Recon

RECON

Updated 4m ago
High-Signal Security Intelligence

2026-04-08

Rapid7 Blog255IN STACK · 2026-04-08 13:39

FortiGate CVE-2025-59718 Exploitation: Incident Response Findings

Rapid7’s Incident Response (IR) team was engaged to investigate an incident involving exploitation of CVE-2025-59718 against a vulnerable FortiGate appliance. In December 2025, Fortinet disclosed this improper verification of cryptographic signature vulnerability that facilitates an SSO login bypass on affected appliances. After the initial exploitation, the attackers maintained a low-profile posture, systematically compromising additional firewalls before moving to internal network hosts. Ul...
exp库-打造中文最大exploit库212IN STACK · 2026-04-08 00:00

Horilla v1.3 - RCE

# Exploit Title: Horilla v1.3 - RCE # Date: 2025-05-29 # Exploit Author: Raghad Abdallah Al-syouf # Version: <= 1.3 # Tested on: Ubuntu / Docker # CVE: CVE-2025-48868 Description: This script exploits the authenticated RCE vulnerability CV......
Docker211IN STACK · 2026-04-08 18:23

Reclaim Developer Hours through Smarter Vulnerability Prioritization with Docker and Mend.io

We recently announced the integration between Mend.io and Docker Hardened Images (DHI) provides a seamless framework for managing container security. By automatically distinguishing between base image vulnerabilities and application-layer risks, it uses VEX statements to differentiate between exploitable vulnerabilities and non-exploitable vulnerabilities, allowing your team to prioritize what really matters. TL;DR: The Developer Value Proposition...
Simon Willison65 · 2026-04-08 23:07

Meta's new model is Muse Spark, and meta.ai chat has some interesting tools

Meta announced Muse Spark today, their first model release since Llama 4 almost exactly a year ago . It's hosted, not open weights, and the API is currently "a private API preview to select users", but you can try it out today on meta.ai (Facebook or Instagram login required). Meta's self-reported benchmarks show it competitive with Opus 4.6, Gemini 3.1 Pro, and GPT 5.4 on selected benchmarks, though notably behind on Terminal-Bench 2.0. Meta themselves say they "continue to invest in areas w...
Huntress Blog40 · 2026-04-08 14:00

The ADWS Architecture That Hides PowerShell AD Enumeration

A threat actor enumerated our entire AD with Get-ADComputer, and none of our detections fired. The problem wasn't their evasion - it was an architectural blind spot in how PowerShell talks to Active Directory.
Huntress Blog39 · 2026-04-08 11:00

Why the Stryker Attack Still Matters. And Five Steps You Can Take Today

The Stryker incident revealed that a "Weaponized Remote Wipe" via compromised MDM is a more permanent and difficult threat than ransomware. Learn concrete steps to secure management platforms and prevent your security shield from becoming a weapon.
The Red Canary Blog: Information Security Insights30 · 2026-04-08 13:43

AI in cybersecurity: The good, the bad, and the FUD

The 2026 Threat Detection Report surveys the AI landscape for both defenders and adversaries. Here’s how you can stay ahead.
OpenAI Blog27 · 2026-04-08 14:00

The next phase of enterprise AI

OpenAI outlines the next phase of enterprise AI, as adoption accelerates across industries with Frontier, ChatGPT Enterprise, Codex, and company-wide AI agents.
Quarkslab's blog17 · 2026-04-08 22:00

Tearing down a car telematic unit (and finding an accident on Facebook)

From hardware analysis to OSINT: how we retrieved information about a BYD car crash by analyzing the TCU embedded memory.
Infosecurity17 · 2026-04-08 10:03

US Thwarts DNS Hijacking Network Controlled by Russian APT28 Hackers

The FBI deployed a method to unplug US-based routers compromised by APT28 from the threat actor’s malicious network
嘶吼15 · 2026-04-08 03:59

