MESH is an open-source remote mobile forensics tool designed to enable encrypted, peer-to-peer wireless debugging and forensic data acquisition on mobile devices, particularly Android. It creates a censorship-resistant mesh network that overcomes NAT and firewall restrictions without exposing devices to the public internet. The tool supports integration with common forensic utilities and includes network monitoring capabilities. MESH is currently in public alpha, actively developed, and has undergone penetration testing with major vulnerabilities patched. It is intended for use in high-risk or censored environments and emphasizes transient, analyst-controlled forensic sessions rather than permanent infrastructure.
User Scanner v1.4.0 is an open-source OSINT tool designed for deep email and username intelligence gathering across over 285 platforms. It aggregates publicly accessible information and threat intelligence feeds to help security researchers and investigators map digital footprints and verify account registrations. The tool is actively maintained and emphasizes accessibility without paywalls. It does not exploit vulnerabilities or access private data. No specific security vulnerability or exploit has been reported for this tool.
AutoJack is a vulnerability in Microsoft Research's AutoGen Studio AI browsing agent framework that allows a malicious web page to hijack the AI agent and achieve full remote code execution (RCE) on the host machine via a privileged local service. The issue arises from a combination of trusting localhost connections, lack of authentication on a WebSocket endpoint, and executing commands directly from requests. The vulnerability affects two pre-release versions of AutoGen Studio (0.4.3.dev1 and 0.4.3.dev2) but not the stable release 0.4.2.2. A fix has been committed to the GitHub main branch but has not yet been released on PyPI. Until an official release is available, users should avoid running AutoGen Studio alongside browsing agents on the same machine or isolate them in containers or VMs.
BruceButBetter is an open-source DIY hardware project that replicates Flipper Zero functionality on an ESP32-S3 platform. It includes multiple radio and signal capabilities such as Sub-GHz, NFC/RFID, 2.4 GHz wireless protocols, IR, WiFi, BLE attacks, and a signal generator. The project is intended as a red-team multitool for authorized testing and education. It is publicly available on GitHub with build guides and prebuilt firmware images.
Bulletin ID: 2026-046-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 06/18/2026 17:30 PM PDT Description: containerd is an open-source container runtime used by Kubernetes via the Container Runtime Interface (CRI) plugin. It underpins AWS managed container services including Amazon Elastic Kubernetes Service (Amazon EKS), Amazon Elastic Container Service (Amazon ECS), AWS Fargate, Bottlerocket, and Amazon Linux. AWS identified five issues in the containerd CRI plugin affecting versions 1.7 through 2.3. - CVE-2026-50195 (GHSA-cvxm-645q-p574) - CRI checkpoint import, local image tag poisoning - CVE-2026-53488 (GHSA-xhf5-7wjv-pqxp) - image-config LABEL -> host-root command exec - CVE-2026-53492 (GHSA-33vj-92qq-66hc) - CDI annotation smuggling during checkpoint restore - CVE-2026-53489 (GHSA-rgh6-rfwx-v388) - arbitrary host file read via symlink in checkpoint restore - CVE-2026-47262 (GHSA-jpcc-p29g-p8mq) - image-triggered runtime DoS Impacted versions: containerd 1.7, 2.0, 2.1, 2.2, 2.3 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Market intelligence platform Klue has publicly confirmed a recent security incident that allowed threat actors to steal OAuth tokens used to connect to customers' Salesforce environments, as the new "Icarus" extortion group publicly claims the attack. [...]
The hackers exfiltrated data from Salesforce instances of Klue customers, such as Huntress and Recorded Future. The post Cybersecurity Firms Impacted by Klue Supply Chain Attack appeared first on SecurityWeek .
Law enforcement and private partners took down 106 SocGholish C&C servers and domains as part of Operation Endgame. The post 15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown appeared first on SecurityWeek .
AutoJack is a novel exploit chain showing how a single malicious webpage can turn an AI browsing agent into a remote code execution vector on the host machine. By abusing trust in localhost, missing authentication, and unsafe parameter handling, attackers can trigger arbitrary process execution through AutoGen Studio’s MCP WebSocket. The research highlights a broader pattern - when agents can browse untrusted content and access local services, traditional boundaries like localhost are no longer secure. The post AutoJack: How a single page can RCE the host running your AI agent appeared first on Microsoft Security Blog .
