“It is possible to unintentionally offend others, not necessarily due to an incorrect stance, but rather due to a difference in perspective.”

GMO不正アクセス犯のサイト、@Namecheap のabuseに通報済み。普通レンサバなので時期banされると思われ ip:198.54.116.91 This site is involved in illegal hacking, extortion, and leaking personal data. Please take urgent abuse action. @NamecheapCEO

uCreator Chinese commercial Android surveillance platform targeting apps like Telegram and WeChat IOCs (SHA-256) 2fc4bad71eda25b9022ea7cb090d6419911ecd67e50e746b418f8a617a980301 (com.ucreator[.]tg / main_module_2.8.6) 0142749a159be3e41d28f910eebf28b577a282880bd0c2383bd7404189f4ff94 (com.uckj.tgx) dcec9640271a782553599197bcb85367971a5bb4aa84c3787d1e49a3f4f9420e (org.thunderdog.challegram repack) 805834e6b8c12e180117a1816b48e387c33b53520f5a91cbf858441dc895e717 (org.telegram.messenger.web repack) a90e3ab2b5cf306439a378faf7107a89196116ad7ee4ad5791c2ba8839ba21c4 (org.thunderdog.challegram / tgx_QX) f82ac2c525d1ed82e57b3f27ae689aeda46875a893ca4c42876b3166ba66bb20 (com.ucreator[.}va_vx) 99c5be579d218acfd2c7e2662528e7ad32a1a605d8efd1da732c13931bc30c4c (com.ucreator[.]va_yjb_client / Onion Box) 9c8b147f76312e651faabb1411a3270efca984dd8f33bd8ded3ea611c7c583a1 (uip.exe) 0x0v1.com/ucreator-virtualiz… #cybersecurity #telegram #wechat #malware

ToxicPanda analysis. By @anyrun_app IOCs IP addresses 192.178.183[.]101 167.150.100[.]108 142.251.14[.]100 142.251.154[.]119 176.97.118[.]95 85.137.51[.]152 142.251.14[.]95 142.251.14[.]138 142.251.150[.]120 3.5.149[.]148 18.140.122[.]166 188.114.97[.]3 34.104.35[.]123 142.251.127[.]81 142.251.127[.]84 142.251.153[.]119 216.239.35[.]8 188.114.96[.]3 3.5.147[.]122 142.251.156[.]119 Domains mjjw0hn96zvgk.s3.ap-southeast-1.amazonaws[.]com www.cctvv4[.]com [blocked] 52z5rtlcbge63cduwsjlngnsvm0gnect.lambda-url.ap-southeast-1.on[.]aws api.globalgamingplatform[.]com www.whh6666[.]com [blocked] fuqbeanifo2vg.s3.ap-southeast-1.amazonaws[.]com xjfpkkcpsuc35liqwmixmu3r4q0wltyi.lambda-url.ap-southeast-1.on[.]aws nv9cdrlpw1l8ctc.s3.ap-southeast-1.amazonaws[.]com #CyberSecurity

Sirius Backdoor Delivered Through Korean-Language PDF Phishing. By @Trellix IOCs dubaitechnicalservice[.]ae 39993389e1e95ebbd55aa54058cf7b52 3cc5147d1dbe295c63da958afadac6c6 6da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4 6ffcf5f7aa4b3b75b06bd7a7f49366a8 7ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca105 87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f51 185.114.206[.]45 #cybersecurity #ThreatIntelligence

