GNUnet P2P Framework 0.26.2

GNUnet is a peer-to-peer framework with focus on providing security. All peer-to-peer messages in the network are confidential and authenticated. The framework provides a transport abstraction layer and can currently encapsulate the network traffic in UDP IPv4 and IPv6, TCP IPv4 and IPv6, HTTP, o...

IServ Schoolserver User Enumeration

IServ Schoolserver suffers from a user enumeration vulnerability. The vendor does not feel this is an issue...

LifeOS 7.28.3

LifeOS is a Life Operating System. It knows your goals, the people who matter to you, and where you are right now, and it works to move you toward where you want to be. The engine underneath is a verifiable loop: turn any request into testable criteria, then climb until they pass. This is the fir...

RFE Standards

Minimum Viable Standard MVS & Request for Evidence RFE Framework - Decompose bloated, legacy RFCs X.509/ASN.1 and RFC 3986 URIs into usage-driven, empirical standards. Coverage is dictated by observable real-world usage data plus an explicit Criticality Override Registry - not design-by-committee...

WireGuardTCP

WireguardTCP adds an opt-in TCP path beneath the existing WireGuard encryption layer. Handshakes, keepalives, and encrypted data are framed inside a long-lived per-peer stream. UDP remains untouched and remains the default...

Specter 2.2 NFC Reader / Skimmer Bug-Sweep FlipperZero FlipperZero

Specter turns your Flipper Zero into a pocket counter-surveillance bug-sweep for active 13.56 MHz NFC readers - a hidden card skimmer slipped into a payment terminal, a covert reader behind a door panel, a rogue logger taped under a desk. It passively senses the RF carrier that any powered-on...

Rhabdomancer Vulnerability Research Assistant

Rhabdomancer is a blazing fast IDA headless plugin that locates calls to potentially insecure API functions in a binary file. Auditors can backtrace from these candidate points to find pathways allowing access to untrusted input...

HashiCorp Consul Template 0.41.4 Sandbox Path Bypass / Information Disclosure

This repository includes details for a HashiCorp Consul Template version 0.41.4 sandbox path bypass information disclosure vulnerability. HashiCorp Consul Template versions 0.41.4 and earlier contain a time-of-check to time-of-use flaw in the file template helper where symlink validation is...

HashiCorp Consul Template 0.42.0 Path Redirection File Overwrite / Information Disclosure

This repository holds details relating to a HashiCorp Consul Template version 0.42.0 path redirection file overwrite vulnerability. HashiCorp Consul Template versions 0.42.0 and earlier contain a path resolution flaw in the writeToFile template helper where operator-supplied output paths are open...

Joern 4.0.594

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

OSSEC HIDS 4.2.0

OSSEC is a full platform to monitor and control your systems. It mixes together all the aspects of HIDS host-based intrusion detection, log monitoring and SIM/SIEM together in a simple, powerful and open source solution. This is the source code release...

Xalgorix Autonomous AI Pentesting Agent 4.5.124

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

Nikto Web Scanner 2.6.1

Nikto is an Open Source web server scanner which performs comprehensive tests against web servers for multiple items, including over 3500 potentially dangerous files/CGIs, versions on over 900 servers, and version specific problems on over 250 servers...

Joern 4.0.593

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

CWEEP: A Lexical Static Analysis Framework for CWE Early Prevention

As the hardware layer becomes a focus point for attackers, the need for improved hardware security verification techniques is more important than ever. State-of-the-art security verification techniques require significant manual effort from individuals with security expertise. Furthermore, there ...

Mind the Gap: Policy Vs Reality in Post-Quantum TLS Deployment

Post-quantum cryptography PQC has evolved from a long-term planning concern into an operational priority. Following NIST's standardization of PQC, governments and standard bodies published transition roadmaps outlining migration timelines, priority sectors, and deployment strategies. However, our...

Bending the Curve: Operational Cyber Epidemiology for Ransomware

Ransomware is often treated as a detection problem, but the most disruptive incidents behave more like outbreaks. A single foothold can spread through identities, administrative tools, and shared services while responders make time-critical decisions with incomplete visibility. This paper present...

AgenticRepair: Multi-Faceted Program Context Engineering for Agentic Vulnerability Repair

Automated vulnerability repair aims to reduce the time and effort required to patch security flaws from a vulnerability triage report. Recent agentic AI approaches have shown promising results in automated program repair. However, vulnerability repair demands richer program context than general b...

