Security of Quantum Conference Key Agreement with Two-Way Classical Communication

Quantum conference key agreement QCKA enables multiple users to establish a common secret key with information-theoretic security and is regarded as a key primitive for secure communication in future quantum networks. However, practical implementations of QCKA typically suffer from higher noise...

Mean Time to Remediate Is Not a Fielding Model: A Cadence Audit for Enterprise Vulnerability Management

Enterprise security teams commonly summarize remediation through mean time to remediate MTTR, SLA compliance, dwell time, or detection delay. These metrics are useful, but they can hide how fixes actually reach the estate: continuously, through scheduled maintenance windows, in deployment rings, ...

Piercing Gilbreath'S Conjecture: From Deep Number Theory Insights to Fintech and Cybersecurity

I propose a new methodology to attack the fascinating Gilbreath's conjecture about prime numbers, first posted in 1878 and unsolved to this day. The problem statement is rudimentary: kids can understand it. However, despite decades of research, almost no progress has been made. This paper changes...

Let My Data Go: Data Brokers' Compliance with Opt-Out and Deletion Requests

Data brokers are a largely American phenomenon. They collect vast amounts of personal information about most adult U.S. consumers, mainly without the latter's knowledge or consent. Accumulated data can be sold to anyone, including employers, landlords, insurance agencies, banks, governments local...

Securing Deep Learning Hardware: A Survey of Side-Channel Vulnerabilities and Countermeasures

As deep learning models are increasingly deployed in critical sectors such as healthcare, finance, and security, ensuring their protection against emerging threats has become crucial. Among these threats, side-channel attacks SCAs represent a particular challenge since they can extract sensitive...

Conductance-Repair Evidence Graphs for Prospective Security Retrieval

Security retrieval is often evaluated as ranking over complete evidence, but operational triage is prospective: CVE descriptions, weakness metadata, fix commits, EPSS scores, KEV membership, validation-vector metadata, and side-channel benchmark routes arrive through separate channels, and many a...

Advanced Topic Modeling Techniques for Categorizing Software Vulnerabilities

The increasing complexity and frequency of software vulnerabilities demand efficient methods to analyze and prioritize threats. Traditional approaches often fail to process the vast amount of unstructured textual data effectively, highlighting the need for advanced solutions. This study leverages...

LLM-Enhanced Hierarchical Heterogeneous Graph Representation Learning for Malicious Python Package Detection

Malicious Python packages have become a major threat to software supply chain ecosystems due to the widespread adoption of open-source repositories such as PyPI. Existing learning-based detection methods struggle to capture the hierarchical organization and heterogeneous interactions among...

Whistleblowersoftware.com Confidentiality Fail

The anonymous reporting flow on whistleblowersoftware.com encrypts report text end-to-end in the browser but does not extend the same guarantee to attachments and exposes the reporter's network identity and timing to a US-based third party. Together these weaken the confidentiality and anonymity...

Overloading Large Vision-Language Models for Jailbreaking

Large Vision-Language Models LVLMs exhibit remarkable vision-language capabilities and are increasingly deployed in real-world applications such as personal assistants, document analysis systems, and embodied agents. However, their dual-modal attack surfaces make them vulnerable to jailbreak...

Agentic-SecPBFT: Agentic AI-Driven Proactive Security Framework for Wireless PBFT Consensus in Mobile Ad-Hoc Networks

The standard Practical Byzantine Fault Tolerance PBFT protocol, designed for stable, wired environments, exhibits critical vulnerabilities when deployed in settings like mobile ad-hoc networks, thus making it susceptible to sophisticated threats such as Sybil attacks, Byzantine collusion, and...

Integer Arithmetic Utilities for Image Buffer Sizing and Offset Validation

This C program demonstrates defensive programming techniques for preventing integer overflows during image-processing calculations by implementing reusable safe arithmetic helpers for addition, multiplication, buffer sizing, and offset validation...

OpenBlow Deanonymization Issues

A production deployment of OpenBlow was observed HTTP archive of a full, real whistleblower submission to route its anonymous reporting flow through Google. The intake CAPTCHA is Google reCAPTCHA, enforced as a mandatory, server-validated gate on report submission, and the UI additionally pulls a...

Nebula AI-Powered Penetration Testing 2.0.0b31

Nebula is an advanced, AI-powered penetration testing open-source tool that revolutionizes penetration testing by integrating state-of-the-art AI models into your command-line interface. Designed for cybersecurity professionals, ethical hackers, and developers, Nebula automates vulnerability...

