Bolthole A proof-of-concept ClickOnce payload for Red Teams to establish initial access in authorized penetration tests. Overview Bolthole provides operators with: Reverse SSH tunnel into the target environment CMD shell access as the executing...
The United Kingdom’s National Cyber Security Centre (NCSC) has unveiled a new program titled the Vulnerability Research Initiative (VRI), aimed at deepening collaboration with independent experts in vulnerability discovery. This initiative seeks to bolster...
The Trump administration is planning to allocate $1 billion over the next four years toward offensive operations in cyberspace. These funds will be disbursed through the Department of Defense as part of a sweeping...
There is no shortage of protective tools today, yet unfortunately, the number of threats continues to outpace them—particularly those that operate subtly and invisibly, penetrating the very core mechanisms of an operating system. Detecting...
The Open-Ended Working Group (OEWG) on security and the use of information and communication technologies (ICTs) in the context of international security has concluded its work in New York. After nearly five years of...
Each month, millions of users visit websites offering so-called “undressing” services—platforms that use generative AI to transform ordinary images of women and girls into fabricated nude depictions. A recent investigation by Indicator has revealed...
Over the weekend, an employee of the Department of Government Efficiency (DOGE), an agency under Elon Musk’s purview, inadvertently exposed a confidential key that granted direct access to over 50 of xAI’s language models....
The Gemini AI assistant, integrated into Google Workspace, has unexpectedly proven vulnerable to a novel form of social engineering. By exploiting a particular method of structuring content within emails, malicious actors can deceive the...
BinPool is a dataset consisting of vulnerable and patched binaries derived from historical Debian packages, compiled using four different optimization levels. It can be used for vulnerability discovery tasks through various methods, including machine...
Security researchers from GitGuardian and Synacktiv have uncovered a critical vulnerability in Laravel, the widely used PHP framework that powers hundreds of thousands of web applications. The issue stems from the leakage of the...
Fortinet has released critical security updates for FortiWeb, addressing a severe vulnerability that allowed unauthenticated attackers to execute arbitrary SQL queries remotely. The flaw, tracked as CVE-2025-25257, received a CVSS score of 9.6, placing...
Cybercriminals have begun leveraging GitHub to disseminate dangerous spyware disguised as a free VPN service. The malicious campaign, uncovered by researchers at Cyfirma, masqueraded as a program called “Free VPN for PC.” Instead of...
Apple has finally begun integrating support for RCS (Rich Communication Services) into its messaging system, yet it still falls short of offering full end-to-end encryption on the iPhone. Although the company pledged in March...
GoExec is a new take on some of the methods used to gain remote execution on Windows devices. GoExec implements a number of largely unrealized execution methods and provides significant OPSEC improvements overall. Goexec supports...
One of the world’s largest steel manufacturing conglomerates, the Japanese company Nippon Steel, has reported a large-scale cyberattack during which hackers gained unauthorized access to data belonging to clients, employees, and business partners. The...
Researchers at Huntress have observed active exploitation of a critical vulnerability in Wing FTP Server—a mere day after its public disclosure. The flaw, tracked as CVE-2025-47812, received the highest possible severity rating (CVSS 10.0),...
