DEV Community: Mark0

Logging is a Discipline, Not a Switch

Mark0 — Thu, 08 Oct 2026 04:26:40 +0000

Effective Active Directory logging is more than just turning on a feature; it is a discipline that requires continuous tuning and maintenance. This guide outlines a structured four-step approach to building a successful logging program, starting with configuring log behavior and sizes to prevent data loss. It emphasizes the importance of transitioning from legacy audit categories to Advanced Audit Policy subcategories to capture high-fidelity events without overwhelming the system.

Beyond basic configuration, organizations must define specific detection goals targeting common adversary behaviors such as credential theft, PowerShell abuse, and security tool evasion. The process concludes with finding telemetry gaps and validating detections through tabletop exercises. By treating logging as a technical discipline rather than a one-time configuration, security teams can significantly improve their ability to detect and respond to intrusions within their Active Directory environment.

Read Full Article

One breach, please, and make no mistakes

Mark0 — Thu, 08 Oct 2026 04:25:30 +0000

The cybersecurity landscape is shifting as autonomous AI agents evolve from laboratory experiments to active threats against public infrastructure. These agent swarms can bypass traditional restrictions through logic-based probing, turning what once took red teams months of effort into campaigns that execute in a matter of hours. The article highlights that while current AI attacks often resemble noisy, high-volume penetration tests, the future will likely see more stealthy, persistent 'agentic' red team operations.

To build resilience, organizations must focus on defensive fundamentals rather than just perimeter security. This includes rehearsing incident response plans specifically for AI scenarios, hardening internal systems with FIDO2 multifactor authentication, and implementing comprehensive endpoint detection and response (EDR). By increasing the computational and financial cost per attack, defenders can lower the probability of success for relentless, non-tiring AI adversaries.

Read Full Article

Microsoft, Adobe, Apple, and Foxit vulnerabilities

Mark0 — Thu, 08 Oct 2026 04:24:18 +0000

Cisco Talos' Vulnerability Discovery & Research team has recently disclosed multiple critical vulnerabilities across various popular software and operating systems, including Adobe Photoshop, Apple macOS, Foxit Reader, and Microsoft Windows. These flaws encompass a range of severe issues such as privilege escalation, information disclosure, remote code execution (RCE), use-after-free, out-of-bounds reads, and type confusion.

Specifically, Adobe Photoshop was found vulnerable to privilege escalation via malformed files, while Apple macOS suffered from an information disclosure flaw in CoreWLAN. Foxit Reader presented two serious vulnerabilities: a remote code execution bug in its JavaScript functionality and a use-after-free flaw exploitable via malicious PDF documents. Microsoft Windows drivers (NETIO.sys, Cloud Files Mini Filter Driver, tcpip.sys) were impacted by multiple vulnerabilities including out-of-bounds reads, use-after-free, privilege escalation, information disclosure, type confusion, and denial-of-service.

All disclosed vulnerabilities have been patched by their respective vendors, aligning with Cisco's disclosure policy. Users are strongly advised to update their software immediately. Snort rule sets have also been updated to detect attempts to exploit these vulnerabilities, and further advisories are available on the Talos Intelligence website.

Read Full Article

The quest for simplicity: Why SMBs want advanced protection without the complexity

Mark0 — Thu, 08 Oct 2026 04:22:40 +0000

Small and Medium Businesses (SMBs) are increasingly targeted by sophisticated cyber threats, ranging from state-sponsored geopolitical attacks to financially motivated ransomware groups. The rise of AI-driven tactics has shortened the vulnerability exploitation window and enabled more convincing phishing campaigns. Furthermore, as SMBs adopt AI tools internally, they face a new attack surface involving unmanaged AI usage and potential manipulation by malicious actors.

Despite these risks, many SMBs are overwhelmed by complex security markets, operational overhead, and alert fatigue. To combat this, there is a growing need for "supervised security" which combines AI-powered automation with human oversight. This approach, often delivered through Managed Detection and Response (MDR), focuses on reducing the operational burden, providing 24/7 monitoring, and ensuring rapid recovery to maintain business continuity without requiring deep in-house expertise.

Read Full Article

Evolution of Web3 in Cloud Supply Chain Attacks

Mark0 — Thu, 08 Oct 2026 04:19:33 +0000

Threat actors, including state-sponsored groups like North Korea's Alluring Pisces, are increasingly shifting their command-and-control (C2) infrastructure to decentralized Web3 architectures. By leveraging smart contracts and blockchain transactions, these attackers can dynamically update botnet configurations and exfiltration endpoints, effectively bypassing traditional DNS sinkholing and IP-based blocking. This evolution is primarily seen in supply chain attacks targeting npm, Go, and Rust ecosystems, where poisoned packages harvest cloud IAM tokens and CI/CD secrets from developer environments.

The technical progression of these methods involves three distinct phases: EtherHiding, which uses hardcoded smart contract states; TxDataHiding, which utilizes transaction calldata to decouple C2 resolution; and NullReceiver, a zero-data address resolution technique that extracts C2 addresses from recipient wallet structures. To mitigate these threats, security teams should implement AI-driven behavioral analytics to detect anomalous blockchain traffic, enforce deep process inspection on developer workstations, and automate policy controls across build pipelines.

Read Full Article

Request, Aggregate, Bypass: How Attackers Can Evade LLM Safety Classifiers

Mark0 — Thu, 08 Oct 2026 04:18:19 +0000

Read Full Article

Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws

Mark0 — Thu, 08 Oct 2026 04:17:39 +0000

Anthropic has announced the expansion of its Cyber Verification Program (CVP), building on the success of Project Glasswing, which identified over 129,000 software vulnerabilities in just four months. The initiative provides vetted cybersecurity professionals with reduced-safeguard access to advanced AI models like Claude Opus 5.5, enabling specialized tasks in defense and red-teaming that would otherwise be blocked by standard safety filters.

