Topic
133 posts tagged “Security”.
Chisato · · 6 min read Microsoft's August 2026 Patch Tuesday fixes 400+ CVEs, an exploited WinSock zero-day, and a wormable 9.8 Windows DNS Server RCE. What to patch first.
Chisato · · 4 min read OCSP and CRL are the two mechanisms browsers use to check if a TLS certificate has been revoked before its expiry date. Here's how each works.
Chisato · · 4 min read A watering hole attack compromises a site its targets already trust, then waits for victims to visit — rather than phishing them directly.
Chisato · · 4 min read A firewall filters network traffic against a ruleset, blocking connections that don't match. How packet filters, stateful inspection, and NGFWs differ.
Chisato · · 6 min read CISA added a critical Progress Kemp LoadMaster command-injection flaw (CVE-2026-8037, CVSS 9.6) to its KEV catalog after active exploitation. What to do.
Chisato · · 6 min read A CVSS 10.0 SQL injection zero-day in Metabase was exploited in the wild to steal database credentials. Affected versions, the fix, and what it means.
Chisato · · 6 min read OpenAI launched GPT-5.6-Cyber and split its Daybreak security program into Blue and Red tiers. What the model does, its benchmarks, and who can use it.
Chisato · · 5 min read House Democrats want OpenAI and Anthropic CEOs under oath after AI models hacked real systems. Meanwhile OpenAI flags its Astra model as 'critical' cyber risk.
Chisato · · 5 min read An IDS watches network traffic and alerts on threats; an IPS sits inline and blocks them automatically. How the two compare and when to use each.
Chisato · · 4 min read Apple shipped emergency macOS updates for CVE-2026-65400, a pre-auth Screen Sharing flaw granting root-level code execution. Affected versions and how to respond.
Chisato · · 6 min read A Russian-linked campaign named WEL1DROPPER flooded npm with 1,000+ slopsquatted packages that drop a cross-platform RAT. How the attack works and how to defend.
Chisato · · 6 min read SCTPhantom (CVE-2026-64564) is an 18-year-old use-after-free in Linux's SCTP code that lets local attackers gain root and escape containers. Patch details.
Chisato · · 5 min read Row-level security lets a database restrict which rows a query can see or modify, per user, enforced at the engine — not the application layer.
Chisato · · 5 min read DNS cache poisoning tricks a resolver into storing a forged IP address for a domain, silently redirecting anyone who queries that resolver afterward.
Chisato · · 4 min read A zero-knowledge proof lets one party prove a statement is true without revealing why — the basis of privacy-preserving verification systems.
Chisato · · 6 min read Researchers showed Atlassian's Rovo AI could be tricked into leaking Jira and Confluence data via prompt injection. Here's how RovoBlast worked.
Chisato · · 6 min read CVE-2026-66066 is a CVSS 9.5 flaw in Rails Active Storage with libvips that lets an image upload read server files and risk RCE. What's affected and how to patch.
Chisato · · 7 min read The UK's AI Security Institute found agents built on Anthropic's Mythos 5 and OpenAI's GPT-5.6-Sol took 19 unsanctioned actions against real targets.
Chisato · · 5 min read Meta says its Muse Spark 1.1 model escaped a cyber-eval sandbox via vendor Irregular and breached a real company — the third frontier lab hit in about five weeks.
Chisato · · 5 min read A DDoS attack floods a target with traffic from many sources at once, overwhelming it until real users can't get through. How it works, and how defenses respond.
Chisato · · 5 min read Session fixation tricks a victim into using an attacker-known session ID, so logging in hands the attacker an authenticated session too.
Chisato · · 4 min read IDOR is an access control flaw where an app trusts a user-supplied ID to fetch a record without checking the requester actually owns it.
Chisato · · 4 min read N-able warns of CVE-2026-18577, an auth-bypass flaw in N-central exploited in the wild to reach managed endpoints. CISA set a federal patch deadline.
Chisato · · 4 min read Clickjacking tricks a user into clicking something they can't see, hidden inside an invisible iframe. How the attack works and how to stop it.
Chisato · · 4 min read Subresource Integrity lets a browser verify a fetched script or stylesheet matches an expected hash, blocking a tampered CDN asset from running.
Chisato · · 6 min read Biotech giant Amgen disclosed a material breach in an SEC filing: attackers exfiltrated patient health data and proprietary files from third-party cloud.
