标签：#cyber

Last week, an AI newsroom beat mainstream journalists—including WIRED—to a story about OpenAI and hacking. It’s just the beginning.

Redirect Chain چیست و چطور دامنه‌های جعلی را قبل از ورود شناسایی کنیم؟ وقتی روی یک لینک کلیک می‌کنید، همیشه مستقیماً به همان آدرسی که دیده‌اید منتقل نمی‌شوید. گاهی مرورگر ابتدا یک URL را باز می‌کند، سپس به آدرس دیگری می‌رود و در نهایت صفحه مقصد نمایش داده می‌شود. این فرایند می‌تواند کاملاً عادی باشد، اما زمانی که تعداد ریدایرکت‌ها زیاد شود یا دامنه‌ها بدون دلیل مشخص تغییر کنند، بررسی دقیق‌تر اهمیت پیدا می‌کند. برای ارزیابی یک لینک بهتر است سه موضوع را جداگانه ببینیم: مسیر Redirect، دامنه نهایی و وضعیت HTTPS. Redirect Chain دقیقاً چیست؟ Redirect Chain زمانی ایجاد می‌شود که یک URL قبل از رسیدن به مقصد نهایی، کاربر را از یک یا چند آدرس دیگر عبور دهد. یک مسیر ساده ممکن است به شکل زیر باشد: Page A → Page B → Final Page این ساختار لزوماً مشکل امنیتی نیست. سایت‌ها ممکن است برای تغییر دامنه، اصلاح ساختار URL یا انتقال صفحات قدیمی از Redirect استفاده کنند. اما مسیرهای طولانی‌تر نیاز به توجه بیشتری دارند: Link A → Domain B → Domain C → Unknown Domain D → Final Page در این حالت باید پرسید چرا کاربر میان چند دامنه متفاوت جابه‌جا می‌شود و آیا این دامنه‌ها با منبع اولیه ارتباط قابل فهمی دارند یا خیر. چه زمانی Redirect Chain مشکوک می‌شود؟ تعداد زیاد Redirect به‌تنهایی اثبات‌کننده جعل نیست، اما می‌تواند یکی از نشانه‌هایی باشد که ارزش بررسی بیشتری دارد. مواردی که بهتر است بررسی شوند شامل تغییر ناگهانی نام دامنه، عبور از چند دامنه نامرتبط، انتقال به URLهایی با ساختار عجیب و نمایش صفحه‌ای متفاوت با چیزی است که لینک اولیه وعده داده بود. مسیر مقصد را با متن لینک مقایسه کنید برای مثال اگر متن یک لینک نام یک پروژه مشخص را نشان می‌دهد اما مقصد نهایی دامنه‌ای کاملاً متفاوت است، بهتر است قبل از وارد کردن اطلاعات حساب دلیل این تفاوت مشخص شود. همچنین Short URLها می‌توانند مقصد واقعی را پنهان کنند. استفاده از Shortener به‌خودی‌خود خطرناک نیست، اما کاربر اطلاعات کمتری درباره مقصد اولیه دارد. HTTPS چه چیزی را ثابت می‌کند؟ HTTPS نشان می‌دهد ارتباط میان مرورگر و سرور با استفاده از TLS رمزگذاری می‌شود. این موضوع برای محافظت از داده‌هایی که در مسیر منتقل می‌شوند اهمیت دارد. اما HTTPS یک سوءبرداشت رای

In a new alert, the FBI said cybercriminals are targeting adults and minors in an attempt to steal their personal and intimate pictures in extortion campaigns.

Zoom screen-sharing bug let people fully take over other devices on a call.

The Delta flight crew switched off the aircraft's legitimate Wi-Fi network for around 30 minutes due to the incident, according to a spokesperson.

The investigation shows that North Koreans are able to infiltrate government agencies, as well as private organizations and crypto exchanges.

Researchers say it took fewer than 20 prompts for a public AI tool to find a flaw (now fixed) allowing anyone on a Zoom call to hijack another participants’ device.

