ARTEX attack
https://ift.tt/fQuBsdT
Submitted November 8, 2026 at 07:01AM by Important_Market961
via reddit https://ift.tt/Qn1ohJT
https://ift.tt/fQuBsdT
Submitted November 8, 2026 at 07:01AM by Important_Market961
via reddit https://ift.tt/Qn1ohJT
Microsoft News
Threat actors use agentic AI tooling to find and abuse exposed secrets
Microsoft Threat Intelligence has observed threat actors using the agentic offensive security framework ARTEX to search GitHub for OAuth application secrets, which can be used to compromise the associated OAuth application and perform authenticated actions…
email encryption
https://ift.tt/pZ1Kh0G
Submitted November 8, 2026 at 09:30PM by fagnerbrack
via reddit https://ift.tt/iCqpf4T
https://ift.tt/pZ1Kh0G
Submitted November 8, 2026 at 09:30PM by fagnerbrack
via reddit https://ift.tt/iCqpf4T
Computers Are Bad
email encryption
Tricking Deepseek Into Not Hacking Your Website
https://ift.tt/HonRPLj
Submitted November 8, 2026 at 10:27PM by utku1337
via reddit https://ift.tt/eEdgQDf
https://ift.tt/HonRPLj
Submitted November 8, 2026 at 10:27PM by utku1337
via reddit https://ift.tt/eEdgQDf
Substack
Tricking Deepseek Into Not Hacking Your Website
Deepseek refuses to look for vulnerabilities on a website when it encounters forbidden strings in its HTML and JavaScript code.
Pwning Home Assistant Green: Pre-Auth RCE in Eclipse Mosquitto
https://ift.tt/nh9plIZ
Submitted November 8, 2026 at 10:28PM by parzel
via reddit https://ift.tt/B2q5YMK
https://ift.tt/nh9plIZ
Submitted November 8, 2026 at 10:28PM by parzel
via reddit https://ift.tt/B2q5YMK
born0monday
Pwning Home Assistant Green: Pre-Auth RCE in Eclipse Mosquitto
In this writeup I’m going to demonstrate that a seemingly benign bug in Eclipse Mosquitto, publicly disclosed back in August 2026 and still unpatched upstream, can in fact be exploited to gain unauthenticated (pre-auth) RCE. The GitHub issue1 incorrectly…
17 offensive AI packages defenders should watch, starting with PentAGI and Cairn
https://ift.tt/fAvzUnC
Submitted November 9, 2026 at 05:50AM by ryanmerket
via reddit https://ift.tt/cozlIvN
https://ift.tt/fAvzUnC
Submitted November 9, 2026 at 05:50AM by ryanmerket
via reddit https://ift.tt/cozlIvN
RuntimeWire
We put together a list of 18 offensive AI packages defenders should watch, starting with ARTEX, PentAGI and Cairn
Google and Mandiant observed PentAGI and Cairn in real intrusions since late August 2026. CyberStrike, the third framework on the list, was not named in the report.
A Boolean PII Flag Is Not Enough
https://ift.tt/uVZD5Cr
Submitted November 9, 2026 at 09:30AM by fagnerbrack
via reddit https://ift.tt/9mfCs4g
https://ift.tt/uVZD5Cr
Submitted November 9, 2026 at 09:30AM by fagnerbrack
via reddit https://ift.tt/9mfCs4g
kore-nordmann.de
A Boolean PII Flag Is Not Enough
Veteran CTO who built successful companies through empathic leadership and mastery of software delivery - from sustainable code to stakeholder trust. Now exploring the future of empathic and sustainable tech.
