<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
     xmlns:dc="http://purl.org/dc/elements/1.1/"
     xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
     xmlns:admin="http://webns.net/mvcb/"
     xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
     xmlns:content="http://purl.org/rss/1.0/modules/content/"
     xmlns:media="http://search.yahoo.com/mrss/">
<channel>
    <title>Cybersecurity Tomorrow &amp; Latest Posts</title>
    <link>https://cybersecuritytomorrow.com/rss/latest-posts</link>
    <description>Cybersecurity Tomorrow &amp; Latest Posts</description>
    <dc:language>en</dc:language>
    <dc:creator></dc:creator>
    <dc:rights>Copyright 2025 Cybersecurity Tomorrow &amp; All Rights Reserved.</dc:rights>
    <item>
        <title>Infrastructure Pivoting: How CTI Analysts Expand From a Single IOC to a Full Attacker Network</title>
        <link>https://cybersecuritytomorrow.com/infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-network</link>
        <guid>https://cybersecuritytomorrow.com/infrastructure-pivoting-how-cti-analysts-expand-from-a-single-ioc-to-a-full-attacker-network</guid>
        <description><![CDATA[ The field manual for tracing attacker infrastructure — from one domain to dozensContinue reading on InfoSec Write-ups » ]]></description>
        <enclosure url="http://cdn-images-1.medium.com/max/2600/1*1ehWz4-YEZTo-PXo4FwemA.png" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:40:54 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Infrastructure, Pivoting:, How, CTI, Analysts, Expand, From, Single, IOC, Full, Attacker, Network</media:keywords>
    </item>
    <item>
        <title>Ploutus Malware: Uptick in ATM jackpotting incidents prompts FBI warning</title>
        <link>https://cybersecuritytomorrow.com/ploutus-malware-uptick-in-atm-jackpotting-incidents-prompts-fbi-warning</link>
        <guid>https://cybersecuritytomorrow.com/ploutus-malware-uptick-in-atm-jackpotting-incidents-prompts-fbi-warning</guid>
        <description><![CDATA[ Three weeks ago, renewed activity involving Ploutus ATM malware surfaced, prompting an alert from the Federal Bureau of Investigation (FBI). At the time, we published an initial breakdown covering the threat and its implications for financial institutions — an analysis that was later recognized as a Top Perspective on LinkedIn, reflecting the growing industry concern around ATM-targeted attacks.Uptick in ATM jackpotting incidents prompts FBI warning | LinkedInThe recent warning has since reignited discussions across financial security circles. But beyond the headlines, a more important question emerges:Why are ATMs still vulnerable to jackpotting in 2026 — and what actually works to stop it?ATM attacks are no longer about fraud. They are about direct cash extraction via system-level manipulation.Ploutus enables attackers to bypass:Card authenticationBanking systemsTransaction validationAnd directly command the ATM to dispense cash.This follow-up article goes beyond surface-level analysis — delivering a deep technical breakdown of how these attacks work, why they continue to succeed, and what actually stops them in real-world environments.ATM Architecture: Why Jackpotting Is PossibleModern ATMs are not simple machines — they are specialized endpoints.Typical characteristics:Windows Embedded / IoT operating systemsXFS (Extensions for Financial Services) middlewareLimited CPU, memory, and storageOften network-isolated or semi-isolatedMaintained by third-party vendorsThe Critical Layer: XFS MiddlewareXFS acts as the bridge between software and hardware:Cash dispenserCard readerPIN padReceipt printerPloutus targets this layer directly.Instead of attacking banking systems, it speaks the ATM’s native language. Once XFS is compromised, the attacker can issue dispense commands without any transaction validation.Ploutus Attack Chain (End-to-End)Phase 1: Initial AccessMost real-world attacks begin with physical compromise:ATM cabinet openedUSB payload insertedBoot process manipulatedAdministrative access obtainedLess frequently:Network pivot via weak segmentationPhase 2: Malware DeploymentThe payload:Injects into ATM processesHooks XFS APIsDisables protectionsMay establish persistenceAdvanced capabilities:ObfuscationVendor-specific targetingEncrypted triggersLog manipulationPhase 3: ExecutionAttackers trigger the malware via:Keypad sequencesExternal input devicesTime-based triggersThe ATM:Executes rapid dispense commandsBypasses transaction flowOperates without card interactionPhase 4: Cash-OutRapid cassette emptying$20K–$200K loss per machineOperation completed within minutesThe Real Issue: Not Advanced — Just UncontrolledDespite its reputation, Ploutus often succeeds due to basic failures:No full-disk encryptionShared or weak credentialsUSB ports left exposedDisabled or ignored alarmsPoor physical securityThis aligns with industry feedback:“Nothing super high-tech — just basics that shouldn’t exist.”Attackers don’t need zero-days. They need gaps in enforcement.Why Traditional Anti-Malware Fails in ATMsATM environments impose constraints:Network isolation limits cloud-based detectionPCI compliance restricts architectureLow hardware resources limit EDR deploymentPatch cycles are slowFrom the AppGuard case study:ATMs are “network isolated &amp; low-power”, making traditional detection-heavy tools impractical .This creates a mismatch:Detection tools expect connectivity and resourcesATMs provide neitherDetection vs Prevention: The Industry DivideDetection-Based ApproachesSignature AVMachine learning AVEDR / behavioral analyticsChallenges:Alert fatigueRequires human triageDelayed responsePrevention-Based ApproachesApplication whitelistingZero-trust execution controlAdvantages:Blocks unknown binariesMinimal overheadWorks offlineAdvanced Detection Engineering (Multi-Layer Model)Effective detection requires correlation across three layers:OS-Level DetectionKey telemetry:Event ID 4688 → Process creationEvent ID 7045 → Service installEvent ID 1102 → Log clearingSysmon Event ID 1Indicators:Execution from USB pathsUnknown binariesSuspicious parent-child chainsUSB &amp; Physical Interaction MonitoringKernel-PnP logsDevice insertion anomaliesActivity outside maintenance windowsXFS Middleware MonitoringMonitor:DLL injection into ATM processesUnauthorized module loadingAPI hooking behaviorDispense Behavior Detection (Most Reliable)Normal:One dispense per transactionMalicious:Rapid repeated dispensesNo card interactionRule: IFMultiple dispense events ANDNo card/PIN validation → Trigger lock immediatelyCash Dispenser TelemetryCorrelate:High dispense volumeNull transaction IDsAfter-hours activityDetection must happen locally and instantly.Sigma-Style Detection RulesSuspicious USB ExecutionProcess from removable mediaAND not signed by trusted vendor→ AlertLog ClearingEventID = 1102→ High severity alertAbnormal Dispensedispense_count &gt; thresholdAND transaction == null→ Critical alert + auto lockXFS InjectionUnknown DLL in ATM process→ Block / Al ]]></description>
        <enclosure url="http://cdn-images-1.medium.com/max/1024/1*Fzglouir4yQlVAVsrBL-dw.png" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:40:54 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Ploutus, Malware:, Uptick, ATM, jackpotting, incidents, prompts, FBI, warning</media:keywords>
    </item>
    <item>
        <title>How I Found a Hardcoded RSA Private Key in a Major Crypto Exchange’s Frontend</title>
        <link>https://cybersecuritytomorrow.com/how-i-found-a-hardcoded-rsa-private-key-in-a-major-crypto-exchanges-frontend</link>
        <guid>https://cybersecuritytomorrow.com/how-i-found-a-hardcoded-rsa-private-key-in-a-major-crypto-exchanges-frontend</guid>
