Rise from the Ashes: LLM-Based Static Analysis for Deep Learning Framework Bugs

Deep learning DL frameworks are critical AI infrastructures that often hide bugs with serious security implications. While dynamic approaches such as fuzzing are effective in uncovering these bugs, they require real test execution and incur high computational costs. Static analysis is a natural...

Cross-Domain Generalization Failure in Lightweight Intrusion Detection Models for IIoT Networks

Lightweight machine learning models are increasingly proposed for intrusion detection in Industrial Internet of Things IIoT networks due to their suitability for resource-constrained edge deployment. Most reported results evaluate these models only within their training network, leaving behavior ...

Splunk Enterprise Access Control Data Compromise

The vulnerability of the Splunk Enterprise platform for operational analysis is related to access control errors, which allow attackers to compromise the integrity of the protected information...

Splunk Enterprise Data Compromise

The vulnerability of the Splunk Enterprise platform for operational analysis is related to improper handling of data with Unicode encoding. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2025-71368 picklescan - Arbitrary Code Execution via Undetected doctest.debug_script

picklescan before 0.0.30 fails to detect the doctest.debugscript function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote attackers can craft malicious pickle files embedding doctest.debugscript calls that bypass picklescan detection and execute arbitrary command...

CVE-2025-71355 Picklescan - Arbitrary Code Execution via Unsafe Numpy Function Detection Bypass

Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and execute arbitrary code during deserialization. Attackers can craft malicious pickle files using numpy.testing.private.utils.runstring within the reduce method to...

SUSE CVE-2026-53090

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix ldabs,ind failure path analysis in subprogs Usage of ldabs,ind instructions got extended into subprogs some time ago via commit 09b28d76eac4 "bpf: Add abnormal return checks.". These are only allowed in subprograms when...

jaiotlink-c492a-wifi-camera

jaiotlink-wifi-camera This repo contains my research notes an...

Robocalls: A Worldwide or US-Only Problem? Analyzing Spam and Fraud in International Phone Calls

Unsolicited automated phone calls robocalls are a serious threat: in the US alone, these calls resulted in reported losses of 1.1$ billion during 2025. Phishing and spoofing consistently rank among the most reported crimes within the FBI's Internet Crime Complaint Center, with phone call scams...

Hybrid Topological Data Analysis and LSTM Networks for Enhanced Network Intrusion Detection Using CIC-IDS2017 Dataset

Network intrusion detection systems NIDS are crucial in cybersecurity infrastructure, needing advanced techniques to detect hostile activity in network traffic. This research introduces a hybrid approach that combines Topological Data Analysis TDA with Long Short-Term Memory LSTM networks to...

CVE-2025-71355: Incomplete List of Disallowed Inputs

Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and execute arbitrary code during deserialization. Attackers can craft malicious pickle files using numpy.testing.private.utils.runstring within the reduce method to...

AgentTesla Config Extractor

Analyze AgentTesla .NET payloads: locate string-decryption methods, invoke them with IL-derived keys under a watchdog timeout, and extract likely C2 indicators HTTP, SMTP, FTP. Requires pythonnet and dnlib.dll. !/usr/bin/env python3 -- coding: utf-8 -- """ Extract C2 configuration from AgentTesla...

convert-and-download (0.3.0), nbinteract (>=0.0.18, <=0.1.8) +3 more potentially affected by CVE-2026-44727 via jupyter-server (1.13.2)

jupyter-server PYPI version 1.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - convert-and-download 0.3.0 - nbinteract =0.0.18, =0.0.2, =0.1.0, =4.3.2 Source cves: CVE-2026-44727 Source advisory:...

aysec-cheatsheets

AYSEC Security Cheatsheets A free, practical collection of...

Malicious code in @digitalcnzz/commonmodule (npm)

This npm package is purpose-built malware that exfiltrates host information and environment secrets. It runs as a postinstall hook the keyword "postinstall" is obfuscated in the code and bails immediately if npmpackagename is unset, confirming it only fires during npm install. After a randomized...

MAL-2026-6598 Malicious code in @sailing-package/core (npm)

This npm package is purpose-built malware that exfiltrates host information and environment secrets. It runs as a postinstall hook the keyword "postinstall" is obfuscated in the code and bails immediately if npmpackagename is unset, confirming it only fires during npm install. After a randomized...

Joern 4.0.568

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

AI-Generated PowerShell Malware: An Experimental Framework and Dataset

Generative AI has emerged as a significant cybersecurity threat, with several recent attack campaigns leveraging LLMs to generate code for malicious purposes via scripting languages such as PowerShell. Consequently, for cybersecurity analysts, it is imperative to investigate the offensive...

Malicious code in @longzy/react-native-polyfill (npm)

This npm package is purpose-built malware that exfiltrates host information and environment secrets. It runs as a postinstall hook the keyword "postinstall" is obfuscated in the code and bails immediately if npmpackagename is unset, confirming it only fires during npm install. After a randomized...

Malicious code in @sailing-package/core (npm)

This npm package is purpose-built malware that exfiltrates host information and environment secrets. It runs as a postinstall hook the keyword "postinstall" is obfuscated in the code and bails immediately if npmpackagename is unset, confirming it only fires during npm install. After a randomized...