Recon

RECON

Updated 4m ago
High-Signal Security Intelligence

2026-04-09

Trail of Bits57 · 2026-04-09 11:00

Master C and C++ with our new Testing Handbook chapter

We added a new chapter to our Testing Handbook: a comprehensive security checklist for C and C++ code . We’ve identified a broad range of common bug classes, known footguns, and API gotchas across C and C++ codebases and organized them into sections covering Linux, Windows, and seccomp. Whereas other handbook chapters focus on static and dynamic analysis, this chapter offers a strong basis for manual code review. LLM enthusiasts rejoice: we’re also developing a Claude skill based on this new ...
Huntress Blog49 · 2026-04-09 14:00

The 60ms Window: How Event 5156 Solves the ADWS Attribution Problem

Event 1644 shows localhost, hiding the attacker's real IP. By correlating Event 5156 with a ~60-80ms timing window, you can attribute ADWS queries to their actual source—and the data was already in your SIEM.
Microsoft Security Blog49 · 2026-04-09 13:21

Intent redirection vulnerability in third-party SDK exposed millions of Android wallets to potential risk

A severe Android intent‑redirection vulnerability in a widely deployed SDK exposed sensitive user data across millions of apps. Microsoft researchers detail how the flaw works, why it matters, and how developers can mitigate similar risks by updating affected SDKs. The post Intent redirection vulnerability in third-party SDK exposed millions of Android wallets to potential risk appeared first on Microsoft Security Blog .
Qualys Threat Research45 · 2026-04-09 16:10

Scaling Modern AppSec: Moving from Static Profiles to AI-Powered Scan Optimization

Key Highlights Security teams today are accountable for an ever-expanding estate of web applications and APIs. In large enterprises, that often means hundreds or thousands of assets distributed across regions, cloud environments, and business units. And yet most organizations cannot confirm, within a given compliance window, that every asset in their environment has been scanned, […]
Qualys Threat Research40 · 2026-04-09 15:00

12 Best Practices for Securing AWS Cloud in 2026

Key Takeaways What Securing the AWS Cloud Really Means in 2026 Amazon Web Services (AWS) cloud security is the discipline of protecting cloud infrastructure, data, applications, and workloads on AWS through a combination of architectural choices, native controls, and continuous independent assurance. In 2026, this definition has materially evolved. Cloud environments are no longer static […]
Rapid7 Blog40 · 2026-04-09 12:46

What’s New in Rapid7 Products and Services: Q1 2026 in Review

If product releases had a runway moment, Q1 at Rapid7 would’ve walked out in Cloud Dancer; crisp, confident, and quietly powerful, before breaking into a full gallop in the Year of the Horse. At Rapid7, our first-quarter launches combined velocity with refinement: meaningful enhancements designed to move security teams faster without adding complexity. Let’s cover off the key launches, one by one. Detection and response MDR for Microsoft Getting more value from the tools you already have is a...
Elastic Security Labs40 · 2026-04-09 00:00

Elastic on Defence Cyber Marvel 2026: A Technical overview from the Exercise Floor

An overview of the Elastic Security and AI infrastructure deployed to support the UK Ministry of Defence's flagship cyber exercise, Defence Cyber Marvel 2026.
Google Online Security Blog39 · 2026-04-09 17:07

Protecting Cookies with Device Bound Session Credentials

Protecting Cookies with Device Bound Session Credentials
Rapid7 Blog35 · 2026-04-09 17:51

What Project Glasswing Means for Security Leaders

Anthropic’s Project Glasswing matters because it offers an early look at how quickly software flaws may soon be found, validated, and potentially turned into viable attack paths, even if that capability is currently limited to a closed partner program. Anthropic says its restricted Claude Mythos Preview model has already identified thousands of high-severity vulnerabilities, including flaws in major operating systems and browsers, and in some cases developed related exploits autonomously. Som...
Huntress Blog34 · 2026-04-09 19:00

What a Fake Claude Download Says About Security Today

Attackers are already targeting the AI tools your team just started using. Here's what that looks like when it lands in your own environment. And what actually stops it.
Microsoft Security Blog32 · 2026-04-09 19:00

The agentic SOC—Rethinking SecOps for the next decade

In the SOC of the future, autonomous defense moves at machine speed, agents add context and coordination, and humans focus on judgment, risk, and outcomes. The post The agentic SOC—Rethinking SecOps for the next decade appeared first on Microsoft Security Blog .
OpenAI Blog27 · 2026-04-09 00:00