        <description><![CDATA[ How I Found a Hardcoded RSA Private Key in a Major Crypto Exchange’s Frontend -And What I Learned the Hard WayA Bug Bounty Story About Recon, Excitement, and Harsh RealityIt started like any other Saturday morning. Coffee in hand, terminal open, and a fresh bug bounty target loaded up. What followed was one of the most educational experiences of my security research career — not because I earned a massive bounty, but because I didn’t.This is that story.The TargetI was hunting on a major cryptocurrency trading platform’s bug bounty program. The scope was broad — *.target.com, iOS app, Android app — and the rewards were listed as Critical bounty for serious findings. The in-scope vulnerability list included the good stuff: SSRF, Business Logic, RCE, Access Control issues, Sensitive Information Disclosure.I decided to start with what I call passive JavaScript recon — one of the most underrated techniques in web bug bounty.Phase 1: JavaScript Recon (Where the Gold Hides)Most hunters jump straight to fuzzing endpoints or running automated scanners. I’ve learned that the real treasure is often hiding in plain sight — inside the frontend JavaScript bundles that ship directly to your browser.# Download the main app bundlecurl -s https://static.target.com/web-frontend/client/app.xxxxx.js -o app.js# Search for interesting keywordsgrep -iE &#039;private_key|secret|password|api_key|token&#039; app.jsAnd then it happened.TRACK_PRIVATE_KEY: &quot;MIICdQIBADANBgkqhkiG9w0BAQEFAA...&quot;My coffee went cold. I was looking at what appeared to be a complete RSA private key hardcoded inside a production JavaScript file — publicly accessible to anyone who visited the website.My heart was racing.Phase 2: Validation — Is This Real?First rule of bug bounty: don’t get excited until you validate. I extracted the key and ran it through OpenSSL immediately.# Save and validate the keycat &gt; extracted.key  ]]></description>
        <enclosure url="http://cdn-images-1.medium.com/max/1024/1*HJzbF9UcCe9yLUb7dWSWyA.png" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:40:54 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>How, Found, Hardcoded, RSA, Private, Key, Major, Crypto, Exchange’s, Frontend</media:keywords>
    </item>
    <item>
        <title>Found a Denial of Service Vulnerability in a Major Company’s Production Infrastructure Using Shodan</title>
        <link>https://cybersecuritytomorrow.com/found-a-denial-of-service-vulnerability-in-a-major-companys-production-infrastructure-using-shodan</link>
        <guid>https://cybersecuritytomorrow.com/found-a-denial-of-service-vulnerability-in-a-major-companys-production-infrastructure-using-shodan</guid>
        <description><![CDATA[ A step-by-step story of reconnaissance, discovery, and responsible disclosureBug bounty hunting is rarely glamorous. Most of the time, it’s hours of staring at HTTP responses, chasing dead ends, and questioning whether that “weird behavior” is actually a vulnerability or just… intended. This is the story of one of those hunts — where a simple Shodan search led me down a rabbit hole that ended with a legitimate Denial of Service vulnerability on production infrastructure serving millions of users.The Hunt Begins: Shodan ReconnaissanceEvery good bug hunt starts with reconnaissance. My target was a large tech company with a public bug bounty program that included IP ranges in their scope. This is often an overlooked attack surface — most researchers focus on web applications and APIs, ignoring raw IP ranges entirely.I fired up Shodan and searched their IP range:net:185.26.x.x/22Most results were boring — a few nginx servers returning 301 redirects, some DNS servers. Standard stuff. But one IP caught my eye immediately.The Interesting HostOne particular host stood out from the rest. While other servers in the range were running standard nginx, this one was running something completely different:Server: Pike v8.0 release 908: HTTP Server modulePike HTTP Server. Not something you see every day.More interesting was the port list:Open Ports: 22, 80, 123, 1080, 2049, 2345, 8081, 8192, 8888, 8889, 9000Eleven open ports on a production server. Each one a potential story.My eyes immediately went to three unusual ports:Port 2049 — traditionally NFS (Network File System)Port 1080 — traditionally SOCKS proxyPort 2345 — traditionally DBM (Database Manager)Ports 8888/8889 — unknown Pike servicesThis was not a standard web server. This was infrastructure.Peeling Back the LayersNFS on Port 2049?My first instinct was to enumerate the NFS service:showmount -e [TARGET_IP]# Result: clnt_create: RPC: Unable to receiveInteresting. The port was open but RPC wasn’t responding. I ran a more detailed nmap scan:nmap -sV -p 111,2049 --script=rpcinfo [TARGET_IP]The result was surprising. Port 2049 wasn’t NFS at all. It was responding with something completely custom:_version\xa0\xe8\xa3\x06\x15cmbt9x79skf8qsbx8hr8q25xgA custom binary protocol, disguised on the NFS port. Every request returned a different random session identifier. This was Opera’s internal proprietary protocol hiding in plain sight on a well-known port — security through obscurity.Port 1080: Closed SOCKScurl --socks5 [TARGET_IP]:1080 http://example.com# Result: curl: (97) connection to proxy closedNot an open proxy. Connection immediately refused. Moving on.Port 8888: Where Things Got InterestingThis is where the real story begins.A simple GET request to port 8888:curl http://[TARGET_IP]:8888/Response:HTTP/1.1 400 Bad RequestServer: Pike v8.0 release 908: HTTP Server moduleDon&#039;t know how to handle request in ext.Immediately interesting. “ext” — an internal Pike module. The server is telling me it has an extension module but doesn’t know how to handle my request. What happens with other HTTP methods?curl -X PUT http://[TARGET_IP]:8888/# Response: &quot;Unhandled method in ext&quot;curl -X DELETE http://[TARGET_IP]:8888/# Response: &quot;Unhandled method in ext&quot;Different error messages for different methods. The server is clearly processing requests through an “ext” module handler. But what about POST?curl -X POST -d &quot;test&quot; http://[TARGET_IP]:8888/I stared at my terminal.Nothing happened.The cursor just… blinked.The Vulnerability Reveals ItselfI waited. Five seconds. Ten seconds. Thirty seconds. A minute.No response.In my experience, this behavior — connection established, data sent, server silent — is almost always significant. Normal servers always respond, even if it’s just an error code. Silence is not normal.I opened a second terminal and ran netstat monitoring:watch -n 2 &quot;netstat -tn | grep [TARGET_IP]:8888&quot;Then sent the POST request again. The netstat output showed:tcp    0    0  MY_IP:44334    TARGET_IP:8888    ESTABLISHEDThe connection was in ESTABLISHED state. The server had accepted my connection, received my data, and… stopped. No response. No timeout. Just open, consuming resources, indefinitely.I set a 300-second timeout to measure exactly how long the server would hold the connection:timeout 300 curl -X POST -d &quot;test&quot; http://[TARGET_IP]:8888/echo $?After exactly 300 seconds, my terminal returned:124Exit code 124. The timeout command killed the process because the server never responded in 300 seconds.This was not normal behavior. This was a vulnerability.Understanding the BugLet me explain what was actually happening technically.When you send an HTTP POST request to a normal server, the following happens:Client → Server: TCP SYNServer → Client: TCP SYN-ACKClient → Server: TCP ACK (handshake complete)Client → Server: HTTP POST dataServer → Client: HTTP Response (200, 400, 500, anything)Connection closes.On this server:Client → Server: TCP SYN ✅Server → Client: TCP SYN-ACK ✅C ]]></description>
        <enclosure url="http://cdn-images-1.medium.com/max/1024/1*zKCBRuXVN524KPSGDjvReg.png" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:40:54 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Found, Denial, Service, Vulnerability, Major, Company’s, Production, Infrastructure, Using, Shodan</media:keywords>
    </item>
    <item>
        <title>TraceBack Box Writeup From HTB DOT EU</title>
        <link>https://cybersecuritytomorrow.com/traceback-box-writeup-from-htb-dot-eu</link>
        <guid>https://cybersecuritytomorrow.com/traceback-box-writeup-from-htb-dot-eu</guid>
