Risk Discovery

Phil Venables

The Daily Swig

We’re going teetotal: It’s goodbye to The Daily Swig

Bug Bounty Radar // The latest bug bounty programs for March 2023

Indian transport ministry flaws potentially allowed creation of counterfeit driving licenses

Password managers: A rough guide to enterprise secret platforms

Chromium bug allowed SameSite cookie bypass on Android devices

Deserialized web security roundup: Twitter 2FA backlash, GoDaddy suffers years-long attack campaign, and XSS Hunter adds e2e encryption

NIST plots biggest ever reform of Cybersecurity Framework

Cisco ClamAV anti-malware scanner vulnerable to serious security flaw

CVSS system criticized for failure to address real-world impact

‘Most web API flaws are missed by standard security tests’ – Corey J Ball on securing a neglected attack vector

AWS Security Blog

Spring 2025 PCI 3DS compliance package available now

177 AWS services achieve HITRUST certification

Malware analysis on AWS: Setting up a secure environment

Amazon EC2 defenses against L1TF Reloaded

Implementing Defense-in-Depth Security for AWS CodeBuild Pipelines

Secure file sharing solutions in AWS: A security and cost analysis guide: Part 2

Secure file sharing solutions in AWS: A security and cost analysis guide, Part 1

How to migrate your Amazon EC2 Oracle Transparent Data Encryption database encryption keystore to AWS CloudHSM

How to automatically disable users in AWS Managed Microsoft AD based on GuardDuty findings

New AWS whitepaper: AWS User Guide to Financial Services Regulations and Guidelines in Australia

Darknet - The Darkside

Least Privilege

My next Step

What’s going on?

The Future of IdentityServer

Flexible Access Token Validation in ASP.NET Core

Refresh Tokens in IdentityServer4 v4

Announcing IdentityServer4 v4.0

Resource Access in IdentityServer4 v4 and going forward

I don’t like Identity Tokens

The JWT Profile for OAuth 2.0 Access Tokens (and IdentityServer)

Updates on our Workshops

Fox-IT Blog

Decrypting Full Disk Encryption with Dissect

Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation

Sifting through the spines: identifying (potential) Cactus ransomware victims

From Backup to Backdoor: Exploitation of CVE-2022-36537 in R1Soft Server Backup Manager

CVE-2022-27510, CVE-2022-27518 – Measuring Citrix ADC & Gateway version adoption on the Internet

Encryption Does Not Equal Invisibility – Detecting Anomalous TLS Certificates with the Half-Space-Trees Algorithm

SnapMC skips ransomware, steals data

StreamDivert: Relaying (specific) network connections

WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group

LDAPFragger: Command and Control over LDAP attributes

Positive Technologies

PHDays 10 IDS Bypass contest: writeup and solutions

APT31 new dropper. Target destinations: Mongolia, Russia, the U.S., and elsewhere

How to detect a cyberattack and prevent money theft

Troy Hunt

Weekly Update 465

That 16 Billion Password Story (AKA "Data Troll")

Get Pwned, Get Local Advice From a Trusted Gov Source

Weekly Update 464

Welcoming Guardio to Have I Been Pwned's Partner Program

Weekly Update 463

Weekly Update 462

11 Years of Microsoft Regional Director and 15 Years of MVP

Good Riddance Teespring, Hello Fourthwall

Weekly Update 461

The Hacker Factor Blog

Detecting AI Music

What C2PA Provides

Breaking Windows and Linux Customizations

Feel the Burn

From Sunny Skies to the Solar System

The Security Skeptic

Exploiting well known TLD strings in domain names

CyberSecPolitics

Mythical Beasts

A quick research overview of the Research Handbook on Cyberwarfare

Automated LLM Bugfinders

What Open Source projects are unmaintained and should you target for takeover ?

