Forwarded Without Question: How Web Frameworks Overtrust the Forwarded Header
https://ift.tt/q2adiUH
Submitted November 6, 2026 at 04:04PM by luryus
via reddit https://ift.tt/xyIPaAZ
https://ift.tt/q2adiUH
Submitted November 6, 2026 at 04:04PM by luryus
via reddit https://ift.tt/xyIPaAZ
www.lkoskela.fi
Forwarded Without Question: How Web Frameworks Overtrust the Forwarded Header
Some web frameworks and servers, including Rails, Spring and Jetty, read values from the Forwarded request header in their default configuration. Most reverse proxies, CDNs and middleware servers do not touch the Forwarded header in requests. As a result…
Reproducing the GhostMap APK crash loop on Android 16/17, plus an offline check for the ZIP parser mismatch
https://ift.tt/p8kvKCQ
Submitted November 7, 2026 at 02:04PM by ImL1s
via reddit https://ift.tt/en90IwY
https://ift.tt/p8kvKCQ
Submitted November 7, 2026 at 02:04PM by ImL1s
via reddit https://ift.tt/en90IwY
GitLab
ImL1s / ghostmap-research · GitLab
Independent Reproduction & Defensive Research
The Exploit Was the Bottleneck
https://ift.tt/f9AsweQ
Submitted November 7, 2026 at 03:08PM by kygyty
via reddit https://ift.tt/rEQRSIf
https://ift.tt/f9AsweQ
Submitted November 7, 2026 at 03:08PM by kygyty
via reddit https://ift.tt/rEQRSIf
www.a16z.news
The Exploit Was the Bottleneck
What 23 Years of Data Say About AI and the Patch Gap
unlocking any car from X brand in most of the world
https://ift.tt/VcZih51
Submitted November 7, 2026 at 04:40PM by Mempodipper
via reddit https://ift.tt/FJBrVCn
https://ift.tt/VcZih51
Submitted November 7, 2026 at 04:40PM by Mempodipper
via reddit https://ift.tt/FJBrVCn
shubs
unlocking any car from X brand in most of the world
I've always had a soft spot for this particular car brand. Our family has owned a few of them over the years, and they've served us incredibly well. In 2023, I bought a new four wheel drive/SUV from them, and it was the first time I had
I spent countless nights digging into PHP2Shell. Here's a deep dive into how it actually works, from memory to PHP internals to a real exploit.
https://ift.tt/EOmSJL4
Submitted November 8, 2026 at 06:30AM by djad04
via reddit https://ift.tt/sgX3C7Q
https://ift.tt/EOmSJL4
Submitted November 8, 2026 at 06:30AM by djad04
via reddit https://ift.tt/sgX3C7Q
djad04.github.io
PHP2Shell — Deep Dive
From memory visualization to PHP source internals to exploit code. How two CVEs chain an OOM crash into RCE.
ARTEX attack
https://ift.tt/fQuBsdT
Submitted November 8, 2026 at 07:01AM by Important_Market961
via reddit https://ift.tt/Qn1ohJT
https://ift.tt/fQuBsdT
Submitted November 8, 2026 at 07:01AM by Important_Market961
via reddit https://ift.tt/Qn1ohJT
Microsoft News
Threat actors use agentic AI tooling to find and abuse exposed secrets
Microsoft Threat Intelligence has observed threat actors using the agentic offensive security framework ARTEX to search GitHub for OAuth application secrets, which can be used to compromise the associated OAuth application and perform authenticated actions…
email encryption
https://ift.tt/pZ1Kh0G
Submitted November 8, 2026 at 09:30PM by fagnerbrack
via reddit https://ift.tt/iCqpf4T
https://ift.tt/pZ1Kh0G
Submitted November 8, 2026 at 09:30PM by fagnerbrack
via reddit https://ift.tt/iCqpf4T
Computers Are Bad
email encryption
Tricking Deepseek Into Not Hacking Your Website
https://ift.tt/HonRPLj
Submitted November 8, 2026 at 10:27PM by utku1337
via reddit https://ift.tt/eEdgQDf
https://ift.tt/HonRPLj
Submitted November 8, 2026 at 10:27PM by utku1337
via reddit https://ift.tt/eEdgQDf
Substack
Tricking Deepseek Into Not Hacking Your Website
Deepseek refuses to look for vulnerabilities on a website when it encounters forbidden strings in its HTML and JavaScript code.
