Recon

RECON

Updated 4m ago
High-Signal Security Intelligence

2026-04-20

Security on TechRepublic214IN STACK · 8d ago

Microsoft Defender Flaws Exploited on Windows, Two Left Unpatched

Although the team with Microsoft moved swiftly to patch the BlueHammer vulnerability, other exploits still threaten Microsoft Defender and Windows users. The post Microsoft Defender Flaws Exploited on Windows, Two Left Unpatched appeared first on TechRepublic .
SitePoint208IN STACK · 9d ago

Running DeepSeek R1 Locally: Your Complete Setup Guide (2026)

Step-by-step guide to deploying DeepSeek R1 on your local machine or private servers. Covers hardware requirements, environment setup, Docker containerization, inference optimization, and integration with Python apps. Perfect for developers wanting privacy-first reasoning model access. Continue reading Running DeepSeek R1 Locally: Your Complete Setup Guide (2026) on SitePoint .
Palo Alto Unit 4255 · 9d ago

Fracturing Software Security With Frontier AI Models

Unit 42 finds frontier AI models enhance vulnerability discovery, acting as full-spectrum security researchers. They enable autonomous zero-day discovery and faster N-day patching. The post Fracturing Software Security With Frontier AI Models appeared first on Unit 42 .
Filippo Valsorda48 · 9d ago

Quantum Computers Are Not a Threat to 128-bit Symmetric Keys

There is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.
Simon Willison45 · 8d ago

llm-openrouter 0.6

Release: llm-openrouter 0.6 llm openrouter refresh command for refreshing the list of available models without waiting for the cache to expire. I added this feature so I could try Kimi 2.6 on OpenRouter as soon as it became available there . Here's its pelican - this time as an HTML page because Kimi chose to include an HTML and JavaScript UI to control the animation. Transcript here . Tags: openrouter , llm , llm-release , pelican-riding-a-bicycle , kimi , ai-in-china , llms , ai , generativ...
Huntress Blog40 · 8d ago

Nightmare-Eclipse Tooling Seen in Real-World Intrusion

Huntress observed in-the-wild use of Nightmare-Eclipse tooling, including BlueHammer, RedSun, and UnDefend, in a live intrusion involving FortiGate VPN compromise as the initial access, reconnaissance commands, and likely tunneling activity.
Rapid7 Blog40 · 8d ago

Project Glasswing and the Next Challenge for Defenders: Turning Faster Discovery into Faster Action

Anthropic’s Project Glasswing has sparked plenty of discussion about what AI might soon do for vulnerability discovery, but the more useful question for most security teams is how to prepare for, and more importantly seize the opportunity of, what comes next.  As we wrote in our earlier blog, What Project Glasswing Means for Security Leaders , AI is becoming more capable of finding software flaws. The pressure that follows lands on the teams responsible for deciding what matters, validating r...
Microsoft Security Blog32 · 8d ago

Making opportunistic cyberattacks harder by design

How Microsoft secures Dynamics 365 and Power Platform by removing credentials, reducing attack surfaces, and using platform engineering to block opportunistic threats. The post Making opportunistic cyberattacks harder by design appeared first on Microsoft Security Blog .
OpenAI Blog30 · 9d ago

OpenAI helps Hyatt advance AI among colleagues

Hyatt deploys ChatGPT Enterprise across its global workforce, using GPT-5.4 and Codex to improve productivity, operations, and guest experiences.
BleepingComputer29 · 8d ago

The Gentlemen ransomware now uses SystemBC for bot-powered attacks

A SystemBC proxy malware botnet of more than 1,570 hosts, believed to be corporate victims, has been discovered following an investigation into a Gentlemen ransomware attack carried out by a gang affiliate. [...]
The Hacker News28 · 8d ago

SGLang CVE-2026-5760 (CVSS 9.8) Enables RCE via Malicious GGUF Model Files

A critical security vulnerability has been disclosed in SGLang that, if successfully exploited, could result in remote code execution on susceptible systems. The vulnerability, tracked as CVE-2026-5760, carries a CVSS score of 9.8 out of 10.0. It has been described as a case of command injection leading to the execution of arbitrary code. SGLang is a high-performance, open-source serving
SecurityWeek27 · 8d ago

Serial-to-IP Converter Flaws Expose OT and Healthcare Systems to Hacking

Forescout researchers discovered 20 new vulnerabilities in Lantronix and Silex products and described theoretical attack scenarios. The post Serial-to-IP Converter Flaws Expose OT and Healthcare Systems to Hacking appeared first on SecurityWeek .
The Hacker News25 · 9d ago

Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain

Cybersecurity researchers have discovered a critical "by design" weakness in the Model Context Protocol's (MCP) architecture that could pave the way for remote code execution and have a cascading effect on the artificial intelligence (AI) supply chain. "This flaw enables Arbitrary Command Execution (RCE) on any system running a vulnerable MCP implementation, granting attackers direct access to
The Hacker News25 · 9d ago

Researchers Detect ZionSiphon Malware Targeting Israeli Water, Desalination OT Systems

Cybersecurity researchers have flagged a new malware called ZionSiphon that appears to be specifically designed to target Israeli water treatment and desalination systems. The malware has been codenamed ZionSiphon by Darktrace, highlighting its ability to set up persistence, tamper with local configuration files, and scan for operational technology (OT)-relevant services on the local subnet.
[DRAGNET]20 · 9d ago

Hackers Exploit CVE-2024-3721 To Deploy Nexcorium Malware On TBK DVRs

Hackers Exploit CVE-2024-3721 To Deploy Nexcorium Malware On TBK DVRs    cyberpress.org
The Register – Security17 · 8d ago

Vibe coding upstart Lovable denies data leak, cites 'intentional behavior,' then throws HackerOne under the bus

A lesson in how not to respond to vulnerability reports UPDATED   Vibe-coding platform Lovable is pooh-poohing a researcher’s finding that anyone could open a free account on the service and read other users' sensitive info, including credentials, chat history, and source code. However, the company’s story keeps changing: First it attributed the publicly exposed info to "intentional behavior" and "unclear documentation," then threw bug-bounty service HackerOne under the bus.…
Cyber Kendra17 · 8d ago

Lovable Left Thousands of Projects Exposed for 48 Days — And Still Hasn't Fixed It

The vibe-coding platform Lovable.dev is sitting on a ticking data exposure bomb — and it's been ticking for 48 days. A security researcher going by @weezerOSINT published a thread on X today revealing that a critical Broken Object Level Authorization (BOLA) flaw in Lovable's API allows any free account — created in minutes — to access the source code, database credentials, AI chat histories, and customer data belonging to other users.  The vulnerability affects every project created before No...
The Record from Recorded Future News17 · 8d ago

Italian regulator fines national postal service orgs $15 million for data privacy violations

The regulator fined Poste Italiane SpA, the postal service provider, €6.6 million ($7.8 million) and Postepay SpA, a digital payments subsidiary, €5.9 million ($7 million) for allegedly illegally processing millions of users’ personal data.
Cyber Kendra17 · 8d ago

Vercel Hacked Through an AI Tool — And Your Google Workspace Could Be Next

A third-party AI tool trusted by a single Vercel employee turned into the entry point for one of the most closely-watched cloud infrastructure breaches of 2026.  Cloud platform Vercel disclosed the security incident after threat actors claiming to be ShinyHunters posted on a hacking forum, alleging they had breached Vercel and were selling access to company data. For a company that hosts deployment infrastructure for millions of developers — and stewards Next.js, the internet's most popular R...
Cyber Kendra17 · 9d ago

The 7 Best Demostack Competitors for SaaS Teams That Need Faster Presales

Canadian software companies may be enjoying record investment, but their revenue teams are feeling the squeeze. Longer buying committees, tighter headcount budgets, and a buyer preference for self-service research mean that presales engineers must do more with less. Demo-automation platforms promise relief by turning repetitive screen-share walk-throughs into on-demand product experiences. Demostack helped popularise the category, yet a vibrant field of rivals now tackles the same problem fro...
Infosecurity17 · 9d ago

Formbook Malware Campaign Uses Multiple Obfuscation Techniques to Avoid Detection

Formbook attacks use combination of DLL Side-Loading and Obfuscated JavaScript to stay hidden, researchers at WatchGuard have uncovered
[DRAGNET]17 · 9d ago

DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy

DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy    Check Point Research
The Register (Security)17 · 9d ago

Next.js developer Vercel warns of customer credential compromise

Blames outfit called Context.ai, which reckons an agentic OAuth tangle caused the incident Vercel, the company that created the open source Next.js web development framework, has a data leak that led to compromise of some customer credentials, and blamed an outfit called Context.ai for the mess.…
先知安全技术社区15 · 8d ago

在野利用CVE-2026-34621漏洞PDF样本深度分析

模拟构建漏洞 PDF 响应载荷后发现,该载荷可异常驻留并嵌入 Adobe Acrobat Reader 内部,即便关闭 PDF、重启软件乃至操作系统,仍能持续触发恶意代码执行。
Codrops15 · 9d ago

