Security News

Morningstar Security News gathers all the most popular infosec and cyber security news headlines into a single page that auto-updates 24/7.

Most Popular

Exploits

Bug Bounties

Vulnerabilities

Tools

Exploit Dev

Reversing/I like ASM

Malware/APT

Crypto

Podcasts

Threat Intel

Privacy/VPNs

Help Wanted

Locks/Social Engineering

Security Blogs

Mainstream Media

Thirsty for more

Security Twitterverse

PacketStorm
CISA Director Jen Easterly To Step Down Jan. 20 new
Equinox Notifies 21,000 Patients And Staff Of Data Theft new
D-Link Tells Users To Trash Old VPN Routers Due To Bug new
Helldown Ransomware Evolves To Target VMware Systems Via Linux new
Apple Confirms Zero Day Attacks Hitting macOS Systems new
Oracle Patches Exploited Agile PLM Zero-Day new
Bitcoin Bursts Past $94,000 For The First Time new
Palo Alto Sounds Alarm Over PAN-OS Zero Day Attacks
Crooks Snag $250k Wire Payment From AI Biz
US Senate To Hold Panel Hearing On Suspected Chinese Hacking Incidents
Thousands Of IoT Devices Turned Into Residential Proxies
Discontinued GeoVision Products Targeted In Botnet Attacks
The Register
Five Scattered Spider suspects indicted for phishing spree and crypto heists new
Chinese cyberspies, Musk’s Beijing ties, labelled ‘real risk’ to US security by senator new
Mega US healthcare payments network restores system 9 months after ransomware attack new
Google's AI bug hunters sniff out two dozen-plus code gremlins that humans missed new
D-Link tells users to trash old VPN routers over bug too dangerous to identify new
Data is the new uranium – incredibly powerful and amazingly dangerous new
Healthcare org Equinox notifies 21K patients and staff of data theft
China-linked group abuses Fortinet 0-day with post-exploit VPN-credential stealer
Russian suspected Phobos ransomware admin extradited to US over $16M extortion
America's drinking water systems have a hard-to-swallow cybersecurity problem
Palo Alto Networks tackles firewall-busting zero-days with critical patches
Navigating third-party risks
Reddit - NetSec
Spelunking in Comments and Documentation for Security Footguns - Include Security Research Blog new
Azure CloudQuarry: Searching for secrets in Public VM Images new
Wormable XSS www.bing.com new
Remediation for CVE-2024-20767 and CVE-2024-21216 Potential Exploitable Bugs
Extracting Plaintext Credentials from Palo Alto Global Protect
Pots and Pans, AKA an SSLVPN - Palo Alto PAN-OS CVE-2024-0012 and CVE-2024-9474 - watchTowr Labs
OpenBMC Remote OS Deployment: A Simplified Approach
Salamander/MIME – Just because it's encrypted doesn't mean it's secure | Lutra Security
Exploring the DOMPurify library: Bypasses and Fixes
🌪️Heads up trainers: TyphoonCon 2025 Call for Training is now open!
Unpatched Remote Code Execution in Gogs
Open-Source PowerHuntShares.v2 - Find Shares, Extract Passwords, and Fingerprint with LLM
Bleeping Computer
The Hacker News
Ghost Tap: Hackers Exploiting NFCGate to Steal Funds via Mobile Payments new
NHIs Are the Future of Cybersecurity: Meet NHIDR new
Decades-Old Security Vulnerabilities Found in Ubuntu's Needrestart Package new
Microsoft Launches Windows Resiliency Initiative to Boost Security and System Integrity new
China-Backed Hackers Leverage SIGTRAN, GSM Protocols to Infiltrate Telecom Networks new
Apple Releases Urgent Updates to Patch Actively Exploited Zero-Day Vulnerabilities
Oracle Warns of Agile PLM Vulnerability Currently Under Active Exploitation
Ngioweb Botnet Fuels NSOCKS Residential Proxy Network Exploiting IoT Devices
Hackers Hijack Unsecured Jupyter Notebooks to Stream Illegal Sports Broadcasts
Privileged Accounts, Hidden Threats: Why Privileged Access Security Must Be a Top Priority
New 'Helldown' Ransomware Variant Expands Attacks to VMware and Linux Systems
Chinese Hackers Exploit T-Mobile and Other U.S. Telecoms in Broader Espionage Campaign

