Recon

RECON

Updated 4m ago
High-Signal Security Intelligence

2026-04-14

Docker208IN STACK · 2026-04-14 21:48

Why We Chose the Harder Path: Docker Hardened Images, One Year Later

We're coming up on a year since launching Docker Hardened Images (DHI) last May, and crossing a milestone earlier this month made me stop and reflect on what we've actually been building. Earlier this month, we crossed over 500k daily pulls of DHIs, and over 25k continuously patched OS level artifacts in our SLSA Build...
Infosecurity203IN STACK · 2026-04-14 11:30

Malicious Chrome Extensions Campaign Exposes User Data

108 malicious Chrome extensions steal sessions, Google data, inject ads via single C2 infrastructure
Google AI Blog200IN STACK · 2026-04-14 17:00

Turn your best AI prompts into one-click tools in Chrome

Skills in Chrome let you discover, save and remix AI workflows — and repeat them instantly.
Simon Willison62 · 2026-04-14 23:58

datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection

datasette PR #2689: Replace token-based CSRF with Sec-Fetch-Site header protection Datasette has long protected against CSRF attacks using CSRF tokens, implemented using my asgi-csrf Python library. These are something of a pain to work with - you need to scatter forms in templates with lines and then selectively disable CSRF protection for APIs that are intended to be called from outside the browser. I've been following Filippo Valsorda's research here with interest, described in this detail...
Simon Willison57 · 2026-04-14 19:41

Cybersecurity Looks Like Proof of Work Now

Cybersecurity Looks Like Proof of Work Now The UK's AI Safety Institute recently published Our evaluation of Claude Mythos Preview’s cyber capabilities , their own independent analysis of Claude Mythos which backs up Anthropic's claims that it is exceptionally effective at identifying security vulnerabilities. Drew Breunig notes that AISI's report shows that the more tokens (and hence money) they spent the better the result they got, which leads to a strong economic incentive to spend as much...
Simon Willison45 · 2026-04-14 21:23

Trusted access for the next era of cyber defense

Trusted access for the next era of cyber defense OpenAI's answer to Claude Mythos appears to be a new model called GPT-5.4-Cyber: In preparation for increasingly more capable models from OpenAI over the next few months, we are fine-tuning our models specifically to enable defensive cybersecurity use cases, starting today with a variant of GPT‑5.4 trained to be cyber-permissive: GPT‑5.4‑Cyber. They're also extending a program they launched in February (which I had missed) called Trusted Access...
Rapid7 Blog40 · 2026-04-14 12:31

Your Cloud Detection Strategy in 2026: What to Expect at the Global Cybersecurity Summit

Cloud environments have changed how security teams detect and respond to threats. Signals come from more places, identities are harder to track, and attacks rarely stay within a single system. For many teams, the challenge is no longer visibility. It is having the risk context to understand what matters and act on it quickly. This shift is reflected in the conversations shaping this year’s Rapid7 Global Cybersecurity Summit. Taking place May 12-13, the summit explores how detection and respon...
Elastic Security Labs40 · 2026-04-14 00:00

Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT

Elastic Security Labs uncovers a novel social engineering campaign that abuses the popular note-taking application, Obsidian's legitimate community plugin ecosystem. The campaign, which we track as REF6598, targets individuals in the financial and cryptocurrency sectors through elaborate social engineering on LinkedIn and Telegram.
Huntress Blog39 · 2026-04-14 13:00

When PUPs Grow Fangs: Dragon Boss Solutions' $10 Supply Chain Risk

Huntress uncovered a malware operation using signed PUP to deploy AV killers with SYSTEM privileges. Learn how this adware crosses the line into malware territory and how anyone could have hijacked their update mechanism.
Cloudflare Blog (Security)35 · 2026-04-14 13:00

Managed OAuth for Access: make internal apps agent-ready in one click

Managed OAuth for Cloudflare Access helps AI agents securely navigate internal applications. By adopting RFC 9728, agents can authenticate on behalf of users without using insecure service accounts.
Cloudflare Blog (Security)35 · 2026-04-14 13:00

Securing non-human identities: automated revocation, OAuth, and scoped permissions

