ROSECURIFY
Subscribe
~/ seclog/ #135

Seclog - #135

23 curated links

g3n3r4l15

  1. HTTP/1.1 Insecure, New Desync Attacks (http1mustdie.com)

    HTTP/1.1 is described as inherently insecure. James Kettle will reveal new classes of desync attack that compromised multiple CDNs.

  2. Django Celebrates 20th Birthday (djangoproject.com)

    The popular web framework, Django, celebrates its 20th birthday. The project began with its first public commit on July 13th, 2005, and has since seen over 400 releases. djangoproject.com

  3. MITRE AADAPT™ for Digital Assets (mitre.org)

    MITRE AADAPT™ is a knowledge base outlining adversary tactics and techniques for digital asset management systems. Modeled after MITRE ATT&CK®, it complements existing frameworks with real-world attack data. mitre.org

  4. XSS Persists in Frameworks Era (flatt.tech)

    Despite robust defensive mechanisms in frameworks, XSS still persists. New developments like React v19 disabling javascript: scheme URLs aim to neutralize more attack vectors.

  5. Next.js Race-Condition Exploitation Research (zhero-web-sec.github.io)

    A new research piece details the conditioned exploitation of an intended race-condition in the Next.js framework, aiming to bypass previous patches.

  6. Cloudflare 1.1.1.1 Outage Post-Mortem (blog.cloudflare.com)

    Cloudflare explains the 1.1.1.1 incident on July 14, 2025, attributing the outage to a misconfiguration of legacy systems used for advertising its IP addresses.

  7. Homebrew Misused in macOS Malware Campaign (medium.com)

    A recent incident reveals that Homebrew, a popular macOS package manager, was misused to deliver macOS malware, adding to cases where this trusted tool has been exploited.

  8. Weaponizing Windows Drivers for Exploitation (securityjoes.com)

    This guide explains how to analyze and exploit vulnerable drivers in Windows, detailing their role in interfacing with the kernel.

  9. Git Clone Recursive RCE Vulnerability (dgl.cx)

    A new critical vulnerability, CVE-2025-48384, allows remote code execution on Unix-like platforms via git clone --recursive on untrusted repositories.

  10. XBOW: AI-Powered Security Pentester (xbow.com)

    XBOW is introduced as an AI-powered security pentester designed to automate and enhance web application security efforts.

  11. Phishing with Gemini Prompt Injection (0din.ai)

    A prompt-injection vulnerability in Google Gemini for Workspace allows attackers to hide malicious instructions in emails, which, when summarized, appends a fake phishing warning.

  12. Passkey Encryption with Typage (Age) (filippo.io)

    Typage is a TypeScript implementation of the age file encryption format, supporting native age recipients, passphrase encryption, and ASCII armoring. It runs across various JavaScript runtimes and browsers. filippo.io

  13. OpenAI Bio Bug Bounty Program (openai.com)

    OpenAI has launched a bio bug bounty to strengthen safeguards for advanced AI in biology, inviting researchers to find a "universal jailbreak" for its models.

  14. Critical RCE in MCP-Remote Project (jfrog.com)

    JFrog Security discovered CVE-2025-6514, a critical (CVSS 9.6) RCE vulnerability in the mcp-remote project, posing a full system compromise risk.

  15. Understanding CodeQL for Vulnerability Analysis (sim4n6.beehiiv.com)

    This summary provides a flow chart detailing how CodeQL does its magic to unearth vulnerabilities.

g1thub8

  1. Android RE Workbench for VS Code (github.com)

    APKLab integrates Android reverse-engineering tools directly into VS Code. Explore on GitHub

  2. Chrome X-Browser-Validation Reversing (github.com)

    A toolkit for reverse-engineering Chrome's private x-browser-validation header used for integrity checks. Explore on GitHub

  3. Docker Layer Exploration Tool (github.com)

    Dive inspects each layer in a Docker image for optimization and security analysis. Explore on GitHub

  4. Playwright Captcha Automation Solution (github.com)

    Solves Cloudflare Turnstile/Interstitial and reCAPTCHA v2/v3 challenges via click or API. Explore on GitHub

  5. BotBrowser Bypasses Anti-Bot Protections (github.com)

    A modified Chromium core designed to evade Cloudflare, Akamai, hCaptcha, and reCAPTCHA. Explore on GitHub

  6. Zip Smuggling via LNK Files (github.com)

    Embeds hidden data in zip files that can be extracted via PowerShell using Windows shortcuts. Explore on GitHub

  7. Detecting Copied Code Across Repos (github.com)

    Vendetect identifies vendored or copy-pasted code, with or without attribution. Explore on GitHub

  8. Open-Source CVE Monitoring Platform (github.com)

    OpenCVE is a platform to track and receive alerts on new vulnerabilities. Explore on GitHub

← All Seclogs