Recon

RECON

Updated 4m ago
High-Signal Security Intelligence

2026-04-07

Simon Willison62 · 2026-04-07 20:52

Anthropic's Project Glasswing - restricting Claude Mythos to security researchers - sounds necessary to me

Anthropic didn't release their latest model, Claude Mythos ( system card PDF ), today. They have instead made it available to a very restricted set of preview partners under their newly announced Project Glasswing . The model is a general purpose model, similar to Claude Opus 4.6, but Anthropic claim that its cyber-security research abilities are strong enough that they need to give the software industry as a whole time to prepare. Mythos Preview has already found thousands of high-severity v...
bishopfox.com56 · 2026-04-07 13:00

API Authentication Bypass in FortiClient EMS 7.4.5-7.4.6–CVE-2026-35616

Bishop Fox researchers expanded on Fortinet's disclosure of CVE-2026-35616 by identifying the root cause via the released hotfix.
Lexfo's security blog52 · 2026-04-07 08:00

Ninja Forms Uploads <= 3.3.26 - Arbitrary File Upload to RCE (CVE-2026-0740)

A technical deep dive into the discovery of an unauthenticated zero-day vulnerability in the Ninja Forms - File Uploads WordPress extension, which allows arbitrary file uploads, remote code execution, and full server compromise.
Trail of Bits50 · 2026-04-07 11:00

What we learned about TEE security from auditing WhatsApp's Private Inference

WhatsApp’s new “Private Inference” feature represents one of the most ambitious attempts to combine end-to-end encryption with AI-powered capabilities, such as message summarization. To make this possible, Meta built a system that processes encrypted user messages inside trusted execution environments (TEEs), secure hardware enclaves designed so that not even Meta can access the plaintext. Our now-public audit , conducted before launch, identified several vulnerabilities that compromised What...
Qualys Threat Research45 · 2026-04-07 15:00

Signals from the Cloud Security Forecast 2026: Cloud Risk Is Scaling through Design, Not Disruption

Key Takeaways Cloud Risk Is No Longer Unpredictable. It Is Settling Into a Pattern. Across most enterprise environments, the same conditions produce the same outcomes. Identities carry more access than required. Trust relationships extend beyond clear boundaries. Exposure lingers longer than intended. Nothing appears broken in isolation, yet together these elements create a system where […]
Cloudflare Blog (Security)40 · 2026-04-07 21:00

Cloudflare targets 2029 for full post-quantum security

Recent advances in quantum hardware and software have accelerated the timeline on which quantum attack might happen. Cloudflare is responding by moving our target for full post-quantum security to 2029.
Rapid7 Blog40 · 2026-04-07 13:06

A First Look at Our Speaker Lineup and Agenda for the Rapid7 2026 Global Cybersecurity Summit

The agenda for the Rapid7 2026 Global Cybersecurity Summit is starting to take shape, and with it, a clearer picture of the conversations security teams need to be having right now. Taking place May 12–13, this year’s summit brings together a mix of security leaders, practitioners, analysts, and industry voices to explore how organizations are moving from reactive defense to preemptive security operations. The focus is practical. What is changing, what is not working, and what teams need to d...
Krebs on Security35 · 2026-04-07 17:02

Russia Hacked Routers to Steal Microsoft Office Tokens

Hackers linked to Russia's military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code.
Huntress Blog34 · 2026-04-07 13:00

Decoding NightSpire: Ransomware IOCs Aren't Set in Stone

A recent incident linked to the NightSpire ransomware workflow gives insight into why the RaaS structure and model, or lack thereof, are important – especially when it comes to scoping and recovering from the incident.
Horizon3.ai20 · 2026-04-07 19:32

10 Minutes with Claude: Remote Code Execution in Apache ActiveMQ (CVE-2026-34197)

CVE-2026-34197 enables remote code execution in ActiveMQ via Jolokia. Exploitation chains VM transport and remote config loading.
Deeplinks17 · 2026-04-07 19:24

EU Parliament Blocks Mass-Scanning of Our Chats—What's Next?