Threat Wire

Exploits

LiveOverflow

Bug Bounties

HackerOne Blog
How HackerOne Employees Stay Connected and Have Fun
How REI Strengthens Security with HackerOne’s Global Security Researcher Community
Flexible Data Retrieval at Scale with HAQL
AI in SecOps: How AI is Impacting Red and Blue Team Operations
HackerOne’s Fall Day of Service
How HackerOne Disproved an MFA Bypass With a Spot Check
Unlocking Engagement with Employee Feedback
How an Improper Access Control Vulnerability Led to Account Theft in One Click
How an Information Disclosure Vulnerability Led to Critical Data Exposure
How a Cross-Site Scripting Vulnerability Led to Account Takeover
How a Business Logic Vulnerability Led to Unlimited Discount Redemption
Who Should Own AI Risk at Your Organization?
Reddit - BugBounty
Possible Account Takeover Vulnerability After Unlinking Google Account new
How to tell if something is a vulnerability or not? 🤔 new
look for bug bounty hunters new
CEH vs MCA(CS) new
out of scope bug bounty
Contentful access token
Can I make bug bounty with only 1 vulnerability?
【Vulnerability Campaign】Earn Your Thanksgiving Bonus Rebate
Anyone ever have luck with an appeal? No Apple bounty payment despite clearly aligning to a published category.
Should I study about all the vulnerabilities then start hunting OR Study one by one vulnerability master it and hunt along the way?
Picking a niche in bug bounty and random advice.
Pentester Land
Portswigger
Take control of your security posture: The Burp Suite Enterprise Edition winter update
API Security: The 6 biggest challenges AppSec teams face, and how to solve them.
Introducing Burp Suite’s game-changing performance update ⚡🏎️
Burp Suite Performance Improvements
Performance Improvements to table sorting and Repeater
Try it for yourself: the latest PortSwigger Research from Black Hat USA
HackerOne Hacktivity

Vulnerabilities

Tools

Exploit Dev

Reversing/I like ASM

Reddit - Reverse Engineering
Why is Apple’s Rosetta 2 so fast?
/r/ReverseEngineering's Weekly Questions Thread
Reverse Engineering iOS 18 Inactivity Reboot
Need help cracking an old program
Reverse engineering a trojan Telegram clone
Using HxD? Try out my new hex editor software optimize for hex file formats.
APK Reverse Eng. Library Puts some Data to Jpeg
Fault Injection - Down the Rabbit Hole
Everyday Ghidra: Ghidra Data Types— When to Create Custom GDTs — Part 1
Finding Exploits in Video Games
Frida Simple GUI - made in python.
Reversing the Parrot Anafi drone and start/land it using a PC
Reddit - Game Hacks
Hydra Solutions | BO6 CHAIR | BOT LOBBY | BO6 COMMUNITY | COD POINTS | BO6 UNLOCKER | LEGIT SERVICES new
BO6 & MW3 UNDETECTED UNLOCK ALL TOOL | PERMA UAV TOOL | AIMBOT,WALLS CHEATS | BOT LOBBIES
Elocarry | 💎Call of Duty: Black Ops 6 + WZ | LEGIT CHEAT | AIMBOT | ESP |🔒UD
BO6 & MW3 UNDETECTED UNLOCK ALL TOOL | PERMA UAV TOOL | AIMBOT,WALLS CHEATS | BOT LOBBIES
Bo6 bot lobby’s and unlock all
BO6 & MW3 UNDETECTED UNLOCK ALL TOOL | PERMA UAV TOOL | AIMBOT,WALLS CHEATS | BOT LOBBIES
AIMEX CHEATS COD BLACK OPS 6 / WARZONE CHEAT | Aimbot | ESP | Radar | Undetected + Streamproof
anyone out there that wouldn’t mind hosting bot lobbies or letting me join up for free
Bot lobby’s bo6
Steam in-game purchases hack
Cheap bo6 boosting lobby’s
good sites/apps to download cheats ?
Reddit - REGames
StackExchange - ReverseEngineering
How is this adversarial process crashing Wireshark?
Reconstructing Source Code for a scratch-built GIS system
What is the Win32 function that displays Microsoft "Pick an account" popup window?
Modifying CreationFlags in CreateProcessA with OllyDBG2 with CREATE_SUSPENDED
Help Identifying Connection Type for YIHUA TFT 10-pin Display (1.75 inch, FPC Connector)
Is there any to know how an android app collects or track device data?
Router Firmware Reverse Engineering
How to get the list of application-defined hooks currently installed by running processes in windows?
What old video game reverse engineering communities or forums are still up?
QR-like color image
Decrypt PPPoE password of Huawei ONT EG8245H5
setup Ida/x64dbg

Guided Hacking

Malware/APT

Reddit - Malware
methods for creating variants of malware embedded in pdf files new
Fileless malware attack leveraging PowerShell new
New Frostygoop (BUSTLEBERM) Indicators of Compromise
Requesting analysis of a Mediafire suspicious file potentially containing Vidar Stealer
Looking for a malware dataset released by China
Malware Development Resources
Emmenhtal loader uses LOLBAS to deliver malware
VEILDrive Uncovered: Attackers Exploit Microsoft OneDrive & Teams with Java Malware that Slips Past Top EDRs
The Role of Cyber Warfare in Shaping Middle Eastern Alliances
Trackers
Assistance Needed For Triage API Access
Uncover it: Popular malware config extractor
Unit42
Threat Brief: Operation Lunar Peek, Activity Related to CVE-2024-0012 and CVE-2024-9474 (Updated Nov. 20) new
Threat Assessment: Ignoble Scorpius, Distributors of BlackSuit Ransomware new
FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications
Fake North Korean IT Worker Linked to BeaverTail Video Conference App Phishing Attack
Global Companies Are Unknowingly Paying North Koreans: Here’s How to Catch Them
ModeLeak: Privilege Escalation to LLM Model Exfiltration in Vertex AI
Silent Skimmer Gets Loud (Again)
Automatically Detecting DNS Hijacking in Passive DNS
TA Phone Home: EDR Evasion Testing Reveals Extortion Actor's Toolkit
Jumpy Pisces Engages in Play Ransomware
Deceptive Delight: Jailbreak LLMs Through Camouflage and Distraction
Gatekeeper Bypass: Uncovering Weaknesses in a macOS Security Mechanism

