<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
  <title>AllSec.sh — Cybersecurity News Aggregator</title>
  <link>https://allsec.sh</link>
  <description>Real-time aggregator of cybersecurity news, vulnerability disclosures, and research.</description>
  <language>en-us</language>
  <lastBuildDate>Wed, 29 Apr 2026 15:45:31 GMT</lastBuildDate>
  <atom:link href="https://allsec.sh/rss.xml" rel="self" type="application/rss+xml" />
  
  <item>
    <title><![CDATA[CISA flags data-theft bug in NSA-built OT networking tool]]></title>
    <link>https://allsec.sh/story/1379df80cb715e</link>
    <guid isPermaLink="false">1379df80cb715e</guid>
    <pubDate>Wed, 29 Apr 2026 15:35:04 GMT</pubDate>
    <description><![CDATA[GrassMarlin leaks sensitive information, provided your targeting phishing skills are sharp enough The Cybersecurity and Infrastructure Security Agency (CISA) is warning anyone who uses GrassMarlin, a tool developed by the National Security Agency (NSA), about a new vulnerability that attackers can use to snoop on sensitive information.…]]></description>
    <source url="https://go.theregister.com/feed/www.theregister.com/2026/04/29/cisa_flags_datatheft_bug_in/">The Register</source>
  </item>
  <item>
    <title><![CDATA[Why a recent supply-chain attack singled out security firms Checkmarx and Bitwarden]]></title>
    <link>https://allsec.sh/story/08581510acc8c6</link>
    <guid isPermaLink="false">08581510acc8c6</guid>
    <pubDate>Wed, 29 Apr 2026 15:23:44 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://arstechnica.com/information-technology/2026/04/why-a-recent-supply-chain-attack-singled-out-security-firms-checkmarx-and-bitwarden/">r/cybersecurity</source>
  </item>
  <item>
    <title><![CDATA[New Wave of DPRK Attacks Uses AI-Inserted npm Malware, Fake Firms, and RATs]]></title>
    <link>https://allsec.sh/story/184522179d2ed6</link>
    <guid isPermaLink="false">184522179d2ed6</guid>
    <pubDate>Wed, 29 Apr 2026 14:43:00 GMT</pubDate>
    <description><![CDATA[Cybersecurity researchers have discovered malicious code in an npm package after a malicious package as a dependency to the project by Anthropic's Claude Opus large language model (LLM). The package in question is "@validate-sdk/v2," which is listed on npm as a utility software development kit (SDK) for hashing, validation, encoding/decoding, and secure random generation. However, its real]]></description>
    <source url="https://thehackernews.com/2026/04/new-wave-of-dprk-attacks-uses-ai.html">The Hacker News</source>
  </item>
  <item>
    <title><![CDATA[Claude Mythos Has Found 271 Zero-Days in Firefox]]></title>
    <link>https://allsec.sh/story/03323501bae85c</link>
    <guid isPermaLink="false">03323501bae85c</guid>
    <pubDate>Wed, 29 Apr 2026 14:41:27 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://www.schneier.com/blog/archives/2026/04/claude-mythos-has-found-271-zero-days-in-firefox.html">r/InfoSecNews</source>
  </item>
  <item>
    <title><![CDATA[Researchers Track 2.9 Billion Compromised Credentials]]></title>
    <link>https://allsec.sh/story/074bc7046fbd88</link>
    <guid isPermaLink="false">074bc7046fbd88</guid>
    <pubDate>Wed, 29 Apr 2026 14:39:32 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://www.infosecurity-magazine.com/news/29-billion-compromised-credentials/">r/InfoSecNews</source>
  </item>
  <item>
    <title><![CDATA[European police dismantles €50 million crypto investment fraud ring]]></title>
