43 matches found
fulcio
Fulcio 用于代码签名的免费 CA Fulcio 是一个免费的证书颁发机构，用于为 OpenID Connect OIDC 身份（例如电子邮件地址）签发代码签名证书。 Fulcio 仅签发有效期为 10 分钟的短期证书。 公共实例 Fulcio 已正式发布（General Availability），提供 99.5% 可用性 SLO，并遵循 semver 规则 以保证 API 稳定性。 有关 Fulcio 公共实例的运行时间数据，请参阅 https://status.sigstore.dev。 Fulcio 的证书链可通过 TrustBundle API 获取，例如公共实例...
ephemera
Ephemera : ゼロトラスト SSH 認証局 Ephemera は、インフラストラクチャへのゼロトラストアクセスを強制するために設計された、軽量でセルフホストの SSH 認証局です。静的 SSH キーを短命な証明書に置き換え、ハードウェアバックアップされた WebAuthn MFA を統合し、暗号検証可能な監査証跡を維持します。 !NOTE 正規のソース : Codeberg GitHub ミラー : GitHub 可用性とホスティングのため 高レベルアーキテクチャ root@kitploit: graph LR subgraph Client"User Operator"...
AETHER-PROTOCOL-P
⬡ AETHER PROTOCOL — Aether AI LLC. 2026 面向自主AI系统的密码学验证短时身份基础设施 专利申请中 — 美国申请号 64/006,746 — 2026年3月16日提交 "世界上每一个AI系统都可能因向其流水线注入虚假指令而被攻破。Aether Protocol 使这种情况在物理上不可能发生。" 问题 2026年2月25日，Check Point Research 披露了 CVE-2025-59536 — 一个存在于 Claude Code 中的严重漏洞（CVSS 8.7），该漏洞允许攻击者向 .claude/settings.json...
GHSA-35C4-RVC8-FRHM Budibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials
Summary The Budibase server route POST /api/attachments/:datasourceId/url packages/server/src/api/routes/static.ts is registered with only the recaptcha middleware. There is no authorized... middleware in the chain. The controller...
Fake malware-signing service Fox Tempest dismantled by Microsoft
Microsoft says it dismantled a malware-signing-as-a-service MSaaS called Fox Tempest, which helped cybercriminals make malware appear legitimate. The service let customers submit malicious files to be digitally signed with short-lived Microsoft-issued certificates, making the malware look...
Topical Shifts in the Dark Web: A Longitudinal Analysis of Content from the Cybercrime Ecosystem
The dark web hosts a dynamic ecosystem of cybercrime forums and marketplaces that adapt to law enforcement pressure, technological change, and economic incentives. Prior research has extracted cyber threat intelligence from these platforms using static snapshots, with limited attention to how...
CVE-2026-7686
Eyeo Adblock Plus (Chrome) up to 4.36.2 contains a vulnerability in postMessage handling within premium.preload.js (Legacy Premium Activation). Exploitation allows improper access controls with remote execution; the attack is publicly disclosed. The vendor notes the legacy activation path is depr...
SUSE CVE-2026-29060
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a registered user without privileges to create or modify file requests is able to create a short-lived API key that has the permission to do so. The user must be registered with...
Free real estate: GoPix, the banking Trojan living off your memory
Introduction GoPix is an advanced persistent threat targeting Brazilian financial institutions' customers and cryptocurrency users. It represents an evolved threat targeting internet banking users through memory-only implants and obfuscated PowerShell scripts. It evolved from the RAT and Automate...
CVE-2026-29060
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a registered user without privileges to create or modify file requests is able to create a short-lived API key that has the permission to do so. The user must be registered with...
CVE-2026-29060 Gokapi: Privilege escalation with auth token
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a registered user without privileges to create or modify file requests is able to create a short-lived API key that has the permission to do so. The user must be registered with...
CVE-2026-29060 Gokapi: Privilege escalation with auth token
Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. Prior to version 2.2.3, a registered user without privileges to create or modify file requests is able to create a short-lived API key that has the permission to do so. The user must be registered with...
Gokapi has privilege escalation with auth token
Impact A registered user without privileges to create or modify file requests is able to create a short-lived API key that has the permission to do so. The user must be registered with Gokapi. If you do not have any other users with access to the admin/upload menu, you are not impacted. Patches...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via the auth token process. An attacker can gain unauthorized privileges by creating a short-lived API key with elevated permissions. This is only exploitable if the attacker is a registered user without existing...
PT-2026-23604
Name of the Vulnerable Software and Affected Versions Gokapi versions prior to 2.2.3 Description Gokapi is a self-hosted file sharing server that supports automatic expiration and encryption. A registered user lacking the necessary permissions to create or modify file requests can generate a...
npm’s Update to Harden Their Supply Chain, and Points to Consider
In December 2025, in response to the Sha1-Hulud incident, npm completed a major authentication overhaul intended to reduce supply-chain attacks. While the overhaul is a solid step forward, the changes don’t make npm projects immune from supply-chain attacks. npm is still susceptible to malware...
Why Serverless Risk Demands Identity-Aware Security at Cloud Scale
Key Takeaways Serverless shifts security risk from infrastructure to identity, permissions, and configuration, where small design choices can have an outsized impact. Short-lived cloud credentials reduce persistence but remain powerful; when exposed, they enable authenticated access, escalation,...
SUSE CVE-2025-62513
OpenBao is an open source identity-based secrets management system. In versions 2.2.0 to 2.4.1, OpenBao's audit log experienced a regression wherein raw HTTP bodies used by few endpoints were not correctly redacted HMAC'd. This impacts those using the ACME functionality of PKI, resulting in...
