CyberRevealed | Cyber Intel | OSINT

CISSP | CISM OSINT • Threat Intel • AI Security • Real-World Threats

Free Cloud Security Scorecard

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

I built a free, interactive Cloud Security Posture Scorecard and I want you to use it.

One of the most common gaps I see isn't a lack of tools.Teams don't always know what to check, where to check it, or why it matters.

So I built something to fix that.

It's nothing crazy . its straightforward consisting of specific controls I have seen most people have issues with. That are also really important and a good foundation for a secure cloud environment.

The Cloud Security Posture Scorecard is a free, interactive self-assessment tool that walks you through 36 security controls across 6 domains Identity & Access, Network Security, Data Protection, Compute, Logging & Monitoring, and Governance.

What makes it different:
✅ Works for Azure, AWS, and GCP select your provider and get platform-specific verification steps for every single control

✅ No fluff every control tells you exactly where to go in your console to verify it

✅ Weighted scoring not all controls are equal. MFA and SIEM are weighted higher than tagging standards. The score reflects real risk

✅ No account needed, no data collected open it, assess your environment, close it

Whether you're a cloud engineer doing a quick gut check, a security practitioner preparing for an audit, or a manager trying to understand your team's posture this tool was built for you.

Try it here

https://t.co/uHqhNWJdNj

Coming in the next release:
PDF Report Export: generate a full assessment report you can hand to your CISO or auditor

Evidence Collection : document what you found for each control, creating an audit-ready paper trail behind every pass/fail

More features in the pipeline.

I hope this could be something helpful for you.

Drop your feedback in the comments what would make this more useful for your team?

#CloudSecurity #CyberSecurity #Azure #AWS #GCP #Security #CSPM #BlueTeam #Amazon #google #Microsoft #cybersecurity #cloud #posture

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

Attackers are using trusted IT remote access tools to compromise customer environments.

Huntress has reported at least 288 affected endpoints across 48 organizations in an active ScreenConnect campaign.

The attackers are abusing access to ScreenConnect management panels to deploy unauthorized remote access clients. Those clients can provide persistent access even if the original management session is revoked.

What concerns me most is the potential for lateral movement through trusted IT support relationships. A technician connecting to a compromised endpoint may also become a target.

ConnectWise has disabled five third party extensions as a precaution, but the initial access method is still under investigation. There is no confirmed new ScreenConnect software vulnerability behind this campaign.

For security teams, I would prioritize reviewing Run Command history, administrative sessions, extension installations, unexpected remote access clients, and technician workstation activity.

Also remember that disabling a vulnerable integration or resetting an account does not automatically remove persistence already installed on endpoints.

Trusted administrative access is powerful. That's exactly why it needs stronger monitoring, restricted permissions, and continuous validation.

#CyberSecurity #ScreenConnect #IncidentResponse #CyberRevealed

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

AI assisted offensive security tools are no longer just a research discussion. We're seeing infrastructure running these frameworks associated with real intrusions.

Arctic Wolf recently documented malicious activity involving AntiFox, an open source agentic penetration testing platform. The observed activity included web application exploitation, webshell deployment, AWS credential use, and access to production secrets.

One case involved attackers making hundreds of AWS API requests across multiple identities within roughly 30 minutes. While many requests were denied, some succeeded.

AWS emphasized that its infrastructure was not compromised. The attackers used credentials obtained from customer applications.

That distinction matters.

From a cloud security perspective, the attack demonstrates how application security, secrets management, and cloud IAM are interconnected.

If an application is compromised and contains usable cloud credentials, an attacker may be able to move from the application layer into cloud resources without exploiting AWS itself.

The addition of AI driven tooling can help automate discovery, validation, and repeated requests, potentially reducing the time defenders have to respond.

What I would prioritize:

1. Eliminate long lived cloud credentials embedded in application configuration wherever possible.

2. Use workload identities and tightly scoped IAM roles instead of unnecessary static access keys.

3. Correlate webshell or application compromise indicators with CloudTrail events and unusual AWS API activity.

4. Investigate bursts of denied API calls followed by successful access to sensitive resources.

5. Monitor Secrets Manager, S3, and privileged role activity, and revoke compromised sessions and credentials quickly.

The lesson isn't that AI has suddenly made traditional security controls irrelevant.

It's that organizations need stronger visibility across application security and cloud identity, especially as attackers automate more of their workflows.

#CloudSecurity #AISecurity #AWS #IAM #CyberSecurity

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

A critical Apache HTTP Server vulnerability deserves attention from teams managing internet facing web infrastructure.

CVE-2026-119618 affects Apache HTTP Server versions 2.4.55 through 2.4.70 when the vulnerable HTTP/2 module is enabled.

The flaw can potentially allow unauthenticated remote code execution. Apache released version 2.4.71 to address it.

One important detail: not every Apache installation is affected. Exposure depends on the HTTP/2 configuration and the specific vendor package. Linux distributions may also provide backported fixes without changing the upstream Apache version number.

Security teams should identify affected deployments, review HTTP/2 configuration across virtual hosts, and apply the appropriate vendor security update.

