Cybersecurity — Cybersecurity News

PCAPGraph: Threat Hunting at the Speed of Triage

PCAPGraph: Threat Hunting at the Speed of Triage

PCAPGraph is an open-source network investigation and threat hunting tool that transforms packet cap...

Open-Source Network Discovery & Topology Mapping

Open-Source Network Discovery & Topology Mapping

RedSide Security has open-sourced NETMAPPER, a network discovery and visualization tool designed to ...

 RDPGraph: Turn Windows Event Logs into an Interactive RDP Attack Graph

RDPGraph: Turn Windows Event Logs into an Interactive RDP Attack Graph

When an incident unfolds and all you have left are Windows event logs, understanding attacker moveme...

Latest Posts

ZachXBT Claims to Infiltrate Crypto Laundering Network Linked to Lazarus Group After $1.5 Billion Bybit Hack

ZachXBT Claims to Infiltrate Crypto Laundering Network Linked to Lazarus Group After $1.5 Billion Bybit Hack

RedSide Security October 06, 2026 Cybercrime 66 views

Blockchain investigator ZachXBT says he infiltrated a Chinese cryptocurrency laundering network allegedly linked to North Korea's Lazarus Group and traced more than $1 billion in stolen assets following the $1.5 billion Bybit hack, helping identify wallet clusters and freeze cryptocurrency connected to the operation.

Continue reading: ZachXBT Claims to Infiltrate Crypto Laundering Net…
 Atlassian CVE-2026-21589: Critical File Access Vulnerability Affects 8 Data Center Products

Atlassian CVE-2026-21589: Critical File Access Vulnerability Affects 8 Data Center Products

RedSide Security October 06, 2026 CVE 123 views

Atlassian has disclosed critical vulnerability CVE-2026-21589 affecting eight self-hosted Data Center products, allowing unauthenticated attackers to read specific files from application root directories. Rated CVSS 9.3, the flaw affects Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye, with Atlassian urging customers to patch immediately.

Continue reading: Atlassian CVE-2026-21589: Critical File Access Vu…
Apple iCloud Email Spoofing Flaws Could Bypass SPF, DKIM and DMARC

Apple iCloud Email Spoofing Flaws Could Bypass SPF, DKIM and DMARC

RedSide Security October 02, 2026 Cybersecurity 96 views

Security researchers discovered two iCloud email spoofing vulnerabilities that could have allowed attackers to send messages appearing to originate from arbitrary @icloud.com addresses while still passing SPF, DKIM, and DMARC authentication checks.

Continue reading: Apple iCloud Email Spoofing Flaws Could Bypass SPF…
ShieldBreak: Microsoft Defender Zero-Day and RoguePlanet Patch Bypass

ShieldBreak: Microsoft Defender Zero-Day and RoguePlanet Patch Bypass

RedSide Security September 17, 2026 Vulnerability 110 views

ShieldBreak (CVE-2026-69414) is a Microsoft Defender elevation-of-privilege vulnerability linked to research on bypassing mitigations for RoguePlanet (CVE-2026-50656). Explore the technical research, affected components, and defensive detection opportunities.

Continue reading: ShieldBreak: Microsoft Defender Zero-Day and Rogue…
Hackers Steal Data of 8.7 Million Customers in Cyberattack on Three UK Airports

Hackers Steal Data of 8.7 Million Customers in Cyberattack on Three UK Airports

RedSide Security August 28, 2026 Data Leaks & Breaches 156 views

Hackers have reportedly stolen personal data belonging to approximately 8.7 million customers following a cyberattack targeting systems used by Manchester Airports Group, which operates Manchester, East Midlands, and London Stansted airports. The incident exposed email addresses, postcodes, vehicle registration details, and other travel-related information.

Continue reading: Hackers Steal Data of 8.7 Million Customers in Cyb…
Microsoft SCCM Vulnerability Chain Could Enable Remote SYSTEM-Level Code Execution

Microsoft SCCM Vulnerability Chain Could Enable Remote SYSTEM-Level Code Execution

RedSide Security August 17, 2026 Vulnerability 226 views

Security researchers have disclosed an attack chain affecting Microsoft System Center Configuration Manager (SCCM) that could allow standard Active Directory users to ultimately execute malicious code with SYSTEM privileges on an SCCM primary site server. The chain combines an AdminService authorization flaw, weak signature validation, CAB path traversal, and unsafe DLL loading.

Continue reading: Microsoft SCCM Vulnerability Chain Could Enable Re…
McDonald’s, Vodafone Hit by Azure Credential Theft Campaign Exposing Millions of Enterprise Records

McDonald’s, Vodafone Hit by Azure Credential Theft Campaign Exposing Millions of Enterprise Records

RedSide Security August 16, 2026 Data Leaks & Breaches 431 views

A threat actor known as TheHatman is allegedly selling employee directories stolen from major enterprises through compromised Azure and Microsoft Entra credentials. The campaign reportedly exposes millions of records, including corporate emails, employee details, reporting structures, service accounts, and administrator information, creating significant risks for spear-phishing, privilege escalation, and further network compromise.

Continue reading: McDonald’s, Vodafone Hit by Azure Credential Theft…
Adobe ColdFusion Critical Vulnerabilities Enable Unauthenticated Remote Code Execution

Adobe ColdFusion Critical Vulnerabilities Enable Unauthenticated Remote Code Execution

RedSide Security August 12, 2026 CVE 184 views

Adobe has released urgent security updates for ColdFusion 2025 and 2023, fixing multiple critical vulnerabilities including a CVSS 10.0 unauthenticated OS command injection flaw that could enable remote code execution and full server compromise. Organizations should patch exposed ColdFusion deployments immediately.

Continue reading: Adobe ColdFusion Critical Vulnerabilities Enable U…
Encrypted AI Reasoning Traces Can Leak Secrets Across API Sessions

Encrypted AI Reasoning Traces Can Leak Secrets Across API Sessions

RedSide Security August 12, 2026 AI Security 236 views

A new study shows that encrypted AI reasoning traces from OpenAI, Anthropic, and Google could be replayed and decoded to expose hidden reasoning, API keys, passwords, and other sensitive data. Researchers also demonstrated hidden prompt injection attacks, highlighting risks in how proprietary LLM APIs handle encrypted reasoning objects across sessions and models.

Continue reading: Encrypted AI Reasoning Traces Can Leak Secrets Acr…
New "Pass-ta-key" Attack Steals Google Passkeys Without Passwords or Biometrics

New "Pass-ta-key" Attack Steals Google Passkeys Without Passwords or Biometrics

RedSide Security August 04, 2026 Vulnerability 171 views

Researchers have disclosed three new attacks—Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key—that allow malware on compromised Windows systems to hijack Google-synced passkeys without passwords or biometrics. The findings expose weaknesses in Chrome's Cloud Authenticator implementation rather than the underlying passkey cryptography.

Continue reading: New "Pass-ta-key" Attack Steals Google Passkeys Wi…