Segurança Ofensiva

Mon, 26 Oct 2026

⚡ Weekly Recap: This2Shell, That2Shell, Everything's an RCE? Rogue AI, Supply Chain Chaos and More

Multiple critical remote code execution vulnerabilities are actively exploited, causing widespread risk across various platforms. Attackers leverage leaked keys and software supply-chain attacks,...

Ler Artigo

Mon, 26 Oct 2026

Two Critical Wasmtime Flaws Could Let Malicious WebAssembly Modules Escape Sandboxes

Two critical vulnerabilities in Wasmtime allow malicious WebAssembly modules to escape the sandbox, posing serious security risks.

Ler Artigo

Mon, 26 Oct 2026

Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses

NDR platforms correlate multiple alerts into a unified attack timeline, enhancing intrusion detection and response.

Ler Artigo

Mon, 26 Oct 2026

Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

Microsoft 365 campaign uses adversary-in-the-middle relay to capture and replay sign-in tokens, compromising email accounts across 79 organizations.

Ler Artigo

Mon, 26 Oct 2026

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions Logs

An automated campaign is using stolen GitHub tokens to plant workflows that print a repository's secrets into its GitHub Actions logs, which the attackers then download before deleting the runs. The...

Ler Artigo

Mon, 26 Oct 2026

Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware

A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report...

Ler Artigo