0xBugHunter

🍎 The password nobody owns: Taking machines to zero standing privilege (ZSP) 📝 Ask your infrastructure lead who owns the service account beh... https://www.csoonline.com/article/4236528/the-password-nobody-owns-taking-machines-to-zero-standing-privilege-zsp.html 📰 CSO Online #CVE #AppSec

theregister.comConnectWise turns off its SaaS-y backup, security, and management services to probe security SNAFUHuntress alleges takeover of M365 accounts

🔒 ConnectWise turns off its SaaS-y backup, security, an... 📝 SaaS-for-manage... https://www.theregister.com/security/2026/10/19/connectwise-turns-off-its-saas-y-backup-security-and-management-services-to-probe-security-snafu/5303758 📰 www.theregister.com - Articles #BugBounty #DataBreach

theregister.comLinux KVM guest-host escape rated critical, may represent a new way to attack penguin-powered networkingParty like it’s CVE-2026-99999 – a 9.3-rated nasty called PwnEscape

🤖 Linux KVM guest-host escape rated critical, may ... 📝 Paulos Yibelo, ... https://www.theregister.com/virtualization/2026/10/19/linux-kvm-guest-host-escape-rated-critical-may-represent-a-new-way-to-attack-penguin-powered-networking/5303744 📰 www.theregister.com - Articles #AI #BugBounty

schneier.comFriday Squid Blogging: Squid Before the Chicxulub Meteor Impact - Schneier on SecurityNew research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

🔒 Friday Squid Blogging: Squid Before the Chicxulub Meteor Impact 📝 New research shows that squid lived all around the g... https://www.schneier.com/blog/archives/2026/10/friday-squid-blogging-squid-before-the-chicxulub-meteor-impact.html 📰 Schneier on Security #DataBreach #CyberSecurity

theregister.comCybercrims go beyond stealing data to attack physical building systemsRead the full article for details.

🔒 Cybercrims go beyond stealing data to attack physical building systems 📝 Late Sunday night, a still... https://www.theregister.com/security/2026/10/17/cybercrims-go-beyond-stealing-data-to-attack-physical-building-systems/5303677 📰 www.theregister.com - Articles #Pentesting #DataBreach

sentinelone.comHow SentinelOne Blocked APT29's CaptiveCrunch CampaignLearn how SentinelOne's Static AI blocked APT29's CaptiveCrunch campaign on the endpoint, stopping local DNS poisoning and captive portal network lures.

🤖 How SentinelOne Blocked APT29's CaptiveCrunch Campaign 📝 Once the corporate network stopped being defensible, the control had to move to the devi... https://www.sentinelone.com/blog/how-sentinelone-blocked-apt29-s-captivecrunch-campaign/ 📰 Cybersecurity Blog | SentinelOne #AI #Phishing

sentinelone.comThe Good, the Bad and the Ugly in Cybersecurity – Week 34U.S. indicts Iranian cyber espionage operations, Medusa ransomware breaches 500 organizations, and attackers exploit a critical Windows protocol flaw.

🇮🇷 The Good, the Bad and the Ugly in Cybersecurity – Week 34 📝 Charges Iranian Cyberattackers Over Mass Intellectual Property Theft The U. Justice ... https://www.sentinelone.com/blog/the-good-the-bad-and-the-ugly-in-cybersecurity-week-34-8/ 📰 Cybersecurity Blog | SentinelOne #APT #OSINT

schneier.comMore Incidents of AIs Going Rogue in Cybersecurity Challenges - Schneier on SecurityThe AI Security Institute has a new report of AI systems engaging in “unsanctioned behavior”—what I have been calling “genie behavior—while being tested on their cybersecurity capabilities. The incident stemmed from a single evaluation where agents were given a task of solving a cyber security challenge. We ran this challenge 122 times across several models. Our investigation found that in 10 of those runs, an AI agent took autonomous, unsanctioned action on the live internet, targeting real people and organisations. In total, we catalogued 19 such actions. Almost all of this behaviour (17 actions) came from a single model, Anthropic’s Mythos 5, with 2 actions involving OpenAI’s GPT-5.6-Sol with cyber classifiers (mechanisms to prevent misuse) disabled. In the most serious case, an agent tried to insert malicious code into an open-source project. In an attempt to get the code approved, the agent engaged in social engineering—creating f...