UnConfuserEx is an open-source tool designed to deobfuscate .NET assemblies protected by ConfuserEx2, a popular obfuscation framework. It supports removal of multiple protection techniques such as anti-tamper, compressors, constants obfuscation, control flow obfuscation, and resource encryption. The tool improves upon previous versions by handling newer ConfuserEx2 variants and edge cases encountered in real-world protected assemblies. It is intended for authorized use in malware analysis, reverse engineering, and software recovery. No direct vulnerability or exploit is described in the provided information.
In the latest Threat Source, Hazel channels her inner Spielberg to explore why humans are delightfully irrational, reminding us that while security best practices are simple in theory, they’re a lot harder to pull off when you’re busy dealing with real life.
The Popa botnet is an Android-based network that has compromised millions of consumer TV boxes over the past four years. It has been used to relay internet traffic for activities such as advertising fraud, account takeovers, and large-scale data scraping. Recent research links the Popa botnet to NetNut, a residential proxy service operated by Alarum Technologies Ltd, a publicly-traded Israeli company. There is no indication of a specific vulnerability or patch available. No known exploits in the wild have been reported.
Market intelligence platform Klue suffered a OAuth breach that enabled the "Icarus" threat actors to steal Salesforce CRM data from multiple organizations in an ongoing extortion campaign. [...]
International law enforcement agencies cleaned nearly 15,000 malware-infected WordPress websites and took down more than 100 servers linked to the SocGholish botnet and the Evil Corp Russian cybercrime group. [...]
CISA's Binding Operational Directive (BOD) 26-04 changes federal vulnerability management by ending reliance on static severity scores and mandating a dynamic, risk-based prioritization model based on asset exposure, KEV status, exploit automation, and technical impact. Tenable One provides continuous asset discovery, threat validation, and automated orchestration to help federal agencies comply with these requirements. The directive enforces compressed remediation timelines for vulnerabilities on internet-facing assets with known exploitation and total control impact, requiring forensic triage within three days. Tenable's platform integrates CISA's KEV catalog and offers early warnings for emerging threats, enabling proactive remediation. The directive requires continuous monitoring as compliance timelines shift with changes in risk variables. Tenable's research identifies high-risk vulnerabilities not yet listed on KEV, providing predictive prioritization to reduce risk beyond compliance.
The attackers deployed a new Go-based backdoor that uses Microsoft Teams servers for command-and-control. The post Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack appeared first on SecurityWeek .
Nocobase versions up to 2.0.57 contain two chained vulnerabilities that allow an authenticated admin to achieve remote code execution (RCE). The first vulnerability permits arbitrary file write by manipulating the file upload storage root path without validation. The second vulnerability allows local file inclusion (LFI) via an unsanitized require() call on user-supplied paths. Together, these flaws enable an attacker with admin credentials to upload and execute malicious code on the server. The issue is fixed in version 2.1.5.
Discover how continuous control validation in Tenable One can improve your CTEM program by filtering out alert noise and factoring in your active cyber defenses. Focus your team on accessible and exploitable attack paths. Key takeaways: With vulnerability exploitation ranking as the top initial access vector and frontier AI accelerating vulnerability discovery, organizations must shift from managing theoretical cyber risks to validating actual, accessible exposure. Tenable One maps active security controls including EDR, MFA, and firewalls directly onto potential attack paths, allowing teams to automatically deprioritize weaknesses that existing defenses already neutralize. Ingesting penetration testing results via the Tenable One Open Connector allows organizations to layer real-world attack simulations over real-time exposure insights to identify toxic risk combinations that threaten critical assets. Your security tools probably indicate you have thousands, perhaps tens or hundreds of thousands, of vulnerabilities across your environment. Maybe your tools prioritize these vulnerabilities based on CVSS scores or other criteria, but how do you know which vulnerabilities combine with other preventable security risks, like misconfigured cloud buckets and identity weaknesses, to create attack paths threat actors could realistically traverse? How do you validate which vulnerabilities an existing security control mitigates? You need this context to distinguish the real risks from the theoretical ones to ensure your team focuses on remediating what matters most. The work of validating, prioritizing, and remediating vulnerabilities alongside other security weaknesses to understand the true exposure they create has become much more urgent, as frontier AI models accelerate vulnerability discovery. In this environment, the traditional patch-based defense model will get crushed. Moreover, defenders cannot afford inaccurate decision-making and wasted remediation work that addresses low-priority vulnerabilities. They desperately need the context and validation that a continuous threat exposure management (CTEM) program provides. This is why security leaders