Interactive Storytelling for the Web: Building Immersive Stories with Timelines, 3D, and Layered Scenes

A step by step tutorial on creating an immersive Moon story in Instorier with motion, interaction, and 3D scene building.
SANS ISC15 · 9d ago

ISC Stormcast For Monday, April 20th, 2026 https://isc.sans.edu/podcastdetail/9898, (Mon, Apr 20th)

ISC Stormcast For Monday, April 20th, 2026 https://isc.sans.edu/podcastdetail/9898, (Mon, Apr 20th)
Infosecurity14 · 9d ago

Attackers Exploit DVR Command Injection Flaw to Deploy Mirai-Based Botnet

FortiGuard Labs has identified a Mirai-based Nexcorium campaign actively exploiting CVE-2024-3721 in TBK DVR devices
Phoronix (Linux)13 · 8d ago

Linux 7.1 KVM Adds "Very Experimental" Support For pKVM Protected Guests

The Kernel-based Virtual Machine changes were recently merged for the Linux 7.1 merge window for further enhancing KVM as this important piece of the open-source virtualization stack...
Phoronix (Linux)13 · 8d ago

While New NTFS Driver Merged, NTFS3 Driver Sees Fixes & Minor Changes For Linux 7.1

Last week saw the "NTFS resurrection" as Linux Torvalds put it with the new/overhauled NTFS driver having been merged for Linux 7.1. Even still, the NTFS3 driver that was contributed a few years ago by Paragon Software remains in the mainline kernel and today were some fixes/improvements merged for that existing driver...
Phoronix (Linux)13 · 8d ago

Box64 0.4.2 Begins Working On POWER PPC64LE Backend, Support For SteamRT3 + Proton 11

While FEX-Emu has been garnering a lot of attention due to being sponsored by Valve and slated to be used by the Steam Frame for running Linux x86_64 binaries on AArch64, the Box64 project continues moving along with similar goals for x86_64 binaries on other CPU architectures...
Phoronix (Linux)13 · 9d ago

A Lot Of Memory Management "MM" Improvements Merged For Linux 7.1

Andrew Morton recently sent out his various "MM" related pull requests for the ongoing Linux 7.1 kernel. There are a number of memory management optimizations in this next kernel version, which is always nice to see but all the more so these days with the inflated RAM pricing and other computer component prices...
Phoronix (Linux)13 · 9d ago

Linux 7.1 Kernel Graphics Driver Changes Merged With Intel & AMD Leading The Way

The Direct Rendering Manager (DRM) kernel graphics driver and accelerator driver changes for Linux 7.1 were recently merged to Git. As usual, it's the Intel and AMD kernel graphics drivers seeing a bulk of the interesting open-source GPU driver activity. Plus ongoing work to make Rust-based GPU drivers more viable...
The Hacker News13 · 9d ago

Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials

Web infrastructure provider Vercel has disclosed a security breach that allows bad actors to gain unauthorized access to "certain" internal Vercel systems. The incident stemmed from the compromise of Context.ai, a third-party artificial intelligence (AI) tool, that was used by an employee at the company. "The attacker used that access to take over the employee's Vercel Google Workspace account,
Phoronix (Linux)13 · 9d ago

New Lenovo Legion Go Drivers & More Sony HID Device Support In Linux 7.1

The HID subsystem updates landed this week for the in-development Linux 7.1 kernel that includes new hardware support and other changes...
Dark Reading12 · 8d ago

Vercel Employee's AI Tool Access Led to Data Breach

Stolen OAuth tokens, which are at the root of these breaches, "are the new attack surface, the new lateral movement," a researcher notes.
Dark Reading12 · 8d ago

Serial-to-IP Devices Hide Thousands of Old & New Bugs

The OT devices that translate machine talk into Internet-speak are riddled with vulnerabilities and more frequently targeted for attacks, researchers say.
SitePoint12 · 9d ago

Open-Source vs Commercial LLMs: The Complete Guide (2026)

Comprehensive TCO analysis comparing Llama 3, Mistral 8x7B, and other open-source models against Claude and GPT-4. Includes compute costs, licensing, deployment infrastructure, and performance benchmarks. Helps teams make data-driven decisions on their LLM strategy for 2026. Continue reading Open-Source vs Commercial LLMs: The Complete Guide (2026) on SitePoint .
[DRAGNET]12 · 9d ago