The EU’s  so-called Chat Control plan , which would mandate mass scanning and other encryption breaking measures, has had some good news lately . The most controversial idea, the forced requirement to scan encrypted messages, was given up by EU member states. And now, another win for privacy: the EU Parliament has dealt a real blow to voluntary mass-scanning of chats by voting to not prolong an interim derogation from e-Privacy rules in the EU. These rules allowed service providers, temporari...
Cyber Kendra17 · 2026-04-07 17:02

Linux's Print System Has a Zero-Click Root Hole — and No Fix Yet

If your Linux server runs a shared PostScript print queue, a remote attacker with no credentials whatsoever can — right now — execute arbitrary code on it, then quietly escalate to root. That's the condensed version of two newly disclosed vulnerabilities in CUPS, the printing backbone of virtually every Linux and Unix-like system. Security researcher Asim Manizada, working with a self-orchestrating team of AI agents that hunt for AI vulnerabilities, discovered and chained the two flaws : CVE-...
Cyber Kendra17 · 2026-04-07 16:20

Your Router Is Spying on You — And Russia's APT28 Is Behind It

Your home router may already be working for Russian military intelligence — and you'd have no idea. In a rare coordinated disclosure, both the UK's National Cyber Security Centre (NCSC) and Microsoft Threat Intelligence have published detailed research exposing how APT28 — Russia's GRU military intelligence unit, tracked by Microsoft as Forest Blizzard and its sub-group Storm-2754 — has been running a large-scale campaign to hijack home and small office routers, silently redirecting internet ...
Intigriti17 · 2026-04-07 00:00

Five key takeaways from the UK’s new Cyber Security & Resilience Bill

What You Will Learn What the UK Cyber Security & Resilience Bill covers Which organizations and sectors will be affected New incident reporting and regulatory requirements How to prepare your organization for compliance The content of the Cyber Security & Resilience Bill (CSRB) recently introduced to Parliament contained few surprises. Having spent a significant amount of time working with European cyber-security frameworks, particularly NIS2, I see the Bill as both a continuation of the t…
We Live Security » Languages » English15 · 2026-04-07 09:00

As breakout time accelerates, prevention-first cybersecurity takes center stage

Threat actors are using AI to supercharge tried-and-tested TTPs. When attacks move this fast, cyber-defenders need to rethink their own strategy.
嘶吼15 · 2026-04-07 03:59

嘶吼安全动态|工信部NVDB平台发布风险提示:利用苹果iOS漏洞的攻击活动激增 黑客利用React2Shell发起自动化凭证窃取活动

嘶吼安全动态 【国内新闻】 国家计算机病毒应急处理中心检测发现71款违法违规收集使用个人信息的移动应用 摘要:依据《网络安全法》《个人信息保护法》等法律法规,经国家计算机病毒应急处理中心检测,71款移动应用存在违法违规收集使用个人信息情况,现已进行通报。 原文链接:https://www.cverc.org.cn/zxdt/report20260403.htm 工信部NVDB平台发布风险提示:利用苹果iOS漏洞的攻击活动激增 摘要:近日,工业和信息化部网络安全威胁和漏洞信息共享平台监测发现,有攻击者利用针对苹果公司终端产品的漏洞实施网络攻击活动,可导致信息窃取、系统受控等严重危害。影响范围包括运行iOS 13.0至17.2.1的iPhone、iPad等苹果公司终端产品。 原文链接:https://baijiahao.baidu.com/s?id=1861446183160560256&wfr=spider&for=pc 智能体“龙虾”(OpenClaw)再曝安全漏洞,存在泄露用户对话隐私风险 摘要:开源AI智能体OpenClaw(龙虾)被曝隐私保护缺陷。攻击者可利用特定Promp...
Hayden James14 · 2026-04-07 01:02

Why Linux Servers Slow Down: R, S, D, Z and T Process States Explained

Monitoring dashboards occasionally indicate low CPU utilization (e.g., 22%) and ample free memory, yet applications may exhibit sluggishness and increased response times. This common discrepancy in Linux environments often stems from process states that are not captured by high-level resource summaries. Continue reading...
Krypt3ia12 · 2026-04-07 20:05

Scenario Matrix: First 72 Hours After Nuclear Use on Tehran

Foreword The analysis that follows is not a prediction. It is a structured examination of a low-probability, high-impact scenario whose consequences would extend far beyond any single battlefield or decision cycle. The detonation of a nuclear weapon against a capital city specifically Tehran would represent a fundamental rupture in the post-1945 international system, one defined […]
IEEE Spectrum12 · 2026-04-07 14:00