Pwning Home Assistant Green: Pre-Auth RCE in Eclipse Mosquitto
https://ift.tt/nh9plIZ
Submitted November 8, 2026 at 10:28PM by parzel
via reddit https://ift.tt/B2q5YMK
https://ift.tt/nh9plIZ
Submitted November 8, 2026 at 10:28PM by parzel
via reddit https://ift.tt/B2q5YMK
born0monday
Pwning Home Assistant Green: Pre-Auth RCE in Eclipse Mosquitto
In this writeup I’m going to demonstrate that a seemingly benign bug in Eclipse Mosquitto, publicly disclosed back in August 2026 and still unpatched upstream, can in fact be exploited to gain unauthenticated (pre-auth) RCE. The GitHub issue1 incorrectly…
17 offensive AI packages defenders should watch, starting with PentAGI and Cairn
https://ift.tt/fAvzUnC
Submitted November 9, 2026 at 05:50AM by ryanmerket
via reddit https://ift.tt/cozlIvN
https://ift.tt/fAvzUnC
Submitted November 9, 2026 at 05:50AM by ryanmerket
via reddit https://ift.tt/cozlIvN
RuntimeWire
We put together a list of 18 offensive AI packages defenders should watch, starting with ARTEX, PentAGI and Cairn
Google and Mandiant observed PentAGI and Cairn in real intrusions since late August 2026. CyberStrike, the third framework on the list, was not named in the report.
A Boolean PII Flag Is Not Enough
https://ift.tt/uVZD5Cr
Submitted November 9, 2026 at 09:30AM by fagnerbrack
via reddit https://ift.tt/9mfCs4g
https://ift.tt/uVZD5Cr
Submitted November 9, 2026 at 09:30AM by fagnerbrack
via reddit https://ift.tt/9mfCs4g
kore-nordmann.de
A Boolean PII Flag Is Not Enough
Veteran CTO who built successful companies through empathic leadership and mastery of software delivery - from sustainable code to stakeholder trust. Now exploring the future of empathic and sustainable tech.
Behavioral LOLBins detection engine with sequential correlation, PE masquerading checks, and Sysmon integration
I built a behavioral detection engine focused on Living-off-the-Land binaries on Windows and wanted to share it with the community for feedback.Problem it tries to solve Traditional signature/hash-based detection struggles with LOLBins because they are legitimate, signed Microsoft binaries. Attackers also rename them, obfuscate command lines, and chain multiple utilities across time. Single-event rules often miss the broader operational context.What the tool doesCollects process telemetry (prefers Sysmon Event ID 1, falls back to psutil)Single-event behavioral rules for common LOLBins (certutil, bitsadmin, mshta, regsvr32, rundll32, powershell, wmic, etc.)Sequential multi-stage correlation (download → execute, LOLBin → encoded PowerShell, process cascades)Binary masquerading detection via PE OriginalFileNamePPID spoofing anomaly checksCommand-line obfuscation heuristics (carets, backticks, Base64 blocks, environment variable slicing)False-positive suppression + de-duplicationTimeline reconstruction (±5–10 min window) + process lineageLocal web dashboard for triageAutomated Markdown incident reports + webhook support (Slack/Discord/SIEM)Architecture highlightsModular pipeline: collector → correlation state machine → detection engine → timeline reconstructor → dispatcherRules can be written in YAML (declarative) or pure PythonBuilt-in threat emulation test harness (11 scenarios currently)Current limitationspsutil mode has polling latency (can miss very short-lived processes)Still user-mode only (no kernel/ETW consumer yet)Needs more real-world tuning of suppression rulesGitHub: https://github.com/nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-SystemWould love feedback on:Rule coverage / false positive rates you’ve seen with similar approachesMissing high-value sequential chainsWhether the dashboard and timeline reconstruction are useful in practiceAny other LOLBins or techniques I should prioritizeHappy to answer technical questions or discuss design decisions.
