cloud-sniper

Cloud Sniper : Detection-as-code platform Cloud Sniper is a comprehensive platform meticulously designed to streamline Cloud Security Operations. It swiftly responds to security incidents by analyzing and correlating cloud artifacts, ensuring a holistic view of the company's cloud security postur...

reportly

Reportly is an EntraID user activity report tool. About the tool This is a tool that will help blue teams during a cloud incident. When running the tool, the researcher will enter as input a suspicious user and a time frame and will receive a report detailing the following: 1. Information about t...

openclaw_vulnerabilities_and_solutions

OpenClaw — 漏洞、加固与 VPS 部署 关于在 VPS 上安全部署 OpenClaw 的已脱敏公开文档：访问架构、已知漏洞以及带解决方案的实际事故案例。 来自真实 OpenClaw 运维的公开脱敏文档：如何在不暴露网关的情况下将平台部署到 VPS，哪些 CVE/问题在实践中真正重要，以及生产环境中出现了哪些故障（附修复方案）。 当前版本 / Current version: v1.2 · 更新日志 · GitHub Releases 这是什么 / What this repository is | RU| EN ---|---|--- 面向人群 / Audience| 自托管...

IRM

IRM-2022 事件响应方法论 2022 CERT Societe Generale 与 CERT aDvens 合作，提供易于使用的运营事件最佳实践。这些速查表专门用于事件处理，涵盖 CERT 团队可能参与的多个领域。对于我们所处理的每种安全事件，都有一个对应的 IRM。 CERT Societe Generale 谨感谢 SANS 和 Lenny Zeltser，他们为部分 IRM 提供了重要的灵感来源。 我们还要感谢 CERT aDvens 的协作工作和法语翻译。 如果您在这些 IRM 中发现错误或问题，请随时联系我们。 本作品采用 知识共享署名 3.0 未本地化许可协议 进行许...

An analysis of incidents at Brazilian educational institutions

Introduction Because of the amount of data that can be obtained and the high impact that successful attacks may have, educational institutions are frequent targets of cybercriminals. Both public and private schools and universities rely on software for managing personally identifiable information...

CVE-2026-67596

creationtimestamp| type| source ---|---|--- 2026-08-02 09:09:28+00:00| seen| https://gist.github.com/fkan001/9eb1ebd3d98743c920f2fd241a51ccbb 2026-08-02 09:29:17+00:00| seen| https://gist.github.com/fkan001/86026af6c6a04b70229801e3a084d44a...

IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains

Phishing was the primary means of gaining initial access this quarter, appearing in over half of all Cisco Talos Incident Response Talos IR engagements - an increase from approximately a third of engagements last quarter. Attackers continued to innovate their delivery methods to evade defenses,...

A week in security (July 20 – July 26)

Last week on Malwarebytes Labs: Don’t get fooled by TikTok resin art scams Call of Duty Mobile scam uses fake free points to steal player accounts OpenAI’s agent escaped its sandbox during a security test Google wants to store a selfie video of your face Beyond the Play Store: How Android threats...

Healthcare giant Abbott probes two cyber incidents amid extortion claims

Abbott Laboratories, one of the world's largest healthcare and medical device companies, is investigating two apparently unrelated cyber incidents after confirming unauthorized access to internal systems. While Abbott says there has been no impact on manufacturing, laboratory operations, or patie...

Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects

The following analysis presents the key findings from Kaspersky Compromise Assessment engagements performed in 2025. A compromise assessment is an independent, expert-driven service that examines whether a target network has been compromised. The service combines threat intelligence analysis...

Survey: 94% of Incidents Involve Anonymized Infrastructure. Teams Are Still Reactive

Security teams have never had more IP data at their disposal. Every day, analysts ingest enrichment feeds, geolocation data, reputation scores, telemetry, and threat intelligence from a growing ecosystem of vendors and platforms. Yet despite this abundance of information, many organizations...

Improper Handling of Exceptional Conditions

Overview @hulumi/drift is a Local-first drift classifier and live posture validator — distinguishes provider-API churn from console break-glass from genuine IaC drift, then renders read-only live posture findings as JSON, Markdown, and SARIF. Verdict logic mirrors HulumiDrift.tla Ha Affected...

CVE-2026-48134

When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access the UserCheck Ask page could attempt to manipulate the Security Gateway's stored DLP/UserCheck incident information. This could lead to...

CVE-2026-48134

When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access the UserCheck Ask page could attempt to manipulate the Security Gateway's stored DLP/UserCheck incident information. This could lead to...

CVE-2026-48134

When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access the UserCheck Ask page could attempt to manipulate the Security Gateway's stored DLP/UserCheck incident information. This could lead to...

CVE-2026-48134 SQL injection issue in UserCheck Portal when DLP Software Blade is active

When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access the UserCheck Ask page could attempt to manipulate the Security Gateway's stored DLP/UserCheck incident information. This could lead to...

CVE-2026-48134 SQL injection issue in UserCheck Portal when DLP Software Blade is active

When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access the UserCheck Ask page could attempt to manipulate the Security Gateway's stored DLP/UserCheck incident information. This could lead to...

EUVD-2026-31821

When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access the UserCheck Ask page could attempt to manipulate the Security Gateway's stored DLP/UserCheck incident information. This could lead to...

The vulnerability of the GLPI system for managing requests, incidents, and inventory of computer equipment is related to deficiencies in authentication procedures, which allow unauthorized users to elevate their privileges.

The vulnerability of the GLPI system for managing requests, incidents, and inventory of computer equipment is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers who operate remotely to gain increased privileges...

CVE-2026-48239

Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tickid POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents summary report without sanitization. Authenticated attackers can craft requests that alter query...