CyberAgent moves faster with ChatGPT Enterprise and Codex

CyberAgent uses ChatGPT Enterprise and Codex to securely scale AI adoption, improve quality, and accelerate decisions across advertising, media, and gaming.
Dark Reading22 · 2026-04-09 20:13

'BlueHammer' Windows Zero-Day Exploit Signals Microsoft Bug Disclosure Issues

Under the alias 'Chaotic Eclipse,' a researcher released a PoC exploit for a zero-day flaw that allows for system takeover by a local user, citing an undisclosed beef with Microsoft.
先知安全技术社区20 · 2026-04-09 09:16

Vim Tabpanel Modeline 远程命令执行漏洞分析(CVE-2026-34714)

Vim Tabpanel Modeline 远程命令执行漏洞分析(CVE-2026-34714)
先知安全技术社区20 · 2026-04-09 05:27

Apache ActiveMQ CVE-2026-34197 Jolokia 远程代码执行漏洞分析

Apache ActiveMQ CVE-2026-34197 Jolokia 远程代码执行漏洞分析
Krypt3ia17 · 2026-04-09 13:58

Threat Analysis Report: AI Enhanced Infrastructure Attacks At Scale on Critical Infrastructure

Overview of the Threat Environment By the mid-to-late 2020s, the cybersecurity landscape is characterized by a structural shift in the speed and scale at which vulnerabilities are discovered and exploited. Reporting and internal disclosures from organizations such as Anthropic indicate that advanced AI systems are capable of identifying and operationalizing previously unknown software flaws, including […]
[DRAGNET]17 · 2026-04-09 07:00

Adobe Reader Zero-Day Exploited for Months: Researcher

Adobe Reader Zero-Day Exploited for Months: Researcher    SecurityWeek
Sophos News17 · 2026-04-09 00:00

We let OpenClaw loose on an internal network. Here’s what it found

Following our article on the challenges posed by agentic AI, we gave OpenClaw access to one of our legacy networks Categories: Threat Research Tags: OpenClaw, LLM, AI, penetration testing, Red Team, CISO, Sophos X-Ops
嘶吼15 · 2026-04-09 03:59

嘶吼安全动态|中央网信办召开全国网络法治工作会议 设备码钓鱼攻击暴增36倍,新型攻击工具在网上大肆扩散

嘶吼安全动态 【国内新闻】 上海人工智能实验室发布“珠穆朗玛计划”,打造AI4S全国中枢 摘要:上海AI实验室重磅发布“AGI4S 珠穆朗玛计划”,同步推出DeepLink融合算力平台。该计划旨在通过全维度合作打破算力与数据壁垒,为高能物理、疾病诊断等关键科学领域提供自主受控的智能底座。 原文链接: https://www.news.cn/tech/20260408/fe5a61186ceb4582bdcf019c9abe0733/c.html 中央网信办召开全国网络法治工作会议,部署 “十五五” 依法治网重点任务 摘要:会议明确完善网络法律体系、强化App/SDK个人信息治理、加强网络司法惩戒等五大任务,推进依法治网全面落地。 原文链接: https://www.cac.gov.cn/2026-04/08/c_1777384058981550.htm 上海警方侦破AI黑稿工厂案,2人操控4000账号抹黑车企 摘要:嫌疑人用AI批量生成虚假黑稿造谣,涉案流量超千万;警方依法采取强制措施,严打AI网络水军与商业诋毁。 原文链接: https://baijiahao.baidu.co...
paper - Last paper15 · 2026-04-09 00:26

SkillTrojan:针对基于技能的智能体系统的后门攻击

作者:Yunhao Feng, Yifan Ding, Yingshui Tan等 译者:知道创宇404实验室翻译组 原文链接:https://arxiv.org/html/2604.06811v1/https://arxiv.org/html/2604.06811v1 摘要 基于技能的智能体系统通过组合可复用技能完成复杂任务,在提升模块化与可扩展性的同时,引入了尚未被充分研究的安全攻击面。本文提...
Tenable Blog14 · 2026-04-09 20:28

What to Know About CyberAv3ngers: The IRGC-Linked Group Targeting Critical Infrastructure

An Iran-affiliated threat group has evolved from defacing water utility displays to deploying custom ICS malware and exploiting Rockwell Automation PLCs across multiple U.S. critical infrastructure sectors. Key takeaways: CyberAv3ngers is a state-directed threat group operating under Iran's IRGC Cyber-Electronic Command. The U.S. Treasury sanctioned six named officials in February 2024 and the State Department has offered a $10 million bounty for information on the group's activities.   The g...
Sophos News14 · 2026-04-09 00:00