        <description><![CDATA[ Looking at the box on HTB rating and graph levels , it looks more of a CTF — Like Box so lets try to crack it :PLets head to start with INFOGATHER as always.1st of Every Penetration Session.INFO GATHERINGstarting with nmap scan as following :sudo nmap -sC -sV -oA nmap/traceback 10.10.10.181two ports are open from the results 22 SSH 80 APACHEThe nmap results are as follows :PORT STATE SERVICE VERSION22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)| ssh-hostkey: | 2048 96:25:51:8e:6c:83:07:48:ce:11:4b:1f:e5:6d:8a:28 (RSA)| 256 54:bd:46:71:14:bd:b2:42:a1:b6:b0:2d:94:14:3b:0d (ECDSA)|_ 256 4d:c3:f8:52:b8:85:ec:9c:3e:4d:57:2c:4a:82:fd:86 (ED25519)80/tcp open http Apache httpd 2.4.29 ((Ubuntu))|_http-server-header: Apache/2.4.29 (Ubuntu)|_http-title: Help usService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 36.74 seconds```lets try all flag , “all ports” maybe we are missing some ports that are open. Just in case.lets while that is running enumerate the web directory and check the index and headers , etc.looking at the main page we find a scary message :lets see if enumeration work in the next part of this writeup.all ports flag also gave us the same results so no need for it actually2nd Vital Step of Penetration Session is :ENUMERATION AND SCANNINGLets enumerate with dirb this time just because it’s easy.dirb http://10.10.10.181or sudo dirb http://10.10.10.181 -o /home/MrRobot/Documents/Documents/BoxesHACK/Traceback/resultsenumeration.txtlets wait while we wait lets run some tools```dig 10.10.10.181curl 10.10.10.181nothing special.lets move forward  with enumeration results we get two directories  Scanning URL: http://10.10.10.181/ — — + http://10.10.10.181/index.html (CODE:200|SIZE:1113) + http://10.10.10.181/server-status (CODE:403|SIZE:300)nothing special about these results lets try another wordlist ..Lets Scan &gt;&gt;dirb http://10.10.10.181/ /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -o /home/MrRobot/Documents/Documents/BoxesHACK/Traceback/resultsenumLets google the apache ubuntu version.Apache httpd 2.4.29 ((Ubuntu))going back to something i noticed in the source page or the main page lets mention itthere was writting something that gave us a clue about what we are dealing with here which is :so we have to hack the website using the webshell maybe?or get a reverse connection with something similar.Lets research something about thisLets postpone it and use gobuster to try to use another wordlist instead of dirb.gobuster dir -u http://10.10.10.181/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -s 200,204,301,302,307,401 -o /home/MrRobot/Documents/Documents/BoxesHACK/Traceback/enumerationweb.txt3rd Step of the Process isExploitation and Examining With Different tools.lets start.nothing from ZAPlets run Raccoon and see if we can get something….raccoon 10.10.10.181wait for resultsnothing.I guess the standard steps doesn’t work lets try to do some OSINT on the target and try to get something usefulby looking at the main page’s sourcepage again we find something interesting :by googling this sentence we link to a github page with web shells names , first idea came to my mind is make a list of these webshells for enumeration with gobuster.https://github.com/TheBinitGhimire/Web-Shellsby running gobuster against this list , BINGO we can find the one url that will lead us to the target webpagesmevk.phpby entering admin admin as credentials we could guess it easily.we can login inside the main page ]]></description>
        <enclosure url="http://cdn-images-1.medium.com/max/682/1*Ugz4CH9LV18I_GB2G9lMkw.jpeg" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:40:54 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>TraceBack, Box, Writeup, From, HTB, DOT</media:keywords>
    </item>
    <item>
        <title>FBI Warns Russian Hackers Target Signal, WhatsApp in Mass Phishing Attacks</title>
        <link>https://cybersecuritytomorrow.com/fbi-warns-russian-hackers-target-signal-whatsapp-in-mass-phishing-attacks</link>
        <guid>https://cybersecuritytomorrow.com/fbi-warns-russian-hackers-target-signal-whatsapp-in-mass-phishing-attacks</guid>
        <description><![CDATA[ Threat actors affiliated with Russian Intelligence Services are conducting phishing campaigns to compromise commercial messaging applications (CMAs) like WhatsApp and Signal to seize control of accounts belonging to individuals with high intelligence value, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) said Friday.
&quot;The campaign ]]></description>
        <enclosure url="http://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjiMsZnvgdoACYJn8WjDy_Lpvpy1iqvGpj-vb4hYfYTLujLp_5dm8WZKjl64LYwY4-MON0-1k8-F2K3KDu0QG7isYjhaMvre0E0vrqJCSP49r2j374JPbV6WvkTG8lwqwrxquX-3xrReaA3G-NQGvskSnlOtM1XRj1J3MdPuCK9lXC6vf8ZkrCizN6ohcLC/s1600/signal-whatsapp.jpg" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:38:52 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>FBI, Warns, Russian, Hackers, Target, Signal, WhatsApp, Mass, Phishing, Attacks</media:keywords>
    </item>
    <item>
        <title>Oracle Patches Critical CVE&amp;2026&amp;21992 Enabling Unauthenticated RCE in Identity Manager</title>
        <link>https://cybersecuritytomorrow.com/oracle-patches-critical-cve-2026-21992-enabling-unauthenticated-rce-in-identity-manager</link>
        <guid>https://cybersecuritytomorrow.com/oracle-patches-critical-cve-2026-21992-enabling-unauthenticated-rce-in-identity-manager</guid>
        <description><![CDATA[ Oracle has released security updates to address a critical security flaw impacting Identity Manager and Web Services Manager that could be exploited to achieve remote code execution.
The vulnerability, tracked as CVE-2026-21992, carries a CVSS score of 9.8 out of a maximum of 10.0.
&quot;This vulnerability is remotely exploitable without authentication,&quot; Oracle said in an advisory. &quot;If successfully ]]></description>
        <enclosure url="http://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxIh9aqIMPc6elNLcqZwmxGq0BHfA3NS2kkxawAr-H7SzPJKmvc7tXrykcm664TGFkJUIb_BmGpJV0CkEjIxVoRfTCrc8br5bi_TL93Nv_g7J_c9ccucZL4e55lp_zyywwBeAzDIoA1bnI95ELRLCbOyVf0WX0CGgGHLun2uQFKhqeMKf16nBOeJTO7O77/s1600/oracle-flaw-hack.jpg" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:38:52 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Oracle, Patches, Critical, CVE-2026-21992, Enabling, Unauthenticated, RCE, Identity, Manager</media:keywords>
    </item>
    <item>
        <title>CISA Flags Apple, Craft CMS, Laravel Bugs in KEV, Orders Patching by April 3, 2026</title>
        <link>https://cybersecuritytomorrow.com/cisa-flags-apple-craft-cms-laravel-bugs-in-kev-orders-patching-by-april-3-2026</link>
        <guid>https://cybersecuritytomorrow.com/cisa-flags-apple-craft-cms-laravel-bugs-in-kev-orders-patching-by-april-3-2026</guid>
        <description><![CDATA[ The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added five security flaws impacting Apple, Craft CMS, and Laravel Livewire to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch them by April 3, 2026.
The vulnerabilities that have come under exploitation are listed below -

CVE-2025-31277 (CVSS score: 8.8) - A vulnerability in Apple ]]></description>
        <enclosure url="http://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJQDea3eiUAONNSYkmQsjicwXBMSALOAUJi7yPHqOStd9N-KBADSGXjH5zJS66VPyzi7-w5ULK7Ax9qH66_Av9E3xIL8BB7sDKz9d-ZbmlyqeyfKyCUYBb15eOH5_keQQ-RUchVoh7NvguG3Ps8sau8Ik17QNOMVtmTkQEck9gao_1zcLPE8JE_qPvc4Q9/s1600/cisa-kev.jpg" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:38:52 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>CISA, Flags, Apple, Craft, CMS, Laravel, Bugs, KEV, Orders, Patching, April, 2026</media:keywords>
    </item>
    <item>
        <title>Trivy Supply Chain Attack Triggers Self&amp;Spreading CanisterWorm Across 47 npm Packages</title>
        <link>https://cybersecuritytomorrow.com/trivy-supply-chain-attack-triggers-self-spreading-canisterworm-across-47-npm-packages</link>
        <guid>https://cybersecuritytomorrow.com/trivy-supply-chain-attack-triggers-self-spreading-canisterworm-across-47-npm-packages</guid>
        <description><![CDATA[ The threat actors behind the supply chain attack targeting the popular Trivy scanner are suspected to be conducting follow-on attacks that have led to the compromise of a large number of npm packages with a previously undocumented self-propagating worm dubbed CanisterWorm.