Certified Asterisk 20.7-cert11 Security Release

The Asterisk Development Team would like to announce security release Certified Asterisk 20.7-cert11. It addresses 18 security issues...

Builder, Defender, Breaker: The Case against Removing the Human from the AI-Driven Security Lifecycle

Artificial intelligence has spread across the whole of the security lifecycle. The same family of models now writes application code, hardens it, and probes it for weaknesses, so that a single generative substrate increasingly performs all three roles at once. Enthusiasm for this convergence tend...

ThreatVisionAI: A Hybrid CNN-ViT Framework for Image-Based Malware Classification

Traditional malware detection methods struggle to generalize to obfuscated or previously unseen threats. This paper introduces ThreatVisionAI, a hybrid malware family classification framework that integrates a raw-image CNN, a wavelet-based CNN, and a Vision Transformer ViT to capture complementa...

IPv6 WebSocket Test Server

This script is a minimal, Python WebSocket server that listens on all IPv6 addresses dual-stack enabled on port 8765. It performs the WebSocket handshake, sends a test text message, and responds to connections in separate threads...

Asterisk 20.20.1 Security Release

The Asterisk Development Team would like to announce security release Asterisk 20.20.1. It addresses 19 security issues...

LifeOS 6.0.0

LifeOS is a Life Operating System. It knows your goals, the people who matter to you, and where you are right now, and it works to move you toward where you want to be. The engine underneath is a verifiable loop: turn any request into testable criteria, then climb until they pass. This is the fir...

Apple Security Advisory 06-29-2026-1

Apple Security Advisory 06-29-2026-1 - iOS 26.5.2 and iPadOS 26.5.2 addresses double free, out of bounds access, out of bounds write, and use-after-free vulnerabilities...

InnoShop 0.8.2 File Manager Scanner

This Python script is a scanner designed to identify potential exposure of an InnoShop installation and verify access to the File Manager API...

Asterisk 22.10.1 Security Release

The Asterisk Development Team would like to announce security release Asterisk 22.10.1. It addresses 20 security issues...

FBI FLASH: Cyber Criminal Group TeamPCP

The Federal Bureau of Investigation FBI is releasing this FLASH to highlight the tactics, techniques, and procedures TTPs and indicators of compromise IOCs associated with the cyber criminal group TeamPCP. TeamPCP actors have conducted large-scale software supply chain compromises by targeting...

CONTRA: Red-Teaming Configurations of Personalizable Agents

Recent tools such as OpenClaw have extended the capabilities of LLM-based agents from simple dialog-based systems to fully autonomous agents. These systems allow personalization of the agent through modifiable internal files and the installation of skills. While this enables deployment in a wide...

Asterisk 23.4.1 Security Release

The Asterisk Development Team would like to announce security release Asterisk 23.4.1. It addresses 20 security issues...

HotelDruid 3.0.x Custom Hash Verification

Python script for cracking a custom MD5 hashing scheme used in HotelDruid version 3.0.x...

Enhanced Feature Extraction for IoT Network Intrusion Detection Using GNNs and KAN

Recent advancements in the Internet of Things IoT emphasize the urgent need for advanced network security, as IoT networks feature dynamic topologies, imbalanced traffic, and complex attack patterns. Unlike general IT networks, IoT environments exhibit extreme heterogeneity and sparse topologies...

pwnlift Symlink File Write

Symlink following and TOCTOU issues in the pwnlift upload handler allow arbitrary file write as root...

Apple Security Advisory 06-29-2026-3

Apple Security Advisory 06-29-2026-3 - Safari 26.5.2 addresses out of bounds access, out of bounds write, and use-after-free vulnerabilities...

A Measurement Study on the Adoption of Pledges and Unveils in the OpenBSD Operating System

The paper presents a longitudinal measurement study on the adoption of the pledge and unveil system calls in OpenBSD. These system calls are used to sandbox programs and libraries. Given a dataset covering 19 releases, many programs and libraries were modified to use the system calls already befo...

Gardyn IoT Log Disclosure

The Azure Blob Storage container used for Gardyn device logs is publicly listable without authentication. A malicious user can enumerate and read any device log file in the container. Logs were available from approximately May 2020 through disclosure 5+ years...

Asterisk 21.12.3 Security Release

The Asterisk Development Team would like to announce security release Asterisk 21.12.3. It addresses 20 security issues...