Crypto

Seytonic

Podcasts

Security Weekly
No CVE and No Accountability - Ed Skoudis - PSW #851
Cybersecurity For Schools - Kayne McGladrey - PSW #850
Shadow IT and Security Debt - Dave Lewis - PSW #849
Secure By Default - How do we get there? - Andy Syrewicze - PSW #848
Effective Operational Outcomes - Ken Dunham - PSW #847
The Code of Honor: Embracing Ethics in Cybersecurity - Ed Skoudis - PSW #846
Analyzing Malware at Scale - John Hammond - PSW #845
AI in Cyber & Addressing Analyst Burnout - Kayla Williams - PSW #844
Exploding Pagers - Tod Beardsley - PSW #843
Recent Cyber Security Laws & Regulations - Lee Kim - PSW #842
Hacker Heroes - Mark Loveless - PSW Vault
Building AI BOMs - Helen Oakley - PSW #841
Risky.Biz
Risky Business #771 -- Palo Alto's firewall 0days are very, very stupid
Risky Business #770 -- A Russian IR guy discovers extremely cool spookware
Risky Biz Soap Box: Why black box email security is dead
Risky Business #769 -- Sophos drops implants on Chinese exploit devs
Risky Business #768 -- CSRB will investigate China's Wiretap Hacks
Risky Biz Soap Box: Thinkst Canary's decade of deception
Risky Business #767 – SEC fines Check Point, Mimecast, Avaya and Unisys over hacks
Risky Business #766 – China hacks America's lawful intercept systems
Snake Oilers: Sandfly Security, Permiso and Wiz
Risky Business #765 -- The Kaspersky switcheroo
Risky Business #764 -- Mossad expands into telecommunications services
Risky Business #763 – Microsoft un-patches critical bug
The CyberWire
When location data becomes a weapon. new
Biden vs. Trump: A tale of two cybersecurity strategies.
A new era for CISA under Trump?
Cyber-entrepreneurship in the age of CyberAI. [CSO Perspectives]
Teresa Shea: The challenge of adapting new technologies. [Intelligence] [Career Notes]
Credential harvesters in the cloud. [Research Saturday]
One tap, total access: Pegasus exploits unveiled.
Eavesdropping on America’s eyes and ears.
‘Bitcoin Jesus’ and Sheboygan face problems.
Ransomware as a public health crisis.
Veterans Day Special. [CSO Perspectives]
Solution Spotlight: Rebuilding trust in the wake of tech calamities. [Special Edition]
Cyber Security Interviews
ISC Daily Stormcast
ISC StormCast for Wednesday, November 20th, 2024
ISC StormCast for Tuesday, November 19th, 2024
ISC StormCast for Monday, November 18th, 2024
ISC StormCast for Wednesday, November 13th, 2024
ISC StormCast for Tuesday, November 12th, 2024
ISC StormCast for Monday, November 11th, 2024
ISC StormCast for Friday, November 8th, 2024
Darknet Diaries
151: Chris Rock
150: mobman 2
149: Mini-Stories: Vol 3

Threat Intel

Privacy/VPNs

Slashdot - Rights
US Regulators Seek To Break Up Google, Forcing Chrome Sale new
Z-Library Helps Students to Overcome Academic Poverty, Study Finds new
Strava Closes the Gates To Sharing Fitness Data With Other Apps new
Half of Young Norwegians Justify Piracy as Streaming Costs Soar new
The US Patent and Trademark Office Banned Staff From Using Generative AI
Indian News Agency Sues OpenAI Alleging Copyright Infringement
DOJ Wants Google To Sell Chrome To Break Search Monopoly
India Orders Meta To Curb WhatsApp Data Sharing
Belgian Region Trials Web Founder's Data Privacy System
What Happened When a Washington County Tried a 32-Hour Workweek?
New Pentagon Report on UFOs: Hundreds of New Incidents, No Evidence of Aliens
NSO, Not Government Clients, Operates Its Spyware
Reddit - Privacy
Account privacy. new
Turns out I HAVE been pwned, what now? new
The CIA, NSA, and Pokémon Go new
Is there a way to remove Twitter URLs/photos off Wayback Machine? new
Fake Online Reviews Removal new
Sophos Installed Monitoring Software on Customers' Systems new
How Google Spent 15 Years Concealing Its Internal Conversations new
Inside Clear’s ambitions to manage your identity beyond the airport new
Surf bot to generate junk data as a way to disguise online presence? new
Can MS read Word documents that we don't upload to OneDrive? new
What Is Browser Fingerprinting? Here’s Everything You Need to Know
Apple Further Expanding Into Ads, Now Directly Selling Ads in News App
Reddit - VPN
"error calling protect () method on socket" new
Hi, have any of you figured out what you are going to do about this? new
Does Lockdown Browser turn off my VPN?
how does a vpn hotspot work
Sorry if this is stupid, looking for guidance on vpn. Do I need virus protection etc ?
Does this mean my VPN is leaking?
Is Android OS IKEv2 more power efficient than userspace WireGuard?
PrivacyTools.io
EFF
Oppose The Patent-Troll-Friendly PREVAIL Act new
The U.S. National Security State is Here to Make AI Even Less Transparent and Accountable
Now's The Time to Start (or Renew) a Pledge for EFF Through the CFC
Speaking Freely: Marjorie Heins
On Alaa Abd El Fattah’s 43rd Birthday, the Fight For His Release Continues
"Why Is It So Expensive To Repair My Devices?"
EFF Is Ready for What's Next | EFFector 36.14
Tell Congress To Stop These Last-Minute Bills That Help Patent Trolls
Speaking Freely: Tanka Aryal
Creators of This Police Location Tracking Tool Aren't Vetting Buyers. Here's How To Protect Yourself
Celebrating the Life of Aaron Swartz: Aaron Swartz Day 2024
EFF to Second Circuit: Electronic Device Searches at the Border Require a Warrant

