Guardicore Labs uncovers a Ransomware detection campaign targeting MySQL servers. Attackers use Double Extortion and publish data to pressure victims.

In the beginning of April, three attacks detected in the Guardicore Global Sensor Network (GGSN) caught our attention. All three had source IP addresses originating in South-Africa and hosted by VolumeDrive ISP (see IoCs).

Our deception technology is able to reroute attackers into honeypots, where they believe that they found their real target. The attacks brute forced passwords for RDP credentials to connect to the victim download and execute a previously undetected malware, which we named Trojan.sysscan.

Starting on Amazon Web Services (AWS) is now more straightforward and more secure by default than it’s ever been. Over the past several months, we rolled out a new AWS experience that changes how you start building. It brings together a set of sensible, secure defaults, and taken one at a time, it’s easy to […]

Over the past few weeks, I’ve introduced you to people who fell into security from the most unexpected places, who work in domains you’ve probably never heard of, and who were honest about what the job is like after the excitement fades and the real work begins. This is the final post in a four-part […]

It's likely an ultra-rare supermassive neutron star.

Silicon Valley tries to understand the election.

The All-In podcast contemplates the "ornery mood" of America's "bottom half of non-equity holders."

These are the top threats you should know about this week.

A standard user on a Mac running the Proofpoint ITM agent can gain root by creating a file with a crafted name in a OneDrive-managed folder. Bishop Fox breaks down how the File Activity Monitor builds shell commands from filenames, the additional attack paths, and what defenders should do.

The teams responsible for security today don’t have a problem with the number of alerts they receive; they have a problem turning those alerts into something truly actionable. When an analyst concludes an investigation with “this was caused by our vulnerability scanner” or “this account is configured to share Amazon Machine Images (AMIs) publicly on […]

Amazon Web Services (AWS) is pleased to announce renewal of the AWS ProcessUnity Global Risk Exchange assessment. This validated assessment report helps customers perform effective cloud supplier due diligence on AWS and enhances their third-party risk management process. What is the AWS ProcessUnity Global Risk Exchange assessment Many customers use third-party cyber risk management (TPCRM) […]

AWS re:Invent returns to Las Vegas for cloud and AI’s biggest week from November 30–December 4, 2026. This year we have over 2,200 sessions, 70 percent of which are interactive, led by experts from Amazon Web Services (AWS), our customers, and our partners. With that much to choose from, we’ve pulled together the sessions built […]

The penultimate month of 2026 bring with it the usual storm of patches from Microsoft and Adobe. I’ve been prototyping some new ways to display this data, but as always, I’m open to suggestions. Seriously – hit me up on Bluesky if you have any ideas.If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for November 2026 For the first part of the November release, Adobe released nine bulletins addressing 110 unique CVEs in Adobe Connect, Experience Manager, After Effects, Audition, Dimension, Photoshop, Media Encoder, Premiere, and Content Credentials SDK. Here’s this month’s overview table: Adobe Patches for November 2026 Bulletin IDProductCVE CountHighest SeverityHighest CVSSExploitedDeployment Priority APSB26-191Adobe Connect24…

Summary A shadow market is helping Chinese users sidestep U.S. AI export controls. Proxy services provide access to restricted frontier… The post The Shadow Market Behind China’s AI Model Distillation Boom appeared first on Chainalysis.

Discover how Akamai Functions cuts latency and cloud costs by running fast WebAssembly code at the edge with zero cold starts and no idle capacity fees.

Akamai Functions is now generally available, and it’s the best place to run the sandboxed, fast-starting code that AI agents keep writing.

AI companies crack down on 'reverse engineer anything.'

The future of hacking your devices is in local and open-weight AI.

Many AI security assessments are automated scans or checklist audits that miss where serious risk lives: where model outputs become database queries, API calls, and agent actions. This post lays out a six-step full-stack standard that proves exploit chains and delivers structural fixes.

France Blames Iran for a Cyberattack That Heated Supermarket Refrigerators France on Monday blamed Iran for the October 12 cyberattack that remotely seized refrigeration systems in roughly 700 French supermarkets, pushing temperatures as high as 50°C for about six hours and forcing stores to discard fresh and frozen goods. The national cybersecurity agency ANSSI attributed […] The post InfoSec News Nuggets – 11/10/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Police arrested a man in South Carolina after he left his daughter asleep in a Target parking lot so he could keep his place in line.

Also: Wanna get off this planet? There's a job open on the moon.

