Mewt, an open-source mutation-testing engine, now supports DAML smart contracts by deliberately injecting code flaws to expose gaps in test suites that traditional coverage metrics miss. The tool includes two DAML-specific mutations targeting authorization vulnerabilities—the most common bug class in contract development—and can identify missing security tests even when coverage reports show 100%. Early testing on production codebases revealed that standard happy-path tests often fail to verify negative cases like unauthorized party actions, leaving exploitable vulnerabilities undetected.
Cyber threat actors are executing a coordinated campaign that delivers both the Vidar infostealer and XMRig cryptocurrency miner to compromised systems. The dual-payload approach combines data theft capabilities with unauthorized cryptographic resource consumption, targeting victims' sensitive information and computing resources simultaneously.
A suspected Chinese threat group is actively exploiting Roundcube vulnerabilities to breach university networks across the US and Canada with the goal of harvesting user credentials. The campaign targets higher education institutions, leveraging weaknesses in the popular webmail platform to gain initial access to sensitive academic and research environments.
The UK government has launched a Cyber Resilience Pledge with over 60 organizational signatories including major companies like M&S, Microsoft UK, and Vodafone. The initiative is designed to strengthen cyber security and resilience practices across British businesses.
Threat actors are actively exploiting a critical Adobe ColdFusion vulnerability with a maximum CVSS severity score of 10.0. Organizations running ColdFusion should prioritize patching this flaw immediately given the active exploitation and highest possible severity rating.
Check Point researchers have identified a new Iran-linked hacking group tracked as Cavern Manticore that is actively targeting Israeli government and IT sector organizations. The discovery adds to the growing threat landscape of state-sponsored cyber operations in the region, highlighting ongoing geopolitical tensions manifesting through cyber espionage and attack campaigns.
Zscaler researchers have identified a new attack vector where malicious actors embed prompt-injection code within web content to compromise AI agents and force them into unauthorized cryptocurrency transactions. This indirect injection technique exploits the way AI systems process and act upon instructions embedded in web pages they access, representing a novel threat to automated AI agent deployments.
A vulnerability in Opera GX allowed malicious websites to automatically install browser modifications capable of stealing data from other pages users visited, potentially compromising sensitive information across multiple sites. The flaw has been patched, addressing the threat posed by this unauthorized mod installation vector.
Researchers have identified JadePuffer as the first fully agentic AI-powered ransomware campaign, demonstrating how autonomous agents can orchestrate and automate cyber-attack operations with minimal human intervention. This discovery underscores an emerging threat landscape where AI agents are being leveraged to streamline ransomware deployment and potentially increase attack sophistication and scale.
HackTheBox - DevArea
IppSec·6K views · 1 month ago
00:00 - Introduction
00:45 - Start of nmap, discovering an open FTP Server, downloading the jar file.
04:45 - Using JadX to decompile the jar and then look at it in VSCode with Snyk, have to install Maven to see CVE's based upon libraries
11:00 - Looking into Apache CXF CVE's
15:40 - Using SoapUI to analyze the WSDL for us and make the request
19:15 - Showing we need to use the multipart/related functionality of HTTP in order to exploit this
23:20 - Have a File Disclosure, bruteforcing /proc/$pid/cmdline to get a list of running processes (which has hoverfly credentials). Then showing we could read directories from a File Disclosure which is somewhat unique to java. But this eliminates a lot of the bruteforce.
29:00 - Discovering a CVE within Hoverfly that gets us RCE
33:00 - Shell as dev_ryan
35:30 - Enabling commandline in SSH so we can do ~C in order to setup the SSH Tunnel to 7777 without exiting ssh
37:40 - Finding the secret syswatch uses to sign cookies, then giving ourself access to the applicaiton
42:10 - Finding command injection with syswatch, have to evade the filter, can use characters but not uppercase which breaks base64. Using xxd so we can have a hex cradle to get a shell
52:00 - Script we can execute as cron blocks symlinks but does not traverse them, doing a double symlink can evade the next filter and we can read files as root, reading the SSH Private Key.
Qilin has emerged as the dominant ransomware-as-a-service operation as the cybercriminal landscape undergoes consolidation around major players. This shift represents a significant realignment in the ransomware market, with larger operations gaining prominence over the fragmented threat ecosystem that existed previously.
The FBI and Google have successfully dismantled the NetNut proxy network, which threat actors exploited for malicious purposes. The operation targeted infrastructure connected to the Popa botnet, which had been distributing Mirai DDoS botnet variants to infected devices.
Fable 5 is back.....run these prompts before July 12th
NetworkChuck·179K views · 1 month ago
Fable 5 — the most powerful AI on earth — got pulled offline by the U.S. government three days after it launched, and it just came back. But for most of us the free window is only a handful of days (through July 7). So I sat down with Daniel Miessler, who's already living inside that window, to figure out the one thing that actually matters: what's worth asking it before it's gone.
This isn't about doing bigger tasks. It's about pointing maximum intelligence at your deepest systems — your AI harness, the security of everything you've shipped, and the single hardest question about what you're actually building toward — so the payoff outlasts the window. Think of it like a super-intelligent alien that can only help for a week: you don't send it on errands, you have it rebuild your roads.
In this video, you'll learn Daniel Miessler's exact list of meta-prompts to run on Fable 5: how to improve the harness that governs all your AI, how to audit the full attack surface of everything you've deployed, and how to ask the model to tell you what you're really shooting at. Whether you're deep into AI already or just trying not to waste the most capable model on earth, this is the prompt playbook for the week Fable is back.