Help Wanted

Reddit - AskNetSec
Need advice about how to securely store SSH keys in SQL db new
Dev culture: "We're going to add the security later"
Are there some "easy" ways to spot if you're being hacked on windows 10 ?
How does TLS work?
P2P Zero trust VPN or SASE?
What projects should I put in my cybersecurity portfolio?
Adopted Security policies and processes?
Reddit - Netsec Students
GitHub Security Checklist: 9 Must-Follow Best Practices
WinRM Access Issue: Unable to Use Valid Credentials for Domain Users on Target Machine
Stackoverflow - Security
How to Handle Sensitive Data (API Keys, Database IDs) Accidentally Pushed to GitHub? new
How do you share environment variables for multiple stages with your team in a local development environment? new
How to become certified ethical hacker [closed] new
OpenLiberty Authentication: Adding roles to Principal new
Why Should I Continue Studying Buffer Overflow Vulnerabilities in the Context of Modern Protections? [closed]
API REST C# Security [closed]
How to Add Authorization Header for API Scanning in OWASP ZAP with OpenAPI?
Is there a way to generate the authorization url for the importdata function to run?
How to Remove SHA-1 Signature Support to connect SFTP Client in .NET applications [duplicate]
Correct way to handle Cors origin: Null
Remove SHA-1 Signature Support from SFTP Client .NET application [closed]
Strict Transport Security Not Enforced fixed in IIS but still insecure
Stack Exchange
Who is required to register for PF? new
Bearer token in header as Basic token? - Does that violate the RFC6749 spec? new
HSM for Secure Encrypted Data Storage new
Combination user:pass using Hydra new
Browser- side caching of encrypted sensitive informations in sessionStorage? new
Tab opening and quickly closing every time I launch Chrome browser [closed] new
Should I Continue Studying Buffer Overflow Vulnerabilities?
Why does iOS require my passcode before performing a system update? [closed]
Boot Recovery Mode W Backdoor Networking Roku Tv [closed]
Image loaded despite Cross-Origin-Embedder-Policy: require-corp
How to evaluate security of non-standard challenge response implementation?
Automated auditing of device image based on CIS Hardening Image Benchmark

Locks/Social Engineering

Reddit - Lockpicking
Toolbox Talk: Lock warding and pick selection new
Good beginners set? new
44 delta new
Love those Dom magic drivers! Dom Plura pick and gut. new
Jimmy Longs!!! First impressions. new
Working through Medeco M3 new
Advise for newbie new
Following Up on the Jimylongs Color Tags + 44 Delta has its own YT channel for this stuff now new
Medium hook partial tang custom pick, made with LLT HY 301 SS, brass tube pins and a polished Padauk handle ☝🏻😎 new
Medium hook partial tang custom pick, made with LLT HY 301 SS, brass tube pins and a polished Padauk handle ☝🏻😎 new
Abus Bravus 3000 new
Union 2101 Picked new
Reddit - Social Engineering
has anyone done Chris Hadnagy's online courses? new
Should online elicitation be done differently than offline elicitation ?
Could AI language model be used to teach social engineering?
How do you establish long-term relations with people? How to pretend to care about others?
How would a good democrat combat Trump?
Type A personalities
Podcasts on Social Engineering?
What are some hacks people taught you like "wait a day before responding to someone who send an angry email, they will forget and get…
How do socially successful people actually MAKE friends?
I chose to become friends with an ideologically radical authoritarian over a year ago in hopes of deradicalizing them; here are the results
Old age and deceit
How do you deal with aggressive entitled narcissists who stop at nothing, and the law does nothing?

