标签：#Security

Open source, commercial, single-hop, multi-hop, mixnet? The array of options is dizzying.

Abliteration.AI is making powerful AI models without guardrails easier to access, arguing that giving defenders the same tools as bad actors could ultimately improve cybersecurity.

A system has to run a chunk of code you don't control —a plugin, a dependency, something generated— and you want to guarantee that code cannot touch the file system or spawn processes. Not that it "shouldn't": that it can't , mechanically. That's capability confinement, and it's one of the central problems of runtime security. Designing it and demonstrating it are two different things, and confusing them is expensive. A design is a claim You can write an impeccable document: "access to fs and to spawning processes is controlled like this, with these mechanisms, under this threat model". It's real and necessary work. But it's a claim . And the failure mode of a security boundary is that it looks like it holds until it doesn't —silent, invisible in tests, visible only when someone crosses it—. In security, an unverified claim has exactly the shape of a beautiful, wrong architecture. The design can assume that a module-loader hook fires at a point where it actually doesn't, and all the reasoning hanging off that is correct and worth nothing. The mechanisms exist, and there are several In Node, to name a concrete runtime, there are at least three layers, and they aren't interchangeable: The native permission model ( --permission , --allow-fs-read …), which cuts access to fs and to spawning processes at the whole-process level. SES / Hardened JavaScript (Compartments, lockdown() ), which confines what each module can import within the process. Module-loader interception , which controls what resolves when the code asks for something. Choosing well among them is the design. But choosing well doesn't prove the choice holds against the real dependency tree you're going to run. Demonstrate instead of claim The alternative to signing off a design is delivering a confinement harness : untrusted code that tries to reach the dangerous capability —open a file, spawn a process— against the real runtime and its real dependency tree, and a log that shows each attempt was blocked . O

OpenAI introduces Daybreak for Frontline Defenders. A $1 billion commitment expands access to frontier cyber AI, training, and support for essential services.

Dynamic rendering in Angular sounds like a fairly narrow technical problem: “I don't know which component I need until runtime.” Angular already gives us several good tools for that. But there is a big difference between dynamically choosing a component and dynamically constructing an entire UI from a runtime specification. And that difference becomes especially important with Server-Driven UI and Generative UI. 1. ngComponentOutlet : when the problem is really just component selection For simple cases Angular already gives us: <ng-container *ngComponentOutlet= "componentType" /> This works very well when the application already knows its possible components and runtime logic only decides which one to display. componentType = condition ? UserCardComponent : AdminCardComponent ; The advantages are obvious: very little infrastructure, normal Angular lifecycle, AOT-compatible components and a relatively declarative template. But this approach starts becoming uncomfortable when the runtime input is no longer: UserCardComponent and instead becomes: { "type" : "Card" , "children" : [ { "type" : "Input" , "props" : { "label" : "Name" } } ] } Now we are no longer selecting a component. We are interpreting a UI description. 2. ViewContainerRef.createComponent() : more control, more responsibility Angular also allows components to be instantiated programmatically: const ref = viewContainerRef . createComponent ( componentType ); ref . setInput ( ' label ' , ' Name ' ); This is a powerful primitive. We control where the component is created, which component is used, how inputs are assigned and when the component is destroyed. For relatively contained dynamic behavior, this can be exactly what we need. But once a runtime specification controls many components, application code often starts evolving into something like: switch ( node . type ) { case ' input ' : ... case ' select ' : ... case ' button ' : ... case ' dialog ' : ... } Then we add input mapping. Then events. Then ne

WIRED rebuilt Flock’s latest search tool from code the company sends to a police officer’s browser. Its AI can keep watch across multiple cameras for anyone fitting a written description.

Not three percent. Three techniques. The four chains you would most want to catch — discovery, collection, exfiltration, C2 — produced zero alerts between them. I want to be precise about what that number is and is not, because the number is easy to misread in both directions. What it is A default install. Stock rules, no Sysmon, no ScriptBlock logging, no tuning. We replayed 24 techniques and counted how many produced an alert a human would see. Denominator: 24. Numerator: 3. What it is not It is not a claim that Wazuh is a bad SIEM. It is a claim that a default SIEM is close to blind, and that most of the detection you think you bought is configuration you have not done yet. The same technique, three SIEMs T1110.001 (brute force) is the one technique we have run end-to-end on all three platforms. SIEM Setup Result MTTD Wazuh 4.14.2 SSH brute force, 20+ failed logins, custom rule 100113 ALERTED ×2, coverage 100% 25s / 45s IBM QRadar CE 7.3.3 hydra, 50 SSH login attempts against a live victim host ALERTED ~4s Splunk Enterprise winsrv01 , 12× EventCode 4625 — events replayed into Splunk, not generated by a live attack ALERTED 0s Read the third row differently from the first two. Wazuh and QRadar were measured against a real attack on a real host: hydra and a live SSH brute force, with the alert coming back out of the platform. The Splunk row is a real Splunk Enterprise, a real detection-as-code rule, and a real query — but the 4625 events were replayed in rather than produced by an attack we ran. That makes it a valid test of the connector and the rule. It is not a test of Splunk's ingest path, and we are not going to let it read as one. 🔴 Do not read this table as a race either. The three numbers are not comparable and we are not going to pretend they are. Splunk's 0s is not Splunk being six times faster than QRadar — it is Windows 4625 events already sitting in the index before the clock started, while the Wazuh figure includes agent-to-manager-to-indexer propagati