嘶吼安全动态|国家安全部提醒:“囤词元暴富” 背后,暗藏间谍窃取数据陷阱 苹果Mac威胁50.32%来自木马,盗窃用户隐私成主要目的

嘶吼安全动态 【国内新闻】 国家安全部提醒:“囤词元暴富” 背后,暗藏间谍窃取数据陷阱 摘要:国家安全部提醒,随着词元(Token)的爆火,一些不法分子开始打起了词元的主意,伺机布设各种陷阱。不法分子可通过跨站脚本攻击(XSS)、公共Wi-Fi嗅探等方式,窃取、截获未加密的词元。一旦词元泄露,攻击者可直接盗用用户身份,获取隐私信息、登录账号、篡改数据,甚至实施诈骗、转账等操作,直接威胁个人财产安全。 原文链接:https://finance.sina.com.cn/7x24/2026-04-07/doc-inhtrivn0610932.shtml CNNVD通报OpenClaw多个安全漏洞 摘要:根据国家信息安全漏洞库统计,自2026年3月10日-2026年4月2日,共采集OpenClaw漏洞155个,其中超危漏洞11个、高危漏洞53个,中危漏洞80个、低危漏洞11个,包含了访问控制错误、代码问题、路径遍历等多个漏洞类型。 原文链接:https://finance.sina.com.cn/jjxw/2026-04-07/doc-inhtrqcm7319735.shtml 应对AI...
Deeplinks14 · 2026-04-08 08:22

Digital Hopes, Real Power: How the Arab Spring Fueled a Global Surveillance Boom

This is the third installment of a blog series reflecting on the global digital legacy of the 2011 Arab uprisings. You can read the first post here , and the second here . When people recall the 2011 uprisings across the Middle East and North Africa (MENA), they often picture crowded squares, raised phones, and the feeling that the internet had finally shifted the balance of power toward ordinary people. But the past decade and a half is also a story about how governments, companies, and plat...
Infosecurity12 · 2026-04-08 09:15

Claude Discovers Apache ActiveMQ Bug Hidden for 13 Years

Anthropic’s Claude AI has helped researchers find a vulnerability in Apache ActiveMQ Classic
Graham Cluley11 · 2026-04-08 23:27

Smashing Security podcast #462: LinkedIn is spying on you, and you agreed to nothing

LinkedIn has been secretly scanning your browser for over 6,000 installed extensions — on every single click you make. It can tell if you're job hunting, what religion you are, and whether you have ADHD. And none of this is mentioned anywhere in their privacy policy. Meanwhile, California's crypto millionaires are learning that no amount of encryption can protect you from someone who knocks on your door pretending to deliver a pizza. All this and more in episode 462 of the “Smashing Security”...
Infosecurity11 · 2026-04-08 15:10

Critical Vulnerability in Ninja Forms Exposes WordPress Sites

Ninja Forms File Upload RCE via unauthenticated arbitrary file upload; update to 3.3.27 immediately
嘶吼11 · 2026-04-08 08:38

“龙虾”来袭,绿盟科技三位一体防御体系,让网络告别 “裸奔” 风险

2026年开年,OpenClaw(俗称“龙虾”)这款本地优先的 AI Agent 自动化平台以燎原之势席卷全球,凭借自然语言指令实现 PC 全功能自动化的能力,成为开发者追捧的工具。其支持15+通信平台、多模型调用、自主任务执行等特性,让效率提升的同时,也埋下了巨大的安全隐患。工信部于2026年3月8日正式发布openclaw安全风险预警通报。这款看似便捷的工具,正成为企业网络安全的“特洛伊木马”,筑牢其安全防护防线已成为企业的迫切需求。 一、OpenClaw 五大核心安全痛点,直击企业网络软肋 OpenClaw 的安全风险并非单一漏洞引发的局部问题,而是贯穿系统架构、权限模型、供应链和数据流转的系统性危机,五大核心痛点直指企业网络安全的薄弱环节,带来全方位的威胁。 痛点一:高危漏洞频发,远程代码执行(RCE)风险一触即发 OpenClaw 从2025年11月发布到首个高危 CVE 漏洞出现仅耗时2个月,目前已有9个已知CVE 被收录,CISA 已将其纳入漏洞跟踪通信。其中 CVE-2026-25253 跨站 WebSocket 劫持漏洞 CVSS 评分达 8.8,可实现一键远程...
Infosecurity11 · 2026-04-08 08:15

Iran‑Backed Threat Actors Hit US CNI Providers via Internet‑Facing OT Assets

CISA has revealed Iranian attacks causing disruption and financial loss at US critical infrastructure firms
[DRAGNET]10 · 2026-04-08 07:00

Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems

Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems    The Hacker News
exp库-打造中文最大exploit库10 · 2026-04-08 00:00

FortiWeb 8.0.2 - Remote Code Execution

# Exploit Title: FortiWeb 8.0.2 - Remote Code Execution # Date: 2025-11-22 # Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # GitHub: https://github.com/mbanyamer # Vendor Homepage: https://www.fortine......
exp库-打造中文最大exploit库10 · 2026-04-08 00:00

