Live Feed

Add vulnerability remediation demo: docs/vulnerability-remediation-demo.md

Add vulnerability remediation demo: scripts/create_bitbucket_pr.py

One retail scam used more than 1,200 look-alike .shop domains sharing a single IP address. The sites reused HTML, JavaScript and payment-page designs intended to harvest card numbers, expiry dates and security codes, according Akamai’s Fraud and Abuse Report 2026. A ticket scam used a similar setup. Several websites…

chore: remove staging-only R4 report leaked to main via PR #127 (#128) * chore: remove staging-only R4 report leaked to main via PR #127 Remove docs/audit/STAGING-0-R4-REMEDIATION-REPORT.md which was accidentally included in PR #127 (staging -> main merge). This file is staging-specific remediation documentation and…

ci(E16-S8): fail-closed secret scan gate; written rotation for the leaked secret scripts/secret-scan.py scans the working tree and the full history for Google OAuth/AIza keys, AWS key ids, GitHub/Slack tokens, PEM private keys, postgres URLs carrying a real password, sk-/sk-ant- keys and high-entropy strings in config…

Smart TVs and connected plugs accounted for a large share of recorded security weaknesses in household devices, according to Bitdefender’s 2026 IoT Security Landscape Report. The analysis covered approximately 10.4 million protected home routers between January and September. Televisions represented 22.7% of…

Remove hard auto-fail on failureCondition breach; replace with 35-min attempt ceiling A candidate who is actively working an incident was being auto-failed and locked out the moment a scenario's failureCondition stayed true for its sustainedSeconds window (often just 60s) — testing reflexes against a clock rather than…

Add Security Advisory for CVE-2026-111357 (CVSS 7.0) - CyberVault CyberVault Daily Real-Time Zero-Day Advisories, Nuclei YAML Templates, Exploit Verification Probes & Remediation Guides.

Add vulnerability assessment report for database server Added a vulnerability assessment report detailing risks associated with a publicly accessible database server, including risk assessment, remediation strategies, and overall improvement recommendations. Cybersecurity portfolio showcasing hands-on labs and…

Crypto exchange Binance has paused trading after discovering unknown parties cracked one of its workers’ laptops and used it to make massive trades Late on Thursday, US time, the company used its social media feeds to report “Our teams are aware of reports of a potential security issue and are actively investigating.”…

Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets. The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far. Tether and Circle said they have frozen more than 1.567 billion…

feat(web,api): finding lifecycle timeline + asset vulnerability tracking (FR-27 ③) GET /findings/:id/timeline merges creation, status-change events, and retest history (trigger, verdict, replay mode) into one newest-first lifecycle — the finding detail page renders it as a timeline card, closing the loop: discover…

feat: add Redis 2026 security advisory and interactive CVE workflows

`Task.bind` leaks the inner task when the bind task is dropped while its function runs ### Prerequisites * [x] Check that your issue is not already filed: https://github.com/leanprover/lean4/issues * [x] Reduce the issue to a minimal, self-contained, reproducible test case. Avoid dependencies to Mathlib or Batteries.…

Malicious code in test-01-rafamarrara-learning-dc (PyPI)

Malicious code in twitter-request-diagnostics (PyPI)

Configure Argo CD development deployment and patch container vulnerabilities (#56) * Configure Argo CD development deployment with migration gate * Update transitive Zod dependency to fix security advisory * Patch Keycloak CA certificates and restore trust-store generation * Build patched Keycloak from pinned source…

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

Shared on r/netsec.

Security Vulnerability — Request for Private Disclosure Channel Hello, My name is Yousef Mohammed Alturki, and I am an independent security researcher. I have identified and successfully reproduced a potential security vulnerability affecting Gately v0.6.0.4. I have prepared a technical report, including source-code…

Add Security Advisory for CVE-2026-98432 (CVSS 9.8) - CyberVault CyberVault Daily Real-Time Zero-Day Advisories, Nuclei YAML Templates, Exploit Verification Probes & Remediation Guides.

docs(cpg): C-1001 P0 S58 bindValue security advisory (security-expert; Pass 1 + Pass 2 dispositions check); spec-amendment gate sections (analyst, graph-dba); paused checkpoint in ledger Experiments with graphs and LLMs

This newsletter is brought to you by Nebulock . You can subscribe to an audio version of this newsletter as a podcast by searching for "Risky Business" in your podcatcher or subscribing via this RSS feed . You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here…

Hall of Fame: ImportPlacementBleed, five stars through GHSA-pm7j-752h-qfvj. zachariah-mithani reported ImportPlacementBleed through GitHub Security Advisory GHSA-pm7j-752h-qfvj, with a proof of concept and a suggested fix, so it has five stars, as a GHSA with a suggested fix does. The index row and its own page credit…

Binance investigates a $5.8 billion crypto theft, with $3 billion in assets frozen. The exchange says user funds are safe as investigators trace funds.

A vulnerability has been discovered in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software that could allow for denial of service (DoS). Cisco Secure Firewall ASA and FTD provide firewall, VPN, and threat defense capabilities for enterprise…

A vulnerability has been discovered in GitLab that could allow for remote code execution. GitLab is a DevOps platform that provides source code management, CI/CD pipelines, issue tracking, and collaboration tools in a single application for software development teams. Successful exploitation of this vulnerability…

php2shell raised fears of mass exploitation. A week of testing by our research team found that working exploits had to be fitted to each target’s exact PHP setup. Systems that share one build, such as network appliances, are the exception: one tuned exploit can reach every device that runs it. Key takeaways The five…

AlmaLinux Security Advisory NVD, Ubuntu, Alpine

DEP Require CMS 6.1, as 6.0 dev builds are blocked by a security advisory A feature for Betamask admin theme to display CMS bar in the frontend while user logged in