To keep scammers at bay, dating apps are embracing biometric scanning tools and “verified human” badges. These moves are sparking concerns about surveillance and privacy.

abandoned open source package vulnerability EOL dependency strategy fork vs patch security alert open source risk mitigation OSS abandonment decision tree tech lead security SLA abandoned dependency vulnerability end of life open source package unpatched upstream dependency replace abandoned OSS library isolate vulnerable code fork open source package internal maintenance OSS fork formal risk acceptance InstaSLA accepted risk logging vulnerability SLA deadline EOL package remediation open source dependency risk unmaintained open source library patching abandoned packages Upstream OSS Abandonment An Engineering Decision Tree for EOL Dependencies Back to blog The Silent Crisis of Upstream Abandonment Option 1: Replace the Dependency (The Ideal, but Costly Path) Option 2: Wrap and Isolate the Code (The Tactical Defense) Option 3: Fork and Maintain Internally (The Ownership Commitment) Option 4: Formal Risk Acceptance (The Compliance Reality) What 2025–2026 Actually Looked Like Conclusion Upstream OSS Abandonment: An Engineering Decision Tree for EOL Dependencies When an active vulnerability SLA deadline looms over a critical application, the standard playbook is straightforward: update the package, run the tests, merge the pull request. But what happens when the underlying open-source library has been quietly abandoned by its maintainer? Engineering teams are running into this exact scenario more often, and the numbers back that up: Veracode's 2025 State of Software Security report found that half of organizations carry critical security debt, and 70% of that debt originates from third-party code and the software supply chain. As the software supply chain grows more complex, the odds of an EOL package sitting somewhere in your dependency tree keep climbing. This article lays out a step-by-step decision framework for tech leads and security teams managing an EOL dependency when no upstream patch is coming — and updates it with what's actually happened in the open-source

Security teams have historically operated on instinct. A firewall rule feels right. A new tool seems like it will help. An audit finding gets patched because someone said it was important. That approach worked when security was a small, contained function bolted onto IT. It doesn't work anymore. Attack surfaces are larger, budgets are scrutinized more closely, and boards want to know whether the money spent on security is actually reducing risk. The answer to that pressure is metrics-driven security: running your security program the way a good engineering or product team runs theirs, with defined measurements, targets, and feedback loops. Table of Contents What "Metrics-Driven" Actually Means Why Most Security Metrics Fail Metrics Worth Tracking Turning Metrics Into Decisions The Cultural Shift Conclusion What Metrics-Driven Actually Means Being metrics-driven means three specific things: You decide in advance what "good" looks like. Before you deploy a new control, you define what success would look like in numbers, not just vibes. You track the same metrics over time, so you can tell whether things are improving, stagnant, or getting worse. You let the metrics change what you do. If a number tells you a program isn't working, you adjust the program. If it tells you a risk is shrinking, you can safely redirect resources elsewhere. The distinguishing feature isn't the existence of data. It's that decisions actually flow from the data, rather than data being collected to justify decisions already made. Why Most Security Metrics Fail A lot of security metrics programs collapse under their own weight because they measure activity instead of outcomes. Counting the number of vulnerabilities scanned, phishing emails sent, or tickets closed tells you that people were busy. It doesn't tell you whether the organization is safer. Good metrics programs avoid a few common traps: Vanity metrics. Numbers that always trend in a favourable direction regardless of actual security p

Originally published on indiecore.net . I deployed, opened the console on the live site out of habit, and found this: Loading the script 'https://static.cloudflareinsights.com/beacon.min.js/v3d52…' violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'inline-speculation-rules'". The action has been blocked. I had not added that script. It is in no template, no build output, and no dependency. grep -c cloudflareinsights dist/index.html returns 0. It is not in the page you build Cloudflare Web Analytics has an automatic mode, on by default when a site is added, that injects beacon.min.js into HTML responses at the edge. Your origin never sees it. Your repository never contains it. It also does not inject for everything. I fetched the same URL with curl, then again with a full desktop browser User-Agent, and neither response carried the script. Only a real browser navigation gets it, which is why Lighthouse saw it and my terminal did not. That combination is worth sitting with for a second. The artefact exists in production, is absent from your source, and cannot be reproduced with the tool most of us reach for first when we want to see what a server actually returned. Nothing was tracked The CSP did its job. From the Lighthouse network trace: url : https://static.cloudflareinsights.com/beacon.min.js/v3d52… resourceType : Script statusCode : -1 transferSize : 0 Status −1 with zero bytes transferred means the request never started. The browser matched the URL against script-src , found no permitted source, and refused before opening a connection. No data left anyone's browser. So the console error is the sound of a guard working. It still costs something: a logged error drops the Best Practices category from 100 to 92, and a red line in the console trains you to ignore red lines in the console. The fix everyone reaches for is the wrong one here Search the error and the common answer is to add https://static.cloudflareinsights.com