The name is a reference to the fact that the malware uses an ICP canister, which refers to tamperproof smart contracts on ]]></description>
        <enclosure url="http://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJqn31IC9aCQ9LMLCLRXgpwsa1gvtzXlYk20-1yRmCMYVM_MwGHedfSgbKl24yaeTx4fqRc4-vscge-d3P6sN8sErQBVGD0kgxMGzV-mDCI1wGFh87BB8me019zcennhvA6xyMHLnH9IKZ-txSWs9OwL5cGbg0X8sx_KZ2tj5A5awErRRRMbdSrw_cXs6a/s1600/npm-malware.jpg" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:38:52 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Trivy, Supply, Chain, Attack, Triggers, Self-Spreading, CanisterWorm, Across, npm, Packages</media:keywords>
    </item>
    <item>
        <title>Trivy Security Scanner GitHub Actions Breached, 75 Tags Hijacked to Steal CI/CD Secrets</title>
        <link>https://cybersecuritytomorrow.com/trivy-security-scanner-github-actions-breached-75-tags-hijacked-to-steal-cicd-secrets</link>
        <guid>https://cybersecuritytomorrow.com/trivy-security-scanner-github-actions-breached-75-tags-hijacked-to-steal-cicd-secrets</guid>
        <description><![CDATA[ Trivy, a popular open-source vulnerability scanner maintained by Aqua Security, was compromised a second time within the span of a month to deliver malware that stole sensitive CI/CD secrets.
The latest incident impacted GitHub Actions &quot;aquasecurity/trivy-action&quot; and &quot;aquasecurity/setup-trivy,&quot; which are used to scan Docker container images for vulnerabilities and set up GitHub Actions workflow ]]></description>
        <enclosure url="http://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgNf7vYlImTCJ7BCjYYEhoFZXTawhHcJJad9cFjQn98oQjaPY9HY6Qgpp6pAyqkq7CNHyVXI9fR8hcyVNlW_knYia3f0BhAlK7fZb2gplznk9v9QCFGKtIbMLTSu-erTslOxZCHd8jkJKXIcCYhK8QkKLuWjG8yxjhPBaEWUDzwY0sUkX5JvhBtzFxyfp_q/s1600/scan.jpg" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:38:52 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Trivy, Security, Scanner, GitHub, Actions, Breached, Tags, Hijacked, Steal, CICD, Secrets</media:keywords>
    </item>
    <item>
        <title>Who is the Kimwolf Botmaster “Dort”?</title>
        <link>https://cybersecuritytomorrow.com/who-is-the-kimwolf-botmaster-dort</link>
        <guid>https://cybersecuritytomorrow.com/who-is-the-kimwolf-botmaster-dort</guid>
        <description><![CDATA[ In early January 2026, KrebsOnSecurity revealed how a security researcher disclosed a vulnerability that was used to assemble Kimwolf, the world&#039;s largest and most disruptive botnet. Since then, the person in control of Kimwolf -- who goes by the handle &quot;Dort&quot; -- has coordinated a barrage of distributed denial-of-service (DDoS), doxing and email flooding attacks against the researcher and this author, and more recently caused a SWAT team to be sent to the researcher&#039;s home. This post examines what is knowable about Dort based on public information. ]]></description>
        <enclosure url="http://krebsonsecurity.com/wp-content/uploads/2026/02/ben-door.png" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:34:56 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Who, the, Kimwolf, Botmaster, “Dort”</media:keywords>
    </item>
    <item>
        <title>How AI Assistants are Moving the Security Goalposts</title>
        <link>https://cybersecuritytomorrow.com/how-ai-assistants-are-moving-the-security-goalposts</link>
        <guid>https://cybersecuritytomorrow.com/how-ai-assistants-are-moving-the-security-goalposts</guid>
        <description><![CDATA[ AI-based assistants or &quot;agents&quot; -- autonomous programs that have access to the user&#039;s computer, files, online services and can automate virtually any task -- are growing in popularity with developers and IT workers. But as so many eyebrow-raising headlines over the past few weeks have shown, these powerful and assertive new tools are rapidly shifting the security priorities for organizations, while blurring the lines between data and code, trusted co-worker and insider threat, ninja hacker and novice code jockey. ]]></description>
        <enclosure url="http://krebsonsecurity.com/wp-content/uploads/2026/03/lethaltrifecta.png" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:34:51 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>How, Assistants, are, Moving, the, Security, Goalposts</media:keywords>
    </item>
    <item>
        <title>Microsoft Patch Tuesday, March 2026 Edition</title>
        <link>https://cybersecuritytomorrow.com/microsoft-patch-tuesday-march-2026-edition</link>
        <guid>https://cybersecuritytomorrow.com/microsoft-patch-tuesday-march-2026-edition</guid>
        <description><![CDATA[ Microsoft Corp. today pushed security updates to fix at least 77 vulnerabilities in its Windows operating systems and other software. There are no pressing &quot;zero-day&quot; flaws this month (compared to February&#039;s five zero-day treat), but as usual some patches may deserve more rapid attention from organizations using Windows. Here are a few highlights from this month&#039;s Patch Tuesday. ]]></description>
        <enclosure url="http://krebsonsecurity.com/wp-content/uploads/2026/03/winupdatechecking.png" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:34:46 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Microsoft, Patch, Tuesday, March, 2026, Edition</media:keywords>
    </item>
    <item>
        <title>Iran&amp;Backed Hackers Claim Wiper Attack on Medtech Firm Stryker</title>
        <link>https://cybersecuritytomorrow.com/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker</link>
        <guid>https://cybersecuritytomorrow.com/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker</guid>
        <description><![CDATA[ A hacktivist group with links to Iran&#039;s intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports out of Ireland, Stryker&#039;s largest hub outside of the United States, said the company sent home more than 5,000 workers there today. Meanwhile, a voicemail message at Stryker&#039;s main U.S. headquarters says the company is currently experiencing a building emergency. ]]></description>
        <enclosure url="http://krebsonsecurity.com/wp-content/uploads/2026/03/handala-stryker.png" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:34:41 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Iran-Backed, Hackers, Claim, Wiper, Attack, Medtech, Firm, Stryker</media:keywords>
    </item>
    <item>
        <title>Feds Disrupt IoT Botnets Behind Huge DDoS Attacks</title>
        <link>https://cybersecuritytomorrow.com/feds-disrupt-iot-botnets-behind-huge-ddos-attacks</link>
        <guid>https://cybersecuritytomorrow.com/feds-disrupt-iot-botnets-behind-huge-ddos-attacks</guid>
        <description><![CDATA[ The U.S. Justice Department joined authorities in Canada and Germany in dismantling the online infrastructure behind four highly disruptive botnets that compromised more than three million hacked Internet of Things (IoT) devices, such as routers and web cameras. The feds say the four botnets -- named Aisuru, Kimwolf, JackSkid and Mossad -- are responsible for a series of recent record-smashing distributed denial-of-service (DDoS) attacks capable of knocking nearly any target offline. ]]></description>
        <enclosure url="http://krebsonsecurity.com/wp-content/uploads/2026/01/ss-botnet.png" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:34:36 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Feds, Disrupt, IoT, Botnets, Behind, Huge, DDoS, Attacks</media:keywords>
    </item>
    <item>
