Cloudflare has integrated Cloudforce One threat intelligence directly into its WAF, enabling customers to automatically block high-risk traffic based on threat indicators in real time. Security teams can now leverage new cf.intel fields to create rules that target specific threat actors and protect against attacks aimed at their industry vertical.
00:00 - Introduction 00:55 - Start of nmap 02:30 - Discovering it is Camaleon CMS based upon the theme url 04:00 - Looking at the cookie to see it is likely a RAILS App 06:00 - Discovering /admin, enumerating valid usernames by how long a login takes 09:40 - Playing with Mass Assignment spots in the application, failing the first few 13:10 - Exploiting mass assignment from the password reset and setting role to admin 16:30 - Discovering AWS Information in the admin panel, setting upthe AWS CLI to use this endpoint then download a ssh key from S3 21:30 - Cracking SSHNG$6 with John because Hashcat doesn't have this yet 25:15 - Our user can run facter with sudo, looking at the GTFOBin and getting code execution 29:20 - Beyond Root: Exploiting CVE-2024-46987, which is a File Disclosure
Learn four practical ways GreyNoise improves SOC outcomes—from reducing alert volume and surfacing targeted threats to identifying compromised hosts.
Your child’s first data breach may happen before they’ve even opened a bank account. Here’s how to keep their digital life safe.
Bitdefender Labs has identified a widespread malvertising ecosystem spanning 13 APAC countries, with 12,000 scam campaigns generating over 400,000 ad impressions through paid advertising on Meta platforms. Health and finance sectors are the primary targets, accounting for 37.3% of the detected campaigns, demonstrating how threat actors leverage legitimate ad networks to distribute scams at scale across the region.
00:00 - Introduction 00:46 - Start of nmap 05:30 - Looking at CVE-2023-43208, Exploiting Mirth Connect 4.4.0 07:45 - Extracting the payload from python so we can send it via the API, getting ping to work to verify RCE 09:22 - Getting a reverse shell working in one-shot, weird oddity due to Java Deserialization 13:10 - Reverse shell returned, dumping the database 16:00 - Looking at Mirth Connect Source Code to see how the passwords are stored, then getting the passwords in a format hashcat likes to crack 27:00 - SSH as Sedric, discovering an app listening on port 54321, doing some weird eval 36:20 - Getting a payload to the custom webserver, troubleshooting XML Schema validation 40:20 - Confirming code execution then building a payload to get a shell
In this roundup, Tony looks at attacks against Polish water treatment facilities, how AI-directed attacks failed in Mexico, and what Google believes is the first AI-generated zero-day exploit
Learn how to evaluate AI cybersecurity vendors using five key assessment categories, including governance, transparency, model validation, and AI explainability, to support safer AI adoption and stronger security outcomes.
An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q4 2025 and Q1 2026
Football fans are being targeted by a surge of scam campaigns exploiting the sport's popularity, with Bitdefender Labs identifying over 55 malvertising operations leveraging club loyalty, national teams, collectibles, and FIFA World Cup 2026 excitement. These scams operate through multiple vectors including fake online stores, fraudulent social media ads, IPTV piracy schemes, malicious football apps, and phishing emails promoting bogus giveaways and lotteries.
Follow a malicious email through Darktrace / EMAIL’s multi-layered AI system to see how AI detects threats, understands intent, and autonomously responds in real time.
Using chatbots for medical advice could elicit hallucinations and even expose you to security and privacy risks. Here’s what’s at stake and how to stay safe.
BTMOB is a remote access trojan targeting Android devices that combines RAT functionality with pre-built campaign tools to facilitate widespread device compromise. The malware's integrated toolset reduces technical barriers for attackers, enabling easier orchestration of large-scale infection campaigns against mobile users.
00:00 - Introduction 00:57 - Start of nmap 03:20 - Looking at the webpage doing basic enumeration 05:30 - Talking about Orange Tsai Worst Fit -- Doesn't get us anything but a path i went down first 09:50 - Discovering the /user endpoint, fuzzing the token parameter discovering type juggling, cracking hashes 14:40 - Logging into the application, which seems like an odd static page 18:00 - Discovering the Cacti Domain, Logging in and showing we can enumerate if a user is valid or not by a timing attack 23:50 - Exploting CVE-2025-24367 , which lets us create php files on the target 28:40 - Creating the payload to drop the file to get RCE 36:00 - Shell returned. 38:10 - Using bash to be a basic port scanner, then dumping the database 45:00 - Manually exploiting CVE-2025-9074, talking to Docker over HTTP to create a container that mounts the host operating system in a container then reading the flag 55:00 - Getting code execution on the host by looking at scheduled tasks and changing a powershell script that runs every 3 minutes
Threat actors are leveraging the popularity of World Cup events by creating fraudulent FIFA websites that impersonate legitimate ticketing and merchandise platforms. These fake sites are designed to harvest both financial information and personal data from unsuspecting soccer fans attempting to purchase tickets and official merchandise.
GreyNoise Labs conducted a study comparing over 119,000 malicious IPs against 11 major threat feeds and found that traditional blocklists capture only an average of 2% coverage, revealing significant gaps in static security defenses. This analysis highlights a critical vulnerability in reliance on conventional threat intelligence feeds, demonstrating that the majority of active malicious infrastructure remains undetected by standard blocklisting approaches. Organizations dependent solely on these traditional lists face substantial exposure to threats that fall through the cracks of fragmented threat intelligence sources.
A new SonicWall scanning surge mirrors the pattern that preceded CVE-2026-0400. GreyNoise details the activity and what defenders should watch.
Sentinels League 2026 brings global threat hunters together to battle across AI, Endpoint, Cloud, and SIEM surfaces for $100K in prizes and more.
ESET researchers have identified new tools and techniques recently adopted by the Webworm APT group, expanding its operational capabilities. The analysis details how the threat actor has enhanced its attack methods, though specific technical details about these innovations are reserved for the full report.