Hear your own voice cloned in real time and understand why your team is vulnerable to vishing.

Get the latest updates concerning DEF CON and the next DEF CON Conference!

If you run Falco, an EDR, or a generic host agent on a validator and a network-DoS attack against the node went undetected, this explains why. A technique-by-technique analysis of five reproduced P2P-infrastructure attacks against the syscall detection surface.…

Threat intelligence report: RoguePlanet - 2 million installs, one hijacked search bar. Research by MalExt Sentry.

Practical pentesting notes for vibe-coded apps, covering JWT flaws, exposed secrets, broken authorization, SSRF, and other boundary failures.

The Internet is almost anonymous and privacy-preserving by design. I mean, unless some administrator actively tries to track you, there is no built-in...

A technical analysis of a live Google Ads malvertising campaign abusing Claude AI, Base64-obfuscated shell commands and trusted domains to deliver the MacSync infostealer.

Summary A vulnerability in vBulletin has been identified, the vulnerability allows an unauthenticated user to cause the vBulletin to execute arbitrary code (PHP) on the remote server. Vendor Response The vendor has issued a fix available at: https://foru…

VE Commercial Vehicles’ My Eicher platform had a critical vulnerability that let you take over anyone’s account and gain control over their vehicle fleets.

Threat intelligence report: BrainDrain - SecondBrain's Prompt Optimizer Collects Your AI Chats. Research by MalExt Sentry.

Coding Pollard's 1974 Paper on Factoring Within P-1 Multiplicative Subgroups

The state of vibe-coded app security (549 repos) — first-party research from ogbuilds, based on 549 repos. secure·vibes heuristic rules engine (no AI pass) run over 549 public GitHub repos that describe themselves as AI- or vibe-coded. The original 107-repo…

A 20-year-old vulnerability gave us access to bare-metal servers - and a foothold in the no man’s land of data center infrastructure.

Even in modern web apps, IDOR bugs are treated as one-off findings. What if we designed patterns that made introducing IDOR impossible?

PoC for CVE-2024-1813: unauthenticated PHP object injection in Simple Job Board ≤ 2.11.0, chained to RCE via AIOSEO/Monolog.

Hunt.io and NetAskari trace a leaked Android RAT framework across 170 active servers, analyze the APK builder internals, and document a successor platform called Night Dragon targeting Chinese users.

A look at two undocumented, AI-built phishing kits that automate the full business email compromise chain: device code phishing, token theft, persistence, and AI-driven invoice fraud.

Anthropic researchers find weaknesses in cryptographic algorithms with Claude Mythos Preview

Hush Security raised a $30 million Series A from Akamai, Battery Ventures and YL Ventures to expand its runtime identity and access platform for AI agents.

Security experts