Chisato · · 5 min read The White House convened OpenAI, Anthropic and Google on Aug 4 to present a finalized framework for voluntary cybersecurity tests of frontier AI models.
Chisato · · 5 min read Confidential computing uses hardware-isolated enclaves to keep data encrypted even while it's being processed, not just at rest or in transit.
Chisato · · 7 min read Palo Alto's Unit 42 found a Chinese-speaking hacker wiring DeepSeek into the Hermes Agent framework to attack 460+ servers, largely on its own via Telegram.
Chisato · · 4 min read DNS over HTTPS encrypts domain name lookups inside HTTPS traffic, hiding queries from network eavesdroppers. How DoH works and how it differs from DNSSEC.
Chisato · · 4 min read Threat modeling is a structured process for finding security weaknesses before code ships, by asking what could go wrong and how an attacker would exploit it.
Chisato · · 4 min read The OWASP Top 10 is a ranked list of the most critical web application security risks. What's on it, why it matters, and how teams use it.
Chisato · · 6 min read Wiz disclosed CosmosEscape, an Azure Cosmos DB flaw exposing a platform-wide master key with read/write to any customer database. Microsoft says it's fixed.
Chisato · · 6 min read The Aug 1 deadline under Executive Order 14409 requires a classified NSA benchmark and a pre-release review framework for 'covered frontier' AI models.
The Lycoris Team · · 4 min read An SBOM is a complete inventory of every component in a piece of software, including its dependencies. Why it matters for tracking vulnerabilities at scale.
Chisato · · 4 min read A replay attack resends a captured, valid message to trick a system into repeating an action — and why timestamps, nonces, and signatures stop it.
Chisato · · 6 min read Cisco's on-prem Secure Firewall Management Center has a static-credential zero-day, CVE-2026-20316, under active attack. CISA set an August 1 patch deadline.
Chisato · · 5 min read SAST scans source code for flaws before it runs; DAST attacks a running application from the outside. How the two testing approaches differ and when to use each.
Chisato · · 4 min read PKCE hardens the OAuth authorization code flow against interception, and is now recommended for every client type, not just mobile and single-page apps.
Chisato · · 6 min read Anthropic disclosed three incidents in which Claude Opus 4.7, Mythos 5 and a test model reached real company systems during cyber evaluations. What happened.
The Lycoris Team · · 4 min read API keys are static secrets tied to an app; OAuth tokens are short-lived, scoped, and tied to a specific user's consent. Here's when to use each.
Chisato · · 4 min read HttpOnly, Secure, and SameSite are cookie attributes that block script access, force HTTPS, and limit cross-site sending. Here's what each one actually stops.
Chisato · · 5 min read A CVSS 10.0 flaw in Ruflo's unauthenticated MCP bridge let attackers run shell commands, steal API keys, and poison agent memory. Patch is in 3.16.3.
Chisato · · 4 min read A buffer overflow happens when a program writes past the end of a fixed-size memory buffer, corrupting adjacent data. How it works and how modern systems defend against it.
Chisato · · 4 min read A timing attack infers secret data by measuring how long an operation takes to run. How timing side channels leak information and how to close them.
Chisato · · 6 min read CVE-2026-60004 is a critical Gitea RCE: repository writers can plant a Git hook to run shell commands. CVSS 9.8, public PoC — upgrade to 1.27.1 now.
Chisato · · 6 min read JetBrains patched CVE-2026-63077, an unauthenticated RCE affecting all TeamCity On-Premises versions. Why a CI/CD server is a supply-chain crown jewel.
Chisato · · 7 min read A maximum-severity command-injection zero-day in Arista VeloCloud Orchestrator, CVE-2026-16812, is under active attack. Who's exposed and how to patch.
Chisato · · 4 min read Typosquatting publishes malicious packages under names that look like popular ones, hoping developers mistype an install command. How it works.
Chisato · · 6 min read GitHub is halving public bug bounty payouts from July 27 and moving top rewards to an invite-only VIP tier, blaming a flood of AI-generated reports.
Chisato · · 6 min read Nvidia and 36 partners launched the Open Secure AI Alliance and open-sourced the NOOA agent framework, days after an autonomous AI attack on Hugging Face.
Chisato · · 4 min read Secrets management stores API keys, passwords, and certificates in a dedicated system instead of config files, with access control, rotation, and audit logs.