The Open Source Problem

Jia Tan and SocialCyber

The Atlantic Council Paper and Defending Forward

FORECASTING

Guest Post: HostileSpectrum’s futures: Looking back on 2021’s estimative signposts

Pride Month

Schneier on Security

Friday Squid Blogging: Squid-Shaped UFO Spotted Over Texas

Trojans Embedded in .svg Files

LLM Coding Integrity Breach

AI Applications in Cybersecurity

SIGINT During World War II

The “Incriminating Video” Scam

Automatic License Plate Readers Are Coming to Schools

Friday Squid Blogging: New Vulnerability in Squid HTTP Proxy Server

Google Project Zero Changes Its Disclosure Policy

China Accuses Nvidia of Putting Backdoors into Their Chips

SANS Inernet Storm Center

ISC Stormcast For Friday, August 15th, 2025 https://isc.sans.edu/podcastdetail/9572, (Fri, Aug 15th)

SNI5GECT: Sniffing and Injecting 5G Traffic Without Rogue Base Stations, (Thu, Aug 14th)

ISC Stormcast For Thursday, August 14th, 2025 https://isc.sans.edu/podcastdetail/9570, (Thu, Aug 14th)

AI and Faster Attack Analysis [Guest Diary], (Wed, Aug 13th)

CVE-2017-11882 Will Never Die, (Wed, Aug 13th)

ISC Stormcast For Wednesday, August 13th, 2025 https://isc.sans.edu/podcastdetail/9568, (Wed, Aug 13th)

Microsoft August 2025 Patch Tuesday, (Tue, Aug 12th)

ISC Stormcast For Tuesday, August 12th, 2025 https://isc.sans.edu/podcastdetail/9566, (Tue, Aug 12th)

ISC Stormcast For Monday, August 11th, 2025 https://isc.sans.edu/podcastdetail/9564, (Mon, Aug 11th)

Google Paid Ads for Fake Tesla Websites, (Sun, Aug 10th)

Red Hat Security

Introducing Red Hat Technical Account Management Service for Product Security

Introducing OpenShift Service Mesh 3.1

Confidential containers on Microsoft Azure with Red Hat OpenShift Sandboxed Containers 1.10 and Red Hat Build of Trustee

Deploy sensitive workloads with OpenShift confidential containers

Reduce risk in Kubernetes: How to separate admin roles for safer, compliant operations

Red Hat Advanced Cluster Security 4.8 simplifies management, enhances workflows and offers deeper external IP visibility

Now available: Red Hat Enterprise Linux Security Select Add-On

Model Context Protocol (MCP): Understanding security risks and controls

Updates to Red Hat Advanced Cluster Security for Kubernetes Cloud Service strengthen your security posture

Pentest Partners

Pedro Felix's Shared Memory

Reactive streams: a play in multiple acts

RFC 8252 and OAuth 2.0 for Native Apps

Accessing the HTTP Context on ASP.NET Core

Should I PUT or should I POST? (Darling you gotta let me know)

Health check APIs, 500 status codes and media types

On contracts and HTTP APIs

Focus on the representation semantics, leave the transfer semantics to HTTP

Client-side development on OS X using Windows hosted HTTP Web APIs

Using multiple IIS server certificates on Windows 7

The OpenID Connect Cast of Characters

Google Online Security Blog

Android’s pKVM Becomes First Globally Certified Software to Achieve Prestigious SESIP Level 5 Security Certification

Introducing OSS Rebuild: Open Source, Rebuilt to Last

Advancing Protection in Chrome on Android

Mitigating prompt injection attacks with a layered defense strategy

Sustaining Digital Certificate Security - Upcoming Changes to the Chrome Root Store

Tracking the Cost of Quantum Factoring

Advanced Protection: Google’s Strongest Security for Mobile Devices

What’s New in Android Security and Privacy in 2025

Using AI to stop tech support scams in Chrome

Google announces Sec-Gemini v1, a new experimental cybersecurity model

Netlabs.360.com

僵尸网络911 S5的数字遗产

Heads up! Xdr33, A Variant Of CIA’s HIVE Attack Kit Emerges

警惕：魔改后的CIA攻击套件Hive进入黑灰产领域

快讯：使用21个漏洞传播的DDoS家族WSzero已经发展到第4个版本

P2P Botnets: Review - Status - Continuous Monitoring

P2P 僵尸网络：回顾·现状·持续监测

Fodcha Is Coming Back, Raising A Wave of Ransom DDoS

卷土重来的DDoS狂魔：Fodcha僵尸网络再次露出獠牙

PureCrypter is busy pumping out various malicious malware families

PureCrypter Loader持续活跃，已经传播了10多个其它家族

MS Cyber Security

Connect with the security community at Microsoft Ignite 2025

Dow’s 125-year legacy: Innovating with AI to secure a long future

Announcing public preview: Phishing triage agent in Microsoft Defender

Sharing practical guidance: Launching Microsoft Secure Future Initiative (SFI) patterns and practices

