When The Impersonation Function Gets Used To Impersonate Users (Fortinet FortiWeb Auth. Bypass CVE-2025-64446)

Justice Department Announces Nationwide Actions to Combat Illicit North Korean Government Revenue Generation [IT Worker]

Inside the Great Firewall Part 3: Geopolitical and Societal Ramifications

RONINGLOADER: DragonBreath’s New Path to PPL Abuse

Abusing Delegation with Impacket (Part 2): Constrained Delegation

A dual strategy: legal action and new legislation to fight scammers

Contagious Interview Actors Now Utilize JSON Storage Services for Malware Delivery

‘World-class’ hacker arrested in Phuket rumoured to be GRU officer Aleksey Lukashev

Australian spy chief says Chinese hackers probing telecoms, key facilities

Disrupting the first reported AI-orchestrated cyber espionage campaign

Is It CitrixBleed4? Well, No. Is It Good? Also, No. (Citrix NetScaler Memory Leak & RXSS CVE-2025-12101)

New runc vulnerabilities allow container escape: CVE-2025-31133, CVE-2025-52565, CVE-2025-52881

Analysis of Encryption Structure of Yurei Ransomware Go-based Builder

Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics

Payroll Pirates: The Widespread Malvertising Network

Uncovering a Multi-Stage Phishing Kit Targeting Italy's Infrastructure

Operation Endgame

From North Korean IT Workers to IT recruiters

Amazon discovers APT exploiting Cisco and Citrix zero-days

DPRK UNC3782

Tech giants vow to defend users in US as spyware companies make inroads with Trump administration

Tough new laws to strengthen the UK's defences against cyber attacks on NHS, transport and energy

Purple-team telemetry & simulation toolkit

BSI Annual Report: Progress in cybersecurity – but continued high vulnerability

New OWASP Top 10 --- 2025 RC1

Deleting the BCD through COM as low privileged user - Warpnet

Balancer hack analysis and guidance for the DeFi ecosystem

Tank interview: A hacking kingpin reveals all to the BBC

[2511.03247] Death by a Thousand Prompts: Open Model Vulnerability Analysis

[2511.03841] Security Analysis of Agentic AI Communication Protocols: A Comparative Evaluation

Sanctions on cyber criminals funding North Korean weapons of mass destruction

Israeli Spyware Maker NSO Gets New Owners, Leadership and Seeks to Mend Reputation

Applied Cryptography 101: Real-World Deployments

Interview with the Chollima V

​​Whisper Leak: A novel side-channel attack on remote language models

teams-cookies-bof: BOF to steal Teams cookies

Hacking GraalVM Espresso: Abusing Continuation API to Make ROP-Like Attack

conquest: Conquest is a feature-rich and malleable command & control/post-exploitation framework developed in Nim.

State-Sponsored Remote Wipe Tactics Targeting Android Devices

DonPwner: Advanced Domain Controller attack and credential analysis tool leveraging DonPAPI database

Weaponizing Trust: ClickOnce Deployment with AppDomainManager Injection

ADCSDevilCOM: A C# tool for requesting certificates from ADCS using DCOM over SMB. This tool allows you to remotely request X.509 certificates from CA server using the MS-WCCE protocol over DCOM and It bypasses the traditional endpoint mapper requirement by using SMB directly.

ESET APT Activity Report Q2 2025–Q3 2025

EtwLeakKernel: Leaking kernel addresses from ETW consumers. Requires Administrator privileges.

Evading Elastic EDR's call stack signatures with call gadgets

Congressional Budget Office believed to be hacked by foreign actor

venom: Venom C2 is a dependency‑free Python3 Command & Control framework for redteam persistence

JA4+ Plugin for Wireshark

Implementing the Etherhiding technique

警惕！APT-C-08（蔓灵花）组织首次借WinRAR漏洞CVE-2025-6218实施网络攻击 - Beware! The APT-C-08 (Manlinghua) group has launched its first cyberattack using the WinRAR vulnerability CVE-2025-6218.