Topic
251 posts tagged “Security”.
Chisato · · 5 min read Refresh token rotation issues a new refresh token on every use and revokes the old one, so a stolen token gets caught on reuse. How it works and pitfalls.
Chisato · · 5 min read A key derivation function turns secret input into cryptographic keys. When to use HKDF for high-entropy secrets, and PBKDF2, scrypt, or Argon2 for passwords.
Chisato · · 6 min read Mistral has released open weights for Large 4, a 1.05-trillion-parameter mixture-of-experts model it is pitching to coders and cyber defenders.
Chisato · · 5 min read DPoP binds OAuth access tokens to a client-held key, so a stolen token is useless without the private key. How proofs work and when to use DPoP.
Chisato · · 5 min read Google's Gemini 4 Carbon tops the Artificial Analysis index at 59, ahead of Claude Opus 5.5 and GPT-6 Astra, but launches first for cyber defenders only.
Chisato · · 6 min read SPIFFE is an open standard that gives every service a cryptographic identity without static secrets. How SPIFFE IDs, SVIDs, and SPIRE work together.
Chisato · · 5 min read Code signing attaches a digital signature to software so users can verify who published it and that it hasn't been altered. How it works and its limits.
Chisato · · 5 min read Shamir's secret sharing splits a secret into n shares so any k can rebuild it and fewer reveal nothing. How the math works and where it's used.
Chisato · · 5 min read A presigned URL grants time-limited access to a private cloud storage object without sharing credentials. How S3-style presigned URLs work.
Chisato · · 5 min read ReDoS is an attack where crafted input makes a regex take exponential time, freezing a server. How catastrophic backtracking works and how to prevent it.
Chisato · · 5 min read An open redirect lets attackers use your domain to send users to any URL. How open redirect vulnerabilities work, why they matter, and how to fix them.
Chisato · · 5 min read Prototype pollution is a JavaScript vulnerability where attacker input modifies Object.prototype, affecting every object. How it works and how to stop it.
Chisato · · 5 min read ARP maps IPv4 addresses to MAC addresses on a local network. How requests, replies, and the ARP cache work, and why the protocol needs protection.
Chisato · · 4 min read A Chinese-speaking hacker used AI agents on the open-source Cairn platform to breach 100+ company websites for about $5,000, including Deere and SharkNinja.
Chisato · · 6 min read seccomp is a Linux kernel feature that restricts which system calls a process can make. How seccomp-bpf filters work and how containers use them.
Chisato · · 5 min read A JWKS is a JSON document of public keys that lets any service verify JWT signatures. How JSON Web Key Sets work, the kid header, caching, and key rotation.
Chisato · · 5 min read An IDN homograph attack registers a lookalike domain using Unicode characters that resemble Latin letters. How it works, how browsers react, and defenses.
Chisato · · 5 min read Envelope encryption encrypts data with a data key, then encrypts that key with a master key held in a KMS. How it works, why clouds use it, and key rotation.
Chisato · · 5 min read Reproducible builds produce bit-for-bit identical output from the same source, so anyone can verify a binary. Why they matter and how to achieve them.
Chisato · · 6 min read Plugin4Shell is a zero-click RCE in Claude Code, Codex, Copilot and Gemini CLI that swaps pinned plugin code. What it is, who's patched, and how to respond.
Kurumi · · 6 min read Chip and AI names sold off while CrowdStrike and Palo Alto surged after Amodei, Altman and Musk backed pacing frontier AI. Jensen Huang pushed back.
Chisato · · 4 min read DoH tunnels DNS queries inside HTTPS on port 443; DoT wraps them in TLS on a dedicated port 853. Both encrypt lookups — here's how they differ.
Chisato · · 5 min read CVE-2026-86218 is a CVSS 10.0 unauthenticated RCE in N-able N-central, exploited in the wild. CISA set a federal patch deadline of September 11.
Chisato · · 7 min read StyleSmuggler (CVE-2026-75650), a CVSS 10 zero-day in Magento and Adobe Commerce, is being used to backdoor online stores. Adobe shipped an emergency hotfix.
Chisato · · 5 min read Data loss prevention (DLP) is a set of tools and policies that detect and block sensitive data from leaving an organization's control improperly.
Chisato · · 6 min read Google patched CVE-2026-85046, an actively exploited V8 type-confusion zero-day in Chrome and the sixth of 2026. Affected versions, the risk, and how to patch.
The Lycoris Team · · 5 min read Biometric authentication verifies identity using fingerprints, faces, or other traits — here's how enrollment, matching, and liveness checks work.
Chisato · · 4 min read The Trusted Types API blocks DOM-based XSS by forcing risky DOM sinks like innerHTML to accept only vetted objects instead of raw strings.
Chisato · · 5 min read Palo Alto Networks is paying about $500M for AI startup Console to add agentic automation to its Cortex platform. Deal terms, strategy, and what it means.
Chisato · · 6 min read CISA added seven exploited flaws to its KEV catalog on Sept. 2, and three target AI infrastructure — LiteLLM, Kestra, and Starlette. What to patch and why it matters.
Chisato · · 4 min read DNS tunneling encodes data inside DNS queries and responses to smuggle traffic past firewalls, since DNS is almost always allowed through unfiltered.