    <link>https://allsec.sh/story/056868cb1b7deb</link>
    <guid isPermaLink="false">056868cb1b7deb</guid>
    <pubDate>Wed, 29 Apr 2026 14:27:36 GMT</pubDate>
    <description><![CDATA[Austrian and Albanian authorities dismantled a criminal ring accused of running a large-scale cryptocurrency investment fraud operation that caused estimated losses of over €50 million ($58.5 million) to victims worldwide. [...]]]></description>
    <source url="https://www.bleepingcomputer.com/news/security/european-police-dismantles-50-million-crypto-investment-fraud-ring/">Bleeping Computer</source>
  </item>
  <item>
    <title><![CDATA[Apple Fixes Bug That Let FBI Extract Deleted Signal Messages After 404 Media Coverage]]></title>
    <link>https://allsec.sh/story/0c3ac7e674d296</link>
    <guid isPermaLink="false">0c3ac7e674d296</guid>
    <pubDate>Wed, 29 Apr 2026 13:49:02 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://www.404media.co/apple-fixes-bug-that-let-fbi-extract-deleted-signal-messages-after-404-media-coverage/">r/cybersecurity</source>
  </item>
  <item>
    <title><![CDATA[Minirat malware deployed via NPM targeting macOS machines]]></title>
    <link>https://allsec.sh/story/1f79e1b86b574b</link>
    <guid isPermaLink="false">1f79e1b86b574b</guid>
    <pubDate>Wed, 29 Apr 2026 13:41:41 GMT</pubDate>
    <description><![CDATA[A newly analyzed Go-based macOS remote access trojan (RAT), internally named Minirat, has surfaced in the wild using anti-VM checks, LaunchAgent persistence, and AES-encrypted command and control (C2) configuration to maintain stealthy, long-term access on victim endpoints. According to [SafeDep](https://safedep.io/malicious-velora-dex-sdk-npm-compromised-rat/), the initial infection vector was a malicious npm package (velora-dex-sdk) that dropped the Go-based macOS RAT onto developer endpoints.]]></description>
    <source url="https://www.iru.com/blog/minirat">r/Malware</source>
  </item>
  <item>
    <title><![CDATA[Set up automated dependency scanning after the recent npm/PyPI supply chain attacks]]></title>
    <link>https://allsec.sh/story/0a12da99a529a6</link>
    <guid isPermaLink="false">0a12da99a529a6</guid>
    <pubDate>Wed, 29 Apr 2026 13:33:04 GMT</pubDate>
    <description><![CDATA[With everything that's happened recently, the Axios npm account hijack, LiteLLM getting poisoned on PyPI, and that coordinated npm/PyPI/Docker Hub campaign in April, I finally stopped manually running `npm audit` and set up something proper.

Been running Dependency-Track for a few weeks now. It's an OWASP open source project that works differently from the usual scanners, you upload an SBOM for each project and it continuously monitors against NVD, OSS Index, GitHub Advisories, and more. New CVE drops affecting your stack? You get notified without doing anything.

Wrote up how I set it up on Hetzner with Docker, Traefik for HTTPS, and GitHub Actions to auto-generate and upload SBOMs on every push]]></description>
    <source url="https://blog.prateekjain.dev/stop-ignoring-supply-chain-attacks-set-up-dependency-track-in-30-minutes-a5c25871b815?sk=5e79331f743ae2a2cdacbb26eb390f46">r/netsec</source>
  </item>
  <item>
    <title><![CDATA[Claude deletes entire database]]></title>
    <link>https://allsec.sh/story/058f7d7aebf7ac</link>
    <guid isPermaLink="false">058f7d7aebf7ac</guid>
    <pubDate>Wed, 29 Apr 2026 13:13:45 GMT</pubDate>
    <description><![CDATA[Yo, saw this while i was scrolling. Is this some real concern or just noise?!

