标签：#cybersec

AI Agent Security, Malware Evasion, & LLM Data Leakage Risks Today's Highlights Today's highlights cover crucial security challenges, from sophisticated malware evasion tactics confusing analysis tools to the inherent risks of autonomous AI agents causing financial damage. We also delve into the critical data security implications of interacting with large language models, emphasizing the need for robust data governance and user education. Malware developers added nuclear and biological weapons text to to their spyware (Hacker News) Source: https://twitter.com/jsrailton/status/2064661778978533571 This report highlights a concerning tactic employed by malware developers to evade detection and analysis. By embedding seemingly innocuous, yet contextually irrelevant, strings such as "nuclear and biological weapons" text within their spyware's code or data, threat actors aim to mislead security researchers and automated analysis tools. This technique, often referred to as 'camouflage' or 'noise injection,' complicates the process of signature-based detection and behavioral analysis by adding irrelevant data that can confuse pattern matching algorithms or human analysts investigating suspicious binaries. It leverages the expectation that malicious code should contain only code related to its function, subverting this by introducing data that might trigger false positives or simply overwhelm analysis efforts. This tactic necessitates more sophisticated defensive techniques, moving beyond simple string searches or basic heuristic analysis. Organizations must enhance their sandboxing capabilities, employ advanced machine learning-driven anomaly detection, and focus on dynamic analysis that observes the actual behavior of the malware rather than relying solely on static analysis. Understanding such obfuscation and evasion tactics is crucial for developing robust threat intelligence and improving the resilience of endpoint detection and response (EDR) systems against evolving

The tech giant said a group called "Outsider Enterprise" used AI to scam hundreds of thousands of victims, sending 2.5 million text messages over a span of two weeks.

Congress, afraid of empowering Bill Pulte, has allowed a decades-old spying law to lapse.

Definição O HMAC (Hash-based Message Authentication Code) é um mecanismo de segurança que permite verificar a integridade e autenticidade de uma mensagem, garantindo que ela não foi alterada e que foi gerada por quem possui uma chave secreta. Ele é muito usado em autenticação de APIs, tokens e assinaturas digitais. Analogia Imagine que você envia uma carta dentro de um envelope lacrado com um selo exclusivo que só você e o destinatário conhecem a forma de produzir. Se alguém abrir a carta e alterar qualquer palavra, o selo não vai mais bater com o original. O HMAC funciona exatamente assim: ele “lacra” os dados com uma assinatura impossível de reproduzir sem a chave secreta. Exemplo sem HMAC (inseguro) $payload = [ 'user' => 'joao' , 'exp' => time () + 300 ]; // token simples sem proteção $token = base64_encode ( json_encode ( $payload )); Problema Qualquer pessoa pode: decodificar o token alterar exp reencodar e enganar o sistema Exemplo com HMAC (seguro) $payload = [ 'user' => 'joao' , 'exp' => time () + 300 ]; $secret = 'chave_super_secreta' ; $signature = hash_hmac ( 'sha256' , json_encode ( $payload [ 'user' ]) . '|' . $payload [ 'exp' ], $secret ); $payload [ 'sig' ] = $signature ; $token = base64_encode ( json_encode ( $payload )); Validação do lado do servidor $payload = json_decode ( base64_decode ( $_GET [ 'token' ]), true ); $check = hash_hmac ( 'sha256' , json_encode ( $payload [ 'user' ]) . '|' . $payload [ 'exp' ], $secret ); if ( ! hash_equals ( $check , $payload [ 'sig' ])) { die ( "Token inválido" ); }

The tech giant said a group called "Outsider Enterprise" used AI to scam hundreds of thousands of victims, sending 2.5 million text messages over a span of two weeks.

