Guy Bejerano

AI-enabled supply chain attacks jumped 156% last year. Discover why traditional defenses are failing and what CISOs must do now to protect their organizations. Download the full CISO’s expert guide to AI Supply chain attacks here.  TL;DR AI-enabled supply chain attacks are exploding in scale and sophistication - Malicious package uploads to open-source repositories jumped 156% in

1

Rooting the Blackpearl Machine (TCM Security) In this step-by-step walkthrough, I demonstrate how a virtual host misconfiguration led to full system compromise — exploiting Navigate CMS v2.8 for RCE and escalating privileges via a misconfigured SUID binary. A solid reminder that small misconfigurations scale into total compromise. #CyberSecurity #PenetrationTesting #EthicalHacking #WebSecurity #RedTeam #CTF

5

1 Comment

I recently talked with a CISO of a big organization who said something that stuck with me: he's not just measuring MTTR, he's also measuring time to RCA (Root Cause Analysis). It made me think about how much gets buried in MTTR. Detection, investigation, containment, remediation. It all blends into one number, and you lose sight of how long it actually took to investigate. And that's a shame, because there's a lot you can do to optimize that part specifically. When you start paying attention to investigation time, you notice where the hours actually go. The back-and-forth between tools to answer one question. Manually enriching IPs with context that should already be there. Data that's technically there, but not in a shape you can actually use. But if you're measuring time to RCA, it stops being invisible. You start asking: what slowed the investigation down, and more importantly, how do we fix it.

19

On October 4, Oracle published a Security Alert Advisory (https://lnkd.in/e4FbFPhq) for a new zero-day vulnerability in E-Business Suite (EBS), Oracle’s integrated business application suite for various business functions including order management, logistics, procurement and more. This vulnerability is being actively exploited in the wild. Here is a FAQ by Tenable Research providing more information and context for this critical exposure. https://lnkd.in/eGGrkaVb

24

Proofpoint researchers found that cybercriminals are developing and selling tools designed to hide malicious instructions inside emails, documents, calendar invites, and webpages that AI systems routinely process. See the details in eSecurityPlanet.

4

After lengthy late-night discussions with Cédric Bonhomme on sightings and KEV formats, we produced a first draft of a generic format for Known Exploited Vulnerabilities (KEV).  Initially, we considered extending GCVE BCP-05 using the CVE Record format. However, we ultimately concluded that it may be more appropriate to define a standalone format, allowing sources to publish their KEV data independently. Feel free to comment on the discourse link below. KEV Assertion Format – Draft Specification (potential BCP?) This format describes a generic KEV (Known Exploited Vulnerability) assertion format. The goal is to express who claims exploitation, when, based on what, where it was observed, and with which level of confidence, without turning KEV into full threat intelligence. A KEV assertion is usually very binary and lacking some meta-information. The format adds some information which could better capture details about the exploitation. A majority of the fields are optional except vulnerability, status and evidence.[].source which are recommended. 🔗 https://lnkd.in/eaBUFXie GCVE-EU CIRCL (Computer Incident Response Center Luxembourg) CVE Program

144

11 Comments