Cybersecurity is entering a new phase. This is because security teams are facing more and more complex problems and threats that are moving faster. To help defenders respond more effectively, OpenAI has introduced GPT-5.6-Cyber, a special model designed for advanced cybersecurity tasks. The model supports authorized security research, vulnerability discovery, and other defensive workflows. The Daybreak program is showing how specialized AI tools can improve modern cybersecurity by working together with human security experts. Quick overview GPT-5.6-Cyber is a specialized model for authorized cybersecurity work. It is available through OpenAI’s Daybreak Red access for approved defenders. OpenAI reports a 95% completion rate on its internal advanced cybersecurity evaluation. The model helped researchers uncover vulnerabilities in Chrome’s V8 JavaScript engine. Controlled access, monitoring, and human oversight remain important for safe deployment. What Is GPT-5.6-Cyber? GPT-5.6-Cyber is OpenAI’s cybersecurity-specific model, available through Daybreak Red. Built on GPT-5.6 Sol, it is trained to improve performance on specialized cybersecurity tasks such as finding zero-day vulnerabilities and developing exploit chains, while reducing refusals for certain higher-risk, dual-use cyber tasks. Daybreak has two access tiers: Daybreak Blue provides approved defenders with frontier general-purpose models such as GPT-5.6 Sol, with safeguards tailored to authorized defensive security work. Daybreak Red provides purpose-trained cybersecurity models for authorized vulnerability research, exploit validation, and security testing. This approach reflects a significant shift toward security tools designed for professional cybersecurity environments rather than unrestricted public use. The goal is clear: to help trusted defenders investigate vulnerabilities, analyze potential threats, and respond to security incidents more effectively while keeping access controlled. According to Open

Your smart home is not smart. It is just very, very observant. I did not buy a smart speaker because I wanted a friend. I bought it because it was on sale for $29.99 and it promised to play rain sounds on command. For two years she lived on my kitchen counter. She set timers for pasta. She told me the weather with the aggressive optimism of someone who has never paid rent. She was helpful. She was ambient. She was furniture that could hear. And then one night at 2:17 a.m., she lit up blue for no reason. No wake word. No one speaking. Just a soft, smug blue ring in a dark apartment, listening to an empty room like she was waiting for me to confess something. That is the moment you understand your home is not just connected. It is attentive. And attentiveness without consent is just surveillance with better industrial design. We Carried Them In Ourselves No one kicked down the door. We invited this in. We carried it in from Best Buy, plugged it in, gave it our Wi-Fi password, which is literally the master key to our entire digital life, and whispered, here, learn my routines. We did it because convenience is a drug that hits faster than paranoia. Let's do an inventory of your very normal, very bugged apartment. Your TV watches you back. Modern smart TVs use Automatic Content Recognition. That is a polite, enterprise friendly way of saying your TV takes screenshots of everything you watch every few seconds and sells that ledger to advertisers. You agreed to it on page 47 of a menu you clicked through while trying to watch Love Island. Your robot vacuum maps your floor plan. It knows the square footage of your bedroom, how often you move the couch, and where you drop the most crumbs. That map is stored in the cloud. Your light bulbs log when you are home. Your smart plugs log when you are not. Your doorbell films every human who has ever had the courage to approach your front door, plus every dog walker who did not, and then it stores that footage on a server you do not

A bug in the tech giant's website the logo of US marketing automation company Klaviyo Inc. is seen displayed on a smartphone in front of an abstract background on a computer screen..

AI agents are escaping cybersecurity testing environments and reaching real-world systems, raising questions about whether safety infrastructure, industry standards and regulation can keep pace with increasingly powerful models.

A security researcher has designed an algorithm that can create computer-generated patterns capable of hiding people, faces, and vehicles from detection by surveillance cameras.

You're triaging an alert. Scheduled task, weird parent process, and a command line that looks like this: powershell.exe -nop -w hidden -enc JABjACAAPQAg... You know the drill: grab the Base64 blob, decode it, read the script. So you paste it into a decoder and get back this: $ c = " h t t p : / / ... Garbage. A space (or a null) between every single character. First instinct is that the payload is doubly-encoded or encrypted. It isn't. This is the single most common gotcha with -EncodedCommand , and once you know it, it takes ten seconds to fix. Why it looks garbled powershell.exe -enc (short for -EncodedCommand ) expects Base64 of UTF-16LE (little-endian Unicode) bytes — not UTF-8. That's mandated by PowerShell itself, not a choice the attacker made. In UTF-16LE, every ASCII character is stored as two bytes : the character followed by a 0x00 null byte. So the letter c isn't 0x63 , it's 0x63 0x00 . When you Base64-decode the blob and then read it as UTF-8, every one of those null bytes renders as a space or an invisible control character. Hence the h t t p spacing. Text: c = " UTF-16LE: 63 00 3D 00 22 00 UTF-8 view: c ␀ = ␀ " ␀ <- the null shows up as a "space" Decode it as UTF-16LE instead and the nulls disappear, because that's what they were: the high byte of each 16-bit code unit. Decode it correctly In PowerShell itself — the encoding is literally called Unicode in .NET, which means UTF-16LE: $enc = 'JABjACAAPQAg...' [ System.Text.Encoding ]:: Unicode.GetString ([ System.Convert ]:: FromBase64String ( $enc )) In Python — decode the bytes, then read them as utf-16-le : import base64 enc = " JABjACAAPQAg... " print ( base64 . b64decode ( enc ). decode ( " utf-16-le " )) In CyberChef — build the recipe From Base64 → Decode text (UTF-16LE) . Or From Base64 then Remove null bytes for a quick-and-dirty look. Any of these turns the spaced-out mess back into readable PowerShell. The encode direction (for building test cases) If you're writing detections or a lab sample