        <title>Patch Now: Oracle&amp;apos;s Fusion Middleware Has Critical RCE Flaw</title>
        <link>https://cybersecuritytomorrow.com/patch-now-oracles-fusion-middleware-has-critical-rce-flaw</link>
        <guid>https://cybersecuritytomorrow.com/patch-now-oracles-fusion-middleware-has-critical-rce-flaw</guid>
        <description><![CDATA[ Attackers can execute arbitrary code without authentication if Oracle&#039;s Identity or Web Services Managers are exposed to the Web. ]]></description>
        <enclosure url="http://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt3966162dd76f69cb/69bd954678da062bb91c2e6a/Oracle-Jerome_Cid-Alamy.jpg" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:33:16 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Patch, Now:, Oracles, Fusion, Middleware, Has, Critical, RCE, Flaw</media:keywords>
    </item>
    <item>
        <title>Cyber OpSec Fail: Beast Gang Exposes Ransomware Server</title>
        <link>https://cybersecuritytomorrow.com/cyber-opsec-fail-beast-gang-exposes-ransomware-server</link>
        <guid>https://cybersecuritytomorrow.com/cyber-opsec-fail-beast-gang-exposes-ransomware-server</guid>
        <description><![CDATA[ Files on a central cloud server used by the ransomware group highlight a systematic, aggressive attack on network backups as a key TTP. ]]></description>
        <enclosure url="http://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt37940faf94d51576/69bd782de800671de0dc9622/beast-masks-at-hungarian-spring-carnival-Zsolt_Biczo-shutterstock.jpg" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:33:16 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Cyber, OpSec, Fail:, Beast, Gang, Exposes, Ransomware, Server</media:keywords>
    </item>
    <item>
        <title>Interlock Ransomware Targets Cisco Enterprise Firewalls</title>
        <link>https://cybersecuritytomorrow.com/interlock-ransomware-targets-cisco-enterprise-firewalls</link>
        <guid>https://cybersecuritytomorrow.com/interlock-ransomware-targets-cisco-enterprise-firewalls</guid>
        <description><![CDATA[ The ransomware gang, known for double-extortion attacks, had access to a critical Cisco firewall vulnerability weeks before it was publicly disclosed. ]]></description>
        <enclosure url="http://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc20a31ce918ced0e/69bc51ca221466202f29a950/Interlocking_Gears_Zoonar_GmbH_Alamy.jpg" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:33:16 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Interlock, Ransomware, Targets, Cisco, Enterprise, Firewalls</media:keywords>
    </item>
    <item>
        <title>AI Conundrum: Why MCP Security Can&amp;apos;t Be Patched Away</title>
        <link>https://cybersecuritytomorrow.com/ai-conundrum-why-mcp-security-cant-be-patched-away</link>
        <guid>https://cybersecuritytomorrow.com/ai-conundrum-why-mcp-security-cant-be-patched-away</guid>
        <description><![CDATA[ RSAC Conference Preview: MCP introduces security risks into LLM environments that are architectural and not easily fixable, researcher says. ]]></description>
        <enclosure url="http://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt1b349661d49e33aa/69bc6456139466076c16011f/mcp_Umut_Hasanoglu_shutterstock.jpg" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:33:16 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Conundrum:, Why, MCP, Security, Cant, Patched, Away</media:keywords>
    </item>
    <item>
        <title>With Government&amp;apos;s Role Uncertain, Businesses Unite to Combat Fraud</title>
        <link>https://cybersecuritytomorrow.com/with-governments-role-uncertain-businesses-unite-to-combat-fraud</link>
        <guid>https://cybersecuritytomorrow.com/with-governments-role-uncertain-businesses-unite-to-combat-fraud</guid>
        <description><![CDATA[ Major industry leaders agree to share information and collaborate to boost defenses in the wake of distressing online scams. ]]></description>
        <enclosure url="http://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt852374154dc9b41e/680964f6901a150e471ede06/Cyber_fraud_(1800)_Olekcii_Mach_Alamy.jpg" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:33:16 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>With, Governments, Role, Uncertain, Businesses, Unite, Combat, Fraud</media:keywords>
    </item>
    <item>
        <title>South Korean Police Accidentally Post Cryptocurrency Wallet Password</title>
        <link>https://cybersecuritytomorrow.com/south-korean-police-accidentally-post-cryptocurrency-wallet-password</link>
        <guid>https://cybersecuritytomorrow.com/south-korean-police-accidentally-post-cryptocurrency-wallet-password</guid>
        <description><![CDATA[ An expensive mistake:

Someone jumped at the opportunity to steal $4.4 million in crypto assets after South Korea’s National Tax Service exposed publicly the mnemonic recovery phrase of a seized cryptocurrency wallet.
The funds were stored in a Ledger cold wallet seized in law enforcement raids at 124 high-value tax evaders that resulted in confiscating digital assets worth 8.1 billion won (currently approximately $5.6 million).
When announcing the success of the operation, the agency released photos of a Ledger device, a popular hardware wallet for crypto storage and management... ]]></description>
        <enclosure url="http://www.schneier.com/wp-content/uploads/2019/10/rss-32px.png" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:33:14 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>South, Korean, Police, Accidentally, Post, Cryptocurrency, Wallet, Password</media:keywords>
    </item>
    <item>
        <title>Meta’s AI Glasses and Privacy</title>
        <link>https://cybersecuritytomorrow.com/metas-ai-glasses-and-privacy</link>
        <guid>https://cybersecuritytomorrow.com/metas-ai-glasses-and-privacy</guid>
        <description><![CDATA[ Surprising no one, Meta’s new AI glasses are a privacy disaster.
I’m not sure what can be done here. This is a technology that will exist, whether we like it or not.
Meanwhile, there is a new Android app that detects when there are smart glasses nearby. ]]></description>
        <enclosure url="http://www.schneier.com/wp-content/uploads/2019/10/rss-32px.png" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:33:13 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Meta’s, Glasses, and, Privacy</media:keywords>
    </item>
    <item>
        <title>Hacking a Robot Vacuum</title>
        <link>https://cybersecuritytomorrow.com/hacking-a-robot-vacuum</link>
        <guid>https://cybersecuritytomorrow.com/hacking-a-robot-vacuum</guid>
        <description><![CDATA[ Someone tries to remote control his own DJI Romo vacuum, and ends up controlling 7,000 of them from all around the world.
The IoT is horribly insecure, but we already knew that. ]]></description>
        <enclosure url="http://www.schneier.com/wp-content/uploads/2019/10/rss-32px.png" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:33:11 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Hacking, Robot, Vacuum</media:keywords>
    </item>
    <item>
        <title>Proton Mail Shared User Information with the Police</title>
        <link>https://cybersecuritytomorrow.com/proton-mail-shared-user-information-with-the-police</link>
        <guid>https://cybersecuritytomorrow.com/proton-mail-shared-user-information-with-the-police</guid>
        <description><![CDATA[ 404 Media has a story about Proton Mail giving subscriber data to the Swiss government, who passed the information to the FBI.