Hak5

Security Blogs

Security Bloggers Network
Sentient IAM: Unlocking Success Through Human-Centric Leadership new
Respond to Fewer Alerts with Automated Grouping new
Build Confidence with Robust Machine Identity Solutions new
DEF CON 32 – A Treasure Trove of Failures: What History’s Greatest Heist Can Teach Us About Defense In Depth new
How to Move from Manual to Certificate Automation with ACME new
How to Motivate Employees and Stakeholders to Encourage a Culture of Cybersecurity new
Microsoft Adds Raft of Zero-Trust Tools and Platforms new
Securing the Software Supply Chain: Checkmarx One Expands its Offerings new
Shift Left and Shift Up Workload Attack Surface Protection new
Empower Your Security with Advanced IAM Features new
Randall Munroe’s XKCD ‘Kedging Cannon’ new
Azure Key Vault Tradecraft with BARK new
Rapid7
Multiple Vulnerabilities in Wowza Streaming Engine (Fixed) new
Rapid7 Extends AWS Support to Include Coverage for Newly-Launched Resource Control Policies (RCPs) new
Rapid7 Recognized for ‘Excellence in Workplace Health and Wellbeing’ at the Belfast Telegraph IT Awards
Accelerate Mean Time to Exposure Remediation Across Hybrid Environments with Remediation Hub
Unlock 24/7 SOC Coverage: Rapid7 MXDR Now Supports with Microsoft Security Products
Metasploit Weekly Wrap-Up: 11/15/2024
New IDR Log Search Enhancements: Accelerate, Streamline, and Simplify Investigations
Zero-Day Exploitation Targeting Palo Alto Networks Firewall Management Interfaces
Patch Tuesday - November 2024
LodaRAT: Established malware, new victim patterns
Metasploit Wrap-Up: 11/08/2024
Mind the Gap: How Surface Command Tackles Asset Visibility in Attack Surface Management
ThreatPost
Hacker News (YCombinator) - Security
Show HN: We Open-Sourced Our Compost Monitoring Tech – Use It for Your Projects new
Show HN: We open-sourced our compost monitoring tech new
Show HN: Shop on Amazon with Crypto new
Google stops letting sites like Forbes rule search for "Best CBD Gummies" new
With Core One, Prusa's Open Source Hardware Dream Dies new
Ghost Tap: New cash-out tactic with NFC Relay new
Apple Confirms Zero-Day Attacks Hitting macOS Systems
Tech-vexed: how digital life threatens our capacity for awe
Paged Out #5 – hacker zine release [pdf]
Hong Kong Jails Benny Tai for 10 Years in Longest Security Law Sentence
DNA testing company vanishes along with its customers' genetic data
Drinking water systems for 26M Americans face high cybersecurity risks
digitalmunition
Hacker Noon #Security
The Power of AI-Driven Proxy Management new
AIntivirus Announces Initiative Inspired By The Legacy Of John McAfee new
AI Platform bitGPT Experiences Significant Growth Following Binance Demonstration new
IMF Warns: CBDCs Could Enable State Surveillance Through Personal Data and Behavioral Insights new
Can Claude AI Solve Alexa’s Data Privacy Issues? new
Fhenix Enhances Blockchain Privacy with New Testnet Release new
Degate Launches Cross-Chain Intent Trading: Trade Tokens Across Blockchains Seamlessly new
The TechBeat: Towards Glory: Lumoz OG NFT Event is Now Live! (11/20/2024) new
AnimateDiff Ethics Statement: Ensuring Responsible Use of Generative AI for Animation
Mizzle Partners with InFlux Technologies to Power DePIN Platform
MathNodes Launches Meile v2.0, Latest Core Update for Decentralized VPN Built on Sentinel Network
Trader Loses $26M in ezETH Tokens: Media Blames User, Hacker Calls Out ERC-20 Flaws
Wired - Security
Inside the Booming ‘AI Pimping’ Industry new
Anyone Can Buy Data Tracking US Soldiers and Spies to Nuclear Vaults and Brothels in Germany
Immigration Police Can Already Sidestep US Sanctuary City Laws Using Data-Sharing Fusion Centers
Bitfinex Hacker Gets 5 Years for $10 Billion Bitcoin Heist
More Spyware, Fewer Rules: What Trump’s Return Means for US Cybersecurity
Teen Behind Hundreds of Swatting Attacks Pleads Guilty to Federal Charges
These Guys Hacked AirPods to Give Their Grandmas Hearing Aids
ICE Started Ramping Up Its Surveillance Arsenal Immediately After Donald Trump Won
The WIRED Guide to Protecting Yourself From Government Surveillance
The Real Problem With Banning Masks at Protests
The AI Machine Gun of the Future Is Already Here
Auto-Rebooting iPhones Are Causing Chaos for Cops
Control C
Krebs on Security
Fintech Giant Finastra Investigating Data Breach
An Interview With the Target & Home Depot Hacker
Microsoft Patch Tuesday, November 2024 Edition
FBI: Spike in Hacked Police Emails, Fake Subpoenas
Canadian Man Arrested in Snowflake Data Extortions
Booking.com Phishers May Leave You With Reservations
Change Healthcare Breach Hits 100M Americans
The Global Surveillance Free-for-All in Mobile Ad Data
Brazil Arrests ‘USDoD,’ Hacker in FBI Infragard Breach
Sudanese Brothers Arrested in ‘AnonSudan’ Takedown
Lamborghini Carjackers Lured by $243M Cyberheist
Patch Tuesday, October 2024 Edition
Elttam
Abusing Amazon VPC CNI plugin for Kubernetes
PwnAssistant - Controlling /home’s via a Home Assistant RCE
Naked Security
Sophos MDR blocks and tracks activity from probable Iranian state actor “MuddyWater” new
November Patch Tuesday loads up everyone’s plate
VEEAM exploit seen used again with a new ransomware: “Frag”
Bengal cat lovers in Australia get psspsspss’d in Google-driven Gootloader campaign
Pacific Rim: Inside the Counter-Offensive—The TTPs Used to Neutralize China-Based Threats
From the frontlines: Our CISO’s view of Pacific Rim
Pacific Rim: What’s it to you?
Pacific Rim: Learning to eat soup with a knife
