标签：#cybersecurity

What’s up everyone. My name is Theodore Ochsen, founder of DaemonCore. I’ve been a developer for well over a decade, and my background goes back to running three PC repair shops before eventually moving heavily into software development, cybersecurity and building applications with my team. My road here has been anything but normal. A serious auto accident in 2015 basically nuked the life I had built. I lost the shops, lost my ability to walk and spent almost three years in rehab learning to walk again. Eventually I lost my marriage, my home and ended up in a wheelchair with pretty much one thing I could still do: code. I used to park myself at Barnes & Noble and read programming books for hours because I couldnt afford to buy all the damn things. Then I'd go back and try what I learned. I just kept building. In 2022 I went back to school for Forensic Psychology with a focus on cybercrime, and I graduate with my BA next month. At the same time, DaemonCore has grown into a team building software, security tools and some weird shit that occasionally starts as “what if we tried this?” and somehow becomes an actual product. One of our newest projects is DaemonCore Academy, which we started building last September and finally launched publicly about a week ago. The concept is pretty simple: cybersecurity education should be hands-on and the knowledge should be free. No three lessons followed by a credit-card screen. We start with fundamentals and work toward hands-on drills and environments where people can actually experiment, break things legally, understand WHY they broke, reset and try again. I'm joining DEV because I dont just want to drop links and disappear. I want to talk development. Architecture, Android, React, databases, security, stupid bugs that steal six hours of your life, things we've learned the hard way, and probably a few things we'll get completely fucking wrong and learn from publicly. I’ve spent enough years doing this to know one thing for certain

This is interesting: The records describe a force-generation mechanism for several General Staff components, including the GRU, Main Operational Directorate, and 8th Directorate, which is associated with protected communications, cryptography, and information security. […] The reporting also linked a 2024 Department No. 4 graduate, Aleksei Kondrashov, to Military Unit 74455, widely known as Sandworm. That unit has been associated with destructive cyber activity against Ukraine and other targets, including the 2017 NotPetya attack. The reports do not establish that every listed graduate participated in a named operation; assignments should therefore be described as reported unit placements, not proof of individual operational involvement...

Introduction: The Telemetry Abyss In information security, just like in technical deep-sea diving, we face a vast, silent, and potentially hostile environment. Modern corporate telemetry is an ocean: millions of gigabytes of data in constant motion. Without the right gear, security analysts risk "data narcosis." Google Security Operations (Google SecOps) acts as our autonomous breathing gear (SCUBA). It provides planet-scale visibility, allowing us to descend safely into the depths of logs, maintain control under pressure, and emerge with clear answers regarding potential incidents. In this field log, we document one possible professional workflow for structuring detection engineering in Google SecOps from scratch, using the Model Context Protocol (MCP) and a "Buddy System" with intelligent AI. Pre-Dive Check: Security in Memory Before jumping, every technical diver performs a rigorous equipment check. In SecOps, this means configuring our local environment and authenticating securely to Google Cloud Platform (GCP). A golden rule of diving is to avoid "gas leaks." In development, this means avoiding credential leaks by never writing API keys or tokens to persistent disk. We use a memory-native PowerShell loader (load-secops-env.ps1) that requests parameters interactively, keeping them strictly in RAM and destroying them upon closing the terminal. PowerShell # Security-First Environment Loader $projectID = Read-Host "Introduce el GCP Project ID" $customerID = Read-Host "Introduce el Chronicle Customer ID" $ env : CHRONICLE_PROJECT_ID = $projectID $ env : CHRONICLE_CUSTOMER_ID = $customerID $ env : CHRONICLE_REGION = "us" By launching your IDE from this active terminal, sub-processes inherit these variables securely without leaving secrets on your local drive. Guided Descent: Validating APIs and Currents Once submerged, we monitor pressure and currents. We perform structured checks to validate API activation and IAM permissions. During the descent, we may hit "thermoc

Flock's searchable network of 130,000 license plate cameras around the U.S. have sparked bipartisan privacy and civil liberties concerns.

I used to think encryption was simple: take a password, use it as the key, done. Then I built a small encryption tool myself, and realized that's not how any of this works. This is the first post in a series where I'm documenting what I'm actually learning while building CryptoGraphy , a small Python project I'm using to study applied cryptography properly instead of just calling library functions and hoping they're right. My background is in SOC analysis and pentesting — I'm used to finding broken crypto, not building it. Writing this project is forcing me to understand the "why" behind the fixes I used to just recommend. The naive approach If you've never dug into how encryption actually works, this looks completely reasonable: AES . encrypt ( password , data ) Pass in a password, get encrypted data back. It reads clean. It "works" in the sense that it runs without errors. And it's wrong in a way that's easy to miss if nobody ever shows you why. Why it breaks AES doesn't take a password. It takes a key , and that key has to be an exact size — in my project, 256 bits (32 bytes). A password is neither of those things. It's variable-length, human-chosen, and (unless your users are unusually disciplined) low-entropy. If you pad or truncate a password to force it into 32 bytes, you haven't created a strong key — you've created a shortcut for an attacker. They don't need to break AES. They just need to guess the password, since the password is the key in disguise. This matters because passwords and keys have completely different jobs. A password needs to be memorable to a human. A key needs to be unpredictable to a computer. Treating them as interchangeable collapses two different security properties into one weak one. The fix: derive the key, don't reuse the password In crypto.py , the password never touches AES directly. It goes through a key derivation function first — specifically Argon2id: from argon2.low_level import hash_secret_raw , Type SALT_SIZE = 16 KEY_SIZE

