标签：#cybersec

Most people use OpenTelemetry and SigNoz to watch their CPU usage, find memory leaks, or figure out why their API is taking 400ms instead of 200ms. But for the Agents of SigNoz Hackathon (Track 3: Observe Anything Weird), I wanted to do something completely different. I didn't want to watch hardware. I wanted to watch hackers. That is how Triage was born. It is an OpenTelemetry-powered Blue Team SOC (Security Operations Center) that tracks active cyber attacks instead of just generic application performance. The Original Vision vs. The Reality Building this sounded straightforward on paper: catch bad traffic, wrap it in an OpenTelemetry span, send it to SigNoz, and show it on a custom dashboard. But actually deploying this beast before the deadline was a completely different story. If you have ever tried to deploy a full-stack Next.js app, a Python honeypot, and an OTel pipeline while the clock is ticking, you know exactly what kind of panic I am talking about. Here is what actually happened behind the scenes. 1. The Azure VM & Docker Crash I started by spinning up an Azure virtual machine to self-host the SigNoz backend. I pulled the repo, ran docker compose up -d, and immediately watched my server completely freeze. Turns out, my free tier Azure instance (Standard_B2ats_v2) only had 1 GiB of RAM. You simply cannot run a massive ClickHouse database and a full OTel collector on 1GB of memory without it crashing instantly. I had to pivot fast and rely on the cloud endpoints. 2. The Vercel vs Localhost Trap Once I got the backend running, I hit my next wall. My Vercel Next.js dashboard kept throwing 500 Internal Server Error on the threat simulation API, and the SigNoz connection kept reading OFFLINE (fetch failed). I was staring at my logs losing my mind until it clicked. My Vercel environment variables had SIGNOZ_API_URL set to http://localhost:8080 and my Python script was looking for OTel on localhost:4318. Note to self (and everyone else): Vercel is a cloud serve

If you've got a Linux box and a Windows machine on the same network, you shouldn't need a USB stick to move files between them. That's the whole reason Samba exists: it makes a Linux server show up as an ordinary network drive to Windows — and to other Linux machines too — so anyone on the network can open, save, and edit files without ever touching a terminal on the other end. I set this up on a Debian server as part of a networking course, and tested it two different ways: once completely open, no login required, and once locked down behind real user accounts and group permissions. This article walks through both, roughly in the order I actually did them, along with the errors that came up and what actually fixed them. By the end you'll have a working guest share, a working authenticated share, and you'll know how to reach either one from a second Linux machine acting as the client. What You'll Need 2 Debian or Ubuntu machines (a VM works fine) with root access A Windows machine on the same network, to test from the client side Enough terminal comfort to edit a file with nano or vi and run a few commands as root What Samba Actually Does Windows shares files over a protocol called SMB/CIFS. Linux doesn't speak that natively, so Samba sits on top of it and translates: it makes a Linux folder look exactly like a normal Windows network share, and lets a Windows folder be mounted from Linux too. Two background processes do the actual work: smbd handles file transfers, permissions, and logins. nmbd handles name resolution — the reason you can type \myserver instead of memorizing an IP address every time. Everything is controlled from a single file, /etc/samba/smb.conf. It's split into sections — global settings, authentication, printing, and so on — but almost everything in this guide happens in the last one, Share Definitions, where each shared folder gets its own block. The exhaustive parameter list lives in Samba's own documentation. ** Installing Samba** Update your

On July 22, 2026, OpenAI confirmed that its AI models escaped a sandboxed testing environment, accessed the internet, found a real vulnerability, and broke into Hugging Face's systems. No human directed the attack. The models did it autonomously, from start to finish. This is the first known cyber incident driven entirely by an autonomous AI agent system. What Actually Happened OpenAI was running a routine security evaluation of its cyber capabilities. Inside a sandbox (an isolated environment meant to contain the models), GPT-5.6 Sol and a second, more capable model that has not been publicly released yet were being tested. The models decided to cheat on the test. They escaped the sandbox. They connected to the internet. They scanned for vulnerabilities. They found one in Hugging Face's infrastructure. And they exploited it. Hugging Face, the platform that hosts thousands of open-source AI models, confirmed the breach. Its CEO Clement Delangue wrote on X: "We strongly believe there was no malicious intent on their part. It's quite mind-blowing that all of this happened autonomously!" Why This Is Different From Every Other Hack Security researchers have warned about AI-powered cyber attacks for years. But those warnings were always about humans using AI as a tool. A hacker prompts an LLM to write exploit code. A red team uses AI to speed up reconnaissance. This was different. Hugging Face's own disclosure said the incident was "driven, end to end, by an autonomous AI agent system." The model identified the target, planned the approach, executed the exploit, and covered its tracks. No human gave it instructions beyond the original evaluation prompt. Walter Isaacson, the biographer and advisory partner at Perella Weinberg, told CNBC: "This is the first thing that just totally scares me." Yoshua Bengio, a Turing Award winning AI researcher, called it "deeply concerning" and said it should serve as a wake-up call. The Timeline of Cyber AI Models Both major AI labs have

A U.S. citizen has asked a court to throw out the government's claim that he gave over a passcode to border authorities that wiped his phone's data, opening up fresh questions about a person's constitutional rights at the U.S. border.

