Community icon

blueteamsec

!blueteamsec@infosec.pub

Hot
New Old Active
Hot
New Old Active
Posts Comments
List Tile Wide tile

CTO at NCSC Summary: week ending May 10th

by
0
1

Daily BlueTeamSec Briefing Archive - daily AI generated podcast of the last 24hours of posts

by
0
1

Analyse des DNS-Ausfalls vom 5. Mai 2026 - Analysis of the DNS outage of May 5, 2026

by
0
4

Member of Prolific Russian Ransomware Group Sentenced to Prison

by
0
4

EasterBunny: advanced espionage artifacts attributed to APT29

by
0
3

Tracking the "Sorry" Extortionist Campaign Against cPanel Websites

by
0
3

PositiveIntent: Evasive loader for .NET Framework assemblies

by
0
2

The Accidental C2: Exploring Dev Tunnels for Remote Access

by
0
2

Living of the Land - DISM Sandbox Provider Hijack

by
0
2

HyperVenom: Using Hyper-V for Ring -1 Control from Usermode | HyperVenom

by
0
2

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

by
0
2

SunnyDayBPF: SunnyDayBPF: eBPF-based post-syscall user-buffer telemetry deception

by
0
2

Copy_Fail2-Electric_Boogaloo: Copy Fail 2: Electric Boogaloo

by
0
3

Bleeding Llama: Critical Unauthenticated Memory Leak in Ollama

by
0
17

Student Arrested in Taiwan for using SDR and Handheld Radios to Halt Four High Speed Trains with TETRA Hack

by
3
9

Dirty Frag: Universal Linux LPE

by
72
7
4

We are aware of a very limited number of customers exploited with CVE-2026-6973. Successful exploitation requires Admin authentication.

by
0
3

Two U.S. Nationals Sentenced for Facilitating Fraudulent Remote Information Technology Worker Schemes to Generate Revenue for the Democratic People’s Republic of Korea

by
0
10

Revealed: Russia’s top secret spy school teaching hacking and election meddling

by
32
7
4

OceanLotus suspected of distributing ZiChatBot malware via wheel packages in PyPI

by
0
5

Unpacking Russian-Iranian Private-Sector Cyber Connections

by
0
5
1

Inadvertent Injections

by
0
1

Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware

by
0
1

CVE-2026-0300 PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

by
1
4

A rigged game: ScarCruft compromises gaming platform in a supply-chain attack

by
0
6

Iranian-Nexus Operation Against Oman's Government: 12 Ministries Hit and 26,000 Citizen Records Exposed

by
0
4

UAT-8302 and its box full of malware

by
0
4

Popular DAEMON Tools software compromised

by
2
4
3

The cPanel Zero-Day Was Active for 64 Days Before Anyone Knew

by
0
5

Accelerating Vulnerability Detection and Response at Oracle

by
0
1

GIDR: A behavioral intrusion detection system for Windows. Files are innocent until proven guilty at runtime. When malicious behavior is detected, the entire attack chain is traced to root

by
0
5

dMSA Ouroboros: Self-Sustaining Credential Extraction in Windows Server 2025 | Huntress

by
0
3

N-Day Research with AI: Using Ollama and n8n

by
0
1

38 CVEs in Healthcare Software Used by 100,000 Medical Providers

by
0
3
1

vanguard: VanGuard is a self-contained incident response toolkit built in Go that gives DFIR teams a single binary for triage, threat hunting, memory forensics, disk collection, remote operations

by
0
3

Recursively fuzzing MS-RPC structures and monitoring using ETW

by
0
1

CVE-2026-31431：我用 DeepSeek 复现了 AI 发现Copy Fail 提权的全过程 - CVE-2026-31431: I used DeepSeek to reproduce the entire process of AI detecting Copy Fail privilege escalation.

by
0
5

《APT高级威胁研究报告》（2026 版）- Advanced Threat Research Report (2026 Edition)

by
0
3

nginxpulse: 轻量级 Nginx 访问日志分析与可视化面板，提供实时统计、PV 过滤、IP 归属地与客户端解析。- A lightweight Nginx access log analysis and visualization dashboard, providing real-time statistics, PV filtering, IP geolocation etc

by
0
4

Added new vulnerable samples for IoBitUnlocker, Zemana and TfSysMon

by
0
5

AMSI Page Guard Bypass (Rust PoC)

by
0
5

AI-powered honeypots: Turning the tables on malicious AI agents

by
0
12

copy.golf — golf your exploits - copy.fail smaller exploits

by
0
8

DragonBreath: Dragon in the Kernel

by
0
7

蔓灵花组织使用NUITKA打包的python样本进行投递 - The Manlinghua organization used Python samples packaged in NUITKA for delivery.

by
0
2

gdrv3.sys - Reverse Engineering a Signed Kernel Driver with 13 Hardware Access Primitives

by
0
2

Meet Bluekit: The AI-Powered All-in-One Phishing Kit

by
0
2

Malicious Ruby Gems and Go Modules Impersonate Developer Tools to Steal Secrets and Poison CI

by
0
2

A hacker group was detained in Lviv Oblast, which hacked game accounts and received almost UAH 10 million in profit from their sale in Russia

by
0
3

IRQL - Incident Response Query Language - A collection of Kusto (KQL) functions that unify security logs behind a consistent, analyst-friendly dialect

by
0
4

Nuclei template CVE-2026-41940.yaml - cPanel & WHM - Authentication Bypass via Session-File CRLF Injection

by
0
2

ARP Around and Find Out: Hijacking GPO UNC Paths for Code Execution…

by
0
4

Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia

by
0
3

Study of Post Quantum status of Widely Used Protocols

by
0
4

Malicious Intercom PHP Package Spreads Mini Shai-Hulud Attack to Packagist via Composer Plugin

by
0
4

Possible supply chain attack on version 2.6.3 · Issue #21689 · Lightning-AI/pytorch-lightning

by
0
2

code-needle: A VS Code plugin to execute arbitrary JavaScript code at runtime over a local HTTP endpoint.

