Mirage2FA stole 4,561 M365 session cookies despite MFA via AiTM proxy (CVE-2026-69836 CVSS 10.0) : detection rules and WHfB/Cloud Kerberos Trust hardening guide
https://ift.tt/qv6tDAr
Submitted November 1, 2026 at 03:45PM by doit4everyone
via reddit https://ift.tt/yXuaSVW
https://ift.tt/qv6tDAr
Submitted November 1, 2026 at 03:45PM by doit4everyone
via reddit https://ift.tt/yXuaSVW
MVC nLPD — Microsoft 365 Business Premium
AiTM / Cookie Hijacking M365 — Détection, mitigation et protection structurelle DoIt4Everyone
Guide technique complet sur les attaques AiTM contre Microsoft 365. CAE, WHfB, FIDO2, Cloud Kerberos Trust, CA Authentication Strength. Validé terrain sur infra hybride — août 2026.
r/netsec monthly discussion & tool thread
Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.Rules & GuidelinesAlways maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.Avoid use of memes. If you have something to say, say it with real words.All discussions and questions should directly relate to netsec.No tech support is to be requested or provided on r/netsec.As always, the content & discussion guidelines should also be observed on r/netsec.FeedbackFeedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.
Submitted November 1, 2026 at 07:59PM by albinowax
via reddit https://ift.tt/CTe2k53
Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.Rules & GuidelinesAlways maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.Avoid use of memes. If you have something to say, say it with real words.All discussions and questions should directly relate to netsec.No tech support is to be requested or provided on r/netsec.As always, the content & discussion guidelines should also be observed on r/netsec.FeedbackFeedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.
Submitted November 1, 2026 at 07:59PM by albinowax
via reddit https://ift.tt/CTe2k53
Reddit
From the netsec community on Reddit
Explore this post and more from the netsec community
/r/netsec's Q4 2026 Information Security Hiring Thread
OverviewIf you have open positions at your company for information security professionals and would like to hire from the /r/netsec user base, please leave a comment detailing any open job listings at your company.We would also like to encourage you to post internship positions as well. Many of our readers are currently in school or are just finishing their education.Please reserve top level comments for those posting open positions.Rules & GuidelinesInclude the company name in the post. If you want to be topsykret, go recruit elsewhere. Include the geographic location of the position along with the availability of relocation assistance or remote work.If you are a third party recruiter, you must disclose this in your posting.Please be thorough and upfront with the position details.Use of non-hr'd (realistic) requirements is encouraged.While it's fine to link to the position on your companies website, provide the important details in the comment.Mention if applicants should apply officially through HR, or directly through you.Please clearly list citizenship, visa, and security clearance requirements.You can see an example of acceptable posts by perusing past hiring threads.FeedbackFeedback and suggestions are welcome, but please don't hijack this thread (use moderator mail instead.)
Submitted November 1, 2026 at 10:49PM by netsec_burn
via reddit https://ift.tt/Q2TJG9S
OverviewIf you have open positions at your company for information security professionals and would like to hire from the /r/netsec user base, please leave a comment detailing any open job listings at your company.We would also like to encourage you to post internship positions as well. Many of our readers are currently in school or are just finishing their education.Please reserve top level comments for those posting open positions.Rules & GuidelinesInclude the company name in the post. If you want to be topsykret, go recruit elsewhere. Include the geographic location of the position along with the availability of relocation assistance or remote work.If you are a third party recruiter, you must disclose this in your posting.Please be thorough and upfront with the position details.Use of non-hr'd (realistic) requirements is encouraged.While it's fine to link to the position on your companies website, provide the important details in the comment.Mention if applicants should apply officially through HR, or directly through you.Please clearly list citizenship, visa, and security clearance requirements.You can see an example of acceptable posts by perusing past hiring threads.FeedbackFeedback and suggestions are welcome, but please don't hijack this thread (use moderator mail instead.)
Submitted November 1, 2026 at 10:49PM by netsec_burn
via reddit https://ift.tt/Q2TJG9S
Investigating three incidents in our evaluations
https://ift.tt/zf31eqN
Submitted November 2, 2026 at 10:02AM by fagnerbrack
via reddit https://ift.tt/cNgOkwb
https://ift.tt/zf31eqN
Submitted November 2, 2026 at 10:02AM by fagnerbrack
via reddit https://ift.tt/cNgOkwb
Anthropic
Investigating three incidents in our cybersecurity evaluations
We found three cases where a Claude model reached the internet from an evaluation environment and accessed real systems. We share what happened and what we're changing.
WordPress pingback and Brotli RCE
https://ift.tt/ae6TD2L
Submitted November 2, 2026 at 02:41PM by adrian_rt
via reddit https://ift.tt/VbthI9E
https://ift.tt/ae6TD2L
Submitted November 2, 2026 at 02:41PM by adrian_rt
via reddit https://ift.tt/VbthI9E
FORTBRIDGE
WordPress pingback and Brotli RCE
A pinned WordPress 7.1.3 image returned the web-process id line to an anonymous XML-RPC pingback. See the live capture, raw evidence and limits.