Submitted November 9, 2026 at 03:38PM by nimesh404
via reddit https://ift.tt/P5C1HUo
I built a behavioral detection engine focused on Living-off-the-Land binaries on Windows and wanted to share it with the community for feedback.Problem it tries to solve Traditional signature/hash-based detection struggles with LOLBins because they are legitimate, signed Microsoft binaries. Attackers also rename them, obfuscate command lines, and chain multiple utilities across time. Single-event rules often miss the broader operational context.What the tool doesCollects process telemetry (prefers Sysmon Event ID 1, falls back to psutil)Single-event behavioral rules for common LOLBins (certutil, bitsadmin, mshta, regsvr32, rundll32, powershell, wmic, etc.)Sequential multi-stage correlation (download → execute, LOLBin → encoded PowerShell, process cascades)Binary masquerading detection via PE OriginalFileNamePPID spoofing anomaly checksCommand-line obfuscation heuristics (carets, backticks, Base64 blocks, environment variable slicing)False-positive suppression + de-duplicationTimeline reconstruction (±5–10 min window) + process lineageLocal web dashboard for triageAutomated Markdown incident reports + webhook support (Slack/Discord/SIEM)Architecture highlightsModular pipeline: collector → correlation state machine → detection engine → timeline reconstructor → dispatcherRules can be written in YAML (declarative) or pure PythonBuilt-in threat emulation test harness (11 scenarios currently)Current limitationspsutil mode has polling latency (can miss very short-lived processes)Still user-mode only (no kernel/ETW consumer yet)Needs more real-world tuning of suppression rulesGitHub: https://github.com/nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-SystemWould love feedback on:Rule coverage / false positive rates you’ve seen with similar approachesMissing high-value sequential chainsWhether the dashboard and timeline reconstruction are useful in practiceAny other LOLBins or techniques I should prioritizeHappy to answer technical questions or discuss design decisions.
Submitted November 9, 2026 at 03:38PM by nimesh404
via reddit https://ift.tt/P5C1HUo
GitHub
GitHub - nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-System
Contribute to nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-System development by creating an account on GitHub.
Certificate authority list: every CA's incident record since 2017
https://ift.tt/03q859W
Submitted November 9, 2026 at 07:54PM by certkit
via reddit https://ift.tt/AK2enzW
https://ift.tt/03q859W
Submitted November 9, 2026 at 07:54PM by certkit
via reddit https://ift.tt/AK2enzW
CertKit SSL Certificate Management
Certificate authority list: every CA's incident record since 2017
Certificate authorities in Mozilla's CA program and their incident records since 2017: severity, certificates affected, size, and who found each one.
Lessons from 126 AWS Breach Investigations with Claude Code, Codex and Cursor
https://ift.tt/6zm3GRB
Submitted November 9, 2026 at 09:25PM by elitistAlmond
via reddit https://ift.tt/aEhBveC
https://ift.tt/6zm3GRB
Submitted November 9, 2026 at 09:25PM by elitistAlmond
via reddit https://ift.tt/aEhBveC
CloudAgent
CloudAgent: Lessons from 126 AWS Breach Investigations with Claude Code, Codex and Cursor
126 investigations across seven breached AWS environments: what Claude Code, Codex and Cursor found, missed and inferred, and how an incident-response runbook changed their work.
IP snowshoeing under US .gov email via a whitelisted AmazonSES typo in SPF
https://ift.tt/6ZXmuDf
Submitted November 9, 2026 at 11:11PM by PlasmaJam
via reddit https://ift.tt/GeYh1vp
https://ift.tt/6ZXmuDf
Submitted November 9, 2026 at 11:11PM by PlasmaJam
via reddit https://ift.tt/GeYh1vp
www.sh.consulting
Dangling DNS in 43 State & Local Gov Domains | SH Consulting
We scanned 25,964 US government domains: 43 have SPF, MX, NS or DMARC records that trust expired or typo domains. One typo authorizes 32,066 IPs.