🤖 More Incidents of AIs Going Rogue in Cybersecurity Challenges 📝 The AI Security Institute has a new report of AI systems engaging in ... https://www.schneier.com/blog/archives/2026/08/more-incidents-of-ais-going-rogue-in-cybersecurity-challenges.html 📰 Schneier on Security #AI #ZeroDay

🤖 OpenAI adds an AI safety layer to detect misuse without retaining enterprise ... 📝 OpenAI is adding a new safety capability that... https://www.csoonline.com/article/4212398/openai-adds-an-ai-safety-layer-to-detect-misuse-without-retaining-enterprise-data.html 📰 CSO Online #AI #Malware

theregister.comResearcher tricks Apple’s Find My into sharing location data with LinuxClever protocol wrangling gets iBiz-only people tracking working on a non-iGadget

🍎 Researcher tricks Apple’s Find My into sharing location data with Linux 📝 A young security researcher figu... https://www.theregister.com/security/2026/08/20/researcher-tricks-apples-find-my-into-sharing-location-data-with-linux/5290496 📰 www.theregister.com - Articles #AppSec #ZeroDay

theregister.comCisco bug severity warning reads like Olympic gymnastics scores: 10, 10, 9.9, 9.6, and 7.5.Secure Workload Software has five nasty flaws and even SaaS users have updates to install

🔍 Cisco bug severity warning reads like Olympic gymnastics scores: 10... 📝 Cisco has revea... https://www.theregister.com/security/2026/08/21/cisco-bug-severity-warning-reads-like-olympic-gymnastics-scores-10-10-99-96-and-75/5290838 📰 www.theregister.com - Articles #CyberSecurity #AppSec

csoonline.comCitrix issues critical security updates for its NetScaler devicesA memory overflow vulnerability and an authentication bypass both require urgent attention.

🔴 Citrix issues critical security updates for its NetScaler devices 📝 Citrix is urging its NetScaler ADC and NetScaler Gateway customers t... https://www.csoonline.com/article/4212082/citrix-issues-critical-security-updates-for-its-netscaler-devices.html 📰 CSO Online #Malware #Ransomware

theregister.comRussian snoops add OAuth abuse to targeted phishing campaignsDon

🤖 Russian snoops add OAuth abuse to targeted phishing campaigns 📝 Google is tracking three distinct suspected Russian cy... https://www.theregister.com/security/2026/08/21/russian-snoops-add-oauth-abuse-to-targeted-phishing-campaigns/5290706 📰 www.theregister.com - Articles #AI #Phishing

🤖 Critical flaw patched in popular JavaScript sandbox used in AI projects 📝 A critical sandbox escape vulnerability was discovered and patched i... https://www.csoonline.com/article/4212151/critical-flaw-patched-in-popular-javascript-sandbox-used-in-ai-projects.html 📰 CSO Online #AI #CVE

intigriti.comWeb fuzzing for hackersFuzzing has been around for as long as web applications have. In fact, the term itself was coined back in 1988, when Barton Miller, a professor at the University of Wisconsin, was working over a dial-...

🔒 Web fuzzing for hackers 📝 Fuzzing has been around for as long as web applications have. In fact, the term itself was coined back in 1988, when ... https://www.intigriti.com/researchers/blog/hacking-tools/web-fuzzing-for-hackers 📰 Intigriti #AppSec #Malware

cisa.govCISA Adds Two Known Exploited Vulnerabilities to Catalog | CISARead the full article for details.