It’s metadata—payment information related to a particular account—but still important knowledge. This sort of thing happens, even to privacy-centric companies like Proton Mail. ]]></description>
        <enclosure url="http://www.schneier.com/wp-content/uploads/2019/10/rss-32px.png" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:33:10 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Proton, Mail, Shared, User, Information, with, the, Police</media:keywords>
    </item>
    <item>
        <title>Friday Squid Blogging: Jumbo Flying Squid in the South Pacific</title>
        <link>https://cybersecuritytomorrow.com/friday-squid-blogging-jumbo-flying-squid-in-the-south-pacific</link>
        <guid>https://cybersecuritytomorrow.com/friday-squid-blogging-jumbo-flying-squid-in-the-south-pacific</guid>
        <description><![CDATA[ The population needs better conservation.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Blog moderation policy. ]]></description>
        <enclosure url="http://www.schneier.com/wp-content/uploads/2019/10/rss-32px.png" length="49398" type="image/jpeg"/>
        <pubDate>Sun, 22 Mar 2026 15:33:09 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Friday, Squid, Blogging:, Jumbo, Flying, Squid, the, South, Pacific</media:keywords>
    </item>
    <item>
        <title>Upcoming Speaking Engagements</title>
        <link>https://cybersecuritytomorrow.com/upcoming-speaking-engagements</link>
        <guid>https://cybersecuritytomorrow.com/upcoming-speaking-engagements</guid>
        <description><![CDATA[ This is a current list of where and when I am scheduled to speak:

I’m giving an online talk on AI and trust for the Weizenbaum Institute on April 24, 2025 at 2:00 PM CEST (8:00 AM ET).

The list is maintained on this page.
  ]]></description>
        <enclosure url="http://cybersecuritytomorrow.com" length="4096" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:11:19 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Upcoming, Speaking, Engagements</media:keywords>
    </item>
    <item>
        <title>Slopsquatting</title>
        <link>https://cybersecuritytomorrow.com/slopsquatting</link>
        <guid>https://cybersecuritytomorrow.com/slopsquatting</guid>
        <description><![CDATA[ As AI coding assistants invent nonexistent software libraries to download and use, enterprising attackers create and upload libraries with those names—laced with malware, of course. ]]></description>
        <enclosure url="http://cybersecuritytomorrow.com" length="4096" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:11:18 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Slopsquatting</media:keywords>
    </item>
    <item>
        <title>CVE Program Almost Unfunded</title>
        <link>https://cybersecuritytomorrow.com/cve-program-almost-unfunded</link>
        <guid>https://cybersecuritytomorrow.com/cve-program-almost-unfunded</guid>
        <description><![CDATA[ Mitre’s CVE’s program—which provides common naming and other informational resources about cybersecurity vulnerabilities—was about to be cancelled, as the US Department of Homeland Security failed to renew the contact. It was funded for eleven more months at the last minute.
This is a big deal. The CVE program is one of those pieces of common infrastructure that everyone benefits from. Losing it will bring us back to a world where there’s no single way to talk about vulnerabilities. It’s kind of crazy to think that the US government might damage its own security in this way—but I suppose no crazier than any of the other ways the US is working against its own interests right now... ]]></description>
        <enclosure url="http://cybersecuritytomorrow.com" length="4096" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:11:16 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>CVE, Program, Almost, Unfunded</media:keywords>
    </item>
    <item>
        <title>Age Verification Using Facial Scans</title>
        <link>https://cybersecuritytomorrow.com/age-verification-using-facial-scans</link>
        <guid>https://cybersecuritytomorrow.com/age-verification-using-facial-scans</guid>
        <description><![CDATA[ Discord is  testing the feature:
“We’re currently running tests in select regions to age-gate access to certain spaces or user settings,” a spokesperson for Discord said in a statement. “The information shared to power the age verification method is only used for the one-time age verification process and is not stored by Discord or our vendor. For Face Scan, the solution our vendor uses operates on-device, which means there is no collection of any biometric information when you scan your face. For ID verification, the scan of your ID is deleted upon verification.”... ]]></description>
        <enclosure url="http://cybersecuritytomorrow.com" length="4096" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:11:15 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Age, Verification, Using, Facial, Scans</media:keywords>
    </item>
    <item>
        <title>Friday Squid Blogging: Live Colossal Squid Filmed</title>
        <link>https://cybersecuritytomorrow.com/friday-squid-blogging-live-colossal-squid-filmed</link>
        <guid>https://cybersecuritytomorrow.com/friday-squid-blogging-live-colossal-squid-filmed</guid>
        <description><![CDATA[ A live colossal squid was filmed for the first time in the ocean. It’s only a juvenile: a foot long.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. ]]></description>
        <enclosure url="http://cybersecuritytomorrow.com" length="4096" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:11:13 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Friday, Squid, Blogging:, Live, Colossal, Squid, Filmed</media:keywords>
    </item>
    <item>
        <title>AWWA Supports Introduction of Collaborative Cybersecurity Legislation</title>
        <link>https://cybersecuritytomorrow.com/awwa-supports-introduction-of-collaborative-cybersecurity-legislation</link>
        <guid>https://cybersecuritytomorrow.com/awwa-supports-introduction-of-collaborative-cybersecurity-legislation</guid>
        <description><![CDATA[  ]]></description>
        <enclosure url="http://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt850556f866500627/654a5a8e05eb4d040a046894/325351_DR23_Graphics_General_Large_Text_v1.png" length="49398" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:10:51 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>AWWA, Supports, Introduction, Collaborative, Cybersecurity, Legislation</media:keywords>
    </item>
    <item>
        <title>Could Ransomware Survive Without Cryptocurrency?</title>
        <link>https://cybersecuritytomorrow.com/could-ransomware-survive-without-cryptocurrency</link>
        <guid>https://cybersecuritytomorrow.com/could-ransomware-survive-without-cryptocurrency</guid>
        <description><![CDATA[ Threat actors would be at least temporarily derailed, experts say. But the real issue ladders back to organizations’ weak cyber hygiene. ]]></description>
        <enclosure url="http://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt121d9e06e00992e3/66e1a2cd23ab25574e44ad14/Ransomware(1800)_Andreas_Prott_Alamy.jpg" length="49398" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:10:51 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Could, Ransomware, Survive, Without, Cryptocurrency</media:keywords>
    </item>
    <item>
        <title>Organizations Fix Less Than Half of All Exploitable Vulnerabilities, With Just 21% of GenAI App Flaws Resolved</title>
        <link>https://cybersecuritytomorrow.com/organizations-fix-less-than-half-of-all-exploitable-vulnerabilities-with-just-21-of-genai-app-flaws-resolved</link>
        <guid>https://cybersecuritytomorrow.com/organizations-fix-less-than-half-of-all-exploitable-vulnerabilities-with-just-21-of-genai-app-flaws-resolved</guid>
        <description><![CDATA[  ]]></description>
        <enclosure url="http://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt850556f866500627/654a5a8e05eb4d040a046894/325351_DR23_Graphics_General_Large_Text_v1.png" length="49398" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:10:51 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Organizations, Fix, Less, Than, Half, All, Exploitable, Vulnerabilities, With, Just, 21, GenAI, App, Flaws, Resolved</media:keywords>
    </item>
    <item>
        <title>Attackers and Defenders Lean on AI in Identity Fraud Battle</title>
        <link>https://cybersecuritytomorrow.com/attackers-and-defenders-lean-on-ai-in-identity-fraud-battle</link>
        <guid>https://cybersecuritytomorrow.com/attackers-and-defenders-lean-on-ai-in-identity-fraud-battle</guid>
        <description><![CDATA[ Identity verification, insurance claims, and financial services are all seeing surges in AI-enabled fraud, but organizations are taking advantage of AI systems to fight fire with fire. ]]></description>