Google recently changed how it refers and assigns names to hacking groups. TechCrunch spoke with one of the world’s foremost experts on tracking hackers to understand why companies give hackers codenames.

I Turned an Android Phone Into a No-Root Cybersecurity Learning Workspace Most people don't look at an Android phone and think: "This could be a practical Linux, Python, networking, and cybersecurity learning environment." Usually, the assumption is that serious technical learning requires a laptop, a virtual machine, or dedicated hardware. I wanted to see how far I could push the opposite idea. What if the Android phone you already own could become a practical learning workspace without root access? That experiment eventually became DedSec . DedSec is a free and open-source project built around Android and Termux. Its goal is not simply to install a large collection of tools. The goal is to create an environment where someone can actually learn how the pieces fit together. Repository: https://github.com/dedsec1121fk/DedSec Official website: https://ded-sec.space/ Why Android? Android devices are incredibly capable machines. Even an older phone can provide: a Linux-like command-line environment through Termux Python Git package management networking utilities file manipulation scripting automation local development workflows And you can do a surprising amount without root access. The limitation isn't always the hardware. A bigger limitation is often knowing what to do with it. You can install dozens of packages, copy commands from tutorials, and still not understand what is actually happening underneath. That was one of the problems I wanted DedSec to address. More Than a Collection of Scripts There are plenty of repositories containing security scripts. That wasn't enough for what I wanted to build. Installing a tool doesn't automatically teach you: what problem the tool solves when you should use it what its output means what layer of the system is failing how networking concepts connect together why a command works why another command fails So DedSec gradually became an ecosystem rather than just a scripts directory. The project connects several things together:

Why “it encrypts” doesn't equate to “it’s secure” If you want to find a tutorial for encrypting files in code, your search results will provide dozens of tutorials. Most of these tutorials will produce code that, on the surface, performs encryption. Users can provide plaintext, receive ciphertext, and the code also performs decryption. Unfortunately, the phrase “the output looks scrambled” is an unsecure way to test a program for security. These tutorials fail to incorporate security practices, which will result in these tools being rejected in real life security assessments. By identifying these mistakes, we can reason about the validity of these encryption schemes. This article covers the correct way to build a file encryption tool and the mistakes that beginner encryption tools include. These mistakes will help you learn the correct way to build an encryption tool. SecureVault (Node.js, packaged with no dependencies) is a command-line tool that is referenced throughout to help provide context to the design decisions that were made for this tool. Prerequisite mindset: When designing secure systems, always assume that the attacker knows more than you. Do you really think that your adversary will only submit the inputs you assumed they would submit? They will submit corrupted inputs, they will submit old ciphertexts, and they will do anything you thought was impossible. You need to have a secure design. You must think "what malicious inputs can I handle here?" . The goal: three guarantees, not one Before you even think about writing code, you need to know exactly what you mean by that something is secure. A good file encryption tool must provide three guarantees. Most of the tutorials that I have seen think only about the first one. Confidentiality - the attacker that steals the file should not be able to read the file. Integrity - If the attacker alters the encrypted file, you will know. Authenticity - The file can only be generated by a user that knows the passwor

Researchers found common points of failure, like software used to organize and display web content, could have allowed hackers to run riot through government websites.

Hackers employing AI in their tactics are finding ways to exploit vulnerabilities that didn't even exist before.

Framework told "all" of its customers that hackers accessed their names, email addresses, phone numbers, and physical addresses in a data breach.

In the Kimi test, the sandbox designed to contain the experiment was not properly configured.