Mirage2FA is a phishing kit that uses HTML smuggling and obfuscated JavaScript to deliver fake Microsoft 365 login pages. It targets users with business-themed lures and mimics the Microsoft 365 sign-in process, including MFA prompts. The goal is to steal Microsoft 365 credentials and potentially take over accounts. The phishing campaign uses short-lived domains and sophisticated code obfuscation to evade detection.
HoneyWire is an open-source deception technology platform designed to deploy high-fidelity network canaries on Linux hosts. It uses a decentralized architecture with a central Hub that enforces security policies and validates all inputs, including untrusted manifests and local deployment requests. The system employs Docker containers with strict least-privilege configurations and sandboxing to reduce attack surfaces. Several threat scenarios are analyzed, including supply chain compromise, local component manipulation, privilege escalation attempts, and Hub compromise. Some mitigations are implemented, such as schema validation, image digest pinning, capability allowlisting, and rate limiting. However, certain gaps remain, including lack of cryptographic manifest signature verification and signed deployment artifact enforcement. The platform accepts some risks related to local host compromise and bootstrap credential exposure. Overall, HoneyWire emphasizes strict verification and boundary enforcement to minimize trust assumptions in its security model.
A user on Reddit reported a potential security issue with Substack Notes involving impersonation and alteration of timestamps. The report highlights that certain user IDs and timestamps appear in client-side JSON payloads, raising concerns that these parameters might be manipulated to spoof post metadata such as timestamps or profile URLs. The user questions whether Substack blindly trusts these client-side parameters for rendering, which could allow attackers to backdate posts or impersonate users. The reporter has contacted Substack support but no official advisory or patch information is available.
This report discusses a user experience issue related to requesting CVE IDs through the MITRE CNA-LR form. The user reports not receiving confirmation emails after submitting a zero-day vulnerability request and describes steps taken to whitelist MITRE email addresses. The content is primarily a user inquiry about the CVE request process rather than a security vulnerability or threat.
This entry references a Reddit post linking to a personal video about university experience and debt, with no technical details or indications of a security threat.
This is a public statement from the Hackers on Planet Earth (HOPE) conference organizers expressing concern about the lack of openness and scrutiny from major AI companies regarding their technologies. The statement highlights that invited AI companies declined to participate in open, challenging discussions at the conference. It calls for greater transparency and democratic engagement with AI technologies that have significant societal impact. No specific technical vulnerability or exploit is described.
Cloudflare is collaborating with major browser providers to develop PACT, a privacy-first protocol designed to distinguish human users from bots. PACT enables sites with strong confidence in a visitor's personhood to issue anonymous tokens that other sites can trust to verify human activity without additional user interaction. This approach aims to reduce reliance on invasive tracking methods and CAPTCHAs, improving user experience while maintaining privacy. The protocol's governance and token issuance process remain to be clarified. No direct security vulnerability or exploit is described in the available information.
This entry references a public statement from the Five Eyes cyber security agencies, linked via a Reddit post. The content is a news highlight rather than a specific vulnerability or exploit. It discusses general cybersecurity challenges such as security standards in small companies, AI sprawl, and IT versus cybersecurity ownership, but does not detail a concrete threat or vulnerability.
Two ransomware groups simultaneously targeted on-premises Microsoft SharePoint servers by exploiting known vulnerabilities. This parallel attack highlights that modern ransomware incidents may involve multiple threat actors operating concurrently, complicating incident response efforts. The attacks were identified through a Microsoft investigation and involved exploitation of existing security weaknesses in SharePoint deployments.
Exclusion Auditor is an open-source, read-only tool designed to identify risky Next-Generation Antivirus (NGAV) exclusions, with an initial focus on CrowdStrike Falcon but vendor-agnostic in design. It audits endpoint security exclusions that may create blind spots or security risks, scoring them based on a set of rules mapped to MITRE ATT&CK techniques. The tool operates read-only, requires minimal permissions, and supports importing exclusions from multiple vendors. It helps security teams identify and remediate potentially dangerous exclusions that could impair defenses. The project is in early development (v0.1) and actively seeks feedback and contributions to improve rule accuracy and reduce false positives.