7-Zip 24.00 - Directory Traversal

# Exploit Title: 7-Zip < 25.00 - Directory Traversal to RCE via Malicious ZIP # Date: 2025-11-22 # Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # GitHub: https://github.com/mbanyamer # Vendor Homep......
exp库-打造中文最大exploit库10 · 2026-04-08 00:00

xibocms 3.3.4 - RCE

# Exploit Title: XiboCMS 3.3.4- Remote Code Execution # Google Dork: N/A # Date: 2025-11-18 # Exploit Author: complexusprada # Vendor Homepage: https://xibo.org.uk/ # Software Link: https://github.com/xibosignage/xibo-cms # Version: 1.8.0 - 2.3......
exp库-打造中文最大exploit库10 · 2026-04-08 00:00

SQLite 3.50.1 - Heap Overflow

# Exploit Title: SQLite 3.50.1 - Heap Overflow # Date: 2025-11-05 # Author: Mohammed Idrees Banyamer # Author Country: Jordan # Instagram: @banyamer_security # GitHub: https://github.com/mbanyamer # Vendor Homepage: https://www.sqlite.org # So......
exp库-打造中文最大exploit库10 · 2026-04-08 00:00

Microsoft MMC MSC EvilTwin - Local Admin Creation

#!/usr/bin/env python3 # Exploit Title: Microsoft MMC MSC EvilTwin - Local Admin Creation # Date: 2025-11-22 # Author: Mohammed Idrees Banyamer # Author Country: Jordan # GitHub: https://github.com/mbanyamer # Vendor Homepage: https://www.micros......
Deeplinks8 · 2026-04-08 19:24

Banning New Foreign Routers Mistargets Products to Fix Real Problem

On March 23, the FCC issued an update to their Covered List, a list of equipment banned from obtaining regulatory approval necessary for U.S. sale (and thus effectively a ban on sale of new devices), to include all new routers produced in foreign countries unless they are specifically given an exception by the Department of Defense (DoD) or DHS. The Commission cited “security gaps in foreign-made routers” leading to widespread cyberattacks as justification for the ban, mentioning the high-pro...
嘶吼8 · 2026-04-08 08:31

当“小龙虾”潜入内网,如何解决“影子AI”的隐匿危机

近期,OpenClaw(俗称“小龙虾”)这一开源AI智能体因其强大的自主执行能力而迅速爆火,成为众多企业与开发者的效率神器。然而,就在热度持续攀升之际,国家及行业权威机构接连发布重磅预警:这个看似能干的“AI助手”,正因其模糊的信任边界和脆弱的默认安全配置,成为潜伏在企业内网中的高危风险源。 从已披露的CVE-2026-25253、CVE-2026-25157到最新的多个供应链投毒事件,多个已知漏洞正威胁着从个人隐私到关键基础设施的安全防线。面对来势汹汹的“龙虾”漏洞潮,传统“只扫不治”的扫描模式已然失效。企业需要的不是一份简单的风险清单,而是一套可管、可控、可追溯的漏洞治理方案。 一、治理之困:为何你的网络成了“坏虾”的养殖场? 在与众多企业的交流中,我们听到了两种典型的声音:   “影子AI”的恐慌:“员工偷偷部署了OpenClaw,我连它们在哪里都不知道,更别提管控了。这些主机端口暴露在外,无异于给黑客留了后门。”   “合法使用”的盲区:“业务部门正式部署了小龙虾,但我根本看不清它做了哪些外部访问,是否存在被恶意指令劫持的风险?” 更棘手的是,OpenClaw的流量通常加...
Unit 426 · 2026-04-08 22:00

Cracks in the Bedrock: Agent God Mode

Unit 42 reveals "Agent God Mode" in Amazon Bedrock AgentCore. Broad IAM permissions lead to privilege escalation and data exfiltration risks. The post Cracks in the Bedrock: Agent God Mode appeared first on Unit 42 .
Red Hat Security6 · 2026-04-08 00:00

Navigating the Mythos-haunted world of platform security

The preview release of Claude Mythos presents a massive challenge for IT security experts, as well as an opportunity (at least for the organizations that can afford it). Mythos represents a new category of frontier model that can not only identify complex memory safety issues and logic flaws hidden in legacy code but also exploit them in increasingly sophisticated ways. This dramatically compounds and expands the outsize role currently played by AI-driven vulnerability scanning both in corpor...