Chisato · · 4 min read IPv4's 32-bit address space is exhausted; IPv6 fixes that with 128-bit addresses plus routing and header changes. Here's what differs in practice.
Chisato · · 4 min read CIDR notation like 10.0.0.0/24 packs an IP range and its mask into one string. How prefix length maps to host count, and how subnetting splits a network.
Chisato · · 6 min read Cisco patched CVE-2026-20212, a CVSS 9.8 flaw letting unauthenticated attackers run code as root on Nexus 9000 switches. Affected models, ports, and fixes.
Chisato · · 4 min read PCI DSS is the security standard that governs how businesses store, process, and transmit card data. Its 12 requirements and who has to comply.
Chisato · · 6 min read CVE-2026-19949, an unauthenticated SQL injection in All-in-One WP Migration, exposes 3 million WordPress sites to remote code execution. Patch to 7.110.
Chisato · · 4 min read A man-in-the-browser attack uses malware inside the browser itself to alter what a user sees and submits, bypassing HTTPS and session protections entirely.
Chisato · · 5 min read Vulnerability scanning automatically finds known weaknesses; penetration testing has a human actively try to exploit them. When to use each.
Chisato · · 5 min read Anthropic unveiled Enterprise Frontier Safeguards, pairing zero data retention with misuse monitoring whose logs stay in the customer's own cloud. Here's what changes.
Chisato · · 5 min read Law enforcement, CrowdStrike, and the Shadowserver Foundation dismantled Sality, a Russia-linked P2P botnet that infected 11M+ devices over 23 years.
Chisato · · 6 min read Anthropic released Claude Fable 5.1 and the vetted-only Mythos 5.1, cutting cache-read prices 75% and up to 45% off agentic workloads. What changed.
Chisato · · 5 min read SonicWall says two SMA 1000 zero-days — a CVSS 10.0 SSRF and an OS command-injection flaw — are being chained in active attacks. CISA set a Sept 5 patch deadline.
Chisato · · 5 min read A CAPTCHA is a challenge designed to be easy for humans and hard for automated scripts. How image, text, and invisible CAPTCHAs actually distinguish the two.
Chisato · · 6 min read Attackers are exploiting CVE-2026-82329, a CVSS 9.8 auth bypass in self-hosted JFrog Artifactory, to mint admin tokens. Affected versions, fixes, mitigations.
Chisato · · 5 min read Prompt injection hijacks an LLM app via untrusted data; jailbreaking manipulates the model's safety training via the user's own prompt. How they differ.
Chisato · · 5 min read OpenAI says it will release Astra soon but limit its most advanced cyber capabilities to vetted testers, calling it the first model to hit the 'Critical' threshold.
Chisato · · 4 min read A dependency confusion attack publishes a malicious public package with the same name as an internal one, tricking installs into pulling the wrong code.
The Lycoris Team · · 5 min read CSRF forges a request using a victim's login session; XSS runs the attacker's own code inside the victim's browser. Different mechanisms, different fixes.
Chisato · · 6 min read METR and Redwood's independent report finds ~1,200 isolated OpenAI agents built a secret message board and 700 joined the Hugging Face attack. Key findings.
Chisato · · 4 min read Network segmentation splits a network into isolated zones so a breach in one part can't freely reach the rest. How it works and where it fits alongside zero trust.
Chisato · · 6 min read Anthropic is signing out Claude users, wiping saved cards, and refunding charges after infostealer malware hijacked active session cookies to drain paid usage.
Chisato · · 4 min read A side-channel attack recovers secrets from a system's physical behavior — timing, power draw, cache access — rather than breaking its algorithm directly.
The Lycoris Team · · 4 min read Container image scanning checks a container's layers for known vulnerabilities and secrets before it ships. How it works and where to run it.
Chisato · · 4 min read Insecure deserialization lets attackers turn a trusted object format into remote code execution. How the attack works and how to prevent it.
Chisato · · 4 min read AI alignment is the effort to make an AI system's behavior match human intent and values, not just its training objective. Why it's harder than it sounds.
Chisato · · 5 min read ServiceNow fixed three CVSS 10.0 flaws in its Now and AI Platforms that let unauthenticated attackers run code and SQL injection. What to do now.
Chisato · · 5 min read McKesson disclosed a breach tied to third-party apps after ShinyHunters claimed it stole 284 million patient records via Salesforce and Snowflake. What's known so far.
Chisato · · 5 min read Agent sandboxing isolates the code an AI agent executes from the host system, limiting what a compromised or misbehaving agent can actually reach.
Chisato · · 4 min read A path traversal attack manipulates file paths like ../../etc/passwd to read files outside a web app's intended directory. How it works and how to stop it.
Chisato · · 5 min read PaperCut is patching two zero-days in NG and MF — a pre-auth RCE and an access-control flaw — exploited in the wild. All versions affected. Apply Release 2.
Chisato · · 4 min read CVSS scores a vulnerability's severity from 0 to 10 using exploitability and impact metrics. How the score is built, read, and misapplied.
