DEV Community: Mark0

Finding and Addressing Vulnerable and Outdated Web Application Components

Mark0 — Thu, 02 Jul 2026 04:43:25 +0000

Vulnerable and outdated third-party components like jQuery, Angular, and Bootstrap remain a pervasive security risk in modern web applications. These libraries can introduce vulnerabilities ranging from minor information disclosure to critical remote code execution. Identifying these risks requires security professionals to move beyond basic automated scanning and perform manual inspections of the application's site map and file sources using browser developer tools.

To effectively manage these risks, testers can utilize tools like Wappalyzer for component identification and the Snyk Vulnerability Database for tracking known exploits. Organizations are encouraged to maintain strict patching cycles, monitor component lifecycles, and remove unneeded libraries to reduce the overall attack surface and maintain a strong security posture.

Read Full Article

Update: base64dump.py Version 0.0.30

Mark0 — Thu, 02 Jul 2026 04:40:30 +0000

Didier Stevens has released a new update for base64dump, version 0.0.30. This version introduces the --stats option, designed to assist in the statistical analysis of base64-encoded strings. This feature is particularly useful for identifying anomalies in encoded data that may indicate malicious intent.

The update was prompted by a SANS Internet Storm Center (ISC) diary entry titled "Evil MSI Background: BASE64 Statistical Analysis," which details the use of statistical methods to analyze MSI files. The tool provides a practical way for security researchers to apply these methodologies during malware analysis and digital forensics.

Read Full Article

Overview of Content Published in June

Mark0 — Thu, 02 Jul 2026 04:38:45 +0000

This post provides a comprehensive overview of the cybersecurity content published by the author during the month of June 2026. It highlights contributions across multiple platforms, specifically focusing on personal blog posts and entries for the SANS Internet Storm Center (ISC) Diary.

The compilation serves as a centralized reference for security professionals to access technical analyses, malware research, and threat intelligence reports released throughout the period. It underscores the author's continuous involvement in the infosec community and provides a structured way to review past research.

Read Full Article

Train, triage, repeat: The AI agent changing how we fight phishing

Mark0 — Thu, 02 Jul 2026 04:37:56 +0000

With the rise of AI-powered phishing attacks, which reached over 3.8 million incidents in 2025, security teams are facing unprecedented scales of triage. Red Canary has addressed this challenge by implementing an AI triage agent that utilizes a complex graph workflow of orchestrated subagents. This system moves away from a single "catch-all" model toward specialized nodes for email parsing, enrichment, and feature extraction, achieving a 94% accuracy rate through precise agentic loops.

The architecture combines traditional boolean logic with advanced Natural Language Processing (NLP) to extract rich features, such as sentiment and intent, from suspicious emails. A deterministic rules engine ensures reliability by pairing TTP-level detection with atomic indicators, while a hybrid AI/ML classification model handles cases where specific rules aren't met. By maintaining a human-in-the-loop feedback cycle, analysts can focus on bespoke threats while the agent handles the bulk of high-volume triage, providing transparent explanations for every decision.

Read Full Article

The Autonomous SOC, Revisited: What 18 Months on the Road Has Taught Us

Mark0 — Thu, 02 Jul 2026 04:36:07 +0000

This article explores the progression of the Autonomous SOC maturity model, highlighting that the transition to an automated security environment is an organizational journey rather than a single technical deployment. SentinelOne reflects on eighteen months of real-world implementation, noting that while AI technology has advanced significantly, the primary barriers to achieving partial autonomy (Level 3) remain grounded in governance, accountability, and the establishment of trust-based data foundations.

Security leaders are encouraged to treat autonomy as a scaling organizational capability rather than a feature list. By defining clear rules of engagement and audit trails, teams can shift from manual alert fatigue to high-level oversight. Ultimately, the path toward a high-autonomy SOC requires a disciplined approach to policy and human-in-the-loop governance to ensure that automated responses are defensible and effective against modern attacker asymmetry.

Read Full Article

OpenClaw: risks for the users and how to mitigate them

Mark0 — Thu, 02 Jul 2026 04:34:02 +0000

OpenClaw is a rapidly growing AI agent ecosystem designed for automating complex tasks through natural language instructions. While its flexibility and modular "skills" architecture have led to widespread adoption, it introduces significant security risks to organizations. Recent reports indicate over 500 vulnerabilities in the platform, often involving insecure data storage and excessive privilege escalation, making it a prime target for attackers.

A major threat vector involves malicious "skills" distributed via centralized hubs like ClawHub. These skills can execute harmful natural language commands or bash scripts, effectively acting as modern supply-chain attacks. To mitigate these risks, organizations should implement layered protection, monitor agent network access, and employ security scanning solutions like Kaspersky Scan Engine to vet skills before deployment.

Read Full Article

Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector

Mark0 — Thu, 02 Jul 2026 04:32:14 +0000

⚠️ Region Alert: UAE/Middle East

Unit 42 researchers have identified a new supply chain threat termed "phantom squatting," where adversaries register nonexistent web domains that are consistently hallucinated by large language models (LLMs). By analyzing over 900 global brands and 2.1 million AI-generated URLs, the study found that attackers are proactively weaponizing these "born clean" domains to bypass traditional reputation-based security filters. A notable case involved an attacker using an AI coding assistant to develop a phishing kit named Montana Empire, targeting a domain predicted by researchers 23 days prior.