Behavioral LOLBins detection engine with sequential correlation, PE masquerading checks, and Sysmon integration
I built a behavioral detection engine focused on Living-off-the-Land binaries on Windows and wanted to share it with the community for feedback.Problem it tries to solve Traditional signature/hash-based detection struggles with LOLBins because they are legitimate, signed Microsoft binaries. Attackers also rename them, obfuscate command lines, and chain multiple utilities across time. Single-event rules often miss the broader operational context.What the tool doesCollects process telemetry (prefers Sysmon Event ID 1, falls back to psutil)Single-event behavioral rules for common LOLBins (certutil, bitsadmin, mshta, regsvr32, rundll32, powershell, wmic, etc.)Sequential multi-stage correlation (download → execute, LOLBin → encoded PowerShell, process cascades)Binary masquerading detection via PE OriginalFileNamePPID spoofing anomaly checksCommand-line obfuscation heuristics (carets, backticks, Base64 blocks, environment variable slicing)False-positive suppression + de-duplicationTimeline reconstruction (±5–10 min window) + process lineageLocal web dashboard for triageAutomated Markdown incident reports + webhook support (Slack/Discord/SIEM)Architecture highlightsModular pipeline: collector → correlation state machine → detection engine → timeline reconstructor → dispatcherRules can be written in YAML (declarative) or pure PythonBuilt-in threat emulation test harness (11 scenarios currently)Current limitationspsutil mode has polling latency (can miss very short-lived processes)Still user-mode only (no kernel/ETW consumer yet)Needs more real-world tuning of suppression rulesGitHub: https://github.com/nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-SystemWould love feedback on:Rule coverage / false positive rates you’ve seen with similar approachesMissing high-value sequential chainsWhether the dashboard and timeline reconstruction are useful in practiceAny other LOLBins or techniques I should prioritizeHappy to answer technical questions or discuss design decisions.
Submitted November 9, 2026 at 03:38PM by nimesh404
via reddit https://ift.tt/P5C1HUo
I built a behavioral detection engine focused on Living-off-the-Land binaries on Windows and wanted to share it with the community for feedback.Problem it tries to solve Traditional signature/hash-based detection struggles with LOLBins because they are legitimate, signed Microsoft binaries. Attackers also rename them, obfuscate command lines, and chain multiple utilities across time. Single-event rules often miss the broader operational context.What the tool doesCollects process telemetry (prefers Sysmon Event ID 1, falls back to psutil)Single-event behavioral rules for common LOLBins (certutil, bitsadmin, mshta, regsvr32, rundll32, powershell, wmic, etc.)Sequential multi-stage correlation (download → execute, LOLBin → encoded PowerShell, process cascades)Binary masquerading detection via PE OriginalFileNamePPID spoofing anomaly checksCommand-line obfuscation heuristics (carets, backticks, Base64 blocks, environment variable slicing)False-positive suppression + de-duplicationTimeline reconstruction (±5–10 min window) + process lineageLocal web dashboard for triageAutomated Markdown incident reports + webhook support (Slack/Discord/SIEM)Architecture highlightsModular pipeline: collector → correlation state machine → detection engine → timeline reconstructor → dispatcherRules can be written in YAML (declarative) or pure PythonBuilt-in threat emulation test harness (11 scenarios currently)Current limitationspsutil mode has polling latency (can miss very short-lived processes)Still user-mode only (no kernel/ETW consumer yet)Needs more real-world tuning of suppression rulesGitHub: https://github.com/nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-SystemWould love feedback on:Rule coverage / false positive rates you’ve seen with similar approachesMissing high-value sequential chainsWhether the dashboard and timeline reconstruction are useful in practiceAny other LOLBins or techniques I should prioritizeHappy to answer technical questions or discuss design decisions.
Submitted November 9, 2026 at 03:38PM by nimesh404
via reddit https://ift.tt/P5C1HUo
GitHub
GitHub - nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-System
Contribute to nimesh895/Behavioral-Living-off-the-Land-LOLBins-Detection-System development by creating an account on GitHub.
Certificate authority list: every CA's incident record since 2017
https://ift.tt/03q859W
Submitted November 9, 2026 at 07:54PM by certkit
via reddit https://ift.tt/AK2enzW
https://ift.tt/03q859W
Submitted November 9, 2026 at 07:54PM by certkit
via reddit https://ift.tt/AK2enzW
CertKit SSL Certificate Management
Certificate authority list: every CA's incident record since 2017
Certificate authorities in Mozilla's CA program and their incident records since 2017: severity, certificates affected, size, and who found each one.
