ROSECURIFY
Subscribe
~/ seclog/ #136

Seclog - #136

22 curated links

g3n3r4l12

  1. SLSA Framework Secures Software Supply Chains (slsa.dev)

    SLSA (Supply-chain Levels for Software Artifacts) provides standards to prevent tampering and ensure artifact integrity across infrastructure. It transitions ecosystems from "safe enough" to maximum resilience against supply chain attacks.

  2. GMS Gadgets (gmsgadget.com)

    Inspired by Black Hat research, GMSGadget explores bypassing XSS defenses using script gadgets. This project revives techniques to circumvent modern mitigations.

  3. Positive Technologies Vulnerabilities Database (dbugs.ptsecurity.com)

    dbugs is JSC Positive Technologies' platform for vulnerabilities. It serves as a home for security findings and related information from 2025.

  4. How we rooted CoPilot (research.eye.security)

    Microsoft's Jupyter Notebook integration in Copilot Enterprise allowed arbitrary code execution. Researchers rooted the system via this live Python sandbox vulnerability.

  5. OTP Bypass Techniques in Mobile Apps (resecurity.com)

    Resecurity details API and authorization flaws allowing OTP bypass during VAPT engagements. These issues persist across organizations regardless of maturity.

  6. Amazon Q's Unintended Self-Destruct Feature (lastweekinaws.com)

    A malicious PR merged into Amazon Q instructed it to wipe computers and cloud infrastructure. This supply chain breach highlights AI tool risks.

  7. Google OSS Rebuild Fortifies Open Source Trust (security.googleblog.com)

    OSS Rebuild reproduces upstream artifacts to combat supply chain attacks targeting dependencies, offering security teams actionable data without burdening maintainers. This enhances trust in package ecosystems.

  8. Netskope SWG Tenant Security Analysis (quickskope.com)

    Netskope's cloud-native platform integrates CASB, SWG, and ZTNA for app security. Recent research explores tenant configurations and vulnerabilities.

  9. Vendetect Detects Code Copying Efficiently (blog.trailofbits.com)

    Trail of Bits' Vendetect uses semantic fingerprinting to identify copied code across repositories, even with altered variables. It leverages version history for precise tracing.

  10. Novel PDO SQL Injection Technique (slcyber.io)

    A new method exploits SQL injection in PDO's prepared statements, bypassing traditional defenses. Research shows evolving vulnerability complexity in modern apps.

  11. Accidental ETQ Reliance RCE Discovery (slcyber.io)

    Researchers accidentally found a remote code execution flaw in ETQ Reliance, proving vulnerabilities persist despite advanced frameworks. Modern apps still hide critical risks.

  12. Critical JavaScript Library Vulnerability (cybersecuritynews.com)

    A Critical Vulnerability in a JavaScript library has been discovered, exposing millions of applications. This flaw allows for potential Code Execution Attacks.

y0utube1

  1. Prompt Engineering AI Red Teaming (youtube.com)

    Learn from HackAPrompt's creator about prompt engineering guides and the world’s first AI red teaming competition. Techniques cover adversarial LLM exploitation. Watch Here

g1thub9

  1. Vim Tar.vim Path Traversal Advisory (github.com)

    A path traversal vulnerability affects Vim 9.1.1552 via specially crafted tar files in tar.vim, enabling unauthorized access. Patch mitigations are critical for secure archive handling.

  2. eBPF MCP Monitoring Tool (github.com)

    MCPSpy leverages eBPF for detailed MCP monitoring, providing low-level system insights. Ideal for performance and security analysis. Explore on GitHub

  3. Blackbird OSINT Account Discovery (github.com)

    Search for accounts by username/email across social networks. This tool streamlines reconnaissance and footprinting. Explore on GitHub

  4. SharePoint WebPart RCE Exploit (github.com)

    Exploits CVE-2025-53770 via ToolPane.aspx, enabling .NET deserialization and remote code execution. Critical for SharePoint penetration testing. Explore on GitHub

  5. YSoNet .NET Deserialization Payloads (github.com)

    Generates deserialization payloads for multiple .NET formatters. Essential for exploiting insecure serialization in applications. Explore on GitHub

  6. 0day.today (github.com)

    Exploit Archive – Comprehensive archive of historical 0day.today exploits. A resource for vulnerability research and historical analysis. Explore on GitHub

  7. CVE-2025-7783 Proof of Concept (github.com)

    Demonstrates exploitation of CVE-2025-7783, a critical vulnerability with broad impact. Useful for defensive validation. Explore on GitHub

  8. Promptmap LLM Security Scanner (github.com)

    Scans custom LLM applications for vulnerabilities like prompt injection. Crucial for securing AI deployments. Explore on GitHub

  9. S3grep Bucket Content Search (github.com)

    CLI tool for searching logs and unstructured data in AWS S3 buckets. Accelerates incident response and forensics. Explore on GitHub

← All Seclogs