TamperedChef Malvertising Uses US Shell Companies to Sign Trojanized Apps with Valid Certificates, Deploying Stealth Backdoor

New UK laws to strengthen critical infrastructure cyber defenses

https://www.bleepingcomputer.com/news/security/new-uk-laws-to-strengthen-critical-infrastructure-cyber-defenses/

Critical RCE Vulnerability CVE-2025-11953 Puts React Native Developers at Risk

https://www.reddit.com/r/netsec/comments/1oo9ic9/critical_rce_vulnerability_cve202511953_puts/

Grandparents to C-Suite: Elder Fraud Reveals Gaps in Human-Centered Cybersecurity

https://www.darkreading.com/cyber-risk/grandparents-to-c-suite-elder-fraud-reveals-gaps-in-human-centered-cybersecurity

EU Spectrum War: Will the Upper 6GHz Band Go to Wi-Fi 7 or 6G Networks?

https://securityonline.info/eu-spectrum-war-will-the-upper-6ghz-band-go-to-wi-fi-7-or-6g-networks/

Sora 2 Makes Videos So Believable, Reality Checks Are Required

https://www.darkreading.com/application-security/sora-2-makes-videos-so-believable-reality-checks-are-required

Critical Fortinet FortiWeb WAF Bug Exploited in the Wild

https://www.darkreading.com/application-security/critical-fortinet-fortiweb-waf-bug-exploited-in-wild

Critical IBM AIX RCE (CVE-2025-36250, CVSS 10.0) Flaw Exposes NIM Private Keys and Risks Directory Traversal

https://securityonline.info/critical-ibm-aix-rce-cve-2025-36250-cvss-10-0-flaw-exposes-nim-private-keys-and-risks-directory-traversal/

RondoDox botnet malware now hacks servers using XWiki flaw

https://www.bleepingcomputer.com/news/security/rondodox-botnet-malware-now-hacks-servers-using-xwiki-flaw/

Microsoft Patch Tuesday, November 2025 Edition

https://krebsonsecurity.com/2025/11/microsoft-patch-tuesday-november-2025-edition/

Update now: November Patch Tuesday fixes Windows zero-day exploited in the wild

https://www.malwarebytes.com/blog/news/2025/11/update-now-november-patch-tuesday-fixes-windows-zero-day-exploited-in-the-wild

Pentesting Next.js Server Actions

https://www.reddit.com/r/netsec/comments/1of84hu/pentesting_nextjs_server_actions/

Modding And Distributing Mobile Apps with Frida

https://www.reddit.com/r/netsec/comments/1oe43pb/modding_and_distributing_mobile_apps_with_frida/

pyLDAPGui - Python based GUI for browsing LDAP

https://www.reddit.com/r/netsec/comments/1nh8qvn/pyldapgui_python_based_gui_for_browsing_ldap/

pyghidra-mcp: Headless Ghidra MCP Server for Project-Wide, Multi-Binary Analysis

https://www.reddit.com/r/netsec/comments/1muobce/pyghidramcp_headless_ghidra_mcp_server_for/

Snoop - OSINT Tool For Research Social Media Accounts By Username

http://www.kitploit.com/2025/04/snoop-osint-tool-for-research-social.html

Implementing the Etherhiding technique

https://www.reddit.com/r/netsec/comments/1orqn0f/implementing_the_etherhiding_technique/

Privescing a Laptop with BitLocker + PIN

https://www.reddit.com/r/netsec/comments/1oe6hrc/privescing_a_laptop_with_bitlocker_pin/

Yet Another Random Story. VBScript's Randomize Internals.

https://www.reddit.com/r/netsec/comments/1nq3i96/yet_another_random_story_vbscripts_randomize/

Fine-grained HTTP filtering for Claude Code

https://www.reddit.com/r/netsec/comments/1nff57n/finegrained_http_filtering_for_claude_code/

Practical guide for hunters: how leaked webhooks are abused and how to defend them

https://www.reddit.com/r/netsec/comments/1njbx3q/practical_guide_for_hunters_how_leaked_webhooks/

