Tag

#infosec

513 posts13 followers

Explore Hashnode

Alternatives

404 Founders7h ago · 10 min read

Aoki Infostealer Steals Claude, Codex and Cursor Tokens

The Aoki infostealer, also tracked as Aokigahara, has added AI coding assistant credentials to its shopping list. It takes the login and session files of Claude Code, OpenAI Codex, Cursor, GitHub Copi

404-founders.com

Damiano Bianda1d ago · 6 min read

Your PDF says AES-256. The key had 9 bits of entropy

Open a password-protected PDF and the properties dialog will proudly tell you the document is secured with AES-256. That number describes the cipher. It says nothing about the key. This week, Rick de

damianobianda.hashnode.dev

Damiano Bianda2d ago · 7 min read

CVE-2026-97631: A 16-Year-Old Buffer Overflow That Runs Before Your Defenses Do

Your server's security model has a load-bearing assumption buried in it: the code that runs first is trustworthy. Secure Boot, the TPM, disk encryption, remote attestation — all of it sits on top of f

damianobianda.hashnode.dev

Victor Chukwuemeka Onwuegbuchulem5d ago · 15 min read

Firewalls and Defence in Depth: Why One Wall Is Never Enough

Every post in this series has had a shadow. The OSI layers trusting the layer beneath. IP addresses that locate a machine but authenticate no one. DNS that cannot verify its own answers. TCP handshake

victor-chukwuemeka.hashnode.dev

Daniel Isaac E6d ago · 9 min read

PHP2Shell: Inside Two Critical PHP Core Vulnerabilities That Enable Unauthenticated RCE

Understanding CVE-2026-109618 and CVE-2026-109619, the memory-management failures behind them, and what defenders should do now. On October 21, 2026, the PHP development team disclosed two critical vu

danielisaace.hashnode.dev

Muhammad ShahisOct 23 · 4 min read

The Hidden Danger in WordPress: How XML-RPC and Pingback Can Expose Your Server

The Hidden Danger in WordPress: How XML-RPC and Pingback Can Expose Your Server A deep dive into how XML-RPC and Pingback features can be exploited for brute-force amplification and origin IP leakage

httpsportflio-latest-318ave1yf-shahiskhans-projectsvercelapp.hashnode.dev

Jack HeathOct 23 · 7 min read

You Can't Respin a House

Originally published on Insight Source. Written by Jack Heath, Information Security Engineer Most security advice quietly assumes a fantasy world: one where you can start over. Buy the new appliance.

insight-source.hashnode.dev

Cyber KnightOct 23 · 4 min read

The Firm That Audits Everyone's Risk Just Landed on a Ransomware Leak Site

Nobody expects the auditors to get audited. On October 22, a new name appeared on the Everest ransomware group's leak site — and it made incident-response people across the world pause mid-scroll: PwC

nulltrace.hashnode.dev

Cyber KnightOct 22 · 4 min read

A CVSS 10.0 Bug Sat Inside GitLab for 12 Years. It Lived in the Regex Engine.

Twelve years ago, somebody compiled a regular expression. Not in a browser. In a server-side library called Onigmo — the Ruby regex engine GitLab bundles — quietly turning patterns into executable mat

1 nulltrace.hashnode.dev

viditOct 21 · 8 min read

The eMudhra Certificate Compromise: The Internet Trusted a Private Key That Was Literally the Number 4

Eight intermediate CA keys. A key-generation failure. And a reminder that strong cryptography means nothing if the secret is predictable. That is not a test fixture from a cryptography tutorial. That

viditp.hashnode.dev

Search Hashnode