❌

Normal view

Received — 7 August 2026 ⏭ Security

Growing Up The Hard Way

✇The Hacker News
By: Unknown
7 August 2026 at 11:55
Open Source had a great childhood. For two decades it got to be a kid. It ran around barefoot, gave everything away, trusted strangers, and never once thought about who was watching. It ran the kind of lemonade stand that took IOUs from anyone who wandered up — take what you need, pay me back whenever, no need to leave a name. It was idyllic. It was also, in retrospect, a little feral. Then,

Received — 6 August 2026 ⏭ Security

AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory

✇The Hacker News
By: Unknown
6 August 2026 at 11:30
A new class of prompt injection is spreading across commercial websites. It requires no malware, no stolen credentials, and no zero-day exploit. It abuses a standard feature built into almost every major AI assistant: pre-filled deep links. We observed production websites embedding hidden prompt injection payloads inside "Ask AI" buttons on marketing and competitor comparison pages. When a user

Kali365 Weaponizes Microsoft Authentication Against US Companies: New Enterprise Risk

✇The Hacker News
By: Unknown
5 August 2026 at 11:43
Kali365 is turning a legitimate Microsoft login into a gateway to corporate data. The phishing kit targets US organizations with attacker-controlled device codes that victims approve on Microsoft's real authentication page. Once access and refresh tokens are issued, attackers may retain access to email, documents, and cloud resources, creating a direct path to data exposure, financial fraud,

Leaked n8n API Tokens Exposed Live Instances to Credential Theft

✇The Hacker News
By: Unknown
5 August 2026 at 10:35
GitGuardian researchers found 321 n8n instances accepting API tokens exposed in public GitHub commits and demonstrated four ways attackers could use them to access sensitive data and downstream credentials without exploiting a software vulnerability. We scanned public GitHub commits for exposed n8n API tokens and identified 4,576 unique credentials associated with 1,255 hostnames. Of the 896

Received — 4 August 2026 ⏭ Security

When Vibe Hacking Turns AI into the Junior Hacker Every Adversary Always Wanted

✇The Hacker News
By: Unknown
4 August 2026 at 11:30
The cybersecurity industry has spent decades assuming that offensive capability scales with technical expertise. That assumption is starting to break. Security teams have long estimated risk by ranking attacker sophistication. Nation-state actors sat at one end. Organized criminal groups followed. Inexperienced attackers, dismissed as "script kiddies," sat at the other end, running public

FOMO in the SOC: Where AI Platforms like Claude Actually Fit

✇The Hacker News
By: Unknown
3 August 2026 at 11:30
AI is moving incredibly fast, and every security leader is feeling the pressure to keep up. AI platforms like Claude, Codex and Cursor are already helping security teams write detections, investigate alerts, summarize incidents, and automate repetitive work. The conversation has evolved from whether AI belongs in the SOC, to where each type of AI delivers the most value. With so many new AI

Received — 1 August 2026 ⏭ Security

6 Reasons Why Device Code Phishing is the Fastest-Growing Threat of 2026

✇The Hacker News
By: Unknown
31 July 2026 at 11:25
Device code phishing - the abuse of the OAuth 2.0 device authorization grant to steal access tokens - has evolved from a niche red-team technique to an industrial-scale threat in under six months. Designed for input-constrained devices like smart TVs, printers, and so on, the device authorization login flow has been adopted by a wide range of apps and use-cases that it wasn't originally

Received — 29 July 2026 ⏭ Security

Mythos Asks the Right Question. It Doesn't Answer It.

✇The Hacker News
By: Unknown
29 July 2026 at 12:15
AI is compressing exploit timelines. The real question isn't whether your vulnerability management playbook needs to change, it's which part of it you've been getting wrong all along. The conversation happening in security circles right now goes something like this: Mythos is here. Exploit timelines are collapsing. Does the vulnerability management playbook need to change? The honest answer is

73% of Organizations Say They Are Not Fully Ready for a Major Cyberattack

✇The Hacker News
By: Unknown
29 July 2026 at 11:13
Most organizations have incident response plans, security tools, and technical teams in place. Yet new research suggests that many still lack the coordination, visibility, and executive alignment needed to withstand a serious cyberattack. According to The State of Incident Response Readiness 2026, based on a survey of 600 senior IT security decision makers conducted by Vanson Bourne in January

Received — 24 July 2026 ⏭ Security

Seeing AI Agents Is Not Enough. Security Teams Must Enforce What They Can Do

✇The Hacker News
By: Unknown
24 July 2026 at 11:30
AI agent security is moving through a familiar maturity curve: adoption, then visibility, and finally, control. But what we've collectively discovered is that enforcing least privilege for AI agents is harder than we ever imagined. This is why there are so many approaches, from prompt filtering to identity-layer access controls. Where we've collectively landed is that understanding the intent of

Received — 23 July 2026 ⏭ Security

How Synthetic Identity Fraud is Coming for Machine Identities

✇The Hacker News
By: Unknown
23 July 2026 at 11:45
Most people understand identity theft as an attacker stealing a real person's sensitive information and impersonating them. Synthetic identity fraud is much harder to catch. Instead of stealing a real identity, the attacker manufactures a new one, frankensteining together several real data points with fabricated ones to create a person who doesn't exist. Since no real victim monitors misuse, a

I was reporter #11 for a WPForms PayPal webhook vulnerability (CVE-2026-4986)

✇/r/netsec - Information Security News & Discussion
By: /u/unknownhad
22 July 2026 at 14:46

I found and reported an authentication failure in the WPForms PayPal Commerce webhook, the webhook route being public was not the vulnerability as webhooks have to be publicly reachable so that PayPal can deliver events.