HPC Technical Expert - TS/SCI/FSP

Company: CrowdCyber

Location: Annapolis Junction, MD

Technical Writer II - Cyber - TS/SCI/FSP

Company: CrowdCyber

Location: Annapolis Junction, MD

Information System Security Engineer 2 - TS/SCI/FSP

Company: CrowdCyber

Location: Annapolis Junction, MD

Windows Cyber Software Engineer - TS

Company: CrowdCyber

Location: Chantilly, VA

CyberSecurity Engineer - TS/SCI

Company: CrowdCyber

Location: Annapolis Junction, MD

Windows Reverse Engineer - Top Secret - Full Scope

Email Us to talk about our Candidates!

Linux Cyber Software Engineer - Top Secret - Full Scope

Email Us to talk about our Candidates!

Apple iOS Cyber Software Engineer - Top Secret SCI

Email Us to talk about our Candidates!

Mobile Android Cyber Software Engineer - Top Secret - Poly

Email Us to talk about our Candidates!

Windows Vulnerability Researcher - Top Secret - Full Scope Poly

Email Us to talk about our Candidates!

Apple’s Bug Bounty Program

https://www.schneier.com/blog/archives/2025/10/apples-bug-bounty-program.html

Zeroday Cloud hacking contest offers $4.5 million in bounties

https://www.bleepingcomputer.com/news/security/zeroday-cloud-hacking-contest-offers-45-million-in-bounties/

Google now pays $250,000 for KVM zero-day vulnerabilities

https://www.bleepingcomputer.com/news/security/google-now-pays-250-000-for-kvm-zero-day-vulnerabilities/

Bug Bounty: An Economic Disadvantage for Researchers?

https://www.digitaloperatives.com/2023/07/29/bug-bounty-an-economic-disadvantage-for-researchers/

Google Pixel Titan M with Persistence - Zero click Up to $1,000,000

https://bughunters.google.com/about/rules/6171833274204160/android-and-google-devices-security-reward-program-rules

Whisper Leak: Attack Infers Encrypted AI Chat Topics with 98%+ Accuracy

https://securityonline.info/whisper-leak-attack-infers-encrypted-ai-chat-topics-with-98-accuracy/

Quantifying Swiss Cheese, the Bayesian Way

https://www.reddit.com/r/netsec/comments/1oluzam/quantifying_swiss_cheese_the_bayesian_way/

Evading Elastic EDR's call stack signatures with call gadgets

https://www.reddit.com/r/netsec/comments/1opyr37/evading_elastic_edrs_call_stack_signatures_with/

[Research] Unvalidated Trust: Cross-Stage Failure Modes in LLM/agent pipelines arXiv

https://www.reddit.com/r/netsec/comments/1onseux/research_unvalidated_trust_crossstage_failure/

The AI-Designed Bioweapon Arms Race

https://www.schneier.com/blog/archives/2025/10/the-ai-designed-bioweapon-arms-race.html

Operation Triangulation: What You Get When Attack iPhones of Researchers

https://media.ccc.de/v/37c3-11859-operation_triangulation_what_you_get_when_attack_iphones_of_researchers

Our Polymorphic Reverse Shell Generator beat EVERY AV!

https://m.youtube.com/watch?v=9kAq-OO72Uk

How Hackers Hide From Memory Scanners

https://youtu.be/WYuhJzngfVc?si=KYvedCuIOsItE7sc

How Hackers Exploit Vulnerable Drivers

https://youtu.be/ELVdDwvELKY?feature=shared

DEF CON 31 - Weaponizing Plain Text ANSI Escape Sequences as a Forensic Nightmare - STÖK

https://m.youtube.com/watch?v=3T2Al3jdY38&feature=youtu.be

FX of Phenoelit - @41414141

https://twitter.com/41414141

vx-underground - @vx-underground

https://twitter.com/vx-underground

BTCillustrated - @BTCillustrated

https://www.twitter.com/btcillustrated

Halvar Flake - @halvarflake

https://twitter.com/halvarflake

Dave Aitel - @daveaitel

https://twitter.com/daveaitel

Prompt Injection in AI Browsers

https://www.schneier.com/blog/archives/2025/11/prompt-injection-in-ai-browsers.html

