Explainable Vulnerability Detection in C/C++ Using Edge-Aware Graph Attention Networks

Detecting security vulnerabilities in source code remains challenging, particularly due to class imbalance in real-world datasets where vulnerable functions are under-represented. Existing learning-based methods often optimise for recall, leading to high false positive rates and reduced usability...

From Text to Actionable Intelligence: Automating STIX Entity and Relationship Extraction

Sharing methods of attack and their effectiveness is a cornerstone of building robust defensive systems. Threat analysis reports, produced by various individuals and organizations, play a critical role in supporting security operations and combating emerging threats. To enhance the timeliness and...

MAL-2025-6213 Malicious code in donotinstallthisistest6 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 272225f1adba5810796fd9c194041e72e5fcdcc032fa296a701bcc480b37bfcb Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

How WIRED Analyzed the Epstein Video

On this episode of Uncanny Valley, we dive into the differences between what the US government said about a Jeffrey Epstein video it released and the story told by its metadata...

curl: on the implications of permitting procedural culling

Good day. My name is Lorentso Youriévitch Bogdanov. It has come to my attention that you are in need of higher-quality code review. Rest assured that you are not alone in noticing a certain degree of brain-drain in this field. As you can perhaps imagine, the recent shortage of qualified hackers a...

Exploit for Type Confusion in Google Chrome

CVE-2024-4947 A in-the-wild V8 type confusion bug. This repo...

Exploit for Inclusion of Functionality from Untrusted Control Sphere in Sudo_Project Sudo

CVE-2025-32463 Detection Framework A comprehensive security m...

Exploiting Context-Dependent Duration Features for Voice Anonymization Attack Systems

The temporal dynamics of speech, encompassing variations in rhythm, intonation, and speaking rate, contain important and unique information about speaker identity. This paper proposes a new method for representing speaker characteristics by extracting context-dependent duration embeddings from...

Privacy-Preserving Drone Navigation through Homomorphic Encryption for Collision Avoidance

As drones increasingly deliver packages in neighborhoods, concerns about collisions arise. One solution is to share flight paths within a specific zip code, but this compromises business privacy by revealing delivery routes. For example, it could disclose which stores send packages to certain...

MAL-2025-6009 Malicious code in protolab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 395ceb17d3bf331597e101e685532b4af1d732b5ee31005221b0fcae61b97632 The OpenSSF Package Analysis project identified 'protolab' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6007 Malicious code in groq-mcp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f310f1669db9ce74e36d92085a6a67098f7c0ee086d8da5998b709d565a3fe12 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in everestsystems-content-core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b1e36c55069fe1374c19441b5e3cbabd0ba1bc120d2d1651dd5570157a8a9c57 The OpenSSF Package Analysis project identified...

Vulnerabilities fixed in Citrix NetScaler ADC and NetScaler Gateway

Citrix has fixed vulnerabilities in NetScaler ADC and NetScaler Gateway. The vulnerability with reference CVE-2025-5777 involves an Out-of-Bounds Read. This vulnerability arises from insufficient input validation in systems configured as Gateway services. These include VPN virtual servers, ICA...

The CryptoNeo Threat Modelling Framework (CNTMF): Securing Neobanks and Fintech in Integrated Blockchain Ecosystems

The rapid integration of blockchain, cryptocurrency, and Web3 technologies into digital banks and fintech operations has created an integrated environment blending traditional financial systems with decentralised elements. This paper introduces the CryptoNeo Threat Modelling Framework CNTMF, a...

Faraday 5.15.1

Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use...

Malicious code in marcom-ac-console (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 64d378ac078f27f1f0357746b50307c933999c2eb82b5c9c7a7a6b0645910749 The OpenSSF Package Analysis project identified 'marcom-ac-console' @ 1.0.5 npm as malicious. It is considered malicious because: - The package...

MAL-2025-6209 Malicious code in marcom-ac-console (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 64d378ac078f27f1f0357746b50307c933999c2eb82b5c9c7a7a6b0645910749 The OpenSSF Package Analysis project identified 'marcom-ac-console' @ 1.0.5 npm as malicious. It is considered malicious because: - The package...

CVE-2025-50082

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and 9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQ...

MAL-2025-5992 Malicious code in ngx-satoris (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 673e3bc6e9e3b3d52385697990c722fc2d418dcb3169950ac1063ae5b0371c1f Any computer that has this package installed or running should be considered...

PHASE: Passive Human Activity Simulation Evaluation

Cybersecurity simulation environments, such as cyber ranges, honeypots, and sandboxes, require realistic human behavior to be effective, yet no quantitative method exists to assess the behavioral fidelity of synthetic user personas. This paper presents PHASE Passive Human Activity Simulation...