Lessons from 126 AWS Breach Investigations with Claude Code, Codex and Cursor
https://ift.tt/6zm3GRB
Submitted November 9, 2026 at 09:25PM by elitistAlmond
via reddit https://ift.tt/aEhBveC
https://ift.tt/6zm3GRB
Submitted November 9, 2026 at 09:25PM by elitistAlmond
via reddit https://ift.tt/aEhBveC
CloudAgent
CloudAgent: Lessons from 126 AWS Breach Investigations with Claude Code, Codex and Cursor
126 investigations across seven breached AWS environments: what Claude Code, Codex and Cursor found, missed and inferred, and how an incident-response runbook changed their work.
IP snowshoeing under US .gov email via a whitelisted AmazonSES typo in SPF
https://ift.tt/6ZXmuDf
Submitted November 9, 2026 at 11:11PM by PlasmaJam
via reddit https://ift.tt/GeYh1vp
https://ift.tt/6ZXmuDf
Submitted November 9, 2026 at 11:11PM by PlasmaJam
via reddit https://ift.tt/GeYh1vp
www.sh.consulting
Dangling DNS in 43 State & Local Gov Domains | SH Consulting
We scanned 25,964 US government domains: 43 have SPF, MX, NS or DMARC records that trust expired or typo domains. One typo authorizes 32,066 IPs.
N-able N-central Critical Vulnerabilities: What We Know So Far
https://ift.tt/W2yqCZX
Submitted November 9, 2026 at 11:24PM by ethicalhack3r
via reddit https://ift.tt/AwpJrmM
https://ift.tt/W2yqCZX
Submitted November 9, 2026 at 11:24PM by ethicalhack3r
via reddit https://ift.tt/AwpJrmM
Previdian
N-able N-central Critical Vulnerabilities: What We Know So Far
N-able has taken its hosted N-central classic environments offline following the public disclosure of critical vulnerabilities in N-central.
The company is also advising customers running on-premises N-central servers to take them offline until further notice…
The company is also advising customers running on-premises N-central servers to take them offline until further notice…
Electron, we have a problem
https://ift.tt/SFhNjbw
Submitted November 10, 2026 at 05:08PM by pascalschaerli
via reddit https://ift.tt/41aXndL
https://ift.tt/SFhNjbw
Submitted November 10, 2026 at 05:08PM by pascalschaerli
via reddit https://ift.tt/41aXndL
Pascal Schärli
Electron, we have a problem
Many Electron apps auto-update without verifying signatures. Many also still trust the compromised eMudhra certificates. Together, that lets an attacker on your network install malware on your machine.
Kubernetes Non-Core Security Audit
https://ift.tt/ZtmUseH
Submitted November 10, 2026 at 08:57PM by smaury
via reddit https://ift.tt/FYSBACn
https://ift.tt/ZtmUseH
Submitted November 10, 2026 at 08:57PM by smaury
via reddit https://ift.tt/FYSBACn
Shielder
Shielder - Kubernetes Non-Core Security Audit
Security audit of projects in the Kubernetes non-core ecosystem. Sponsored by the CNCF (Cloud Native Computing Foundation), facilitated by Open Source Technology Improvement Fund (OSTIF) and performed by Shielder.
Cracking Server 2022 NTLMv1-SSP Hashes with Rainbow Tables
https://ift.tt/3wrES59
Submitted November 11, 2026 at 01:23AM by elohhs
via reddit https://ift.tt/onlU6ys
https://ift.tt/3wrES59
Submitted November 11, 2026 at 01:23AM by elohhs
via reddit https://ift.tt/onlU6ys
hun.io
Cracking downgraded NTLMv1 SSP hashes with rainbow tables
It works with Windows Server 2022!
