A vulnerability in Ruby on Rails versions 8.1.0 through 8.1.4 allows unauthenticated attackers to spoof the client IP address via the Forwarded HTTP header. This occurs because Rails trusts the Forwarded header by default, which can be manipulated if a reverse proxy does not remove or overwrite client-supplied Forwarded headers. This spoofing can bypass IP-based access controls, rate limits, and falsify client IP information in logs.
The 2026 VulnCheck Exploit Intelligence Report analyzes vulnerability exploitation trends in 2025, distinguishing between 'weaponized' and 'exploited' CVEs. 'Weaponized' CVEs refer to vulnerabilities for which exploit code or tools have been developed and made available, while 'exploited' CVEs are those actually used in attacks in the wild. The report highlights that only about 1% of disclosed vulnerabilities were exploited, but those exploited caused significant impact. It also discusses the rise of AI-generated exploit code increasing noise in risk assessments and the evolving tactics of threat actors, including ransomware groups and nation-linked actors. The report aims to help organizations prioritize real threats over misleading signals.
This content summarizes Snapchat's data retention and deletion policies for Snaps and Chats. Snaps and Chats are generally deleted automatically after viewing or expiration, with configurable retention settings. Content shared with Snapchat's AI is stored until deleted by the user, and public Topic Chats are retained for five years. Users can save or delete messages, which affects retention. Snapchat warns that recipients can save messages via screenshots or other capture methods. No direct security vulnerability or exploit is described.
This content discusses the cybersecurity challenges introduced by AI-generated code, including rapid code generation outpacing human review, unreliable runtime threat detection due to limited observability, and slow patching processes. It proposes a visual programming language called Pipe as a solution to improve code review, observability, and patching speed by enabling visual logic representation and runtime observability. The discussion is conceptual and does not describe a specific vulnerability or exploit.
CVE-2026-122192 is a vulnerability in Firecracker versions 0.23.0 through 1.16.1 that allows a root user in a guest VM to read or modify memory of the Firecracker process on the host. This occurs when restoring VMs from snapshots using the File memory backend with a balloon or virtio-mem device, due to a failed memory remapping operation that leaves stale host virtual address references. The issue is fixed in Firecracker versions 1.16.2 and 1.17.0 and later. AWS Lambda and other AWS services are not affected. No customer action is required for AWS-managed services.
Aegis Latent Core is a tamper-evident evidence chain designed to secure AI interaction logs by hash-chaining and signing each event before delivery. It aims to help blue teams detect post-collection tampering of AI traffic logs, preserve forensic artifacts, and support compliance with AI traceability regulations. It does not prevent or detect endpoint compromise or guarantee client honesty, as it starts at the collector. The system is intended as an additional evidence layer rather than a SIEM replacement or producer attestation mechanism.
This content discusses the concept of Insecure Direct Object Reference (IDOR) vulnerabilities, emphasizing that simply changing an object ID in a request does not conclusively prove an IDOR exists. It highlights the importance of verifying whether the resource belongs to another user, if authorization checks are enforced, and if unauthorized access violates the application's intended access control policy. The discussion is educational and references PortSwigger's materials on access control vulnerabilities.
An independent security assessment of Pax Historia revealed multiple security weaknesses, including large-scale exposure of Firestore data and issues with production API authorization. The assessment identified over 1,000,200 accessible user profile documents and verified all tested claims. The researcher contacted the company with a 10-day response window but received no official reply. Some technical details were withheld to protect users and prevent misuse.
This is an announcement for an upcoming Ask Me Anything (AMA) event featuring Mike Kosak, Director of Threat Intelligence and Response at LastPass. The event will focus on the evolving role of AI in cybersecurity, discussing AI-driven threats, how attackers use AI, and related topics. No specific vulnerability or threat is described.
The Greeter attack framework targets Flowise, an AI development platform, by exploiting a vulnerability (CVE-2024-58351) in its runtime configuration mechanism. Attackers send numerous benign-looking "hello" messages that carry malicious JavaScript commands via the overrideConfig parameter, enabling remote code execution without altering the saved chatflow. This allows attackers to perform host reconnaissance, credential and cloud metadata harvesting, persistence attempts, and fileless execution preparation. The attack was observed on exposed Flowise instances, including unauthenticated and vulnerable deployments, highlighting risks of AI applications as entry points into cloud environments.