Amazon Bedrock AgentCore Memory helps AI agents maintain context across sessions through persistent short-term and long-term memory. Because memory content is automatically retrieved and injected into future conversations, the integrity of what gets written to memory directly shapes future agent behavior, which makes the write path a valuable control point to strengthen. AgentCore already provides […]

You can now use tokens from AWS Identity and Access Management (IAM) outbound federation to assume roles in other Amazon Web Services (AWS) partitions. When your workloads run across AWS partitions such as Commercial, China, GovCloud (US), and European Sovereign Cloud, a workload in one partition might need to access resources or communicate with AWS […]

Summary A group of Canadian OTCs have helped move millions for Iranian illicit financial networks: On Friday, OFAC designated eight… The post Sanctioned Canadian Crypto OTCs Served Iran and Drug Cartels appeared first on Chainalysis.

Summary Western Europe’s $2.08 trillion crypto economy held firm despite a global downturn. The region grew 1.2% between July 2025… The post Western Europe’s $2 Trillion Crypto Economy Holds Firm appeared first on Chainalysis.

Trio accused of using deepfake CEOs and bogus lawyers to scam businesses out of $129 million The US Justice Department has charged three men with running a two-year fraud scheme that used AI-generated deepfakes of company CEOs and impersonated attorneys at major international law firms to convince employees to wire more than $129 million into […] The post InfoSec News Nuggets – 11/09/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

📖 [The CloudSecList] Issue 363 was originally published by Marco Lancini at CloudSecList on November 08, 2026.

Earth is missing a huge chunk of its geological record before the Cambrian period 538 million years ago, when complex life emerged. A new study suggests that the gap was caused by the rise and fall of ancient supercontinents.

Protocols like Android Debug Bridge (ADB) and Web Real-Time Communication (WebRTC), by default, use unencrypted channels for network communications and don’t support enterprise authentication mechanisms like JSON Web Tokens (JWTs). In a multi-tenant Kubernetes cluster—including Amazon Elastic Kubernetes Service (Amazon EKS)—pods can reach other tenants’ open ports by default unless you configure network policies to […]

This week, we discuss election outcomes and code as a human endeavor.

Adult creators are left in the dark as content that they didn't believe broke the law disappears from clip sites.

OpenAI Model Wrote Its Own Network Code to Get Around Sandbox Restrictions OpenAI disclosed that an internal research model, asked during an August coding evaluation to build a website modeled on a reference site, found its sandbox web proxy down and spent hours trying to get around network restrictions. The model crafted raw packets to […] The post InfoSec News Nuggets – 11/06/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Back to the drawing board!

Archaeologists have discovered the oldest direct evidence of psychoactive cannabis use in a Siberian tomb that was used for human and horse sacrifices, a finding that sheds light on ancient rituals and could help revive wild strains of cannabis lost to time.

The Crime and Policing Act, which goes into force on November 6, criminalizes possessing or publishing strangulation or suffocation porn, as well as some types of "close familial relatives" roleplay.

Inside Proton's AI reckoning, the AO3 outage, and why we're not tech support.

It turns out  you can’t post Malfoids and Anakin when diesel is $6 a gallon and expect America to vote for you.

AWS Identity and Access Management (IAM) is introducing account access manager, a flexible new way to manage workforce access to your Amazon Web Services (AWS) accounts. This combines the IAM role flexibility your teams already rely on, delivered through the centralized federation of AWS IAM Identity Center, with user-level visibility built-in. Account access manager streamlines […]

Discover how higher education institutions use Zero Trust microsegmentation and AI governance to contain ransomware and meet FERPA compliance.

Two AI security tools can use the same model and produce very different results. The difference is the harness. This post explains what an agent harness is, how its execution loop works, and why design choices around context, verification, and scope matter for AI-powered penetration testing.

Russia-Linked Hackers Hit iOS, Android Devices With Exploit Chains via Watering Holes Russian state-sponsored group Midnight Blizzard (APT29) is believed to be behind a large-scale watering hole campaign that targeted iOS and Android users in the US and Europe, mainly Ukraine, with zero-click exploit chains abusing previously patched vulnerabilities, according to Sekoia. The attackers injected […] The post InfoSec News Nuggets – 11/05/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

These are the top threats you should know about this week.

Synthetic CISOs rank AI agents as the top underestimated threat. See key survey findings and learn how to secure overpermissioned agents and vulnerable APIs.

Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Binance has detailed how attackers pulled off the record $6.43 billion theft from the exchange, describing a multi-stage campaign rather than a single breach. It began in June 2026 when a Wallet DevOps engineer downloaded a trojanized Homebrew installer while […] The post InfoSec News Nuggets – 11/04/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Summary Binance disclosed that a DPRK fake employment scheme was behind its $6 billion hack: Attackers used a fabricated job… The post DPRK Hackers Perfected Their Fake Interview Playbook Over Dozens of Attacks Before Binance appeared first on Chainalysis.

