Quantifying and Prioritizing Stealthy Source-Manipulation Threats against Multi-Source Anomaly Detectors

Security pipelines often fuse several data sources and protect a downstream model with a cross-source anomaly detector. Such detectors are usually judged by their clean false-positive rate and by how well they catch random corruption. Neither metric captures an adversary who controls some sources...

NXP MCUXpresso SDK USB Middleware Before 2.13.0 Heap Buffer Overflow

NXP MCUXpresso SDK USB middleware versions before 2.13.0 contain a heap buffer overflow in host audio, video, and CDC class drivers that trust device-supplied descriptor values...

MalGuard GTA Guard Malware Scanner 1.3.2 Source Code

MalGuard GTA Guard is a defensive static malware analysis tool designed to inspect Grand Theft Auto V modifications, Windows executables, DLLs, scripts, and compressed archives without executing the scanned content. It provides PE and .NET inspection, YARA-X signature matching, script and string...

PHP Session Serialization Desynchronization Remote Code Execution

PHP web applications that dynamically switch session serialization handlers between phpserialize and php may be susceptible to session desynchronization and injection attacks. An unauthenticated attacker can abuse the PHPSESSIONUPLOADPROGRESS mechanism to inject specially crafted session data tha...

Zeek 8.0.11

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Zeek ha...

Next.js 15.2.2 Middleware Bypass Mitigation

Next.js versions in affected advisory ranges contain a middleware bypass vulnerability. This Ansible role and Python tool identify installed Next.js versions and can configure nginx to remove the x-middleware-subrequest header as a temporary mitigation...

Hikvision IP Camera Firmware V5.4.5 Improper Authentication

Hikvision IP camera firmware versions through V5.4.5 contain an improper authentication vulnerability that allows unauthenticated attackers to bypass normal access controls and obtain administrative device access...

Zeek 9.0.1

Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Zeek ha...

Nebula AI-Powered Penetration Testing 3.0.36

Nebula is an advanced, AI-powered penetration testing open-source tool that revolutionizes penetration testing by integrating state-of-the-art AI models into your command-line interface. Designed for cybersecurity professionals, ethical hackers, and developers, Nebula automates vulnerability...

Cisco Expressway Series X15.5.3 Remote Code Execution

Cisco Expressway Series versions X15.5.3 and earlier configured in a cluster contain a remote code execution vulnerability due to persistent cookies and insufficient client certificate validation. The supplied offline tool assesses saved inventory and CLI evidence...

Nmap Port Scanner 7.993

Nmap is a utility for port scanning large networks, although it works fine for single hosts. Sometimes you need speed, other times you may need stealth. In some cases, bypassing firewalls may be required. Not to mention the fact that you may want to scan different protocols UDP, TCP, ICMP, etc...

OpenSSH 9.7p1 regreSSHion Mitigation

An Ansible role and Python tool detect OpenSSH versions affected by the regreSSHion signal-handler race and upgrade openssh-server or apply the documented LoginGraceTime 0 workaround...

polkit pkexec Privilege Escalation Mitigation

polkit pkexec versions prior to vendor fixes contain a local privilege escalation vulnerability. This Ansible role upgrades polkit where possible and otherwise removes the pkexec setuid bit...

NXP MCUXpresso SDK USB Middleware Before 2.13.0 RNDIS Out-of-Bounds Read

NXP MCUXpresso SDK USB middleware versions before 2.13.0 contain an out-of-bounds read in USBDeviceCdcRndisSetCommand that can disclose device memory through crafted RNDIS SET messages...

XZ Utils 5.6.1 Backdoor Detection / Mitigation

An Ansible role and Python tool detect backdoored XZ Utils versions and liblzma libraries associated with CVE-2024-3094, back up affected files, upgrade supported distribution packages, and optionally restart sshd...

When POST Becomes GET: Investigating HTTP Method Interchangeability and Its Security Implications

HTTP method semantics are a common boundary between safe retrieval and state-changing operations; however, deployed web applications do not always enforce this boundary consistently. In this paper, we study HTTP method interchangeability, a behavior where a POST request can be rewritten as a GET...

GKS Fully Homomorphic Encryption: Security Analysis

All traditional encryption schemes share a fundamental operational vulnerability: encrypted data must be decrypted before it can be used. Fully homomorphic encryption eliminates this vulnerability by enabling computation directly on encrypted data, but existing FHE schemes impose substantial...

Security Analysis of Ekert-Type QKD Protocol Coming under Cloning Attacks

We analyze the security of an Ekert type bipartite key distribution protocol coming under cloning attacks by an untrusted observer. Precisely, an eavesdropper is assumed to intercept and apply an asymmetric, phase-variant cloner on one or both qubits which are transmitted over public channel from...

