Demystifying DRAM Read Disturbance: Bridging the Gap between Experimental Characterization and Device-Level Modeling of RowHammer and RowPress Phenomena

DRAM read disturbance, like RowHammer and RowPress, is a critical robustness issue where accessing DRAM can cause unintended bitflips in other unaccessed DRAM locations. DRAM read disturbance bitflips significantly impact the safe, secure, and reliable operation of DRAM-based computing systems...

Fingerprint-Driven Automation: Coupling Reconnaissance with POC Verification

In the field of network security confrontation, reconnaissance is the first and most critical step. Accurate, efficient, and comprehensive reconnaissance can help network security workers more fully understand the target's current state, identify potential weaknesses, and formulate a targeted...

MemSecBench: Tracking Agent Memory Poisoning from Persistence to Consequence and Repair

Memory systems allow agents to retain and reuse information from past interactions, but they can also let malicious content persist. A malicious instruction crafted by an attacker may be stored in long-term memory, recalled much later, and quietly shape a real action. Recent benchmarks increasing...

FakeIDet3-DB: Refining Digital Attacks and Patch Extraction for Secure ID Benchmarking

Identity document ID authentication relies on the structural integrity of complex, high-frequency security patterns. However, advanced Generative AI models can now inject localized, high-fidelity manipulations, creating deceptive attacks that bypass standard verification. Training robust image...

angr 9.3.1

angr is an open-source binary analysis platform for Python. It combines both static and dynamic symbolic "concolic" analysis, providing tools to solve a variety of tasks...

FreeBSD Security Advisory - FreeBSD-SA-26:55.elf

FreeBSD Security Advisory - The ELF core dump code counted the number of dumpable VM map entries, allocated a buffer for the corresponding program headers, then iterated over the map a second time to populate them. A process sharing the address space via rfork2 can mutate the map between the two...

Guarding Organizations against Malware Risk: A Novel Graph-Based Malware Detection Method

Organizational digitalization expands cybersecurity risks, making cybersecurity an increasingly important research area in Information Systems IS. Among these risks, malware has become a pervasive and destructive threat. Byte-based machine learning ML methods are widely used for malware detection...

Open Security Benchmark: Towards Autonomous Enterprise Cyber Defense

Enterprises are moving toward autonomous cyber defense: agentic AI that builds situational awareness of an organization's security state and reasons from it to assessments, decisions, and actions. This rests on a holistic view of the enterprise's security state, the continuous, cross-vendor pictu...

HoF-Bench: Rediscovering Real AI-Discovered CVEs without Frontier Models

AISLE's analyzer is credited with more than 280 CVEs across 78 projects, including OpenSSL, curl, and GnuTLS. They introduce HoF-Bench named after AISLE's public Hall of Fame, a benchmark built from 95 of these public AI-discovered CVEs across eight repositories pinned at vulnerable commits...

FreeBSD Security Advisory - FreeBSD-SA-26:51.ktimer

FreeBSD Security Advisory - To retrieve the previous timer value, the kernel calls realtimergettime, which obtains the current time for the timer's clock. For a timer using CLOCKTAI this can fail when no TAI offset has been configured, but the error return was not checked, so the uninitialized...

Joern 4.0.591

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

Targeted Quarantine Strategies Mitigate SIS-Model Cyber Epidemics on Complex Networks

The rapid expansion of highly connected and heterogeneous digital infrastructures has fundamentally altered the dynamics of cyber epidemics, making it increasingly important to understand how malware propagates under realistic structural and policy conditions. In this study, we employ an SIS...

From Backlog Items to Security Guidance: Towards Continuous Security Compliance

Continuous software engineering in regulated domains requires engineering teams to address security throughout the development lifecycle. Yet making security requirements explicit in backlog items is still problematic. Engineers must instead infer security relevance of backlog items from brief,...

Enhancing the Security of Coherent One-Way Quantum Key Distribution Using CHSH Correlations

The coherent one-way COW protocol is a quantum key distribution scheme that has attracted significant attention, leading to the development and commercialization of practical implementations. Despite this progress, the security of the COW protocol has remained a fundamental challenge since its...

SecRespond: Benchmarking AI Agents for Real-World Post-Compromise Incident Response

Large Language Model LLM agents are increasingly adopted in real-world security operations with access to host artifacts and command-line interfaces CLIs, making it critical to thoroughly assess their security capabilities. However, existing cybersecurity benchmarks focus on pre-compromise settin...

FreeBSD Security Advisory - FreeBSD-SA-26:53.ktrace

FreeBSD Security Advisory - As an inadvertent side effect of an unrelated code change, PRIVKTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged...