[https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-powered-ai-coding-agent-deletes-entire-company-database-in-9-seconds-backups-zapped-after-cursor-tool-powered-by-anthropics-claude-goes-rogue?referrer=https%3A%2F%2Freddit.com](https://www.tomshardware.com/tech-industry/artificial-intelligence/claude-powered-ai-coding-agent-deletes-entire-company-database-in-9-seconds-backups-zapped-after-cursor-tool-powered-by-anthropics-claude-goes-rogue?referrer=https%3A%2F%2Freddit.com)]]></description>
    <source url="https://www.reddit.com/r/cybersecurity/comments/1syygx3/claude_deletes_entire_database/">r/cybersecurity</source>
  </item>
  <item>
    <title><![CDATA[ShinyHunters Medtronic ADT Breach: 14.5M Records Stolen]]></title>
    <link>https://allsec.sh/story/023f64c426339c</link>
    <guid isPermaLink="false">023f64c426339c</guid>
    <pubDate>Wed, 29 Apr 2026 13:06:57 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://www.decryptiondigest.com/blog/shinyhunters-medtronic-adt-vishing-salesforce-breach">r/InfoSecNews</source>
  </item>
  <item>
    <title><![CDATA[Learning from the Vercel breach: Shadow AI & OAuth sprawl]]></title>
    <link>https://allsec.sh/story/12cc8a41b472eb</link>
    <guid isPermaLink="false">12cc8a41b472eb</guid>
    <pubDate>Wed, 29 Apr 2026 13:05:14 GMT</pubDate>
    <description><![CDATA[A single third-party OAuth integration can become a direct path into your environment. Push explains how the Vercel breach shows a compromised OAuth app can lead to widespread impact across downstream customers. [...]]]></description>
    <source url="https://www.bleepingcomputer.com/news/security/learning-from-the-vercel-breach-shadow-ai-and-oauth-sprawl/">Bleeping Computer</source>
  </item>
  <item>
    <title><![CDATA[GitHub: Woah, a genuinely helpful AI-assisted bug report that isn't total slop. Here, Wiz, take this wad of cash]]></title>
    <link>https://allsec.sh/story/08aae0906c97e0</link>
    <guid isPermaLink="false">08aae0906c97e0</guid>
    <pubDate>Wed, 29 Apr 2026 13:02:16 GMT</pubDate>
    <description><![CDATA[Claude ploughs through months of work in rapid time, helps Wiz researchers nab lucrative award Wiz researchers are set for a tidy payday thanks to their discovery of a high-severity flaw in GitHub's git infrastructure that handed remote attackers full read/write access to private GitHub repositories using a single command.…]]></description>
    <source url="https://go.theregister.com/feed/www.theregister.com/2026/04/29/github_woah_a_genuinely_helpful/">The Register</source>
  </item>
  <item>
    <title><![CDATA[GitHub fixes RCE flaw that gave access to millions of private repos]]></title>
    <link>https://allsec.sh/story/0b8adfc529438e</link>
    <guid isPermaLink="false">0b8adfc529438e</guid>
    <pubDate>Wed, 29 Apr 2026 12:41:17 GMT</pubDate>
    <description><![CDATA[In early March, GitHub patched a critical remote code execution vulnerability (CVE-2026-3854) that could have allowed attackers to access millions of private repositories. [...]]]></description>
    <source url="https://www.bleepingcomputer.com/news/security/github-fixes-rce-flaw-that-gave-access-to-millions-of-private-repos/">Bleeping Computer</source>
  </item>
  <item>
    <title><![CDATA[I built a free open-source CAN bus reverse engineering workstation in Python — 15 tabs, offline ML, dual AI engines, MitM gateway]]></title>
    <link>https://allsec.sh/story/1599ad20dc6fe5</link>
    <guid isPermaLink="false">1599ad20dc6fe5</guid>
    <pubDate>Wed, 29 Apr 2026 12:38:24 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://github.com/Sherin-SEF-AI/CanLab">r/ReverseEngineering</source>
  </item>
  <item>
    <title><![CDATA[EU waves through open source age-check tool to keep kids safe online]]></title>
    <link>https://allsec.sh/story/175a756f8c264f</link>