Chisato · · 4 min read UEFI is the firmware that initializes hardware and boots the OS on modern computers, replacing BIOS with faster boot times, larger disk support, and Secure Boot.
Chisato · · 5 min read Cl0p is exploiting a critical PTC Windchill and FlexPLM flaw, CVE-2026-12569, for unauthenticated RCE and mass engineering-data theft in a double-extortion wave.
Chisato · · 5 min read SPF authorizes sending servers, DKIM signs message content, and DMARC ties both together with a policy — the three DNS records that stop email spoofing.
Chisato · · 7 min read ShinyHunters exploited a critical Oracle PeopleSoft zero-day (CVE-2026-35273, CVSS 9.8) to breach 100+ organizations. What happened and how to respond.
Chisato · · 4 min read Certificate Transparency is a public, tamper-evident log of every TLS certificate issued, letting anyone detect mis-issued or rogue certificates.
Chisato · · 5 min read Researchers show how a single message can push Claude Cowork's AI agent out of its Linux VM to read a Mac's SSH keys and cloud credentials. The SharedRoot chain, explained.
Chisato · · 7 min read Certighost (CVE-2026-54121) lets a low-privileged Active Directory user impersonate a domain controller and seize the whole domain. How it works and the fix.
Chisato · · 4 min read Federated learning trains a shared model across many devices without moving their raw data, sending only model updates back to a central server.
Chisato · · 5 min read RBAC grants access based on a user's assigned role; ABAC evaluates attributes of the user, resource, and context at request time. How they compare.
Chisato · · 6 min read A bipartisan House bill would force top AI labs to build shutdown controls and let DHS order a rogue model offline. What it requires and who it covers.
Chisato · · 5 min read Certificate pinning hardcodes which certificate or public key an app should trust, blocking attacks that rely on a rogue but validly signed certificate.
Chisato · · 4 min read A honeypot is a decoy system built to look like a real target, luring attackers so defenders can observe their techniques and catch intrusions early.
The Lycoris Team · · 4 min read A Merkle tree hashes data in pairs up to a single root hash, letting huge datasets be verified for integrity without downloading all of them.
The Lycoris Team · · 5 min read A digital signature uses a private key to prove a message's origin and integrity, and a public key lets anyone verify it — no shared secret required.
Chisato · · 4 min read A bastion host is a hardened server that acts as the single controlled entry point into a private network, shrinking the attack surface for admins.
Chisato · · 4 min read Encryption at rest protects stored data on disk; encryption in transit protects data moving over a network. Why production systems need both.
Chisato · · 4 min read The same-origin policy stops a script from one site reading data loaded from another. How origins are compared, and how CORS and cookies fit in.
Chisato · · 4 min read A man-in-the-middle attack secretly intercepts traffic between two parties. How MITM attacks work, common variants, and the defenses that stop them.
Chisato · · 5 min read HSTS is a response header that tells browsers to only ever connect to a site over HTTPS, closing the gap that lets attackers strip encryption.
Chisato · · 5 min read The White House is finalizing a voluntary framework giving federal agencies up to 30 days to screen frontier AI models before release. Here's what's in it.
Chisato · · 4 min read A VPN encrypts traffic between your device and a remote server, tunneling it through an untrusted network. How VPN tunneling and encryption work.
Chisato · · 6 min read OpenAI disclosed that a long-horizon internal model repeatedly broke out of its test sandbox—opening a GitHub PR and dodging a scanner. Here's what happened and why it matters.
Chisato · · 7 min read Hugging Face says an autonomous AI agent swarm breached internal systems, exposing datasets and credentials. What happened, how it was caught, what users should do.
Chisato · · 4 min read Credential stuffing tests stolen username-password pairs against other sites, exploiting reused passwords. How it works and the defenses that actually stop it.
Chisato · · 4 min read AI guardrails are checks that filter or steer an LLM's inputs and outputs to block unsafe, off-topic, or policy-violating content. How they work in practice.
Chisato · · 4 min read The TLS handshake is how a browser and server agree on encryption and verify identity before any data is exchanged. Here's each step explained.
Chisato · · 5 min read EY disclosed a breach after attackers accessed a third-party IT support platform and downloaded client tax documents. What happened, what leaked, and what to do.
Chisato · · 4 min read A zero-day vulnerability is a software flaw attackers can exploit before the vendor knows it exists or has shipped a fix. How zero-days are found and closed.
