Ich komme immer noch nicht darüber weg, dass Ulf Poschardt wirklich zu glauben scheint (oder zumindest so tut), „linke Milliardärseliten“ zögen in Deutschland heimlich irgendwelche Strippen. Schon das Wort „Milliardärseliten“ ist ja sehr lustig. Er scheint mir etwas besessen.
Flax Typhoon and other APTs used MicroScan and FishHub to scan and hack US and foreign critical infrastructure.
The Pwn2Own Ireland 2026 hacking contest has concluded, with hackers collecting $1,262,000 in rewards after exploiting 98 zero-day flaws. [...]
The U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China-linked advanced persist…
Feds claim he charged clients more than ransoms, paid up, pocketed the difference
Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group Sh…
Read how How Microsoft Security's FORGE Lab is scaling vulnerability research from Windows to the Linux kernel.
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. <a href="https://www.cve.
Why the AI Attack Surface Extends Your Stack
Across recruiting, engineering, and operations, Oracle turns specialist knowledge into fast, repeatable workflows with ChatGPT Work and Codex.
Secure your Kubernetes supply chain with WizOS Helm Charts.
TL;DR Supply chain security usually treats runtime as the final stage, the place where teams find out whether earlier controls worked.
Five practical priorities for turning AI-enabled vulnerability discovery into coordinated remediation and verified risk reduction.
Static analysis found the flaws, but only live attack testing proved how they could be chained into breaches.
I think what really resonates with me this week is being able to completely turn the tables on perceptions around things like AI being the big bad hacking tool the new…
We already know AI can find vulnerabilities. James Kettle, PortSwigger's Director of Research, wanted to answer a harder question: can an autonomous system invent genu…
Kevin Mandia, best known as the founder of Mandiant, has a new startup that is using agent swarms to test and protect enterprises.
Passive subdomain enumeration from dozens of sources.
Relevance: Recon & attack-surface mapping
Open-source XDR/SIEM for threat detection and compliance.
Relevance: Detection & response / compliance
Comprehensive scanner for containers, IaC, and dependencies.
Relevance: Cloud & container defenders
Template-based vulnerability scanner for massive-scale network scanning.
Relevance: Offensive security & recon
Interactive TLS-capable intercepting proxy for traffic analysis.
Relevance: AppSec & traffic inspection
Swiss-army toolkit for network attacks, MITM and recon.
Relevance: Network penetration testing
Graph-based Active Directory relationship explorer for attack paths.
Relevance: Red teams & AD assessment
New breach: Neogen was targeted by ShinyHunters in August. Data allegedly stolen from the company was later published, including 436k unique email addresses, names and other mostly corporate contact details. 59% were already in @haveibeenpwned. More: https://haveibeenpwned.com/Breach/Neogen
The Pwn2Own Ireland 2026 hacking contest has concluded, with hackers collecting $1,262,000 in rewards after exploiting 98 zero-day flaws.https://www.bleepingcomputer.com/news/security/hackers-earn-1262000-for-98-zero-days-at-pwn2own-ireland/
Linux backdoors disguised as email security tools in Asia🔗 https://cybersecurefox.com/en/linux-backdoors-email-security-korea-taiwan#linux #backdoor #BPFDoor #AVERAT #mail #gateways #telecom
We turned Envoy's hot-restart shared memory file into an ASLR leak and an arbitrary write. The maintainers said it's not a security issue.We think that is only half the story. When you run it on Kubernetes, it enables lateral movement into your Envoy sidecar containers.Read more in our blogpost: https://x41-dsec.de/news/2026/10/09/envoy-on-k8s-shm/
You cannot audit yourself, for the same reason a barrister cannot sit on the jury in their own case. You know what you meant to do and which compromises were sensible. None of that is visible in the controls.The room goes quiet at the same moment in most audits: someone asks for evidence of the last twelve restore tests. The work being done and the work that can be proven are two different things, and only one of them protects you in front of a regulator.A finding is also air cover. When the auditor writes that privileged access needs work, the meeting you could not get for six months happens that week.https://altlibre.com/blog/audit-you-are-dreading-one-you-need#CyberSecurity #InfoSec #Audit #ISO27001