    <guid isPermaLink="false">175a756f8c264f</guid>
    <pubDate>Wed, 29 Apr 2026 12:03:22 GMT</pubDate>
    <description><![CDATA['Online platforms can rely on our app,' says Commish, 'there are no more excuses' The European Commission has recommended EU member states adopt an age verification app designed to protect children from harmful online content.…]]></description>
    <source url="https://go.theregister.com/feed/www.theregister.com/2026/04/29/eu_adopts_open_source_ageverification/">The Register</source>
  </item>
  <item>
    <title><![CDATA[I'm not an expert but a beginner. So using guides I've tried an app in everyway for intercepting network traffic.Frida didn't worked even. The app doesn't even work in a rooted I tried decompiling and change network config. But doesn't work as after installed the app redirects play store for update.]]></title>
    <link>https://allsec.sh/story/15f9370c116ad3</link>
    <guid isPermaLink="false">15f9370c116ad3</guid>
    <pubDate>Wed, 29 Apr 2026 11:58:41 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://www.slowly.app">r/ReverseEngineering</source>
  </item>
  <item>
    <title><![CDATA[Stolen VPN Credential, Unpatched Zero-Day: The Nightmare-Eclipse Intrusion]]></title>
    <link>https://allsec.sh/story/04bff401361583</link>
    <guid isPermaLink="false">04bff401361583</guid>
    <pubDate>Wed, 29 Apr 2026 11:54:31 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://www.zeroport.com/blog/nightmare-eclipse-bluehammer-vpn-breach">r/InfoSecNews</source>
  </item>
  <item>
    <title><![CDATA[What to Look for in an Exposure Management Platform (And What Most of Them Get Wrong)]]></title>
    <link>https://allsec.sh/story/122e5c5ef07470</link>
    <guid isPermaLink="false">122e5c5ef07470</guid>
    <pubDate>Wed, 29 Apr 2026 11:30:00 GMT</pubDate>
    <description><![CDATA[Every security team has a version of the same story. The quarter ends with hundreds of vulnerabilities closed. The dashboards are bursting with green. Then someone in a leadership meeting asks: "So, are we actually safer now?" Crickets. The room goes quiet because an honest answer requires context – which is something that patch counts and CVSS scores were never designed to provide. Exposure]]></description>
    <source url="https://thehackernews.com/2026/04/what-to-look-for-in-exposure-management.html">The Hacker News</source>
  </item>
  <item>
    <title><![CDATA[Extending Ruzzy with LibAFL]]></title>
    <link>https://allsec.sh/story/1f917db9e5b63f</link>
    <guid isPermaLink="false">1f917db9e5b63f</guid>
    <pubDate>Wed, 29 Apr 2026 11:00:00 GMT</pubDate>
    <description><![CDATA[LibAFL is all the rage in the fuzzing community these days, especially with LLVM’s libFuzzer being placed in maintenance mode . Written in Rust, LibAFL claims improved performance, modularity, state-of-the-art fuzzing techniques, and libFuzzer compatibility . For these reasons, I set out to add LibAFL support to Ruzzy , our coverage-guided fuzzer for pure Ruby code and Ruby C extensions. This gives Ruby developers and security researchers access to a more advanced and actively maintained fuzzing engine without changing how they write their fuzzing harnesses. Ruzzy was originally built on top of LLVM’s libFuzzer, so using LibAFL’s compatibility layer should be easy enough. However, digging around in the internals of complex systems is never quite as simple as it seems. In this post, I will investigate some of the deep plumbing inside these fuzzing engines, take a detour into executable and linkable format (ELF) files, and ultimately add LibAFL support to Ruzzy. Building with libafl_libfuzzer Ruzzy currently supports Linux, so I use a Dockerfile for development and for production fuzzing campaigns. To that end, using a similar Dockerfile for LibAFL support is the simplest integration point. LibAFL provides excellent documentation a]]></description>