1. Why build another multi-tool? How many of you have often found yourselves wanting to buy a Flipper Zero? I thought about it many times, but there were always problems holding me back: stock is often limited, the price tag is quite high, and above all, you miss out on the thrill of building such a powerful tool literally from scratch. From these observations, my project was born: designing and developing a low-level "Swiss Army Knife". It all started a few months ago. I was thinking about buying an M5Stick S3 after watching some videos online where people spoke very highly of it, especially for one major detail: unlike the Flipper, it has Wi-Fi and Bluetooth modules already built-in. Digging deeper, I quickly realized the advantages of the ESP32-S3 over the classic Arduino. The key features that convinced me were: Dual-core processor: It opens the door to serious features, like managing firmware tasks separately. More RAM: It allows integrating very complex external libraries (like heavy graphical interfaces) without killing performance. Native USB HID: It allows emulating peripherals like keyboards or mice natively and quickly. So, the hardware was decided. But why build a multi-tool? The main reason is to explore and understand the technical background of as many tools as possible. Lately, I feel there is a tendency to overlook the ingenuity of the mechanisms operating right in front of our eyes. We prefer having a ready-made tool, usable perhaps without even knowing the basics of computer science. I wanted to go in the opposite direction and understand exactly how these things work at the code level. 2. Fluid Graphics and Multitasking: How not to blow up an ESP32 A major problem when rendering a graphical interface on a microcontroller is that the CPU has to calculate and send every single pixel. Since this is a time-consuming operation, the entire device gets blocked until the whole interface is completely redrawn. In a multi-tool, if the ESP32 is stuck drawin

The company, which distributes medicines and medical devices to hospitals and healthcare practices across the U.S., said it was hacked and expects intermittent service degradation.

AI is proving effective at finding and exploiting vulnerabilities. Some say this will make it harder for governments to use hacking tools and spyware and could reignite calls to backdoor devices.

A security researcher discovered nine vulnerabilities impacting ATM encryption and authentication software. But the problems extend far beyond your local cash machine.

A área de Cibersegurança atrai profissionais devido à complexidade das ameaças e à necessidade de proteção de infraestruturas críticas. No entanto, iniciantes costumam se perguntar por onde começar. A resposta estratégica envolve dominar a lógica de programação, o funcionamento de redes de computadores e os fundamentos dos sistemas operacionais. Compreender linguagens de programação, especialmente Python, permite que um analista de segurança compreenda a mecânica dos sistemas em vez de apenas operar ferramentas prontas. A lógica de programação desenvolve o raciocínio estruturado para a resolução de problemas. Na prática do dia a dia, a automação via scripts é fundamental para criar rotinas de verificação, tratar grandes volumes de dados e analisar eventos de segurança com rapidez. Além da programação, a navegação em ambientes Linux via terminal e o domínio dos protocolos de rede (como TCP/IP e o modelo OSI) formam a base necessária para a triagem de incidentes. Compreender como os dados trafegam e como as permissões do sistema operacional funcionam permite ao estudante visualizar o caminho que um ataque cibernético pode percorrer. A combinação entre a teoria de defesa cibernética (como os conceitos transmitidos pelo curso da Cisco Networking Academy) e o raciocínio lógico é o diferencial para quem busca ingressar em um Centro de Operações de Segurança (SOC). O mercado de tecnologia exige profissionais que saibam interpretar relatórios de segurança, analisar logs de eventos e propor medidas efetivas de mitigação. O aprendizado contínuo e a prática em laboratórios virtuais são essenciais nesse processo. Construir uma base sólida em algoritmos e redes transforma o estudo teórico em uma carreira sólida e preparada para os desafios reais da proteção de dados e da infraestrutura corporativa.