Cloudflare is introducing scannable API tokens, enhanced OAuth visibility, and GA for resource-scoped permissions. These tools help developers implement a true least-privilege architecture while protecting against credential leakage.
Cloudflare Blog (Security)35 · 2026-04-14 13:00

Scaling MCP adoption: Our reference architecture for simpler, safer and cheaper enterprise deployments of MCP

We share Cloudflare's internal strategy for governing MCP using Access, AI Gateway, and MCP server portals. We also launch Code Mode to slash token costs and recommend new rules for detecting Shadow MCP in Cloudflare Gateway.
Codrops32 · 2026-04-14 13:56

They Call Me Giulio: The Making of a Cinematic Cyberpunk Portfolio

A deep dive into four cinematic scenes, exploring how film-inspired ideas evolved into a cohesive and immersive portfolio experience.
The Hacker News28 · 2026-04-14 05:50

ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers

A critical security vulnerability impacting ShowDoc, a document management and collaboration service popular in China, has come under active exploitation in the wild. The vulnerability in question is CVE-2025-0520 (aka CNVD-2020-26585), which carries a CVSS score of 9.4 out of 10.0. It relates to a case of unrestricted file upload that stems from improper validation of
Full Disclosure27 · 2026-04-14 17:07

CyberDanube Security Research 20260408-1 | Multiple Vulnerabilities in Siemens SICAM A8000

Posted by Thomas Weber | CyberDanube via Fulldisclosure on Apr 14 CyberDanube Security Research 20260408-1 ------------------------------------------------------------------------------- title| Multiple Vulnerabilities product| Siemens SICAM A8000 CP-8050/CP-8031/CP-8010/CP-8012 vulnerable version| fixed version| V26.10 CVE number| CVE-2026-27664 impact| High homepage| https://siemens.com/ found|...
Full Disclosure27 · 2026-04-14 17:07

CyberDanube Security Research 20260408-0 | Remote Operation Denial of Service in Siemens SICAM A8000

Posted by Thomas Weber | CyberDanube via Fulldisclosure on Apr 14 CyberDanube Security Research 20260408-0 ------------------------------------------------------------------------------- title| Remote Operation Denial of Service product| Siemens SICAM A8000 CP-8050/CP-8031/CP-8010/CP-8012 vulnerable version| fixed version| V26.10 CVE number| CVE-2026-27663 impact| Medium homepage| https://siemens.com/ ...
The Hacker News25 · 2026-04-14 14:30

AI-Driven Pushpaganda Scam Exploits Google Discover to Spread Scareware and Ad Fraud

Cybersecurity researchers have unmasked a novel ad fraud scheme that has been found to leverage search engine poisoning (SEO) techniques and artificial intelligence (AI)-generated content to push deceptive news stories into Google's Discover feed and trick users into enabling persistent browser notifications that lead to scareware and financial scams. The campaign, which has been
The Hacker News25 · 2026-04-14 10:00

Analysis of 216M Security Findings Shows a 4x Increase In Critical Risk (2026 Report)

OX Security recently analyzed 216 million security findings across 250 organizations over a 90-day period. The primary takeaway: while raw alert volume grew by 52% year-over-year, prioritized critical risk grew by nearly 400%. The surge in AI-assisted development is creating a "velocity gap" where the density of high-impact vulnerabilities is scaling faster than
The Hacker News25 · 2026-04-14 08:35

108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users

Cybersecurity researchers have discovered a new campaign in which a cluster of 108 Google Chrome extensions has been found to communicate with the same command-and-control (C2) infrastructure with the goal of collecting user data and enabling browser-level abuse by injecting ads and arbitrary JavaScript code into every web page visited. According to Socket, the extensions (complete list
OpenAI Blog24 · 2026-04-14 00:00

Trusted access for the next era of cyber defense

OpenAI expands its Trusted Access for Cyber program, introducing GPT-5.4-Cyber to vetted defenders and strengthening safeguards as AI cybersecurity capabilities advance.
ElcomSoft blog22 · 2026-04-14 14:00