Decentralized Training Can Help Solve AI’s Energy Woes

Artificial intelligence harbors an enormous energy appetite. Such constant cravings are evident in the hefty carbon footprint of the data centers behind the AI boom and the steady increase over time of carbon emissions from training frontier AI models . No wonder big tech companies are warming up to nuclear energy , envisioning a future fueled by reliable, carbon-free sources. But while nuclear-powered data centers might still be years away, some in the research and industry spheres are takin...
gilesthomas.com11 · 2026-04-07 21:00

Writing an LLM from scratch, part 32i -- Interventions: what is in the noise?

Towards the end of last year, I trained a 163M-parameter GPT-2-style model from scratch on my local RTX 3090 , using code based on Sebastian Raschka 's book " Build a Large Language Model (from Scratch) ". The result was a pretty decent little model, but it wasn't as good as the original GPT-2-small, despite having more parameters (because it wasn't using weight-tying). Specifically: on a particular test set, my model gave a loss of 3.944 -- quite a lot more than the original GPT-2's 3.500 on...
Infosecurity11 · 2026-04-07 15:30

Russian APT28 Hackers Hijack Routers to Steal Credentials, UK Security Agency Warns

Newly identified malicious campaigns are linked to virtual private servers modified by APT28 to operate as malicious DNS servers
Infosecurity11 · 2026-04-07 15:05

GPU Rowhammer Attack Enables Privilege Escalation and Full System Compromise

GPUBreach uses GPU Rowhammer on GDDR6 to flip bits, corrupt page tables and escalate to system root
Infosecurity11 · 2026-04-07 14:00

GrafanaGhost Exploit Bypasses AI Guardrails for Silent Data Exfiltration

GrafanaGhost chains AI prompt injection and URL flaws to exfiltrate sensitive Grafana data
先知安全技术社区11 · 2026-04-07 05:53

基于 WireGuard 与 Caddy 构建红队应用层流量重定向器

本文介绍利用 WireGuard 组建加密隧道并结合 Caddy 实现应用层 TLS 卸载的流量重定向架构。通过配置反向代理规则将特定路径流量转发至内网 C2 服务器,有效隐藏真实 IP 并伪装业务流量特征。该方法相比传输层透传更能规避防火墙对非标准加密流量的检测。
Trend Micro Simply Security11 · 2026-04-07 00:00

Claude Code Packaging Error Remains a Lure in an Active Campaign: What Defenders Should Do

Threat actors leveraged Anthropic’s Claude Code npm release packaging error to distribute Vidar, GhostSocks, and PureLog Stealer. This blog details immediate steps organizations can take and best practices to prevent further risk.
Jeremy Kun10 · 2026-04-07 13:00

Deterministic Primality Testing for Limited Bit Width

Problem: Determine if a 32-bit number is prime (deterministically) Solution: (in C++) // Bases to test. Using the first 4 prime bases makes the test deterministic // for all 32-bit integers. See https://oeis.org/A014233. int64_t bases[] = {2, 3, 5, 7}; inline int countTrailingZeros(uint64_t n) { if (n == 0) return 64; return __builtin_ctzll(n); } int64_t modularExponentiation(int64_t base, int64_t exponent, int64_t modulus) { int64_t res = 1; int64_t b = base % modulus; int64_t e = exponent; ...
Infosecurity10 · 2026-04-07 09:26

Fortinet Releases Emergency Patch After FortiClient EMS Bug Is Exploited

Fortinet has updated its FortiClient EMS product after zero-day attacks surfaced
[DRAGNET]10 · 2026-04-07 07:00

China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware

China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware    The Hacker News
Infosecurity9 · 2026-04-07 10:02

Storm-1175 Exploits Flaws in High-Velocity Medusa Attacks

Microsoft has released a new report about the Storm-1175 group and its connection to Medusa ransomware
Linux Foundation Blogs8 · 2026-04-07 18:07

Introducing Project Glasswing: Giving Maintainers Advanced AI to Secure the World's Code