N-able N-central Critical Vulnerabilities: What We Know So Far
https://ift.tt/W2yqCZX
Submitted November 9, 2026 at 11:24PM by ethicalhack3r
via reddit https://ift.tt/AwpJrmM
https://ift.tt/W2yqCZX
Submitted November 9, 2026 at 11:24PM by ethicalhack3r
via reddit https://ift.tt/AwpJrmM
Previdian
N-able N-central Critical Vulnerabilities: What We Know So Far
N-able has taken its hosted N-central classic environments offline following the public disclosure of critical vulnerabilities in N-central.
The company is also advising customers running on-premises N-central servers to take them offline until further notice…
The company is also advising customers running on-premises N-central servers to take them offline until further notice…
Electron, we have a problem
https://ift.tt/SFhNjbw
Submitted November 10, 2026 at 05:08PM by pascalschaerli
via reddit https://ift.tt/41aXndL
https://ift.tt/SFhNjbw
Submitted November 10, 2026 at 05:08PM by pascalschaerli
via reddit https://ift.tt/41aXndL
Pascal Schärli
Electron, we have a problem
Many Electron apps auto-update without verifying signatures. Many also still trust the compromised eMudhra certificates. Together, that lets an attacker on your network install malware on your machine.
Kubernetes Non-Core Security Audit
https://ift.tt/ZtmUseH
Submitted November 10, 2026 at 08:57PM by smaury
via reddit https://ift.tt/FYSBACn
https://ift.tt/ZtmUseH
Submitted November 10, 2026 at 08:57PM by smaury
via reddit https://ift.tt/FYSBACn
Shielder
Shielder - Kubernetes Non-Core Security Audit
Security audit of projects in the Kubernetes non-core ecosystem. Sponsored by the CNCF (Cloud Native Computing Foundation), facilitated by Open Source Technology Improvement Fund (OSTIF) and performed by Shielder.
Cracking Server 2022 NTLMv1-SSP Hashes with Rainbow Tables
https://ift.tt/3wrES59
Submitted November 11, 2026 at 01:23AM by elohhs
via reddit https://ift.tt/onlU6ys
https://ift.tt/3wrES59
Submitted November 11, 2026 at 01:23AM by elohhs
via reddit https://ift.tt/onlU6ys
hun.io
Cracking downgraded NTLMv1 SSP hashes with rainbow tables
It works with Windows Server 2022!
Supabase Security findings why RLS is only 25% of the issues
https://ift.tt/0o5GDyw
Submitted November 11, 2026 at 03:51AM by 1thirteenthirtyseven
via reddit https://ift.tt/LOFwxdK
https://ift.tt/0o5GDyw
Submitted November 11, 2026 at 03:51AM by 1thirteenthirtyseven
via reddit https://ift.tt/LOFwxdK
Oneleet
Supabase Security: Why RLS Is Only 25% of the Problem | Oneleet
Our research breakdown of the Supabase vulnerabilities we found across nearly 200 companies and how our ASM scanner detects them.
2.4% of AFRINIC’s IPv4 addresses answer from outside Africa, and about 81% of those sit in one company’s four blocks
https://ift.tt/eixYIcH
Submitted November 11, 2026 at 07:42PM by seremot
via reddit https://ift.tt/G7BwZx6
https://ift.tt/eixYIcH
Submitted November 11, 2026 at 07:42PM by seremot
via reddit https://ift.tt/G7BwZx6
ipinfo.io
One Company Accounts for 80% of AFRINIC's IP Addresses Being Used Outside Africa | IPinfo.io
IPinfo's WHEREIS research reveals where IP addresses are used outside their registered regions and why measurement-based geolocation matters.