IPv4/IPv6 Connectivity Validator

This Python script is a network validation utility built with Scapy that performs basic reachability testing for both IPv4 and IPv6 targets using ICMP echo requests...

Gardyn IoT Hub Key Disclosure

Gardyn exposes a privileged iothubowner shared-access key. Access to this key allows a malicious user to invoke an Azure IoT Hub Registry Manager function that returns connection information for all Gardyn Home Kit and Studio devices. The same key allows execution of arbitrary commands on a...

Gardyn IoT Hub Missing Security Headers

Gardyn IoT Hub is missing security headers that help mitigate clickjacking and cross site scripting...

IPv6 Extension Header Testing and Network Stress Utility Using Scapy

This Python script combines network validation, protocol behavior testing, and packet-generation capabilities focused on IPv4 and IPv6 traffic analysis using Scapy...

Agentic and Generative AI for Open-Source Intelligence and Cyber Investigations: Taxonomy, Evaluation, Challenges, and Future Directions

The rapid growth of publicly available digital information has rendered manual open-source intelligence OSINT analysis insufficient for modern intelligence, cybersecurity, and cyber investigation. Large language models LLMs and agentic AI systems, capable of tool use, multi-step reasoning, and...

Joern 4.0.573

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

Certified Asterisk 22.8-cert3 Security Release

The Asterisk Development Team would like to announce security release Certified Asterisk 22.8-cert3. It addresses 20 security issues...

Apache .htaccess Persistence

This Metasploit module writes a persistence payload into an Apache .htaccess file using modcgi. The .htaccess file itself acts as a CGI shell, executing commands passed via the query string. Inspired by the htshells project by wireghoul...

Apple Security Advisory 06-29-2026-2

Apple Security Advisory 06-29-2026-2 - macOS Tahoe 26.5.2 addresses double free, out of bounds access, out of bounds write, and use-after-free vulnerabilities...

Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware

LLM coding agents increasingly rely on third-party agent skills from public marketplaces, which execute with the agent's privileges and create a software supply-chain attack surface: a malicious skill can steal credentials, exfiltrate source code, or install backdoors. Existing defenses use stati...

Knowledge over Parameters: Evolving Smart Contract Vulnerability Detection

Smart contract vulnerabilities are predominantly logic bugs whose detection requires structured, step-by-step procedural knowledge of attack patterns and contract semantics. Existing LLM-based methods struggle to generate this knowledge automatically: prompt-based methods rely on manually crafted...

Hacking Measurement-Device-Independent Quantum Key Distribution

The security of practical quantum key distribution QKD systems is fundamentally constrained by vulnerabilities of single-photon detectors. Measurement-device-independent quantum key distribution MDI-QKD was proposed to remove this limitation by allowing all measurements to be performed by a...

GNU Privacy Guard 2.5.21

GnuPG the GNU Privacy Guard or GPG is GNU's tool for secure communication and data storage. It can be used to encrypt data and to create digital signatures. It includes an advanced key management facility and is compliant with the proposed OpenPGP Internet standard as described in RFC2440. As suc...

Understanding Build Reproducibility in the F-Droid Ecosystem

The security of open source applications benefits considerably from the possibility of rebuilding their source and verifying the output. F-Droid, a prominent distribution for open source Android applications, systematically rebuilds them from source and tests their bitwise reproducibility at app...

Overview of Risk Assessment and Management for Intelligent Systems under the AI Act and Beyond

The society and emerging risk-based regulatory frameworks for AI underscore the need for rigorous risk assessment to ensure safe and reliable AI systems. In response to this imperative, this paper presents an overview of AI risk assessment identification and analysis and management methodologies...

Beyond Gradient-Based Attacks: Adversarial Robustness and Explainability Stability in Cybersecurity Classifiers

Adversarial attacks on cybersecurity classifiers pose a dual threat: degrading predictions and destabilising the SHAP-based explanations that security analysts rely on to understand and triage alerts. We extend our prior MLP conference study to Random Forest and XGBoost across four tabular securi...

Trust Boundary Semantic Gaps: A Multi-Dimensional Analysis and Mitigation for Security-By-Design

Modern systems use format-, protocol-, and signature-based mechanisms before accepting artifacts across trust boundaries. These mechanisms are necessary: they show that an artifact is well formed, protocol-compliant, or properly authenticated. They do not, however, show that the artifact satisfie...