Violation de données personnelles : que faire en 3 étapes clés ? Face à la multiplication des violations de données personnelles et à la nécessité de mieux sensibiliser le public, Cybermalveillance.gouv.fr et la CNIL proposent un nouveau support pratique : « Violation de données personnelles, que fa

Une centaine de comptes utilisateurs, liée au piratage de Metabase, a été concernée par une compromission. À la clé, des données de connexion désormais dans la nature. Mais des "mesures de sécurisation" ont été prises.

Un utilisateur de Reddit a fait tourner gpt-oss-120b, le plus gros modèle ouvert d'OpenAI, en le découpant entre six appareils, dont un Samsung Galaxy S24+

Uncensored AI models or those fine-tuned for cybersecurity tasks. - JoasASantos/Offensive-Security-AI-Models

One-pass anonymous Active Directory enumeration over SAMR and LSARPC — null session, no credentials, with structured reusable output. - crypt0p3g/adnullenum

Proof of Concept for Process Code Injection Without Using WriteProcessMemory - TwoSevenOneT/InjectSetConsole

Visualize elliptic curve cryptography with animated examples

97 % des victimes de ransomware par vol d'identifiants avaient activé le MFA. Voici comment repérer les accès restés en mot de passe seul et les combler.

tl;dr; omnibin is a FUSE filesystem that puts every binary nixpkgs ever shipped on your $PATH. Nothing is installed. Nothing needs building. 0 bytes on disk until something actually reads a file. 😈 It’s 2026, why am I still installing packages individually?1 Why must I go through the ritual of addin

[Experimental] A virtio device for near-native NVIDIA GPU access in KVM virtual machines. - nestrilabs/virtio-nvgpu

Arm support is expanding on Linux, with Qualcomm announcing Linux support for the Snapdragon X2 Series.

Think like a programmer and move like a programmer with a collection of learning courses from the experts at No Starch Press!

An engineering report on PFL: a from-scratch reimplementation of OpenBSD's pf — its configuration language and packet-processing semantics — as a Rust/eBPF program on the Linux XDP hook.…

This half-day workshop provides an introduction to the Game of Trees version control system. Game of Trees (Got) is a version control system which prioritizes ease of use and simplicity over flexibil...

45 days of Signal history may be exposed by German police messaging surveillance using linked devices, Netzpolitik says. Read what the documents reveal

This is a practical guide to assessing the security of an agentic AI system.

n options.

This short blog post is about abusing a privilege escalation bug that Microsoft recently fixed in...

Chainalysis has identified 15+ campaigns using EtherHiding-style tactics to store malware on blockchains. Inside an attack type exploding in the AI age.

Host and manage multiple Juice Shop instances for security trainings and Capture The Flags - juice-shop/multi-juicer

Hercules is a Windows domain controller running an ASP.NET site. I’ll slip past the filters to an LDAP injection, and with a rate limit bypass, I’ll brute force the directory and pull a default password out of a user description. An arbitrary file read in the download handler leaks the machine key from the site’s configuration, which lets me forge an authentication cookie carrying the Web Administrators role and unlock the file upload. An uploaded document coerces an authentication attempt that cracks, opening a long chain of Active Directory abuse that runs through shadow credentials, moving an account into an organizational unit to bring it under rights I already hold, and ESC3 against the certificate authority. Finally I’ll trigger a cleanup task that strips admin protections from a privileged account, then abuse delegation to reach the machine account that can dump the domain.

Google has been fined €403 million by the Irish Data Protection Commission after the Norwegian Consumer Council exposed how the company manipulated users into accepting extensive tracking.

Introducing Kaine User-Defined C2, expanded Linux post-ex capabilities, refactored port forwarding and sleep masking, enhanced .NET/PowerSafe execution, Beacon Object File improvements, In-Memory PE E...

Ghostlink is built around a fictional threat group running its operations on a Windows domain controller, with a message broker quietly announcing infrastructure I can’t otherwise reach. I’ll subscribe to that broker anonymously to find internal sites, then publish a tampered health check message to coerce the host into authenticating to me. Relaying that authentication gets me into a restricted file sharing site, where an unchecked path in the download endpoint gives arbitrary file read, leading to a user’s registry hive and a password database. Those credentials unlock the Gogs instance, where a symbolic link flaw in the content API lets me overwrite a Git config and get a shell on the virtual machine hosting it. I’ll crack a password hash from the Gogs database to reach a domain account, and finish by relaying coerced machine account authentication to the certificate authority to get a certificate for the domain controller and dump the domain. In Beyond Root, I’ll show why the other certificate services path never had a chance, and reverse engineer the file sharing application.

Master AI tools in production environments with confidence using professional‑grade lessons from our latest Manning learning bundle!

14-15 septembre 2026, Paris et visioconférence.

La CNIL va se pencher sur les fuites de données qui ont frappé les impôts cet été. L'autorité a annoncé qu'elle allait contrôler « dans les tout prochains jours » la Direction générale des Finances publiques (DGFiP) à la recherche d'infractions au RGPD. Les systèmes de l'Agence nationale des titres