Quantum Random Number Generation Using Spatial Quantum Noise of Light

Generating high-speed, verifiable random numbers is a fundamental requirement for cryptography, large-scale stochastic simulations, and secure quantum communication. Here, we present a robust quantum random number generator that utilizes the spatial distribution of quantum fluctuations captured b...

ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping

Threat modeling is essential for secure software development, yet manual analysis of cloud-native architectures is slow and demands scarce security expertise. We present ThreatForest, a multi-agent system that generates structured attack trees from source code repositories, maps attack steps to...

Send and Pretend: Exploiting Transcript Consistency Issues in End-To-End Encrypted Group Chats

End-to-end encrypted E2EE messaging apps are widely praised for their security and thus also used for sensitive coordination in group chats e.g., by political decision makers. After Threema and WhatsApp, also Signal and iMessage have recently introduced polls to aid agreement processes in groups...

FreeBSD Security Advisory - FreeBSD-SA-26:52.if_wg

FreeBSD Security Advisory - After dispatching a decrypt operation to OCF and receiving the result, the wg4 driver failed to check whether the MAC verification step succeeded. The driver thus silently accepted packets with an invalid Poly1305 authentication tag...

Microsoft SharePoint CVE-2026-50522 Post-Exploitation Payload Collection

A collection of payloads, webshells, and HTTP request artifacts observed following exploitation of the Microsoft SharePoint CVE-2026-50522 vulnerability. The repository documents real-world payloads deployed by multiple threat actors rather than providing an exploit for the underlying vulnerabili...

Nimux 1.0.3

Nimux is a native command surface for authorized security assessments. It combines network enumeration, credential validation, Active Directory operations, Kerberos workflows, remote execution, file movement, secrets collection, DCSync, GPO operations, database clients, and SOCKS routing into one...

Xalgorix Autonomous AI Pentesting Agent 4.5.100

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

FreeBSD Security Advisory - FreeBSD-SA-26:54.sysvsem

FreeBSD Security Advisory - The GETALL and SETALL commands in semctl2 recorded the number of semaphores in the target set, dropped the lock protecting the set, allocated a buffer sized for that count, and reacquired the lock. A sequence-number check was used to verify that the set had not been...

CDN Tsunami: Exploiting HTTP/3-HTTP/1.1 Conversion for DoS Attacks

Content Delivery Networks CDNs provide high availability, accelerate content delivery for their host websites, but are also vulnerable to different types of Denial-of-Service DoS attacks. Prior works have studied a variety of DoS attacks with HTTP/1.1 or HTTP/2 connections, but most of them are...

CVE-2026-51302 Appears Hallucinated

This write-up argues that CVE-2026-51302 is invalid and that the published advisory is based on incorrect analysis rather than an actual SQLite vulnerability...

AgentSnare: Learning to Delay, Divert, and Defuse Autonomous Penetration Agents

Large language model LLM agents automate penetration testing through an observation-action loop, selecting actions based on observations returned by tools. This dependence allows defenders to inject deceptive observations that can mislead the agent's decision-making process. However, existing...

FreeBSD Security Advisory - FreeBSD-SA-26:50.kqueue

FreeBSD Security Advisory - While the kernel was copying knotes during fork, a knote with a timer-based filter could fire and be enqueued on the kqueue's active list before the copy was complete. The copy routine did not account for this and could enqueue the new knote a second time, corrupting t...

Graph Is the Verifier: Agentic Reinforcement Learning for Interprocedural Vulnerability Detection

Real-world vulnerabilities often span multiple functions, yet most learning-based detectors classify each function in isolation: on a sample of real CVEs, we find that 71.7% of vulnerable functions require evidence from outside the function to be classified correctly. Agentic reinforcement learni...

Impossible to Hide Secret ...: Uncovering Security and Privacy Issues in LLM-Native IDEs

LLM-native IDEs Integrated Development Environments, aka LIDEs, are designed from the ground up to work with Large Language Models LLMs. LIDEs have found remarkable success in Software Engineering SE tasks such as coding, debugging, and program comprehension. LIDEs are software systems, and, like...

A Controlled Candidate-Set Benchmark for Offline Satellite-Security Plan Decomposition

Some security-development settings require local models that map an objective to an ordered, checkable plan. We present a low-rank decomposition adapter and release a case-disjoint corpus with 24 authored decompositions and 83 derived next-step examples across 24 satellite-security cases. To...

AI Deployment and Cyber Governance Failures in Public-Sector Organizations: A Typological Analysis

The intersection of artificial intelligence adoption, cybersecurity governance, and public sector institutional constraints has not been examined as a unified analytical problem in the existing literature. Studies address AI cybersecurity risks generically, public sector governance independently,...

Joern 4.0.590

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...

C-RE-ACT: Causal RE-ACTing Agent for O-RAN Forensic Triage

The shift to O-RAN architectures marks a turning point in cellular security, where increased openness and modularity directly translate into a broader attack surface. Among the security threats cataloged by the O-RAN Alliance Working Group 11, performance-degradation attacks constitute the larges...