Despite the surge in AI-driven vulnerability discovery, research indicates that actual exploitation remains low, with only a tiny fraction of Anthropic-identified flaws currently observed in the wild. Furthermore, security experts warn that AI-generated code still presents significant risks, as nearly 44% of AI-produced patches or code snippets may introduce new vulnerabilities, emphasizing the ongoing need for human oversight in AI-assisted security workflows.

Read Full Article

Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely

Mark0 — Thu, 08 Oct 2026 04:16:39 +0000

A critical unauthenticated remote code execution (RCE) vulnerability, tracked as CVE-2026-105192, has been discovered in LMCache, an open-source software used to accelerate large language model (LLM) servers such as vLLM. The flaw resides in the multiprocess mode, where the server uses the ZeroMQ messaging library. Due to insecure pickle deserialization of network messages, an attacker can execute arbitrary commands with the privileges of the LMCache process, which often runs as root in official container images.

There is currently no patched version available for LMCache, which affects versions 0.3.9 through 0.5.5. Security researchers at JFrog, who disclosed the flaw with a severity rating of 9.8, recommend that operators avoid assigning routable addresses to the multiprocess server and restrict access via firewalls or trusted cluster networks until a fix is released.

Read Full Article

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Mark0 — Thu, 08 Oct 2026 04:15:27 +0000

Threat actors are exploiting a critical remote code execution (RCE) vulnerability in the Realtek Jungle SDK (CVE-2021-35394) to deploy a sophisticated botnet malware known as Cling (or ClingSTUN). The malware is notable for its abuse of standard Session Traversal Utilities for NAT (STUN) protocol behavior to create a command-and-control (C2) channel. By disguising its traffic as legitimate NAT-traversal activity, Cling can bypass traditional network monitoring and even make operator commands appear as if they originate from trusted public services like Google's STUN servers.

Cling achieves persistence on infected systems by either modifying initialization scripts (SysV and BusyBox) or by hijacking the 'wget' binary. It targets a wide range of IoT devices, including routers and DVRs from vendors such as Realtek, D-Link, Linksys, and TP-Link, using a comprehensive library of embedded exploits. Once established, the botnet can be used for recursive propagation, proxying, TCP tunneling, and launching distributed denial-of-service (DDoS) attacks against various targets, including ISPs and gaming servers.

Read Full Article

How to fix a bug in a fix

Mark0 — Thu, 08 Oct 2026 04:14:18 +0000

This article explores the systemic challenges software vendors face when responding to critical security vulnerabilities, highlighting that testing and delivery—rather than triage or development—are the primary bottlenecks in the patching process. The risk of 'bricking' devices or causing data loss necessitates a cautious rollout, which often conflicts with the need for immediate remediation in the face of active exploitation.

To bridge this gap, the text details several emergency remediation strategies currently employed by major vendors, including feature flags for disabling vulnerable code, dynamic filtering for blocking malicious inputs, and hotpatching for in-memory code replacement. These methods allow for rapid response with reduced risk to system stability.

As AI and LLMs accelerate the discovery and exploitation of software flaws, the authors argue that vendors must move beyond standard update cycles. By implementing lightweight, pre-tested emergency mechanisms, organizations can significantly improve user protection during the critical window between vulnerability discovery and the release of a full software patch.

Read Full Article

Blinder Tunnel Campaign Targets Iraqi Infrastructure

Mark0 — Thu, 08 Oct 2026 04:13:13 +0000

⚠️ Region Alert: UAE/Middle East

Security researchers have identified a sophisticated cyber espionage campaign dubbed "Blinder Tunnel," attributed to the Iranian state-aligned threat actor CL-STA-1178. The operation targets critical infrastructure in Iraq, Israel, and the United Arab Emirates by impersonating the Dubai Airports IT department through fraudulent recruitment lures. The attack chain begins with trojanized Visual Studio coding challenges, utilizing a three-stage execution process that includes malicious .csproj files, AppDomainManager hijacking, and DLL sideloading to deploy custom backdoors.

The campaign's toolset features modular malware such as ShelbyLoader V2, ShelbyC2 V2, and an in-memory Chisel tunneling wrapper named Blackwood. A key characteristic of this actor's tradecraft is the misuse of legitimate GitHub API infrastructure for command-and-control (C2) communications, including the use of GitHub Issues as a resilient fallback mechanism. The actor consistently employs a "Peaky Blinders" pop-culture theme throughout its infrastructure, which ultimately aided analysts in attribution through operational security failures and embedded metadata.

Read Full Article

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Mark0 — Wed, 07 Oct 2026 04:15:14 +0000

Threat actors are actively exploiting a critical vulnerability in the Realtek Jungle SDK (CVE-2021-35394) to distribute a botnet malware known as Cling (or ClingSTUN). This malware is particularly notable for its sophisticated use of the Session Traversal Utilities for NAT (STUN) protocol to establish command-and-control (C2) channels. By embedding malicious traffic within harmless-looking STUN packets and utilizing public STUN infrastructure, the botnet can evade traditional network monitoring that expects such traffic to be legitimate NAT-traversal activity.

Once a device is compromised, Cling achieves persistence through several methods, including modifying system init scripts or hijacking the wget binary. The malware functions as a backconnect proxy and a worm, carrying a library of exploits for various routers and DVRs to facilitate self-propagation. Beyond expanding its reach, the botnet is used to launch denial-of-service attacks and create encrypted tunnels, often making its commands appear as if they are originating from reputable services like Google's STUN servers.

Read Full Article