The Brotli RCE in Node.js is brutal! CVE-2026-111497 affects all three supported major lines: 22.0.0-22.23.3, 24.0.0-24.22.0, and 26.0.0-26.12.0. One sleepless night with GLM-5.3 and DeepSeek V4.1 Flash 1017, plus $26.80 in tokens, and I had a reliable PoC across those versions on Linux arm64 and x86_64 with ASLR and UV_THREADPOOL_SIZE independent vectors for all 84 builds. But I wouldn't call it suitable for blind black-box testing. I ran 14,877 fresh exploit attempts - every ARM target against every ARM and x86 profile, each in a fresh lab. Wrong profiles are destructive: 58.3% crashed the lab (56.4% ARM profiles, 60.2% x86 profiles replayed on ARM). And HTTP-only fingerprinting was useless: all 87 builds returned byte-identical responses, so you cannot safely guess the profile without force/out-of-band info. Bug bounty hunters, please do not spray profiles at production :) Nine years ago, when I started my career as a Node.js SWE, I never imagined that an ordinary body-parser setup on a Node.js runtime could become an RCE entry point. 2026 keeps surprising me. And it's making me look at attack surfaces differently... Huge respect to the researchers who found this bug

UPDATE: Israeli company we caught delivering zero-click infections is #1 bidder on Starlink ads in 105 countries. Data from @trendai_RSRCH suggests worldwide surveillance op targeting @Starlink users. 1/ By @razhael reuters.com/business/media-t…

日本語マルウェアメールの接到を確認しています。また、組織の代表を騙ったメールも確認しています。 #ScreenConnect 件名: ①<組織名> 2026年度第3四半期 （10月30日までにご対応ください） 　②Re:【業務連絡】 <組織名> 　③Re:【業務連絡】 <組織名>

🚨 Dahua IP cameras compromised in Ukraine. CERT-UA confirms attackers gained access to video feeds, changed device settings, and created rogue accounts. The attacks exploit Easy4IP P2P access alongside weak passwords or authentication bypass flaws. Full details ↓ thehackernews.com/2026/10/at…

We observed in-the-wild exploitation of CVE-2026-102785 on a site running a vulnerable version of YOOtheme Pro two days after the patch. Scanners planted JPEG/PHP polyglot webshells in uploads, then operators deployed an ALFA webshell. Details: bit.ly/48fpUZ3

Announcing 3 Critical vulns for hundreds of millions of IoT, Firewalls, OT, and Military devices including: Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi, Lockheed Martin, Boeing... The vulns are with GoAhead Web Server which is a backend library used by these devices. There's a patch available from GoAhead but that doesn't mean there's a patch available for the devices yet -- that's up to the manufacturer. - TLS traffic over DHE ciphers have a 1-byte secret, "04", meaning anyone can decrypt connections to these devices and steal login credentials and session tokens if the client negotiated with DHE ciphers like the latest TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, which is extremely likely. - LibreSSL mTLS has been completely bypassed, meaning anyone can connect over mTLS. If you have one of these devices listening on the internet and are expecting mTLS to protect it from attackers, take it offline or patch asap. - OpenSSL Certificate Revocation Lists (CRLs) are not enforced, meaning if a user device is stolen or compromised, and you revoke that mTLS cert, nothing actually happens. There are a lot of other attacks this can be used for. These are critical because these types of devices run our world. Water systems, electricity, military, firewalls, critical infrastructure. foxio.io/blog/choose-your-ba…

【お名前VPS ランサム攻撃の痕跡確認方法（暫定）】 犯人が公開したZIPに含まれる10件のPC情報は、すべて以下のフォルダに出力されていました。 C:\ProgramData\USOShared\RdTmp\ つまり、このフォルダが存在するかどうかで、攻撃の痕跡をチェックできるかも、と考えました。。 C:\ProgramData\USOShared\ というフォルダ自体は、Windows Updateで使用される正規です。その先に異常があるか、ないか。 お名前.com VPS利用者の方は、ご確認お願いします。（まだ今のところ該当報告は見つかっていません） ★痕跡チェックのポイント ・C:\ProgramData\USOShared\のフォルダ確認 ・正常：通常は Logs\ フォルダがあり .etl 形式のログが保存されています ・異常：RdTmp\ ディレクトリや不審な .exe等があれば、今回の攻撃に関連する痕跡の可能性 ・連絡：痕跡があった場合は、証拠をGMO等に連絡。必要に応じてバックアップ後のOS再構築も検討 ※痕跡がなくても、安全が保証されるわけではありません ・10/27（本日）12:00に犯人がランサム攻撃を予告済み #GMO あ

Our demo shows PHP2Shell giving a shell on MediaWiki, Symfony, Laravel, and phpBB. We’ve confirmed exploits work on pre-patch releases of PHP 8.2–8.5. If you haven’t updated, assume attackers can compromise your server, and that exploitation will only get easier.