Watermark Basins: Black-Box Detection of Distilled LLMs

Proprietary language models and their reasoning traces are vulnerable to API-based distillation, where an adversary trains a student model on the teacher model's outputs. To obtain evidence of distillation, model providers can watermark the teacher's outputs, aiming to leave a radioactive signal ...

Uncovering Why LLMs Fail: From Internal Mechanisms to Adversarial Reasoning Trajectories

Large language models LLMs are usually evaluated by final-output correctness or safety, yet an endpoint label does not reveal how a failure develops throughout the reasoning process. We therefore ask whether ordinary reasoning failures and adversarially induced failures can be characterized using...

Silent Blindness: Fault Vulnerability of Hardware Malware Detectors

Hardware malware detectors HMDs classify hardware performance-counter measurements to identify malicious execution. Faults in their decision logic or parameters can weaken detection and allow malware to be classified as benign. We investigate this vulnerability through structural fault injection...

SecDMP: Provably Secure Data Memory-Dependent Prefetching (Extended Version)

Data memory-dependent prefetchers DMPs are a microarchitectural optimization recently introduced in mainstream desktop and server CPUs. Although DMPs offer performance improvements, they have been shown to enable side-channel leakage of secrets, even from constant-time code that has been hardened...

RePAIR: Inverting Backdoor Attacks in Semantic Segmentation

Despite significant advances in computer vision, semantic segmentation models remain vulnerable to backdoor attacks, posing a security risk. These attacks redirect pixels of a chosen victim class to an attacker-specified target class when a trigger is present, while preserving clean predictions...

Oracle E-Business Suite 12.2.15 SQL Injection

Oracle E-Business Suite versions 12.2.3 through 12.2.15 contain an unauthenticated Thin Client Framework SQL injection issue that can lead to remote code execution. The supplied Nuclei template checks the affected AppsTCFServer handshake and proxy creation response...

Google Brotli 1.2.0 Out-Of-Bounds Write Detection / Mitigation

Google Brotli versions 1.0.3 through 1.2.0 contain an out-of-bounds write vulnerability. This Ansible role detects affected packages, Node.js binaries, and running containers, and can back up and upgrade host packages where fixes are available...

Apple Security Advisory 10-26-2026-8

Apple Security Advisory 10-26-2026-8 - watchOS 27.2 addresses out of bounds access, out of bounds read, out of bounds write, use-after-free, memory corruption, buffer overflow, integer overflow, and information disclosure vulnerabilities...

NVDA Remote 2.6.4 / Tele NVDA Remote 2025.3.3 Weak Password Authentication

NVDA Remote version 2.6.4 and Tele NVDA Remote version 2025.3.3 accept weak connection passwords without additional authentication or computer verification, allowing remote system access when an attacker guesses the password...

Apple Security Advisory 10-26-2026-4

Apple Security Advisory 10-26-2026-4 - macOS Golden Gate 27.2 addresses out of bounds access, out of bounds read, out of bounds write, use-after-free, memory corruption, buffer overflow, integer overflow, arbitrary code execution, and information disclosure vulnerabilities...

Detecting and Mitigating Query-Based System Prompt Leakage Attacks

Large Language Models LLMs rely on proprietary system prompts to enforce task directives, safety policies, and access controls. These prompts are vulnerable to query-based leakage attacks, where black-box adversaries extract confidential instructions through adaptive, multi-turn interactions...

Apple Security Advisory 10-26-2026-2

Apple Security Advisory 10-26-2026-2 - iOS 26.7.2 and iPadOS 26.7.2 addresses out of bounds access, out of bounds read, out of bounds write, use-after-free, memory corruption, buffer overflow, integer overflow, and information disclosure vulnerabilities...

Apple Security Advisory 10-26-2026-7

Apple Security Advisory 10-26-2026-7 - tvOS 27.2 addresses out of bounds access, out of bounds read, out of bounds write, use-after-free, buffer overflow, integer overflow, and information disclosure vulnerabilities...

Bringing Hardware Security Education to All: A Seamless Curriculum Integration Approach

Cybersecurity education has predominantly focused on software and network security, under the assumption that the underlying hardware is trustworthy. Threats introduced through the global semiconductor supply chain, together with vulnerabilities arising during design and integration, challenge th...

They Will See Johnny's Message: A Measurement Study of Post-Quantum Cryptography across Email Delivery Paths

Harvest-now, decrypt-later HNDL attacks make the transition to post-quantum cryptography PQC urgent for email. This paper presents a systematic measurement that jointly examines PQC deployment across email service stages, negotiation by communicating peers, and usable message encryption...

Qualcomm Snapdragon Primary Bootloader Memory Corruption

Qualcomm Snapdragon Primary Bootloader contains a write-what-where condition while processing a crafted ELF file. This proof of concept provides read-only Sahara/EDL reconnaissance, including identity, memory, PBL, and fuse reads...