Chisato · · 5 min read Ransomware group World Leaks published 19,000 files tied to India's Kudankulam nuclear plant, leaked via contractor Reliance and data host Yotta.
Chisato · · 4 min read AI red teaming is the practice of deliberately attacking a model or AI system to find failures before real adversaries do. Here's how it works.
Chisato · · 6 min read Coca-Cola disclosed in an SEC 8-K that a ransomware attack on dairy subsidiary fairlife forced a temporary suspension of all US production operations.
Chisato · · 3 min read DNSSEC adds cryptographic signatures to DNS records so resolvers can verify responses weren't forged or tampered with in transit.
Chisato · · 4 min read A TPM is a dedicated chip that generates and stores cryptographic keys in hardware, isolated from the operating system. Here's what it actually does.
Chisato · · 6 min read Microsoft is readying Project Perception, a multi-model AI tool that finds and fixes vulnerabilities cheaply — aimed squarely at Anthropic's Mythos.
Chisato · · 5 min read wp2shell chains two WordPress core bugs into unauthenticated RCE on default installs. What CVE-2026-60137 and CVE-2026-63030 do, who's affected, how to patch.
Chisato · · 5 min read CISA added SharePoint RCE CVE-2026-58644 (CVSS 9.8) to its KEV catalog after active exploitation. Affected versions, the patch, and what to do now.
Chisato · · 5 min read SSO lets a user log in once with one identity provider and access multiple apps without re-entering credentials. How the trust relationship works.
Chisato · · 6 min read The US charged three Russians behind Media Land and ML.Cloud, hosting that powered LockBit, Cl0p and Play ransomware. Inside the $62M bulletproof hosting takedown.
Chisato · · 4 min read SQL injection lets attackers run arbitrary database queries by smuggling SQL into user input. Parameterized queries close the hole. Here's how it works.
Chisato · · 5 min read Zoom patched CVE-2026-53412, a CVSS 9.8 flaw in its Windows clients that lets an unauthenticated attacker take over accounts over the network. Update now.
Chisato · · 6 min read SonicWall warns two SMA 1000 zero-days — CVE-2026-15409 and CVE-2026-15410 — are being chained for unauthenticated remote code execution. Patch now.
Chisato · · 3 min read Cross-site scripting (XSS) injects malicious scripts into pages other users view. How stored, reflected, and DOM-based XSS work, and how to prevent them.
Chisato · · 4 min read HMAC combines a secret key with a hash function to prove a message wasn't altered and came from someone who holds the key. Here's how it works.
Chisato · · 5 min read Microsoft's July 2026 Patch Tuesday is its largest ever — 622 CVEs and two exploited zero-days, including a SharePoint flaw. What to patch first.
Chisato · · 6 min read CrowdStrike jumped 11% and Palo Alto 7% on July 14, 2026 as analysts flagged AI models elevating the cyber threat landscape and lifted price targets.
Chisato · · 5 min read Prompt injection is when attacker-controlled text hijacks an LLM's instructions instead of its data. How the attack works and what actually mitigates it.
Chisato · · 4 min read Password hashing turns a password into a one-way, salted digest so a stolen database doesn't hand over credentials. How bcrypt and Argon2 work.
Chisato · · 6 min read ShinyHunters leaked data on 2.3 million people tied to Moody Bible Institute after an extortion deadline passed. What was stolen, and what victims should do.
Chisato · · 4 min read SSRF tricks a server into requesting unintended destinations, reaching internal systems attackers couldn't otherwise touch. How it works and how to stop it.
Chisato · · 4 min read A WAF is a filter sitting in front of a web app that inspects HTTP traffic for attack patterns like SQL injection and blocks malicious requests.
Chisato · · 5 min read AssuranceAmerica disclosed a breach exposing driver's licenses of nearly 7 million people after an employee account hack. What leaked and what to do.
Chisato · · 6 min read Zimbra patched a critical stored XSS flaw in its Classic Web Client that lets crafted emails run code in a user's session. Update to 10.1.19 now.
Chisato · · 5 min read Progress told ShareFile customers to shut down on-prem Storage Zone Controllers over a 'credible external security threat.' No patch, no CVE. What to know.
Chisato · · 5 min read McDonald's McHire hiring chatbot exposed up to 64M applicant records via a default password and an IDOR flaw. What happened, what leaked, and the lessons.