AI App Spending Report: Where Are the Security Tools?

https://www.darkreading.com/cybersecurity-operations/ai-app-spending-report-where-are-the-security-tools

AI Agents Are Going Rogue: Here's How to Rein Them In

https://www.darkreading.com/cyber-risk/ai-agents-going-rogue

OpenAI plans to release GPT-5.1, GPT-5.1 Reasoning, and GPT-5.1 Pro

https://www.bleepingcomputer.com/news/artificial-intelligence/openai-plans-to-release-gpt-51-gpt-51-reasoning-and-gpt-51-pro/

42.5 ExaFLOPS: Google Launches Ironwood TPU to Power Next-Gen Agentic AI

https://securityonline.info/42-5-exaflops-google-launches-ironwood-tpu-to-power-next-gen-agentic-ai/

TamperedChef Malvertising Uses US Shell Companies to Sign Trojanized Apps with Valid Certificates, Deploying Stealth Backdoor

https://securityonline.info/tamperedchef-malvertising-uses-us-shell-companies-to-sign-trojanized-apps-with-valid-certificates-deploying-stealth-backdoor/

Shai-Hulud malware infects 500 npm packages, leaks secrets on GitHub

https://www.bleepingcomputer.com/news/security/shai-hulud-malware-infects-500-npm-packages-leaks-secrets-on-github/

Iran APT SpearSpecter Uses Weeks-Long WhatsApp Lures and Fileless TAMECAT Backdoor to Hit Defense

https://securityonline.info/iran-apt-spearspecter-uses-weeks-long-whatsapp-lures-and-fileless-tamecat-backdoor-to-hit-defense/

Akira RaaS Targets Nutanix VMs, Threatens Critical Orgs

https://www.darkreading.com/threat-intelligence/akira-raas-nutanix-vms-critical-orgs

North Korea’s Contagious Interview APT Uses JSON Keeper and GitLab to Deliver BeaverTail Spyware

https://securityonline.info/north-koreas-contagious-interview-apt-uses-json-keeper-and-gitlab-to-deliver-beavertail-spyware/

CoinTelegraph Hacked: Fake CTG Airdrop Scam Steals Crypto Via Malicious Pop-Ups

https://securityonline.info/cointelegraph-hacked-fake-ctg-airdrop-scam-steals-crypto-via-malicious-pop-ups/

Cencora’s $75 Million Ransom: A New High in Cyber Extortion

https://securityonline.info/cencoras-75-million-ransom-a-new-high-in-cyber-extortion/

FBI warns against using unlicensed crypto transfer services

https://www.bleepingcomputer.com/news/security/fbi-warns-against-using-unlicensed-crypto-transfer-services/

iOS v17.4 Beta 2 Nerfs (Some) Progressive Web Apps for EU Users

https://www.nobsbitcoin.com/ios-v17-4-beta2-undermines-progressive-web-apps-pwas-for-eu-users/

CoinCenter: Broad, Ambiguous, or Delegated: Constitutional Infirmities of the Bank Secrecy Act

https://www.coincenter.org/broad-ambiguous-or-delegated-constitutional-infirmities-of-the-bank-secrecy-act/

Flok License Plate Surveillance

https://www.schneier.com/blog/archives/2025/10/flok-license-plate-surveillance.html

Privacy Alert: Meta to Use User-AI Conversations to Target Ads Across Facebook and Instagram

https://securityonline.info/privacy-alert-meta-to-use-user-ai-conversations-to-target-ads-across-facebook-and-instagram/

LinkedIn will use your data to train its AI unless you opt out now

https://www.malwarebytes.com/blog/news/2025/09/linkedin-will-use-your-data-to-train-its-ai-unless-you-opt-out-now

TikTok is misusing kids’ data, says privacy watchdog

https://www.malwarebytes.com/blog/news/2025/09/tiktok-is-misusing-kids-data-says-privacy-watchdog