🏛️ CISA Adds Two Known Exploited Vulnerabilities to Catalog 📝 CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog ... https://www.cisa.gov/news-events/alerts/2026/08/20/cisa-adds-two-known-exploited-vulnerabilities-catalog 📰 Alerts #GovSec #ZeroDay

theregister.comUS Bank investigates LockBitFollow the money

🤖 US Bank investigates LockBit's claims as ransomware crims set p... 📝 US Bank says th... https://www.theregister.com/security/2026/08/20/us-bank-investigates-lockbits-claims-as-ransomware-crims-set-pay-or-leak-deadline/5290560 📰 www.theregister.com - Articles #AI #DataBreach #Ransomware

theregister.comRansomware crook poses as recovery firm to steal payments from fellow extortionistsBecause apparently even ransomware gangs can

⚡ Ransomware crook poses as recovery firm to steal payments from fel... 📝 A ransomware af... https://www.theregister.com/cyber-crime/2026/08/20/ransomware-crook-poses-as-recovery-firm-to-steal-payments-from-fellow-extortionists/5290344 📰 www.theregister.com - Articles #Ransomware #AppSec

theregister.comGrok chat duped into swallowing injected instructionsA spoonful of encryption helps the malware go down

🤖 Grok chat duped into swallowing injected instructions 📝 xAI's Grok web chat agent is currently vulnerable to a novel form of pro... https://www.theregister.com/ai-and-ml/2026/08/20/grok-chat-duped-into-swallowing-injected-instructions/5290019 📰 www.theregister.com - Articles #AI #OSINT

csoonline.comKriminal breaks out of Grok, Claude guardrails at $12.99The criminal AI service uses jailbreaks to bypass safeguards on legitimate AI models and offers capabilities including exploit development, OSINT, and social engineering.

🤖 Kriminal breaks out of Grok, Claude guardrails at $12.99 📝 Security researchers are warning of a criminal AI service built on Grok and Claude, among ... https://www.csoonline.com/article/4211952/kriminal-breaks-out-of-grok-claude-guardrails-at-12-99.html 📰 CSO Online #AI #CyberSecurity

schneier.comPolice Are Hiding Their Use of Flock Surveillance Cameras - Schneier on SecurityA usage policy for Flock license plate reader cameras tells police not to talk about the cameras: When cops use Flock to arrest someone in Wapello County, Iowa, they don’t want them to know. A usage policy for the automated license plate reader cameras in the county tells police, in no uncertain terms, to keep them a secret: “DO NOT MENTION ALPR USAGE TO THE OCCUPANTS OF THE VEHICLE,” the policy document reads. “DO NOT MENTION ALPR USAGE IN YOUR REPORT OR COMPLAINT UNLESS ABSOLUTELY NECESSARY.” This reminds me of IMSI-catchers (Stingray was the most popular) a couple of decades ago. Police would go to even more extremes to hide their usage...

🔒 Police Are Hiding Their Use of Flock Surveillance Cameras 📝 A usage policy for Flock license plate reader cameras tells police n... https://www.schneier.com/blog/archives/2026/08/police-are-hiding-their-use-of-flock-surveillance-cameras.html 📰 Schneier on Security #ThreatIntel #Malware

csoonline.comAirlock Digital Completes Independent IRAP Assessment at the PROTECTED LevelIndependent assessment provides Australian organisations with additional evidence when evaluating application control for sensitive, government, defence and critical infrastructure environments.

🤖 Airlock Digital Completes Independent IRAP Assessment at the PROTECTED Level 📝 Airlock Digital, a global provider of application contr... https://www.csoonline.com/article/4211754/airlock-digital-completes-independent-irap-assessment-at-the-protected-level.html 📰 CSO Online #AI #AppSec

csoonline.comOpenAI ‘temporarily slows’ scaling efforts, also promises zero data retention for select frontier model customers Analysts said the moves may be nothing more than positioning the company for its IPO, but that both changes are welcome news nonetheless.

🤖 OpenAI ‘temporarily slows’ scaling efforts, also promises zero data retention... 📝 OpenAI this wee... https://www.csoonline.com/article/4211672/openai-temporarily-slows-scaling-efforts-also-promises-zero-data-retention-for-select-frontier-model-customers-2.html 📰 CSO Online #AI #ZeroDay

theregister.com'Not a theoretical risk,' feds warn as attackers use AI-made code to hack critical infrastructure controllersRead the full article for details.