        <enclosure url="http://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltad54be6b01576633/67ffbc8f590d24262f8594d5/fingerprint-identity-verification-ART_STOCK_CREATIVE-shutterstock.jpg" length="49398" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:10:51 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Attackers, and, Defenders, Lean, Identity, Fraud, Battle</media:keywords>
    </item>
    <item>
        <title>Chinese APT Mustang Panda Debuts 4 New Attack Tools</title>
        <link>https://cybersecuritytomorrow.com/chinese-apt-mustang-panda-debuts-4-new-attack-tools</link>
        <guid>https://cybersecuritytomorrow.com/chinese-apt-mustang-panda-debuts-4-new-attack-tools</guid>
        <description><![CDATA[ The notorious nation-state-backed threat actor has added two new keyloggers, a lateral movement tool, and an endpoint detection and response (EDR) evasion driver to its arsenal. ]]></description>
        <enclosure url="http://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt61e68617764cdb10/680277d35ded1a8c1efc56d7/Mustang_Panda-Dan_Herrick-Alamy.jpg" length="49398" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:10:51 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Chinese, APT, Mustang, Panda, Debuts, New, Attack, Tools</media:keywords>
    </item>
    <item>
        <title>CISA Calls For Action to Close the Software Understanding Gap</title>
        <link>https://cybersecuritytomorrow.com/cisa-calls-for-action-to-close-the-software-understanding-gap</link>
        <guid>https://cybersecuritytomorrow.com/cisa-calls-for-action-to-close-the-software-understanding-gap</guid>
        <description><![CDATA[  ]]></description>
        <enclosure url="http://cybersecuritytomorrow.com" length="4096" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:10:00 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>CISA, Calls, For, Action, Close, the, Software, Understanding, Gap</media:keywords>
    </item>
    <item>
        <title>Statement on CISA&amp;apos;s Red Team</title>
        <link>https://cybersecuritytomorrow.com/statement-on-cisas-red-team</link>
        <guid>https://cybersecuritytomorrow.com/statement-on-cisas-red-team</guid>
        <description><![CDATA[  ]]></description>
        <enclosure url="http://cybersecuritytomorrow.com" length="4096" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:09:59 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Statement, CISAs, Red, Team</media:keywords>
    </item>
    <item>
        <title>CISA Probationary Reinstatements</title>
        <link>https://cybersecuritytomorrow.com/cisa-probationary-reinstatements</link>
        <guid>https://cybersecuritytomorrow.com/cisa-probationary-reinstatements</guid>
        <description><![CDATA[  ]]></description>
        <enclosure url="http://cybersecuritytomorrow.com" length="4096" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:09:58 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>CISA, Probationary, Reinstatements</media:keywords>
    </item>
    <item>
        <title>CISA and Partners Issue Fast Flux Cybersecurity Advisory</title>
        <link>https://cybersecuritytomorrow.com/cisa-and-partners-issue-fast-flux-cybersecurity-advisory</link>
        <guid>https://cybersecuritytomorrow.com/cisa-and-partners-issue-fast-flux-cybersecurity-advisory</guid>
        <description><![CDATA[  ]]></description>
        <enclosure url="http://cybersecuritytomorrow.com" length="4096" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:09:56 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>CISA, and, Partners, Issue, Fast, Flux, Cybersecurity, Advisory</media:keywords>
    </item>
    <item>
        <title>CISA Statement on CVE Program</title>
        <link>https://cybersecuritytomorrow.com/cisa-statement-on-cve-program</link>
        <guid>https://cybersecuritytomorrow.com/cisa-statement-on-cve-program</guid>
        <description><![CDATA[  ]]></description>
        <enclosure url="http://cybersecuritytomorrow.com" length="4096" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:09:55 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>CISA, Statement, CVE, Program</media:keywords>
    </item>
    <item>
        <title>Burp Everywhere, All Around the World: Bringing AppSec Enthusiasts Together in 2025</title>
        <link>https://cybersecuritytomorrow.com/burp-everywhere-all-around-the-world-bringing-appsec-enthusiasts-together-in-2025</link>
        <guid>https://cybersecuritytomorrow.com/burp-everywhere-all-around-the-world-bringing-appsec-enthusiasts-together-in-2025</guid>
        <description><![CDATA[ Security is a team sport. Whether you&#039;re a pentester, bug bounty hunter, student, or just love breaking (and fixing) things, our field thrives on shared knowledge, collaboration, and support. We want ]]></description>
        <enclosure url="http://portswigger.net/content/images/logos/portswigger-twittercardlogo.png" length="49398" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:09:29 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Burp, Everywhere, All, Around, the, World:, Bringing, AppSec, Enthusiasts, Together, 2025</media:keywords>
    </item>
    <item>
        <title>Welcome to the next generation of Burp Suite: elevate your testing with Burp AI</title>
        <link>https://cybersecuritytomorrow.com/welcome-to-the-next-generation-of-burp-suite-elevate-your-testing-with-burp-ai</link>
        <guid>https://cybersecuritytomorrow.com/welcome-to-the-next-generation-of-burp-suite-elevate-your-testing-with-burp-ai</guid>
        <description><![CDATA[ At PortSwigger, we believe AI has the power to transform penetration testing - not by replacing human testers, but by augmenting them. With the release of Burp Suite Professional 2025.2, we’re introdu ]]></description>
        <enclosure url="http://portswigger.net/content/images/logos/portswigger-twittercardlogo.png" length="49398" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:09:28 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Welcome, the, next, generation, Burp, Suite:, elevate, your, testing, with, Burp</media:keywords>
    </item>
    <item>
        <title>You asked, we answered: Q&amp;amp;amp;A from The Future of AppSec webinar</title>
        <link>https://cybersecuritytomorrow.com/you-asked-we-answered-qa-from-the-future-of-appsec-webinar</link>
        <guid>https://cybersecuritytomorrow.com/you-asked-we-answered-qa-from-the-future-of-appsec-webinar</guid>
        <description><![CDATA[ When we wrapped up our biggest-ever webinar, The Future of AppSec: PortSwigger’s Vision, the conversation was far from over. With thousands of security professionals tuning in live, the questions came ]]></description>
        <enclosure url="http://portswigger.net/cms/images/5b/c1/e445-twittercard-future_of_app_sec_1x1.png" length="49398" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:09:27 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>You, asked, answered:, Q&amp;ampA, from, The, Future, AppSec, webinar</media:keywords>
    </item>
    <item>
        <title>The Future of Application Security: key insights from the webinar</title>
        <link>https://cybersecuritytomorrow.com/the-future-of-application-security-key-insights-from-the-webinar</link>
        <guid>https://cybersecuritytomorrow.com/the-future-of-application-security-key-insights-from-the-webinar</guid>
        <description><![CDATA[ PortSwigger&#039;s Vision In March, PortSwigger hosted its biggest webinar to date and the turnout spoke volumes. With over 7,500 registrants, it’s clear that the future of application security is top of m ]]></description>
        <enclosure url="http://portswigger.net/cms/images/ec/1b/049c-twittercard-burp_q1_2025_webinar_-_march_2025_(9).png" length="49398" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:09:27 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>The, Future, Application, Security:, key, insights, from, the, webinar</media:keywords>
    </item>
    <item>
        <title>Meet Burp Suite DAST: A clearer name for the industry&amp;apos;s leading DAST solution</title>
        <link>https://cybersecuritytomorrow.com/meet-burp-suite-dast-a-clearer-name-for-the-industrys-leading-dast-solution</link>
        <guid>https://cybersecuritytomorrow.com/meet-burp-suite-dast-a-clearer-name-for-the-industrys-leading-dast-solution</guid>
        <description><![CDATA[ Burp Suite Enterprise Edition has a new name: Burp Suite DAST. This new name better reflects what the product truly is: the most accurate, scalable solution for automated dynamic application security ]]></description>
        <enclosure url="http://portswigger.net/cms/images/7a/47/1e3e-twittercard-dast_1x1.png" length="49398" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:09:26 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Meet, Burp, Suite, DAST:, clearer, name, for, the, industrys, leading, DAST, solution</media:keywords>