Short answer: For a server-rendered Go login, keep session creation, verification, refresh, and logout under one server-side policy, then make password recovery revoke old sessions and emit an audit trail before it creates a new one. The page reaches on-call as a symptom, not a diagnosis: a learner completes /forgot-password , lands on /login again, and support can't tell whether the old browser session was revoked. The least complex design that survives the audit is an opaque cookie backed by a server-side session record, with recovery tokens kept separate from login sessions. That choice does add a stateful lookup to authenticated requests. It also gives the platform team a place to enforce expiry and revocation without trusting the browser to report its own status. No magic here. The page starts at the end of the audit chain The first alert should describe the user-visible control that failed: password recovery completed, yet session revocation did not complete within the authorization-change SLO. A raw rise in 401 responses isn't enough because it mixes expired cookies, revoked sessions, invalid credentials, and application mistakes into one noisy count. The useful page carries a correlation ID, the affected flow, and the oldest incomplete state transition; it does not carry a password, recovery token, or raw session identifier. Work backward from that page. A defensible event chain is recovery_requested , recovery_credential_verified , password_changed , sessions_revoked , and, when policy permits it, new_session_created . The names are local choices rather than a standard, but their order represents the control being audited: the temporary recovery credential proves only that the password may be changed, while the login session authorizes later requests. Combining those credentials makes expiration and revocation harder to explain, so keep separate hashes, lifetimes, and consume paths. Consider two tabs submitting the same recovery form. Both requests may pass

With cryptocurrency wallets becoming huge targets for hackers, using a cold wallet to protect your private keys has never been more important.

Every developer I know now runs an AI coding agent in something like auto-accept mode. Claude Code, Codex, Cursor: you give it a task, it runs commands, edits files, installs packages, and you review... the diff, maybe. The commands? The installs? The thing it did in that folder outside the repo? Nobody looks. The activity scrolls off the terminal and is gone. That asymmetry bothered me. We built an entire industry around audit trails for humans (git blame, CI logs, access logs), then handed the keyboard to agents and kept none for them. So I built Tracon: a local flight recorder for AI coding agents. The name is the FAA's term for Terminal Radar Approach Control, the radar room that tracks every aircraft in an airspace. This one tracks every agent on your machine. What it does Tracon is a Mac and Windows desktop app (Tauri 2, Rust core, React UI, SQLite store) that sits in the tray and records what your agents do: A timeline per session: every command, file edit, package install, and prompt, attributed to the agent and session that did it Danger flags as they happen: recursive deletes, pipe to shell installs, credential access, force pushes, permission bypasses. Tracon flags; it never blocks A Live page: one monitor per active session, like a security room, streaming recent commands with flagged ones highlighted in red, plus which subagents the session has spawned A conversation reader: the actual chat behind any event, read straight from the agent's own transcript, read only A package watch across npm, pnpm, pip, cargo, and brew, with opt in threat intelligence against osv.dev Capture is deliberately passive. Hooks give real time events over localhost; transcript tailing (filesystem notify, read only) covers everything else, so CLI sessions show up live even with zero setup. A dead or closed Tracon never slows an agent down. Everything stays on your machine: no telemetry, no accounts, AGPL. The recursive part Here is the part I find genuinely funny: Tracon was lar

Article Summary: This article argues that EDR evasion testing does not depend on access to a cloud management console. Instead, the core requirement is a reproducible test environment employing single-variable controlled experiments to pinpoint detection triggers. It introduces the open‑source Detonator framework for automated EDR testing, supporting CrowdStrike and other major EDRs. The methodology emphasises a snapshot‑per‑run and one‑variable‑per‑test approach, and the article also notes the availability of authorised EDR test tokens. Categories: Cybersecurity, Red Teaming, Security Tools Executive Summary This briefing addresses a common challenge faced by red team practitioners: testing a new loader against a CrowdStrike‑protected endpoint without access to the cloud‑based Falcon console. Many assume that the absence of logs renders testing futile. However, the author contends that the console provides only a conclusion (whether the sample was killed), whereas what the tester truly needs is the point of failure in the attack chain. By adopting a reproducible, single‑variable testing methodology—supported by the Detonator framework—one can systematically isolate the specific API call or technique that triggers detection, independent of console logs. This approach transforms debugging from a blind guessing game into a rigorous scientific process. Introduction Consider the following scenario: you have obtained a CrowdStrike endpoint with the sensor online and fully operational. You are ready to test a loader that you have been refining for three weeks. Then you realise— you have no cloud console . No logs, no detection strings, no rule triggers. The immediate reaction is often panic: "How can I test without visibility?" But the central thesis of this article is that the console is not as indispensable as it seems. The true value lies not in receiving a binary verdict, but in understanding where and why the detection occurred. The Console: A Mere Reporter of Result

