419 matches found
sniffglue
sniffglue sniffglue is a network sniffer written in rust. Network packets are parsed concurrently using a thread pool to utilize all cpu cores. Project goals are that you can run sniffglue securely on untrusted networks and that it must not crash when processing packets. The output should be as...
atomic-red-team
Atomic Red Team Atomic Red Team™ 是一个测试库，映射到 MITRE ATT&CK® 框架。安全团队可以使用 Atomic Red Team 快速、可移植、可重复地测试其环境。 开始使用 您可以直接从命令行执行原子测试，无需安装。请参阅我们维基的入门页面。 为了获得更强大的测试体验，请考虑使用执行框架，如 Invoke-Atomic。 了解更多 Atomic Red Team 文档可在维基中获取。 有关 Atomic Red Team 理念和开发的信息，请访问我们的网站：https://atomicredteam.io。 要随时了解 Atomic Red...
security-operations-labs
Security Operations Labs Overview This repository consolidates defensive security work from a university context in a form reworked for public traceability. The focus is on methodology, reproducible labs, validation, and the limitations of the measures developed—not on publishing course material...
The vulnerability of the Python relenv tool for creating reproducible and portable environments is related to insufficient resource control during its existence. This allows a malicious actor to trigger a service failure.
The vulnerability of the Python relenv tool for creating reproducible and portable environments is related to insufficient resource control during its existence. Exploiting this vulnerability could allow a malicious actor to cause service failures...
GHSA-8WR5-JM2H-8R4F vLLM has Remote DoS via Invalid Recovered Token Reinjection
Summary A frontend-legal multi-request speculative workload can make vLLM produce an out-of-vocabulary recovered token equal to vocabsize, convert that value to -1 when choosing the next live token for a request, and then feed that -1 back into the next drafter input ids. On Qwen3 GPTQ this reach...
GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures
New research shows that a signed Git commit's hash is not the one-of-a-kind name that much of the software world assumes it to be. Given any signed commit, someone without the signing key can mint a second commit with the same files, author, and date, and a valid signature, GitHub still stamps...
[SECURITY] Fedora 44 Update: helm-4.2.2-1.fc44
Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. Use Helm to: - Find and use popular software packaged as Helm Charts to run in Kubernetes - Share your own applications as Helm Charts - Create reproducible builds of your Kubernetes applications -...
PT-2026-53227
Name of the Vulnerable Software and Affected Versions WsgiDAV versions prior to 4.3.5 Description The sample MySQLBrowserProvider in wsgidav/samples/mysql dav provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. This occurs within the exists record by...
-Web-Attack-Detection-Lab
!Kali Linuxhttps://img.shields.io/badge/KaliLinux-557C94?sty...
Web-Attack-Detection-Lab
!Kali Linuxhttps://img.shields.io/badge/KaliLinux-557C94?sty...
Exploit for Use After Free in Linux Linux_Kernel
CVE-2026-23111 nftables LPE: exposure check and safe lab Def...
exploit-labs
exploit-labs Companion code for the Windows-security blog at...
Quality-Diversity Evolution for Discovering Diverse Vulnerabilities in LLM Safety
Current approaches to LLM adversarial testing suffer from coverage gaps: manual red-teaming does not scale, LLM-as-attacker methods exhibit mode collapse, and gradient-based approaches produce uninterpretable gibberish. We introduce a quality-diversity evolutionary framework that operates at the...
How to Compare the Security of Code Written by Humans to LLM-Generated Code
Large language models LLMs are rapidly transforming how software is created and maintained. Comparing LLM-generated code against human-written standards is essential to determine whether these new tools uphold or erode the security baselines established by professional developers. Yet, we lack a...
The Fault in Our Drafts: Vulnerabilities in RPKI Specification and Software
The Resource Public Key Infrastructure RPKI secures the Internet's routing system by defining a complex trust and validation framework for certificates, Route Origin Authorizations ROAs, manifests, and Certificate Revocation Lists CRLs. These mechanisms are specified across dozens of RFCs. This...
Unlocking Apple's Private Cloud Compute: An Analysis of Privacy-Preserving Artificial Intelligence
Many existing Artificial Intelligence AI solutions on mobile devices rely on an extensive collection of sensitive data, raising privacy concerns and often requiring storage for both context and model improvement. Apple's Private Cloud Compute PCC aims to address this by emphasizing mobile device...
FuzzingBrain V2: A Multi-Agent LLM System for Automated Vulnerability Discovery and Reproduction
Software vulnerabilities pose critical security threats, with nearly 50,000 CVEs reported in 2025. While Large Language Models LLMs show promise for automated vulnerability detection, three key challenges remain. First, LLM-generated vulnerability reports suffer from high false positive rates and...
LITMUS: Benchmarking Behavioral Jailbreaks of LLM Agents in Real OS Environments
The rapid proliferation of LLM-based autonomous agents in real operating system environments introduces a new category of safety risk beyond content safety: behavior jailbreak, where an adversary induces an agent to execute dangerous OS-level operations with irreversible consequences. Existing...
Beyond Collection: Measuring the Detection Efficacy of Modern Security Logging Standards
Effective security logging is crucial for the timely and accurate detection of cyber threats; however, the relative effectiveness of various industry-standard logging frameworks remains understudied. This paper addresses this critical gap by presenting the first systematic evaluation of modern...