Nocobase versions up to 2.0.57 contain two chained vulnerabilities that allow an authenticated admin to achieve remote code execution (RCE). The first vulnerability permits arbitrary file write by manipulating the file upload storage root path without validation. The second vulnerability allows local file inclusion (LFI) via an unsanitized require() call on user-supplied paths. Together, these flaws enable an attacker with admin credentials to upload and execute malicious code on the server. The issue is fixed in version 2.1.5.
SecureX is an open-source specification protocol defining 13 rules for zero-knowledge, privacy-preserving application design. It mandates client-side encryption, multi-tenant isolation, elimination of third-party tracking, no administrative backdoors, atomic data deletion, and other privacy and security best practices. The protocol aims to establish a compliance standard for software developers to ensure absolute data isolation and privacy. There is no indication of a specific vulnerability or exploit associated with SecureX itself.
This content is a community-shared set of detection queries for identifying suspicious PowerShell and living-off-the-land binary (LOLBin) activities in production environments. It includes specific queries to detect unusual parent processes for LOLBins, PowerShell spawned from office or browsers, encoded PowerShell commands with payload decoding, reflective loading indicators, and behavioral baseline layering to reduce false positives. The post is a knowledge-sharing resource rather than a direct security vulnerability or exploit.
This report discusses testing offensive AI agents within a cloud lab environment using deception technology. The source is a Reddit post linking to an external site describing repeated experiments of the Tularosa study against multiple offensive AI agents to evaluate the effectiveness and perception of deception techniques. There is no indication of a specific vulnerability or exploit. The content is informational about security research rather than a direct security threat.
This content describes a practical detection approach for identifying encoded PowerShell commands using Kusto Query Language (KQL) in Microsoft Sentinel. The detection method incorporates a weighted scoring model that reduces noise by considering multiple indicators beyond the simple presence of encoded commands, such as the parent process, download-related keywords, execution flags, and execution paths. The approach aims to improve alert accuracy and reduce false positives in enterprise environments. It is not a vulnerability or exploit but a detection technique shared on a public forum.
This is a project update describing the implementation of a robust watermarking pipeline using DCT-QIM (Discrete Cosine Transform - Quantization Index Modulation) for intellectual property protection. The system embeds a resilient payload into mid-frequency DCT coefficients of images and videos, designed to withstand modifications such as resampling, compression, and cropping. It uses Reed-Solomon channel coding for error correction and a soft-symbol scoring with beam search for extraction. Verification employs a normalized Levenshtein similarity metric to assess watermark integrity even under tampering. The project is intended to maintain authorship traceability of digital assets. No vulnerabilities or exploits are reported.
Entra Agent ID objects are a new type of identity in Microsoft Entra ID that behave similarly to service principals. They have baseline protections such as blocking assignment of some highly privileged roles and Microsoft Graph API permissions. However, many powerful API permissions remain assignable, and because these objects can operate cross-tenant, risks like consent phishing persist. Certain roles and permissions related to agent identities and blueprints should be considered highly privileged due to their potential for takeover or control. Defensive focus should include monitoring privileged agent objects, blueprint ownership, credentials, inherited permissions, and cross-tenant usage.
Anthropic is releasing a cybersecurity AI model named Claude Fable 5, derived from its previously restricted Mythos model. Mythos was designed to identify software vulnerabilities, attack paths, and zero-day exploits at a level surpassing many human experts. Initially limited to vetted organizations due to misuse concerns, the public release introduces new guardrails intended to balance capability with risk. The model's release represents a governance experiment to see if constraint-based controls can safely enable broad access to powerful vulnerability discovery tools. The dual-use nature of the model poses challenges, as it can aid both defenders and attackers. The effectiveness of the guardrails and governance mechanisms will be critical to managing misuse risks.
This security news discusses HTTP/2 HPACK amplification attacks, also known as the "HTTP/2 bomb," which can cause large server-side memory allocations from small client requests. The research covers multiple HTTP/2 server implementations including nginx, Apache httpd, Envoy, Pingora, and Microsoft IIS. The authors provide detection signatures and verified mitigation directives, such as specific nginx and Apache configuration changes and version upgrades. Lab tests show significant amplification effects, with memory usage rising from megabytes of wire traffic to multiple gigabytes of server RAM. Fixes are available for nginx (version 1.29.8 and later) and Apache httpd (mod_http2 version 2.0.41 and later). The status of fixes for IIS, Envoy, and Pingora is currently unknown.
This research documents a technique to bypass Netskope enterprise DLP by embedding sensitive data three layers deep inside a PPTX file: a text file zipped, appended to a PNG image via Windows CMD binary copy, then embedded in the PPTX. Netskope's default inspection recursion depth is less than three, so it fails to detect the hidden data. The technique requires only native Windows tools and no admin rights. Detection can be improved by increasing recursion depth or using metadata anomaly rules. A coordinated detection approach using SentinelOne EDR behavioral alerts on CMD binary copy commands combined with Netskope metadata inspection is recommended. The technique applies to all Microsoft Office file formats using ZIP-based structures.