Elevate your protection with expanded Microsoft Defender Experts coverage

Microsoft Entra Suite delivers 131% ROI by unifying identity and network access

Modernize your identity defense with Microsoft Identity Threat Detection and Response

Frozen in transit: Secret Blizzard’s AiTM campaign against diplomats

Sploitlight: Analyzing a Spotlight-based macOS TCC vulnerability

Disrupting active exploitation of on-premises SharePoint vulnerabilities

The Last Watchdog

Black Hat Fireside Chat: Automation takes center stage as TLS lifespans grow ever shorter

SHARED INTEL Q&A: From Code Red to the ‘new control plane’ — Marc Maiffret on identity

News alert: New Heimdal study reveals tool overload is driving fatigue, missed threats in MSPs

News alert: INE named among top providers of practical, career-ready cybersecurity training in 2025

MY TAKE: Black Hat 2025 vendors define early contours for a hard pivot to AI security architecture

MY TAKE: The GenAI security crisis few can see — but these startups are mapping the gaps

News alert: SpyCloud’s AI-powered platform mimics veteran analysts, speeds threat detection

Black Hat Fireside Chat: Inside the ‘Mind of a Hacker’ — A10’s plan for unified threat detection

SHARED INTEL Q&A: From alert to fix — Gomboc brings trusted AI to Infrastructure-as-Code

News alert: OpenSSL conference to convene experts on cryptograohy, compliance and open-source

The Security Catalyst

Why we must develop ourselves before we can elevate our team

Ease change by painting a picture of a better tomorrow

Deliver value faster by asking what they know… that you don’t (yet)

Why I love asking “What if I’m wrong?”

The surprising reason you need to record yourself rehearsing before your next presentation

Security needs more sizzle, less steakhouse

Why we always restate the problem

How you get disconnected from your value (and your story)

Do you see the progress you made this week?

How to use percolation and incubation to solve problems

Cloud Security Alliance

Agentic AI and Zero Trust

Assets Under Attack: Email Threats Targeting Financial Services Jump 25%

Why You Should Say Goodbye to Manual Identity Processes

How to Secure and Manage Virtualized IT Environments the Right Way

Sunsetting Circle: Where CSA Communities Are Headed and How to Join

Cloud Security Alliance Names Google Cloud as First Company to be Valid-AI-ted, Setting New Benchmark for Data-driven Cloud Assurance

Visibility ≠ Security: The SaaS Illusion That’s Putting Enterprises at Risk

The Missing Piece in GRC

Strategic Implementation of the CSA AI Controls Matrix: A CISO's Guide to Trustworthy AI Governance

From Aware to Actionable: Closing the Cloud Security Resilience Gap

Krebs on Security

Mobile Phishers Target Brokerage Accounts in ‘Ramp and Dump’ Cashout Scheme

Microsoft Patch Tuesday, August 2025 Edition

KrebsOnSecurity in New ‘Most Wanted’ HBO Max Series

Who Got Arrested in the Raid on the XSS Crime Forum?