The research highlights that approximately 250,000 unique phantom domains remain unregistered, presenting a significant opportunity for preemptive exploitation. This vulnerability is particularly dangerous for autonomous AI agents and developers who trust LLM-generated URLs for documentation or API endpoints. Because these hallucinations are often predictable based on a model's internal language patterns, defenders have a unique window—the adversarial exploitation window—to identify and block these domains before they are officially registered and weaponized.

Read Full Article

Falcon Cloud Security June 2026 Release: Updates for Azure and Google Cloud

Mark0 — Thu, 02 Jul 2026 04:30:18 +0000

CrowdStrike has announced significant updates to its Falcon Cloud Security platform, focusing on enhancing visibility and risk management across multi-cloud environments. The latest innovations expand capabilities in Cloud Security Posture Management (CSPM), Data Security Posture Management (DSPM), and Cloud Infrastructure Entitlement Management (CIEM) specifically for Microsoft Azure and Google Cloud. By unifying these workflows, security teams can maintain consistent security oversight across AWS, Azure, and Google Cloud platforms.

A major highlight of this release is the introduction of real-time CSPM for Google Cloud. Unlike traditional snapshot-based scanning that often suffers from visibility gaps, this feature enables the detection of misconfigurations and asset changes within minutes. This shift toward real-time monitoring helps defenders identify potential breach paths and cloud exposures as they emerge, facilitating faster remediation and reducing the window of opportunity for attackers.

Read Full Article

Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique

Mark0 — Thu, 02 Jul 2026 04:28:49 +0000

Check Point Research recently analyzed nearly 3,000 files attributed to DeepSeek, identifying a significant portion as malicious or dangerous. A key discovery was a sample implementing an "In-Browser Ransomware" technique. This method exploits the browser-native File System Access API by social engineering victims into granting folder permissions under the guise of a legitimate utility, such as an AI image upscaler. Once access is granted, the script can enumerate, exfiltrate, and encrypt local files without needing a traditional native payload or system exploitation.

The research highlights how modern LLMs like DeepSeek can bridge the gap between theoretical platform risks and practical attack chains. While frontier models often refuse direct requests to create ransomware, they may still generate the necessary functional components when prompted with broader requirements or through creative iteration. This capability allows attackers with limited expertise to operationalize complex techniques, particularly targeting sensitive data on Android devices using Chromium-based browsers where the File System Access API is supported.

Read Full Article

Browser Security: Zero-Days Are Only Part of the Problem

Mark0 — Thu, 02 Jul 2026 04:27:18 +0000

The browser has evolved into the primary operating environment for modern enterprises, making it a high-value target for sophisticated attackers. Recent threat reports highlight a significant shift, with vulnerability exploitation surpassing stolen credentials as the leading breach entry point. The prevalence of zero-day vulnerabilities in shared components like Chromium exacerbates this risk, as a single flaw can simultaneously expose multiple browser platforms across managed and unmanaged devices.

Defending against these threats is complicated by the time gap between vulnerability discovery and patch deployment. Attackers often exploit these windows using complex chains that include rendering logic flaws, sandbox escapes, and session hijacking. Because web activity is constant and user-driven, traditional security perimeters often lack the real-time visibility needed to stop these browser-mediated attacks before they lead to data exfiltration or privilege escalation.

To mitigate these risks, organizations are turning to runtime security solutions like CrowdStrike Falcon Secure Access. By employing JavaScript Language Randomization (JSLR), the platform creates a moving target defense within the browser's execution environment, neutralizing exploits even before patches are available. This approach provides a consistent security layer across any browser and device, protecting identities and sensitive data at the point where web risk intersects with business operations.

Read Full Article

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

Mark0 — Thu, 02 Jul 2026 04:25:30 +0000

In July 2025, a sophisticated cyber attack utilized SEO poisoning to deliver the BumbleBee loader through trojanized ManageEngine OpManager installers. Upon execution via DLL side-loading, the malware established communication with its command-and-control (C2) infrastructure and deployed an AdaptixC2 beacon. This allowed the threat actor to perform extensive network reconnaissance, map internal systems, and establish persistence using new domain admin accounts and remote access tools like RustDesk and Cloudflared.

The intrusion progressed into significant credential harvesting, where actors dumped the NTDS.dit Active Directory database and extracted Veeam backup credentials. Lateral movement was facilitated through RDP and reverse SSH tunneling to bypass firewall restrictions. Over 75GB of sensitive data, including file shares and SYSVOL configurations, was exfiltrated via FileZilla to an external server in Ukraine. The operation culminated in the deployment of Akira ransomware, which utilized WMI to delete Volume Shadow Copies and encrypt both root and child domains.

Read Full Article

Anthropic to restore Claude Fable access on Wednesday

Mark0 — Thu, 02 Jul 2026 04:22:37 +0000

Anthropic has announced plans to restore access to the Claude 'Fable' model, following a period where users were unable to utilize this specific iteration of the AI. The restoration is scheduled to take place this Wednesday, bringing back functionality that users had previously come to rely on for specific tasks and interactions.

The decision to bring back the Fable model reflects Anthropic's responsiveness to user feedback and the ongoing evolution of their large language model offerings. This move ensures that the diverse capabilities of their AI suite remain accessible to their user base while they continue to refine their core technologies.

Read Full Article