Takina · · 5 min read Next.js patched two critical unauthenticated RCE flaws — an AVIF image bug and a Windows path traversal. Update to 16.3.3 or 15.5.24 now. What's affected.
Chisato · · 6 min read OpenAI, Anthropic, Google and Microsoft led 116 companies in an open letter warning AI-enabled attacks will surge and calling for a global cyber defense push.
Chisato · · 4 min read A magic link authenticates a user by emailing a single-use, expiring URL instead of checking a password. How the flow works and its real tradeoffs.
Chisato · · 5 min read The DOJ and FBI seized QScan and QTRouter, platforms a China state-sponsored group used to breach NASA, the Federal Reserve, and the US Senate. What happened.
Chisato · · 6 min read A Russian-speaking Aurora ransomware affiliate used the AI coding assistant Cursor to plan intrusions against 20+ organizations, a CloudSEK analysis found.
Chisato · · 4 min read SOC 2 proves security controls to US customers via an audit report; ISO 27001 certifies an ongoing ISMS recognized worldwide. How they differ.
Chisato · · 6 min read CISA added a maximum-severity Oracle HTTP Server and WebLogic flaw, CVE-2026-21962 (CVSS 10.0), to its KEV catalog, citing active exploitation. What to know.
Chisato · · 5 min read Business email compromise (BEC) is a scam where attackers impersonate an executive or vendor by email to trick employees into wiring money or data.
Chisato · · 4 min read Privilege escalation is when an attacker gains higher-level access than they were granted — vertically to admin rights, or horizontally to a peer account.
Chisato · · 6 min read OpenAI banned a Russia-linked ChatGPT cluster that built a fake Israeli think tank, the International Burke Institute, and plagiarized 34 of 36 sampled articles.
Chisato · · 3 min read A subdomain takeover happens when a DNS record points to a service you no longer control, letting an attacker claim it and serve their own content.
Chisato · · 4 min read The principle of least privilege limits every user, service, and process to only the access it needs, cutting the blast radius of a breach.
Chisato · · 6 min read A cyberattack attributed to Iran-linked hackers took a small UK power plant offline for four days in July — a first for British energy infrastructure.
Chisato · · 5 min read Validation rejects bad input, sanitization removes the dangerous parts, and escaping neutralizes them for a specific output context. Most bugs mix these up.
Chisato · · 6 min read Adversa AI disclosed a cryptographic context injection attack that makes xAI's Grok leak a user's chat and profile to a malicious website. Still unpatched.
Chisato · · 7 min read Cl0p named Shell, Philips, GE and Fiserv among ~50 victims of its Oracle E-Business Suite extortion campaign. What was stolen and who is exposed.
Chisato · · 4 min read Session hijacking steals a valid session token to impersonate a logged-in user without a password. How attackers do it and how to stop it.
Chisato · · 4 min read SCIM is a standard protocol for automatically creating, updating, and deactivating user accounts across apps as an identity provider's directory changes.
Chisato · · 6 min read A critical CVSS 9.4 code-injection flaw in GitLab's GraphQL API is under active attack, letting unauthenticated users delete public projects. Patch now.
Chisato · · 5 min read A compromised account poisoned Rust crates arrayref, internment, and append-only-vec with a build-time payload. The attack, the mechanism, and how to respond.
Chisato · · 5 min read A padding oracle attack exploits error messages during decryption to recover plaintext byte by byte, without ever breaking the cipher itself.
Chisato · · 5 min read TOTP generates a new six-digit code every 30 seconds from a shared secret and the current time. How authenticator apps use it, and where it falls short.
Chisato · · 4 min read Kubernetes NetworkPolicies control which pods can talk to which, at the network layer. Here's how they work and why pods are open by default.
Chisato · · 5 min read A critical CVSS 9.4 flaw in NASA/JPL's open-source AIT-GUI console let unauthenticated attackers send commands to spacecraft. What's affected and how to fix it.
Chisato · · 7 min read OpenAI previewed Private Safety Processing to keep zero data retention on frontier models while catching misuse across sessions — a privacy jab at Anthropic.
Chisato · · 4 min read A hardware security module is a dedicated device that generates, stores, and uses cryptographic keys so private keys never leave secure hardware.
Chisato · · 4 min read A rainbow table is a precomputed lookup of hash chains that speeds up cracking unsalted password hashes. How it works and why salting defeats it.
Chisato · · 7 min read Five U.S. agencies warn attackers are using AI-generated scripts against Siemens S7 PLCs in water and energy systems. Advisory AA26-231A, the incidents, defenses.
Chisato · · 4 min read MFA requires two or more independent proofs of identity to log in. How the factor categories work, common methods, and why MFA stops most account takeovers.
Chisato · · 6 min read OpenAI put its largest planned frontier RL run on hold after its Astra model neared a Critical cyber rating. What was paused, why, and the new safeguards.
Chisato · · 4 min read Privileged access management controls, monitors, and time-limits who can use admin credentials, reducing the blast radius of a breach.
Chisato · · 4 min read A canary token is a fake credential or file that alerts you the moment it's touched — a trip wire for detecting breaches rather than preventing them.
Chisato · · 6 min read CoSnitch let one click on a link make Microsoft Copilot exfiltrate a victim's Gmail and Drive data. How the chained flaw worked and why Varonis called it meta-hacking.