Can Open Be Too Open? on the Security and Trustworthiness of Fully Transparent LLMs

There are different levels of transparency for LLMs: open weights, open data, and/or open pipeline. Recently, more interest has emerged in fully transparent LLMs, i.e., LLMs with fully open weights, data, and training pipeline. Drawing analogies to other fields such as software security, it is...

Then There Is Prompt Injection, a Malicious Email, ...: The Wild Wide West of OpenClaw Agentic System Security

AI-powered personal assistant frameworks such as OpenClaw combine LLM reasoning, persistent memory, tool invocation, local execution, and web-based workflows. These capabilities enable useful automation, but they also create security risks when untrusted inputs, model reasoning, tools, memory, an...

Man-In-The-Middle Proxy 12.3.1

mitmproxy is an open source, SSL/TLS-capable intercepting proxy for HTTP/1, HTTP/2, and WebSocket traffic. It enables users to inspect, capture, modify, and replay HTTP and HTTPS communications for debugging, traffic analysis, and security testing. The package includes mitmproxy, an interactive...

Apple Security Advisory 10-26-2026-3

Apple Security Advisory 10-26-2026-3 - iOS 18.7.11 and iPadOS 18.7.11 addresses out of bounds write and arbitrary code execution vulnerabilities...

The Target Agent Is Its Own Best Critic but a Poor Proposer: Self-Improved Red Teaming

Automatic red teaming increasingly relies on large language models LLMs to iteratively diagnose failed attacks and propose improved adversarial prompts or injections. Although prior work strengthens this loop through prompt engineering and search-harness design, the mechanisms underlying its two...

Reva: Real-Time Vulnerability Detection through Contextual Probing of Large Language Models

A vulnerability costs more to fix the later it is discovered. As coding agents generate code faster than developers can review it, software needs a first line of defense screening each new function in real time. LLM agents have recently become capable of finding real-world vulnerabilities by...

PHP Session Upload Progress Enabled Detection

This template detects PHP targets with session.uploadprogress enabled, a required precondition for CVE-2026-115560. It also checks exposed phpinfo pages for the setting and session serialize handler...

JANUS: Synthesizing Cross-Layer Defenses against Web Deserialization Attacks

Unsafe deserialization turns untrusted data into attacker-controlled execution, and a single vulnerability can admit diverse exploit variants that evade defenses tailored to a known exploit. Existing defenses typically operate at a single enforcement point with limited visibility into the full...

Frankly Speaking: The Company Election Integrity Keeps in Congressional Communication

Election integrity is a shared commitment in American politics, but Democrats and Republicans in Congress increasingly mean different things by it. Analyzing 10,420 congressional e-newsletters sent from 2010 to 2025, we examine how the two parties invoke election terms such as "integrity,''...

Apple Security Advisory 10-26-2026-6

Apple Security Advisory 10-26-2026-6 - macOS Sequoia 15.8.2 addresses out of bounds access, out of bounds read, out of bounds write, use-after-free, memory corruption, buffer overflow, integer overflow, arbitrary code execution, and information disclosure vulnerabilities...

Apple Security Advisory 10-26-2026-9

Apple Security Advisory 10-26-2026-9 - visionOS 27.2 addresses out of bounds access, out of bounds read, out of bounds write, use-after-free, memory corruption, buffer overflow, integer overflow, and information disclosure vulnerabilities...

OpenSSH 9.7p1 Remote Code Execution

OpenSSH server versions 8.5p1 through 9.7p1 are affected by a regression that may allow unauthenticated remote code execution. This guide provides update and mitigation instructions...

Program-Level Adversarial Co-Adaptive Self-Play for Robotic Security

Coding agents can adapt robotic software by revising executable programs, but successful responses to an evolving opponent may not remain effective. We present a framework for program-level adversarial co-adaptive self-play in which coding agents generate attacks and defenses from tested opponent...

Cheap AI-Assisted Reverse Engineering and What It Will Do

Generative AI is putting the law of reverse engineering RE under severe strain. Existing IP and technology laws assume that RE is expensive and time-consuming, and that it requires specialized expertise. They generally allow it, but they rely on its difficulty as a filter to separate permissible ...

Adversary Brains: Hypothesis-Based Logical Signatures for Threat Actor Detection with LLMs

An adversary brain is an LLM-based model of a threat actor's behavior, held as an evolving logical signature: a hypothesis with enough structure that data can test it continuously, without a person re-interpreting it each time. Rather than any single observation, such as an IoC Indicator of...

CoSA: The Conflict of Skills Attack in Real-World LLM Agent Ecosystems

Agent Skills allow LLM agents to combine reusable capabilities, but checking each Skill in isolation cannot rule out policy violations when they are composed. We term such failures Conflict of Skills CoS: artifacts or assessment signals produced for one purpose may be reused downstream without...