Introducing the BloodHound Query Library! 📚 Martin Sohn & Joey Dreijer explore the new collection of Cypher queries designed to help BloodHound users to unlock the full potential of the BloodHound platform by creating an open query ecosystem. ghst.ly/4jTgRQQ

New Defender detection "Suspicious Cloudflared Tunnel" 🔎 This detection will alert on Cloudflare tunnels that don't belong to your organization by parsing the --token parameter and checking it against your Cloudflare account ID. github.com/lawndoc/Advanc…

FileFix - A ClickFix Alternative mrd0x.com/filefix-clickf…

We're Hiring! Looking for an experienced Red Teamer. To plan and deliver intelligence-led operations against some of the most complex enterprise environments in the UK and beyond. Full info here ➡️jumpsec.com/position-red-c… #cybercareer #redteam JUMPSEC LABS

On July 19, Microsoft issued guidance on CVE-2025-53770, a variant of CVE-2025-49706. At the time of posting, a patch is not available. Learn more about Microsoft’s customer guidance as the situation evolves: msrc.microsoft.com/blog/2025/07/c…

cloud.google.com/blog/topics/th…

Technical deep dive into some current AiTM infrastructure using Azure Front Door and some other rather clever techniques. aitm-feed.com/blog/azure-fro… #AiTM

🕷️🚨 Scattered Spider threat actors are using social engineering techniques like phishing, push bombing & SIM swap attacks to target #CriticalInfrastructure orgs & commercial facilities. Check out our updated joint advisory for recommended mitigations. 👉go.dhs.gov/ioX

WOW!!! temp43487580.github.io/intune/bypass-… %TEMP% such a good post!!! it is so well written, interesting research and great results! Thank you! 🤩

Minutes until this gets abused by threat actors: 0

The surge to 30,000 AiTM infrastructure detections on Wednesday this week was very much driven by pages[.]dev and workers[.]dev use. Rather than playing whack-a-mole we've been blocking those domains and so far have only blocked AiTM nothing legit!! YMMV #AiTM #Cloudflare

If you want to block ShadowCaptcha campaigns blocking these three domains will help: - cloudshielders[.]com - analytiwave[.]com - analyticanoden[.]com There is heavy geo/user-agent/os detection going on, so you may not see click-fix but your users might #clickFix #shadowCaptcha

🚨 We identified a ViewState deserialization attack affecting Sitecore deployments. The attacker leveraged an exposed ASP[.]NET machine key to perform remote code execution. Get the full details, indicators of compromise, and defensive recommendations: goo.gle/47oNWll

🚨 #Salty2FA is a new #phishkit linked to #Storm1575. Active since June, it bypasses 2FA to gain access beyond stolen creds. Using a unique domain pattern and multi-stage chain, it targets finance, energy, telecom and more. Read analysis: any.run/cybersecurity-…

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-glob…

Lateral movement getting blocked by traditional methods? werdhaihai just dropped research on a new lateral movement technique using Windows Installer Custom Action Server, complete with working BOF code. ghst.ly/4pN03PG

Emails claim Oracle data theft in new Clop-linked extortion campaign - Lawrence Abrams bleepingcomputer.com/news/security/… bleepingcomputer.com/news/security/…

This is cool

We just posted our AttackerKB Rapid7 Analysis for the recent Cisco ASA 0day chain; CVE-2025-20362 and CVE-2025-20333. The auth bypass appears to be a patch bypass of an older 2018 vuln. The buffer overflow is in a Lua endpoint, but unsafe native code operations allow a buffer to

It's confirmed! Ken Gannon / 伊藤 剣 (@yogehi) of Mobile Hacking Lab, and Dimitrios Valsamaras (Dimitri Os) of Summoning Team (SummoningTeam) used five different bugs to exploit the #Samsung Galaxy S25. They earn $50,000 and 5 Master of Pwn points. #Pwn2Own