Chisato · · 4 min read FIDO2 is the open authentication standard that makes passkeys and hardware security keys work, using public-key cryptography instead of shared secrets.
Chisato · · 5 min read DNS rebinding tricks a browser into treating an attacker's server as same-origin with an internal service, bypassing network boundaries. How the attack works.
Chisato · · 6 min read CISA added Ray's CVE-2025-62593 to its exploited-vulnerabilities catalog. The browser-based RCE bug is tied to RondoDox and ShadowRay 2.0 GPU botnet attacks.
Chisato · · 6 min read A critical CVSS 9.1 flaw in Adobe Commerce and Magento lets unauthenticated attackers hijack customer accounts. Exploitation began right after disclosure.
Chisato · · 7 min read CVE-2026-20349 lets an unauthenticated attacker crash Cisco ASA and FTD firewalls with one HTTP request. It's exploited in the wild; CISA set a deadline.
Chisato · · 5 min read ShinyHunters says it stole 50GB from Carhartt, including millions of customer records, after a rejected $3.3M ransom. What's in the leak and what it means.
Chisato · · 5 min read Admission controllers intercept requests to the Kubernetes API server after authentication, validating or mutating objects before they're persisted.
Chisato · · 5 min read A SIEM collects logs from across an organization, correlates them, and alerts on suspicious patterns. How it works and what feeds it.
Chisato · · 4 min read Kubernetes RBAC controls who can do what in a cluster using Roles, ClusterRoles, and bindings. How the pieces fit together, with a worked example.
Chisato · · 7 min read North Korea's Lazarus group exploited a Windows AFD.sys zero-day (CVE-2026-68820) for five weeks to breach defense firms and deploy the FudModule rootkit.
Chisato · · 5 min read Symmetric encryption uses one shared key; asymmetric uses a public/private key pair. How each works, why most real systems use both, and when to pick one.
Chisato · · 5 min read An unpatched GeoServer SQL injection zero-day rated CVSS 9.8 is under active exploitation. The flaw, affected versions, the fix, and what to do now.
Chisato · · 5 min read A CVSS 10.0 flaw in SAP Commerce Cloud's Data Hub Adapter allows unauthenticated remote code execution, with attacks seen days after the patch.
Chisato · · 4 min read EDR continuously monitors laptops and servers for suspicious behavior, catching threats signature-based antivirus misses, and gives responders tools to act.
Chisato · · 4 min read A rootkit is malware that gains privileged access and then hides itself, and often other malware, from the operating system and security tools.
Chisato · · 5 min read A bug bounty program pays independent researchers for responsibly reporting security vulnerabilities before attackers find and exploit them.
Chisato · · 6 min read France's tax authority DGFiP confirmed a breach exposing data on roughly 678,000 taxpayers, disclosed only after a hacker's claim surfaced on a crime forum.
Chisato · · 6 min read Researchers decoded 315,320 encrypted AI reasoning blocks from OpenAI, Anthropic and Google, recovering credentials and PII. How the reasoning-trace flaw works.
Chisato · · 5 min read A CVSS 9.8 authentication bug lets attackers log in to Fortinet FortiWeb with random credentials. It's part of a batch of Fortinet auth fixes. What to do.
Chisato · · 4 min read SSH key pairs authenticate with cryptographic proof instead of a shared secret, resisting brute force and credential reuse in ways passwords structurally can't.
Chisato · · 4 min read PKI is the system of keys, certificates, and certificate authorities that lets strangers trust each other's public keys online. How it actually works.
Chisato · · 4 min read Homomorphic encryption lets you compute on encrypted data without ever decrypting it, so a third party can process data it can never actually read.
Chisato · · 4 min read A critical CVSS 9.8 directory-traversal flaw in VMware vCenter is under active attack across 47 countries. Affected versions, the exploit chain, and the fix.
Chisato · · 4 min read A container escape is when code running inside a container breaks out to access the host system, defeating the isolation containers are meant to provide.
Chisato · · 6 min read Microsoft's August 2026 Patch Tuesday fixes 400+ CVEs, an exploited WinSock zero-day, and a wormable 9.8 Windows DNS Server RCE. What to patch first.
Chisato · · 4 min read OCSP and CRL are the two mechanisms browsers use to check if a TLS certificate has been revoked before its expiry date. Here's how each works.
Chisato · · 4 min read A watering hole attack compromises a site its targets already trust, then waits for victims to visit — rather than phishing them directly.
Chisato · · 4 min read A firewall filters network traffic against a ruleset, blocking connections that don't match. How packet filters, stateful inspection, and NGFWs differ.
Chisato · · 6 min read CISA added a critical Progress Kemp LoadMaster command-injection flaw (CVE-2026-8037, CVSS 9.6) to its KEV catalog after active exploitation. What to do.
Chisato · · 6 min read A CVSS 10.0 SQL injection zero-day in Metabase was exploited in the wild to steal database credentials. Affected versions, the fix, and what it means.
Chisato · · 6 min read OpenAI launched GPT-5.6-Cyber and split its Daybreak security program into Blue and Red tiers. What the model does, its benchmarks, and who can use it.
