ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “open-source software”

30 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 1041Malware 546Ransomware 418Exploit / PoC 373Threat actor 190Data breach 155Industry 133Policy & legal 127Phishing & fraud 58AI safety & security 51Tools 45AI tools & infra 32Research 30AI industry 24
SeverityAllcritical 1495high 933medium 496low 207info 140

An Empirical Security Analysis of Open-Source Software Used in Onboard Satellite Systems

Study of 126 onboard satellite OSS repositories finds 2,827 security findings, 72% medium severity or higher, dominated by memory safety and code quality weaknesses.

Researchers performed an empirical security analysis of 126 public repositories of open-source software used in onboard satellite systems using SBOM generation, software composition analysis, static application security testing, infrastructure-as-code analysis, and secret scanning. After cleaning and deduplication the pipeline produced 2,827 findings, with medium-severity findings accounting for 49% and 72% classified medium or higher. A CWE-based taxonomy mapped all findings to eight weakness families, with Memory Safety and Code Quality dominating, followed by Input Validation and Injection. Project-developed code accounted for 81.4% of findings, though external dependency code remained relevant; findings do not establish mission-specific exploitability.

arXiv cs.CR · 1d agoResearch1

Propagation Model for SSC attacks: Why SBOM (tools) don't tell the whole truth

Study shows open-source SBOM tools only cover structural exposure and vulnerability presence, missing code reachability and taint-path analysis stages.

An arXiv paper proposes a four-stage propagation model for software supply chain attack effects and empirically evaluates four open-source SBOM tools against it using three projects and the Log4j vulnerability as the test case. Current SBOM tools systematically support only Stage 1 (structural exposure) and Stage 2 (vulnerability class presence), while Stage 3 (code reachability) and Stage 4 (taint path analysis) require capabilities absent from the SBOM ecosystem. The authors argue propagation-centred SSC security research is needed to prevent cyber risk from evolving into systemic risk.

arXiv cs.CR · 11d agoResearch1

Scareware ads keep running on Google's transparency tool, even after they're reported

NYU and Radboud researchers built AdLens, which found 238 scareware and 3,346 false-claim ads in Google's ad archive; reported ads often stayed live.

The AdLens tool, built by NYU and Radboud University researchers, mined Google's Ads Transparency Center and screened 188,000 software ad creatives using similarity search plus a panel of open-source language models, finding 238 scareware ads, 3,346 false-claim ads, and 258 anonymity-avoiding ads with over 100 million impressions in Europe. Reporting ads through Google's standard flow produced inconsistent removals: some ads acknowledged as violations stayed live, and after one takedown tied to the TamperedChef malware domain, 41 other ads pointing to the same domain kept running. The pipeline runs entirely on open-weight models at low cost (a $96 DigitalOcean VM plus $1.57/hour L40S inference) and is designed to extend to Meta and Amazon ad libraries.

Help Net Security · 14d agoResearch

A Feature-Rich Embedded NIDS with eBPF/XDP: Detector and Architecture Trade-offs

eBPF/XDP-based NIDS with Isolation Forest reaches 0.965 live F1 on DDoS replay; gRPC microservices match monolithic accuracy within 2ms overhead.

The paper presents a DDoS-focused network intrusion detection system for transport networks built with Ericsson, combining a statistical baseline with an Isolation Forest trained on flow features from GoFlowMeter, an open-source Go implementation of CICFlowMeter, plus eBPF/XDP kernel-level traffic filtering. On a Raspberry Pi 5 testbed replaying CIC-DDoS2019 as real traffic, the Isolation Forest achieves 0.965 recall/F1 live in the monolithic variant, catching low-volume attack windows the baseline misses. gRPC microservices nearly match monolithic accuracy adding under 2ms per window, while the Kafka pipeline trails by roughly nine percentage points and adds about 27ms.

arXiv cs.CR · 4d agoResearch

Code review used to be the only way to catch these bugs

Palo Alto Networks' Unit 42 says its NOVA system found 14,090 vulnerabilities in 3,915 open-source projects, mostly non-crashing bugs like access control flaws.