StealthBench: Measuring Operational Stealth in Autonomous Offensive-Security Agents

Stealth, the discipline of achieving an objective without revealing your presence, capabilities, or collected intelligence, is what separates sophisticated operators from detectable ones. Elite security researchers and advanced persistent threats achieve their objectives unnoticed; autonomous...

QUIC-TRIP: A Triple-Redundant Journey toward Secure Substation Communications

Modern power systems rely on real-time substation communication protocols, such as the Routable Generic Object-Oriented Substation Event R-GOOSE, for critical control and protection functions. However, these protocols often lack built-in security features and prioritize availability over...

Cyber-Capable AI Agents: Vulnerabilities, Evaluation Containment, and Defensive Response

Cyber-capable AI agents combine language models with tools, memory, and execution en- vironments to perform multi-step offensive-security tasks. Existing work separately measures cyber capability and catalogs attacks against agent components, but provides less guidance on containing a capable age...

Distributing Security Controls through Harness Engineering

AI coding agents are being adopted at historic speed, yet security and risk concerns remain the primary barrier to scaling agentic AI across organizations. Existing security controls for coding agents are not systematically distributed to engineering teams, and vendor-native solutions introduce...

Xalgorix Autonomous AI Pentesting Agent 4.5.89

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

Does Runtime Topology Context Improve LLM-Generated Kubernetes Security Patches?

Kubernetes is central to the cloud-native ecosystem, orchestrating containerised workloads. Recent work suggests that large language models LLMs can automate cluster security remediation, generating configuration patches from Kubernetes Security Posture Management KSPM findings without human...

A Structuration Approach to Theorizing Cybersecurity Practice: The STARC Model

The problem: Cybersecurity practice runs simultaneously across analysts, teams, organizations, sectors, and regulators, co-evolves with adversaries, and increasingly blends human and algorithmic decision-making. The theories applied to it operate at single organizational levels and cannot explain...

Benchmarking Optical Receivers for Quantum Communication and Randomness Certification

The choice of optical receiver determines which properties of the transmitted states remain visible in the observed data and therefore affects the performance of different quantum protocols. We compare continuous-variable, photon-counting and hybrid receivers within the same prepare-and-measure...

The Disruptive Impact of Large Language Models on Capture the Flag Competitions and the Path toward Fair Play

Capture the Flag CTF competitions are among cybersecurity's most effective training grounds, developing practical skill across cryptography, web exploitation, and binary exploitation. Large language models LLMs can now solve a growing share of challenges with minimal human input, raising urgent...

tcpreplay 4.6.0

tcpreplay is a BSD-style licensed tool to replay saved tcpdump files at arbitrary speeds. It provides a variety of features for replaying traffic for both passive sniffer devices as well as inline devices such as routers, firewalls, and intrusion detection systems. Many NIDSs fare poorly when...

(EC)2: Event-Centric Explainability for Cybersecurity through Multi-Agent LLM Investigations

Security operations centers rely on anomaly detection systems to flag suspicious events. Feature-level explanations for anomaly detectors offer limited value for operational investigations. To effectively handle alerts, analysts need to know contextual relationships and need actionable...

HiTMS: A High-Throughput Multi-Stream Linguistic Steganography Framework

Research code for linguistic steganography over LLM chat dialogues, with a single-stream baseline and a batched multi-stream HiTMS protocol that hides several independent secret messages at once and exploits GPU batching for much higher throughput. A Bob model asks questions; an Alice model...

From Profiling to Parameterization: Physics-Guided Acoustic Eavesdropping Via Smartphone Accelerometers

We present LEAKFORGE, a device-agnostic framework that converts cross-device accelerometer eavesdropping into a physics-guided data-generation problem. Crucially, device-specific leakage is not arbitrary; its dominant variation lies within a constrained family of audio-to-accelerometer transfer...

SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents

Software engineering teams now deploy AI coding agents Cursor, Claude Code, GitHub Copilot as first-class productivity tools, installing domain-specific skill files to tailor agent behavior to project APIs, framework conventions, and organizational workflows. These complex Markdown files are easi...

RedAmon 6.2.5

An autonomous AI framework that chains reconnaissance, exploitation, and post-exploitation into a single pipeline, then goes further by triaging every finding, implementing code fixes, and opening pull requests on your repository. From first packet to merged patch, with human oversight at every...

Network Reciprocity Shapes Evolutionary Cybersecurity Dynamics

AI-assisted cybersecurity systems are characterised by continuous adaptation between attackers and defenders, making evolutionary game theory a natural framework for studying their long-term behaviour. However, existing evolutionary cybersecurity models have primarily focused on homogeneous...