标签：#c2

What Happened On July 20, 2026, cybersecurity firm Group-IB disclosed a new espionage implant dubbed HollowGraph that hijacks compromised Microsoft 365 mailboxes to run a command-and-control (C2) channel hidden inside calendar events. The malware attaches encrypted files to calendar entries dated May 13, 2050 — far enough in the future that a mailbox owner would never scroll to them — and retrieves operator instructions from the same dead drop. All traffic moves through the Microsoft Graph API, making the activity indistinguishable from legitimate M365 usage. At least 12 systems have been infected, with three actively communicating with the threat actor between June 3 and July 9, 2026. The indicators point to a targeted espionage campaign focused on Israeli organizations . Technical Analysis HollowGraph is a lightweight .NET DLL that supports only two commands: GET and SEND . To receive tasking, it queries the compromised mailbox's calendar for an event titled in the format "Event ID: <7-char-taskID>", downloads the attached file, and decrypts it using RSA and AES-256-GCM. To exfiltrate data, the implant creates a new calendar entry titled "Boss{..}ID{..}" and uploads stolen files encrypted with the attacker's public RSA key. The Group-IB research team described the mailbox calendar as a "covert dead-drop," with HollowGraph retrieving commands from events scheduled within a fixed one-hour window between 22:00 and 23:00 UTC on the far-future date. The hybrid encryption scheme uses separate RSA key pairs for inbound and outbound channels, keeping them cryptographically isolated. A second, unencrypted channel runs over DNS tunneling . HollowGraph refreshes its Microsoft Entra ID (Azure AD) credentials by querying IPv6 AAAA records from the attacker-controlled domain cloudlanecdn[.]com . Each returned IPv6 address yields 14 usable payload bytes, which the malware assembles and decodes as UTF-8 text to update its logAzure.txt configuration file — a file masquerading as a

The ScyllaDB PHP driver is not a C++ extension anymore. As of 1.4.0 it's pure C23, the ZendCPP template layer we leaned on for the object embed and allocate pattern is deleted, and the build no longer needs a C++ compiler at all. Every hand-written .cpp file is a .c file now (71 of them), the descriptor generator emits .c , and CMake builds with c_std_23 and nothing else. That's the biggest change to how this extension is built since we forked it for PHP 8.0. This is also the release where a plan I opened back in 2023 finally landed. PR #50 laid it out: rewrite the src/Cluster directory to be more maintainable, use Zend Fast Argument Parsing, remove some memory allocations, and add .stub.php files that generate the C headers so nobody has to hand-maintain Zend arginfo by hand. 1.4.0 is that plan finished, and a lot more that grew out of it. The things you'll actually feel: persistent session connect() doesn't allocate a 200-character key string on every call anymore, and the minimum PHP is now 8.3 (8.2 is gone). Nothing in your application code changes, this is almost all under the surface. The .stub.php Build The idea from PR #50 was small. Instead of writing ZEND_BEGIN_ARG_INFO_EX blocks by hand and keeping them in sync with the actual method bodies, write the signature once in a .stub.php file and generate the C arginfo from it. In v1.4.0 that's the whole build. There are 75 .stub.php files now, and each one is just the PHP signature of the class: // src/Keyspace.stub.php interface Keyspace { public function name (): string ; public function replicationClassName (): string ; /** @return array<string, mixed> */ public function replicationOptions (): array ; public function hasDurableWrites (): bool ; /** @return Table|false */ public function table ( string $name ): Table | false ; public function aggregate ( string $name , mixed ... $types ): Aggregate | false ; } At build time CMake runs gen_stub.php (vendored from PHP 8.5's build/gen_stub.php , with two small p

A cybersecurity startup dangling millions of dollars to acquire zero-day security vulnerabilities in popular software is run by a pair of far-right conspiracy theorists and convicted felons whose most recent ventures included fake intelligence companies and a now-defunct AI-based lobbying platform they operated under assumed names.

🚀 CNTRL by Omnikon Org Selected for Elite Coders Summer of Code (ECSoC) 2026 Building an AI-first browser for developers—and taking the next step through ECSoC 2026. Open source has always been one of the best ways to learn, collaborate, and build software that makes a difference. Today, I'm excited to share a milestone that means a lot to our team. Our project CNTRL , developed by Omnikon Org , has officially been selected for Elite Coders Summer of Code (ECSoC) 2026 ! 🎉 This selection gives us an incredible opportunity to collaborate with contributors worldwide and continue building a browser that's designed from the ground up for developers. 💡 Why We Started CNTRL Every developer has experienced this workflow: Open documentation Search GitHub Ask an AI assistant Open Stack Overflow Copy code Switch back to the IDE Repeat... The browser has become the center of development, but it still isn't designed for developers. We wanted to change that. Instead of building another browser, we started building one where AI is part of the experience—not another tab. 🌐 What is CNTRL? CNTRL is an AI-powered browser built for developers. Our vision is to create a browser that understands how developers work and helps them stay focused. Some of the ideas we're working toward include: 🤖 AI-assisted coding 📖 Context-aware documentation 💬 Built-in developer assistant ⚡ Faster research workflows 🔌 Extensible architecture 🌍 Community-driven open source The project is still evolving, and ECSoC gives us the perfect platform to accelerate its development. 🏆 Selected for ECSoC 2026 Being selected for Elite Coders Summer of Code 2026 is a huge milestone for our organization. It means we'll have the opportunity to: Collaborate with talented contributors Improve the project's architecture Build exciting new features Learn from the community Grow CNTRL into an even better developer tool We're incredibly thankful to the ECSoC team for believing in our vision. 🌍 About Omnikon Org Omnikon Org is

