This content describes a newly built free VMA 486 Emulator and VAXD_VM that includes a machine state analyzer capable of freezing, saving, loading, disassembling, and patching machine memory during execution. It supports running legacy operating systems such as DOS and Windows 3.x, as well as Windows 7 in a VM environment. The post is primarily an announcement of a tool with analysis capabilities rather than a security vulnerability or threat.
This is a call for testers of Resku, a free browser extension designed to detect phishing and fraudulent websites by scoring pages before sensitive data entry. The extension analyzes page content locally and uses multiple detection rules to identify threats such as typosquatting and malicious scripts. The project is in beta and seeks feedback from French users on accuracy and usability.
This entry describes a categorized index of security tools organized by phases such as reconnaissance, wireless, forensics, and reverse engineering. It is a curated collection of links to external tools maintained by original authors, intended to help security professionals avoid rebuilding bookmarks repeatedly. No software vulnerability or exploit is described.
AWSHound is a free, self-hosted tool that generates attack path graphs for AWS accounts and organizations using BloodHound CE. It analyzes IAM policies, boundaries, SCPs, RCPs, and resource policies offline to visualize potential compromise paths. This is a security tool release rather than a vulnerability or active threat.
This is an open-source project focused on early detection of phishing infrastructure by monitoring newly registered domains (NRDs) and applying structural and keyword analysis to identify suspicious domains before they become known indicators of compromise (IOCs). The detection pipeline integrates with Suricata rulesets to enable DNS and TLS detection of these suspicious domains, aiming to reduce the time gap between domain registration and network detection. The project is evolving and seeks community feedback for improvement.
Hackers exploited a SQL injection vulnerability to install a post-exploitation toolkit directly inside an Oracle database that was used to breach a corporate network. [...]
This is a tool that allows users to inspect Chrome, Firefox, and Edge browser extensions without downloading or installing them. It provides features such as code beautification, searching across files, and sharing URLs to specific extension files. The tool is intended for reviewing browser extensions safely and conveniently.
BRIEFR is a self-hosted, open-source tool designed to provide CVE and IOC intelligence as part of a modular SIEM approach. It aggregates data from multiple threat intelligence sources such as NVD, CISA KEV, FIRST EPSS, and various exploit feeds, scoring CVEs against a user's technology stack. The tool also supports IOC lookups via free-tier VirusTotal, AbuseIPDB, MalwareBazzar, and URLHaus, and integrates Sigma community rules and SIEM query starters tied to ATT&CK. BRIEFR is currently in early alpha, intended for personal use with no major issues reported, and is not a vulnerability or threat itself. It is a security tool aimed at improving threat intelligence and situational awareness.
Noteworthy stories that might have slipped under the radar: parcel delivery company OnTrac hacked, Adobe patches, UK Department for Education loses 607,000 records. The post In Other News: OpenAI Open Source Tool, AWS Links Hacks to North Korea, Mythos Crypto Research appeared first on SecurityWeek .
A security issue involving Google Health's Ask Coach AI was reported, where a simple date-label correction led to a bypass of the AI's persona restrictions. The investigation revealed internal-like technical details including repositories, models, expert routing, APIs, and projects. Google has classified the outputs resulting from this bypass as hallucinated or factually incorrect. The report includes a detailed sequence and evidence for independent review.
A legal case involving a traveler who allegedly used a 'duress password' on a GrapheneOS phone to wipe data during a Customs and Border Protection (CBP) search at a US airport. The incident raises complex legal questions about the use of duress passwords, warrantless device searches at ports of entry, and constitutional protections. The traveler was charged with a felony for wiping his phone, which CBP alleges destroyed evidence. The case highlights ongoing debates about privacy rights, government surveillance of activists, and the legality of device searches without warrants at US borders.
The state of vibe-coded app security: my analysis of 549 self-described AI-generated repos (study + raw data)
Source: https://ogbuilds.ai/studies/vibe-coded-security
PoCumentary is an open-source command-line tool designed to help security researchers and developers create polished, narrated screen recordings of proof-of-concept (PoC) exploits. It automates arranging multiple terminal panes, coordinating demo steps, recording workflows, and synchronizing captions or narration tied to actual demo events. The tool aims to improve the clarity, reproducibility, and presentation of technical findings. There is no indication that PoCumentary itself introduces a security vulnerability or threat.
Z-Privesc is a security tool designed for privilege escalation detection on Linux kernels version 5.4 and above. It is a static C binary that performs 17 probes and provides deterministic verdicts with high accuracy on a ground-truth corpus. The tool claims to outperform other similar tools like LinPEAS and Lynis, requires no dependencies, and is released under the MIT license.
This research details the reverse engineering of Windows Data Deduplication, explaining its internal architecture and how deduplicated files are stored and reconstructed. The author developed DedupInspector, an open-source tool that enables offline recovery of deduplicated files by parsing metadata and chunk stores. The work focuses on understanding the deduplication process, chunk storage, and reconstruction mechanisms rather than identifying a specific vulnerability or exploit. No direct exploit or vulnerability is described, and no affected software versions are specified.
Raqhive is an open-source security tool for Linux servers that uses eBPF for real-time kernel-level monitoring. It functions as an IDS/IPS with stateful detection rules, optional automatic termination of high-severity malicious processes, and a centralized dashboard with AI-assisted threat analysis. It targets Linux systems with kernel version 5.4 or higher and requires root privileges. The project is community-driven and designed to enhance Linux security visibility and response capabilities.
Banana RAT is a remote access trojan that has evolved into two related branches. The older branch used ETW-themed paths and static Microsoft-like names with a pseudo-Microsoft command and control identity. The newer branch improved persistence mechanisms with randomized install identifiers, better SYSTEM persistence, and a WebSocket communication channel using a hashed subdomain. The analysis is based on telemetry from an exposed server and recovered payloads. No known exploits in the wild or patches are reported.
This report references a Reddit post linking to a Google Forms survey related to research on machine learning for detecting insider threats. The content is a request for participation in a research survey and does not describe a security vulnerability or threat. No technical details or exploit information are provided.
Honeyports is a modernized active defense tool rewritten in Python 3 that listens on designated TCP ports and blocks future traffic from attackers by dynamically adding firewall rules. It supports Windows, Linux, and macOS with native firewall integration, offers a web-based configuration UI, multi-port support with threading, IP whitelisting, and automatic privilege elevation. This tool is intended as a honeypot to detect and mitigate scanning or attack attempts by blocking offending IPs in real time.