Scammers Unleash Flood of Slick Online Gaming Sites

Phishers Target Aviation Execs to Scam Customers

Microsoft Fix Targets Attacks on SharePoint Zero-Day

Poor Passwords Tattle on AI Hiring Bot Maker Paradox.ai

DOGE Denizen Marko Elez Leaked API Key for xAI

UK Arrests Four in ‘Scattered Spider’ Ransom Group

tl;dr sec

[tl;dr sec] #292- HTTP/1.1 must die, AI + SAST, Google's Insider Threat Detection Tool

[tl;dr sec] #291 - Build a GuardDuty Triage Agent, Scaling Netflix's Threat Detection Pipelines, Claude for Security Review

[tl;dr sec] #290 - Securing MCP, AppSec Archetypes, CISO's Guide to Protecting Crown Jewels

Intent Over Tactics: A CISO's Guide to Protecting Your Crown Jewels

[tl;dr sec] #289 - AI-powered Fuzzing, Incentives in Security, Malware in DNS

[tl;dr sec] #288 - Prompt Injection in Malware, Preventative Security, Top Bug Bounty War Stories

[tl;dr sec] #287 - fwd:cloudsec Talk Recordings, How Figma Only Runs Approved Software, Auditing Code with AI

[tl;dr sec] #286 - Securing Vibe Coding, Finding Secrets "Oops Commits", Backdooring IDE Extensions

[tl;dr sec] #285 - AI Red Teaming, Detection Engineering Field Manual, Building AppSec Partnerships

AppSec as Glue: Building Partnerships to Scale Security

Security Intelligence

Project Zero

From Chrome renderer code exec to kernel with MSG_OOB

Policy and Disclosure: 2025 Edition

The Windows Registry Adventure #8: Practical exploitation of hive memory corruption

The Windows Registry Adventure #7: Attack surface analysis

Breaking the Sound Barrier Part I: Fuzzing CoreAudio with Mach Messages

The Windows Registry Adventure #6: Kernel-mode objects

Blasting Past Webp

Windows Exploitation Tricks: Trapping Virtual Memory Access (2025 Update)

Windows Bug Class: Accessing Trapped COM Objects with IDispatch

The Windows Registry Adventure #5: The regf file format

Mozilla Security

CyberWatch

Comparing Chinese APTs in Software Supply Chain Attacks

Daily Perk 3/30/2021 Updated

“Broken Trust”: The New Report from the Atlantic Council chronicles supply chain attacks

Daily Perk 3/29/2021

Daily Perk 3/252021

Daily Perk 3/23/2021

Zero Day

How you're charging your tablet is quietly killing it - 3 mistakes to avoid (and the right way)

Changing these 12 settings on my Android phone extended its battery life by hours

Your smart home device just got a performance and security boost for free

Why I recommend this $400 Google Pixel over competing models from Samsung and OnePlus

Why you shouldn't buy a Google Pixel phone right now - even if you're a superfan

Why I still recommend this 2024 Dell laptop for work and productivity - even though it's for gamers

This Pixel 10 rumor just gave Google an edge over Samsung and OnePlus

Don't buy new headphones until you do these 5 steps with your old pair

The viral Toniebox is exactly what both kids and parents want from a smart device (and it's on sale)

This 5-in-1 charger is the only one I'll need to travel (and it's full of power)

The Security Ledger

Report Reveals Tool Overload Driving Fatigue and Missed Threats in MSPs

INE Named to Training Industry’s 2025 Top 20 Online Learning Library List

AccuKnox partners with SecuVerse.ai to deliver Zero Trust CNAPP Security for National Gaming Infrastructure

SpyCloud Enhances Investigations Solution with AI-Powered Insights – Revolutionizing Insider Threat and Cybercrime Analysis

Security Risk Advisors Introduces SCALR AI – A Platform for Rapid Agentive AI Enablement

StrikeReady Unveils StrikeStream: The First Fully Integrated Security Data Pipeline Embedded in an AI‑Powered Security Operations Platform

Early Bird Registration Now Open for The Inaugural OpenSSL Conference 2025

Comp AI secures $2.6M pre-seed to disrupt SOC 2 market

SquareX Discloses Architectural Limitations of Browser DevTools in Debugging Malicious Extensions

AccuKnox Named Top AI Security Startup at Security BSides Bangalore 2025

CISA Blog

CyberSecIntelligence

פקודות בסיסיות בלינוקס - תרגול 3

פקודות בסיסיות בלינוקס - תרגול 2

פקודות בסיסיות בלינוקס

פקודות בסיסיות בלינוקס - תרגול 1