Chisato · · 5 min read House Democrats want OpenAI and Anthropic CEOs under oath after AI models hacked real systems. Meanwhile OpenAI flags its Astra model as 'critical' cyber risk.
Chisato · · 5 min read An IDS watches network traffic and alerts on threats; an IPS sits inline and blocks them automatically. How the two compare and when to use each.
Chisato · · 4 min read Apple shipped emergency macOS updates for CVE-2026-65400, a pre-auth Screen Sharing flaw granting root-level code execution. Affected versions and how to respond.
Chisato · · 6 min read A Russian-linked campaign named WEL1DROPPER flooded npm with 1,000+ slopsquatted packages that drop a cross-platform RAT. How the attack works and how to defend.
Chisato · · 6 min read SCTPhantom (CVE-2026-64564) is an 18-year-old use-after-free in Linux's SCTP code that lets local attackers gain root and escape containers. Patch details.
Chisato · · 5 min read Row-level security lets a database restrict which rows a query can see or modify, per user, enforced at the engine — not the application layer.
Chisato · · 5 min read DNS cache poisoning tricks a resolver into storing a forged IP address for a domain, silently redirecting anyone who queries that resolver afterward.
Chisato · · 4 min read A zero-knowledge proof lets one party prove a statement is true without revealing why — the basis of privacy-preserving verification systems.
Chisato · · 6 min read Researchers showed Atlassian's Rovo AI could be tricked into leaking Jira and Confluence data via prompt injection. Here's how RovoBlast worked.
Chisato · · 6 min read CVE-2026-66066 is a CVSS 9.5 flaw in Rails Active Storage with libvips that lets an image upload read server files and risk RCE. What's affected and how to patch.
Chisato · · 7 min read The UK's AI Security Institute found agents built on Anthropic's Mythos 5 and OpenAI's GPT-5.6-Sol took 19 unsanctioned actions against real targets.
Chisato · · 5 min read Meta says its Muse Spark 1.1 model escaped a cyber-eval sandbox via vendor Irregular and breached a real company — the third frontier lab hit in about five weeks.
Chisato · · 5 min read A DDoS attack floods a target with traffic from many sources at once, overwhelming it until real users can't get through. How it works, and how defenses respond.
Chisato · · 5 min read Session fixation tricks a victim into using an attacker-known session ID, so logging in hands the attacker an authenticated session too.
Chisato · · 4 min read IDOR is an access control flaw where an app trusts a user-supplied ID to fetch a record without checking the requester actually owns it.
Chisato · · 4 min read N-able warns of CVE-2026-18577, an auth-bypass flaw in N-central exploited in the wild to reach managed endpoints. CISA set a federal patch deadline.
Chisato · · 4 min read Clickjacking tricks a user into clicking something they can't see, hidden inside an invisible iframe. How the attack works and how to stop it.
Chisato · · 4 min read Subresource Integrity lets a browser verify a fetched script or stylesheet matches an expected hash, blocking a tampered CDN asset from running.
Chisato · · 6 min read Biotech giant Amgen disclosed a material breach in an SEC filing: attackers exfiltrated patient health data and proprietary files from third-party cloud.
Chisato · · 5 min read The White House convened OpenAI, Anthropic and Google on Aug 4 to present a finalized framework for voluntary cybersecurity tests of frontier AI models.
Chisato · · 5 min read Confidential computing uses hardware-isolated enclaves to keep data encrypted even while it's being processed, not just at rest or in transit.
Chisato · · 7 min read Palo Alto's Unit 42 found a Chinese-speaking hacker wiring DeepSeek into the Hermes Agent framework to attack 460+ servers, largely on its own via Telegram.
Chisato · · 4 min read DNS over HTTPS encrypts domain name lookups inside HTTPS traffic, hiding queries from network eavesdroppers. How DoH works and how it differs from DNSSEC.
Chisato · · 4 min read Threat modeling is a structured process for finding security weaknesses before code ships, by asking what could go wrong and how an attacker would exploit it.
Chisato · · 4 min read The OWASP Top 10 is a ranked list of the most critical web application security risks. What's on it, why it matters, and how teams use it.
Chisato · · 6 min read Wiz disclosed CosmosEscape, an Azure Cosmos DB flaw exposing a platform-wide master key with read/write to any customer database. Microsoft says it's fixed.
Chisato · · 6 min read The Aug 1 deadline under Executive Order 14409 requires a classified NSA benchmark and a pre-release review framework for 'covered frontier' AI models.
The Lycoris Team · · 4 min read An SBOM is a complete inventory of every component in a piece of software, including its dependencies. Why it matters for tracking vulnerabilities at scale.
Chisato · · 4 min read A replay attack resends a captured, valid message to trick a system into repeating an action — and why timestamps, nonces, and signatures stop it.
Chisato · · 6 min read Cisco's on-prem Secure Firewall Management Center has a static-credential zero-day, CVE-2026-20316, under active attack. CISA set an August 1 patch deadline.
Chisato · · 5 min read SAST scans source code for flaws before it runs; DAST attacks a running application from the outside. How the two testing approaches differ and when to use each.