KillaBoi ha publicado un exploit de PHP2Shell que, según dice, consigue ejecución remota de código con ASLR activado. github.com/KillaBoi/StealMyB… El desarrollo está relacionado con un desafío público de seguridad resuelto el 25 de octubre a las 15:47 UTC, por el que recibió aproximadamente 2.000 dólares en Bitcoin. La diferencia respecto a los PoC anteriores es que ahora existe código público acompañado de una explicación técnica detallada y resultados de laboratorio reproducibles. Lo que ha probado: - Agotamiento de memoria durante el procesamiento de peticiones multipart. - Divulgación de direcciones del heap mediante cookies de sesión. - Divulgación de una dirección de código PHP para superar ASLR. - Construcción de una estructura interna falsa que provoca una llamada a la función PHP system(). Pero, la imagen Docker utilizada, aunque llevaba la etiqueta php:8.4.26-fpm-alpine3.23, se ejecutó con php -S, no PHP-FPM, por tanto no es reproducible en Apache + PHP-FPM. El propio KillaBoi dice que los desplazamientos de memoria usados dependen de la compilación y que el exploit no funciona directamente contra una imagen Debian PHP-FPM con la misma versión de PHP. A pesar de la mejora de su PoC, es una pequeña trampa, porque sigue sin demostrar que se pueda atacar exitosamente un PHP-FPM Este, como explicaba ayer, es el desafío que falta para que PHP2Shell acabe siendo un problema de dimensiones apocalípticas. Seguimos vigilantes.

Silver Fox phishing email targeted Malaysia. Domain IOCs homescapestaging[.]com segertribute[.]com musicmaxentertain[.]com celialinde[.]com samoliveira[.]com thinnected[.]com brendaeverson[.]com ccaselma[.]com ecomteck[.]com shengshunxin[.]com mohammadinuts[.]com cc @salmanvsf

26日、「サイバーセキュリティに関する関係閣僚会議」が開催され、総理から、来週中を目途に『緊急対策パッケージ』を取りまとめるよう指示がありました。被害企業への支援強化、情報集約体制・情報発信の強化、アクセス・無害化措置を含む対処、システムの脆弱性検証等に、政府一丸で取り組みます。

没想到造飞行滑板这哥们儿初中都没毕业 看来在当今这个信息时代，AI才是最好的老师。只要你肯自学，哪怕是在农村山咔咔里，一样可以学到全世界最前沿的知识。只要有梦想和执行力，哪怕是再低的起点也能一飞冲天

Today we released WhisperHijack, a stealthy process injection PoC that uses thread descriptions to inject payloads into remote processes, then patches a waiting thread's return address for execution. Every memory op happens in-target via Queue APCs, with zero NtWriteVirtualMemory or NtSetContextThread calls. Based on @hasherezade TNC + WTH research. github.com/Maldev-Academy/Wh…

Emergency WAF ruleset update for 2026-10-25 adds two new detections for CVE-2026-111497. They default to log mode so you can audit impact. Check existing overrides to avoid false positives. developers.cloudflare.com/ch…

🇨🇳 Chinese Threat Actor - 12.5K+ Targets. - Php2Shell RCE. - 329 pipeline. - Japan-only targeting. - Automated DB credential and PII harvesting. Platform: app.etugen.io/trashpile/96.1… #etugen #threat #malware #exploit #php2shell #attacker #chinese