30
42
57
45
55
30
55
60
60
55
42
55
55
30
30
55
30
55
60
42
DDRop Attack Forces Intel TDX Confidential VMs Into Debug Mode and Exposes Memory
KU Leuven and ETH Zurich researchers released DDRop PoC hardware that forces Intel TDX confidential VMs into debug mode and exposes plaintext memory.
Researchers from KU Leuven, ETH Zurich, Google, and Durham University published proof-of-concept code, hardware designs, and firmware for DDRop, a DDR5 interposer that injects parity errors to drop selected cache-line writebacks. Because Intel TDX, Intel Scalable SGX, and AMD SEV-SNP lack per-line cryptographic freshness, processors decrypt and accept stale DRAM contents as current state. The PoC flips a victim's ATTRIBUTES.DEBUG flag to enable TDX debug mode, then copies victim memory in plaintext and can forge attestation reports. Affected environments include Intel 5th- and 6th-generation Xeon Scalable with TDX; Intel says the attack falls outside its cloud-computing threat model.
65
30
Top 10 Best Application Control & Allowlisting Tools in 2026
Roundup ranks 2026 application allowlisting tools, scoring ThreatLocker 8.8/10, Airlock Digital 8.5/10 and free Microsoft WDAC among top default-deny options.
This is a scored buyer's guide to ten application control and allowlisting tools for 2026, with ThreatLocker ranked first (8.8/10), Airlock Digital second (8.5/10) and Microsoft's built-in WDAC/AppLocker third (7.2/10). It notes ransomware has renewed interest in default-deny execution controls and that CISA and other agencies list application control among the most effective yet under-deployed mitigations. The evaluation is research-based with no lab testing, weighting policy automation at 30% and operability at 25%.
18
57
55
55
30
Scytale expands vendor risk management with AI-powered TPRM tools
Scytale launched AI-powered third-party risk management in its Vendors module, automating vendor discovery, risk scoring, and continuous vendor posture monitoring.
Scytale added AI-driven TPRM capabilities to its Vendors module, combining automatic vendor discovery from SSO providers and integrations with AI enrichment and dynamic risk scoring. The platform now continuously monitors vendors for breaches, data exposures, and vulnerabilities via third-party intelligence APIs, with proactive email notifications and auto-generated audit-ready security reports. It integrates with cross-framework control mapping for SOC 2, ISO 27001, GDPR, HIPAA, and SOX ITGC. Scytale cites Verizon's 2026 DBIR, which found 48% of breaches involved a third party, up 60% year over year.
20
30
60
Gambling Goblin Turns Brazilian Government Sites Into SEO Weapons
Check Point links Chinese-speaking cluster Gambling Goblin to SEO-fraud compromises of Brazilian government sites via malicious Apache modules since mid-2025.
Check Point Research dubbed the cluster Gambling Goblin and linked it with medium-to-high confidence to Earth Berberoka, a Chinese-speaking group Trend Micro documented in 2022, citing shared oRAT tooling, Chinese-language artifacts, and domains mimicking trusted tech brands. Custom Apache modules installed on compromised Brazilian government and education servers acted as reverse proxies, routing selected visitors to gambling and sports-betting phishing pages impersonating Google Play, the Microsoft Store, and Amazon while stripping CSP headers. The broader Linux toolkit included the DownPro downloader, AlphaAgent and oRAT backdoors, the 3snake-based PasswordHarvester credential stealer, and an SSH brute-forcer, with operations extending to Vietnamese, Spanish, and English phishing pages.
64
55
55
55
gr-PHYSEC: Real-time Channel-based Key Generation for Physical Layer Secure Wireless Communications
gr-PHYSEC GNU Radio module derives symmetric encryption keys from wireless channel randomness using a neural network, validated on robotic platforms with ADALM-Pluto SDRs.
The paper introduces gr-PHYSEC, a GNU Radio out-of-tree module for real-time physical-layer key generation that derives symmetric keys from the wireless channel's inherent randomness instead of pre-shared secrets. A trained neural network extracts channel features between trusted parties during probe exchanges; features are quantized into binary keys, reconciled via Reed-Solomon encoding, and secured with SHA-512 hashing before direct use for encryption. Real-world experiments at the FAU CAAI connected robotics testbed using ADALM Pluto software-defined radios and NVIDIA Jetson Orin demonstrated low key disagreement rates and NIST-verified randomness. Source code is publicly available on GitHub.
25
30
12 Best CNAPP Platforms Compared (2026): Features & Pricing
Independent comparison of 12 CNAPP platforms finds identical estates draw quotes 2-3x apart; Microsoft Defender for Cloud is the only fully published per-resource option.
A vendor-independent buyer's guide compares twelve CNAPP platforms including Prisma Cloud, CrowdStrike Falcon Cloud Security, Wiz, Uptycs, Aqua, Zscaler, and Microsoft Defender for Cloud on pricing mechanics, procurement leverage, and capability-per-dollar. It finds quotes swing 2-3x on identical estates because vendors define 'workload' differently. Microsoft Defender for Cloud is highlighted as the only major with fully published per-resource rates.
6
45
55
55