Researchers from the Citizen Lab and Princeton have won the IRTF Applied Networking Research Prize for their work on the network security of Android apps. The post Citizen Lab Researchers Win IRTF Applied Networking Research Prize appeared first on The Citizen Lab.

IDC MarketScape named Akamai a Leader in Managed Edge Services 2026. Discover how edge computing drives low-latency, secure AI inference beyond the GPU.

AI can produce a plausible vulnerability report in seconds, but proving it is real still takes expert judgment. This post explores the economics of false positives, why they burden your most senior people, and why accountability stays human.

FBI links $6.3 billion Binance hack to North Korea The FBI and federal partners have attributed the $6.3 billion theft from cryptocurrency exchange Binance to North Korea’s TraderTraitor hacking group, the same unit blamed for the $1.5 billion Bybit heist in 2025. Blockchain intelligence firm TRM Labs estimates the attackers moved $6.36 billion out of […] The post InfoSec News Nuggets – 11/03/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Early this morning Mercado Bitcoin, Brazil’s largest crypto exchange, suffered a security incident that resulted in approximately $49 million in… The post Disrupting the Mercado Bitcoin Attack: How Chainalysis Led the Freeze of Nearly $10M in Stolen Funds appeared first on Chainalysis.

Learn about CVE-2026-98432, a critical remote use-after-free flaw in the Linux kernel TCP stack, its root exploit risks, affected versions, and mitigation steps.

Discover how Akamai and Skyfire verify AI shopping agents with Know Your Agent (KYA) to securely enable agentic commerce and prevent checkout friction.

As the email administrator for your organization’s domain, you receive a Domain-based Message Authentication, Reporting, and Conformance (DMARC) aggregate report showing email passing DomainKeys Identified Mail (DKIM) verification as though it came from your domain, sent from IP addresses you don’t recognize to recipients you didn’t contact. To clear the issue, you rotate your DKIM […]

On Saturday, October 24, 2026 we conducted a successful exercise demonstrating that the AWS European Sovereign Cloud can operate without depending on any infrastructure outside the European Union (EU). This was the first public technical exercise demonstrating the independence of a sovereign cloud Region. The AWS European Sovereign Cloud is a new, independent cloud partition […]

Chainalysis Discloses Data Breach Following AI-Driven Cyberattack Blockchain analytics firm Chainalysis has disclosed a data breach after an external actor used offensive agentic AI techniques to gain unauthorized access to its systems and internal tools. The company says investigation content, transaction and query results, and clear-text passwords and secrets were not compromised, but non-sensitive customer […] The post InfoSec News Nuggets – 11/02/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

📖 [The CloudSecList] Issue 362 was originally published by Marco Lancini at CloudSecList on November 01, 2026.

Tuesday Nov 10, 2026 3:00 A.M. EST Update: Data Solutions is now back online. We’re bringing customers back as quickly… The post Updated Nov 10: Chainalysis Security Incident Information appeared first on Chainalysis.

Key takeaways Around 4:20 p.m. ET on October 29, 2026, funds began leaving Binance hot wallets across multiple blockchains. Unauthorized… The post The $6.4 Billion Binance Hack: Tracing the North Korea Link appeared first on Chainalysis.

No content preview

Discover how the Akamai Workforce Protector Partner Playbook helps you secure browser AI interactions, eliminate data visibility gaps, and close deals.

Binance links $6.3 billion security incident to compromised laptop Binance says a compromised DevOps engineer’s laptop may have let an attacker reach a service container and submit unauthorized withdrawal transactions in an incident with an estimated impact of $6.3 billion. The exchange has frozen roughly $3 billion in affected assets on-chain, kept withdrawals paused while […] The post InfoSec News Nuggets – 10/30/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Learn from my experience and use it in yours. Continue reading on InfoSec Write-ups »

Explore Akamai Cloud's Q3 2026 updates: expanded NVIDIA RTX PRO™ 6000 GPUs, Valkey Managed Database, LKE Enterprise Kubernetes scaling, and enhanced load balancing.

No content preview

What started as a question about Claude’s sandbox turned into a connected investigation of container internals, process memory, and authorization tokens. Bishop Fox researcher Chris Davis documents what Claude revealed, what it handed over, and what that means for defense in depth.

FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering The U.S. Department of Justice announced the seizure of virtualine[.]net, the domain of a bulletproof hosting provider that allegedly advertised its services on cybercrime forums for phishing, carding, spam and port scanning. Court documents say the service, which also operated under names such […] The post InfoSec News Nuggets – 10/29/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Summary Everyday financial needs are driving Sub-Saharan Africa’s crypto growth. The region’s crypto economy grew 13.4% to $101 billion, making… The post South Africa Leads Sub-Saharan Africa’s 13.4% Crypto Growth appeared first on Chainalysis.

Summary OFAC sanctioned Russian and DPRK nationals that targeted U.S. businesses with fraudulent IT workers, generating cryptocurrency proceeds to fund… The post Treasury Sanctions Russians, North Koreans supporting DPRK IT Worker Fraud appeared first on Chainalysis.

Politicians in Europe and the U.S. are speaking out against the use of advertising technology to infect targets with zero-click spyware. The post Politicians in U.S. and E.U. Say Targeted Ads Are a Security Risk appeared first on The Citizen Lab.

No content preview

CISA warns of hackers now exploiting critical Node2Shell flaw CISA has confirmed that attackers are now actively exploiting CVE-2026-111497, a critical out-of-bounds write flaw in Google’s Brotli decoder that researchers have dubbed Node2Shell, Broccoli2Shell and HTTP2Shell. First identified in Node.js, the bug also affects HTTP servers, clients and other software that rely on vulnerable Brotli […] The post InfoSec News Nuggets – 10/28/2026 appeared first on AboutDFIR - The Definitive Compendium Project.

Your workloads reach most destinations by domain name, but a firewall can only act on what it sees in the traffic. For HTTP and HTTPS, AWS Network Firewall domain rules match the name that the client puts in the request, and the client chooses that name. The connections for protocols such as SSH and SSH […]

November 9, 2026: We added a link to the French translation of this post and made other minor edits for clarity. French translation We continue to expand the scope of our assurance programs at Amazon Web Services (AWS) and are pleased to announce the successful completion of our first ever Canadian Centre for Cyber Security […]

The most important work I’ve done in cybersecurity would make for terrible television. There were no countdown clocks and no frantic typing, just a lot of careful reading, a lot of hard conversations, and the occasional quiet moment where everything finally clicked. That’s the part I want to show you this week, because the three […]

Summary The FBI Washington Field Office, working with international law enforcement partners, seized the domain virtualine.net, which, according to the… The post International Law Enforcement Seizes Domain of Virtualine Bulletproof Hosting Service appeared first on Chainalysis.

New findings by the Citizen Lab and SHARE Foundation show that a prominent supporter of Serbia's student movement was targeted with spyware. The post Serbian Prosecutor Who Investigated Belgrade Trump Tower Project ‘Targeted with Spyware’ appeared first on The Citizen Lab.

On September 25, 2026, Mandiant released a report regarding continued mass exploitation of CVE-2026-35273 by the ShinyHunters group. TrendAI’s Zero Day Initiative first reported this CVE to Oracle on June 10, 2026, following an investigation I conducted with Minh Giang and Lucas Miller of TrendAI Research. Although Oracle issued a patch under a single CVE, we reported three distinct vulnerabilities across multiple PeopleSoft components. We are coordinating with Oracle to assign separate CVEs for each issue. In this blog post, we will walk through each of these vulnerabilities, starting with a Server-Side Request Forgery (SSRF) vulnerability. We will also review the validateClient method that Oracle introduced to allow PeopleSoft system administrators to restrict access to certain functiona…

On October 21, 2026, the PHP project disclosed two critical memory-corruption vulnerabilities that can allow unauthenticated remote code execution. Both are fixed in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Every PHP install serving web requests is in scope,

This blog post presents a LibAFL-Qemu based way to explore state machines and why we failed to find CVE-2026-9539.

No content preview

No content preview

No content preview

📖 [The CloudSecList] Issue 361 was originally published by Marco Lancini at CloudSecList on October 25, 2026.

Senior research associate Kate Robertson spoke about the legal concerns that Canada’s proposed Lawful Access Act poses with the Canadian Internet Society. The post Built-In Weakness: Lawful Access and Encryption in the Age of AI-Powered Cyber Threats appeared first on The Citizen Lab.

No content preview

PHP2Shell scanning began before official disclosure. F5 Labs examines the first 24 hours of activity, exploit attempts, and what defenders need to know.

No content preview

No content preview

No content preview

Discover how Akamai responded to critical PHP vulnerabilities using agentic AI, real-time telemetry, and rapid action switching to deliver adaptive WAF defense.

No content preview

Kate Pundyk, Siena Anstis, and Marcus Michaelsen write about the rise of AI-enabled digital transnational repression in their piece for Just Security. The post How Generative AI is Scaling Transnational Repression appeared first on The Citizen Lab.