Digital Detritus: The engine of Pacific Rim and a call to the industry for action
Pacific Rim timeline: Information for defenders from a braid of interlocking attack campaigns
Sophos Firewall hardening best practices
SophosAI team presents three papers on AI applied to cybersecurity at CAMLIS
Schneier on Security
Steve Bellovin’s Retirement Talk new
Why Italy Sells So Much Spyware
Most of 2023’s Top Exploited Vulnerabilities Were Zero-Days
Friday Squid Blogging: Female Gonatus Onyx Squid Carrying Her Eggs
Good Essay on the History of Bad Password Policies
New iOS Security Feature Makes It Harder for Police to Unlock Seized Phones
Mapping License Plate Scanners in the US
Criminals Exploiting FBI Emergency Data Requests
Friday Squid Blogging: Squid-A-Rama in Des Moines
AI Industry is Trying to Subvert the Definition of “Open Source AI”
Prompt Injection Defenses Against LLM Cyberattacks
Subverting LLM Coders
Linux Security
AlmaLinux 9.5 Released: Exploring Key Updates & Improvements new
Analyzing the Emergence of Helldown Ransomware Targeting Linux & VMware Systems new
Critical Flaw Found in Samba Active Directory Implementations: Understanding Its Impact & Mitigation
AMD ERAPS: A New Era for Zen 5 Performance and Security
SUSEs Strategic Shift: New AI-Powered Data Protection and Comprehensive Rebranding
Evaluating TPM Bus Encryption and Integrity Protection: Pros, Cons, and Opting Out in Linux 6.12
The Dual Edge of Open Source: Examining Key Benefits and Security Challenges
OpenShift 4.17: Revolutionizing Kubernetes for AI, Edge, and Security
Red Hat Enterprise Linux 9.5: Addressing Modern IT Challenges with Enhanced Security and Automation
Intel's November Update Patches Two Fresh CPU Security Flaws
A Focus on Linux Vulnerabilities Over Time and Ways to Safeguard Linux-Based Networks from Exploits
Chrome 131 Released: Major Update Fixes 12 Significant Vulnerabilities
Dark Reading
It's Near-Unanimous: AI, ML Make the SOC Better new
China's 'Liminal Panda' APT Attacks Telcos, Steals Phone Data new
Apple Urgently Patches Actively Exploited Zero-Days new
Small US Cyber Agencies Are Underfunded & That's a Problem new
'Water Barghest' Sells Hijacked IoT Devices for Proxy Botnet Misuse new
African Reliance on Foreign Suppliers Boosts Insecurity Concerns new
SWEEPS Educational Initiative Offers Application Security Training
Linux Variant of Helldown Ransomware Targets VMware ESXi Systems
We Can Do Better Than Free Credit Monitoring After a Breach
Security Industry Association Announces SIA RISE Scholarship Awardees
AI About-Face: 'Mantis' Turns LLM Attackers Into Prey
Kyndryl & Microsoft Unveil New Services to Advance Cyber Resilience for Customers
Securelist
Scammer Black Friday offers: Online shopping threats and dark web sales
Сrimeware and financial cyberthreats in 2025
Whitehat Security Blog
HITB News
WhatsApp: NSO Group Operates Pegasus Spyware for Customers
Korea extradites Russian, Vietnamese suspects linked to $16M ransomware scheme
CISA Director Jen Easterly, in Place Since 2021, to Step Down
Man sick of crashes sues Intel for allegedly hiding CPU defects
North Korean hackers target cryptocurrency with malware
Law enforcement operation takes down 22,000 malicious IP addresses worldwide
Here’s the paper no one read before declaring the demise of modern cryptography
OpenAI launches ChatGPT with Search, taking Google head-on
Chinese attackers accessed Canadian government networks – for five years
Youth of today say passwords are old news, passkeys are the future
Not just ChatGPT anymore: Perplexity and Anthropic’s Claude get desktop apps
The RISKS Digest
Kaspersky Blog
Tor Browser and anonymity: what you need to know | Kaspersky official blog
New 2024 NIST requirements for password strength and storage
Security and privacy settings in adidas Running | Kaspersky official blog
ID card selfie: pros and cons | Kaspersky official blog
Security and privacy settings in MapMyRun | Kaspersky official blog
Which cybersecurity processes can be automated with AI? | Kaspersky official blog
Security and privacy settings in Nike Run Club | Kaspersky official blog
What to do if you receive a sextortion email | Kaspersky official blog
Kaspersky apps are no longer available on Google Play: what to do? | Kaspersky official blog
Transatlantic Cable podcast episode 365 | Kaspersky official blog
How to snoop on what an Apple Vision Pro user is typing | Kaspersky official blog
Is technology increasing potential threats in relationships? | Kaspersky official blog
Adam Shostack & friends
Graham Cluley
Smashing Security podcast #394: Digital arrest scams and stream-jacking new
The AI Fix #25: Beware of the superintelligence, and a spam-eating AI super gran
Malware delivered via malicious QR codes sent in the post
ShrinkLocker ransomware: what you need to know
IT specialist Jack Teixeira jailed for 15 years after leaking classified military documents on Discord
Smashing Security podcast #393: Who needs a laptop to hack when you have a Firestick?
The AI Fix #24: Where are the alien AIs, and are we being softened up for superintelligence?
Winter Fuel Payment scam targets UK citizens via SMS
200,000 SelectBlinds customers have their card details skimmed in malware attack
Smashing Security podcast #392: Pasta spies and private eyes, and are you applying for a ghost job?
The AI Fix #23: Murder most weird, and why 9.11 is bigger than 9.9
Fired Disney worker accused of hacking into restaurant menus, replacing them with Windings and false peanut allergy information