In April 2026, a security incident occurred on Taiwan High Speed Rail's (THSR) TETRA mission-critical radio network when a student maliciously transmitted an unauthorized emergency alarm message. This caused several trains to halt temporarily. The attack exploited fundamental authentication flaws in the TETRA network, including lack of message-level authenticity and integrity guarantees and absence of re-authentication during roaming. The attacker cloned a legitimate radio identity using parameters obtained via software-defined radio captures and insider assistance. The incident demonstrated the feasibility of disrupting critical infrastructure operations through relatively simple radio network attacks.
This is a research dashboard providing dated evidence and detailed case studies on global cyber incidents across multiple sectors including critical infrastructure, finance, healthcare, and AI. It compiles 18 incident dossiers with evidence classifications, source links, and tools for infrastructure dependency analysis and emergency preparedness. The dashboard is a static snapshot as of November 2, 2026, and is not a live alerting service.
Two incidents involving 'prompt_attack' errors were detected at a healthcare company using third-party platform looplabs.run. The issue arose when open source plugins like SuperPowers and BMAD automatically injected coercive instructions into user prompts sent to a large language model (LLM), causing the platform to block these prompts. The injected text included phrases such as 'YOU DO NOT HAVE A CHOICE. YOU MUST USE IT. This is not negotiable,' which triggered the enforcement mechanism. This behavior was initially misunderstood as a platform error but was traced to the plugin-injected prompt content.
Multiple TLS vulnerabilities were discovered in the GoAhead embedded web server, notably a critical flaw where revoked client certificates are accepted due to revocation checking being disabled despite loading a revocation list. This affects builds using the OpenSSL backend with mutual TLS enabled. Additional issues include a certificate chain length bypass in LibreSSL builds and a weak Diffie-Hellman key exchange in Mbed TLS builds. GoAhead 6.1.1, released August 2, 2026, fixes these issues. The vulnerabilities impact device makers who embed GoAhead in firmware for routers, printers, and industrial controllers. No known exploitation has been reported as of October 27, 2026.
TheLeaf Threat Observatory operates honeypot sensors that mimic common internet services such as WordPress, Tomcat, phpMyAdmin, SMTP, Telnet, and RDP to capture unsolicited traffic and automated probing attempts. These sensors collect data on login attempts, credential guessing, and exploitation probes, publishing categorized observations with a delay. The project aims to provide real-world insight into automated scanning and attack techniques without enabling actual exploitation or access. It serves as an educational and research tool rather than a direct threat or vulnerability.
This content discusses the concept of Identity-Defined Reachability (IDR), a security model aimed at aligning service reachability strictly with current authorisation states. It addresses the challenge where network reachability, identity policy, and application permissions often become unsynchronized, potentially leaving services reachable even after authority is revoked. IDR proposes that a usable path to a protected service exists only while the relationship is authorised, verified cryptographically, and contextually valid. The model builds on Zero Trust principles and aims to reduce exposure and connectivity friction, especially in environments with rapid changes driven by AI and distributed applications. The discussion highlights practical difficulties such as shared connections and legacy systems that complicate enforcement. This is a conceptual and strategic discussion rather than a report of a specific vulnerability or active threat.
This analysis covers a Horus Loader 64-bit Windows loader sample linked to the Stealth Falcon campaign and CVE-2025-33053. The loader employs techniques such as IP obfuscation, WebDAV execution, and integrates with the Mythic command and control (C2) framework. It performs clean kernel32/ntdll mapping, security process checks, IPv6 payload reconstruction, and injection into suspended msedge.exe processes.
The Slaiclind campaign uses blockchain smart contracts as covert communication channels to deliver malicious payloads. Attackers embed scripts in compromised websites that query a Polygon blockchain smart contract to retrieve URLs hosting malicious JavaScript. This technique, called EtherHiding, replaces traditional command-and-control infrastructure with blockchain storage, making detection and takedown more difficult. The campaign also employs a kill-switch mechanism controlled via the smart contract. The malicious JavaScript then uses the ClickFix technique to trick users into executing commands, advancing the infection.
In May 2026, a critical security incident was reported involving the Bash project infrastructure. An attacker exploited a vulnerability allowing code execution via a crafted email address, escalating privileges to superuser, impersonating the Bash maintainer, and gaining push access to the upstream Bash repository. Further exploitation of an unpatched kernel vulnerability granted root access and control over a GNU backup server. The incident was responsibly disclosed to the Free Software Foundation (FSF) and documented in an FSF incident report.
/r/netsec's Q4 2026 Information Security Hiring Thread is a community post on Reddit inviting companies to share open information security job and internship positions with the /r/netsec user base. It serves as a platform for recruiting cybersecurity professionals and students nearing graduation.