Beyond Resilience: Antifragility in Critical Infrastructure Cybersecurity

Critical infrastructure cybersecurity increasingly requires frameworks that move beyond recovery toward bounded improvement under disruption, yet empirically grounded theories for operational technology remain limited. This paper develops a Theory of Antifragility AFT for critical infrastructure ...

Ruby on Rails Active Storage CVE-2026-66066 Detection Tool

A safe detection tool for identifying Ruby on Rails Active Storage deployments that may be affected by the CVE-2026-66066 vulnerability. The utility performs non-invasive fingerprinting by checking for Rails and Active Storage indicators, exposed endpoints, and version information without...

Rethinking AI Cloud Infrastructure for Agentic Serving Systems with the Aries Experimentation Framework

Autonomous agents challenge conventional LLM serving by coupling repeated inference with persistent context and sandboxed tool execution. We present Aries, a full-stack experimentation framework that separates task semantics from execution configurations, reconstructs cross-component agent...

Adaptive Security at the Edge for 6G-Enabled Healthcare IoT

Healthcare IoT services increasingly rely on edge gateways to relay routine telemetry and deliver rare but timecritical alarms. Even short traffic bursts can inflate worstcase delay and interfere with urgent messages. We present NANOEDGEGUARD, a kernel-plane closed-loop controller that observes...

Temporal Poisoning: Clean-Label Backdoors Via Event Redistribution in SNNs

Backdoor attacks on Spiking Neural Networks SNNs have primarily assumed dirty-label poisoning, in which triggered training samples are relabeled to an attacker-selected class. We study clean-label temporal poisoning, where a fixed timestamp transformation is applied only to the target-class...

Strategy Phasing of Cyber Attacks on Digital Substations

Digital substations that comply with IEC 61850 have improved the operational efficiency of modern power systems. However, adversaries can abuse IEC 61850 communication to manipulate circuit breaker operations in substations, which can result in severe system impacts. These cyber attacks are craft...

Deterministic QKD Source Robust against Side-Channel Attacks

Quantum key distribution QKD is secure in principle, but practical security can be undermined by discrepancies between real devices and the idealized models assumed in security proofs. Source side channels, including those exploited by Trojan-horse attacks, are particularly detrimental: neglectin...

Formalization of Security

Proof assistants are often used to validate that designs and implementations meet their expected security properties. A further motivation for using proof assistants is to support certification. This chapter focuses on their applications to system security, language-based security, secure...

Wazuh 4.14.7

Wazuh is a free and open source security platform that unifies XDR and SIEM capabilities. It protects workloads across on-premises, virtualized, containerized, and cloud-based environments. This is the source code release...

Technology-Enhanced Tabletop Exercises for Cybersecurity Education: Lessons Learned

This innovative practice full paper examines the integration of technology-enhanced tabletop exercises TTXs into computing education, focusing on cybersecurity curricula. The motivation is to better prepare students for complex, collaborative problem solving typical of incident response and IT...

Piggybacking on Perception: Stealthy Concurrent Audio Prompt Injections against Multimodal LLM Agents

Large Language Model LLM-driven multimodal agents are increasingly deployed to execute autonomous tasks via continuous audio interaction. While this paradigm enhances interaction naturalness, it introduces a critical yet under-explored attack surface, as audio inputs inevitably contain...

Implementing Homomorphic Encryption-Based Logic Locking in System-On-Chip Designs

This study presents a logic locking scheme based on the binary Ring Learning With Errors algorithm, implemented in a RISC-V System-on-Chip design. Unlike traditional logic locking methods that require providing users with raw locking parameters, the proposed approach secures critical logic paths ...

CodeQL 2.26.2

Discover vulnerabilities across a codebase with CodeQL, an industry-leading semantic code analysis engine. CodeQL lets you query code as though it were data. Write a query to find all variants of a vulnerability, eradicating it forever. Then share your query to help others do the same...

Statistically Secure Uncloneable Encryption of Arbitrary Messages

Unconditional uncloneable encryption of a single bit with efficient encryption and decryption is now possible. However, whether the extension to messages of arbitrary length achieves statistical security remains to be known. Using the fact that the encoding bases for the single-bit scheme known t...

Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluation

World models give embodied AI a predictive core: they compress observations into states, simulate action-conditioned futures, and enable planning beyond reactive control. This predictive layer, however, opens a new security boundary-compromise can propagate from data, sensors, prompts, or feedbac...

