Recon

RECON

Updated 4m ago
High-Signal Security Intelligence

2026-04-03

Alexander V. Leonov220IN STACK · 2026-04-03 17:00

About Remote Code Execution – Microsoft SharePoint (CVE-2026-20963) vulnerability

About Remote Code Execution – Microsoft SharePoint (CVE-2026-20963) vulnerability. This vulnerability was fixed in the January MSPT. At the time of the MSPT release on January 13, VM vendors did not highlight this vulnerability in their reviews, and Microsoft reported no evidence of exploitation in the wild. The CVSS vector was initially rated as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H […]
SentinelOne214IN STACK · 2026-04-03 13:00

The Good, the Bad and the Ugly in Cybersecurity – Week 14

SentinelOne stops LiteLLM supply chain attack in real time, attackers weaponize Axios to deploy RAT, and Chrome zero-day enables RCE.
Simon Willison72 · 2026-04-03 13:54

The Axios supply chain attack used individually targeted social engineering

The Axios team have published a full postmortem on the supply chain attack which resulted in a malware dependency going out in a release the other day , and it involved a sophisticated social engineering campaign targeting one of their maintainers directly. Here's Jason Saayman'a description of how that worked : so the attack vector mimics what google has documented here: https://cloud.google.com/blog/topics/threat-intelligence/unc1069-targets-cryptocurrency-ai-social-engineering they tailore...
Rapid7 Blog45 · 2026-04-03 19:06

Metasploit Wrap-Up 04/03/2026

Additional Adapters and More Modules This week, we added a whole new bunch of HTTP/HTTPS-based CMD payloads for X64 and X86 versions of Windows. The additional breadth of selectable payloads and delivery techniques allows users new options to tailor the attack workflow for their environment. This was contributed by  bwatters-r7 . Adding new architectures for adapted payloads is surprisingly easy and something a first-time contributor might want to look into! New modules added to Metasploit Fr...
Trail of Bits45 · 2026-04-03 11:00

Simplifying MBA obfuscation with CoBRA

Mixed Boolean-Arithmetic (MBA) obfuscation disguises simple operations like x + y behind tangles of arithmetic and bitwise operators. Malware authors and software protectors rely on it because no standard simplification technique covers both domains simultaneously; algebraic simplifiers don’t understand bitwise logic, and Boolean minimizers can’t handle arithmetic. We’re releasing CoBRA , an open-source tool that simplifies the full range of MBA expressions used in the wild. Point it at an ob...
Rapid7 Blog40 · 2026-04-03 13:46

You Don’t Have a Security Problem, You Have a Visibility Problem

What you’ll learn in this article This article explains why many breaches are driven by gaps in visibility rather than advanced exploits, how attackers move through modern environments, and what changes when organizations start connecting assets, identities, and attack paths into a single view. What is a visibility problem in cybersecurity? A visibility problem exists when security teams cannot clearly answer three basic questions: what assets exist, who or what can access them, and how those...
Freek Van der Herten27 · 2026-04-03 10:30

Under the Hood: How Blaze Speeds Up Blade Templates

A deep dive into how Blaze works internally. Matt Stauffer builds two toy versions from scratch to show how Blaze shifts Blade component rendering from runtime to compile time. Read more
Full Disclosure20 · 2026-04-03 03:52

[CVE-2026-33691] OWASP CRS whitespace padding bypass vulnerability

Posted by cyber security on Apr 02 A vulnerability was identified in OWASP CRS where whitespace padding in filenames can bypass file upload extension checks, allowing uploads of dangerous files such as .php, .phar, .jsp, and .jspx. This issue has been assigned CVE‑2026‑33691. Impact: Attackers may evade CRS protections and upload web shells disguised with whitespace‑padded extensions. Exploitation is most practical on Windows backends that normalize whitespace in filenames...
Unit 4217 · 2026-04-03 22:00

When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi-Agent Applications

Unit 42 research on multi-agent AI systems on Amazon Bedrock reveals new attack surfaces and prompt injection risks. Learn how to secure your AI applications. The post When an Attacker Meets a Group of Agents: Navigating Amazon Bedrock's Multi-Agent Applications appeared first on Unit 42 .
Trend Micro Simply Security17 · 2026-04-03 00:00

Weaponizing Trust Signals: Claude Code Lures and GitHub Release Payloads

A packaging error in Anthropic’s Claude Code npm release briefly exposed internal source code. This entry examines how threat actors rapidly weaponized the resulting attention, pivoting an existing AI-themed campaign to spread Vidar and GhostSocks.
idiallo.com15 · 2026-04-03 12:00