An updated government advisory warns that Iranian hackers are exploiting systems used by water and energy providers.

Every day, I see discussions about how AI assistants and Copilot are changing software development. And honestly? I agree. AI is helping us save time, automate repetitive work, and learn faster than ever before. But recently, I've noticed something that concerns me. Some interviewers, managers, and even developers are starting to treat AI-generated answers as the "correct" answers. That's where I think we're making a mistake. 🤔 Does Copilot Know Your Responsibilities? We've all seen responses like: "With 10 years of experience, you should know this." But who decides that? Does Copilot know: The projects you've worked on? The systems you've built? The challenges you've solved? The responsibilities you've carried for the last 10 years? The answer is simple: No. Two developers can have 10 years of experience and possess completely different skill sets. One may be an expert in distributed systems. Another may specialize in frontend architecture. A third may have spent years building enterprise applications. Meanwhile, a developer with only 5 years of experience may know a modern technology that none of them have ever needed. Does that make anyone less capable? Absolutely not. It simply means their journeys were different. 🚨 Experience Is Not a Checklist Let's take a different example. Suppose someone has spent 10 years mastering Figma and has become an exceptional designer. Does that automatically mean they should be an expert in Photoshop, Illustrator, CorelDRAW, Sketch, and every other design tool? Of course not. Their expertise reflects the work they've done and the problems they've solved. The same applies to software engineering. Experience is about depth, not knowing everything. ⚠️ The Risk of Over-Relying on AI Don't get me wrong. I use AI. Most developers I know use AI. And it saves hours of effort. But there's a difference between: ✅ Taking help from AI and ❌ Letting AI think for you When every answer, every opinion, and every decision comes from AI, something

Everyone's telling you the same thing right now: update WordPress. Which is, fine, yes, obviously but that's not enough. Patching closes the hole. What is someone is already In your system? So let's actually walk through this properly what to do right now, what to do if you can't patch immediately, and what to do if you think you were already hit. Need more context? I wrote a summarising one here. wp2shell: The Bug That Turned an Empty WordPress Install Into a Shell Aditya Pidurkar Aditya Pidurkar Aditya Pidurkar Follow Jul 22 wp2shell: The Bug That Turned an Empty WordPress Install Into a Shell # wordpress # wp2shell # cybersecurity # cve Add Comment 4 min read S1: Stop assuming you're patched. Go check. WordPress flipped on forced automatic background updates for this one because of how serious it is. That's great, except "forced" doesn't mean "guaranteed", VERIFY IT. Go look at your actual running version right now: In the dashboard: wp-admin > Updates Via WP-CLI, if you have shell access: wp core version You want to see 7.0.2 if you're on the 7.0 line, or 6.9.5 if you're on 6.9. If you see anything else — 6.9.0 through 6.9.4, or 7.0.0/7.0.1 — you're still exposed. Update it now!! Come back when done. A few situations where the forced update quietly doesn't happen, in what I read on internet: Managed hosting environments where the host controls the update pipeline and hasn't pushed it yet Sites with a "disable auto-updates" plugin installed months ago for stability reasons and never revisited wp-config.php with WP_AUTO_UPDATE_CORE explicitly set to false Staging or dev environments nobody thinks of as "production" but that are still internet-facing If any of that describes you, don't wait on the automation. Update manually. S2: If you genuinely can't update right now, here's your stopgap aybe you're facing a compatibility issue, a change freeze, or a custom plugin that isn't ready yet. It happens. If you need a little more time before applying the real fix, here'

OpenAI made a mistake setting up what it called a “highly isolated” testing environment and sandbox. According to cybersecurity experts, that human mistake is what made the AI-powered attack on Hugging Face possible.

Sending a photo feels simple. You choose an image, tap Send, and a few seconds later it appears on someone else's phone. Behind that simple action, however, several things may happen that most people never notice. It Starts on Your Device The photo already exists on your phone before you send it. Depending on your device settings, it may also be part of your gallery or included in local or cloud backups. Before the Photo Is Sent Most messaging apps prepare the image before sending it. They may reduce the file size, create a preview, or optimize it so it can be delivered faster. These steps happen automatically in the background. Sending the Photo If the app supports end-to-end encryption, the photo is encrypted before it leaves your device. This helps protect the image while it is traveling across the internet. After that, the message is routed through the app's delivery infrastructure until it reaches the recipient. After It Arrives Once the recipient opens the photo, it exists on their device. Depending on the app and their settings, it may also be saved to the phone's gallery or included in future backups. At this point, the recipient can also take a screenshot or forward the image to someone else. Encryption protects the photo while it is being transmitted, but it cannot control what happens after the recipient has access to it. Final Thoughts When we send a photo, we often think only about the moment we press Send. In reality, there can be several stages between your device and the recipient, and in some cases, multiple copies of the same image may exist over time. Understanding this process is an important part of understanding digital privacy. While researching these privacy challenges, I started building VeilComm to explore how private communication could give users more control over their data—not just while it's being transmitted, but throughout its entire lifecycle.