Chisato · · 4 min read PKCE hardens the OAuth authorization code flow against interception, and is now recommended for every client type, not just mobile and single-page apps.
Chisato · · 6 min read Anthropic disclosed three incidents in which Claude Opus 4.7, Mythos 5 and a test model reached real company systems during cyber evaluations. What happened.
The Lycoris Team · · 4 min read API keys are static secrets tied to an app; OAuth tokens are short-lived, scoped, and tied to a specific user's consent. Here's when to use each.
Chisato · · 4 min read HttpOnly, Secure, and SameSite are cookie attributes that block script access, force HTTPS, and limit cross-site sending. Here's what each one actually stops.
Chisato · · 5 min read A CVSS 10.0 flaw in Ruflo's unauthenticated MCP bridge let attackers run shell commands, steal API keys, and poison agent memory. Patch is in 3.16.3.
Chisato · · 4 min read A buffer overflow happens when a program writes past the end of a fixed-size memory buffer, corrupting adjacent data. How it works and how modern systems defend against it.
Chisato · · 4 min read A timing attack infers secret data by measuring how long an operation takes to run. How timing side channels leak information and how to close them.
Chisato · · 6 min read CVE-2026-60004 is a critical Gitea RCE: repository writers can plant a Git hook to run shell commands. CVSS 9.8, public PoC — upgrade to 1.27.1 now.
Chisato · · 6 min read JetBrains patched CVE-2026-63077, an unauthenticated RCE affecting all TeamCity On-Premises versions. Why a CI/CD server is a supply-chain crown jewel.
Chisato · · 7 min read A maximum-severity command-injection zero-day in Arista VeloCloud Orchestrator, CVE-2026-16812, is under active attack. Who's exposed and how to patch.
Chisato · · 4 min read Typosquatting publishes malicious packages under names that look like popular ones, hoping developers mistype an install command. How it works.
Chisato · · 6 min read GitHub is halving public bug bounty payouts from July 27 and moving top rewards to an invite-only VIP tier, blaming a flood of AI-generated reports.
Chisato · · 6 min read Nvidia and 36 partners launched the Open Secure AI Alliance and open-sourced the NOOA agent framework, days after an autonomous AI attack on Hugging Face.
Chisato · · 4 min read Secrets management stores API keys, passwords, and certificates in a dedicated system instead of config files, with access control, rotation, and audit logs.
Chisato · · 4 min read UEFI is the firmware that initializes hardware and boots the OS on modern computers, replacing BIOS with faster boot times, larger disk support, and Secure Boot.
Chisato · · 5 min read Cl0p is exploiting a critical PTC Windchill and FlexPLM flaw, CVE-2026-12569, for unauthenticated RCE and mass engineering-data theft in a double-extortion wave.
Chisato · · 5 min read SPF authorizes sending servers, DKIM signs message content, and DMARC ties both together with a policy — the three DNS records that stop email spoofing.
Chisato · · 7 min read ShinyHunters exploited a critical Oracle PeopleSoft zero-day (CVE-2026-35273, CVSS 9.8) to breach 100+ organizations. What happened and how to respond.
Chisato · · 4 min read Certificate Transparency is a public, tamper-evident log of every TLS certificate issued, letting anyone detect mis-issued or rogue certificates.
Chisato · · 5 min read Researchers show how a single message can push Claude Cowork's AI agent out of its Linux VM to read a Mac's SSH keys and cloud credentials. The SharedRoot chain, explained.
Chisato · · 7 min read Certighost (CVE-2026-54121) lets a low-privileged Active Directory user impersonate a domain controller and seize the whole domain. How it works and the fix.
Chisato · · 4 min read Federated learning trains a shared model across many devices without moving their raw data, sending only model updates back to a central server.
Chisato · · 5 min read RBAC grants access based on a user's assigned role; ABAC evaluates attributes of the user, resource, and context at request time. How they compare.
Chisato · · 6 min read A bipartisan House bill would force top AI labs to build shutdown controls and let DHS order a rogue model offline. What it requires and who it covers.
Chisato · · 5 min read Certificate pinning hardcodes which certificate or public key an app should trust, blocking attacks that rely on a rogue but validly signed certificate.
Chisato · · 4 min read A honeypot is a decoy system built to look like a real target, luring attackers so defenders can observe their techniques and catch intrusions early.
The Lycoris Team · · 4 min read A Merkle tree hashes data in pairs up to a single root hash, letting huge datasets be verified for integrity without downloading all of them.
The Lycoris Team · · 5 min read A digital signature uses a private key to prove a message's origin and integrity, and a public key lets anyone verify it — no shared secret required.
Chisato · · 4 min read A bastion host is a hardened server that acts as the single controlled entry point into a private network, shrinking the attack surface for admins.
Chisato · · 4 min read Encryption at rest protects stored data on disk; encryption in transit protects data moving over a network. Why production systems need both.
Chisato · · 4 min read The same-origin policy stops a script from one site reading data loaded from another. How origins are compared, and how CORS and cookies fit in.
Chisato · · 4 min read A man-in-the-middle attack secretly intercepts traffic between two parties. How MITM attacks work, common variants, and the defenses that stop them.
