Synergizing Static Analysis with Large Language Models for Vulnerability Discovery and Beyond

This report examines the synergy between Large Language Models LLMs and Static Application Security Testing SAST to improve vulnerability discovery. Traditional SAST tools, while effective for proactive security, are limited by high false-positive rates and a lack of contextual understanding...

MAL-2025-47425 Malicious code in storj-satellite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a2cdc91ce66bac3ff8836be68fb784bbdf468eed157c29548ca788ae8669b69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47427 Malicious code in tml-footer (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 00452b25be1612714f1d3a1de19a9429e6d4f1d0c2450103ce3791c2d27ff72a The OpenSSF Package Analysis project identified 'tml-footer' @ 99.9.9...

PT-2025-42268

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a use-after-free issue within the xc5000 driver related to timer management. The xc5000 release function originally used cancel delayed work, which does not...

Beyond Classification: Evaluating LLMs for Fine-Grained Automatic Malware Behavior Auditing

Automated malware classification has achieved strong detection performance. Yet, malware behavior auditing seeks causal and verifiable explanations of malicious activities -- essential not only to reveal what malware does but also to substantiate such claims with evidence. This task is challengin...

Cybersecurity AI: Humanoid Robots As Attack Vectors

We present a systematic security assessment of the Unitree G1 humanoid showing it operates simultaneously as a covert surveillance node and can be purposed as an active cyber operations platform. Partial reverse engineering of Unitree's proprietary FMX encryption reveal a static Blowfish-ECB laye...

PT-2025-42270

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a use-after-free flaw within the b2c2 component, specifically in the flexcop pci remove function. The issue arises because cancel delayed work does not guarante...

ATLANTIS: AI-Driven Threat Localization, Analysis, and Triage Intelligence System

We present ATLANTIS, the cyber reasoning system developed by Team Atlanta that won 1st place in the Final Competition of DARPA's AI Cyber Challenge AIxCC at DEF CON 33 August 2025. AIxCC 2023-2025 challenged teams to build autonomous cyber reasoning systems capable of discovering and patching...

SUSE CVE-2023-53332

In the Linux kernel, the following vulnerability has been resolved: genirq/ipi: Fix NULL pointer deref in irqdatagetaffinitymask If ipisendmask|single is called with an invalid interrupt number, all the local variables there will be NULL. ipisendverify which is invoked from these functions does...

CLSA-2025-1758041082 libsndfile: Fix of CVE-2024-50612

CVE-2024-50612: fix out-of-bounds read in vorbisanalysiswrote in oggvorbis.c...

New FileFix Variant Delivers StealC Malware Through Multilingual Phishing Site

Cybersecurity researchers have warned of a new campaign that's leveraging a variant of the FileFix social engineering tactic to deliver the StealC information stealer malware. "The observed campaign uses a highly convincing, multilingual phishing site e.g., fake Facebook Security page, with...

Malicious code in updox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6dd4f7a8300a1eb6ed1be834e8cbec76f95c8eb7325192124ad7379896c9a0b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

nettoolbox

NetToolbox - Network Security Toolkit A comprehensive, modern...

Malicious code in kreme-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 74b37346bf5501afd9654bd64f028afa11d20457e237fb2b45a4bff318617c64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47129 Malicious code in kreme-crypto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 74b37346bf5501afd9654bd64f028afa11d20457e237fb2b45a4bff318617c64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cyber Attack Mitigation Framework for Denial of Service (DoS) Attacks in Fog Computing

Innovative solutions to cyber security issues are shaped by the ever-changing landscape of cyber threats. Automating the mitigation of these threats can be achieved through a new methodology that addresses the domain of mitigation automation, which is often overlooked. This literature overview...

gadgetinspector

This is a Java-based tool for finding deserialization gadget chains in Java applications. The tool is called "Gadget Inspector" and is presented as a project that was showcased at Black Hat USA 2018. The tool is designed to automatically discover possible gadget chains in an application's...

Exploit for Generation of Error Message Containing Sensitive Information in Postgresql

This is a PoC exploit for CVE-2021-3393, a Java source code static code analysis and danger function identifier program. The tool, named JavaID, identifies dangerous functions in Java source code by way of regular matching. It targets Java vulnerabilities such as XXE, Java Object Deserialization,...

Malicious code in @cnx-ui/cnx-ui-core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 87e84454809b6a23abcd234d62b4b3630bd69cf9c89b02f5e5f8c16204712981 Any computer that has this package installed or running should be considered...

Software-Security-Learning

It is an offensive tool for binary analysis. The repository Software-Security-Learning contains a collection of resources for learning software security, including tools and tutorials for binary analysis. The tools listed include Pharos, Angr, Vuzzer, PEDA, and pwntools, which are used for static...