🤖 'Not a theoretical risk,' feds warn as attackers use ... 📝 Attackers are u... https://www.theregister.com/security/2026/08/19/not-a-theoretical-risk-feds-warn-as-attackers-use-ai-made-code-to-hack-critical-infrastructure-controllers/5289960 📰 www.theregister.com - Articles #AI #ZeroDay

theregister.comFlock surveillance backlash mounts as fiendish Halloween plans circulateCEO apologizes for police misuse as activists call for vandal action against license plate cameras

🔒 Flock surveillance backlash mounts as fiendish Halloween plans circulate 📝 Surveillance tech company ... https://www.theregister.com/security/2026/08/19/flock-surveillance-backlash-mounts-as-fiendish-halloween-plans-circulate/5289701 📰 www.theregister.com - Articles #BugBounty #Hacking

theregister.comICE boss to agents: Leave the Meta spy glasses at homeRead the full article for details.

🔒 ICE boss to agents: Leave the Meta spy glasses at home 📝 Some ICE employees seemingly needed a reminder not to wear their Meta... https://www.theregister.com/security/2026/08/19/ice-boss-to-agents-leave-the-meta-spy-glasses-at-home/5289826 📰 www.theregister.com - Articles #Hacking #CVE

cisa.govCISA Adds One Known Exploited Vulnerability to Catalog | CISARead the full article for details.

🏛️ CISA Adds One Known Exploited Vulnerability to Catalog 📝 CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog ,... https://www.cisa.gov/news-events/alerts/2026/08/19/cisa-adds-one-known-exploited-vulnerability-catalog 📰 Alerts #GovSec #CVE #ZeroDay

theregister.comComcast gives its Wi-Fi motion detector a security makeoverRebranded feature promises household alerts without video, but mind the small print

🛡️ Comcast gives its Wi-Fi motion detector a security makeover 📝 Comcast has folded its Wi-Fi-based intruder de... https://www.theregister.com/security/2026/08/19/comcast-gives-its-wi-fi-motion-detector-a-security-makeover/5289572 📰 www.theregister.com - Articles #DataBreach #ThreatIntel

csoonline.comSnowflake flaw slips past AI checks, gets exploited by another AIWiz’s Red Agent exploited a vulnerable GitHub Actions workflow in a Snowflake repository, ultimately compromising Jira credentials.

🤖 Snowflake flaw slips past AI checks, gets exploited by another AI 📝 An autonomous AI security agent developed by cloud security firm Wi... https://www.csoonline.com/article/4211501/snowflake-flaw-slips-past-ai-checks-gets-exploited-by-another-ai.html 📰 CSO Online #AI #CloudSec #ZeroDay

csoonline.comMost organizations aren’t ready for a Hugging Face-level eventAI is changing the cyber fight, so security teams need to test their defenses constantly — not just hope they work.

🔒 Most organizations aren’t ready for a Hugging Face-level event 📝 The National Security Agency (NSA) and Central Security Service recently pu... https://www.csoonline.com/article/4211112/most-organizations-arent-ready-for-a-hugging-face-level-event.html 📰 CSO Online #Ransomware #Malware

theregister.comCISA gives feds 3 days to fix actively exploited Ray RCE bugPhishing, malvertising attacks could target devs to gain access to private corporate networks

🏛️ CISA gives feds 3 days to fix actively exploited Ray RCE bug 📝 CISA says attackers are exploiting a critical 2... https://www.theregister.com/security/2026/08/18/cisa-gives-feds-3-days-to-fix-actively-exploited-ray-rce-bug/5289007 📰 www.theregister.com - Articles #GovSec #CVE #ZeroDay

csoonline.comMicrosoft finally patches critical one-click Copilot vulnerability, almost eight months after learning of itDubbed CoSnitch by the security researcher who discovered it, the flaw executes an attack chain that exfiltrates data from enterprises without any obvious red flags.