Low-Level Extraction for iOS 17 and 18

We’ve just updated iOS Forensic Toolkit to version 10.0, significantly expanding its low-level extraction capabilities for both the extraction agent and bootloader-based methods. Previously, agent-based extraction was capped at iOS 16.6.1. This release finally covers the remainder of the iOS 16 branch, and adds support for the entire iOS 17  branch as well as iOS […]
SentinelOne17IoCs DETECTED · 2026-04-14 22:59

Securing the Software Supply Chain: How SentinelOne’s AI EDR Autonomously Blocked the CPU-Z Watering Hole Cyber Attack

On April 9, 2026, cpuid.com was actively serving malware through its own official download button. Threat actors had compromised the CPUID domain at the API level and were silently redirecting legitimate download requests to attacker-controlled infrastructure. The attack ran for approximately 19 hours. Users who navigated directly to the official site received a legitimate, properly […]
Tenable Blog17 · 2026-04-14 20:45

Claude Mythos: Prepare for your board’s cybersecurity questions about the latest AI model from Anthropic

With the Federal Reserve Chairman meeting with bank CEOs to discuss the security implications of Claude Mythos, you can bet that your board of directors will ask you about the impact of the AI model on your cybersecurity strategy. Here’s how to prepare.  Key takeaways Anthropic announced Claude Mythos Preview, its most powerful general-purpose frontier model to date, and highlighted its exceptional ability to find software vulnerabilities that no human vulnerability research had previously di...
Cyber Kendra17 · 2026-04-14 17:01

Cloudflare Mesh Wants to Replace Your VPN — and It's Built for AI Agents, Not Just Humans

The way teams think about private network access has quietly changed. A year ago, the things knocking on your internal APIs were your developers and your services. Today, there's a growing third category: AI agents — running autonomously, without interactive logins, against infrastructure that was never designed to let them in. Cloudflare wants to solve that. Today, the company launched Cloudflare Mesh, a private networking product built on post-quantum encryption that connects servers, lapto...
SitePoint17 · 2026-04-14 16:29

DeepSeek V4 Preview: What the Fast, Expert, and Vision Modes Suggest

Short news analysis with mode-by-mode breakdown, why it matters for developers, and a practical watchlist for release day Continue reading DeepSeek V4 Preview: What the Fast, Expert, and Vision Modes Suggest on SitePoint .
The Register (Security)17 · 2026-04-14 12:56

No honor among thieves as 0APT threatens rival ransomware gang Krybit

Honey, the skids are fighting again Two rival ransomware gangs have locked horns after 0APT threatened to expose people affiliated with Krybit.…
Bruce's Blog17 · 2026-04-14 02:00

Hermes Agent Hands-On: Nous Research Personal AI Agent Review

Nous Research just shipped Hermes Agent v0.9.0 "the everywhere release". Hands-on review of the first AI agent that ships with the harness built in — self-evolving skills, three-layer memory, 40+ tools, $5 VPS to run.
Qualys Threat Research15 · 2026-04-14 20:16

Microsoft and Adobe Patch Tuesday, April 2026 Security Update Review

April 2026’s Patch Tuesday arrives with Microsoft addressing a fresh set of vulnerabilities across its ecosystem, reinforcing the ongoing need for timely patching in an increasingly threat-heavy landscape. Here’s a quick breakdown of what you need to know. Microsoft Patch Tuesday for April 2026 This month’s release addresses 163 vulnerabilities, including eight critical-severity vulnerabilities. In this month’s updates, Microsoft has addressed one publicly disclosed zero-day vulnerability and...
Cyber Kendra14 · 2026-04-14 15:17

PHP Composer Hit by Two Command Injection Flaws That Work Even Without Perforce Installed

If you use PHP's Composer package manager, stop what you're doing and run composer.phar selfupdate right now.  Two newly disclosed command injection vulnerabilities — CVE-2026-40261 and CVE-2026-40176 — in Composer's Perforce VCS driver could let an attacker execute arbitrary commands on your system, and here's the unsettling part: Perforce doesn't even need to be installed on your machine for the attack to work. Both flaws were patched today in Composer 2.9.6 and 2.2.27 (LTS), disclosed by m...
先知安全技术社区14 · 2026-04-14 07:59

