60
60
30
30
55
30
30
55
30
USN-8766-1: Suricata-Update vulnerability
Ubuntu patches Suricata-Update path validation flaw allowing arbitrary file writes outside the rules directory from malicious rule archives.
Ubuntu security notice USN-8766-1 fixes a Suricata-Update vulnerability discovered by Guillem Lefait. The tool did not properly validate destination paths when extracting files referenced by downloaded rule archives, allowing an attacker to write arbitrary files outside the configured rules directory. Users are advised to update the suricata-update package.
10
35
30
Release Notes: Faster TI Investigations, Fresh Threat Research, and 650+ Threat Coverage Updates
ANY.RUN August release adds TI Lookup connections view, 81 behavior signatures, 16 YARA rules, 559 Suricata rules, and three new threat intelligence reports.
ANY.RUN released August product updates expanding its Threat Intelligence Lookup with a Connections block for pivoting between related observables (domains, IPs, URLs), JSON export for retrohunting and SIEM/NDR integration, and hidden whitelisted data by default. Detection coverage grew with 81 new behavior signatures, 16 YARA rules, and 559 Suricata rules covering malware execution, phishing, and C2 traffic. Three new Threat Intelligence Reports cover a US-focused RMM phishing campaign across 46 countries, the Mirage2FA phishing-as-a-service targeting Microsoft 365 (1,249 sandbox sessions, 9,332 potential compromise events), and a threat brief on OVERLORD RAT, CRPX0, and TRIBACK loader.
28
30
30
55
30
42
30
30
60
55
30
60
30
30
Week in review: 5 free CISA resources, surviving a DDoS attack, Google to make Cobalt Strike useless
57
57
55
30
30
Smishing Hackers Can Watch Every Keystroke as Victims Enter Card Details and OTPs
Group-IB details the JWR smishing kit, used by the Outsider cluster, that streams keystrokes and OTPs to fraudsters in real time via WebSocket.
Group-IB linked the JWR phishing kit to an operator cluster it tracks as Outsider within the broader Smishing Triad ecosystem. Fake toll, parcel, and delivery messages lead to live phishing pages that capture card numbers, passwords, and one-time passcodes before victims submit forms. The kit supports up to 32 guided pages, AES-256-CTR wrapped traffic with keys embedded per message, rotating short links and domains, and WordPress or Shopify integration markers, enabling account takeover and unauthorized payments.
58
China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access
VulnCheck discloses two factory implants, SPEAKINGSTONE and DARKLANTERN, in ZBT router firmware granting unauthenticated remote attackers root command execution.
VulnCheck found two previously undocumented implants in firmware from Shenzhen Zhibotong Electronics (ZBT), tracked as CVE-2026-74232 (SPEAKINGSTONE) and CVE-2026-74233 (DARKLANTERN), each rated 9.8 on CVSS 3.1. SPEAKINGSTONE (yunmgrd) beacons to a hardcoded C2 over UDP port 10000 and supports root command execution, PPPoE credential exfiltration, DNS hijacking, and reverse SSH tunnels; DARKLANTERN (infosrvd) listens on UDP port 9992 with weak hardcoded authentication. Scanning found 203 internet-facing DARKLANTERN instances across 22 countries, and 392 devices reported to the SPEAKINGSTONE backup C2, nearly all in China on China Mobile. No fixed firmware release is named, and ZBT's white-labeling means model number rather than brand is the reliable detection check.
68
What researchers learned about building an LLM security workflow
Oslo and FFI researchers show structured agentic workflows lift LLM alert-triage accuracy from 0% to about 93% on malicious cases.
Researchers at the University of Oslo and the Norwegian Defence Research Establishment tested GPT-5-mini, Claude 3 Haiku, Qwen3:30B, and Gemma 3:27B on alerts from the AIT Log Data Set V1.1; given only alert descriptions and log summaries, all four models correctly flagged zero percent of true-positive cases involving reconnaissance, brute-force logins, and initial access. Wrapping the same models in a workflow with constrained SQL queries over Suricata logs, an evidence summarizer, and a verdict stage with revision loops raised malicious-case accuracy to an average of 93 percent, with GPT-5-mini identifying every malicious case across 100 runs. The authors flag it as a proof-of-concept on one synthetic scenario and note models skewed conservative on benign alerts, with GPT-5-mini marking every benign case uncertain.
55
30
47
30
30
30
30