Remote code execution on Linux systems with multipath TCP
https://ift.tt/NwXQ2xg
Submitted November 2, 2026 at 03:00PM by lucidsparrow982
via reddit https://ift.tt/bAziqkj
https://ift.tt/NwXQ2xg
Submitted November 2, 2026 at 03:00PM by lucidsparrow982
via reddit https://ift.tt/bAziqkj
LWN.net
Remote code execution on Linux systems with multipath TCP
On October 27, LLM provider Anthropic reported on a remotely exploitable use-after-free bug a [...]
Securing Internet-Critical Software: How We Could Have Backdoored Bash
https://ift.tt/1qybeV2
Submitted November 2, 2026 at 03:13PM by gainan
via reddit https://ift.tt/bWmkHBT
https://ift.tt/1qybeV2
Submitted November 2, 2026 at 03:13PM by gainan
via reddit https://ift.tt/bWmkHBT
Hacktron AI
Securing Internet-Critical Software: How We Could Have Backdoored Bash
A shell injection hidden in an email address gave us code execution on GNU Savannah, then root, then the ability to push to the upstream Bash repository. We reported it, kept auditing, and helped the FSF fix 26 vulnerabilities in the forge that hosts GNU.
Fake Nuclear Alert Sent Through Russian Emergencies Ministry App After Hack
https://ift.tt/2LMTIJt
Submitted November 2, 2026 at 09:55PM by Much-Television-9449
via reddit https://ift.tt/BROkbqA
https://ift.tt/2LMTIJt
Submitted November 2, 2026 at 09:55PM by Much-Television-9449
via reddit https://ift.tt/BROkbqA
KYLES INVESTIGATION
Fake Nuclear Alert Sent Through Russian Emergencies Ministry App After Hack - Nationwide Private Investigator & Skip Tracing |…
MOSCOW, November 2, 2026— Russia’s Emergencies Ministry said Monday that its mobile app was hit by a cyberattack that let outsiders push false warnings to users, according to the state news agency TASS. The incident came hours after Ukraine reported that…
Jailbreaking my car's navigation system just so I can change the time
https://ift.tt/384PrQC
Submitted November 3, 2026 at 12:46AM by nns_ee
via reddit https://ift.tt/Bk5ye4U
https://ift.tt/384PrQC
Submitted November 3, 2026 at 12:46AM by nns_ee
via reddit https://ift.tt/Bk5ye4U
nns.ee
Jailbreaking my car's navigation system just so I can change the time | nns.ee
I shouldn't have to be doing any of this, but at least it's fun.
CPGuard / OPSSHIELD LLP Breach
https://ift.tt/HrZCnlx
Submitted November 3, 2026 at 04:45AM by 3verse16
via reddit https://ift.tt/mNoT5Sy
https://ift.tt/HrZCnlx
Submitted November 3, 2026 at 04:45AM by 3verse16
via reddit https://ift.tt/mNoT5Sy
OPSSHIELD
cPGuard security advisory: Update channel compromise
Update every cPGuard server to version 5.88.25 or later immediately. Administrator actions and known indicators, published 3 November 2026.
A primer on TETRA mission-critical radio network authentication flaws
https://ift.tt/7hI31Rg
Submitted November 3, 2026 at 03:49PM by 2ROT13
via reddit https://ift.tt/P0OS74y
https://ift.tt/7hI31Rg
Submitted November 3, 2026 at 03:49PM by 2ROT13
via reddit https://ift.tt/P0OS74y
www.midnightblue.nl
TETRA authentication flaws
Blog post elaborating on the very limited added value of authentication in TETRA in many networks; it provides no authenticity guarantees for messages/traffic.
Pass-ta-key Golden Attack: Stealing Google Password Manager Synced Passkeys for Offline Account Takeover
https://ift.tt/sHayY7m
Submitted November 3, 2026 at 06:05PM by True_Mixture_309
via reddit https://ift.tt/Aq4sJm2
https://ift.tt/sHayY7m
Submitted November 3, 2026 at 06:05PM by True_Mixture_309
via reddit https://ift.tt/Aq4sJm2
0rcruxe
Pass-ta-key Golden Attack: Extracting the Security Domain Secret from Chrome process memory
Part 1 of a technical deep-dive into the Pass-ta-key Golden Attack, covering a new method for extracting the Security Domain Secret (SDS) of Google Password Manager from Chrome process memory.
We found 4,972 "hello" messages hiding thousands of malicious commands targeting Flowise
https://ift.tt/bAxjTZh
Submitted November 3, 2026 at 08:41PM by Budget-Score725
via reddit https://ift.tt/Z3RLQ8I
https://ift.tt/bAxjTZh
Submitted November 3, 2026 at 08:41PM by Budget-Score725
via reddit https://ift.tt/Z3RLQ8I
Era Security
You Had Me at "Hello": Inside The Greeter, A Chinese-Language Framework Targeting AI Infrastructure
Era Research uncovered Greeter, a Chinese-language exploitation framework that hid malicious commands inside "hello" messages to attack exposed Flowise AI deployments.
