Securityblog

There are 10 types of people in the world. Those who understand binary, and those who don't. All opinions and views are my own. #BsidesDub organizer

[International Cyber Digest @IntCyberDigest]

‼️ The alienation continues: more security researchers are sticking up the middle finger after feeling squeezed by Microsoft and GitHub. MSRC emailed Black Hat USA 2026 presenters asking which MSRC cases, VULN-IDs, or CVEs their talks would cover. GitHub told a researcher to delete his public PoC repos and flagged his accounts under ToS.

[0xor0ne @0xor0ne]

lang Hardening Cheat Sheet (2026 edition)

https://t.co/f451C7NKzV

By @0xTRIKKSS and @bcreusillet

#infosec

[Matt Johansen @mattjay]

MSRC couldn’t possibly do anything worse this week… oh. Oh ok.

[Zhenpeng (Leo) Lin @Markak_]

We helped FFmpeg find and fix 21 security vulnerabilities.

In a 1.5M-line codebase, we spent just $1K in API costs. Some of these bugs had been hiding for decades.

We also developed a PoC demonstrating an RCE primitive when FFmpeg processes RTSP streams.

Full write-up: https://t.co/mIrjirCgcB

[Source Defense Research @sdcyberresearch]

#Magecart alert
Hidden img ng-on-error reused a CSP nonce to load npm.clickcdn01[.]net, opened WebRTC to 85.17.55[.]137, injected a pixel-perfect fake @2c2p #payment form, and exfiltrated card data over WebRTC.

#DataBreach #PCIDSS #ClientSideSecurity #WebSkimming #eSkimming #FormJacking

[Wiz @wiz_io]

🚨 Our CIRT and Research teams uncovered JINX-0164, a threat actor targeting crypto organizations.

A single LinkedIn message can lead to malware, CI/CD compromise, stolen crypto, and supply chain attacks.

Read more: https://t.co/SBTWQYCjWK

[Dark Web Informer @DarkWebInformer]

‼️ SSRF to Root: Unauthenticated File-Write Flaw in Cisco Unified CM (CVE-2026-20230)

https://t.co/mlMlfDBDlL

[0x12 Dark Development @Salsa12__]

Bring Your Own RWX Region DLL (BYORWXDLL)

New Medium post, today we are exploring a technique I call Bring Your Own RWX Region DLL, inspired by the well-known BYOVD (Bring Your Own Vulnerable Driver)

https://t.co/slNKv9qF4W

[OX Security @OX__Security]

🚨 BREAKING: Miasma is back.

The Shai-Hulud variant has returned to npm, impacting 57 packages with a combined 647K+ monthly downloads.

⚠️ GitHub token theft
⚠️ Cloud credential theft
⚠️ npm account compromise
⚠️ 118+ infected GitHub repos

Full technical analysis to come — follow @OX__Security for updates

#CyberSecurity #SupplyChainSecurity #AppSec #npm #OpenSource

[Michael Weber @BouncyHat]

We think of WASM as a mechanism to run compiled code in your browser, but what if we shimmed in all the host APIs necessary to run full implants with ALL logic entirely in the WASM VM? This post walks through what that looks like.
https://t.co/xGVpPe2zyC

#wasm #malware #sliver

[Managed IT Services @itdotie]

🚨 Cybersecurity Alert: The HSE is experiencing IT disruption today due to a ransomware attack on an external vendor. The health service itself wasn't directly targeted, proving once again that your security is only as strong as your weakest third-party link. Read more: https://t.co/cebf46722b

#Cybersecurity #hse #ransomware #cyberattack #nis2 #3rdPartyRisk

[Eimer McAuley @eimer_mcauley]

HSE computer systems down after cyberattack on third party that stores data https://t.co/K1t2rMqvl7

[blackorbird @blackorbird]

The attackers demonstrated strong operational security and evasion discipline during a 5-month campaign focused on stealing an executive’s Outlook mailbox.
Their primary goal was to remain undetected by minimizing noise, blending with legitimate activity, and avoiding common detection triggers.

[International Cyber Digest @IntCyberDigest]

❗️Google employees are flooding an internal meme board with posts about how bad the company's AI is.

A source says dozens of anti-AI memes post weekly, spiking when models update or their internal coding tool Jetski breaks. One showed Jetski admitting it fabricated report metrics with over 400 upvotes.

Engineers say AI removed the code-gen bottleneck but jammed everything else: testing, build times, and human review now drowning in code nobody wrote.

CEO Pichai says 75% of new code is AI-generated, btw.

Via 404Media

[Cyber_OSINT @Cyber_O51NT]

Flashpoint reports that XSS, once a unified Russian-speaking cybercrime hub, fractured into competing factions after a July 2025 takedown, with DamageLib, Rehub, XSS[.pro], and XSSF emerging. https://t.co/CZaoIw85fW

[Renzon @r3nzsec]

IRFlow Timeline v1.0.7 is live.

This one focuses on a problem I think DFIR teams will see more often: AI assistant usage becoming part of the investigation surface.

You can now collect and normalize local AI usage history from tools like Claude Code, ChatGPT Desktop, Cursor, GitHub Copilot, OpenAI Codex, Gemini CLI, Continue, Windsurf, and Claude Desktop into a unified timeline view.

Also added AI Secret Hunt, which helps identify secrets, tokens, API keys, private keys, and credentials that may have been pasted into AI assistants during real investigations or day-to-day engineering work.

The goal is simple: make AI app activity easier to preserve, search, tag, and correlate during incident response. AI usage is becoming part of the forensic record. We need tooling that treats it that way.

Link in the comment ⬇️

#DFIR #IncidentResponse

[blackorbird @blackorbird]

#Gamaredon
This report analyses over a decade of malware families and establishes a unified naming taxonomy to cut through the fragmented nomenclature.
1:
https://t.co/pjywWtlIkQ
2:
https://t.co/fKcZ0hSaEf
3:
https://t.co/vcMDWqD47S

[JAMESWT @JAMESWT_WT]

"Re: Family Room Reservation"
fake #booking spam email

⛔️https://haddjskak827sja.]com/v
drop zip > lnk
👇
drop genuine node-v24.13.0-win-x64. zip
👇
tonajukbhuakpo2.]shop

Samples
https://t.co/7BiTfkUY8d

[zhero; @zhero___]

New short article on a real-world exploitation case rather than pure research, demonstrating how a specific mistake in Next.js can lead to a systematic zero-click SXSS on its latest versions (w/@inzo____):

Re:CACHE - Excessive reflection, type confusion, and 0-click SXSS on Next.js

https://t.co/0JWjH6yzC2

[Co11ateral @co11ateral]

Using Nezha RMM as C2 - No Detection

Earlier we spoke on this issue. RMMs are dangerous when not monitored. Here is an example of Nezha that doesn't trigger any AV alert and works really well if abused by hackers. The victim won't even see anything suspicious when hackers connect to their computer. We also showed the forensic artifacts it might leave.

So, you better monitor them all

Learn more: https://t.co/8np8jXJkF0

RMMs to monitor: https://t.co/CtFNVxjnlM

@three_cube @_aircorridor #blueteam #redteam #apt