Threat actors use GSocket to keep access after Linux web flaws are fixed
Defender detections rose 356.2% from March to August 2026, and patching the original web flaw does not remove the client.
Stories per day · 30 days
3 RSS
Relatedcsrf2access-control1acl1authorization1broken-object-level1clickjacking1command-and-control1gsocket1http1linux1method-interchange1persistence1runtime-detection1web-cache-deception1
7 stories, newest first · one card per story
Stories tagged #web-applications
Cross-Evidence Learning Detects Broken Object-Level Authorization in Web Applications
The method reconstructs authorization relations from request-response transactions to detect BOLA in black-box systems.
2009 HP report says ACL checks fail for multi-principal access
HP Labs argued missing cross-message state lets clickjacking and CSRF bypass ACL decisions on many web applications.
POST-to-GET interchange found on 407 of Tranco top 10k
Some equivalent GETs accept CSRF tokens rejected on POST and return cacheable responses.
EvoWeb benchmark tests coding agents on evolving web apps
It uses 320 cumulative requests across 32 applications and a live-browser tester for integration and regressions.
SWEeper-Bench: Can Agents Discover Bugs in Interactive Software?
SWEeper-Bench tests whether coding agents can find and fix interaction-only bugs across 200 real web apps.
Threat Matrix: Mapping threats across cloud web applications
Microsoft released a Cloud Web Applications Threat Matrix, a MITRE ATT&CK-aligned framework mapping threats to cloud-hosted web apps and serverless platforms.
4