Police using drones to read your license plates, warns EFF

https://www.malwarebytes.com/blog/news/2025/09/police-using-drones-to-read-your-license-plates-warns-eff

Details About Chinese Surveillance and Propaganda Companies

https://www.schneier.com/blog/archives/2025/09/details-about-chinese-surveillance-and-propaganda-companies.html

The Great Firewall Leaks: A 600GB Trove of Secrets Exposed

https://securityonline.info/the-great-firewall-leaks-a-600gb-trove-of-secrets-exposed/

Tor needs 200 new WebTunnel bridges to fight censorship

https://www.bleepingcomputer.com/news/security/tor-needs-200-new-webtunnel-bridges-to-fight-censorship/

Meta plans retention 'hooks' for Threads as more than half of users leave app

https://www.reuters.com/business/media-telecom/meta-plans-retention-hooks-threads-more-than-half-users-leave-app-2023-07-28/?taid=64c3b01ee6cfe30001c4540f&utm_campaign=trueAnthem:+Trending+Content&utm

EFF: The U.K. Government Is Very Close To Eroding Encryption Worldwide

https://www.eff.org/deeplinks/2023/07/uk-government-very-close-eroding-encryption-worldwide

Aircrack Cheat Sheet

https://raw.githubusercontent.com/Ignitetechnologies/Mindmap/main/aircrack/Aircrack-ng%20%20UHD.png

How a Load Balancer Works

https://pbs.twimg.com/media/F5-ByLvXkAASw3j?format=jpg&name=4096x4096

Process Injection

https://4.bp.blogspot.com/-ixv5E0LMZCw/WWi5yRjL-_I/AAAAAAAAAnk/WO99S4Yrd8w6lfg6tITwUV02CGDFYAORACLcBGAs/s1600/Process%2BInjection%25281%2529.png

Argument Map on Restricting Encryption

https://www.argumentenfabriek.nl/wp-content/uploads/2021/11/EN-Argumentenkaart-inperking-encryptie.pdf

OSCP Enumeration Cheat Sheet

https://pbs.twimg.com/media/F2HWy_LWgAI5hT1?format=jpg&name=4096x4096

Google Chrome's new post-quantum cryptography may break TLS connections

https://www.bleepingcomputer.com/news/security/google-chromes-new-post-quantum-cryptography-may-break-tls-connections/

Companies, countries battle to develop quantum computers | 60 Minutes

https://youtu.be/K4ssT6Dzmnw

An Efficient Quantum Factoring Algorithm

https://arxiv.org/abs/2308.06572

You Can’t Rush Post-Quantum-Computing Cryptography Standards

https://www.schneier.com/blog/archives/2023/08/you-cant-rush-post-quantum-computing-standards.html?utm_source=dlvr.it&utm_medium=twitter

Supercomputer makes calculations in blink of an eye that take rivals 47 years

https://www.telegraph.co.uk/business/2023/07/02/google-quantum-computer-breakthrough-instant-calculations/

The Human Rights Foundation Announces 20 Btc Bounty Challenge For Bitcoin Development

https://bitcoinmagazine.com/business/human-rights-foundation-announces-20-btc-bounty-challenge-for-bitcoin-development

Open-Sourcing the Design Guide: 2 BTC to port the Bitcoin UI Kit from Figma to an open-source Penpot project.

https://hrfbounties.org/

Serverless Payjoin: 2 BTC to deploy a production-ready version 2 payjoin protocol which may send and receive Payjoin transactions without requiring a sender or recipient to operate a public server.

https://hrfbounties.org/

E2EE Group Chats: 2 BTC for the creation of end to end encrypted group chats powered by any popular Nostr client that does not leak metadata

https://hrfbounties.org/

Silent payments: 2 BTC for a mobile wallet which can send and receive Silent Payments in a private manner without requiring the user to run a full node

https://hrfbounties.org/

Free test for Post-Quantum Cryptography TLS

https://www.reddit.com/r/netsec/comments/1oqsojn/free_test_for_postquantum_cryptography_tls/