Cyble's Monthly Threat Landscape Analysis - March 2026

Cyble's Monthly Threat Landscape Analysis - March 2026    Cyble
gilesthomas.com11 · 8d ago

Writing an LLM from scratch, part 32l -- Interventions: updated instruction fine-tuning results

I've been working on a GPT-2-small-style LLM based on Sebastian Raschka 's book " Build a Large Language Model (from Scratch) ", and have tried a bunch of different things to see if I could get it to approach the quality of the original OpenAI GPT-2-small, measured in terms of loss on a held-back test dataset. After working through them, in my last post , I managed to train one that was almost (if not quite) there. Now, back before I started digging into these interventions, I was doing three...
Security on TechRepublic11 · 8d ago

Amtrak Data Breach Exposes 2.1M Records, Reports Suggest Larger Leak

Amtrak data breach exposes over 2.1 million customer records after CRM access. Learn what was leaked, risks, and steps users and IT teams should take now. The post Amtrak Data Breach Exposes 2.1M Records, Reports Suggest Larger Leak appeared first on TechRepublic .
Linux Foundation Blogs11 · 8d ago

Navigating the Agentic AI Guardrails: Why Open Source is the Key to AI in Regulated Industries

Last week, I had the pleasure of standing before a packed room at the Open Source in Finance Forum (OSFF), a FINOS-hosted event taking place (at long last!) in my home town of Toronto. The audience was filled with familiar faces from Canadian and global banks, and the burgeoning fintech ecosystem, including a few cryptoasset pioneers. I was reminded of my own roots in the financial services sector, which began with obtaining my securities license through our regulator, the Ontario Securities ...
Hacker News Frontpage10 · 8d ago

Making RAM at Home [video]

Article URL: https://www.youtube.com/watch?v=h6GWikWlAQA Comments URL: https://news.ycombinator.com/item?id=47842569 Points: 287 # Comments: 74
Hacker News Frontpage10 · 8d ago

Changes to GitHub Copilot individual plans

Article URL: https://github.blog/news-insights/company-news/changes-to-github-copilot-individual-plans/ Comments URL: https://news.ycombinator.com/item?id=47838508 Points: 435 # Comments: 172
Hacker News Frontpage10 · 8d ago

Bloom (YC P26) Is Hiring

Article URL: https://www.ycombinator.com/companies/trybloom/jobs Comments URL: https://news.ycombinator.com/item?id=47837176 Points: 0 # Comments: 0
[DRAGNET]10 · 9d ago

Attackers Exploit Windows Zero-Days to Bypass Microsoft Defender

Attackers Exploit Windows Zero-Days to Bypass Microsoft Defender    Petri IT Knowledgebase
CISA Alerts9 · 9d ago

CISA Adds Eight Known Exploited Vulnerabilities to Catalog

CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation.  CVE-2023-27351 PaperCut NG/MF Improper Authentication Vulnerability CVE-2024-27199 JetBrains TeamCity Relative Path Traversal Vulnerability CVE-2025-2749 Kentico Xperience Path Traversal Vulnerability CVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability CVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Cr...
Kotlin8 · 9d ago

Helping Decision-Makers Say Yes to Kotlin Multiplatform (KMP)

This post was written by external contributors from Touchlab. KMP is a strategic platform In the current competitive landscape, the traditional mobile development model characterized by maintaining independent, duplicated codebases for iOS and Android is no longer a sustainable use of capital. This approach systematically introduces feature lag, technical debt, and a fragmented engineering culture […]
The Akamai Blog (https://blogs.akamai.com/feeds.html)8 · 9d ago

The AI Threat Multiplier: Why Architectural Flaws Are the New Frontier

AI has put an end to the era of evaluating CVEs in isolation. The most critical risks now emerge when legacy state machines meet asynchronous execution.
Phoronix (Linux)8 · 9d ago

JFS Sees Data Integrity Hardening With Linux 7.1

It's pretty rare nowadays seeing any real changes to the JFS file-system on Linux when there are multiple far superior solutions available. But in any event, the JFS file-system driver has seen a few fixes in Linux 7.1...
Hayden James8 · 9d ago

Bash Aliases: Speed Up Your Linux Workflow (Updated with Zsh)

Bash aliases turn long, repetitive commands into short custom shortcuts that load every time you open a terminal. Here's how to set them up, where to store them, and a practical set of aliases built for real sysadmin work. Continue reading...
rtl-sdr.com8 · 9d ago

