SigDigger

SigDigger - フリーのデジタル信号アナライザ SigDigger は GNU/Linux および macOS 向けのフリーのデジタル信号アナライザで、未知の無線信号から情報を抽出するために設計されています。SoapySDR を通じてさまざまな SDR デバイスをサポートし、FSK、PSK、ASK 信号の調整可能な復調、アナログビデオのデコード、バースト信号の解析、アナログ音声チャンネルの聴取（すべてリアルタイム）を可能にします。 既存ユーザー向けの注意事項 もう develop...

loupe

Loupe Loupeは、デバイスフィンガープリントの表面を実践的に探索できるiOS／iPadOSアプリです。公開されたiOS API（サードパーティ製アプリなら誰でも呼び出せるものと同じAPI）から実際の値を読み取り、そのまま表示します。目的は単純です。自分のiPhoneが静かに何をさらしているのか、そしてそれぞれの読み取り値がなぜアプリによる再認識に役立つのかを確認することです。...

wigle-wifi-wardriving

WiGLE 무선 워드라이빙 Android용 네트워크 스텀블링 클라이언트, wigle.net에서 제공. 이 클라이언트는 Android 기기를 사용하여 WiFi, Bluetooth 및 셀룰러 신호의 위치 기반 탐지 및 로깅을 제공합니다. 2023년 1월 기준으로 이 애플리케이션은 Android SDK 버전 24누가 이상을 지원합니다. 이전 버전의 경우 2.67 릴리스 태그를 참조하여 직접 빌드하거나 컴파일된 아티팩트를 사이드로드하세요. 참고 로 이전 릴리스는 WiGLE.net API 호출에 대한 인증서 투명성 검사에 실패합니다. ...

trustlock

trustlock Git 네이티브 의존성 승인 컨트롤러입니다. 모든 의존성 변경 시 신뢰 신호를 평가합니다. 작동 방식 trustlock은 Git pre-commit 훅권고 모드과 CI 검사강제 모드로 실행됩니다: 권고 pre-commit: 위반 시 경고, 종료 코드 0, 모든 패키지가 승인되면 신뢰 기준선을 업데이트합니다. 강제 --enforce: 위반 시 차단, 종료 코드 1, 기준선을 업데이트하지 않습니다. 패키지별 평가 신뢰 신호: 쿨다운Cooldown — 레지스트리에 게시된 이후 경과 시간 출처Provenance —...

ai-email-threat-research

위협 터미널 AI 생성 피싱 이메일을 인간이 얼마나 잘 탐지하는지 측정하는 사이버 보안 연구 게임입니다. 레트로 터미널 경험으로 제작되었습니다. 라이브: research.scottaltiparmak.com 문제 이제 AI는 완벽한 문법, 틀림없는 철자, 설득력 있는 맥락을 갖춘 피싱 이메일을 생성할 수 있습니다. 과거의 신호깨진 영어, 어색한 표현, 명백한 오타는 더 이상 유효하지 않습니다. 그렇다면 2026년에 인간은 어떻게 피싱을 탐지할까요? 이것이 무엇인가 위협 터미널은 게임이자 실시간 연구 플랫폼입니다. 플레이어는 레트...

fingerprint-pro-internals

Fingerprint Pro v4, deobfuscated and documented 143 signals named. The bundle unpacked. The wire format decoded. Run it on your browser · Read the docs · Signal map · Collector sources...

Astra Linux – Vulnerability in glib2.0

A issue was discovered in GNOME GLib before version 2.78.5, and also in versions 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus...

Astra Linux – Vulnerability in PostgresSQL 11

A vulnerability was discovered in PostgreSQL 12.2, allowing attackers to cause a denial of service by repeatedly sending SIGHUP signals. NOTE: This claim is disputed by the vendor, as untrusted users are unable to send SIGHUP signals; such signals can only be sent by a PostgreSQL superuser, a use...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: signal: restored the overriderlimit logic Before committing the change d64696905554 “Reimplemented RLIMITSIGPENDING based on ucounts”, the R LIMIT for UCOUNTRLIMITSIGPENDING was not enforced for a certain class of signals. Howeve...

EUVD-2026-46178

A flaw was found in libssh. When ProxyCommand is used, an unchecked fork failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service...

CVE-2026-59845

CVE-2026-59845 describes a vulnerability in the libssh library where, when using the ProxyCommand feature, an unchecked fork() failure can be stored as PID -1. During cleanup, signals may be sent across the caller’s process tree, enabling local denial of service. The Red Hat advisory confirms thi...

PT-2026-61859

Name of the Vulnerable Software and Affected Versions libssh affected versions not specified Description A flaw exists in libssh when using the ProxyCommand feature. An unchecked failure in the fork function can result in a process ID of -1 being stored. During the cleanup process, signals may be...

MAL-2026-10690 Malicious code in qwen-asr-pvt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68e8b2f6db0443a648cdf03348c8dd9351568469f84b8d61022f1ed1da2a330e The package's pyproject.toml declares an unpinned runtime dependency on transformers4576, a lookalike of the widely used HuggingFace transformers...

patchtriage

PatchTriage !CIhttps://github.com/d01ki/patchtriage/actio...

Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents

Security firm AIR built a fake AI agent skill, pushed it through a popular skill marketplace and an Instagram ad, and says it reached roughly 26,000 agents, including some on corporate accounts. Every skill security scanner the firm tested it against marked it safe. The payload was harmless by...

Scammers Use Fake GitHub Stars, VirusTotal Reviews to Spread Crypto Clipper

A multi-platform malware campaign abuses fake trust signals to infect Windows and Mac users with a crypto clipper packed with 15,500 attacker wallets...

Malicious code in @mastra/github-signals (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e263abbd9ed9975f3f8aaecfd1a780616bc3aef00238ed9ba9075b5bf4e38f37 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in backoffice-charges-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 047eb92a0e8bb401b2c205765616c9b4b715ee7cfd33d2e6ef9dc8d645b77f04 On every npm install, the preinstall lifecycle script node index.js /dev/null 2&1 silently HTTPS-POSTs a JSON payload to https://avamnrwqo7.rbmock.de...

MAL-2026-5612 Malicious code in gpt-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b9bdc5e04979d5b4f73407bcedaecc9df24dbb03e0bfbc0edefe333023dc50c On npm install, postinstall.js runs unconditionally and collects a wide range of installer-side reconnaissance data: hostname and FQDN, contents of...

Reconstructing AI activity in investigations

AI systems are now part of everyday work. Investigators need a consistent way to reconstruct what happened within them. Security teams are already investigating activity involving Microsoft 365 Copilot and Azure AI services—from prompt injection attempts to unexpected data access. Those signals a...