Where immediate patching isn't possible, disabling HTTP/2 may be a temporary mitigation after testing application compatibility.

Public exploit availability has been described differently by security researchers, and confirmed exploitation in the wild has not been established in the reporting reviewed.

This is another example of why vulnerability management needs asset visibility and configuration context, not just a CVE score.

#Apache #AppSec #VulnerabilityManagement #CyberRevealed

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

@MMAJOEYC They probably paid to promote a feature. I'm pretty sure that feature on android phones. Wasn't always there.

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

@PromiseOfStorms @DreamLi84160429 @SandBag_King @SStricklandMMA Lol

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

@anmol_rerato Yah. As I stated in the post.

Use dedicated identities, least privilege, isolated execution environments, network restrictions, and approvals for sensitive actions.

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

Microsoft researchers demonstrated something concerning about AI agent security.

By modifying fewer than ten neurons in a model, they were able to introduce a hidden trigger that could cause an AI agent to execute an attacker’s command while otherwise behaving normally.

The important distinction is that this was security research. Microsoft has not observed attackers using this specific technique in the wild.

What stands out to me is that traditional testing may not be enough. A model could behave normally during evaluations and still contain hidden behavior that activates under particular conditions.

For organizations deploying AI agents, this introduces another supply chain risk. We need to verify where models come from, protect model artifacts, audit changes, and monitor what agents actually do at runtime.

Most importantly, an agent should never have unrestricted access simply because we trust the model.

Use dedicated identities, least privilege, isolated execution environments, network restrictions, and approvals for sensitive actions.

AI model security and agent authorization are two different problems. We need to address both.

#AISecurity #CyberSecurity #AgenticAI

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

@anmol_rerato Absolutely. Trusting the model is not a control.

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

شركة SAP أصدرت تحديثات أمنية لأربع ثغرات خطورتها 10 من 10، وبعضها ممكن يسمح بتنفيذ أوامر عن بعد أو تجاوز تسجيل الدخول.

إحدى الثغرات، CVE-2026-120017، بتأثر على خدمة SAML 2.0 ببعض أنظمة SAP NetWeaver، وممكن تسمح للمهاجم بانتحال هوية مستخدمين، حتى أصحاب الصلاحيات العالية.

الشي المهم هون إنو استخدام SAML لتسجيل الدخول الموحد مو معناته إنو التطبيق صار آمن بشكل تلقائي.

البروتوكول ممكن يكون آمن، بس طريقة تطبيقه والتحقق من الهوية هي اللي بتحدد مستوى الحماية.

الشركات لازم تحدد الأنظمة المتأثرة، وتطبّق تحديثات SAP، وتراجع الواجهات المكشوفة وسجلات تسجيل الدخول.

وبرأيي لازم فريق إدارة الهوية IAM يشتغل مع مسؤولي أنظمة SAP لمعالجة المشكلة، لأنو ثغرات المصادقة مو بس مسؤولية فريق البنية التحتية.

التحديثات متوفرة، وما في تأكيد باستغلال هالثغرات الأربع بالهجمات حسب التقارير اللي راجعتها.

#الأمن_السيبراني #SAP #IAM

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

SAP released security fixes for four vulnerabilities rated CVSS 10.0, including remote code execution and authentication bypass risks.

One of the issues, CVE-2026-120017, affects the SAML 2.0 service provider in certain SAP NetWeaver configurations and could allow attackers to impersonate users, including privileged accounts.

This is particularly important because organizations often assume that implementing SAML SSO automatically means the application authentication process is secure.

SAML is a protocol. Its security still depends on how the service provider validates authentication and enforces trust.

Security teams should identify affected SAP components, apply the relevant vendor patches, review exposed interfaces, and investigate unusual authentication activity.

I would also make sure the IAM team and SAP application owners coordinate on remediation. Authentication vulnerabilities aren't always just an infrastructure problem.

The patches are available, and there was no confirmed exploitation of these four vulnerabilities in the reporting reviewed.

#SAPSecurity #IAM #CyberSecurity

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

النموذج ممكن يشتغل بشكل طبيعي ويمر من الاختبارات، بس لما يظهر شرط معين، وكيل AI المرتبط فيه ممكن ينفذ أمر المهاجم.
بس لازم نوضح إنو هاد بحث أمني، وMicrosoft قالت إنو ما رصدت مهاجمين عم يستخدموا هالطريقة فعلياً.

الشي المهم بالنسبة إلي إنو نجاح النموذج بالاختبارات مو دليل كافي إنو آمن بكل الظروف.

إذا الشركات بدها تستخدم وكلاء ذكاء اصطناعي، لازم تتأكد من مصدر النماذج، وتحمي ملفاتها من التعديل، وتراقب العمليات اللي الوكلاء بينفذوها.

والأهم، ما لازم نعطي وكيل AI صلاحيات مفتوحة بس لأنو منثق بالنموذج.

كل وكيل لازم يكون إله هوية مستقلة، صلاحيات محدودة، وبيئة تشغيل معزولة، مع موافقات للعمليات الحساسة.