Tactical_FSK_Modem: An Open Software MFSK Image & Text Modem for PC and Android

Thanks to Ibrahim (YD1RUH), who wrote in to share his open-source open-software project Tactical_FSK_Modem, which turns a standard PC or Android device into an audio-based MFSK transceiver for sending images and text over a radio link. Conceptually similar to SSTV or HF FAX, it adds Hamming (7,4) Forward Error Correction that wraps every 4 data […]
Red Hat Security8 · 9d ago

Integrating Red Hat Lightspeed with CrowdStrike for enhanced malware detection coverage

Today’s cybersecurity teams need proactive defense mechanisms to meet modern threats as the threat landscape continues to evolve and change. We're excited to announce a significant advancement for our customers: the integration of Red Hat Lightspeed with CrowdStrike, empowering Red Hat Enterprise Linux users with an expanded arsenal against malware threats.A new era of malware signature coverageCustomers who use Red Hat Enterprise Linux, Red Hat Lightspeed, and CrowdStrike can now immediately...
Security on TechRepublic6 · 8d ago

This VPN Lets You Verify Your Business Privacy For $130

VP.NET makes VPN privacy verifiable, not just policy-based, with secure enclave tech for up to five devices. The post This VPN Lets You Verify Your Business Privacy For $130 appeared first on TechRepublic .
[DRAGNET]5 · 8d ago

Justice Department seizes $10 million from ransomware conspirator

Justice Department seizes $10 million from ransomware conspirator    mypanhandle.com
[DRAGNET]5 · 8d ago

“Essentially invisible:” How hackers 'trojan-horsed' QEMU virtual machines to bypass security and drop ransomware

“Essentially invisible:” How hackers 'trojan-horsed' QEMU virtual machines to bypass security and drop ransomware    TechRadar
[DRAGNET]5 · 8d ago

The Gentlemen ransomware now uses SystemBC for bot-powered attacks

The Gentlemen ransomware now uses SystemBC for bot-powered attacks    BleepingComputer
[DRAGNET]5 · 8d ago

Payouts King ransomware abuses QEMU for hidden VMs and backdoors

Payouts King ransomware abuses QEMU for hidden VMs and backdoors    SC Media
[DRAGNET]5 · 8d ago

Ransomware Attack on Healthcare IT Solutions Provider Impacts Dutch Hospitals

Ransomware Attack on Healthcare IT Solutions Provider Impacts Dutch Hospitals    CPO Magazine
[DRAGNET]5 · 9d ago

Today Ransomware evolution neutralizes current incident response strategies

Today Ransomware evolution neutralizes current incident response strategies    Cybersecurity Insiders
[DRAGNET]5 · 9d ago

Attackers Turn QEMU Into a Stealth Backdoor for Credential Theft and Ransomware

Attackers Turn QEMU Into a Stealth Backdoor for Credential Theft and Ransomware    CyberSecurityNews
[DRAGNET]5 · 9d ago

New JanaWare Ransomware Targets Turkish Users Through Customized Adwind RAT

New JanaWare Ransomware Targets Turkish Users Through Customized Adwind RAT    CyberSecurityNews
[DRAGNET]5 · 9d ago

Arizona & Texas Clinics Notify Patients About Ransomware Incidents

Arizona & Texas Clinics Notify Patients About Ransomware Incidents    The HIPAA Journal
[DRAGNET]5 · 9d ago

Ransomware’s Next Phase: From Data Encryption to Business Extortion

Ransomware’s Next Phase: From Data Encryption to Business Extortion    Silicon UK
[DRAGNET]5 · 9d ago

Payouts King Ransomware Uses QEMU VMs to Bypass Endpoint Security

Payouts King Ransomware Uses QEMU VMs to Bypass Endpoint Security    Security Boulevard
[DRAGNET]5 · 9d ago

QEMU Hijacked as Stealth Backdoor for Credential Theft, Ransomware

QEMU Hijacked as Stealth Backdoor for Credential Theft, Ransomware    gbhackers.com
[DRAGNET]5 · 9d ago

Comment: Why proactive cybersecurity beats ransomware threats - The Engineer

Comment: Why proactive cybersecurity beats ransomware threats    The Engineer - Home
[DRAGNET]0 · 9d ago

Ransomware’s back office: What the ransom note won’t say

Ransomware’s back office: What the ransom note won’t say    WeLiveSecurity
[DRAGNET]0 · 9d ago

Akira Ransomware Targets Integra Architecture Inc.

Akira Ransomware Targets Integra Architecture Inc.    DeXpose