Building a Spring Boot application is only half the journey. At some point, every backend project reaches the next question: Where should this application actually run? If you are deploying on AWS, two common options are: Amazon EC2 Amazon ECS Both can run the same Dockerized Spring Boot application. But they are not the same kind of deployment model. EC2 gives you a server. ECS gives you container orchestration. Choosing between them is less about which one is “better” and more about which one fits the stage of your application. Starting with EC2 EC2 is the most direct way to run a Spring Boot application on AWS. You create a virtual machine, install what you need, and run your application. For a Dockerized Spring Boot app, the flow often looks like this: GitHub Actions ↓ SSH into EC2 ↓ Pull latest code or image ↓ Build / run Docker container ↓ Spring Boot app runs on EC2 The mental model is simple: One server One Docker container One Spring Boot application That simplicity is useful. Especially when you are launching an MVP, a freelancer project, an internal tool, or your first production version. Why EC2 Works Well for Many Spring Boot Apps EC2 is not outdated just because newer deployment platforms exist. For many applications, EC2 is enough. It works well when: traffic is predictable the application is small or medium-sized you want full control over the server you want simple debugging through SSH you do not need multiple replicas yet you want to keep infrastructure easy to understand A common setup might be: Spring Boot Dockerfile Docker Compose GitHub Actions EC2 That setup can be production-ready for many early-stage apps. It gives you: a real deployment target repeatable Docker builds automated deployment through GitHub Actions simple logs direct server access For a solo developer or small team, that matters. You can understand the entire deployment flow without needing a full container orchestration platform. The Tradeoff With EC2 The tradeoff is that you

Another productive week of Google Summer of Code with OWASP BLT is in the books! Building on the visual blueprints from last week, this week was focused on locking down our structural foundations and diving deeper into the system architecture. Here is a simple breakdown of the progress made and what lies ahead. Milestones The primary goal for this phase was setting up the structural guardrails for how data travels through our app. Finalized Security Contract Structures: Successfully established the foundational security contract structures. This ensures that our application components have a uniform, strict schema to communicate safely and predictably. trying to figureout some missing point on the security_alerts with the help of my mentor. Merge request updates: Glad to share that the initial setup has been done across our repository through these milestones: 🔗 Merge Request #3 🔗 Merge Request #4 🔗 Merge Request #5 🔗 Merge Request #6 🧠 Current Focus: System Design & UI Polish With the basic structures merged, my day-to-day focus has shifted toward high-level engineering and refining the user experience. Architecture & System Designing: Spending time mapping out the data flows to ensure our local-first storage design works seamlessly with minimal, encrypted web updates. Ongoing UI Revamp: Continuing to polish the user interface layouts based on our initial feedback, ensuring the experience feels clean, intuitive, and highly minimal. ⚡ The Next Step: Building the Workers Now that the structural blueprints are active in the project, it is time to make them functional. ⚙️ Contract Workers: Moving forward, the next step is to start creating the edge contract workers. These workers will handle the actual validation and processing logic for the security contracts we just established. The structural groundwork is officially laid, and the architecture is shaping up beautifully. Excited to bring the core backend logic to life next week! 💻🛡️

Introduction In my previous IAM article we learnt basics of IAM and how to create Users, Groups and attach Policies. You can refer here: https://dev.to/kadhamvj23/aws-identity-and-access-management-explained-for-beginners-cn7 After setting up secure access to our AWS account using IAM, the next question we mostly have is where do we actually run our application? The answer is Amazon EC2 - Elastic Cloud Compute. EC2 is one of the most widely used AWS services and understanding it well is essential for anyone starting their cloud journey. In this article we will cover what EC2 is, why it exists, the different types of instances, pricing models, Regions and availability Zones and finally hands-on walk through of creating your first EC2 instance. Breaking Down the Name -EC2 Let us understand what each word in the name actually means: Elastic --> In AWS you will notice many services have this prefix "Elastic". The reason is simple. Whenever AWS provides a service that can be scaled up or scaled down based on our needs, that service is called Elastic . With EC2 you can increase resources when traffic is high and decrease them when the traffic is low. So in simple terms EC2 = A virtual server on the cloud that you can resize anytime. Cloud: EC2 runs on AWS's public cloud infrastructure, meaning the servers are owned and managed by Amazon across the world. Compute: The word compute means you are asking AWS to provide you CPU, RAM and Disk - basically a virtual machine or server that can run your applications. How does EC2 actually work? When you request a Virtual server from AWS, here is what happens behind the scenes: You request a virtual machine on AWS ⬇️ request goes to a Hypervisor(a software layer sitting on top of physical servers that creates and manages VMs) ⬇️ Hypervisor creates your VM ⬇️ You get the access to your EC2 instance You never touch any physical hardware. AWS manages all of that for you. Why use EC2? Imagine your company wants to host an application. T