Langflow 1.8.3 CodeParser eval() —RCE漏洞分析+POC

小0day;CodeParser.parse_callable_details() 方法在解析函数的返回类型注解时,将注解字符串通过 ast.unparse() 提取后直接传递给 eval() 执行。
The Hacker News13 · 2026-04-14 14:56

Google Adds Rust-Based DNS Parser into Pixel 10 Modem to Enhance Security

Google has announced the integration of a Rust-based Domain Name System (DNS) parser into the modem firmware as part of its ongoing efforts to beef up the security of Pixel devices and push memory-safe code at a more foundational level. "The new Rust-based DNS parser significantly reduces our security risk by mitigating an entire class of vulnerabilities in a risky area, while also laying
The Hacker News13 · 2026-04-14 05:39

CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added half a dozen security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The list of vulnerabilities is as follows - CVE-2026-21643 (CVSS score: 9.1) -  An SQL injection vulnerability in  Fortinet FortiClient EMS that could allow an
SurveyMonkey12 · 2026-04-14 16:03

SurveyMonkey Research: AI Sentiment Study

SurveyMonkey Research: AI Sentiment Study
Freek Van der Herten12 · 2026-04-14 10:30

Why use static closures?

A clear walkthrough of how PHP closures implicitly capture $this, even when they don't use it, and how that can prevent objects from being garbage collected. Also covers what PHP 8.6 will change with automatic static inference. Read more
Dark Reading11 · 2026-04-14 21:22

Privilege Elevation Dominates Massive Microsoft Patch Update

Elevation-of-privilege bugs accounted for more than half of the 165 vulnerabilities patched, with two zero-days in that mix.
Deeplinks11 · 2026-04-14 16:00

EFF to State AGs: Investigate Google's Broken Promise to Users Targeted by the Government

Google's Failure to Warn Users About Law Enforcement Demands for Data Is Deceptive SAN FRANCISCO – The Electronic Frontier Foundation sent complaints today to the attorneys general of California and New York urging them to investigate Google for deceptive trade practices, related to the company's broken promise to give users prior notice before disclosing their information to law enforcement.  The letters were sent on behalf of Amandla Thomas-Johnson, whose information was disclosed to U.S. I...
Daring Fireball8 · 2026-04-14 22:06

Fraudulent Cryptocurrency App in Mac App Store Stole $9.5 Million From 50-Some Users

Fraudulent Cryptocurrency App in Mac App Store Stole $9.5 Million From 50-Some Users
paper - Last paper8 · 2026-04-14 19:31

合法终端管理软件遭滥用:疑似银狐攻击事件分析与溯源

作者:知道创宇高级威胁情报团队 一、事件概述 近期,我们在客户现场应急响应中排查到一起新型攻击事件。攻击者伪造常用工具安装包诱导执行,随即部署一款带有合法数字签名的终端管理软件。经技术溯源确认,该程序具备主机信息收集、远程控制等完整恶意能力,其 C2 基础设施与 “银狐” 高度关联。由于合法数字签名的天然 “免杀” 特性,该恶意程序可轻易绕过主流杀毒软件检测,实现隐蔽入侵与长期控制。 银狐简介 银...
Real Python6 · 2026-04-14 14:00

Vector Databases and Embeddings With ChromaDB

Learn how to use ChromaDB, an open-source vector database, to store embeddings and give context to large language models in Python.
[DRAGNET]5 · 2026-04-14 17:49

Zero Day Initiative — The April 2026 Security Update Review

Zero Day Initiative — The April 2026 Security Update Review    thezdi.com
[DRAGNET]5 · 2026-04-14 07:00

Kettering Health Ransomware Attack: 1.7 Million Individuals Affected

Kettering Health Ransomware Attack: 1.7 Million Individuals Affected    The HIPAA Journal
[DRAGNET]5 · 2026-04-14 07:00

Hackers Exploit Obsidian Plugin to Deploy Cross-Platform Malware

Hackers Exploit Obsidian Plugin to Deploy Cross-Platform Malware    gbhackers.com