AMD RCE Ignored, GitHub Boosts Secret Scanning with LLMs, AUR Supply Chain Attack Today's Highlights This week, a critical RCE vulnerability in AMD hardware went unpatched, highlighting vendor inaction, while GitHub significantly enhanced its secret scanning using LLM-driven verification to reduce false positives. Additionally, a widespread supply chain attack compromised hundreds of AUR packages with an infostealer, demanding immediate attention from Arch Linux users. The RCE that AMD wouldn't fix (Hacker News) Source: https://mrbruh.com/amd2/ This report details a critical Remote Code Execution (RCE) vulnerability affecting AMD hardware, which the vendor reportedly declined to fix. The article delves into the technical specifics of the RCE, outlining the exploit vector and potential impact. Such vulnerabilities allow attackers to execute arbitrary code on a compromised system, often leading to full system control, data exfiltration, or further network penetration. The disclosure highlights the challenges faced by security researchers when vendors are unresponsive to critical findings, leaving users exposed. It emphasizes the importance of independent security research and transparent vulnerability reporting for the wider tech ecosystem. Comment: A developer should be deeply concerned when a major hardware vendor like AMD refuses to patch a severe RCE. This forces users to either accept the risk or seek third-party mitigations, underscoring the need for robust supply chain security diligence beyond just software. Making secret scanning more trustworthy: Reducing false positives at scale (GitHub Blog) Source: https://github.blog/security/making-secret-scanning-more-trustworthy-reducing-false-positives-at-scale/ GitHub's security team details their efforts to enhance their secret scanning service by significantly reducing false positives. The article focuses on the implementation of context-aware LLM (Large Language Model) reasoning in the verification step of secret

Most cybersecurity roadmaps fail beginners. They give you a long list of topics like Linux, Networking, Python, and Security tools without any order or direction. This makes people confused, overwhelmed, and they usually quit early. This roadmap is different. It follows a momentum-first learning system, where every step builds on the previous one. You don’t just learn topics — you grow step by step like a system. The goal is simple: You always know what to learn next and why you are learning it. 🧠 How This Roadmap Works Instead of random learning, this roadmap is divided into phases. Each phase: builds real skills connects with the next phase moves from basic → advanced focuses on practical understanding By the end, you will understand how systems work, how they are built, how they are tested, and how they are secured. 🟢 PHASE 1: 🧠 The Signal Awakening Protocol (System Basics) Goal: Understand how computers and the internet actually work. Topics Google Dorking Using advanced search techniques to find specific information on the internet. You learn how search engines work beyond normal searches. OSINT (Open Source Intelligence) Collecting information from public sources like websites, social media, and forums. You learn how to gather data like a digital investigator. How Web Browsers Work Understanding how a browser sends requests and receives data from servers. This helps you understand what happens behind every website you open. Introduction to Computers & Operating Systems Basic understanding of CPU, RAM, storage, and how operating systems manage everything. This is the foundation of all cybersecurity. Virtualization (VirtualBox / VMware) Running a virtual computer inside your main computer. You use this to create a safe lab for practice. Linux Basics Learning how to use Linux systems. Most servers and cybersecurity tools run on Linux, so this is important. Bash Scripting Writing simple scripts to automate tasks in Linux. You move from manual work to automation. O

You're about to install a VS Code extension. Maybe it's a formatter, a linter, a theme, an AI tool....

South Korean authorities issued the record-breaking fine following a data breach that affected over 30 million customers.

Cross-border purchasing platforms commonly use marketing tactics such as coupons, registration points, order rebates, and spend-based discounts to acquire new users and boost engagement. However, public promotions are prime targets for “wool hunters” (fraudsters) who exploit batch account registration, fake orders, malicious order spamming, and combined discount abuse to drain platform benefits, causing direct financial losses. Most purchasing systems lack dedicated event risk controls, making them highly vulnerable to batch exploitation as soon as a promotion goes live. This not only leads to financial losses but also crowds out genuine user benefits and distorts campaign effectiveness. This article details Taocarts’ comprehensive anti-fraud risk control framework, which uses multi‑dimensional behavior detection, rule‑based blocking, and account risk assessment to accurately distinguish real users from malicious exploiters, ensuring fair and controllable marketing activities. First, we identify common malicious exploitation scenarios and system vulnerabilities in cross‑border platforms: Batch account registration – Using new‑user exclusive coupons and registration points to harvest benefits repeatedly. Fake order placement and cancellation – Repeatedly claiming limited‑time discounts or rebates by placing and then canceling orders. Multiple accounts from the same device/IP – Spamming orders to consume activity quotas. Illegal discount stacking – Violating platform rules by combining multiple coupons or point deductions. Activity volume manipulation – Generating fake orders to earn activity rewards or points, creating false engagement data. Traditional systems have no risk rules and cannot detect batch operations or abnormal behavior, leading to wasted marketing spend and campaigns that actually lose money. Taocarts builds a fine‑grained anti‑exploit rule engine based on four dimensions: user behavior, device information, network characteristics, and order data, ena