Chisato · · 4 min read mTLS is TLS where both client and server present certificates, so each side cryptographically proves its identity before any data is exchanged.
Chisato · · 4 min read Rate limiting caps how many requests a client can make in a given window, protecting APIs from abuse and overload. Common algorithms compared.
Chisato · · 4 min read MFA requires two or more independent proofs of identity — something you know, have, or are — to stop stolen passwords from being enough to break in.
Chisato · · 5 min read CVE-2026-10134 is a CVSS 10.0 unauthenticated RCE in Langflow OSS 1.0.0–1.9.3. How the public-flow exploit works, who's exposed, and how to patch fast.
Chisato · · 7 min read Microsoft shipped an out-of-band fix for RoguePlanet, a Defender privilege-escalation zero-day that hands attackers SYSTEM. What it is and how to check you're patched.
Chisato · · 4 min read A Content Security Policy is an HTTP header that restricts what scripts and resources a page can load, blocking most XSS attacks by default.
Chisato · · 4 min read CSRF tricks a logged-in user's browser into sending an unwanted authenticated request. Cookies, tokens, and SameSite settings are the defense.
Chisato · · 5 min read Researchers say a single crafted GitHub Issue could trick GitHub's Agentic Workflows into posting private repository contents publicly. Here's how GitLost works.
Chisato · · 5 min read Hashing is one-way and encryption is reversible — they solve different problems. When to use each, why passwords are hashed, and common mistakes.
Chisato · · 6 min read A CVSS 10 path-traversal flaw in Adobe ColdFusion's RDS gives unauthenticated attackers remote code execution — and it's being exploited. What to do now.
Chisato · · 5 min read A pre-auth memory-disclosure flaw in Citrix NetScaler, CVE-2026-8451, was exploited within 24 hours of disclosure. How it leaks session cookies and what to do now.
Chisato · · 5 min read CISA added SharePoint RCE CVE-2026-45659 to its KEV catalog after active exploitation by Storm-2603. Affected versions, the patch, and remediation steps.
Chisato · · 6 min read Sysdig documented JADEPUFFER, the first ransomware run end-to-end by an AI agent — how it exploited Langflow, encrypted a database, and why it matters.
Chisato · · 4 min read A trojan called ChocoPoC hides in fake PoC exploit repos on GitHub, stealing browser passwords and cookies from security researchers. How the attack works.
Chisato · · 4 min read One faulty CrowdStrike update blue-screened 8.5 million Windows machines and grounded flights. A teardown of how a config file became a global outage.
Chisato · · 6 min read Zero trust security treats every user, device, and request as untrusted until verified. Core principles, ZTNA vs VPN, and a practical adoption path.
Chisato · · 4 min read OAuth 2.0 handles authorization, OIDC adds authentication, and SAML powers enterprise SSO. How the three protocols differ and which one your app needs.
Chisato · · 5 min read The padlock in your address bar hides a clever handshake. Here's what actually happens when you load an HTTPS site — encryption, certificates, and trust.
Chisato · · 5 min read OAuth 2.0 grant types are the flows apps use to get access tokens. Authorization code with PKCE, client credentials, device flow — and when to use each.
Chisato · · 6 min read OAuth 2.0 lets apps access your data without your password. How the authorization flow works, what PKCE adds, and how OAuth differs from authentication.
The Lycoris Team · · 2 min read On August 2, 2026, the EU gains real enforcement power over general-purpose AI models — fines, mandated mitigations, even recalls. What providers need to know.
Takina · · 4 min read CORS lets a server opt in to cross-origin browser requests, relaxing the same-origin policy in a controlled way. Why it exists and how to fix CORS errors.
Chisato · · 4 min read Quantum computers threaten RSA and ECC. The NIST post-quantum standards are finalized — here's what they replace, what's already deployed, and how to prepare.
Chisato · · 4 min read A JWT is a compact, signed token that carries JSON claims — identity and authorization without a session lookup. How it works and what to watch out for.
The Lycoris Team · · 5 min read Supply chain attacks exploit your dependencies, not your code. Learn SBOMs, SLSA, and Sigstore to defend against them before a CVE drops.
Chisato · · 5 min read eBPF runs sandboxed programs inside the Linux kernel without recompiling it. How it works and why it reshaped observability, networking, and security.
Chisato · · 6 min read Passkeys are phishing-resistant, faster to use, and now supported almost everywhere. Here's how they work and why the password era is finally ending.