In the late fall of 2025, artificial intelligence models made a big leap in coding ability. Since then, we have been hearing about a darker side of this breakthrough — how the new generation of AI models are also astoundingly good at identifying previously undiscovered software vulnerabilities. These discoveries are impacting some of the most security-hardened systems in the world. What’s more, the AI systems making these discoveries demonstrate incredible sophistication, often chaining toget...
.NET8 · 2026-04-07 18:00

Your Migration’s Source of Truth: The Modernization Assessment

Introducing GitHub Copilot Modernization and diving into the assessment report as part of cloud modernization process The post Your Migration’s Source of Truth: The Modernization Assessment appeared first on .NET Blog .
The Akamai Blog (https://blogs.akamai.com/feeds.html)8 · 2026-04-07 13:00

Scale Smarter: A Practical Guide to Building with Akamai Object Storage

Akamai Object Storage provides high-performance, cost-effective Amazon S3–compatible object storage. Here's what it's used for and how to set it up.
The Akamai Blog (https://blogs.akamai.com/feeds.html)8 · 2026-04-07 13:00

Scale Faster: A Practical Guide to Building with Akamai Block Storage

Scale Faster: A Practical Guide to Building with Akamai Block Storage
嘶吼8 · 2026-04-07 08:11

以 CaaS 2.0 重构数字信任,领航后量子时代——亚数TrustAsia 2026春季战略发布会圆满举行

这是一个数字身份呈指数级爆炸的时代。当人们还在谈论移动互联网的红利消减,关于后量子时代(PQC)的威胁、TLS/SSL 证书、代码签名证书有效期的持续缩短、以及机器身份规模化管理的挑战,已如潮水般涌至企业 CIO 们的案头。 在回溯亚数TrustAsia 过去十四年的演进历程中,亚数TrustAsiaCEO 翟新元告诉我们,在行业剧烈变革来临之前,企业真正的确定性,来自于主动融入技术演进的浪潮,通过持续的产品深度迭代,在不确定中锚定增长机会。  2026 年 3 月 31 日,2026 亚数TrustAsia 春季战略发布会于上海圆满举行。会上,亚数TrustAsia 正式发布 CaaS 2.0 产品服务体系,并同步推出公益普惠项目 LiteSSL,以产品创新、技术沉淀与社会责任协同推进,开启数字信任领域的新一轮增长曲线。  这不仅是一次产品层面的跨代升级,更展示了一家数字信任领军企业在面对“后量子时代”与“全自动化”双重挤压下的前瞻判断与战略定力。 一、以自动化为锚:CaaS 体系破解 TLS/SSL 证书管理难题  数字安全的演进始终与市场刚需同频。2025 年 4 月,CA...
Stripe8 · 2026-04-07 00:00

How agents, digital wallets, and trust are rewriting checkout

We analyzed checkout activity across more than 20K businesses, surveyed shoppers and ecommerce leaders, and gathered insights from businesses on the Stripe network to understand what’s changing in online conversion.
shkspr.mobi6 · 2026-04-07 11:34

Did WordPress VIP leak my phone number?

As discussed in my last blog post, the scumsuckers at Apollo.io have been giving out my personal details. Not only did they have my email address, they also had a copy of one of my phone numbers. I asked them where they got it from and they said: Your phone number came from Parsely, Inc (wpvip.com) one of our customers who participates in our customer contributor network by sharing their…
[DRAGNET]5 · 2026-04-07 07:00

Medusa Ransomware Fast to Exploit Vulnerabilities, Breached Systems

Medusa Ransomware Fast to Exploit Vulnerabilities, Breached Systems    SecurityWeek
[DRAGNET]5 · 2026-04-07 07:00

Adobe Reader zero-day vulnerability in active exploitation

Adobe Reader zero-day vulnerability in active exploitation    Sophos
[DRAGNET]5 · 2026-04-07 07:00

Microsoft says Medusa-linked Storm-1175 is speeding ransomware attacks

Microsoft says Medusa-linked Storm-1175 is speeding ransomware attacks    csoonline.com
[DRAGNET]0 · 2026-04-07 20:37

Storm-1175 Deploys Medusa Ransomware at 'High Velocity'

Storm-1175 Deploys Medusa Ransomware at 'High Velocity'    Dark Reading