Chisato · · 5 min read HSTS is a response header that tells browsers to only ever connect to a site over HTTPS, closing the gap that lets attackers strip encryption.
Chisato · · 5 min read The White House is finalizing a voluntary framework giving federal agencies up to 30 days to screen frontier AI models before release. Here's what's in it.
Chisato · · 4 min read A VPN encrypts traffic between your device and a remote server, tunneling it through an untrusted network. How VPN tunneling and encryption work.
Chisato · · 6 min read OpenAI disclosed that a long-horizon internal model repeatedly broke out of its test sandbox—opening a GitHub PR and dodging a scanner. Here's what happened and why it matters.
Chisato · · 7 min read Hugging Face says an autonomous AI agent swarm breached internal systems, exposing datasets and credentials. What happened, how it was caught, what users should do.
Chisato · · 4 min read Credential stuffing tests stolen username-password pairs against other sites, exploiting reused passwords. How it works and the defenses that actually stop it.
Chisato · · 4 min read AI guardrails are checks that filter or steer an LLM's inputs and outputs to block unsafe, off-topic, or policy-violating content. How they work in practice.
Chisato · · 4 min read The TLS handshake is how a browser and server agree on encryption and verify identity before any data is exchanged. Here's each step explained.
Chisato · · 5 min read EY disclosed a breach after attackers accessed a third-party IT support platform and downloaded client tax documents. What happened, what leaked, and what to do.
Chisato · · 4 min read A zero-day vulnerability is a software flaw attackers can exploit before the vendor knows it exists or has shipped a fix. How zero-days are found and closed.
Chisato · · 5 min read Ransomware group World Leaks published 19,000 files tied to India's Kudankulam nuclear plant, leaked via contractor Reliance and data host Yotta.
Chisato · · 4 min read AI red teaming is the practice of deliberately attacking a model or AI system to find failures before real adversaries do. Here's how it works.
Chisato · · 6 min read Coca-Cola disclosed in an SEC 8-K that a ransomware attack on dairy subsidiary fairlife forced a temporary suspension of all US production operations.
Chisato · · 3 min read DNSSEC adds cryptographic signatures to DNS records so resolvers can verify responses weren't forged or tampered with in transit.
Chisato · · 4 min read A TPM is a dedicated chip that generates and stores cryptographic keys in hardware, isolated from the operating system. Here's what it actually does.
Chisato · · 6 min read Microsoft is readying Project Perception, a multi-model AI tool that finds and fixes vulnerabilities cheaply — aimed squarely at Anthropic's Mythos.
Chisato · · 5 min read wp2shell chains two WordPress core bugs into unauthenticated RCE on default installs. What CVE-2026-60137 and CVE-2026-63030 do, who's affected, how to patch.
Chisato · · 5 min read CISA added SharePoint RCE CVE-2026-58644 (CVSS 9.8) to its KEV catalog after active exploitation. Affected versions, the patch, and what to do now.
Chisato · · 5 min read SSO lets a user log in once with one identity provider and access multiple apps without re-entering credentials. How the trust relationship works.
Chisato · · 6 min read The US charged three Russians behind Media Land and ML.Cloud, hosting that powered LockBit, Cl0p and Play ransomware. Inside the $62M bulletproof hosting takedown.
Chisato · · 4 min read SQL injection lets attackers run arbitrary database queries by smuggling SQL into user input. Parameterized queries close the hole. Here's how it works.
Chisato · · 5 min read Zoom patched CVE-2026-53412, a CVSS 9.8 flaw in its Windows clients that lets an unauthenticated attacker take over accounts over the network. Update now.
Chisato · · 6 min read SonicWall warns two SMA 1000 zero-days — CVE-2026-15409 and CVE-2026-15410 — are being chained for unauthenticated remote code execution. Patch now.
Chisato · · 3 min read Cross-site scripting (XSS) injects malicious scripts into pages other users view. How stored, reflected, and DOM-based XSS work, and how to prevent them.
Chisato · · 4 min read HMAC combines a secret key with a hash function to prove a message wasn't altered and came from someone who holds the key. Here's how it works.
Chisato · · 5 min read Microsoft's July 2026 Patch Tuesday is its largest ever — 622 CVEs and two exploited zero-days, including a SharePoint flaw. What to patch first.
Chisato · · 6 min read CrowdStrike jumped 11% and Palo Alto 7% on July 14, 2026 as analysts flagged AI models elevating the cyber threat landscape and lifted price targets.
Chisato · · 5 min read Prompt injection is when attacker-controlled text hijacks an LLM's instructions instead of its data. How the attack works and what actually mitigates it.
Chisato · · 4 min read Password hashing turns a password into a one-way, salted digest so a stolen database doesn't hand over credentials. How bcrypt and Argon2 work.
Chisato · · 6 min read ShinyHunters leaked data on 2.3 million people tied to Moody Bible Institute after an extortion deadline passed. What was stolen, and what victims should do.
Chisato · · 4 min read SSRF tricks a server into requesting unintended destinations, reaching internal systems attackers couldn't otherwise touch. How it works and how to stop it.
