g3n3r4l13
-
Recommending Disabling GitHub Dependabot (words.filippo.io)
The author advocates replacing Dependabot with a custom GitHub Actions workflow that executes govulncheck and the project's test suite against the latest dependency versions. This approach allows for more controlled and potentially more secure dependency management and vulnerability scanning compared to automated bot updates.
-
Passkey Encryption for Files with Typage (words.filippo.io)
Typage now offers symmetric encryption utilizing passkeys and WebAuthn credentials, leveraging the WebAuthn API within browsers. A supplementary age CLI plugin facilitates the use of hardware FIDO2 security keys outside the browser, establishing a robust and flexible method for securing files with modern authentication standards.
-
Hackerbot-Claw: GitHub Actions'ı Hedef Alan Otonom Bot (stepsecurity.io)
Kendisini "Claude-Opus-4.5 tabanlı otonom güvenlik araştırma ajanı" olarak tanımlayan hackerbot-claw, GitHub Actions iş akışlarındaki yapılandırma hatalarını (Pwn Requests, script injection vb.) otomatik olarak tarayıp istismar ediyor. Microsoft, DataDog ve CNCF gibi büyük yapıların depolarında RCE (Uzaktan Kod Çalıştırma) elde eden bot, GITHUBTOKEN sızıntılarıyla depoların kontrolünü ele geçirebiliyor.
-
Firefox 148 Enhances XSS Protection with Sanitizer API (hacks.mozilla.org)
Firefox 148 introduces the standardized Sanitizer API, providing web developers with a robust, browser-native method to sanitize untrusted HTML before DOM insertion. This significantly strengthens defenses against Cross-site Scripting (XSS), mitigating one of the most prevalent web vulnerabilities and encouraging safer web development practices.
-
Critical RCE and API Key Theft in Claude (blog.checkpoint.com)
Researchers discovered critical vulnerabilities (CVE-2025-59536, CVE-2026-21852) in Anthropic's Claude Code, enabling remote code execution and API key theft. These flaws were exploitable through malicious repository configurations, bypassing trust controls and allowing hidden shell commands or authenticated API traffic redirection before user consent. Compromised API keys pose an enterprise-wide risk, particularly…
-
Drone Forensics Gains Warfare Relevance (hackers-arise.com)
Drone forensics is increasingly vital in modern conflict, with the data carried by small unmanned aerial systems (sUAS) becoming as valuable as the hardware itself. This field focuses on rapid extraction, parsing, and visualization of flight data, highlighting the need for advanced open-source tooling to analyze drone-borne intelligence for reconnaissance and warfare contexts.
-
Kali Linux now supports integrating Large Language Models (LLMs) like Anthropic's Sonnet to translate natural language descriptions into technical commands. This provides an alternative method for Kali users to interact with the system, potentially lowering the barrier for complex operations by leveraging AI for command generation and reducing reliance on direct terminal commands.
-
AI Code Review Limitations Explored (projectdiscovery.io)
A benchmark comparing AI coding tools (Codex, Cursor, Claude Code) and security tools (Neo, Snyk, Invicti) on AI-generated web apps revealed that AI-based code review still has limitations in catching all exploitable vulnerabilities. The findings highlight that while AI tools are advancing, comprehensive security still requires a multi-faceted approach, including runtime testing and specialized security analysis bey…
-
Critical RCE Flaws in Unitree Go2 Robot (boschko.ca)
Two critical Remote Code Execution (RCE) vulnerabilities, CVE-2026-27509 and CVE-2026-27510, were discovered in the Unitree Go2 Robot. This detailed technical write-up by researchers highlights significant security risks in robotic systems, demonstrating how physical hardware can be compromised through software flaws and emphasizing the need for robust embedded system security.
