Seclog - #116

g3n3r4l10

1. InfoSecMap (infosecmap.com)

   Mapping out the best InfoSec events and groups! -

2. Increasing Google & Alphabet VRP rewards up to $151,515 (bughunters.google.com)

   Google Bug Hunters announces increased rewards for vulnerability reports.

3. Undocumented "backdoor" found in Bluetooth chip used by a billion devices (bleepingcomputer.com)

   Critical security flaw discovered affecting numerous Bluetooth-enabled devices.

4. Sitecore: Unsafe Deserialisation Again! (CVE-2025-27218) (slcyber.io)

   New vulnerability in Sitecore CMS due to unsafe deserialization practices.

5. Google Vulnerability Reward Program: 2024 in Review (security.googleblog.com)

   Google's annual review of their vulnerability reward program highlights key findings and statistics.

6. Zen and the Art of Microcode Hacking (bughunters.google.com)

   Insights into microcode vulnerabilities and exploitation techniques shared by Google Bug Hunters.

7. Find my hacker: How Apple's network can be a potential tracking tool (cec.gmu.edu)

   Analysis on potential misuse of Apple's Find My network for tracking purposes.

8. K8s-Security-4 (substack.com)

   Deep dive into Kubernetes security best practices and vulnerabilities.

9. Threat modeling the TRAIL of Bits way (blog.trailofbits.com)

   Comprehensive guide to effective threat modeling methodologies by Trail of Bits.

10. Ciofeca Forensics - Never Trust Cookies (ciofecaforensics.com)

    Exploration of cookie-based vulnerabilities and forensic analysis techniques.

y0utube2

1. Do you know this common Go vulnerability? (youtube.com)

   Explanation and demonstration of a prevalent Go programming language vulnerability. Watch Here

2. The tools that real hackers use (youtube.com)

   Overview of essential hacking tools used by cybersecurity professionals and penetration testers. Watch Here

g1thub6

1. PostgreSQL: Privilege Escalation Vulnerability via pg\cron (github.com)

   Advisory detailing privilege escalation vulnerability in PostgreSQL's pg\cron extension.

2. webcap (github.com)

   An ultra lightweight web screenshot tool with advanced DOM analysis features by Black Lantern Security. Explore on GitHub

3. oasis (github.com)

   Ollama Automated Security Intelligence Scanner for efficient vulnerability detection by Psyray. Explore on GitHub

4. JavaRansomware (github.com)

   Simple ransomware tool implemented purely in Java by Panagiotis Drakatos for educational purposes. Explore on GitHub

5. system-prompts-and-models-of-ai-tools (github.com)

   Collection of system prompts and models used by various AI tools, curated by x1xhlol. Explore on GitHub

6. phisherman (github.com)

   A realistic fake social engineering application developed by jfmaes for security training purposes. Explore on GitHub