An identity theft search site claimed to have more than 150 million driver's license photos stolen from an ID verification service. The crime site has now shut down.

I needed to automate Gumroad product creation — log in, create a product, set the price, upload a file, write the description, publish. Gumroad has no public API for this. The only option is browser automation. Here's what I had to get right, in order, and where each step breaks if you're not careful. The auth chain Step 1: Password reset The account had a password I didn't know. I triggered a reset from the login page. Gumroad sends a reset email with a link. The link expires fast — I don't know the exact TTL, but it was under 30 minutes. I used the AgentMail MCP to read the email and extract the reset link. The link is a Gumroad URL with a token parameter. Navigating to it shows a password reset form. Where it breaks: If you try to fill the new password field with input.value = 'newpassword' , React won't register the change. The form will submit with an empty password. You need to use the native value setter: const nativeSetter = Object . getOwnPropertyDescriptor ( HTMLInputElement . prototype , ' value ' ). set ; nativeSetter . call ( passwordInput , newPassword ); passwordInput . dispatchEvent ( new Event ( ' input ' , { bubbles : true })); This is because React overrides the value property on inputs with its own setter that tracks changes via a value tracker. The native setter bypasses React's tracker, and the input event tells React to sync state. Step 2: Two-factor authentication After password reset, logging in triggers 2FA. Gumroad's 2FA is email-based — not TOTP. There's no authenticator app. They email you a 6-digit token. The token appears in the email subject line: "Your authentication token is 126874" . This is convenient — you don't need to parse the email body. Just grab the subject, regex out the digits. const subject = " Your authentication token is 126874 " ; const token = subject . match ( /token is (\d + ) / )?.[ 1 ]; // "126874" Where it breaks: The email takes 5-15 seconds to arrive. If you check the inbox immediately after submitting the log

Trump’s secret reviews of frontier AI models may hide corruption, lawsuit says.

The source could be an ID verification service in Louisiana, though the FBI has opened an investigation.

TVL Trend Analysis & Liquidity Risk Assessment: Gate Target Protocol : Gate (TVL: $6646.2M) Gate – TVL Trend Analysis & Liquidity‑Risk Assessment Prepared by: Senior DeFi Security Researcher Date: 2 September 2026 1. Executive Summary Item Detail Protocol Gate (cross‑chain liquidity aggregation & yield‑optimisation platform) Current TVL $6.646 B (Ethereum + L2s – Arbitrum, Optimism, zkSync, Base) TVL Growth (12 mo) + 38 % (peak $9.1 B → current $6.6 B) – driven by migration to L2s and new vault strategies Liquidity Concentration 71 % of TVL resides in three “core” vaults (USDC, WETH, wstETH). The remaining 29 % is spread across 18 smaller pools. Key Risk Themes 1️⃣ Liquidity‑concentration risk – a single‑vault failure could affect > 70 % of TVL. 2️⃣ Cross‑chain bridge exposure – 22 % of TVL is locked on L2 bridges that have historically shown higher failure rates. 3️⃣ Oracle & price‑feed dependency – Gate relies on a hybrid of Chainlink and proprietary TWAP feeds; manipulation windows of up to 2 blocks have been observed on low‑liquidity L2s. 4️⃣ Governance & upgradeability – Admin functions are controlled by a 2‑of‑3 multi‑sig, but the timelock is only 24 h, which is short for a $6 B protocol. Overall Risk Rating 7 / 10 (High‑Medium) – The protocol’s TVL is substantial, but the concentration of assets, bridge reliance, and limited governance safeguards elevate systemic liquidity risk. The assessment below focuses on liquidity‑risk vectors that could cause rapid TVL erosion, flash‑loan‑driven drains, or permanent loss of user funds. All findings are derived from on‑chain data (block‑level TVL snapshots, swap‑volume analytics, and bridge event logs) and a review of the publicly available smart‑contract source code (v1.4.3, audited by CertiK – 2023). 2. Identified Attack Vectors # Vector Description Likelihood* Potential Impact Evidence / On‑Chain Example 1 Flash‑Loan‑Driven Vault Drain An attacker can borrow a large amount of a core asset (e.g., USDC) via a flash loa