This report discusses a browser-based peer-to-peer (P2P) messaging app demo called Enkrypted. Chat, which aims to provide secure and private communication using end-to-end encryption, the Signal protocol, and post-quantum cryptography. The app is local-first, requires no registration or installation, and uses WebRTC with TURN servers for connectivity. It is currently a work in progress and has not undergone formal security audits or reviews. The project is shared for testing and feedback purposes only, and users are cautioned to use it responsibly. No confirmed vulnerabilities or exploits are reported at this time.
An autonomous AI agent developed by the security startup depthfirst discovered 21 zero-day vulnerabilities in the FFmpeg multimedia framework, including nine assigned CVEs (CVE-2026-39210 through CVE-2026-39218). These vulnerabilities primarily involve heap and stack overflows in various parsers and demuxers, with some bugs dating back to 2003. FFmpeg maintainers have been responsive and are shipping fixes. The discovery raises concerns about the effectiveness of traditional static and dynamic analysis tools against memory corruption in large C codebases and the potential impact of AI-driven vulnerability discovery on disclosure pipelines and vulnerability economics.
Void Dokkaebi malware infection has been confirmed on macOS systems, with a user reporting suspicious commit tampering in code repositories potentially linked to VS Code Copilot agent activity. The malware campaign is known to use fake job interview lures and commit tampering techniques, primarily documented on Windows, but macOS-specific behaviors remain unclear. The user is investigating whether the VS Code Copilot agent was manipulated to insert malicious code or if tampering occurred independently at the OS level. No official macOS-specific indicators or commit tampering scripts have been identified yet. There is no confirmed exploit or patch information available. The investigation is ongoing with questions about forensic artifacts and logging related to VS Code Copilot and git operations on macOS.
This report describes a campaign promoting a WhatsApp group that offers discounted cybersecurity exam vouchers and subscriptions. The campaign appears to target cybersecurity learners and professionals by advertising access to discounted certifications and premium platforms. There is no technical vulnerability or exploit detailed, and no direct evidence of malicious activity or compromise is provided. The source is a Reddit post linking to a WhatsApp group, with minimal discussion and no known exploits in the wild. The nature of the campaign suggests potential risks related to trust and payment fraud rather than a software vulnerability.
Microsoft has announced plans to release a commercially-available quantum chip by 2029, which could accelerate the timeline for practical post-quantum cryptographic threats. This announcement has sparked discussion in the security community about the urgency of preparing for quantum-resistant cryptography. However, the claim is based on a news article and community speculation, with no direct evidence of immediate exploitation or vulnerability. The announcement does not represent an active security threat but highlights a potential future risk as quantum computing technology advances.
This content discusses the launch of an autonomous pentesting platform by Astra Security, designed to identify business logic vulnerabilities using AI-driven agents. The platform offers two modes: a structured checklist-style pentest and a 'bounty hunter' mode that dynamically pursues promising leads. The post is a developer's introduction and invitation for feedback rather than a report of a specific security threat or vulnerability. No actual security vulnerability or exploit is described or confirmed.
Windows 11's input pipeline causes typed passwords from third-party applications like PuTTY, WinSCP, and MySQL to appear in system process memory such as LSASS.exe, Defender (MsMpEng.exe), and ctfmon.exe. This is due to Windows telemetry and text input buffering, not malicious credential harvesting. Passwords may remain in ctfmon.exe memory even after application closure, posing a risk if non-admin malware accesses that process. Credential Guard does not protect these third-party passwords as they are not Windows authentication credentials. This behavior is architectural and expected, not a vulnerability, but it creates a real risk of password exposure through memory forensics or malware. Mitigations include using secure credential APIs, key-based authentication, password managers with secure injection, and avoiding typing passwords into standard text input fields.
SYNTEX has open sourced 2,500 novel MITRE ATT&CK technique mutations generated autonomously by their Nemesis AI red team using reinforcement learning. These mutations represent new attack vectors derived from known MITRE techniques, validated against a production defense system (Guardian AI). The dataset is intended for use in threat intelligence and detection rule development. There is no indication that these mutations represent active exploits in the wild or vulnerabilities in specific products. The vectors are provided in standard formats for SIEM integration and are licensed for free use with attribution.
OnionAccelerator is a Python tool designed to accelerate downloads over the Tor network by splitting downloads across multiple Tor circuits or SOCKS5 proxies. It supports multi-file parallel downloads, chunked downloads of single files across multiple circuits, and proxy speed testing. The tool aims to improve throughput limitations inherent in single Tor circuits, primarily for authorized data collection use cases such as archiving dark web content. There are no indications of vulnerabilities or exploits associated with this tool. It is a utility to enhance download performance over Tor rather than a security threat or vulnerability.
The PCPJack threat actor compromised approximately 230 cloud servers and repurposed them into a hidden SMTP relay network. The attacker left their deployment toolkit publicly accessible in an unauthenticated open directory, facilitating discovery and analysis. Indicators include a systemd service named xsync disguised as a system sync utility, files under /var/tmp/. xs, and Chisel reverse SOCKS5 tunnels on ports 10000-14999. A public blog post provides detailed MITRE ATT&CK mappings and HuntSQL detection queries. No official patch or remediation guidance is currently available.