RCE in the Most Popular Survey Software You’ve Never Heard Of
Source: https://slcyber.io/assetnote-security-research-center/rce-in-the-most-popular-survey-software-youve-never-heard-of/
Code Execution Through Email: How I Used Claude to Hack
Source: https://www.pynt.io/blog/llm-security-blogs/code-execution-through-email-how-i-used-claude-mcp-to-hack-itself
Deriv security team recently uncovered a macOS malware campaign targeting developers - using a fake Homebrew install script, a malicious Google ad, and a spoofed GitHub page.
Broken down in the blog
Worth a read.
I recently investigated a Red Bull-themed phishing campaign that bypassed all email protections and landed in user inboxes.
The attacker used trusted infrastructure via post.xero.com and Mailgun, a classic living off trusted sites tactic. SPF, DKIM and DMARC all passed. TLS certs were valid.
This campaign bypassed enterprise grade filters cleanly... By using advanced phishing email analysis including header analysis, JARM fingerprinting, infra mapping - we rolled out KQL detections to customers.
Key Takeway: No matter how good your phishing protections are, determined attackers will find ways around them. That's where a human-led analysis makes the difference.
Full write-up (with detailed analysis, KQL detections & IOCs)
https://evalian.co.uk/inside-a-red-bull-themed-recruitment-phishing-campaign/
Microsoft Remote Procedure Call (MS-RPC) is a protocol used within Windows operating systems to enable inter-process communication, both locally and across networks.
Researching MS-RPC interfaces, however, poses several challenges. Manually analyzing RPC services can be time-consuming, especially when faced with hundreds of interfaces spread across different processes, services and accessible through various endpoints.
This post will dive into the new algorithm/method I designed and implemented for fuzzing. It will describe some results and why these results differ from the default fuzzing approach. Apart from the additional implemented features, the tool will be released with this post as well! All security researchers from over the world can now freely use this tool in their research.
Researchers from The DFIR Report, in partnership with Proofpoint, have identified a new and resilient variant of the Interlock ransomware group’s remote access trojan (RAT). This new malware, a shift from the previously identified JavaScript-based [Interlock RAT](https://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar/) (aka [NodeSnake](https://www.quorumcyber.com/wp-content/uploads/2025/06/20250416-Higher-Education-Sector-RAT.pdf)), uses PHP and is being used in a widespread campaign.
This report analyzes a historical class of security flaws known as “reflected vulnerabilities,”
which were once potent zero-day attack vectors targeting early Windows versions and antivirus
software. We examine classic exploitation techniques, such as parser attacks, packet fragmen-
tation, and syscall abuse, which could lead to remote code execution (RCE) or privilege esca-
lation. The objective is educational, demonstrating how modern defenses in Windows 11 and
Windows Defender—such as Address Space Layout Randomization (ASLR), Data Execution
Prevention (DEP), Control Flow Guard (CFG), and hardened parsers—have rendered this class
of vulnerabilities obsolete. Proof-of-concept (PoC) code is provided solely to illustrate histor-
ical concepts and is non-functional on modern systems, ensuring compliance with responsible
disclosure principles.
Hey folks,
Just published a write-up where I turned a blind XSS into Remote Code Execution , and the final step?
Injecting commands via Accept-Language header, parsed by a vulnerable PHP script.
No logs. No alert. Just clean shell access.
Would love to hear your thoughts or similar techniques you've seen!
🧠🛡️
[https://is4curity.medium.com/from-blind-xss-to-rce-when-headers-became-my-terminal-d137d2c808a3](https://is4curity.medium.com/from-blind-xss-to-rce-when-headers-became-my-terminal-d137d2c808a3)
Silent Lynx, a persistent cyber espionage threat actor, has conducted targeted intrusion campaigns against government ministries, diplomatic missions, and civil society organizations across Central Asia since 2024. The group focuses on high-value public sector organizations in Commonwealth of Independent States countries, leveraging spear-phishing campaigns through compromised government email accounts and malware staging via GitHub. Operations from late 2024 through 2026 reveal extensive infrastructure including exposed open directories, newly registered domains, and GitHub repositories. The actor employs lightweight reverse shells, PowerShell scripts, proprietary tools, and commodity utilities. Recent activity shows adoption of exploit-assisted delivery via CVE-2025-8088, expanding focus on Linux systems, and interest in FortiWeb vulnerability CVE-2025-25257. Attribution indicators point to Russian-speaking operators likely based in Kazakhstan, with targeting concentrated on water resources, environmenta...
Two critical credential vulnerabilities have been found in Kaseya's RapidFire Tools Network Detective
Source: https://www.galacticadvisors.com/release/critical-vulnerabilities-in-network-detective/
Exploiting Public APP_KEY Leaks to Achieve RCE in Hundreds of Laravel Applications
Source: https://blog.gitguardian.com/exploiting-public-app_key-leaks/
In the high-stakes arena of cybersecurity, Microsoft Defender stands as a cornerstone ofWindows security, integrating a sophisticated array of defenses: the Antimalware Scan Interface (AMSI) for runtime script scanning, Endpoint Detection and Response (EDR) forreal-time telemetry, cloud-based reputation services for file analysis, sandboxing for isolated execution, and machine learning-driven heuristics for behavioral detection. Despiteits robust architecture, attackers increasingly bypass these defenses—not by exploitingcode-level vulnerabilities within the Microsoft Security Response Center’s (MSRC) service boundaries, but by targeting logical vulnerabilities in Defender’s decision-makingand analysis pipelines. These logical attacks manipulate the system’s own rules, turningits complexity into a weapon against it.This article series, Strengthening Microsoft Defender: Analyzing and Countering Logical Evasion Techniques, is designed to empower Blue Teams, security researchers, threathunters, and system administrators with the knowledge to understand, detect, and neutralize these threats. By framing logical evasion techniques as threat models and providingactionable Indicators of Compromise (IoCs) and defensive strategies, we aim to bridgethe gap between attacker ingenuity and defender resilience. Our approach is grounded inethical research, responsible disclosure, and practical application, ensuring that defenderscan anticipate and counter sophisticated attacks without crossing legal or ethical lines.
This comprehensive security report investigates unpatchable vulnerabilities in Windows 10 and11, focusing on systemic flaws that resist traditional patching due to their deep integration intothe operating system’s architecture, hardware dependencies, and legacy compatibility requirements. These vulnerabilities, rooted in fundamental design choices and ecosystem constraints,pose significant challenges to securing millions of Windows devices worldwide. The report examines three critical vulnerabilities: legacy BIOS/UEFI firmware weaknesses, kernel memorymanagement flaws, and backward compatibility with legacy protocols. It provides a detailedtechnical analysis, exploitation vectors, detection challenges, and comprehensive mitigationstrategies. With Windows 10 approaching its end-of-support deadline in October 2025, theseflaws pose heightened risks, necessitating proactive defenses. This report adheres to responsible disclosure principles and aims to support Microsoft’s efforts to strengthen Windows securityin 2025
I recently tested a language-learning site that used live frontend filtering to block HTML input (e.g., <img> <svg> tags were removed as you typed).
But by injecting the payload directly via browser console (without typing it), the input was submitted and stored.
Surprisingly, the XSS executed later on my own profile page — indicating stored execution from a DOM-based bypass.
I wrote a short write-up here:
[https://is4curity.medium.com/xss-before-submit-a-dom-based-execution-flaw-hidden-in-plain-sight-5633bdd686c9](https://is4curity.medium.com/xss-before-submit-a-dom-based-execution-flaw-hidden-in-plain-sight-5633bdd686c9)
enjoy
