ROSECURIFY
Subscribe
~/ seclog/ #149

Seclog - #149

21 curated links

g3n3r4l16

  1. CTFtime Points Calculation Tool (ctfpoints-calculator.me)

    The CTFtime Points Calculator is a utility designed to help participants determine their scores and standings in Capture The Flag competitions. It provides a convenient way to track progress. ctfpoints-calculator.me

  2. Detective Wiki: Cyber Security Resources (detective.wiki)

    The Detective Wiki serves as a comprehensive resource for cybersecurity information, tools, and methodologies. It aims to assist security professionals and enthusiasts in their investigations. detective.wiki

  3. Progress Telerik UI Unsafe Reflection (labs.watchtowr.com)

    A detailed analysis of Progress Telerik UI for ASP.NET AJAX Unsafe Reflection (CVE-2025-3600) reveals vulnerabilities extending beyond typical DoS attacks. This research explores critical implications.

  4. LLM Poisoning: Transformer's Thoughts (synacktiv.com)

    This first part of a series explores LLM Poisoning, focusing on methods for "reading the Transformer's thoughts." It delves into initial techniques for understanding and manipulating large language models.

  5. Agentic AI Red Teaming Playbook (pillar.security)

    A comprehensive Agentic AI Red Teaming Playbook is presented, offering strategies and methodologies for effectively testing and securing AI agents against adversarial attacks.

  6. WSUS Unauthenticated RCE Vulnerability (hawktrace.com)

    HawkTrace details CVE-2025-59287, an unauthenticated RCE vulnerability impacting WSUS. The report provides technical insights into the exploit and potential mitigation strategies.

  7. Cisco Talos Intelligence Report (talosintelligence.com)

    Cisco Talos Intelligence Group releases TALOS-2025-2243, a comprehensive threat intelligence report detailing a specific vulnerability. This advisory provides critical security information.

  8. Microsoft Copilot Data Exfiltration (adamlogue.com)

    Adam Logue details how Microsoft 365 Copilot could be vulnerable to arbitrary data exfiltration through Mermaid diagrams. The issue has since been fixed, highlighting critical AI security concerns.

  9. Stealing Microsoft Teams Access Tokens (blog.randorisec.fr)

    This article explores methods for stealing Microsoft Teams access tokens in 2025, detailing current attack vectors and implications. It provides insights into the persistent challenges of securing collaboration platforms.

  10. Unseeable Prompt Injections in AI Browsers (brave.com)

    Brave's research uncovers unseeable prompt injections via screenshots, revealing more vulnerabilities in Comet and other AI browsers. This highlights new adversarial methods targeting AI-driven interfaces.

  11. Prompt Injection to AI Agents RCE (blog.trailofbits.com)

    Trail of Bits details how prompt injection can escalate to Remote Code Execution (RCE) in AI agents. This analysis demonstrates a critical attack vector against intelligent systems.

  12. Pwn2Own Ireland 2025 Results (zerodayinitiative.com)

    The Zero Day Initiative reports on the Pwn2Own Ireland 2025 event, covering results from Day One, Day Two, and Day Three, culminating in the crowning of the Master of Pwn. This provides a comprehensive overview of successful exploits.

  13. Hacking Formula 1: FIA PII Access (ian.sh)

    A report on hacking Formula 1 reveals vulnerabilities in FIA systems allowing access to Max Verstappen's passport and PII. This highlights critical data breaches in high-profile organizations.

  14. Chromium DevTools XSS Vulnerabilities (issues.chromium.org)

    A Chromium security issue (402791076) details how DevTools XSS vulnerabilities can lead to sandbox escape, UXSS, and CDP access. This impacts browser security significantly.

  15. LLM Poisoning with Small Samples (anthropic.com)

    Anthropic research demonstrates that even a small number of samples can poison LLMs of any size. This study underscores the fragility of large language models to data manipulation.

  16. Burp Suite Extension for gRPC-Web (blog.compass-security.com)

    Compass Security introduces bRPC-Web, a new Burp Suite extension specifically designed for testing gRPC-Web applications. This tool enhances the capabilities of security professionals for API analysis.

X1

  1. AI Browser Jailbreak Alert (@elder_plinius)

    An AI browser jailbreak alert on X reveals a successful "LSD jailbreak" against GPT-5, resulting in an "Atlas-Browser" liberation. This highlights significant vulnerabilities in new AI browsers. Watch Here

y0utube1

  1. Automating Network Exploits with NetExec (youtube.com)

    Dale Hobbs presents on automating network exploits using NetExec. This video provides insights and techniques for enhancing exploit capabilities. Watch Here

g1thub3

  1. Caddy C2 Profile Request Filter (github.com)

    Caddy v2 module for filtering requests based on C2 profiles, enhancing detection evasion capabilities. Explore on GitHub

  2. Enhanced Captcha Killer for Burp (github.com)

    Modified captcha-killer supporting base64 image recognition and free OCR libraries for verification code爆破. Explore on GitHub

  3. MCP Server Vulnerability Scanner (github.com)

    Scanner for Model Context Protocol servers identifying vulnerabilities in AI infrastructure components. Explore on GitHub

← All Seclogs