Security in Mainstream Media

Google News Hacking
US charges 5 crypto hackers in $11M scheme linked to ‘Scattered Spider’ - Cointelegraph new
The U.S. just charged five men in connection to 2023 MGM, Caesars hacks - Axios new
Apple Urges Mac Users to Update After Hackers Exploit Zero-Day Vulnerabilities - CNET new
US charges five in 'Scattered Spider' hacking scheme - MSN new
US Charges 5 Members of Scattered Spider Hacking Group - PCMag new
Senators Call Salt Typhoon Hack ‘Breathtaking,’ Want FCC Action - MeriTalk new
Microsoft announces its own Black Hat-like hacking event with big rewards for AI security - TechRadar new
Fintech giant Finastra investigates data breach after SFTP hack - BleepingComputer new
Mexico's president says government is investigating reported ransomware hack of legal affairs office - The Associated Press new
High Court Drama: MGN Faces 101 Celebrity Phone-Hacking Claims - Devdiscourse new
Prince Harry’s ex-girlfriend among 101 phone-hacking lawsuits targeting Daily Mirror publisher – What’s next? | Today News - Mint new
Hackers Exploit Misconfigured Jupyter Servers for Illegal Sports Streaming - HackRead new
Google Cyber Security
Comparing AI with Cyber Security: A Holistic Overview | by Fahad Qayum | Nov, 2024 - Medium new
What CISOs need to know about the SEC’s breach disclosure rules - CSO Online new
Energizer Holdings Enhances Cybersecurity Framework Amid Evolving Threats - Yahoo Finance new
Are Neobanks safe for your finances? A closer look at data privacy and cybersecurity - ET Edge Insights - ET Edge Insights new
Securing the Future: An Interview with Wendy Thomas, CEO of Secureworks, on Cybersecurity Challenges and Solutions in the Middle East - Edge Middle East new
Retailers warned to bolster cybersecurity for Cyber Monday - Retail Insight Network new
DDoS Attack Growing Bigger & Dangerous, New Report Reveals - CybersecurityNews new
US-UK Armed Forces Dating Service Exposes Over 1 Million Records Online - Information Security Buzz new
N-able Strengthens Cybersecurity Via $266M Adlumin Purchase - BankInfoSecurity.com new
Dynatrace joins Microsoft security group to enhance cloud safety - IT Brief Asia new
MITRE Lists 25 Most Dangerous Software Weaknesses of 2024 - CybersecurityNews new
MorganFranklin Consulting launches Orion MDR service with Stellar Cyber - SDxCentral new

