A Bishop Fox researcher demonstrates that Claude can autonomously crack SonicWall's proprietary firmware encryption—a task previously requiring senior-level expertise—when provided minimal guidance and relevant artifacts. The experiment reveals significant implications for the trajectory of AI-assisted security research and the evolving relationship between human expertise and autonomous AI capabilities in vulnerability discovery.
A cybersecurity startup offering substantial payments for zero-day vulnerabilities is operated by individuals with convictions and a history of deceptive ventures, including fake intelligence firms and a defunct AI-based lobbying platform run under aliases. The operators are identified as far-right conspiracy theorists whose track record raises questions about how acquired vulnerabilities might be used and whether the startup's true intentions align with legitimate security research.
A Sygnia report reveals that threat actors leveraged agentic AI to dramatically accelerate a cloud-focused attack, compressing what would typically take weeks into a 72-hour compromise window. The findings highlight how autonomous AI systems are enabling attackers to execute reconnaissance, exploitation, and lateral movement at unprecedented speed, presenting a significant new threat vector for cloud environments.
Cyber threat actors are executing a coordinated campaign that delivers both the Vidar infostealer and XMRig cryptocurrency miner to compromised systems. The dual-payload approach combines data theft capabilities with unauthorized cryptographic resource consumption, targeting victims' sensitive information and computing resources simultaneously.
Mewt, an open-source mutation-testing engine, now supports DAML smart contracts by deliberately injecting code flaws to expose gaps in test suites that traditional coverage metrics miss. The tool includes two DAML-specific mutations targeting authorization vulnerabilities—the most common bug class in contract development—and can identify missing security tests even when coverage reports show 100%. Early testing on production codebases revealed that standard happy-path tests often fail to verify negative cases like unauthorized party actions, leaving exploitable vulnerabilities undetected.
A suspected Chinese threat group is actively exploiting Roundcube vulnerabilities to breach university networks across the US and Canada with the goal of harvesting user credentials. The campaign targets higher education institutions, leveraging weaknesses in the popular webmail platform to gain initial access to sensitive academic and research environments.
The UK government has launched a Cyber Resilience Pledge with over 60 organizational signatories including major companies like M&S, Microsoft UK, and Vodafone. The initiative is designed to strengthen cyber security and resilience practices across British businesses.
Threat actors are actively exploiting a critical Adobe ColdFusion vulnerability with a maximum CVSS severity score of 10.0. Organizations running ColdFusion should prioritize patching this flaw immediately given the active exploitation and highest possible severity rating.
Check Point researchers have identified a new Iran-linked hacking group tracked as Cavern Manticore that is actively targeting Israeli government and IT sector organizations. The discovery adds to the growing threat landscape of state-sponsored cyber operations in the region, highlighting ongoing geopolitical tensions manifesting through cyber espionage and attack campaigns.
Zscaler researchers have identified a new attack vector where malicious actors embed prompt-injection code within web content to compromise AI agents and force them into unauthorized cryptocurrency transactions. This indirect injection technique exploits the way AI systems process and act upon instructions embedded in web pages they access, representing a novel threat to automated AI agent deployments.
A vulnerability in Opera GX allowed malicious websites to automatically install browser modifications capable of stealing data from other pages users visited, potentially compromising sensitive information across multiple sites. The flaw has been patched, addressing the threat posed by this unauthorized mod installation vector.
Researchers have identified JadePuffer as the first fully agentic AI-powered ransomware campaign, demonstrating how autonomous agents can orchestrate and automate cyber-attack operations with minimal human intervention. This discovery underscores an emerging threat landscape where AI agents are being leveraged to streamline ransomware deployment and potentially increase attack sophistication and scale.
HackTheBox - DevArea
IppSec·6K views · 1 month ago
00:00 - Introduction
00:45 - Start of nmap, discovering an open FTP Server, downloading the jar file.
04:45 - Using JadX to decompile the jar and then look at it in VSCode with Snyk, have to install Maven to see CVE's based upon libraries
11:00 - Looking into Apache CXF CVE's
15:40 - Using SoapUI to analyze the WSDL for us and make the request
19:15 - Showing we need to use the multipart/related functionality of HTTP in order to exploit this
23:20 - Have a File Disclosure, bruteforcing /proc/$pid/cmdline to get a list of running processes (which has hoverfly credentials). Then showing we could read directories from a File Disclosure which is somewhat unique to java. But this eliminates a lot of the bruteforce.
29:00 - Discovering a CVE within Hoverfly that gets us RCE
33:00 - Shell as dev_ryan
35:30 - Enabling commandline in SSH so we can do ~C in order to setup the SSH Tunnel to 7777 without exiting ssh
37:40 - Finding the secret syswatch uses to sign cookies, then giving ourself access to the applicaiton
42:10 - Finding command injection with syswatch, have to evade the filter, can use characters but not uppercase which breaks base64. Using xxd so we can have a hex cradle to get a shell
52:00 - Script we can execute as cron blocks symlinks but does not traverse them, doing a double symlink can evade the next filter and we can read files as root, reading the SSH Private Key.
Qilin has emerged as the dominant ransomware-as-a-service operation as the cybercriminal landscape undergoes consolidation around major players. This shift represents a significant realignment in the ransomware market, with larger operations gaining prominence over the fragmented threat ecosystem that existed previously.