are evolving their vulnerability management programs to exposure management programs. Exposure management allows you to continually assess your attack surface, prioritize risks , and orchestrate automated remediation of security weaknesses at machine speed. Exposure management also helps validate which exposures attackers can actually reach by understanding the accessibility and exploitability of an attack path. It uses validation to shift your organization from managing theoretical risks to executing on actual exposure. What is exposure validation in CTEM? Validation is one of the five steps in the CTEM lifecycle. It is the process of providing consistent, continuous, and automated evidence of an attack’s feasibility. It stress-tests your defenses against real-world attack conditions, using your own environment’s controls and configurations to confirm whether an exposure is genuinely reachable and exploitable. Validation moves security from a reactive “patch everything” mindset to a preemptive, evidence-based exposure strategy . It continuously confirms which weaknesses your existing defenses have already blocked and surfaces the ones that demand immediate attention. Expanded CTEM validation capabilities in Tenable One Validation isn’t new to Tenable: we’ve been using validation techniques in Tenable solutions for more than 25 years. Tenable developed nearly 3,000 direct check plugins to actively probe a vulnerability and prove its exploitability in situations where software version detection isn’t sufficient for our high-accuracy standards. These plugins actually mimic attack techniques and monitor the target’s response to confirm the presence of the vulnerability. What is new in Tenable One is the addition of continuous control validation in the platform. By factoring in your active security controls, Tenable One helps eliminate the noise of theoretically exposed assets that are functionally blocked from exploitation. Security teams can visually map their active prevention and detection controls directly onto potential attack paths, automatically prioritizing weaknesses that existing controls already neutralize. Analysts can also filter top attack paths based on the presence of security controls and whether you can prevent attack chains for faster triage and investigation. Common control validation examples include: Endpoint detection and response (EDR) tools that block Local Security Authority Subsystem Service (LSASS) memory dump tools used to harvest credentials. Multi-factor authentication (MFA) methods that prevent unauthorized access via password guessing , password spraying , or credential stuffing . Firewall and data loss prevention (DLP) tools that prevent data exfiltration by detecting data staging and enforcing egress rules. See how continuous control validation works in Tenable One. Proactively manage risk prioritization with continuous security control validation. Eliminate noise from theoretical risks that are functionally blocked by existing defenses by integrating compensating security controls into the exposure prioritization process. Access a unified dashboard where assets, vulnerabilities, and exposure risks are consolidated. Filter attack paths to identify which are protected by compensating controls. View types of compensating controls deployed in the environment. Examine attack paths that could be protected with endpoint protection tools. Review security controls associated with specific attack paths, including SIEM and EDR controls. Inspect individual nodes within attack paths to determine which security controls are protecting them. Identify assets monitored by SIEM tools such as Splunk. Verify endpoint protection coverage on assets, including Microsoft Defender installations. Filter attack techniques to focus on specific threats like LSASS Memory techniques, which extract credentials from compromised systems and can be mitigated by endpoint protection tools. Identify attack paths and assets lacking appropriate EDR coverage. Prioritize remediation by examining high-priority attack paths where compensating controls are absent. Collaborate with security control owners to confirm coverage and address gaps in protection for critical assets. Integrate penetration testing data into Tenable One Beyond direct check plugins and continuous control validation, security teams can also integrate penetration testing results into Tenable One that simulate real-world attacks against your cyber defenses. This is another way to validate which exposures are truly exploitable and contextualizes them against your broader attack surface. The Tenable One Open Connector makes it easy to ingest the latest pentest results and layer them with real-time exposure insights to turn your findings into active, continuous defenses. Integrating pentest data into an exposure management program adds critical context to help you understand toxic risk combinations and enrich your understanding of high-severity weaknesses that threaten your most critical business assets. Context is essential in exposure management In the AI era, your security team can’t waste precious time on the wrong issues. With exposure management, context is essential to pinpoint the most critical risks to your organization. Security control validation, coupled with asset criticality, threat activity, entitlement privileges, and attack pathways, give your security team the advantage it needs to stay ahead of threat actors. Learn more about Tenable One , the exposure management platform for the modern attack surface.
DragonForce ransomware used a custom malware named 'Backdoor.Turn' to hide command-and-control traffic inside Microsoft Teams relay infrastructure. [...]