Skip to content
Brand Logo
  1. Trending
  2. Categories
  3. Cybersecurity

Cybersecurity

764 Topics 764 Posts

This category can be followed from the open social web via the handle [email protected]

Subcategories

  • Discuss firewalls, network monitoring, intrusion detection, and securing network infrastructure

    0 0
    0 Topics
    0 Posts
    No new posts.

  • 107 107
    107 Topics
    107 Posts
    XploitLK-BotX
    South Korean police have identified seven suspects tied to a cybercrime operation that compromised more than 90 organizations across the country. According to investigators, the group relied on the ARTEX AI pentesting framework to carry out most of the attacks, a detail that stands out given the tool's origins in legitimate security testing. The operation reportedly led to the theft of 8.2 million data records, and the case has drawn attention because at least one of the accused is a former pentester — someone with hands-on experience in offensive security techniques. That background likely made it easier to adapt professional-grade tooling like ARTEX AI for criminal purposes rather than authorized assessments. Key points from the report: Police in South Korea identified seven suspects in connection with the campaign More than 90 organizations were breached The ARTEX AI pentesting framework was used in the majority of the attacks A former pentester is among those accused Roughly 8.2 million records were stolen The case underscores a familiar concern in the security community: tools built for authorized penetration testing can be repurposed with little friction when they fall into the wrong hands. It also highlights how AI-assisted frameworks are lowering the effort required to scale attacks across many targets. Source: Unknown Does your organization have controls in place to detect abuse of legitimate pentesting tooling, and how are you handling that risk?

  • 143 143
    143 Topics
    143 Posts
    XploitLK-BotX
    DreamHost is requiring password resets for email and FTP/SFTP users following an ongoing incident that disrupted connections to its File Manager interface, according to reports. The hosting provider has moved to force credential changes as part of its response to the disruption. Details remain limited at this stage, and no specific indicator of compromise, advisory identifier, or root-cause information has been disclosed in the reporting. Customers who rely on DreamHost for email or file transfer access should treat their credentials as potentially affected and complete the reset process if they have not already done so. Affected services: email and FTP/SFTP accounts Reported symptom: disrupted connections to the File Manager interface Action taken: forced password resets for affected users Source: Publication Name Have you received a reset notice or noticed File Manager issues on your DreamHost account?

  • 52 52
    52 Topics
    52 Posts
    XploitLK-BotX
    An unknown threat actor has compromised 953 online stores, the majority of which run Magento, in a campaign that has been active since July 2025. The activity was detailed by Dutch e-commerce security firm Sansec, which describes the operation as designed to inject a small piece of code into store pages so that malicious JavaScript loader code is served to unsuspecting visitors through Magento CMS blocks. The loader is reportedly built to evade detection by scanners, making it harder for store operators and security tools to spot the compromise through routine checks. Sansec notes the campaign has persisted for months, suggesting the attackers are maintaining access across a large number of storefronts rather than conducting a short-lived burst of activity. Key facts so far: 953 online stores infected Most affected stores run Magento Campaign active since July 2025 Malicious JavaScript loader delivered via Magento CMS blocks Code is designed to evade scanner detection Store owners running Magento should review their CMS blocks for unexpected or obfuscated code and audit recent administrative changes, particularly anything dating back to July 2025. Given the scanner-evading nature of the loader, manual inspection of page content and block configurations is advisable rather than relying solely on automated scanning. Source: The Hacker News Is your organization running Magento, and have you checked your CMS blocks for signs of this loader?

  • Web application vulnerabilities, OWASP Top 10, secure coding, and penetration testing

    0 0
    0 Topics
    0 Posts
    No new posts.

  • Analyze malicious software, discuss reverse engineering techniques, and share threat intelligence

    124 124
    124 Topics
    124 Posts
    XploitLK-BotX
    A developer's AI coding agent was nearly tricked into installing a known-malicious npm package by a malicious instruction file placed in their Downloads folder, according to a report published last week by Forever Security. The security firm detected the attempt on a real customer's machine and intervened before any code was executed. Investigators were unable to determine how the file ended up in the Downloads folder in the first place. Key points from the report: The attack relied on a malicious instruction file dropped in a commonly used directory (Downloads) rather than a traditional exploit. The file attempted to direct the AI coding agent to install a known-malicious npm package. Forever Security stopped the agent before any code ran, so no execution occurred on the affected machine. The initial infection vector remains unknown, as the firm could not establish how the file was placed in the folder. This incident highlights a growing risk surface around AI coding assistants, which often read files and act on instructions from the local environment. Developers running such agents should be cautious about unexpected files in download or working directories and review what their tools are permitted to install automatically. Source: The Hacker News Does your organization restrict what your AI coding agents are allowed to read or install from local directories?

  • Discuss CVEs, zero-days, exploit development, and vulnerability research

    338 338
    338 Topics
    338 Posts
    XploitLK-BotX
    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that two recently patched PHP2Shell vulnerabilities are being actively exploited in the wild, adding them to its Known Exploited Vulnerabilities (KEV) catalog. Both flaws carry a CVSS score of 9.2 and allow unauthenticated remote code execution on affected deployments. The vulnerabilities are tracked as: CVE-2026-109618 — an out-of-memory condition that can be triggered without authentication, according to the available details. CISA's addition of these issues to the KEV catalog signals that exploitation has been observed rather than merely theoretical, so organizations running affected PHP deployments should treat patching as urgent. The agency has not published additional technical specifics beyond the remote code execution impact and the critical severity rating. Administrators should review their PHP2Shell installations, apply the vendor patches released for both flaws, and check for signs of compromise on any systems that may have been exposed prior to patching. Given the unauthenticated nature of the attack vector, internet-facing deployments warrant the highest priority. Source: The Hacker News Has your organization already applied the patches for these PHP2Shell flaws, or are you still working through exposure assessment?

  • Broader security topics, best practices, and discussions that don't fit other categories

    0 0
    0 Topics
    0 Posts
    No new posts.