The vulnerability flood is here. Here’s what it means – and how to prepare

We can't control the pace of AI-driven vulnerability discovery, but we can control how fast we respond. Categories: Sophos Insights Tags: LLM, AI, Exploit, vulnerability, Active Adversary, Pacific Rim
gilesthomas.com11 · 2026-04-09 20:00

Writing an LLM from scratch, part 32j -- Interventions: trying to train a better model in the cloud

Since early February, I've been trying various interventions on a 163M-parameter GPT-2-style model that I trained from scratch on my local RTX 3090 , using code based on Sebastian Raschka 's book " Build a Large Language Model (from Scratch) ". My original model got a loss of 3.944 on my test set, while the original GPT-2 weights got 3.500 on the same dataset. I wanted to see if I could close that gap, and had a list of potential changes to the training setup, and to the model itself. Which o...
IEEE Spectrum11 · 2026-04-09 15:06

GoZTASP: A Zero-Trust Platform for Governing Autonomous Systems at Mission Scale

ZTASP is a mission-scale assurance and governance platform designed for autonomous systems operating in real-world environments. It integrates heterogeneous systems—including drones, robots, sensors, and human operators—into a unified zero-trust architecture. Through Secure Runtime Assurance (SRTA) and Secure Spatio-Temporal Reasoning (SSTR), ZTASP continuously verifies system integrity, enforces safety constraints, and enables resilient operation even under degraded conditions. ZTASP has pro...
miguelgrinberg.com11 · 2026-04-09 15:02

SQLAlchemy 2 In Practice - Chapter 4 - Many-To-Many Relationships

This is the fourth chapter of my SQLAlchemy 2 in Practice book. If you'd like to support my work, I encourage you to buy this book, either directly from my store or on Amazon . Thank you! Continuing with the topic of relationships, this chapter is dedicated to the many-to-many type, which as its name implies, is used when it is not possible to identify any of the sides as a "one" side.
Trend Micro Simply Security11 · 2026-04-09 00:00

U.S. Public Sector Under Siege: Threat Intelligence for Q1 2026

The first quarter of 2026 has reinforced a hard truth: U.S. government agencies and educational institutions are operating in the most hostile cyber threat environment ever recorded.
Deeplinks10 · 2026-04-09 21:32

Yikes, Encryption’s Y2K Moment is Coming Years Early

Google moved up its estimated deadline for quantum preparedness in cryptography to 2029—only 33 months from now. That’s earlier than previous deadlines , and they proposed the new post-quantum migration deadline because of two new papers that comprise a big jump in the state of the technology. It’s ahead of schedule, but not altogether unexpected. Cryptographers and engineers have been working on this for years, and as the deadline gets closer, it’s not surprising to see more precise timeline...
[DRAGNET]10 · 2026-04-09 07:00

Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025

Adobe Reader Zero-Day Exploited via Malicious PDFs Since December 2025    The Hacker News
The Daily WTF10 · 2026-04-09 06:30

CodeSOD: Take a Percentage

When looking at the source of a major news site, today's anonymous submitter sends us this very, very mild, but also very funny WTF: div class = "g-vhs g-videotape g-cinemagraph" id = "g-video-178_article_slug-640w" data-type = "videotape" data-asset = "https://somesite.com/videos/file.mp4" data-cinemagraph = "true" data-allow-multiple-players = "true" data-vhs-options = '{"ratio":"560:320"}' style = "padding-bottom: 57.14285714285714%" > Look, I know that percentage was calculated by JavaScr...
exp库-打造中文最大exploit库10 · 2026-04-09 00:00

React Server 19.2.0 - Remote Code Execution

# Exploit Title: React Server 19.2.0 - Remote Code Execution # Date: 2025-12-05 # Exploit Author: [EynaExp] (https://github.com/EynaExp) # Vendor Homepage: https://react.dev # Software Link: https://react.dev/reference/rsc/server-components # V......
exp库-打造中文最大exploit库10 · 2026-04-09 00:00

RomM 4.4.0 - XSS_CSRF Chain

# Exploit Title: RomM < 4.4.1 - XSS_CSRF Chain # Date: 2025-12-03 # Exploit Author: He4am (https://github.com/mHe4am) # Vendor Homepage: https://romm.app/ # Software Link: https://github.com/rommapp/romm (Docker: https://hub.docker.com/r/rom......
exp库-打造中文最大exploit库10 · 2026-04-09 00:00