    </item>
    <item>
        <title>Obfuscation Isn’t a Fix, And It Cost Them $2,500 — A Real&amp;World Case Study</title>
        <link>https://cybersecuritytomorrow.com/obfuscation-isnt-a-fix-and-it-cost-them-2500a-real-world-case-study</link>
        <guid>https://cybersecuritytomorrow.com/obfuscation-isnt-a-fix-and-it-cost-them-2500a-real-world-case-study</guid>
        <description><![CDATA[ Obfuscation Isn’t a Fix, And It Cost Them $2,500 — A Real-World Case StudyChallenge AcceptedA while ago, I performed a penetration test on a major web application owned by one of my clients. During the assessment, I identified several critical vulnerabilities. Although these flaws weren’t easy to find — they required in-depth analysis and carefully crafted requests — they posed a serious risk to the platform’s integrity and user data.Given the severity of the findings, I expected the development and management teams to prioritize proper remediation. But instead, they chose a different path.Rather than fixing the underlying security issues, they decided to encrypt the entire body of each HTTP request— for example, encrypting login credentials or parameter values — in an attempt to prevent attackers from understanding or reproducing the vulnerabilities.Their idea was to “hide” the vulnerabilities behind encrypted traffic, giving them six months to work on actual fixes. In theory, this would slow down any attacker trying to identify or exploit the issues.I explained why this approach wouldn’t hold. Obscuring insecure functionality doesn’t make it secure — it just shifts the problem and adds complexity without eliminating the risk. I even challenged them: if I could still exploit the vulnerabilities despite the encrypted requests, they would pay me an additional $2,500.Spoiler: they did.Let’s walk through the scenario, why encryption is not a substitute for proper remediation, and what this taught both sides about the real cost of avoiding fixes.The first request is a POST request, in which data is sent encrypted within the HashData parameter. However, after decryption, the data appears to be unreadable.Encrypted RequestEncrypted ResponseUpon inspecting the JavaScript bundle (main.xxxxxxx.chunk.js), I identified a function named HashData, which was responsible for encrypting request data. This function was used in two key places, but only one of them leveraged a request interceptor pattern, which allowed injection or modification of outgoing payloads before being sent.HashData Function Used In First PlaceHashData Function Used In Second PlaceIn this case (Second Place), the developer has used an interceptor method for the request in order to apply modifications. We use a breakpoint to sniff and analyze it.Analyze HashData FunctionDespite the code being minified, I was able to use online tools to beautify it and analyze the logic.HashData FunctionThe encryption process involved the following:A random 256-bit key was generated for each request using a function like random().The request body was encrypted using AES, with this random key as the encryption key.The random key itself was then encrypted using a static RSA public key and attached to the request.The encrypted data was finally Base64-encoded and stored or transmitted (sometimes via localStorage or directly in the request).The AES encryption function is defined as follows:function s(e, t) {var n = t.toString();return r.a.AES.encrypt(JSON.stringify(e), n).toString()}e is the input data that gets converted to JSON and then encrypted.t is the encryption key.The function returns the encrypted result as a string (i.e., the server response).Here’s a simplified version of the AES encryption logic:function encrypt(data, key) {    return CryptoJS.AES.encrypt(JSON.stringify(data), key.toString()).toString();}The AES decryption function is defined as:function u(e, t) {    if (void 0 !== e) {        var n = r.a.AES.decrypt(e.toString(), t).toString(r.a.enc.Utf8);        return JSON.parse(JSON.parse(n).data)    }}e is the encrypted data.t is the encryption key.The decrypted result is parsed from JSON and returned as the original data.Here’s a simplified version of the AES decryption logic:function decrypt(encryptedData, key) {    const decrypted = CryptoJS.AES.decrypt(encryptedData.toString(), key).toString(CryptoJS.enc.Utf8);    return JSON.parse(JSON.parse(decrypted).data);}This means that the payload encryption relied entirely on a client-generated key — which I could capture at runtime using browser breakpoints — and a public RSA key for wrapping that AES key.On the server side, the process was reversed:The encrypted AES key was decrypted using the server’s RSA private key.That AES key was then used to decrypt the actual request body.The server-side implementation accepted requests with a validity window of around 30 seconds to prevent replay attacks. However, this still wasn’t enough to stop me.The 32-byte random array is stored across 8 stack slotse is encryption dataNow we need to simulate the encryption and decryption code (there’s no need to know the server-side private key). That means:If the unique code var n = t.toString(); appears in the response body, we log it as an encryption request.For decryption, if the unique code var n = r.a.AES.decrypt(e.toString(), t).toString(r.a.enc.Utf8); appears in the response body, we print the server’s response.Below, you  ]]></description>
        <enclosure url="http://miro.medium.com/v2/resize:fit:1200/1*_XKOWFHy83hP9B5ilqo72A.png" length="49398" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:08:17 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Obfuscation, Isn’t, Fix, And, Cost, Them, 2, 500 — A, Real-World, Case, Study</media:keywords>
    </item>
    <item>
        <title>TryHackMe: Pickle Rick Walkthrough</title>
        <link>https://cybersecuritytomorrow.com/tryhackme-pickle-rick-walkthrough</link>
        <guid>https://cybersecuritytomorrow.com/tryhackme-pickle-rick-walkthrough</guid>
        <description><![CDATA[ “Because science, Morty.”Continue reading on InfoSec Write-ups » ]]></description>
        <enclosure url="http://miro.medium.com/v2/resize:fit:1200/1*7eOieeiCee9HgQrIszR8Sg.jpeg" length="49398" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:08:16 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>TryHackMe:, Pickle, Rick, Walkthrough</media:keywords>
    </item>
    <item>
        <title>Your NTLM Hashes at Risk: Inside CVE‑2025‑24054</title>
        <link>https://cybersecuritytomorrow.com/your-ntlm-hashes-at-risk-inside-cve202524054</link>
        <guid>https://cybersecuritytomorrow.com/your-ntlm-hashes-at-risk-inside-cve202524054</guid>
        <description><![CDATA[ NTLM (New Technology LAN Manager) is Microsoft’s legacy authentication suite, still found in many enterprise environments. NTLMv2 improves…Continue reading on InfoSec Write-ups » ]]></description>
        <enclosure url="http://miro.medium.com/v2/da:true/resize:fit:1200/0*5_Tsl8mIoMDYNXhu" length="49398" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:08:15 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Your, NTLM, Hashes, Risk:, Inside, CVE‑2025‑24054</media:keywords>
    </item>
    <item>
        <title>Burp Suite Beyond Basics: Hidden Features That Save Time and Find More Bugs</title>
        <link>https://cybersecuritytomorrow.com/burp-suite-beyond-basics-hidden-features-that-save-time-and-find-more-bugs</link>
        <guid>https://cybersecuritytomorrow.com/burp-suite-beyond-basics-hidden-features-that-save-time-and-find-more-bugs</guid>
        <description><![CDATA[ ????Free Article LinkContinue reading on InfoSec Write-ups » ]]></description>
        <enclosure url="http://miro.medium.com/v2/resize:fit:1200/1*Hr3ycIliCfyglthzeKkuJw.jpeg" length="49398" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:08:14 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>Burp, Suite, Beyond, Basics:, Hidden, Features, That, Save, Time, and, Find, More, Bugs</media:keywords>
    </item>
    <item>
        <title>The Ultimate Guide to WAF Bypass Using SQLMap, Proxychains &amp;amp; Tamper Scripts</title>
        <link>https://cybersecuritytomorrow.com/the-ultimate-guide-to-waf-bypass-using-sqlmap-proxychains-tamper-scripts</link>
        <guid>https://cybersecuritytomorrow.com/the-ultimate-guide-to-waf-bypass-using-sqlmap-proxychains-tamper-scripts</guid>
        <description><![CDATA[ Mastering Advanced SQLMap Techniques with Proxychains and tamper scripts Against Cloudflare and ModSecurityContinue reading on InfoSec Write-ups » ]]></description>
        <enclosure url="http://miro.medium.com/v2/resize:fit:1200/1*R1yLRvHPAT-ikersHSkKGQ.png" length="49398" type="image/jpeg"/>
        <pubDate>Sat, 19 Apr 2025 16:08:12 -0400</pubDate>
        <dc:creator>Darpan Neupane</dc:creator>
        <media:keywords>The, Ultimate, Guide, WAF, Bypass, Using, SQLMap, Proxychains, Tamper, Scripts</media:keywords>
    </item>
    </channel>
</rss>