Most people studying for Security+ use practice questions the wrong way. They take a 90 question set, score a 74, feel bad, take another set the next day, score a 76, and call that progress. Two weeks later the number has barely moved and they have no idea why. The score is the least useful thing a practice exam gives you. What you actually want is a map of what you do not know yet. Here is the approach that worked for getting through SY0-701 without burning out on endless question sets. Start cold, on purpose Before you study a single domain, take a full practice exam and do not look anything up. It will feel bad. That is the point. A cold score tells you where you actually stand, not where your notes say you should be. SY0-701 is split into five domains, and they are not weighted evenly: 1.0 General Security Concepts (12%) 2.0 Threats, Vulnerabilities, and Mitigations (22%) 3.0 Security Architecture (18%) 4.0 Security Operations (28%) 5.0 Security Program Management and Oversight (20%) Domain 4 alone is more than a quarter of the exam. If you bomb Security Operations and ace General Concepts, splitting your time evenly between them is a mistake. A cold diagnostic shows you that split in about an hour. If you want one to start with, there is a free diagnostic exam at secplusmastery.com/diagnostic that breaks your result down by domain so the holes are easy to see. Review the wrong answers, and the right ones too This single habit moved my scores more than anything else: for every question I missed, I wrote down why each wrong option was wrong, not just why the correct one was correct. Security+ loves distractors that are real terms used in the wrong context. A question about a control that prevents an attack will offer you a control that detects one, and a control that corrects after the fact, all as plausible answers. If you only learn that the answer was C, you learn nothing you can reuse. If you learn that B was a detective control and the scenario asked for a p

Imagine you lose your work laptop on a commute. It holds 3 years of customer PII, internal product roadmaps, and access keys to your company's cloud infrastructure. Without full disk encryption enabled, anyone who finds the device can access every file in 10 minutes or less with a free bootable USB tool. With encryption enabled? They'll never access your data, even if they brute-force the password for decades. Per IBM's 2025 Cost of a Data Breach Report, organizations that use encryption save significantly on breach costs compared to teams that skip encryption. As cyber threats grow more sophisticated, and quantum computing edges closer to breaking legacy cryptographic standards, encryption is no longer an optional add-on—it's a core requirement for every digital system. This guide breaks down everything you need to know about data encryption, from core concepts to 2026's latest post-quantum developments, with actionable best practices for teams of all sizes. Table of Contents Core Concepts of Data Encryption How Does Data Encryption Work? Key Data Encryption Algorithms (2026 Approved & Deprecated) Encryption for All 3 Data States: At Rest, In Transit, In Use Real-World Data Encryption Use Cases Encryption Standards & Compliance Regulations Data Encryption Best Practices Common Encryption Mistakes to Avoid 2024-2026 Encryption Trends & Future Developments Conclusion & Key Takeaways References Core Concepts of Data Encryption Data encryption is a cryptographic process that converts human-readable plaintext into unreadable scrambled ciphertext using mathematical algorithms and secret keys. Only authorized parties with the correct decryption key can reverse the process to recover the original plaintext. Core Benefits of Encryption Encryption provides three non-negotiable security properties: Confidentiality : Only authorized users can access sensitive data Authentication : Verifies the origin of encrypted data Integrity : Confirms encrypted data has not been tampered w

The update brings a low-latency profile, speeds up search, and patches hundreds of flaws.

“Defenders cannot afford to take weeks to patch,” one Cybersecurity and Infrastructure Security Agency official warned on Wednesday.

North Korean hackers posing as remote IT workers and recruiters remain a major threat to U.S., European, and Asian companies, accounting for about half of all attacks over the past 12 months.

Cybersecurity researchers are complaining that Anthropic's new model Fable has guardrails that are too strict for any cybersecurity work.

ServiceNow is used by thousands of enterprises to automate their internal processes, but says several customers had data accessed because of a security bug.

Check Point said hackers broke into dozens of organizations by exploiting a VPN bug in several of its products used across the government.

Anthropic is releasing Claude Fable 5, its first Mythos-class model available to the public. The model comes with guardrails that block responses in high-risk areas like cybersecurity and biology.

Anthropic is releasing Claude Fable 5, its first Mythos-class model available to the public. The model comes with guardrails that block responses in high-risk areas like cybersecurity and biology.