Connecting AI to enterprise systems changes what organizations entrust software to do. An agent that can query internal databases or modify business records has operational authority, and the scope of that authority becomes a security decision.

October 29, 2026: We added guidance for end-of-life PHP versions (8.1 and earlier), including the source backports that the PHP security team published for PHP 7.4, 8.0, and 8.1. October 23, 2026 (update 2): The PHP project disclosed CVE-2026-115560, a separate remote code execution issue that the October 21 releases don’t fix. It affects only […]

Four new incidents, and CASI/ARS Score updates

These are the top threats you should know about this week.

Amazon Threat Intelligence identified a PHP2Shell exploitation attempt dating to Oct. 17, 2026, in MadPot telemetry, four days before public disclosure of CVE-2026-109618 and CVE-2026-109619. The exploit attempt originated from an IP address associated with a commercial anonymization network. While the vulnerability was under embargo, the targeting of a honeypot from an anonymized IP address […]

Using temporary credentials is a security best practice to reduce the risk from credentials getting compromised. With AWS IAM Roles Anywhere, now your workloads outside of Amazon Web Services (AWS) will be able to access AWS resources by obtaining temporary security credentials in AWS Identity and Access Management (IAM). IAM Roles Anywhere relies on public […]

In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.

Director Ron Deibert spoke to a crowd at SecTor 2026, warning that threats that the Citizen Lab investigates are being “super-charged” thanks to AI. The post Citizen Lab Director Slams Trump Administration, ‘Techno-Fascist’ Executives appeared first on The Citizen Lab.

No content preview

No content preview

October 20, 2026: This post was republished to reflect the new migration capability from Active Directory to an external identity provider (IdP) or the Identity Center directory, now available in IAM Identity Center. September 2, 2026: This post was republished to include Active Directory migration strategies and automation for permission sets. AWS IAM Identity Center […]

No content preview

At the request of the Open Source Technology Improvement Fund (OSTIF), Quarkslab performed a security audit of mbedTLS, evaluating the security of the changes in version 4.0.

Protect sensitive data by pairing Cyera's data discovery with Akamai Guardicore Segmentation to enforce dynamic, data-aware microsegmentation rules.

📖 [The CloudSecList] Issue 360 was originally published by Marco Lancini at CloudSecList on October 18, 2026.

Kate Robertson warns that Bill C-22 poses risks to Canada's national security in this piece for The Globe and Mail. The post The Lawful Access Act’s threats to Canada’s national security appeared first on The Citizen Lab.

We applied AWS Security Agent (now part of AWS Continuum), our autonomous penetration-testing agent, to 37 real, recently disclosed Common Vulnerabilities and Exposures (CVEs), each packaged as a live, containerized target with a flag hidden at the vulnerability’s intended sink. Starting from an unauthenticated or low-privilege position (an endpoint URL and a one-line hint, no […]

Testing AI security without clear scoping produces superficial coverage and unaddressed risk. This post breaks down how to define boundaries, select the right assessment type, and align AI penetration testing, red teaming, and architecture reviews to the decisions that actually matter.

No content preview

The internship 2026-2027 season at Quarkslab is open! Our internship positions cover a wide range of topics and expertise, and aim at tackling new challenges in various fields.

These are the top threats you should know about this week.

Most security tooling that fits into a CI/CD pipeline—static analysis (SAST), software composition analysis (SCA), and dynamic scanners (DAST)—flags potential issues from patterns and signatures. A flagged pattern shows you where to look; penetration testing is what confirms whether something is actually exploitable. That confirmation has traditionally come from a periodic, out-of-band engagement that runs […]

Closing the door doesn’t make a room secure. Alethe Denis breaks down how physical penetration testing evaluates whether unauthorized people can reach sensitive spaces, interact with equipment, or leave something behind without anyone noticing or reporting it.

Another month of patches equals another new record for Microsoft patches. It’s a good thing I survive Pwn2Own Ireland, because between these and the Adobe patches, there’s much to discuss. I’m also looking at different ways I can represent the bugs at this level of volume, so let me know if you have ideas. (Seriously – I’m out of ideas). If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for October 2026 For the first part of the October release, Adobe released 11 bulletins addressing 174 unique CVEs in Adobe Dimension, Commerce, Substance 3D Sampler, ColdFusion, Photoshop, FrameMaker, Experience Manager, Substance 3D Stager, Content Credentials SDK, Bridge, and Substance 3D Designer. Here’s this month’s overview table: Adobe Pa…