cloud-sniper

Cloud Sniper : Detection-as-code platform Cloud Sniper is a comprehensive platform meticulously designed to streamline Cloud Security Operations. It swiftly responds to security incidents by analyzing and correlating cloud artifacts, ensuring a holistic view of the company's cloud security postur...

reportly

Reportly is an EntraID user activity report tool. About the tool This is a tool that will help blue teams during a cloud incident. When running the tool, the researcher will enter as input a suspicious user and a time frame and will receive a report detailing the following: 1. Information about t...

openclaw_vulnerabilities_and_solutions

OpenClaw — vulnerabilidades, endurecimiento y despliegue en VPS Documentación pública saneada sobre el despliegue seguro de OpenClaw en VPS: arquitectura de acceso, vulnerabilidades conocidas e incidentes prácticos con soluciones. Documentación pública y saneada de operaciones reales de OpenClaw:...

IRM

Spanish version Deprecated The Spanish version is available here. These cheat sheets have been written in English and Russian, and translated into Spanish by Francisco Neira from the OAS...

Forecasting Cybersecurity Incidents Using Geopolitical Data and Large Language Models

Predicting security incidents is a profound task critical for informing proactive defensive measures and cyber-insurance policies. Prior work tackling this problem mainly utilized structured, manually defined features based on network measurements e.g., protocol misconfigurations. Still, despite...

Enhancing Privacy, Neglecting Harms: An Analysis of Real-World Digital Privacy Incidents

Privacy-enhancing technologies PETs have emerged as a technical means for providing individuals with greater control over their information. Yet despite the growing deployment of PETs, people continue to experience privacy harms. In this work, we revisit our understanding of privacy incidents and...

[Webinar] Tales from the Frontlines: An exclusive briefing on Q2 incidents

!\Webinar\ Tales from the Frontlines: An exclusive briefing on Q2 incidentshttps://storage.ghost.io/c/af/a0/afa04ee3-414f-4481-8d23-7e7c146f192e/content/images/2026/08/2-1-no-copy.jpg Have you ever read the Talos IR Quarterly Trends report and wondered, "How did that phishing or ransomware campai...

An analysis of incidents at Brazilian educational institutions

Introduction Because of the amount of data that can be obtained and the high impact that successful attacks may have, educational institutions are frequent targets of cybercriminals. Both public and private schools and universities rely on software for managing personally identifiable information...

CVE-2026-67596

creationtimestamp| type| source ---|---|--- 2026-08-02 09:09:28+00:00| seen| https://gist.github.com/fkan001/9eb1ebd3d98743c920f2fd241a51ccbb 2026-08-02 09:29:17+00:00| seen| https://gist.github.com/fkan001/86026af6c6a04b70229801e3a084d44a...

IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains

Phishing was the primary means of gaining initial access this quarter, appearing in over half of all Cisco Talos Incident Response Talos IR engagements - an increase from approximately a third of engagements last quarter. Attackers continued to innovate their delivery methods to evade defenses,...

StealthBench: Measuring Operational Stealth in Autonomous Offensive-Security Agents

Stealth, the discipline of achieving an objective without revealing your presence, capabilities, or collected intelligence, is what separates sophisticated operators from detectable ones. Elite security researchers and advanced persistent threats achieve their objectives unnoticed; autonomous...

A week in security (July 20 – July 26)

Last week on Malwarebytes Labs: Don’t get fooled by TikTok resin art scams Call of Duty Mobile scam uses fake free points to steal player accounts OpenAI’s agent escaped its sandbox during a security test Google wants to store a selfie video of your face Beyond the Play Store: How Android threats...

Healthcare giant Abbott probes two cyber incidents amid extortion claims

Abbott Laboratories, one of the world's largest healthcare and medical device companies, is investigating two apparently unrelated cyber incidents after confirming unauthorized access to internal systems. While Abbott says there has been no impact on manufacturing, laboratory operations, or patie...

Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects

The following analysis presents the key findings from Kaspersky Compromise Assessment engagements performed in 2025. A compromise assessment is an independent, expert-driven service that examines whether a target network has been compromised. The service combines threat intelligence analysis...

ARENA: An Architecture for Measuring the Transferability of Autonomous Cyber Defense

Operational evidence is not automatically scientific evidence. The most realistic Security Operations Center SOC data is production telemetry, yet it remains scientifically inaccessible because raw logs cannot be released; as a result, research relies on synthetic or dated datasets. We treat the...

Survey: 94% of Incidents Involve Anonymized Infrastructure. Teams Are Still Reactive

Security teams have never had more IP data at their disposal. Every day, analysts ingest enrichment feeds, geolocation data, reputation scores, telemetry, and threat intelligence from a growing ecosystem of vendors and platforms. Yet despite this abundance of information, many organizations...

The Audit Gap in Blockchain Security: A Four-Year Empirical Study of Public Audit Findings and Real-World Exploit Incidents

This paper presents an empirical analysis of the Web3 security landscape over the four-year and three-month period from 1 January 2022 to 27 March 2026. The dataset combines 23,818 public audit findings produced by 22 independent security firms with 218 real-world exploit incidents documented by...

Improper Handling of Exceptional Conditions

Overview @hulumi/drift is a Local-first drift classifier and live posture validator — distinguishes provider-API churn from console break-glass from genuine IaC drift, then renders read-only live posture findings as JSON, Markdown, and SARIF. Verdict logic mirrors HulumiDrift.tla Ha Affected...

CVE-2026-48134

When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access the UserCheck Ask page could attempt to manipulate the Security Gateway's stored DLP/UserCheck incident information. This could lead to...

CVE-2026-48134

When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access the UserCheck Ask page could attempt to manipulate the Security Gateway's stored DLP/UserCheck incident information. This could lead to...