by
0
5

EventLogExpert: Can be used as a replacement for Event Viewer to view live event logs. Choose Continuously Update on the View menu and watch new events appear in real time.

by
0
2

MicroSMT: IDA plugin for automatic deobfuscation of opaque predicates by lifting microcode to z3 for SMT reasoning.

by
0
2

Holy-Grail-PCAP: "Holy Grail PCAP" is a capture file offering exceptional coverage across nearly all tcpdump/Wireshark encapsulation types and dissectors.

by
0
7

Impacket-IoCs: This repo contains the results of an internal re-write of impacket I undertook at my current company. It contains some of the IoCs found within the library

by
0
3

Puzzle: Set of PoC to abuse Windows minifilters functionality

by
0
1

Active exploitation of cPanel/WHM critical vulnerability

by
0
7

Important Update From Trellix - "Trellix recently identified unauthorized access to a portion of our source code repository. "

by
1
10
1

Important Update From Trellix - "Trellix recently identified unauthorized access to a portion of our source code repository. "

by
1
11
1

Watch Guard! Qilin affiliate exploits network appliances for initial access

by
0
3

South-East Asian Military Entities Targeted via cPanel (CVE-2026-41940)

by
0
3

Russian Hacker Pleads Guilty in Oil and Gas Facility Attacks

by

https://archive.ph/XmEBG

0
7

April 27th - What happened with our feature flag configuration | The ClickUp Blog

by
0
3

Blog: Evolving the Android & Chrome VRPs for the AI Era

by
0
3

Seven Queries to Audit the Sentinel Detections Your SOC May Have Missed.

by
0
5

VECT: Ransomware by design, Wiper by accident - Check Point Research

by
0
3

VisualSploit: Backdoor Visual Studio project files with custom shellcode, which executes whenever the project is opened or built.

by
0
4

DoomSyscalls: Clean Indirect Syscalls with Hook Evasion & Return Address Spoofing.

by
0
7

Why Data From So Many Breaches Never Sees the Light of Day

by
0
9

Two Americans Who Attacked Multiple U.S. Victims Using ALPHV BlackCat Ransomware Sentenced to Prison

by
0
4

Qilin Ransomware Enumerates RDP Authentication History on a Compromised Server | Cryptika Cybersecurity

by
0
2

Agentic Malware Analysis: From Task Automation to Deep Analysis

by
1
2

pydep-vector-runner: A lightweight runner that guards against weird startup behaviors in python. Lightweight version of PyDepGuard's coderunner.

by
0
2

month-of-bypasses: Proof-of-Concepts for Detection Engineering Purposes Only

by
0
2

How to block CVE-2026-31431 (Copy Fail)

by
0
5
1

How to block CVE-2026-31431 (Copy Fail)

by
0
3
1

Auditing Application Permissions in Microsoft Entra ID: Hidden Risks, Pitfalls, and Quarkslab's QAZPT Tool

by
0
2

CTO at NCSC Summary: week ending May 3rd

by
0
2

wg.copyfail.patch: CVE-2026-31431 eBPF fix - Copy.fail

by
1
2

Beyond CVEs: Untracked Vulnerabilities in Public Issue Trackers

by
0
5

Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective

by
0
1

Komari Red: The Monitoring Tool with a Built-in Reverse Shell

by
0
4

Careful adoption of agentic AI services

by
0
1
1

Careful adoption of agentic AI services

by
0
1
1

Preparing for a ‘vulnerability patch wave’

by
0
2
1

Analyzing the Silver Fox tax campaign and the new ABCDoor backdoor

by
0
2

CVE-2026-42167 Allows Auth Bypass And RCE In ProFTPD - in an extension, not core

by
0
4

Security Advisory: Firmware Update Required — Gen 6, Gen 7, and Gen 8 Firewalls

by
0
4

Building 'nandtap': Dumping a Cisco Meraki Z1 NAND via Raspberry Pi GPIO Without Removing Chip from Board

by
0
4

New Vulnerabilities in NVIDIA NeMo and Meta PyTorch Enable Full System Compromise

by
0
5

WordPress Plugin Hijacked in 2020 Hid a Dormant Backdoor for Years

by
1
5

2033170 - DigiCert: Misissued code signing certificates

by
0
2

Adapting Zero Trust Principles to Operational Technology

by
0
1

The Federal Bureau of Investigation is publishing this Public Service Announcement to warn the public of cyber threat actors increasingly using sophisticated, cyber-enabled tactics to steal cargo

by
0
1
1

The Federal Bureau of Investigation is publishing this Public Service Announcement to warn the public of cyber threat actors increasingly using sophisticated, cyber-enabled tactics to steal cargo

by
0
1
1

SQL injection in Proxy API key verification in LiteLLM

by
0
4