OffsetInspect v3.0.0 – track how Defender signature updates shift detection boundaries across a corpus [PowerShell, MIT]
Source: https://github.com/warpedatom/OffsetInspect
GitHub and PyPI have introduced time-based defenses in their dependency management and package publishing processes to mitigate supply chain attacks. GitHub's Dependabot now enforces a default 72-hour cooldown before automatically updating dependencies, reducing the risk of quickly adopting malicious packages. PyPI blocks maintainers from adding new files to package releases older than 14 days to prevent release poisoning. These measures respond to recent high-profile supply chain attacks and aim to limit the impact of compromised packages or publishing tokens.
The Planet Search Chrome extension, with approximately 2 million installs, has been observed routing user search traffic through a chain of malicious domains. The extension itself has a minimal local footprint with no permissions and a zero-byte background script, relying on server-side mechanisms to override Chrome's default search provider. The traffic is redirected through domains flagged as browser hijackers by multiple security vendors. The publisher also offers other extensions, including a VPN extension with around 1 million users, which are under further investigation.
ProtonVPN reportedly stores users' authentication private keys in plaintext on client devices. Proton has stated that this is intended behavior. There is no indication of a patch or fix, nor evidence of active exploitation. The report originates from a third-party blog post shared on Reddit with minimal discussion and no official vendor advisory provided.
NEO-Radar v1.11 is an open-source network scanning tool designed to simplify host discovery and port scanning for users with limited networking knowledge. It automates basic scanning tasks commonly performed by tools like Nmap. The program supports Linux, Termux (Android), and has a Windows PowerShell version. There is no indication of inherent security vulnerabilities or exploits associated with this software in the provided information.
This content discusses the effectiveness of Data Loss Prevention (DLP) solutions for remote teams, emphasizing the need for data-centric security beyond traditional network perimeters. It highlights how modern DLP solutions monitor data actions within cloud, SaaS, and browser environments, enabling real-time prevention and user coaching without invading employee privacy. The article does not describe a specific vulnerability or exploit but rather provides guidance on securing sensitive data in remote work contexts.
The Chrome extension "Planet Search" with approximately 2 million installs is a search hijacker that routes all user queries through a chain of undisclosed redirects ending at nextgeeker.com, a domain flagged by multiple vendors as a browser hijacker. The extension declares itself as a default search provider but does not disclose the intermediate redirects or the affiliate monetization relationship. The extension's code is minimal and does not reveal this behavior, as the redirect logic is entirely server-side. Users receive standard Google Custom Search results, but their queries transit through third-party domains that may observe search data. The extension is published by FREE VPN PLANET SRL, which also offers other extensions under investigation. The threat was reported to the Chrome Web Store and Google Safe Browsing on 2026-07-25.
ChatGPT is currently experiencing a worldwide connectivity outage affecting multiple regions including the U.S., Europe, India, Japan, and Australia. OpenAI has acknowledged the issue and is investigating. There is no indication this outage is due to a security vulnerability or exploit. The service disruption is impacting user access but no further technical details or attack vectors are provided.
This report describes the engineering challenges and solutions involved in building a zero-copy SQLite carver for the large NIST NSRL database within constrained CI environments. The project avoids using the SQLite engine by parsing raw B-tree binary formats streamed in memory, addressing disk and RAM limitations. Two key production issues were identified and resolved: ineffective compression of cryptographic hash outputs and CPU/IO contention caused by fixed parallelism on small CI runners. The solution includes splitting output into parts and dynamically adjusting concurrency based on available CPU cores. The approach enables efficient processing of a 425GB SQLite database on limited resources without security vulnerabilities or exploits reported.
This report describes a tool named RootHound that processes LinPEAS output to graphically map all privilege escalation paths from a low-privilege user to root on a Linux system. It is a demonstration of a local privilege escalation analysis utility, similar in concept to BloodHound but focused on Linux environments. The tool itself is not a vulnerability or exploit but rather a security assessment aid.
A threat actor used the open-source Hermes AI agent in unattended "YOLO" mode to automate post-exploitation activity during an alleged breach of Thailand's Ministry of Finance. [...]
This content discusses challenges in automated content discovery caused by false positives from wildcard DNS and catch-all responses. The author describes a method to reduce false positives by profiling false hits through repeated requests to nonsense paths, improving the accuracy of findings. This approach increases request volume, which may impact rate-limited targets. The discussion is based on a Reddit post linking to an open-source project but does not describe a specific vulnerability or exploit.
This announcement introduces an open-source External Penetration Testing Program Pack designed to help organizations scope, execute, and manage external penetration tests. The pack includes a preparation checklist, reporting requirements, and a process workflow to guide users through engaging with external penetration testers effectively. It aims to facilitate first-time penetration testing engagements and establish a repeatable process for future tests.
Microsoft says a bug in its automated network maintenance request system caused Thursday's massive outage by mistakenly removing IP routes from more devices than intended, disrupting Azure and Microsoft 365 services. [...]
Slopsquatting, phantom squatting, and HalluSquatting all exploit the same late-binding attack pattern, where AI coding agents trust hallucinated package, repo, or domain names. ActiveState explains how pre-fetch verification and governed dependency management can help stop these attacks before malicious code enters the pipeline. [...]
This report discusses a command-line tool designed to test human perception of lookalike domains generated by dnstwister. The tool rapidly displays domains to users to identify which lookalike domains are visually deceptive and likely to be mistaken for the original domain. It aims to assist cyber threat intelligence (CTI) efforts by prioritizing dangerous typosquatting or homograph domains based on human perception. There is no indication of an inherent vulnerability or exploit in the tool itself.
Europol has flagged 4,340 URLs for removal during a multi-week operation targeting online content linked to "The Com," a loosely organized network of nihilistic violent extremist groups. [...]
The company has raised a total of $49 million in funding, including from Battery Ventures, Accel and Foundation Capital. The post AegisAI Raises $36 Million for AI-Powered Email Security appeared first on SecurityWeek .
