News · r/blueteamsec

• 
  r/blueteamsec 18 Oct

  firmware-reverse-engineering: A full claude, droid and codex skillsets for firmware reverse engineering.

  r/blueteamsec · github.com
• 
  r/blueteamsec 18 Oct

  OAuth2 SSRF vulnerability in SAP Cloud SDK for Python

  r/blueteamsec · github.com
• r/blueteamsec 18 Oct

  The eBPF forensics gap and what your EDR cannot see

  r/blueteamsec · andreafortuna.org
• 
  r/blueteamsec 18 Oct

  TAG-193’s Regional Espionage Operations

  r/blueteamsec · recordedfuture.com
• 
  r/blueteamsec 18 Oct

  Package managers have an integrity problem

  r/blueteamsec · blog.trailofbits.com
• 
  r/blueteamsec 18 Oct

  Submit and Execute: Weaponizing Reflected XSS in Siemens Teamcenter's Login Redirect (CVE-2026-58113)

  r/blueteamsec · bishopfox.com

  CVE-2026-58113
• 
  r/blueteamsec 18 Oct

  Poisoned Vector: JADEPUFFER and Using Unauthenticated Chroma Databases for Retrieval Extortion

  r/blueteamsec · upguard.com
• 
  r/blueteamsec 18 Oct

  Frostbitten in France: A Danfoss StoreView Internet Exposure Report

  r/blueteamsec · censys.com
• r/blueteamsec 18 Oct

  SRE-Bench: A realistic, contamination-free benchmark for agentic reverse engineering.

  r/blueteamsec · sre-bench.lol
• 
  r/blueteamsec 18 Oct

  skynox7: Proxyjacking Edge Devices Into Residential Proxies

  r/blueteamsec · greynoise.io
• 
  r/blueteamsec 18 Oct

  More Critical Bugs in Adobe Experience Manager: Pre-Auth RCE

  r/blueteamsec · slcyber.io
• 
  r/blueteamsec 18 Oct

  連続不正アクセス事案の攻撃手法に関する調査 - Investigation into attack methods in serial unauthorized access cases

  r/blueteamsec · blogs.jpcert.or.jp
• r/blueteamsec 18 Oct

  Cybersecurity Incident Disrupting Bankruptcy Court Operations

  r/blueteamsec · uscourts.gov
• 
  r/blueteamsec 18 Oct

  Keystrokes in Disguise: Forensic Analysis of a Digispark HID Device

  r/blueteamsec · blog.nviso.eu
• 
  r/blueteamsec 18 Oct

  Chinese State-Linked Hackers Target US Critical Infrastructure with Automated Scanning and Cyber Espionage Tools

  r/blueteamsec · blog.polyswarm.io
• 
  r/blueteamsec 18 Oct

  ScreenConnect RMM Abuse: The Cloud Client Gets In, The Self-Hosted One Stays

  r/blueteamsec · newsletter.securityinbits.com
• 
  r/blueteamsec 18 Oct

  BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849)

  r/blueteamsec · sansec.io

  CVE-2026-103849
• r/blueteamsec 18 Oct

  Two Hawks in a Pod: one Android RAT behind a flock of fake Japanese brands

  r/blueteamsec · starlabs.sg
• 
  r/blueteamsec 18 Oct

  Investigation: Unauthorized Access Through the ConnectWise Cloud Backup Microsoft 365 App

  r/blueteamsec · todyl.com
• 
  r/blueteamsec 18 Oct

  Reversing embedded WebAssembly: part 2. Recovering function names from a WAMR .aot in pure C.

  r/blueteamsec · cocomelonc.github.io
• 
  r/blueteamsec 18 Oct

  Reversing embedded WebAssembly: part 1. Cracking the WAMR .aot container in pure C.

  r/blueteamsec · cocomelonc.github.io
• 
  r/blueteamsec 18 Oct

  broadcom-wps: Tools to fingerprint WiFi Access Points running the Broadcom SDK and a list of known affected devices.

  r/blueteamsec · github.com
• 
  r/blueteamsec 18 Oct

  ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant

  r/blueteamsec · specterops.io
• 
  r/blueteamsec 18 Oct

  Frozen Privilege: Remote Code Execution in Snowflake-Managed PostgreSQL

  r/blueteamsec · varonis.com
• 
  r/blueteamsec 18 Oct

  m365-xdr-cli: xdr lets a SOC analyst — or an AI agent working on their behalf — triage incidents, run advanced hunting, and take response actions in Microsoft Defender XDR from a terminal.