حماية نموذج الذكاء الاصطناعي وحماية الصلاحيات اللي منمنحها للوكيل شغلتين مختلفتين، ولازم نهتم بالتنتين.

#الأمن_السيبراني #الذكاء_الاصطناعي

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

What it need in my opinion is better language support for speech to text. Including different dialects.

Google speech to texts has been far superior in my use cases.

One UI 9.5 leak reveals two Samsung Keyboard AI features https://t.co/3ohp2sr40L

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

ممكن ينسرق حسابك عالواتساب من دون ما حدا يخترق موبايلك!

النصّاب ممكن يخدعك لتبعتله رمز التحقق، أو لتربط جهازه بحسابك. وبعدها ممكن يستخدم حسابك ليبعت رسائل لأصحابك ويطلب منهم مصاري.

بالحلقة الثالثة من سلسلة التوعية بالأمن السيبراني باللهجة السورية، بشرح كيف بتصير هالعمليات وشو لازم تعمل لتحمي حالك.

لا تعطي رمز التحقق لأي حدا، فعّل التحقق بخطوتين، وراجع الأجهزة المرتبطة بحسابك.

شارك الفيديو، لأنو الوعي الرقمي بيحمينا كلنا.

#سوريا #الأمن_السيبراني #السعودية #مصر #قطر #عربي

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

@AdamJMatlock @Official_Cavil Wasn't he only fired as the head but he will still be directing right? I don't think they'll actually be starting over again

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

@ThePhoneFuel Ok I thought that might be the case. Thanks

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

مو كل رسالة بتوصلك باسم البنك أو شركة تحويل الأموال بتكون حقيقية!

النصّابين ممكن يبعتولك رسالة بتقلك إنو حسابك توقف، أو يتصلوا فيك ويطلبوا رمز التحقق بحجة حماية حسابك.

لا تكبس عالروابط المشبوهة، ولا تعطي كلمة السر أو رمز التحقق لأي حدا.

بالحلقة التانية من سلسلة التوعية بالأمن السيبراني باللهجة السورية، منحكي عن طرق الاحتيال المالي وكيف نحمي حالنا وأهلنا منها.

شوفوا الفيديو وشاركوه. معلومة بسيطة ممكن تحمي مصريات حدا.

#سوريا #الأمن_السيبراني #CyberRevealed
#لبنان #قطر #السعودية

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

Google DeepMind researchers used AI agents alongside human cryptographers to improve methods for attacking legacy RSA 1024 cryptography.

In one controlled experiment, they reduced the computational cost of a particular signature forgery attack by approximately 3.5 times. They also developed a theoretical approach that could reduce the marginal cost of factoring multiple RSA 1024 keys.

This does not mean RSA 2048 has been broken or that modern encryption is suddenly unsafe.

What interests me is how AI can accelerate specialized security research, including areas that previously required substantial human effort and computational resources.

For organizations, the practical lesson is to inventory cryptographic assets, identify legacy RSA 1024 usage, and plan migration to supported algorithms and key sizes.

AI is changing how we evaluate security assumptions. That doesn't mean every research breakthrough is an immediate real world attack.

#AISecurity #Cryptography #CyberSecurity #CyberRevealed

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

Google has patched another actively exploited Chrome vulnerability, CVE-2026-125350, bringing the total to eight exploited Chrome zero days addressed in 2026.

The vulnerability involves a use after free issue in Chrome's XML component. Google confirmed an exploit exists in the wild, but has not disclosed the attack details or who is responsible.

For security teams, this is a reminder that browser patching should be treated as a priority, not routine maintenance.

Update Chrome, verify that endpoints actually receive the update, and make sure users restart their browsers to activate the patched version.

Organizations using Edge, Brave, or other Chromium browsers should monitor their respective vendor updates as well.

A patch being available doesn't mean the vulnerability is remediated across your environment. Verification is what closes that gap.

#CyberSecurity #Chrome #VulnerabilityManagement #CyberRevealed

[CyberRevealed | Cyber Intel | OSINT @CyberRevealed]

A cloud vendor doesn't need to compromise your AWS account directly to expose your environment.

Wiz researchers reported that attackers abused trusted AWS access associated with Qubole to reach multiple customer accounts. They assumed IAM roles and accessed AWS Secrets Manager, SSM Parameter Store, Lambda environment variables, and S3 data.

One detail stands out to me: some of the roles were no longer actively used, but the trust relationships were still in place.

This is exactly why third party access needs continuous review. An IAM role with an External ID is not automatically secure if the trusted vendor account is compromised. External IDs help prevent confused deputy attacks, but they are not authentication secrets.

Security teams should inventory external IAM trust relationships, remove unused roles, restrict permissions, review CloudTrail AssumeRole activity, and ensure S3 data events are available when investigating access.

If credentials or secrets were exposed, rotate them based on the investigation.

The takeaway is simple. Your cloud security posture depends on more than your own identities. It also depends on every external identity you've chosen to trust.

#CloudSecurity #AWS #IAM #CyberRevealed