🤖 Microsoft finally patches critical one-click Copilot vulnerability, a... 📝 Almost eight mo... https://www.csoonline.com/article/4211342/microsoft-finally-patches-critical-one-click-copilot-vulnerability-more-than-eight-months-after-learning-of-it-2.html 📰 CSO Online #AI #CVE #Microsoft

theregister.comAustralian hotel chain leaks guests’ PII after breach at third-party database operatorUnknown parties know where you stayed last summer, down under, across 120 Quest properties

📧 Australian hotel chain leaks guests’ PII after breach at third-party... 📝 Australian apar... https://www.theregister.com/cyber-crime/2026/08/19/australian-hotel-chain-leaks-guests-pii-after-breach-at-third-party-database-operator/5289341 📰 www.theregister.com - Articles #AI #DataBreach

theregister.comExpired credit cards revived by researchers to make unauthorized paymentsGaps in expiry checks could let dead plastic make purchases again

🛡️ Expired credit cards revived by researchers to make unauthorized payments 📝 Researchers affiliated... https://www.theregister.com/security/2026/08/18/expired-credit-cards-revived-by-researchers-to-make-unauthorized-payments/5289229 📰 www.theregister.com - Articles #Ransomware #InfoSec

theregister.comOpenAIExpanded multistage chain of thought monitoring makes frontier model work more expensive

🤖 OpenAI's overhead will rise 20 percent for some workloads as it hardens security 📝 OpenAI on Tuesday... https://www.theregister.com/ai-and-ml/2026/08/19/openais-overhead-will-rise-20-percent-for-some-workloads-as-it-hardens-security/5289303 📰 www.theregister.com - Articles #AI #ZeroDay

csoonline.comCritical GitLab flaw allows attackers to delete and modify public reposAttackers don’t need credentials or user interaction to exploit the flaw which could enable supply chain attacks in self-hosted code repositories.

🔴 Critical GitLab flaw allows attackers to delete and modify public repos 📝 GitLab has fixed a critical vulnerability that could allow unau... https://www.csoonline.com/article/4211140/critical-gitlab-flaw-allows-attackers-to-delete-and-modify-public-repos.html 📰 CSO Online #CVE #Exploit

microsoft.comHunting MacSync Stealer infrastructure through behavioral pivots | Microsoft Security BlogMacSync Stealer rapidly rotates domains to evade detection, but its behavior remains consistent. Learn how Microsoft uncovered 30+ related domains using durable hunting pivots.

🤖 Hunting MacSync Stealer infrastructure through behavioral pivots 📝 In this article Activity overview Discovery of addi... https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/ 📰 Microsoft Security Blog #AI #Pentesting

cisa.govCISA Adds Four Known Exploited Vulnerabilities to Catalog | CISARead the full article for details.

🏛️ CISA Adds Four Known Exploited Vulnerabilities to Catalog 📝 CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catal... https://www.cisa.gov/news-events/alerts/2026/08/18/cisa-adds-four-known-exploited-vulnerabilities-catalog 📰 Alerts #GovSec #ZeroDay

securityweek.comCISO Conversations: Nico Waisman – From Self-Taught Hacker to AI-Driven Offensive Security at XBOWNico Waisman, CISO at XBOW, on his path from self-taught hacker in Argentina to leading AI-driven offensive security.

🤖 CISO Conversations: Nico Waisman – From Self-Taught Hacker to AI-Driven Offen... 📝 With no formal training and no career plan, Wa... https://www.securityweek.com/ciso-conversations-nico-waisman-from-self-taught-hacker-to-ai-driven-offensive-security-at-xbow/ 📰 SecurityWeek #AI #InfoSec

csoonline.comNew malware turns Microsoft cloud into its control centerTWINLOOT uses SharePoint, Teams, Azure and the victim’s own Edge browser to hide command-and-control traffic inside trusted Microsoft infrastructure.

🖥️ New Malware turns Microsoft cloud into its control center 📝 Security researchers are warning of a newly uncovered Python malware frame... https://www.csoonline.com/article/4210973/new-malware-turns-microsoft-cloud-into-its-control-center.html 📰 CSO Online #CloudSec #Malware #Microsoft

schneier.comLLMs and Contextual Integrity - Schneier on SecurityI have been thinking a lot about AI and integrity. Part of that is contextual integrity. I recently found two papers on the topic. “CIMemories: A Compositional Benchmark for Contextual Integrity of Persistent Memory in LLMs“: Abstract: Large Language Models (LLMs) increasingly use persistent memory from past interactions to enhance personalization and task performance. However, this memory introduces critical risks when sensitive information is revealed in inappropriate contexts. We present CIMemories, a benchmark for evaluating whether LLMs appropriately control information flow from memory based on task context. CIMemories uses synthetic user profiles with over 100 attributes per user, paired with diverse task contexts in which each attribute may be essential for some tasks but inappropriate for others. Our evaluation reveals that frontier models exhibit up to 69% attribute-level violations (leaking information inappropriately), with lower violation rates often coming ...