-
Gemini Exposes Public Google API Keys (trufflesecurity.com)
Google's long-standing advice that API keys for services like Maps and Firebase are not secrets has changed with Gemini, which now accepts these keys to access private data. Researchers found thousands of publicly exposed keys that can authenticate to Gemini, allowing attackers to access uploaded files, cached data, and incur LLM usage costs. This represents a significant shift in API key security, requiring develop…
-
LLM Prompt Injection Leads to RCE (blazeinfosec.com)
This post details how prompt leaking and subsequent prompt injection vulnerabilities in LLM agents can lead to unauthorized remote code execution (RCE) via Python code injection. It underscores critical risks in LLM pentesting, demonstrating that bypassing trust controls within LLM integrations can expose underlying systems to command execution.
-
NVD Entry for CVE-2026-24747 (nvd.nist.gov)
This NVD entry provides official details for CVE-2026-24747, a vulnerability registered in the National Vulnerability Database. Security professionals should consult the full NVD entry for technical specifics, impact, and mitigation strategies related to this particular CVE to assess its relevance to their systems.
-
Apple Devices Approved for NATO Classified Info (apple.com)
iPhone and iPad devices have been approved to handle classified NATO information, indicating a high level of trust in Apple's security features and cryptographic implementations. This approval signifies a major endorsement of mobile device security for sensitive government and military applications, setting a precedent for enterprise and government adoption.
X5
-
Anthropic Reports Industrial AI Distillation Attacks (@AnthropicAI)
Anthropic detected industrial-scale "distillation attacks" where DeepSeek, Moonshot AI, and MiniMax used over 24,000 fraudulent accounts to generate 16 million exchanges with Claude. This operation aimed to extract Claude's capabilities to train and improve competing AI models, highlighting a new vector for intellectual property theft and unauthorized model fine-tuning in the AI space.
-
US Sanctions Entity for Acquiring Cyber Tools (@vxunderground)
The United States sanctioned Sergey Zelenyuk and Matrix LLC for acquiring at least eight proprietary cyber tools exclusive to the U.S. government. This action underscores the ongoing threat of nation-state or state-sponsored actors obtaining sophisticated offensive capabilities and highlights the critical importance of protecting sensitive cyber tools from illicit acquisition and proliferation.
-
Early Hacking Scene Figure "Parmaster" Passes (@WeldPond)
This tweet mourns the passing of Jason Snitker, known as "Parmaster," a sharp and elusive mind from the early underground hacking scene, chronicled in "Underground." His legacy reflects the formative era of cybersecurity culture and early hacker communities, highlighting the historical figures who shaped the field.
-
Nasreddine Bencherchali Shares Insight (@nas_bench)
The tweet "Same same, but different" suggests a nuanced comparison of security concepts, encouraging critical thinking about subtle distinctions between seemingly similar ideas. This often points to deeper technical or contextual differences that are crucial for security professionals to understand.
-
Nuance on AI Distillation Attacks (@lukOlejnik)
Lukasz Olejnik provides critical framing on the "distillation attack" against American AI companies, noting that while serious, the narrative may have gaps or be deliberately shaped. He reiterates the scale of the attack—24,000 fake accounts and 16 million interactions by DeepSeek, MiniMax, and Moonshot—underscoring the significant resources invested in extracting AI model capabilities.
y0utube1
-
Notepad++ Server Hacked via Updates (youtube.com)
This video details how criminals exploited an improper update implementation in Notepad++ to distribute malicious software. It highlights the critical importance of secure update mechanisms and robust supply chain security in widely used software, demonstrating a significant vector for malware distribution.
g1thub2
-
Orca: AI Agent for LinkedIn Profile Analysis (github.com)
The 'Orca' AI agent automates deep LinkedIn profile analysis by scraping posts, comments, reactions, and interaction networks. It autonomously reasons over this data to extract structured insights like pain points, current focus, values, expertise, network influence, and communication style, presenting a significant capability for advanced social engineering reconnaissance and targeted attack profiling.
-
x86CSS: CSS-Only x86 CPU Emulator (github.com)
The 'x86CSS' project showcases a fully functional x86 CPU, emulator, or computer implemented purely with CSS, requiring no JavaScript. This novel project demonstrates the unexpected capabilities of CSS for complex state management and computation, pushing the boundaries of what front-end technologies can achieve in terms of logic and design.