The problem was what happened after the request arrived. In affected versions, the handler could process a supported event before establishing that PayPal was actually the sender. In my local lab, a forged event could change the state of a matching payment record.
The expected order is:

  1. Authenticate the sender
  2. Validate the event
  3. Change payment state

The affected flow effectively performed steps 2 and 3 without first completing step 1. The issue was fixed in WPForms 1.10.0.5 and is tracked as CVE-2026-4986.
Then came the part I found more interesting: triage told me I was reporter #11. That number does not prove exploitation, and it does not tell us the total number of people who found the vulnerability. It does establish a lower bound: at least eleven researchers independently converged on the same trust failure.

The write up covers:
- the vulnerable code path
- my local reproduction
- why payload validation was not sender authentication
- the fallback listener
- the patch
- why duplicate reports may be useful rediscovery intelligence

Full write-up: https://blog.himanshuanand.com/2026/07/reporter-11-10-people-found-the-wpforms-paypal-bug-before-me-cve-2026-4986/

Testing was limited to my own local environment. I am not claiming original CVE credit; I independently rediscovered and reported the issue. Disclosure: I wrote and performed the research, code review and local reproduction.

I used an AI to help copy edit and organize the final article.

Should duplicate report volume affect how urgently a vendor treats a vulnerability?

submitted by /u/unknownhad
[link] [comments]

Why Modern SOCs Need Multi-Layered Detections

✇The Hacker News
By: Unknown
22 July 2026 at 11:25
The cycle is over. For years, cybersecurity followed a familiar pattern: defenses improved, attackers adapted, and the back-and-forth continued. Today, AI-equipped attackers are simply outpacing defenses. Most intrusions now bypass endpoint and malware-based detection entirely. The CrowdStrike Global Threat Report estimates around 79% of attacks are malware-free, as threat actors rely on

N-day is Becoming N-Hour. Patching Faster Won't Save You.

✇The Hacker News
By: Unknown
21 July 2026 at 11:42
Every patch is a confession. The moment a vendor ships a security fix, the diff between the old code and the new code tells anyone watching exactly what was broken and where. Turn that diff back into a working exploit, and you can hit every system that hasn't updated yet. This is N-day exploitation, and it's always been a race: the vendor patches, the clock starts, and defenders try to deploy

Received — 20 July 2026 ⏭ Security

The Race to Field Military Autonomy Is On, Can Trusted Information Infrastructure Keep Pace?

✇The Hacker News
By: Unknown
17 July 2026 at 11:30
Military forces are under increasing pressure to field autonomous capabilities faster than ever before. Across the U.S., UK, and NATO, new investment, evolving defense strategies, and accelerated acquisition pathways are transforming how capability is delivered, rewarding programs that can move from concept to operational deployment at commercial speed. Now the focus shifts to the trusted

Received — 17 July 2026 ⏭ Security

20+ Hijacked Government Websites Became
an Attack Channel

✇The Hacker News
By: Unknown
16 July 2026 at 11:58
More than 20 Brazilian government websites were hijacked and turned into malware delivery channels in an active PhantomEnigma campaign uncovered by ANY.RUN, a leading provider of interactive malware analysis and threat intelligence solutions. The investigation revealed previously undocumented backdoor behavior, hidden infrastructure relationships, and multiple attack arms behind a campaign

AI Can Find Bugs, But Human Knowledge Still Proves Them

✇The Hacker News
By: Unknown
16 July 2026 at 10:10
Artificial intelligence (AI) is changing offensive security, but it has not changed the standard that matters most: a finding has to be proven before it becomes useful. AI-assisted tools can read code quickly, generate payloads, summarize attack surfaces, explain unfamiliar APIs, and run repetitive testing workflows at impressive speed. That is a real advantage for security teams. It also

Received — 15 July 2026 ⏭ Security

How Pentera Turns AI Security Workflows into Validation Engines

✇The Hacker News
By: Unknown
14 July 2026 at 11:30
AI security agents are starting to influence real security decisions. They summarize findings, prioritize remediation, recommend next steps, and help teams move faster. But most still rely on fragmented risk signals: scanner output, severity scores, threat intelligence, configuration findings, and exposure data. That fragmentation matters because attackers do not move through environments one

Received — 13 July 2026 ⏭ Security

Thinking Fast and Slow in the SOC: The Case for Combining Autonomous AI with Analyst Copilots

✇The Hacker News
By: Unknown
13 July 2026 at 11:37
A few days ago, I was sitting with the CISO of a Fortune 50 company, walking through how his security team was thinking about AI agents in the SOC. Smart team. Serious program. They had already connected Claude to a few detection tools and were seeing real value in specific investigations. But as we mapped out the broader architecture, something kept nagging at me. The design they were building

Received — 10 July 2026 ⏭ Security

From 17,000 to 1.1 Million Assets: How Lumen Technologies Rebuilt Exposure Management at Scale

✇The Hacker News
By: Unknown
10 July 2026 at 11:39
Most enterprises assume their asset inventory is close enough to accurate. The evidence suggests otherwise. According to a survey of over 600 security leaders in the 2026 Axonius Actionability Report, only 45% of organizations consolidate their asset and exposure data into a single view, and every downstream security program inherits whatever the inventory gets wrong. Lumen Technologies, a

❌