Finding 40+ Vulnerabilities in Healthcare Software Serving More Than 100 Million Patients
https://ift.tt/0NfEOXu
Submitted November 4, 2026 at 10:58AM by idnsec
via reddit https://ift.tt/XRxtLQl
https://ift.tt/0NfEOXu
Submitted November 4, 2026 at 10:58AM by idnsec
via reddit https://ift.tt/XRxtLQl
IDNSEC
Finding 40+ Vulnerabilities in Healthcare Software Serving More Than 100 Million Patients
An AI assisted security review found local file disclosure, SQL injection, access control flaws, and other vulnerabilities in OpenEMR. There are 42 advisories fixed in version 8.5.0 that credit this research.
Chinese Botnet (XCPE on Android) Broken
https://ift.tt/XuBvk12
Submitted November 4, 2026 at 08:57PM by Doug_Vitale
via reddit https://ift.tt/m5ixOo4
https://ift.tt/XuBvk12
Submitted November 4, 2026 at 08:57PM by Doug_Vitale
via reddit https://ift.tt/m5ixOo4
eSecurity Planet
Google Disrupts 1.3 Million-Device Android Botnet Linked to Manufacturer
Google disrupted the XCPE botnet affecting 1.3 million Android devices, exposing allegations of manufacturer-installed backdoors and supply-chain security risks.
Who Polices the Blockchain? The Binance Heist and the New Gatekeepers
https://ift.tt/5tJyncg
Submitted November 4, 2026 at 09:19PM by RUSIOfficial
via reddit https://ift.tt/MUQcJuI
https://ift.tt/5tJyncg
Submitted November 4, 2026 at 09:19PM by RUSIOfficial
via reddit https://ift.tt/MUQcJuI
www.rusi.org
Who Polices the Blockchain? The Binance Heist and the New Gatekeepers
The institutions that have the authority to police international finance are no longer necessarily the institutions that possess the capabilities to do so.
Escaping AWS Firecracker from guest userspace: VMM memory corruption (CVE-2026-122192)
https://ift.tt/rns461N
Submitted November 5, 2026 at 03:17AM by coinspect
via reddit https://ift.tt/JUH59Wq
https://ift.tt/rns461N
Submitted November 5, 2026 at 03:17AM by coinspect
via reddit https://ift.tt/JUH59Wq
Coinspect Security
Escaping Firecracker from Guest Userspace
Coinspect demonstrated a Firecracker sandbox escape from guest userspace, gained code execution in its host-side process, and used a second issue to bypass Firecracker's...
Who’s Trying to Get Into Our Fridge Freezer? There's nowt in it!
https://ift.tt/toWXpYH
Submitted November 5, 2026 at 06:30PM by ethicalhack3r
via reddit https://ift.tt/5fAe3yd
https://ift.tt/toWXpYH
Submitted November 5, 2026 at 06:30PM by ethicalhack3r
via reddit https://ift.tt/5fAe3yd
Previdian
Who’s Trying to Get Into Our Fridge Freezer? There's nowt in it!
What Our Danfoss Decoy Recorded During the European Refrigeration Incidents
The fridge freezer hacks across Europe have attracted a lot of media attention over the past few days, including coverage of our intelligence and analysis in The Wall Street Journal…
The fridge freezer hacks across Europe have attracted a lot of media attention over the past few days, including coverage of our intelligence and analysis in The Wall Street Journal…
The Confessions of an AI Fraud Kingpin
https://ift.tt/elCd5Ht
Submitted November 5, 2026 at 08:08PM by 404mediaco
via reddit https://ift.tt/Jqz30Av
https://ift.tt/elCd5Ht
Submitted November 5, 2026 at 08:08PM by 404mediaco
via reddit https://ift.tt/Jqz30Av
404 Media
The Confessions of an AI Fraud Kingpin
Yuriy Nazarenko created ‘OnlyFake’, a site that let anyone churn out realistic fake IDs with AI. Then the North Koreans came knocking.
ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS · Forever Security
https://ift.tt/UtNmd2Y
Submitted November 5, 2026 at 08:10PM by Content-Winter5328
via reddit https://ift.tt/YeqxbcG
https://ift.tt/UtNmd2Y
Submitted November 5, 2026 at 08:10PM by Content-Winter5328
via reddit https://ift.tt/YeqxbcG
Forever
ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS · Forever Security
A Claude Dispatch flaw let a browser extension escape the browser and run code on the OS through Claude Desktop, even on another computer. Dispatch is being retired, but the design flaw behind it runs through other parts of the Claude suite.
Sogou Input Method update hijack installs DarkVigil backdoor; update to 16.10 (CVE-2026-120422)
https://ift.tt/WBmSVp8
Submitted November 5, 2026 at 11:56PM by glatisantbeast
via reddit https://ift.tt/okh9zgX
https://ift.tt/WBmSVp8
Submitted November 5, 2026 at 11:56PM by glatisantbeast
via reddit https://ift.tt/okh9zgX
Vulnpocalypse
Sogou Input Method update hijack installs DarkVigil backdoor; update to 16.10 (CVE-2026-120422)
A China-aligned group hijacked DNS to push the DarkVigil implant through Sogou Input Method's plain HTTP requests; Tencent fixed it in version 16.10.