FLAIR

F-Secure 轻量级事件响应取证采集工具（FLAIR） 本文档描述了 FLAIR 采集脚本的用途和基本操作。 用途 在调查客户环境中的安全事件时，有时客户环境中并未部署 EDR 解决方案，导致 IR 团队无法利用其在整个环境中收集取证工件。FLAIR 正是为了对目标主机上的若干关键工件执行半自动化采集而创建的。 FLAIR 填补了主机完整取证镜像所能提供的深层数据与 EDR 解决方案所提供的更具针对性和交互性的方法之间的空白。 设计 FLAIR 基于以下原则创建： 尽可能仅使用 Microsoft Windows 系统自带的工具，即仅使用操作系统“内置”的程序...

CVE-2026-100552 OpenClaw before 2026.8.1 Policy Bypass via Native Tools

OpenClaw npm package 'openclaw' before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, and patch tools owned by the Codex runtime. When a...

new-native-tools (>=3.1.43-as2-9980-421-1785848450, <=3.1.43) potentially affected by unknown CVE via new-native-tools-linux-x64-gnu (3.1.43)

new-native-tools-linux-x64-gnu NPM version 3.1.43 is affected by a known vulnerability. The following packages have a transitive dependency on new-native-tools-linux-x64-gnu and may be impacted: - new-native-tools =3.1.43-as2-9980-421-1785848450, =3.1.43 Source cves: unknown CVE Source advisory:...

new-native-tools (>=3.1.42-as2-9980-418-1785845663, <=3.1.42-origin-chrom-468-delete-windows-32-bit-changelog-fix-416-1785842977) potentially affected by unknown CVE via new-native-tools-linux-x64-gnu (3.1.42)

new-native-tools-linux-x64-gnu NPM version 3.1.42 is affected by a known vulnerability. The following packages have a transitive dependency on new-native-tools-linux-x64-gnu and may be impacted: - new-native-tools =3.1.42-as2-9980-418-1785845663,...

GHSA-M4PR-4J3G-9V7V vulnerabilities

Vulnerabilities for packages: opa-envoy, sbomqs, delve, portieris, terraform-provider-sendgrid, extism, k8ssandra-operator, clickhouse-operator, neuvector-dbgen, argo-rollouts, nri-haproxy, dex, cluster-proportional-autoscaler, sonobuoy, kpt, nri-mysql, cert-manager-csi-driver, juicefs-csi-driver...

Living off the land with Bluetooth PAN

TL:DR Bluetooth is enabled by default on the majority of Windows laptops Bluetooth PAN can be used to bridge connections locally between a client laptop and attacking device Attackers can use Microsoft native SSH client to forward out internal network traffic Windows native SSH is accessible to...

Takeaways From The Take Command Summit: Navigating Modern SOC Challenges

At our recent Take Command summit, experts delved into the pressing challenges faced by SOC teams. With 2,365 more data breaches in 2023 than in 2022 74% of which were a direct result of cyber attacks, the need for robust security operations has never been greater. Key takeaways from the 25 minut...

Living off the land with native SSH and split tunnelling

TL;DR Attackers can use Microsoft native SSH client to forward out internal network traffic Windows native SSH is common The attack only needs minimal set-up and commands Quicker and more cost effective for an attacker than using C2 infrastructure Reduces likelihood of Blue team detection...

The Fault in Our Kubelets: Analyzing the Security of Publicly Exposed Kubernetes Clusters

While researching cloud-native tools, our Shodan scan revealed over 200,000 publicly exposed Kubernetes clusters and kubelet ports that can be abused by criminals...

Azure network security helps reduce cost and risk according to Forrester TEI study

As organizations move their computing from on-premises to the cloud, they realize that leveraging cloud-native security tools can provide additional cost savings and business benefits to their security infrastructure. Microsoft Azure network security offers a suite of cloud-native security tools ...

Azure network security helps reduce cost and risk according to Forrester TEI study

As organizations move their computing from on-premises to the cloud, they realize that leveraging cloud-native security tools can provide additional cost savings and business benefits to their security infrastructure. Microsoft Azure network security offers a suite of cloud-native security tools ...

How Organizations Can Prevent Users from Using Breached Passwords

There is no question that attackers are going after your sensitive account data. Passwords have long been a target of those looking to compromise your environment. Why would an attacker take the long, complicated way if they have the keys to the front door? No matter how extensive your security...

Fileless Attacks: The Next Frontier for Cybercrime

The world of cybersecurity is rapidly evolving, and so are the methods of cybercriminals. More and more attackers are moving away from traditional malware—in fact, 60% of today’s attacks involve fileless techniques. A fileless attack also known as a “memory-based” or “live-off-the-land” attack is...

HackPorts - Mac OS X Penetration Testing Framework and Tools

HackPorts was developed as a penetration testing framework with accompanying tools and exploits that run natively on Mac platforms. HackPorts is a ‘super-project’ that leverages existing code porting efforts, security professionals can now use hundreds of penetration tools on Mac systems without...

[SECURITY] Fedora 16 Update: pki-core-9.0.25-1.fc16

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D || ABOUT "CERTIFICATE SYSTEM" || =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D Certificate System CS is an enterprise software system...

[SECURITY] Fedora 17 Update: pki-core-9.0.25-1.fc17

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D || ABOUT "CERTIFICATE SYSTEM" || =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =3D=3D=3D=3D=3D=3D=3D=3D=3D Certificate System CS is an enterprise software system...