Researchers have identified a novel OAuth Client ID spoofing technique that allows attackers to spoof OAuth Client IDs within Microsoft Entra ID to gain unauthorized access to cloud environments. This attack method provides adversaries with a stealthy mechanism for infiltrating cloud infrastructure, representing a significant threat to organizations relying on Entra ID for authentication and authorization.
Progress Software has warned customers of an external security threat affecting ShareFile and is instructing them to shut down servers hosting the Storage Zone Controller component. The advisory indicates a potential compromise to the widely-used file-sharing and data storage platform, though specific attack details and remediation steps beyond the shutdown directive were not disclosed.
Trail of Bits has released a comprehensive Testing Handbook chapter on security testing for Rust programs, covering dynamic analysis tools (Miri, proptest, coverage measurement), static analysis with Clippy, memory zeroization techniques, and specialized testing approaches like model checking with Kani. The chapter also documents common Rust security gotchas discovered during real audits and introduces rust-review, a Claude Code plugin for automated Rust security reviews that targets over a dozen vulnerability classes including memory safety, concurrency hazards, and FFI issues.
Cybersecurity agencies from 12 countries have issued a joint advisory warning that Russian state-backed hackers are actively exploiting vulnerable routers worldwide, leveraging weak SNMP credentials to gain access. The coordinated alert highlights a widespread campaign targeting infrastructure that often receives lower security attention than other network assets.
An Armenian man extradited from Ukraine has pleaded guilty to charges related to his involvement in the Ryuk ransomware operation. The case represents a significant development in law enforcement efforts against one of the more notorious ransomware groups that has targeted organizations globally.
The Australian Cyber Security Centre has issued a warning about widespread scanning and exploitation activity targeting content management systems globally. The campaign appears to involve mass reconnaissance efforts aimed at identifying and compromising vulnerable CMS installations across multiple organizations.
GreyNoise has launched a Threat Brief Library within its Visualizer platform, enabling users to access and manage curated threat intelligence reports including weekly At The Edge briefs and Executive Situation Reports. The library allows security teams to browse, search, filter, and download these briefs, which are generated from GreyNoise's primary-source sensor data for threat analysis and situational awareness.
HackTheBox - CCTV
IppSec·9.9K views · 1 month ago
00:00 - Introduction
00:40 - Start of nmap
03:00 - Logging into zoneminder with default credentials, flailing around trying to find the date this version was released
10:55 - Looking into the SQL Injection, lots of weird confusion around the date this was released... should of prepared more
13:30 - Getting this into SQLMap to test the injection, discovering it finds Time Based Blind which is really slow and unreliable
16:00 - Playing with the SQL Injection to get it to turn this into Boolean Based which is much better than time based
19:50 - Getting SQLMap to exploit this with boolean using prefix and suffix
24:10 - Cracking the password
30:00 - Got marks credentials, can login now
32:30 - Forwarding port 8765 back to us and accessing the MotionEye webserver, looking at configs and getting an admin password that lets us login
37:00 - RootPath1: Looking at public exploits, finding a command injection, testing it out and getting a shell
42:00 - RootPath2: Talk to the Web Control Port directly, poison that config and get command injection. Misspeak when i say camera, mean web control port
48:30 - Intended path to sa_mark, can tcpdump, capture packets get a credential and login
58:00 - Beyond Root: Using Claude to help me turn the blind injection into boolean.
CISA has disclosed its incident response procedures following the exposure of AWS GovCloud credentials and internal data in a publicly accessible GitHub repository. The agency's detailed account provides insights into how a government cybersecurity organization handles the discovery and remediation of compromised cloud infrastructure access and sensitive information.
Microsoft has identified a new malware called GigaWiper that functions as a multi-purpose backdoor capable of supporting both espionage and destructive operations. The malware's dual functionality allows attackers to conduct covert intelligence gathering before escalating to file-wiping attacks, combining reconnaissance and destructive capabilities in a single tool.
A remote code execution vulnerability in Windows HTTP.sys allows unauthenticated attackers to send specially crafted HTTP/1.x requests over TLS connections to trigger a kernel pool heap buffer overflow, potentially resulting in denial of service or arbitrary kernel-level code execution. The vulnerability stems from an integer overflow in the buffer reference array capacity field during HTTP header parsing, which can be exploited by encapsulating each header line in a separate TLS record to accumulate the required 65,536 buffer references. Microsoft patched this vulnerability in the June 2026 release cycle, and organizations can mitigate risk by keeping the MaxRequestBytes registry value at or below 65,535 bytes or deploying the vendor patch.
Researchers from the AI Now Institute have developed a proof-of-concept exploit demonstrating that security tools from major AI providers could potentially be weaponized by attackers. The findings suggest that common AI-based security tools may inadvertently create new attack vectors when misused, raising concerns about the dual-use nature of these platforms.
GodDamn ransomware leverages a remote desktop application to covertly traverse networks and deploy the PoisonX kernel driver, which disables cybersecurity protections on targeted systems. This combination of lateral movement and driver-based defense evasion represents an escalation in ransomware sophistication, allowing attackers to bypass security controls before executing their encryption payloads.
NIST is advancing nine new post-quantum signature algorithms toward standardization, but their timeline remains uncertain. Cloudflare argues that organizations should adopt ML-DSA immediately rather than wait for future candidates, as it represents the most mature and practical option currently available for post-quantum cryptography deployment.
Have you received an email from a recruiter at Adobe, Netflix, or OpenAI offering you an exciting new marketing role? Well, before you start brushing up your interview technique, take a closer look at who is really behind it. Read more in my article on the Hot for Security blog.
A survey by MetaCompliance reveals significant communication gaps between cybersecurity leaders and corporate boards, with three-quarters of CISOs concerned that executives lack understanding of the cyber risks threatening their workforce. The findings highlight a broader disconnect where many board members appear disengaged from the evolving nature of cybersecurity threats facing employees across their organizations.