  r/blueteamsec · github.com
• 
  r/blueteamsec 18 Oct

  cuban-eight: Cuban Eight is a red team tool that packages a Windows PE payload into a .wsl file spoofing a real Linux distro installer. Double-click to deploy.

  r/blueteamsec · github.com
• 
  r/blueteamsec 18 Oct

  TornadoC2: Pull-based C2 framework with ten native transports, concurrent multi-profile handlers, and end-to-end ECDSA-signed tasking. Single Go binary agent with every property baked in at build time. Multi-operator team server with RBAC, audit chain

  r/blueteamsec · github.com
• 
  r/blueteamsec 18 Oct

  DLL Sideloading for Initial Access and Bypassing Elastic EDR

  r/blueteamsec · akchhat.gitbook.io
• r/blueteamsec 18 Oct

  CloudKeyVaultEvents: Azure Key Vault Logs, Schema and KQL Hunting

  r/blueteamsec · kqlquery.com
• 
  r/blueteamsec 18 Oct

  ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks

  r/blueteamsec · huntress.com
• 
  r/blueteamsec 18 Oct

  We are continuing our investigation and remediation following unauthorized access to application identities associated with ConnectWise Cloud Backup, formerly known as SkyKick.

  r/blueteamsec · connectwise.com
• 
  r/blueteamsec 18 Oct

  LLM-operated Windows Malware With MCP, Skills And Living-off-the-AI

  r/blueteamsec · github.com
• 
  r/blueteamsec 18 Oct

  Konni C2

  r/blueteamsec · pastes.io
• 
  r/blueteamsec 18 Oct

  OmniIDB: Batch reverse engineering and IDA database enrichment using AI.

  r/blueteamsec · github.com
• 
  r/blueteamsec 18 Oct

  MALFEX Moves Its npm Loader into a Native Windows DLL

  r/blueteamsec · safedep.io
• 
  r/blueteamsec 18 Oct

  Setting up a WireGuard VPN

  r/blueteamsec · gitlab.com
• 
  r/blueteamsec 18 Oct

  Investigating Ephemeral Supply Chain Tampering

  r/blueteamsec · cloud.google.com
• 
  r/blueteamsec 18 Oct

  PhantomBuffer: Effective EDR Evasion Through Stealth Injection

  r/blueteamsec · zerosalarium.com
• r/blueteamsec 17 Oct

  Public Security Disclosure: Verified Vulnerabilities in Cline Extension

  r/blueteamsec · medium.com
• 
  r/blueteamsec 17 Oct

  We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users

  r/blueteamsec · x.com
• 
  r/blueteamsec 17 Oct

  CTO at NCSC Summary: week ending October 18th

  r/blueteamsec · ctoatncsc.substack.com
• r/blueteamsec 17 Oct

  One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux

  r/blueteamsec · quentinkaiser.be
• 
  r/blueteamsec 17 Oct

  SPACE: Sandboxed Platform for Agentic Code Execution: pluggable-runtime sandboxes for running agent and user code in isolation.

  r/blueteamsec · github.com
• r/blueteamsec 17 Oct

  A Little More Logic in Splunk: Introducing SPL2’s if Command

  r/blueteamsec · detect.fyi
• r/blueteamsec 17 Oct

  Helix Kitten APT Adversary Simulation

  r/blueteamsec · medium.com
• 
  r/blueteamsec 17 Oct

  ReflectivePluginLoader: A reflective PE mapper, module stomping engine, and multi-plugin manager for Windows x64, built around a clean IPlugin ABI.

  r/blueteamsec · github.com
• 
  r/blueteamsec 17 Oct

  MultiRand: Implements insecure, pseudo-random linear congruential generators using parameters of various common rand() implementations.

  r/blueteamsec · github.com
• 
  r/blueteamsec 17 Oct

  esp32-iphone-agent: Let an AI model use a real iPhone with a $7 ESP32: AirPlay eyes, USB HID hands, any OpenAI-compatible vision model. No Mac, no developer account, no jailbreak.

  r/blueteamsec · github.com
• r/blueteamsec 17 Oct

  Audit only eBPF EDR with deep process lineage and native SIEM export (ECS/OCSF)

  Hi r/blueteamsec, I just released an open source eBPF runtime security tool built specifically for SOC teams. I wanted to share the architecture because it solves a problem I kept running into: traditional agents (like Falco) are too heavy (~300MB RAM) for dense K8s clusters or edge devices, and they force you into complex rule languages. Why audit only? This tool does not block syscalls. It's st…
• r/blueteamsec 17 Oct

  Architectural Security Analysis of AI Coding Agents: Verified Findings in Cline Extension

  r/blueteamsec · medium.com

Older