Unit 42's NOVA system analyzed 3,915 open-source projects over two months and reported 14,090 validated vulnerabilities, only 85 of which matched previously documented findings. 92% of findings fell outside fuzzing-friendly categories, clustering instead in access control, path traversal, injection, prototype pollution, and SSRF; language ecosystems showed distinct weakness profiles. Of 5,421 supply-chain findings, 1,280 were flaws in dependencies while 4,141 were downstream exposures, 2,776 validated with working proof-of-concepts. Unit 42 warned that faster discovery combined with an average 55-day patch deployment window has collapsed the patch-to-exploit gap.

Help Net Security · 21d agoResearch

1Password's AI patching benchmark is misleading

Trail of Bits reanalysis says 1Password's 26% AI clean-fix rate is misleading; 86% of eligible patches blocked exploits.

Trail of Bits critiques 1Password's FLAWED AI patching benchmark, arguing its 26% clean-fix headline mixes trials where agents were instructed to apply wrong fixes (22% of data) with trials that prohibited compiling or testing (36%). Restricting to reasonable conditions, 2,634 of 3,067 patches (86%) blocked the supplied exploit. Trail of Bits also reports 12.5% of 2,265 developer first fixes failed in its own 2024-2026 assessments, and released post-patch-validation and review-walkthrough agent skills.

Lobsters · security · 11h agoResearch

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News · 26d agoResearch2

New hardware device can RAM into encrypted memory, expose your data

Researchers built a $200 DDR5 interposer that silently drops memory writes to break TDX, SGX, and SEV-SNP confidential VM integrity, requiring physical access.

Researchers from KU Leuven, ETH Zurich, Durham University, and Google demonstrated DDRop, a hardware interposer costing under $200 that corrupts DDR5 bus commands to silently drop writes to encrypted memory, enabling replay attacks on confidential VMs. Because scalable memory encryption lacks freshness checks, protected VMs keep computing on stale attacker-selected data; on an Intel TDX server the attack forces debug mode for plaintext memory reads or forges attestation reports, succeeding in under two minutes without crashing. Intel and AMD both called the attack out of scope for their cloud threat models, with no mitigation planned, and proposed cache line versioning appears still vulnerable. The full interposer design is being released as open-source hardware.

The Register · Security · 1d agoResearch

Hacking Public Wi-Fi DNS to Steal Credentials

Attackers can hijack public Wi-Fi DNS to redirect users to credential-stealing fake login pages; commenters debate HTTPS limits and mitigations like encrypted DNS.

The discussion examines how an attacker controlling DNS on shared or public Wi-Fi networks can redirect requests for legitimate services to attacker-controlled servers to steal credentials. Commenters analyze whether HTTPS and certificates mitigate the attack, noting attackers often rely on HTTP or browser trust quirks. Suggested defenses include encrypted DNS (DoH), DNSSEC, and travel routers running OpenWRT. No specific campaign, victims, or indicators are provided.

Schneier on Security · 29d agoResearch1

The AI Malware Maturity Gap

Recorded Future introduces AIM3, a five-level maturity model for AI malware, showing current attacker AI use is mostly AI-assisted rather than autonomous.

Recorded Future proposes AIM3, a five-level model defining AI malware from LLM-translated to LLM-embedded, spanning experimentation to fully autonomous agentic campaigns. Public examples remain early-stage: PROMPTFLUX uses Google Gemini to rewrite its VBScript dropper (Level 1), while Lamehug/PROMPTSTEAL, attributed to APT28, invokes the HuggingFace API to generate reconnaissance commands (Level 3). The authors argue most current AI malware augments existing tradecraft rather than enabling one-click autonomous attacks.

Recorded Future · 21d agoResearch

The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

Unit 42 demonstrates that root access on a Kubernetes node lets attackers spoof SPIFFE/SPIRE attestation and harvest co-located workloads' SVIDs.

Palo Alto Networks Unit 42 describes post-exploitation techniques in which an attacker with root on a compromised Kubernetes node spoofs Linux cgroup metadata used by the SPIRE agent during workload attestation, tricking it into issuing a co-located workload's SPIFFE Verifiable Identity Document to an attacker-controlled process. The research shows the core trust assumption of machine-identity systems—that the node is trusted—collapses once root is obtained, exposing all cryptographic identities scoped to that node. Unit 42 released an open-source tool, Spooffe, for defenders to test identity exposure, and notes the technique has not been observed exploited in the wild.

Palo Alto Unit 42 · 5d agoResearch 9 sources1