This report references a method to bypass conditional access controls by exploiting resource exclusion techniques. The information is sourced from a recent external blog post linked via a Reddit cybersecurity discussion. No specific affected software versions or patches are identified. The threat is assessed as medium severity based on the available details.
This entry describes a tutorial on buffer overflow exploitation aimed at beginners and new CTF players. It is an educational resource explaining how to exploit a buffer overflow without overwriting the return address, including usage of GDB and techniques for finding offsets. The content is a learning aid rather than a report of a new vulnerability or active threat.
This content describes a project aimed at hardening the Metasploitable2 virtual machine, which is widely known for its intentionally vulnerable services. The project provides technical writeups on securing various services such as DNS, SMTP, Telnet, and FTP on Metasploitable2. It is educational in nature and focuses on applying secure configurations to a traditionally insecure lab environment.
This threat involves a phishing campaign leveraging a kit targeting FACEIT and Steam users. The campaign expanded from initially using 3 domains to 75 domains, indicating a significant scaling of the phishing infrastructure. The information is sourced from a Reddit post linking to an external blog analysis. No specific affected software versions or exploits in the wild are reported. The campaign is categorized as medium severity based on available details.
An 8-year-old use-after-free (UAF) vulnerability exists in the Samsung kernel affecting Galaxy S9 through S25 devices. The vulnerability arises from defensive code that unintentionally expands the attack surface. This issue has been publicly discussed in a recent blog post linked from a Reddit cybersecurity thread. No specific affected software versions or patch information are provided. There are no known exploits in the wild at this time.
Google Workspace has expanded its password reset alert feature from only notifying on super admin password resets to including all administrator roles. This change enhances visibility and control over privileged account security by alerting admins to password resets across all admin roles. The alert is enabled by default, requires no action from administrators, and is limited to 25 events every two hours. End users are not affected by this update.
A reseller account compromise allowed an attacker to access and inject malicious content into dozens of unrelated customer websites hosted on a shared cPanel/WHM server. The attacker used the reseller's credentials to propagate Indonesian online-gambling doorway pages across multiple sites without breaching each site individually. This coordinated parasite-SEO attack affected diverse businesses, highlighting the risk posed by reseller account compromises in multi-tenant hosting environments.
A critical vulnerability (CVE-2026-20230) in Cisco Unified Communications Manager (Unified CM) has been recently patched but is currently being exploited in attacks. The flaw allows unauthenticated remote attackers to perform SSRF attacks, write arbitrary files to the operating system, and escalate privileges to root, but exploitation requires the WebDialer service to be enabled, which is disabled by default. Proof-of-concept code was publicly available at the time of patch release, and exploit intelligence firm Defused observed active exploitation from a single source. Cisco has not yet confirmed in-the-wild exploitation. Unified CM is a core enterprise communications platform, making this vulnerability potentially valuable to attackers. No affected versions were explicitly stated in the source information.
darkVault is an open-source Android application that provides zero-knowledge encrypted storage by encrypting files client-side before uploading them to Google Drive. It uses AES-256-GCM encryption and integrates with Android Keystore and biometric authentication to protect user data. The project is seeking security review and feedback from the security community to validate its design, cryptography, and implementation. There are no known exploits or vulnerabilities reported at this time.
This report references a GitHub project titled BeyondYourComprehensionFHE, which is an advanced Fully Homomorphic Encryption (FHE) system developed by a single author. The project claims significant performance and security features, including multi-engine harmonization, post-quantum readiness, and supply chain security. However, the information is primarily promotional and does not describe any specific security vulnerability or threat. There is no indication of exploitation, vulnerability details, or patch status. The content is sourced from a Reddit post linking to the GitHub repository, with minimal discussion or technical threat details.