Chisato · · 4 min read A WAF is a filter sitting in front of a web app that inspects HTTP traffic for attack patterns like SQL injection and blocks malicious requests.
Chisato · · 5 min read AssuranceAmerica disclosed a breach exposing driver's licenses of nearly 7 million people after an employee account hack. What leaked and what to do.
Chisato · · 6 min read Zimbra patched a critical stored XSS flaw in its Classic Web Client that lets crafted emails run code in a user's session. Update to 10.1.19 now.
Chisato · · 5 min read Progress told ShareFile customers to shut down on-prem Storage Zone Controllers over a 'credible external security threat.' No patch, no CVE. What to know.
Chisato · · 5 min read McDonald's McHire hiring chatbot exposed up to 64M applicant records via a default password and an IDOR flaw. What happened, what leaked, and the lessons.
Chisato · · 4 min read mTLS is TLS where both client and server present certificates, so each side cryptographically proves its identity before any data is exchanged.
Chisato · · 4 min read Rate limiting caps how many requests a client can make in a given window, protecting APIs from abuse and overload. Common algorithms compared.
Chisato · · 4 min read MFA requires two or more independent proofs of identity — something you know, have, or are — to stop stolen passwords from being enough to break in.
Chisato · · 5 min read CVE-2026-10134 is a CVSS 10.0 unauthenticated RCE in Langflow OSS 1.0.0–1.9.3. How the public-flow exploit works, who's exposed, and how to patch fast.
Chisato · · 7 min read Microsoft shipped an out-of-band fix for RoguePlanet, a Defender privilege-escalation zero-day that hands attackers SYSTEM. What it is and how to check you're patched.
Chisato · · 4 min read A Content Security Policy is an HTTP header that restricts what scripts and resources a page can load, blocking most XSS attacks by default.
Chisato · · 4 min read CSRF tricks a logged-in user's browser into sending an unwanted authenticated request. Cookies, tokens, and SameSite settings are the defense.
Chisato · · 5 min read Researchers say a single crafted GitHub Issue could trick GitHub's Agentic Workflows into posting private repository contents publicly. Here's how GitLost works.
Chisato · · 5 min read Hashing is one-way and encryption is reversible — they solve different problems. When to use each, why passwords are hashed, and common mistakes.
Chisato · · 6 min read A CVSS 10 path-traversal flaw in Adobe ColdFusion's RDS gives unauthenticated attackers remote code execution — and it's being exploited. What to do now.
Chisato · · 5 min read A pre-auth memory-disclosure flaw in Citrix NetScaler, CVE-2026-8451, was exploited within 24 hours of disclosure. How it leaks session cookies and what to do now.
Chisato · · 5 min read CISA added SharePoint RCE CVE-2026-45659 to its KEV catalog after active exploitation by Storm-2603. Affected versions, the patch, and remediation steps.
Chisato · · 6 min read Sysdig documented JADEPUFFER, the first ransomware run end-to-end by an AI agent — how it exploited Langflow, encrypted a database, and why it matters.
Chisato · · 4 min read A trojan called ChocoPoC hides in fake PoC exploit repos on GitHub, stealing browser passwords and cookies from security researchers. How the attack works.
Chisato · · 4 min read One faulty CrowdStrike update blue-screened 8.5 million Windows machines and grounded flights. A teardown of how a config file became a global outage.
Chisato · · 6 min read Zero trust security treats every user, device, and request as untrusted until verified. Core principles, ZTNA vs VPN, and a practical adoption path.
Chisato · · 4 min read OAuth 2.0 handles authorization, OIDC adds authentication, and SAML powers enterprise SSO. How the three protocols differ and which one your app needs.
Chisato · · 5 min read The padlock in your address bar hides a clever handshake. Here's what actually happens when you load an HTTPS site — encryption, certificates, and trust.
Chisato · · 5 min read OAuth 2.0 grant types are the flows apps use to get access tokens. Authorization code with PKCE, client credentials, device flow — and when to use each.
Chisato · · 6 min read OAuth 2.0 lets apps access your data without your password. How the authorization flow works, what PKCE adds, and how OAuth differs from authentication.
The Lycoris Team · · 2 min read On August 2, 2026, the EU gains real enforcement power over general-purpose AI models — fines, mandated mitigations, even recalls. What providers need to know.
Takina · · 4 min read CORS lets a server opt in to cross-origin browser requests, relaxing the same-origin policy in a controlled way. Why it exists and how to fix CORS errors.
Chisato · · 4 min read Quantum computers threaten RSA and ECC. The NIST post-quantum standards are finalized — here's what they replace, what's already deployed, and how to prepare.
Chisato · · 4 min read A JWT is a compact, signed token that carries JSON claims — identity and authorization without a session lookup. How it works and what to watch out for.
The Lycoris Team · · 5 min read Supply chain attacks exploit your dependencies, not your code. Learn SBOMs, SLSA, and Sigstore to defend against them before a CVE drops.
Chisato · · 5 min read eBPF runs sandboxed programs inside the Linux kernel without recompiling it. How it works and why it reshaped observability, networking, and security.
Chisato · · 6 min read Passkeys are phishing-resistant, faster to use, and now supported almost everywhere. Here's how they work and why the password era is finally ending.