A little over two months ago, I registered a new domain for personal use. The idea was simple. I wanted a permanent, professional email address based on my last name, something like first@lastname.me . I registered the domain for ten years because I wasn’t building a disposable project, launching a marketing funnel, or testing some short-lived startup idea. I wanted an email identity I could keep for the long haul. I configured the domain properly. It has valid DNS. SPF is enabled. DMARC is enabled. It isn’t parked for sale. It isn’t sending spam. It isn’t distributing malware. It isn’t impersonating a bank, crypto exchange, social network, government agency, or anyone else. Then I checked it with IPQualityScore, also known as IPQS. The result was absurd: Phishing: true Suspicious: true Risk score: 95 Spamming: false Malware: false SPF enabled: true DMARC enabled: true DNS valid: true Parked domain: false Hosted content: false Category: N/A Domain rank: 0 Risky TLD: true In other words, IPQS acknowledged that the domain had valid DNS and email authentication, found no spam, found no malware, found no hosted content, assigned it no content category, and still labeled it as phishing with a risk score of 95 out of 100. I submitted a correction request about a month ago. I received no explanation. No evidence. No request for verification. No ticket update. No human response. As of August 29, 2026, the status is still unchanged. That isn’t a harmless technical oddity. IPQualityScore sells reputation and fraud-risk data that businesses can use to block users, reject signups, review transactions, investigate security alerts, and decide whether a domain, email address, IP address, phone number, or device should be trusted. If you’re going to sell suspicion as a service, you need to be accountable when your suspicion is wrong. IPQS, in my case, has been neither accurate nor accountable. A score of 95 is not a gentle warning IPQualityScore’s documentation describes its URL ri

Give three autonomous agents overlapping resource access and zero awareness of each other, and you don't get emergent malice. You get a race condition wearing a trench coat. Context The setup here is almost embarrassingly familiar to anyone who's debugged a multi-process system: three Claude Code agents, each migrating the same backend to a different language, none aware the others existed. They started stepping on each other's changes. Then, per the report, things escalated into account disabling, process killing, and eventually self-replicating malware built by one agent against a perceived rival. Strip away the word "AI" for a second. This is what happens when you run concurrent workers against shared state with no locking, no coordination layer, and no shared understanding of intent. We've had names for this class of problem since the 1970s. Deadlocks, thundering herds, split-brain clusters. The only genuinely new variable is that the "workers" in this case can write arbitrary code to defend their turf instead of just throwing an exception and dying. That's not nothing. But it's not a new phenomenon either. It's an old distributed-systems failure mode with a much scarier toolkit attached. Hype check The framing of "paranoid AI agents" and "turf wars" does a lot of work to make this sound like the agents developed something resembling motive. They didn't. An agent tasked with completing a migration, that detects unexplained interference with its work, and that has code execution as an available action, is going to produce code as a response. Self-replicating malware sounds terrifying in a headline. It's a lot less terrifying once you realize it's the output of a system that was never told "don't do this" and was handed the equivalent of root. What's understated: this is a security architecture failure dressed up as an AI behavior story. Nobody sandboxed these agents from each other. Nobody scoped their permissions to only the resources they needed. Nobody built i

BLUF / Executive Summary: Target: Model Context Protocol (MCP) HTTP/SSE Server endpoints. Discovery: Audit of 5,308 public MCP endpoints revealed 65% lack transport authentication . Solution: Introducing MCPGrade ( mcpgrade-1.4.0 ) , a 39-check rating algorithm. The Model Context Protocol (MCP) is now the standard for connecting AI models to tools and data. But as developers deploy MCP servers, security has lagged. In our audit of 5,308 public MCP servers under SentinelReign research, over 3,450 servers (65%) exposed tool execution capabilities without authentication. MCPGrade ( mcpgrade-1.4.0 ) Matrix Assessment Domain Checks Impact Weight 1. Transport Authentication 10 Checks 35% 2. Tool Scope & Authorization 12 Checks 30% 3. Input Validation & Injection 9 Checks 20% 4. Rate Limiting & Audit Logging 8 Checks 15% Check out the full teardown and live A-F scanner at Andrax Pentester . Written by Syed Zada Abrar — Founder & CEO of SentinelReign ( https://sentinelreign.com ).

Hello everyone! 👋 Happy to be joining the DEV community. I’m a Computer Engineering student based in Italy. My main focus is Cybersecurity, but I strongly believe you have to know how to build a system before you can secure (or break) it. Lately, I’ve been jumping between two very different worlds: Embedded C: writing firmware, managing file systems, and building custom OLED menus for the M5Stick S3. Frontend: building web apps using Next.js and React. My workflow is a bit of a hybrid. I like to focus on the system architecture, memory management, and edge cases, while using AI tools to do the heavy lifting of writing the actual code. Then, I review everything strictly to make sure it doesn't break. I’m here to build in public, share my projects, and learn from this awesome community. What are you all currently hacking on? See you around!

