30
30
30
30
30
55
30
Your threat feed is someone else's database: What ingesting malware intel at scale takes
GitHub's Dependabot lead shares five production lessons for ingesting community malware intelligence feeds across eight package ecosystems at scale.
GitHub's Dependabot team monitors over 30 million repositories and extended malicious-package advisories from npm to eight package ecosystems by ingesting OpenSSF's malicious-packages intelligence. The team catalogued roughly 18 new malicious npm packages per day in the year ending May 2026. The write-up argues that provenance with batch reverts, fingerprinting to catch echo-chamber duplicates, and heavyweight normalization are the make-or-break engineering for feed ingestion. It also recommends automated publishing with import caps and anomaly flagging, and quarantining malformed records rather than silently repairing them.
28
30
Harnessing LLMs for Automating BOLA Detection
Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.
Palo Alto Unit 42 details BOLABuster, a methodology combining large language models with heuristics to automate detection of broken object-level authorization (BOLA) flaws, which traditional fuzzing and static analysis struggle to find. The approach uses LLM reasoning to understand application logic, map endpoint dependency relationships, and generate and interpret test cases. It found CVE-2024-1313 in Grafana, CVE-2024-22278 in Harbor, and 15 CVEs in Easy!Appointments. The team is continuing to hunt for BOLAs in open-source and internal projects.
45
30
30
30
Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0 (1999)
Seminal 1999 USENIX study finds most novice users cannot correctly sign and encrypt email with PGP 5.0 in 90 minutes.
Whitten and Tygar's USENIX Security Symposium paper evaluates whether cryptography novices can use PGP 5.0 effectively, using cognitive walkthrough analysis and a laboratory user test. The majority of test participants failed to successfully sign and encrypt a message within 90 minutes, despite PGP 5.0 having a well-regarded graphical interface. The authors argue that security requires usability standards beyond those of general consumer software and propose domain-specific UI design principles for security. The paper is a foundational reference in usable security research.
24
55
30
30
30
Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments
UMass Amherst researchers demonstrate Zombie Card, an NFC relay attack that revives expired Visa contactless cards for in-store purchases without breaking cryptography.
Researchers at the University of Massachusetts Amherst presented the Zombie Card attack at USENIX Security 2026, showing that Visa's Kernel 3 does not cryptographically bind the Application Expiration Date (tag 5F24) the terminal reads with the Track 2 expiry seen by the issuer. By positioning an NFC man-in-the-middle relay, an attacker can rewrite the terminal-facing expiration date of an expired card and complete contactless purchases, provided the account remains open under the same PAN and the bank does not independently re-check expiry. Testing across five major US banks found three distinct policies; Visa Kernel 3 accepted the modified date, while Mastercard, American Express, and Discover kernels declined modified transactions. Findings were disclosed to Visa and affected banks in May 2025, no CVE has been assigned, and no exploitation has been reported.
58
55
42
30
30
42
30
30
An Open-Source End-to-End FHE Implementation for Privacy-Preserving Llama 3 8B Inference
Odin runs Llama-3-8B fully homomorphic encrypted inference on a single H100 in 366 seconds, a 4.51x speedup over THOR.
Odin is an open-source end-to-end GPU CKKS implementation for privacy-preserving Llama-3-8B inference that co-designs ciphertext packing with model execution. A feature-major cross-layer layout unifies residual connections and layer interfaces, while transient intra-operator layouts serve linear projections and attention, avoiding intermediate repacking of QK^T softmax outputs. Minimax polynomial approximation with input-range control reduces polynomial degree and multiplicative depth for nonlinear ops. With 128-token input, Odin evaluates all 32 Transformer layers on one NVIDIA H100 80 GB in 366.4 s using 58.9 GiB peak memory, versus 1651.9 s for the THOR baseline, a 4.51x speedup.
48
SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now the Leading Path into the Enterprise
SpyCloud survey of 750 security leaders finds compromised non-human identities are the top enterprise entry point, yet only 36% monitor them.