Jumbo Website Manager - Remote Code Execution

#Exploit Title: Jumbo Website Manager - Remote Code Execution #Application: Jumbo Website Manager #Version: v1.3.7 #Bugs: RCE #Technology: PHP #Vendor URL: https://sourceforge.net/projects/jumbo/ #Software Link: https://sourceforge.net/project......
Microsoft Security Blog9 · 2026-04-09 15:00

Investigating Storm-2755: “Payroll pirate” attacks targeting Canadian employees

Microsoft Incident Response – Detection and Response Team (DART) researchers observed an emerging, financially motivated threat actor, tracked as Storm-2755, compromising Canadian employee accounts to gain unauthorized access to employee profiles and divert salary payments to attacker-controlled accounts. The post Investigating Storm-2755: “Payroll pirate” attacks targeting Canadian employees appeared first on Microsoft Security Blog .
Infosecurity9 · 2026-04-09 15:00

STX RAT Targets Finance Sector With Advanced Stealth Tactics

STX RAT, a newly identified remote access trojan, attempted deployment in finance, showing advanced C2 and stealthy delivery methods
bishopfox.com8 · 2026-04-09 19:00

Inside Cirro: Attack Paths, Cloud Graphs, and Extensible Schemas

Cloud risk doesn’t live in a single permission, it lives in the relationships between them. Discover how Cirro maps hidden attack paths across Azure identities, resources, and data to reveal what attackers actually see.
SentinelOne8 · 2026-04-09 13:00

Edge Decay: How a Failing Perimeter Is Fueling Modern Intrusions

Edge devices are prime targets — learn how attackers exploit the perimeter to gain access, persist, and pivot to identity.
Infosecurity8 · 2026-04-09 11:20

Atomic Stealer MacOS ClickFix Attack Bypasses Apple Security Warnings

macOS 26.4 update introduced security warnings into Terminal to prevent ClickFix attacks, so attackers have shifted to Script Editor instead
Infosecurity8 · 2026-04-09 10:45

Middle East Hack-for-Hire Operation Traced to South Asian Cyber Espionage Group

A spear-phishing campaign which spread across the Middle East between 2023 and 2024 has now been linked to Bitter APT group
Infosecurity8 · 2026-04-09 08:35

Google Warns of New Threat Group Targeting BPOs and Helpdesks

Google’s threat intel team warns UNC6783, a new extortion group possibly linked to the “Raccoon” persona, is targeting BPOs and enterprises
Ebay8 · 2026-04-09 07:00

eBay Opens The NYC Edit Market, an IRL Experience Where Selling Unlocks Access to Shopping

A three-day SoHo market filled with insider-sourced pre-loved pieces
Verne in GitHub8 · 2026-04-09 00:00

Google AI Edge Eloquent 是什么,一款离线优先的 AI 语音整理应用

结合 Google AI for Developers 官方页面与 App Store 信息,介绍 Google AI Edge Eloquent 是什么、能做什么、目前有哪些边界,以及为什么它值得关注。
Sucuri Blog6 · 2026-04-09 19:00

Why 2FA SMS is a Bad Idea in 2026

What is 2FA? Two-factor authentication (2FA) offers a second layer of security to help protect an account from brute force, phishing, and social engineering attacks. 2FA requires an extra step for a user to prove their identity, which reduces the chance of a bad actor gaining access to their account or data. And since notifications are sent to verify the initial authentication via username and passwords, it also gives users and business the ability to monitor for potential indicators of a com...
Pen Test Partners6 · 2026-04-09 11:43

You can pen test OT networks without breaking them

TL;DR  Introduction   There is a widely held belief that penetration testing Operational Technology networks is impossible. That simply connecting a laptop to a network will take down everything. That running nmap will take down a factory. That the only safe approach is to not test at all.  This belief is wrong. Or rather, it is a massive […] The post You can pen test OT networks without breaking them  appeared first on Pen Test Partners .
exp库-打造中文最大exploit库6 · 2026-04-09 00:00

ZSH 5.9 - RCE

# Exploit ZSH 5.9 - RCE # Date: 30-12-2025 # Exploit Author: sinanadilrana import pexpect import sys import time def debug_print(msg): print(f"[DEBUG] {msg}") def return_to_gdb(gdb, max_attempts=3, timeout=3): ""&qu......