2595 matches found
semgrep-rules
semgrep-rules "The attack surface is the vulnerability. Finding a bug there is just a detail." -- Mark Dowd "Some details are more important than others." -- Fedor G. Pikus A collection of my Semgrep rules to facilitate vulnerability research. Blog posts...
reconkg
reconkg A vulnerability triage tool. It takes what a scan already found, works out which CVEs plausibly apply, tells you how confident it is and why, and gives you the commands to check for yourself. It does not scan anything, and it does not exploit anything. Install on Kali git clone...
MI5 Says China’s MSS Funded Research Involving 100+ U.K.-Linked Academics
The U.K.'s domestic intelligence and security agency has warned that more than 100 academics have helped China boost its intelligence gathering efforts on behalf of Beijing's state security service. In a "Security Service Espionage Alert" issued on September 30, 2026, MI5 said the "primary purpos...
US and China Discuss Alerting Each Other to AI National Security Threats
Officials discussed setting up a mechanism for the two countries to notify each other of AI incidents which could threaten national security...
Malicious Package
Overview leadconduit-national-renewable-energy-lab is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...
CVE-2026-91752
creationtimestamp| type| source ---|---|--- 2026-09-15 16:45:02+00:00| seen| https://www.acn.gov.it/portale/w/vulnerabilita-in-prodotti-gnu 2026-09-15 20:05:57+00:00| seen| https://bsky.app/profile/cyfar.ca/post/3mvlge4g6lp2i 2026-09-15 20:15:03+00:00| seen|...
Construction and Natural Language Querying of a Cybersecurity Knowledge Graph
Cybersecurity vulnerability information is distributed across numerous platforms and databases, making it difficult for researchers and practitioners to obtain a unified and structured understanding of existing threats. This is a critical issue in cybersecurity, where timely access to accurate...
CVE-2026-20355
creationtimestamp| type| source ---|---|--- 2026-09-03 08:45:03+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=2046 2026-09-03 08:46:09+00:00| seen| https://www.kyberturvallisuuskeskus.fi/fi/haavoittuvuudet/haavoittuvuus-2026-24 2026-09-03 10:44:22+00:00| seen|...
Extradited Russian Hacker Faces Charges Over Excel Malware Campaign That Infected Thousands
The U.S. Department of Justice DoJ has charged a Russian national, extradited from Cyprus on August 28, with using roughly 255 fake accounts on a freelance platform to send malware-laced Excel attachments to about 80,000 of its users in 2016 and 2017. Searzhudin Tamirlanovich Aktulaev , 40, was...
CVE-2026-73337
creationtimestamp| type| source ---|---|--- 2026-08-19 12:45:05+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-per-joomla-1 2026-08-19 13:35:31+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mtgtx3ssvp26...
OSEC-2026-15 EC public key out of bounds read
The internal Point.ofoctets function is missing a length check for compressed points, and thus is raising an exception when a short buffer is provided. This affects all NIST curves P-256, P-384, P-521 and both Dsa.pubofoctets and Dh.keyexchange functions. Fix The fix is to check the length of the...
Ransom Cartel Creator Gets 16 Years in Prison for Operating Ransomware-as-a-Service
A federal judge in Alexandria, Virginia, sentenced Maksim Silnikau to 16 years in prison on August 5 for creating and running Ransom Cartel , the ransomware-as-a-service operation he stood up in 2021. Between 2021 and 2023, Ransom Cartel conspirators attacked at least 18 companies, including firm...
CVE-2026-18485 Local Privilege Escalation in NI-PAL
There is a local privilege escalation vulnerability recently discovered in the NI-PAL kernel driver. This may allow a local, authenticated user to escalate privileges and execute arbitrary code. This vulnerability affects NI-PAL 26.3.1 and prior versions running on Microsoft Windows...
EUVD-2026-53579
There is a local privilege escalation vulnerability recently discovered in the NI-PAL kernel driver. This may allow a local, authenticated user to escalate privileges and execute arbitrary code. This vulnerability affects NI-PAL 26.3.1 and prior versions running on Microsoft Windows...
CVE-2026-18485 Local Privilege Escalation in NI-PAL
There is a local privilege escalation vulnerability recently discovered in the NI-PAL kernel driver. This may allow a local, authenticated user to escalate privileges and execute arbitrary code. This vulnerability affects NI-PAL 26.3.1 and prior versions running on Microsoft Windows...
EUVD-2026-52511
Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TOLAB add/remove subscription commands...
PT-2026-67539
Name of the Vulnerable Software and Affected Versions NASA cFS version 7.0.1 Description A parser boundary flaw exists in the Software Bus Network SBN application's peer subscription message handling. This issue allows an attacker to trigger a Denial of Service DoS by sending a specially crafted...
CVE-2026-67969
An issue in the HSMonitorApplications component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMonTbl entry...
You were onto something with “It’s the Climb,” Miley
Welcome to this week's edition of the Threat Source newsletter. For my fiancee's 30th birthday, I took her on a weekend trip to Shenandoah National Park - a favorite of ours since we went to a wedding there several years back. We've done several incredible hikes over the years, but one in...