The 2026 Identity Threat Report surveyed 750 cybersecurity leaders at organizations with 500+ employees across North America and Europe. Compromised non-human identities (31%) were the most cited primary attacker entry point, nearly double phishing (17%), while only 36% of organizations monitor AI agents, service accounts and API keys. 68% of respondents reported identity-based events, averaging eight each, and 91% use AI tools but only 56% have formal governance over their privileges.
32
SpyCloud 2026 Identity Threat Report Finds Non-Human Identities Are Now the Leading Path into the Enterprise
SpyCloud survey of 750 security leaders finds compromised non-human identities are the top enterprise entry point, yet only 36% monitor them.
The 2026 Identity Threat Report surveyed 750 cybersecurity leaders at organizations with 500+ employees across North America and Europe. Compromised non-human identities (31%) were the most cited primary attacker entry point, nearly double phishing (17%), while only 36% of organizations monitor AI agents, service accounts and API keys. 68% of respondents reported identity-based events, averaging eight each, and 91% use AI tools but only 56% have formal governance over their privileges.
32
New GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 to Gain Host Root Access
University of Toronto researchers present GPUThor, a Rowhammer attack that defeats ECC on NVIDIA RTX A4000-A6000 GDDR6 GPUs and achieves host root access.
GPUThor uses non-uniform hammering to bypass Target Row Refresh and overcome SECDED ECC on NVIDIA Ampere workstation GPUs with GDDR6 memory, inducing 72,000 to 377,552 bit flips per gigabyte across RTX A6000, A5000, A4500, and A4000 cards. Triple-bit silent data corruption enables host privilege escalation to root with the IOMMU enabled, reusing GPUBreach page-table corruption techniques, and double-bit DUEs allow escalation when the IOMMU is disabled during a ~10 ms lazy-service window. The attack cut end-to-end escalation time on the A6000 from 21.9 hours to 1.1 minutes. Reported to NVIDIA, Google, Microsoft, and AWS on April 29, 2026; findings were embargoed until August 25, 2026, and no CVE identifier was assigned.
62
Your Shredded Visa Card May Still Work at the Checkout
UMass Amherst researchers demonstrated expired Visa contactless cards can complete real purchases via relay attacks exploiting Visa Kernel 3's unsigned expiry date handling.
University of Massachusetts Amherst researchers presented at USENIX Security 2026 that expired Visa contactless cards can be revived for real purchases through an NFC man-in-the-middle attack on Visa's Kernel 3. The attack alters the expiry date the terminal sees (tag 5F24) while leaving the Track 2 Equivalent Data (tag 57) sent to the issuing bank unchanged, and the card's cryptographic signature does not cover the expiry date. Two Android phones emulating card and terminal relayed transactions within Visa's 500-millisecond limit. Mastercard, American Express, and Discover kernels blocked the attack, while Visa Kernel 3 did not; researchers also modified the Consumer Device Cardholder Verification Method flag at five US banks, and attackers can also exploit Terminal Verification Results zero-filling. Visa was notified in May 2025 and December 2025; no CVE has been assigned.
65
The Year in Web Threats: Web Skimmers Take Advantage of Cloud Hosting and More
Unit 42 analyzed 2.24 million web threat incidents, finding web skimmers increasingly hosted on cloud infrastructure to steal payment card data.
Palo Alto Unit 42 analyzed 2,241,354 web threat incidents and 831,550 unique URLs detected via Advanced URL Filtering between October 2020 and September 2021. Threat activity peaked from October 2020 to January 2021, coinciding with the holiday shopping season, with most malicious domains geolocated to the United States, Russia, and Germany. Web skimmers ranked third among the top five threat classes and showed the most code diversity, making detection harder. Researchers observed more web skimmer families being hosted on cloud platforms to steal payment data and PII.
24
30
30
30
55
30
30
30
30