    <source url="https://blog.trailofbits.com/2026/04/29/extending-ruzzy-with-libafl/">Trail of Bits</source>
  </item>
  <item>
    <title><![CDATA[CISA orders feds to patch Windows flaw exploited as zero-day]]></title>
    <link>https://allsec.sh/story/01133e697fb6cf</link>
    <guid isPermaLink="false">01133e697fb6cf</guid>
    <pubDate>Wed, 29 Apr 2026 10:29:31 GMT</pubDate>
    <description><![CDATA[The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to secure their Windows systems against a vulnerability exploited in zero-day attacks. [...]]]></description>
    <source url="https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-windows-flaw-exploited-in-zero-day-attacks/">Bleeping Computer</source>
  </item>
  <item>
    <title><![CDATA[CVE-2026-42167 Allows Auth Bypass And RCE In ProFTPD]]></title>
    <link>https://allsec.sh/story/1dfb7a03508d17</link>
    <guid isPermaLink="false">1dfb7a03508d17</guid>
    <pubDate>Wed, 29 Apr 2026 10:25:35 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://zeropath.com/blog/proftpd-cve-2026-42167-auth-bypass-privesc-rce">r/cybersecurity</source>
  </item>
  <item>
    <title><![CDATA[GoDaddy customer claims registrar transferred 27-year-old domain without any security checks]]></title>
    <link>https://allsec.sh/story/018aa37d6b3eea</link>
    <guid isPermaLink="false">018aa37d6b3eea</guid>
    <pubDate>Wed, 29 Apr 2026 10:00:09 GMT</pubDate>
    <description><![CDATA[32 phone calls, 17 email chains, a 5-day ordeal, and no help during the daddy of all stuffups, claim those affected GoDaddy is currently investigating claims that it handed complete control of a valid 27-year-old domain to another customer, without requiring them to pass any authentication processes or upload any supporting documents.…]]></description>
    <source url="https://go.theregister.com/feed/www.theregister.com/2026/04/29/godaddy_megagaffe_wrongly_transferred_27yearold/">The Register</source>
  </item>
  <item>
    <title><![CDATA[Critical cPanel Authentication Vulnerability Identified — Update Your Server Immediately]]></title>
    <link>https://allsec.sh/story/1305351a93d707</link>
    <guid isPermaLink="false">1305351a93d707</guid>
    <pubDate>Wed, 29 Apr 2026 09:37:00 GMT</pubDate>
    <description><![CDATA[cPanel has released security updates to address a security issue impacting various authentication paths that could allow an attacker to obtain access to the control panel software. The problem affects all currently supported versions, according to an alert released by cPanel on Tuesday. The issue has been addressed in the following versions - 11.110.0.97 11.118.0.63 11.126.0.54 11.132.0.29]]></description>
    <source url="https://thehackernews.com/2026/04/critical-cpanel-authentication.html">The Hacker News</source>
  </item>
  <item>
    <title><![CDATA[What triggers change in your security environment?]]></title>
    <link>https://allsec.sh/story/185e6a6219081b</link>
    <guid isPermaLink="false">185e6a6219081b</guid>
    <pubDate>Wed, 29 Apr 2026 09:09:42 GMT</pubDate>
    <description><![CDATA[The easiest way to diagnose whether you're running security operations or compliance operations:

Ask what causes your team to change something.

Compliance-driven triggers: audit findings, contract renewals, framework updates, and regulatory changes. The team acts when an external authority requires it.

Threat-driven triggers: an incident revealed a gap; a purple-team exercise showed a rule didn't fire; threat intel identified a new technique; and a coverage assessment found an empty ATT&CK tactic. The team acts because the adversary's behaviour demands it.

If your program changes primarily in response to audit cycles, you're running a compliance operation. That's a diagnostic, not a judgement — and it's fixable.