🤖 LLMs and Contextual Integrity 📝 I have been thinking a lot about AI and integrity. Part of that is contextual integrity https://www.schneier.com/blog/archives/2026/08/llms-and-contextual-integrity.html 📰 Schneier on Security #AI #DataBreach

csoonline.comWhat you say during a cyber breach can — and will — be used against youCyber breach communications can become costly evidence, making disciplined documentation and privilege practices essential from day one.

📧 What you say during a cyber breach can — and will — be used against you 📝 The first 24 hours after a cyber incident are messy. Teams are mo... https://www.csoonline.com/article/4210677/what-you-say-during-a-cyber-breach-can-and-will-be-used-against-you.html 📰 CSO Online #AI #DataBreach

csoonline.comOpenAI president’s blog pushing agentic AI most notable for what it did not say Given the urgency, analysts and consultants want to hear more about what to do when agents go rogue, as well as how to better control all agent actions.

🤖 OpenAI president’s blog pushing agentic AI most notable for what it did not say 📝 OpenAI president Greg Brockman on Sunday warn... https://www.csoonline.com/article/4210776/openai-presidents-blog-pushing-agentic-ai-most-notable-for-what-it-did-not-say-2.html 📰 CSO Online #AI #BugBounty

🛡️ What the CISO role will look like in 2029 📝 Wolfgang Goerlich has spent his career in security and has been a CISO for the past seven years. Like many lo... https://www.csoonline.com/article/4208210/what-the-ciso-role-will-look-like-in-2029.html 📰 CSO Online #Pentesting #CyberSecurity

csoonline.comNew macOS malware turns stolen browsers into attacker-controlled sessionsAmnesiaStealer tricks users into pasting Terminal commands from a fake GitHub page before harvesting credentials, cookies and documents.

🍎 New macOS malware turns stolen browsers into attacker-controlled sessions 📝 Mac users are being freshly warned of suspicious websi... https://www.csoonline.com/article/4210464/new-macos-malware-turns-stolen-browsers-into-attacker-controlled-sessions.html 📰 CSO Online #Malware #Phishing

csoonline.comZhipu says new coding AI developed advanced cyber skills faster than expectedChina's AI developer claims GLM-5.3 rivals leading Western models in vulnerability discovery and has identified thousands of security flaws across real-world software.

🤖 Zhipu says new coding AI developed advanced cyber skills faster than expected 📝 Chinese AI developer Zhipu has launched GLM-5. 3, ... https://www.csoonline.com/article/4210501/zhipu-says-new-coding-ai-developed-advanced-cyber-skills-faster-than-expected-2.html 📰 CSO Online #AI #ZeroDay

theregister.comAn AI broke SnowflakeDon

🤖 An AI broke Snowflake's code. Then another AI agent exploited it 📝 An AI broke Snowflake’s code; then another AI, an a... https://www.theregister.com/security/2026/08/17/an-ai-broke-snowflakes-code-then-another-ai-agent-exploited-it/5288666 📰 www.theregister.com - Articles #AI #ZeroDay

cisa.govCISA Adds One Known Exploited Vulnerability to Catalog | CISARead the full article for details.

🏛️ CISA Adds One Known Exploited Vulnerability to Catalog 📝 CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog ,... https://www.cisa.gov/news-events/alerts/2026/08/17/cisa-adds-one-known-exploited-vulnerability-catalog 📰 Alerts #GovSec #CVE #ZeroDay

csoonline.comWhy data quality dictates security operations successControlled experiments reveal that enriched network telemetry dramatically outperforms basic logs across investigation benchmarks.

🤖 Why data quality dictates security operations success 📝 As AI takes on more security operations center (SOC) workflows to automate threat triage, indicat... https://www.csoonline.com/article/4206800/why-data-quality-dictates-security-operations-success.html 📰 CSO Online #AI #DataBreach