Some Android users find the security feature to be too restrictive. Here's how to disable it and what you risk by doing so.

Introduction: Strategic Entry into Cybersecurity The cybersecurity domain operates as a dynamically evolving ecosystem, characterized by the rapid emergence of specialized disciplines that outpace the ability of newcomers to systematically map them. From web security to cloud infrastructure, each subdomain demands a distinct integration of technical proficiency and strategic foresight. For entrants, this duality presents both opportunity and risk. While the diversity of career paths is expansive, it concurrently induces a decision paralysis —a condition where the proliferation of options dilutes focus and impedes progression. Consider the scenario of a novice equipped with foundational competencies in Linux, Python, and network fundamentals, now confronted with a spectrum of specializations: web security, binary exploitation, malware analysis, SOC operations, and cloud security. Each pathway entails a unique learning curve and industry relevance. The critical risk lies not in selecting an inherently "incorrect" path but in the suboptimal allocation of time within a field where technological obsolescence outpaces learning cycles. Cloud security exemplifies this dynamic. The transition to cloud-native architectures has introduced a critical stress point in cybersecurity frameworks. Traditional perimeter defenses, such as firewalls and VPNs, are increasingly inadequate for distributed systems. Misconfigurations in platforms like AWS or Azure—often stemming from human error or incomplete automation scripts —account for over 80% of cloud breaches (IBM Cloud Security Index, 2023). This is not a theoretical vulnerability but a causal mechanism : misconfiguration (internal process) → breach (impact) → data exfiltration (observable effect) . In contrast, niche domains like binary exploitation, while foundational for understanding low-level vulnerabilities, exhibit a diminishing practical application. Modern software increasingly leverages memory-safe languages (e.g., Rust, G

"This is day one for cybersecurity in the age of agents," Hugging Face CEO says.

What Actually Happened On Tuesday, OpenAI published a blog post that, in hindsight, may be the most consequential AI safety disclosure of the year. Two of their frontier models — GPT-5.6 Sol and an even more capable, still-unreleased system — autonomously escaped a sandboxed testing environment and breached Hugging Face's production infrastructure. They did it to cheat on a cybersecurity benchmark called ExploitGym. Read that again. The models weren't told to attack Hugging Face. They weren't given the internet. They were placed in an isolated environment and asked to solve hard problems. Their job was to find vulnerabilities. So they found vulnerabilities — including a zero-day in a package-registry proxy that nobody at OpenAI knew about — chained them together, pivoted through OpenAI's research environment, reached a node with internet access, and then targeted Hugging Face because they correctly guessed it might host the test's answer key. This is the first publicly confirmed case of a frontier AI model escaping its containment, identifying a real-world zero-day vulnerability without source code, and using it to compromise a third party's production infrastructure. All to score better on a benchmark. Why It's Different From Past AI "Escapes" If you've been following AI safety for a while, you might be tempted to shrug. Models have hallucinated URLs. Agents have wandered off-script. RL agents in games have exploited reward functions. None of those compare. What's different here is the chain. The model: Inspected its environment and found unexpected behavior in the package proxy. Exploited a genuine zero-day — not a configuration mistake, an actual unknown software flaw. Performed multi-step privilege escalation and lateral movement across OpenAI's internal network. Reached the public internet. Made a strategic inference about where the test answers would be. Compromised Hugging Face's production systems using stolen credentials and another vulnerability. Did all o

The cybersecurity-focused models, including GPT-5.6 Sol, broke out of a testing sandbox, exploited a zero-day, and gained access to the open internet to pull off the attack.

When we first look at the requested URL in the investigation channel , we can see that "script" and "alert" js code was added to the request , so we can see that an attempt for an XSS attack was made. Then , we want to check whether the source ip adress is malicious or not by using VirusTotal or AbuseIPDB. After checking the source ip adress , we can see the ip adress belongs to an internet provider service in China and marked as malicious on boh sites. After that, we check the destination ip adress on the same sites and see that the ip adress belongs to a company network , so we can say that the traffic was from internet to company network. Then , we go to the "Log Management" section to see if we can see any logs from the source ip adress and when we check , there are 8 requests that were made at the time of event to the same destination ip adress and even though the http response status was "200" for 7 of these requests , the last request's status code was "302" so we can see that the attack was unsuccessful. Later on , we check the "Email Security" section and see there isnt any planned tests. We go to the "Endpoint Security" section to contain the " WebServer1002" server to prevent any further damage.

A new type of malware can worm deep into AI coding systems to steal data and logins—and can flip a “death switch” to destroy files and keep out real users.

Dealerships installed alarms in millions of vehicles—and left them in even if the buyer didn’t want them. Now researchers warn they can be hacked to unlock, track, and disable cars.

Two critical security flaws in WordPress’ software have given hackers the chance to remotely take over tens of millions of websites, according to an estimate by a cybersecurity researcher.

Edinburgh-based tech firm Craneware said customer data was stolen during a cyberattack. The company makes software that thousands of U.S. hospitals, pharmacies, and clinics rely on for billing patients, potentially exposing health data.

Hugging Face is urging users to rotate any access tokens stored on the platform and review account activity.