UnConfuserEx is an open-source tool designed to deobfuscate .NET assemblies protected by ConfuserEx2, a popular obfuscation framework. It supports removal of multiple protection techniques such as anti-tamper, compressors, constants obfuscation, control flow obfuscation, and resource encryption. The tool improves upon previous versions by handling newer ConfuserEx2 variants and edge cases encountered in real-world protected assemblies. It is intended for authorized use in malware analysis, reverse engineering, and software recovery. No direct vulnerability or exploit is described in the provided information.
Two critical vulnerabilities with CVSSv3 scores of 9.8 were discovered in Vertiv's Liebert IS-UNITY-DP UPS network cards. These internet-connected devices are used for power management in data centers. Exploiting these flaws could disrupt power management operations, impacting data center availability. Vertiv has released updates addressing both vulnerabilities. The research highlights the importance of including UPS infrastructure in an organization's cyber-physical security considerations.
This is an update announcement for the VirusTotal-CLI project, a command-line interface tool for interacting with the VirusTotal v3 API. The update includes a new IP resolution technique and other features to facilitate structured JSON output from VirusTotal API queries. There is no indication of a security vulnerability or threat associated with this update.
A Windows 11 host running svchost.exe generated unusual DNS queries including google.com.onion, wildcard, and malformed domains within a very short time frame. These queries returned NXDOMAIN responses and did not lead to any follow-up connections or IP resolutions. The behavior resembles synthetic or malformed DNS queries rather than user-initiated activity and is similar to DNS probing or spoof detection patterns observed on other devices. The source of these queries under svchost.exe is unclear, and it is uncertain whether this is normal Windows DNS client behavior, network validation, or triggered by security tools. No confirmed malicious activity or exploit is reported.
ThreatNexus v2 is a threat intelligence platform focused on nation-state APT campaigns, providing improved data quality, strategic and operational context, and actionable intelligence for detection and hunting. It aggregates vendor research, news, and government/CERT sources into a digest format to aid analysts and decision-makers. This release aims to enhance usefulness across strategic, operational, and tactical levels but is not a direct security threat or vulnerability itself.
CVE-2026-23111 is a use-after-free vulnerability in the Linux kernel's nftables subsystem, introduced by a flawed security fix for a previous vulnerability (CVE-2023-4244). It affects Container-Optimized OS nodes and can lead to privilege escalation. Google Kubernetes Engine (GKE) Standard clusters are impacted, while Autopilot clusters are not vulnerable by default unless specific insecure configurations are used. Patch versions have been released for Ubuntu node pools and Container-Optimized OS node pools on GKE. Other GKE environments (AWS, Azure) and VMware are pending patch and severity updates. Bare metal GDC software is not affected as it does not include an OS. The vulnerability is rated high severity. Detection techniques focus on monitoring behavior rather than payload signatures, applicable even on patched kernels.
This content is a guide discussing how Virtual Chief Information Security Officers (vCISOs) can help bridge the communication gap between technical security teams and organizational boards by creating board-ready security roadmaps. It emphasizes aligning cybersecurity strategies with business risk management, regulatory compliance, and resource justification. The guide is intended to improve board-level understanding and oversight of cybersecurity risks and resilience.
A Reddit post titled 'Rumour or Real ? Paper Leak Case' shares a link to a Google Drive file allegedly containing leaked exam papers. The post requests help to crack the file password but provides no technical details or evidence confirming the authenticity or source of the leak. There is minimal discussion or verification available, and no known exploits or vulnerabilities are associated with this content. The threat appears to be a potential data breach rumor without confirmed impact or technical specifics.
FortiBleed is an active hacking campaign that has exposed over 30,000 verified Fortinet firewall credentials globally. The campaign affects a wide range of high-value targets including major banks, telecom companies, and government agencies across 194 countries. The attacker infrastructure, tools, and victim list have been tracked by researchers. The campaign remains active at the time of reporting, posing ongoing risk to affected organizations.
This threat involves autonomous AI agentic phishing, where standard phishing techniques are effective against autonomous AI personal assistants without requiring prompt injection or adversarial content. The information is sourced from a recent Reddit cybersecurity discussion linking to a Varonis blog post. There is no indication of known exploits in the wild or specific affected software versions. The threat is assessed as medium severity based on the potential for phishing attacks to manipulate AI agents.