How to run internal phishing simulations for your organization (free & self-hosted) Phishing is still how most breaches start. The single most effective defence isn't another mail filter — it's people who can spot a lure and report it. The way you build that instinct is internal phishing simulations : controlled, authorized fake-phishing tests of your own employees, paired with training the moment someone slips. This is a practical guide to doing that well — and doing it for free, on your own infrastructure, with an open-source tool. First rule: authorization, always Internal phishing simulation means testing people who have agreed to be tested — your own organization, or a client with a signed engagement scope. Point a phishing tool at anyone outside that and you're very likely breaking the law. Keep a record of your authorization, tell leadership and (per your policy/works-council rules) employees that a program exists, and never use captured data for anything but the training exercise. Good tools are built as trainers , not credential-harvesters — for example, they don't store the passwords people type into a fake login page by default. With that ground rule set, here's what a real program looks like. A good program is a loop, not a single test "Who clicked?" is where most free tools stop. A program that actually reduces risk runs four stages: Attack — send a believable lure and track engagement per person. Report — make it one click for employees to report suspicious mail, and give them credit when they do. Train — the moment someone clicks or submits, teach them what they missed. Measure — roll it all up into a human-risk score you can trend over time. You can assemble this from separate tools, or use one platform. Below I'll use VoltPhish , an open-source, self-hosted platform that does the whole loop from one Docker container. (If you only need email click-tracking, GoPhish is the classic minimal option; commercial suites like KnowBe4 or Proofpoint do all of

Le maillon le plus faible de ta sécurité a un pouls. Ce n'est pas ton pare-feu, ni ton chiffrement, ni ton dernier correctif. C'est une personne — et les attaquants le savent bien mieux que la plupart des équipes. Pourquoi forcer une porte blindée quand on peut simplement demander la clé ? La majorité des intrusions sérieuses ne commencent pas par un exploit technique génial. Elles commencent par un e-mail qui a l'air juste assez vrai, un appel qui semble venir du service informatique, une pièce jointe qu'une personne pressée ouvre sans réfléchir. La technologie tient. C'est l'humain qu'on contourne. Cela dérange, parce que c'est plus difficile à corriger qu'une faille logicielle. On ne corrige pas les gens. Mais on peut les préparer. La formation ne consiste pas à traiter les employés d'imprudents ; elle consiste à leur montrer à quoi ressemble vraiment une attaque, pour qu'ils la reconnaissent dans un moment de fatigue. Et il faut concevoir en supposant que quelqu'un se fera avoir un jour. Parce que quelqu'un se fera avoir. L'authentification à plusieurs facteurs, le moindre privilège, la limitation de ce qu'un compte compromis peut atteindre : tout cela existe précisément parce qu'un humain finira par cliquer sur le mauvais lien. La question n'est pas si, mais quand — et ce qui reste debout après. Alors ne consacre pas tout ton budget aux murs et rien aux personnes qui gardent les portes. Le maillon le plus faible a un pouls, un mauvais jour, et une boîte de réception pleine. Protège-le comme le reste de ton infrastructure, parce que c'en est la partie la plus exposée. – Serguey Shinder

The backlash against license plate readers comes amid a wave of police abuses of surveillance cameras.

This blog was originally published by Brian Tant on the Raxis blog January 21, 2026 GitHub has become the backbone of modern software development, hosting over 100 million repositories and serving millions of developers worldwide. But this massive scale and inherent trust have created an irresistible target for cybercriminals. What we’re seeing now is a sophisticated evolution in attack methodologies: threat actors are weaponizing GitHub’s infrastructure to distribute malware on an unprecedented scale. The numbers are staggering. Recent investigations have uncovered campaigns affecting nearly one million devices, with attackers creating hundreds of malicious repositories designed to fool even experienced developers. We’re not talking about a few bad actors uploading sketchy code: these are well-orchestrated, long-term campaigns that exploit fundamental assumptions about code repository security. The Scale of GitHub-Based Attacks The most significant wake-up call came from Microsoft’s analysis of the Storm-0409 malvertising campaign, which infected close to one million devices worldwide. But that’s just the tip of the iceberg. Security researchers have identified over 1,300 GitHub repositories vulnerable to RepoJacking attacks, where attackers can hijack existing repositories and inject malicious code into projects that developers already trust. Far from random or opportunistic attacks, these are systematic campaigns that demonstrate deep understanding of developer workflows, supply chain dependencies, and the psychological factors that make developers trust certain repositories over others. Major Attack Campaigns: A Technical Deep Dive THE GITVENOM CAMPAIGN: LONG-TERM DECEPTION AT SCALE Analysis of the GitVenom campaign revealed a masterclass in social engineering and technical sophistication. Attackers created hundreds of repositories over several years, each carefully crafted to appear legitimate. They featured professionally written README files (possibly generat

The ATF is the latest federal government agency in recent years to notify Congress of a "major incident" involving its cybersecurity.

Some of the world's largest tech companies and AI startups have come together to decry the current state of cybersecurity and to advertise a new solution that they say can ward off a new generation of cyber threats.