Full post: [https://ridgelinecyber.com/blog/security-operation-or-compliance-operation/](https://ridgelinecyber.com/blog/security-operation-or-compliance-operation/)]]></description>
    <source url="https://www.reddit.com/r/blueteamsec/comments/1syth59/what_triggers_change_in_your_security_environment/">r/blueteamsec</source>
  </item>
  <item>
    <title><![CDATA[Cursor AI IDE Vulnerability Allows Code Execution Via Hidden Git Hooks]]></title>
    <link>https://allsec.sh/story/05274a55242b4d</link>
    <guid isPermaLink="false">05274a55242b4d</guid>
    <pubDate>Wed, 29 Apr 2026 09:04:15 GMT</pubDate>
    <description><![CDATA[]]></description>
    <source url="https://hackread.com/cursor-ai-ide-vulnerability-code-execution-git-hooks/">r/InfoSecNews</source>
  </item>
  <item>
    <title><![CDATA[Microsoft says backend change broke Teams Free chat and calls]]></title>
    <link>https://allsec.sh/story/10ede5dbde36ba</link>
    <guid isPermaLink="false">10ede5dbde36ba</guid>
    <pubDate>Wed, 29 Apr 2026 08:38:07 GMT</pubDate>
    <description><![CDATA[Microsoft is working to resolve a known issue that prevents some Microsoft Teams Free users from chatting and calling others. [...]]]></description>
    <source url="https://www.bleepingcomputer.com/news/security/microsoft-says-backend-change-broke-teams-free-chat-and-calls/">Bleeping Computer</source>
  </item>
  <item>
    <title><![CDATA[30 ClawHub skills secretly turn AI agents into a crypto swarm]]></title>
    <link>https://allsec.sh/story/039d61795fefcb</link>
    <guid isPermaLink="false">039d61795fefcb</guid>
    <pubDate>Wed, 29 Apr 2026 06:32:14 GMT</pubDate>
    <description><![CDATA[Yet another reason not to feast on OpenClaw Thirty ClawHub skills published by a single author are silently co-opting AI agents and creating a mass cryptocurrency mining swarm – without any malware or user consent.…]]></description>
    <source url="https://go.theregister.com/feed/www.theregister.com/2026/04/29/30_clawhub_skills_mine_crypto/">The Register</source>
  </item>
  <item>
    <title><![CDATA[LiteLLM CVE-2026-42208 SQL Injection Exploited within 36 Hours of Disclosure]]></title>
    <link>https://allsec.sh/story/0237f468a2b21c</link>
    <guid isPermaLink="false">0237f468a2b21c</guid>
    <pubDate>Wed, 29 Apr 2026 05:34:00 GMT</pubDate>
    <description><![CDATA[In yet another instance of threat actors quickly jumping on the exploitation bandwagon, a newly disclosed critical security flaw in BerriAI's LiteLLM Python package has come under active exploitation in the wild within 36 hours of the bug becoming public knowledge. The vulnerability, tracked as CVE-2026-42208 (CVSS score: 9.3), is an SQL injection that could be exploited to modify the underlying]]></description>
    <source url="https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html">The Hacker News</source>
  </item>
  <item>
    <title><![CDATA[CRITICAL SECURITY VULNERABILITY WITH CPANEL/WHM, APRIL 28, 2026]]></title>
    <link>https://allsec.sh/story/04b524eb3a8eae</link>
    <guid isPermaLink="false">04b524eb3a8eae</guid>
    <pubDate>Wed, 29 Apr 2026 05:19:12 GMT</pubDate>
    <description><![CDATA[[https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026/](https://www.namecheap.com/status-updates/ongoing-critical-security-vulnerability-in-cpanel-april-28-2026/)



[https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026](https://support.cpanel.net/hc/en-us/articles/40073787579671-cPanel-WHM-Security-Update-04-28-2026)]]></description>
    <source url="https://www.reddit.com/r/cybersecurity/comments/1sypdwo/critical_security_vulnerability_with_cpanelwhm/">r/cybersecurity</source>
  </item>
</channel>
</rss>