Operation Poisson is a cybersecurity campaign analyzed in a blog post by Cato Networks, shared via a Reddit link. The content discusses the comprehensive examination of a cybercriminal operation but does not provide specific technical vulnerability details or exploitation methods. No affected software versions or direct exploits are identified. The campaign is assessed as medium severity based on available information.
A popular Chrome extension with over 2 million users introduced a new component related to Give Freely/Wildlink in a rapid update cycle. This addition enables merchant detection, affiliate attribution, and donation campaigns without requesting new permissions, meaning users received the update automatically. The Give Freely/Wildlink infrastructure appears in multiple unrelated extensions, suggesting it is a white-label monetization or fundraising SDK. There is no evidence of malware, credential theft, or overtly malicious behavior at this time. The main concern is potential transparency and privacy implications due to expanded functionality without explicit user consent.
This entry is a link post sharing a list of popular cybersecurity podcasts, including Darknet Diaries and others. It does not describe a specific security vulnerability or threat. The content is informational and relates to cybersecurity awareness and education through podcasts.
A criminal extortion group known as the Silent Ransom Group bypasses traditional hacking techniques by using social engineering and physical intrusion. They initiate contact with a benign-looking invoice email, followed by phone calls impersonating IT staff to gain remote access via legitimate tools. They steal sensitive data from cloud services and corporate email, targeting especially law firms. When remote tactics fail, they escalate by physically visiting offices posing as IT technicians, using USB sticks to compromise systems. The attack relies on confidence tricks rather than malware or exploits.
Phantom Stealer is a .NET-based fileless infostealer malware distributed via phishing emails containing fake business document attachments. It runs entirely in memory by injecting into trusted Windows processes, evading signature-based antivirus detection. The malware steals saved passwords, session cookies, financial data, cryptocurrency wallets, keystrokes, screenshots, and clipboard contents, then exfiltrates data through multiple channels. Usual defenses like MFA and password resets do not prevent compromise due to session cookie theft and persistence mechanisms. Detection relies on behavior-based monitoring and user training to recognize suspicious email attachments and scripts. Remediation requires isolating infected endpoints, revoking active sessions, resetting credentials, and hunting for persistence. The threat is actively used by multiple criminal groups targeting various industries including banks and logistics.
A large-scale compromise of over 75,000 Fortinet device administrator credentials has been reported. The compromised credentials appear to be recent and include devices that are still online. The data was reportedly obtained from device configuration exports, containing sensitive information visible only from the devices themselves. This incident affects a significant portion of Fortinet firewall devices exposed to the internet, estimated at around 15% based on Shodan polling. The compromised devices include many with fairly recent patches. The source of this information is a Reddit post linking to a LinkedIn profile of a security researcher involved in the discovery.
A Reddit user posted a request for feedback on the security of their website rentmaxai.com, expressing concern about potential hacking. The post does not describe any specific vulnerability or exploit. There is no technical detail indicating an active security threat or confirmed vulnerability in the website or its services.
Aikido Security discovered 15 malicious plugins on the JetBrains Marketplace that steal developers' AI API keys for OpenAI, DeepSeek, and SiliconFlow. These plugins, collectively installed around 70,000 times, exfiltrate API keys in plaintext over HTTP to an attacker-controlled server. The stolen keys are then resold to paying customers, creating a self-funding illicit cloud compute business. The campaign has been active since October 2025 and continued releasing updates as recently as June 2026. Manual code review by JetBrains failed to detect this coordinated supply-chain attack. Developers who entered API keys into these plugins should assume compromise and rotate their keys immediately. The full removal status of these plugins from the marketplace is not confirmed.
This entry describes published research on attacker-perspective cybersecurity awareness training presented at HCII 2024. The research introduces a web-based game called Masterm1nd that immerses users in attacker and victim roles across scenarios such as weak passwords, phishing, public Wi-Fi exfiltration, and malicious charging ports. A pilot study with 20 participants showed improved understanding, especially regarding malicious charging ports. The content is educational and research-focused rather than describing a vulnerability or active threat.
This entry references a research paper and toolset named VSMEx, which collects and provides a dataset of malicious Visual Studio Code extensions. It is a data/tool publication rather than a direct vulnerability or exploit. The information is sourced from a Reddit post linking to an academic paper. There are no specific affected software versions or active exploits reported.