My Zip bomb strategy is not as effective as it used to be

Last year, I wrote about my server setup and how I use zipbombs to mitigate attacks from rogue bots. It was an effective method that helped my blog survive for 10 years. I usually hesitate to write these types of articles, especially since it means revealing the inner workings of my own servers. This blog runs on a basic DigitalOcean droplet, a modest setup that can handle the usual traffic spike without breaking a sweat. But lately, things have started to change. My zipbomb strategy doesn't ...
Full Disclosure15 · 2026-04-03 03:53

[KIS-2026-06] MetInfo CMS <= 8.1 (weixinreply.class.php) PHP Code Injection Vulnerability

Posted by Egidio Romano on Apr 02 --------------------------------------------------------------------------- MetInfo CMS --------------------------------------------------------------------------- [-] Software Link: https://www.metinfo.cn [-] Affected Versions: Versions 7.9, 8.0, and 8.1. [-] Vulnerability Description: The vulnerable code is located into the...
Blog | Praetorian12 · 2026-04-03 16:26

Meet Vespasian. It Sees What Static Analysis Can’t.

Praetorian is excited to announce the release of Vespasian, a probabilistic API endpoint discovery, enumeration, and analysis tool. Vespasian watches real HTTP traffic from a headless browser or your existing proxy captures and turns it into API specifications (OpenAPI, GraphQL SDL, WSDL). We built it because pentesters spend the first days of every API engagement […] The post Meet Vespasian. It Sees What Static Analysis Can’t. appeared first on Praetorian .
ElcomSoft blog12 · 2026-04-03 12:00

Compelled Decryption: The East Asian Region

This piece marks the third installment in our ongoing series analyzing compelled decryption laws. As digital evidence continues to play a central role in modern investigations, legal systems worldwide are actively addressing the friction between encrypted devices and law enforcement access. For this chapter, our geographic focus shifts to East Asia. The region provides a […]
先知安全技术社区12 · 2026-04-03 08:57

KashiCTF 2026 WriteUp

KashiCTF 2026 WriteUp
Hayden James12 · 2026-04-03 01:39

curl Command in Linux with Examples

curl is more than just a download tool. This practical guide covers HTTP headers, API testing, authentication, SSL inspection, timing analysis, and real-world one-liners that sysadmins actually use. Continue reading...
gilesthomas.com11 · 2026-04-03 23:50

Writing an LLM from scratch, part 32h -- Interventions: full fat float32

This is the last of the interventions I'm trying out to see if I can improve the test loss for a from-scratch GPT-2 small base model, trained on code based on Sebastian Raschka 's book " Build a Large Language Model (from Scratch) ". Back when I did my first training run for a base model, on my local RTX 3090 , I used two optimisations: Setting the 32-bit floating point matrix multiplication precision to "high" rather than to "highest" , which means that it uses lower-precision (but still tec...
Deeplinks9 · 2026-04-03 23:15

Triple Header for Privacy’s Defender in New York

You’re invited on a journey inside the privacy battles that shaped the internet. EFF’s Executive Director Cindy Cohn has tangled with the feds, fought for your data security, and argued before judges to protect our access to science and knowledge on the internet. Join Cindy at three events in New York discussing her bestselling new book:   Privacy's Defender: My Thirty-Year Fight Against Digital Surveillance , on sale now. All proceeds from the book benefit EFF. Find the full event details be...
Deeplinks9 · 2026-04-03 15:58

Double Shot of Privacy's Defender in D.C.

You’re invited on a journey inside the privacy battles that shaped the internet. EFF’s Executive Director Cindy Cohn has tangled with the feds, fought for your data security, and argued before judges to protect our access to science and knowledge on the internet. Join Cindy at two events in Washingtion, D.C. on April 13 and 14 discussing her new book: Privacy's Defender: My Thirty-Year Fight Against Digital Surveillance , on sale now. All proceeds from the book benefit EFF. Find the full even...
Deeplinks8 · 2026-04-03 17:37

Tech Nonprofits to Feds: Don’t Weaponize Procurement to Undermine AI Trust and Safety

While the very public fight continues between the Department of Defense and Anthropic over whether the government can punish a company for refusing to allow its technology to be used for mass surveillance, another agency of the U.S. government is quietly working to ensure that this dispute will never happen again. How? By rewriting government procurement rules. Using procurement — meaning, the processes by which governments acquire goods and services  — to accomplish policy goals is a time-ho...
Infosecurity8 · 2026-04-03 08:00

New Phishing Platform Used in Credential Theft Campaigns Against C-Suite Execs

A large-scale credential theft campaign targeting senior executives has been linked to a previously unknown automated phishing platform called Venom