Supabase Security findings why RLS is only 25% of the issues
https://ift.tt/0o5GDyw
Submitted November 11, 2026 at 03:51AM by 1thirteenthirtyseven
via reddit https://ift.tt/LOFwxdK
https://ift.tt/0o5GDyw
Submitted November 11, 2026 at 03:51AM by 1thirteenthirtyseven
via reddit https://ift.tt/LOFwxdK
Oneleet
Supabase Security: Why RLS Is Only 25% of the Problem | Oneleet
Our research breakdown of the Supabase vulnerabilities we found across nearly 200 companies and how our ASM scanner detects them.
2.4% of AFRINIC’s IPv4 addresses answer from outside Africa, and about 81% of those sit in one company’s four blocks
https://ift.tt/eixYIcH
Submitted November 11, 2026 at 07:42PM by seremot
via reddit https://ift.tt/G7BwZx6
https://ift.tt/eixYIcH
Submitted November 11, 2026 at 07:42PM by seremot
via reddit https://ift.tt/G7BwZx6
ipinfo.io
One Company Accounts for 80% of AFRINIC's IP Addresses Being Used Outside Africa | IPinfo.io
IPinfo's WHEREIS research reveals where IP addresses are used outside their registered regions and why measurement-based geolocation matters.
ScriptBlock Smuggling - AMSI Evasion
https://ift.tt/8MZew4l
Submitted November 11, 2026 at 08:03PM by netbiosX
via reddit https://ift.tt/yaTojFP
https://ift.tt/8MZew4l
Submitted November 11, 2026 at 08:03PM by netbiosX
via reddit https://ift.tt/yaTojFP
Purple Team
ScriptBlock Smuggling
ScriptBlock Smuggling is a PowerShell evasion technique that creates a mismatch between the script text presented to security controls and the instructions actually executed. A threat actor can man…
Qlik Sense Servers Hit With PowerShell Reverse Shells; Attacker Server Holds ActiveMQ and Veeam Exploits
https://ift.tt/BAdZTUa
Submitted November 11, 2026 at 08:25PM by Much-Television-9449
via reddit https://ift.tt/5uPO3lQ
https://ift.tt/BAdZTUa
Submitted November 11, 2026 at 08:25PM by Much-Television-9449
via reddit https://ift.tt/5uPO3lQ
KYLES INVESTIGATION
Qlik Sense Servers Hit With PowerShell Reverse Shells; Attacker Server Holds ActiveMQ and Veeam Exploits - Nationwide Private Investigator…
By Mark Kyle November 11, 2026 Security firm Cynet has reported attempts to run PowerShell reverse shells on Qlik Sense servers at several European organizations. The attempts were blocked, but the attacker’s infrastructure contained tooling for other enterprise…
Hide and Stream: Ambient Aircraft-DopplerGeolocation of Live Audio, and a Defense
https://ift.tt/8CEH0Ly
Submitted November 11, 2026 at 08:45PM by lymn
via reddit https://ift.tt/Cevt145
https://ift.tt/8CEH0Ly
Submitted November 11, 2026 at 08:45PM by lymn
via reddit https://ift.tt/Cevt145
History of Password Cracking
https://ift.tt/DzZMsc9
Submitted November 12, 2026 at 06:32AM by netmux
via reddit https://ift.tt/ji4hSQU
https://ift.tt/DzZMsc9
Submitted November 12, 2026 at 06:32AM by netmux
via reddit https://ift.tt/ji4hSQU
Netmux
History of Password Cracking — netmux
How we defended against an AI-driven ARTEX attack
https://ift.tt/DrQM5yW
Submitted November 12, 2026 at 07:06PM by Far_Ice2481
via reddit https://ift.tt/8Fyzpag
https://ift.tt/DrQM5yW
Submitted November 12, 2026 at 07:06PM by Far_Ice2481
via reddit https://ift.tt/8Fyzpag
Eye Research
Machine speed: how we defended against an AI-driven attack
Inside an incident response against an AI-driven attack: how fast the attacker's agents adapted, and how we used AI agents of our own to fight back.