Signal’s Post-Quantum Cryptographic Implementation

https://www.schneier.com/blog/archives/2025/10/signals-post-quantum-cryptographic-implementation.html

Part Four of The Kryptos Sculpture

https://www.schneier.com/blog/archives/2025/10/part-four-of-the-kryptos-sculpture.html

Signal adds new cryptographic defense against quantum attacks

https://www.bleepingcomputer.com/news/security/signal-adds-new-cryptographic-defense-against-quantum-attacks/

Journeys in Hosting 1/x - Precomputed SSH Host Keys

https://www.reddit.com/r/netsec/comments/1no01xq/journeys_in_hosting_1x_precomputed_ssh_host_keys/

The Cloud Edge Is the New Attack Surface

https://www.darkreading.com/cloud-security/cloud-edge-new-attack-surface

Hybrid Clouds Provide a Practical Approach to Post-Quantum Migration

https://www.darkreading.com/cybersecurity-operations/a-practical-approach-for-post-quantum-migration-with-hybrid-clouds

Cloud Threat Hunting and Defense Landscape

https://www.recordedfuture.com/research/cloud-threat-hunting-defense-landscape

US Senator Wyden Accuses Microsoft of ‘Cybersecurity Negligence’

https://www.securityweek.com/us-senator-wyden-accuses-microsoft-of-cybersecurity-negligence/

The 10 Humorous But Immutable Laws of Cloud Security

https://www.digitaloperatives.com/2023/07/18/the-10-humorous-but-immutable-laws-of-cloud-security/

vuls: Vuls is an agent-less vulnerability scanner for various platforms and applications. 6 recent commits. Latest release: v0.35.1.

https://github.com/future-architect/vuls

devguard: DevGuard secures software supply chains through attestation-based compliance and vulnerability management. 22 recent commits. Latest release: v0.17.5.

https://github.com/l3montree-dev/devguard

BBtool: BBtool is a user-friendly penetration testing tool for security researchers and ethical hackers. 1 recent commits.

https://github.com/Physiotherapist16/BBtool

Mobile-Security-Framework-MobSF: Mobile-Security-Framework-MobSF performs automated mobile app security testing and analysis for Android, iOS, and Windows devices. 1 recent commits. Latest release: v4.4.2.

https://github.com/MobSF/Mobile-Security-Framework-MobSF

CVE-2016-10708: This project exploits a vulnerability in OpenSSH versions prior to 7.4 through malicious SSH packets. 2 recent commits.

https://github.com/lggcs/CVE-2016-10708

Joas A Santos (@CyberSecurityUP): Joas A Santos is a cybersecurity expert with experience as a Red Team Lead and Information Security Researcher. 4064 followers. Known for ShadowPhish (209 stars). Expert in Red Team Operations.

https://github.com/CyberSecurityUP

sonyahack1 (@sonyahack1): SonyaHack1 is a cybersecurity developer specializing in penetration testing and red team operations with notable work on VulnHub and HackTheBox. 42 followers. Known for kids_2.0-Tasks (0 stars). Expert in Penetration Testing, Red Team Operations.

https://github.com/sonyahack1

Art of Hacking (@The-Art-of-Hacking): Omar Santos is a cybersecurity developer specializing in ethical hacking, penetration testing, and digital forensics with notable tools like h4cker and Weevely. 2983 followers. Known for h4cker (23348 stars). Expert in Exploit Development, Incident Response.

https://github.com/The-Art-of-Hacking

sickcodes (@sickcodes): Sickcodes is a cybersecurity developer with expertise in security research and open-source development of notable projects like no-sandbox and Docker-OSX. 2664 followers. Known for no-sandbox (186 stars). Expert in Exploit Development, Security Scanning.

https://github.com/sickcodes

kader m (@cyn00b): kader m is a cybersecurity developer specializing in API and framework vulnerability testing with notable open-source contributions. 61 followers. Known for Windows-Exploit-Suggester (1 stars). Expert in Exploit Development.

https://github.com/cyn00b