelligence Center (ASEC) identified the distribution of XLoader malware using the DLL side-loading technique. The DLL side-loading attack technique saves a normal application and a malicious DLL in the same folder path to enable…