Thirsty for more

Hacker News (YCombinator)
DOJ filed paperwork to US District Court to force Google to spin off Chrome [pdf] new
The Matrix: Infinite-Horizon World Generation with Real-Time Interaction new
Boeing overcharged the U.S. Air Force 8,000% above market for soap dispensers new
Spirit Airlines CEO Got a $3.8M Bonus a Week Before Its Bankruptcy new
January 1928: Dirac equation unifies quantum mechanics and special relativity new
Mathematical Thinking Isn't What You Think It Is new
Everyone is capable of, and can benefit from, mathematical thinking new
Why everyone missed solar's exponential growth new
We Open-Sourced Our Compost Monitoring Tech – Hack It for Your Own Projects new
Show HN: We Open-Sourced Our Compost Monitoring Tech – Use It for Your Projects new
Show HN: We open-sourced our compost monitoring tech new
Building Databases over a Weekend new
Reddit - Cyberpunk
Is it possible for a cyberpunk future? Part 2. I WANT ANSWERS AND OPINIONS new
To infinity and beyond new
Error 404 Visual new
Woman controlling a robot with her brain new
Japan street sign - cyberpunk edit by w.vv.vv new
Overpopulation and lack of purpose means death is less meaningful in cyberpunk | Robot Mage Ch2 Pt1 new
If anyone’s in LA the Academy Museum (LACMA) has a Cyberpunk film exhibit now thru mid April
Made a Bladerunner-esque animated loop! Hope that you enjoy!
I spent 3 weeks on embroidery for my most intricate 1of1 hoodie
I wrote my first comic! Couple of pages below
👏👏 saw this ad from @academymuseum ‘s IG page
How do implant a foreign object into yourself and not die? part 1/2
Reddit - Security CTF
Need some help in the a steganography Challenge new
🔒 Security Awards Challenge 🔑 new
Spare laptop question
CTF challenge
Just found google beginners quest... should I quit?
how do i recover a damaged zip file to find the flag?
Can you help me? How can I solve this Steganography problem? I don't know how to solve this.
Looking for CTF Teammates!
Reddit - Sysadmin
Enabling Protected Event Logging via Group Policy new
Bios updates done by SCCM too risky ? new
Large-Scale Windows 11 Rollout: Need Tips and Tools new
Enterprise Password Vaulting coming to the Microsoft Edge Web Browser new
USB device to lock computer when stepping away from PC? new
I hate this job. new
Disconnected from VPN causing file explorer to hang trying to reconnect to network drives. new
Anyone else working at a place that is perpetually falling apart? How are you doing? new
"AI" Computers / Laptops / Phones - Does the Emperor Not Have Clothes? new
2025 coming soon - the year we have to say goodbye to our buddy Windows 10 new
My replacement has no idea what they're doing. new
Tell me I'm not losing my mind new
Lobste.rs
TIL: Some surprising code execution sources in bash new
Investigating SPIR-V for the Stride shader system (part 2) new
Local privilege escalation via needrestart new
Modern Hardware for Future Databases new
Delta Chat introduces realtime Peer-to-Peer networking new
Rust Foundation Collaborates With AWS Initiative to Verify Rust Standard Libraries new
Flexbox & the keyboard navigation disconnect (2016) new
Native compilation of Prolog predicates with Cranelift new
Tiling with Three Polygons is Undecidable new
DBSP: Automatic Incremental View Maintenance for Rich Query Languages new
Map Keys and Lifetimes new
Does the Internet Route Around Damage? - Baltic Sea Cable Cuts new
Hackaday
Stepping On LEGO For Science new
A Tube Stereo Amplifier, From Scratch new
A Cyberpunk Pocketwatch new
FLOSS Weekly Episode 810: Pi4J – Stable and Boring on the Raspberry Pi new
If Life Gives You Lemons, Build this Lemontron new
With Core ONE, Prusa’s Open Source Hardware Dream Quietly Dies new
FreeCAD Version 1.0 Released new
Boss Byproducts: Calthemites Are Man-Made Cave Dwellers new
An Animated Walkthrough of How Large Language Models Work new
Junk Box Build Helps Hams with SDR new
Most Extreme Hypergravity Facility Starts Up in China With 1,900 Times Earth’s Gravity
Batteries Not Included: Navigating the Implants of Tomorrow
Ars Technica
The New Glenn rocket’s second stage set to roll to the launch pad on Monday
The New Glenn rocket’s second stage set to roll to the launch pad on Monday
Audi replaces its bestseller—here’s the next Q5 SUV
Audi replaces its bestseller—here’s the next Q5 SUV
The Starliner spacecraft has started to emit strange noises
The Starliner spacecraft has started to emit strange noises
Agatha All Along’s latest teaser hints at one character’s true identity
Agatha All Along’s latest teaser hints at one character’s true identity
City of Columbus sues man after he discloses severity of ransomware attack
City of Columbus sues man after he discloses severity of ransomware attack
Harmful “nudify” websites used Google, Apple, and Discord sign-on systems
Harmful “nudify” websites used Google, Apple, and Discord sign-on systems
Wired
Selling Chrome Won’t Be Enough to End Google’s Search Monopoly new
Nvidia Says Its Blackwell Chip Is Fine, Nothing to See Here new
Trump FCC Pick Brendan Carr Wants to Be the Speech Police. That’s Not His Job new
Amazon Just Dropped the Biggest Echo Show Ever new
Join Us for the WIRED Big Interview Event new
The Man Behind Amazon’s Robot Army Wants Everyone to Have an AI-Powered Helper new
12 Best Turntables (2024), Tested and Reviewed new
Insta360 Link 2 Review: A Cheaper, Better Webcam new
8 Best MagSafe Wallets (2024), Tested and Reviewed new
The Best Cooling Sheets for Hot Sleepers, Tested and Reviewed (2024) new
The 6 Best Linen Sheets for Cool and Comfy Sleeping (2024) new
Why Is There So Much Off-Brand Oral Ozempic for Sale Online? new
Slashdot
US Regulators Seek To Break Up Google, Forcing Chrome Sale new
Inside the Booming 'AI Pimping' Industry new
Ubuntu Linux Impacted By Decade-Old 'needrestart' Flaw That Gives Root new
Z-Library Helps Students to Overcome Academic Poverty, Study Finds new
Musi Fans Refuse To Update iPhones Until Apple Unblocks Controversial App new
Comcast Spins Off Cable Networks new
Strava Closes the Gates To Sharing Fitness Data With Other Apps new
DeepSeek's First Reasoning Model R1-Lite-Preview Beats OpenAI o1 Performance new
Resentment is Building As More Workers Feel Stuck new
Sony's New A1 II Pairs Updated Design With Largely Familiar Performance new
D-Link Tells Users To Trash Old VPN Routers Over Bug Too Dangerous To Identify new
Delhi Trudges Through Another Air Pollution Nightmare With No Answers new
DZone Security
Data Governance Essentials: Glossaries, Catalogs, and Lineage (Part 5)
4 Essential Strategies for Enhancing Your Application Security Posture
Compliance Automated Standard Solution (COMPASS), Part 7: Compliance-to-Policy for IT Operation Policies Using Auditree
Unifying SecOps and Observability for Enhanced Cloud Security in Azure
Advanced CI/CD Pipeline Optimization Techniques Using GitHub Actions
Using AUTHID Parameter in Oracle PL/SQL
12 Expert Tips for Secure Cloud Deployments
Accelerating Connection Handshakes in Trusted Network Environments
How Federal Agencies Are Achieving Zero Trust With Automation
Implement Hibernate Second-Level Cache With NCache
DZone