Agent Harness Distillation: Inference-Time Harness Extraction and Exploitation in Autonomous Multi-Agent Systems

Autonomous multi-agent systems AMAS built on large language models LLMs, such as Hermes, increasingly rely on inference-time harnesses to coordinate reasoning and action. Constructing these harnesses requires substantial engineering effort and computational resources, as they are iteratively...

Joern 4.0.592

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

Blockchain Transaction Simulation Phishing

Cryptocurrency users have increasingly become targets of phishing and scam attacks. To mitigate these threats, leading crypto wallets e.g., MetaMask have introduced transaction simulation, which previews a transaction's balance changes before on-chain execution. While effective against traditiona...

CoGate: Confidence-Gated Co-Decoding for Secure Code Generation

Large language models are widely used for code generation, but they can also produce insecure programs due to patterns learned from their pretraining data. Decoding-time steering has become an important solution to this problem: a small expert model is combined with the target model at each step ...

Distributed Point Functions and Function Secret Sharing

A distributed point function DPF is a cryptographic primitive that enables compressed additive sharing of a secret weight-1 vector equivalently, a point function across two or more parties. The appealing lightweight structure of DPF constructions has enabled a wide range of applications. These...

Emerging Challenges in Threat Modeling for GenAI-Augmented Systems: A View from the Trenches

Threat modeling remains a central task in secure software engineering, as it enables the identification of security issues from system architectures. As Generative Artificial Intelligence GenAI becomes increasingly pervasive across software systems, traditional threat modeling methods e.g., STRID...

CHARGE: Leveraging CWE Hierarchies for Hardware Security SystemVerilog Assertion Generation

This paper presents CHARGE, an automated framework for generating security properties for unverified RTL modules using CWEs and large language models LLMs. The hallmark is a reasoning process that leverages the hierarchical nature of CWE entries to improve accuracy when identifying...

A Comparative Analysis of Automated Techniques for Security Bug Report Identification

Timely identification of security-related bug reports is essential to minimize the window of vulnerabilities in software systems. Manually screening incoming bug reports to identify security-related issues is time-consuming, error-prone, and non-scalable for large-scale software systems. Thus, a...

Benign on Label, Malicious by Design: Clean-Label Dormant-To-Activated Backdoor Via Machine Unlearning with Removable Camouflage

Existing backdoor attacks often become effective immediately after backdoor implantation and may therefore be exposed before exploitation. Machine unlearning activated dormant backdoors mitigate such behavioral exposure by remaining inactive after training and becoming effective only after select...

Cybersecurity Detection Classification with Reasoning-Enabled Language Models

A major issue in Security Operations Centers SOCs is alert fatigue, as the number of detections reported is more than staff can triage in a given day. Prior work prompts or fine-tunes large language models LLMs to emit a triage label directly, but does not train them to reason about whether a...

Demystifying DRAM Read Disturbance: Bridging the Gap between Experimental Characterization and Device-Level Modeling of RowHammer and RowPress Phenomena

DRAM read disturbance, like RowHammer and RowPress, is a critical robustness issue where accessing DRAM can cause unintended bitflips in other unaccessed DRAM locations. DRAM read disturbance bitflips significantly impact the safe, secure, and reliable operation of DRAM-based computing systems...

Xalgorix Autonomous AI Pentesting Agent 4.5.114

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

Joern 4.0.591

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

FreeBSD Security Advisory - FreeBSD-SA-26:55.elf

FreeBSD Security Advisory - The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two...

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist. A malicious instruction crafted by an attacker may be stored in long-term memory, recalled much later, and quietly shape a real action. Recent benchmarks increasing...

HoF-Bench: Rediscovering Real AI-Discovered CVEs without Frontier Models

AISLE's analyzer is credited with more than 280 CVEs across 78 projects, including OpenSSL, curl, and GnuTLS. They introduce HoF-Bench named after AISLE's public Hall of Fame, a benchmark built from 95 of these public AI-discovered CVEs across eight repositories pinned at vulnerable commits...

Fingerprint-Driven Automation: Coupling Reconnaissance with POC Verification

In the field of network security confrontation, reconnaissance is the first and most critical step. Accurate, efficient, and comprehensive reconnaissance can help network security workers more fully understand the target's current state, identify potential weaknesses, and formulate a targeted...