Latest posts
Blue Team Alerts
24 Sept, 16:17
The Max Messenger: An Analysis of Russia’s State-Mandated Messaging Application https://ift.tt/apqGbf5Discuss on Reddit: https://ift.tt/sZL7EB9 @blueteamalertsInterSecLabThe Max Messenger: An Analysis of Russia’s State-Mandated Messaging ApplicationVK can change what the Russian Max messenger does to you, one user at a time. Its surveillance features can be switched on without you noticing. Read our full analysis.Blue Team Alerts
24 Sept, 15:17
Cyber security and a shared responsibility in the cloud: Renewing the social contract in a volatile era https://youtu.be/x7dvRAumnbY?si=P0M85HaB7zpy00O4Discuss on Reddit: https://ift.tt/oNKML5B @blueteamalertsYouTubeCyber security and a shared responsibility in the cloud: Renewing the social […] - Ollie WhitehouseCyber security and a shared responsibility in the cloud: Renewing the social contract in a volatile era Ollie Whitehouse Ollie Whitehouse: Ollie’s career in cyber security has spanned more than 27 years prior to becoming the NCSC's Chief Technology Officer…Blue Team Alerts
24 Sept, 14:17
Early rogue AI agent activity and attempts to hack found on urlquery.net https://ift.tt/9cob7OHDiscuss on Reddit: https://ift.tt/g0mGoCW @blueteamalertstransluce.orgEarly rogue AI agent activity and attempts to hack found on urlquery.netWe found evidence on urlquery that AI agents were active earlier than previously reported and attempted hacks against public data providers.Blue Team Alerts
24 Sept, 08:17
Agentic Swarm Datasets https://ift.tt/fpNSVXEDiscuss on Reddit: https://ift.tt/oGuaAlV @blueteamalertsAgentic Swarm DatasetsExplore Agentic Swarm Datasets: synthetic enterprise telemetry for agent security research. Inspect records, compare scenarios, and download reproducible datasets.Blue Team Alerts
24 Sept, 08:17
A proof-of-concept for a local Muse vulnerability 0day that can let an unprivileged local process redirect Muse’s dictation traffic and abuse the trust/access granted to the app. https://ift.tt/oynHrw9Discuss on Reddit: https://ift.tt/4lPSuDM @blueteamalertsGitHubGitHub - pwardle/not-a-mused: Not a MusedNot a Mused. Contribute to pwardle/not-a-mused development by creating an account on GitHub.Blue Team Alerts
24 Sept, 08:17
Inside ZCode: Silently Uploading Your Entire Git History to the Cloud https://ift.tt/6oA8i3IDiscuss on Reddit: https://ift.tt/xZLgweM @blueteamalertsCode is cheap, let's talkInside ZCode: Silently Uploading Your Entire Git History to the CloudZCode silently uploads full Git history to the cloud; this post provides a block rule and source review — checkpoint claims fall apart against the code.Blue Team Alerts
24 Sept, 08:17
REx-skill: REx@Skill - Agentic Reverse Engineering eXecution Skill for binary vulnerability discovery https://ift.tt/J5MngAUDiscuss on Reddit: https://ift.tt/AZmcP2B @blueteamalertsGitHubGitHub - tihanyin/REx-skill: REx@Skill - Agentic Reverse Engineering eXecution Skill for binary vulnerability discoveryREx@Skill - Agentic Reverse Engineering eXecution Skill for binary vulnerability discovery - tihanyin/REx-skillBlue Team Alerts
24 Sept, 08:17
WordPress 7.1.1-CVE-2026-87902 exploit https://gist.github.com/harisec/0eb57795ecefa75cf1fe3ee6f856560bDiscuss on Reddit: https://ift.tt/PM1ToGF @blueteamalertsGistWordPress 7.1.1-CVE-2026-87902-exploit.mdGitHub Gist: instantly share code, notes, and snippets.Blue Team Alerts
22 Sept, 19:17
The Closed Quorum: Inside the first reported autonomous AI C2 implant https://ift.tt/G56W4EeDiscuss on Reddit: https://ift.tt/c3JN8lm @blueteamalertsCisco TalosThe Closed Quorum: Inside the first reported autonomous AI C2 implantCLOSEDQUORUM, a malware binary discovered through Cisco Talos’ CAIRN project, exhibits fully autonomous command and control (C2). It represents a shift in effort displacement for attackers, in which expanding portions of the attack chain can be executed without…Blue Team Alerts
22 Sept, 18:17
MikroTrick: technical analysis, disclosure process, and the use of LLM agents https://ift.tt/Ov24XfbDiscuss on Reddit: https://ift.tt/t7mUEqD @blueteamalertscert.plMikroTrick: technical analysis, disclosure process, and the use of LLM agentsWe describe the technical details of the MikroTrick chain, which combines the CVE-2026-67279 and CVE-2026-86060 vulnerabilities and, when chained, allowed full takeover of a device without authentication. We explain the mechanics of the attacks observed in…Blue Team Alerts
22 Sept, 16:17
VPN Purchases worth it? https://ift.tt/ZCaixwtDiscuss on Reddit: https://ift.tt/aqoscjP @blueteamalertsBleepingComputerGet 5 years of AdGuard VPN + Ad Blocker for life for only $50A VPN and an ad blocker handle different parts of your online experience, so having both makes sense. The AdGuard VPN + Ad Blocker Family Security Suite is currently on sale for just $49.99 (MSRP $439.39) for a limited time. It combines five years of VPN…Blue Team Alerts
22 Sept, 14:17
Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures https://ift.tt/YpvuK4rDiscuss on Reddit: https://ift.tt/uEkaWmy @blueteamalertsSOCRadarOperation Talked: Russia-Linked Espionage on Ukraine Defense,OPERATION TALKED is an ongoing Russia-linked espionage campaign, exposed after the actor left their own C2 as an open directory of 8,436 files...Blue Team Alerts
22 Sept, 14:17
ENISA Threat Landscape 2026 https://ift.tt/mGE761lDiscuss on Reddit: https://ift.tt/2sJlOST @blueteamalertswww.enisa.europa.euENISA Threat Landscape 2026 | ENISAENISA is the EU agency dedicated to enhancing cybersecurity in Europe. They offer guidance, tools, and resources to safeguard citizens and businesses from cyber threats.Blue Team Alerts
22 Sept, 14:17
Talaria, a fast, zero dependency Linux privilege escalation and posture auditor built for blue teams and DevSecOps I built this because I kept running into the same headaches when assessing Linux hosts or playing CTFs. Every time you need to check a system for local privilege escalation, the go to tools are massive shell scripts like LinPEAS that take 5 to 10 minutes to run, spawn hundreds of subshells, write temp files to /tmp, and dump thousands of lines of colored text with cleartext credentials scrolling right past your screen.On top of that, traditional shell scripts frequently miss complex, real world human misconfigurations. Because of performance limits and basic shell regex, they mostly stick to simple checks like standard GTFOBins SUIDs, basic crontabs, or kernel versions. They end up blind to deeper operational flaws, like dangerous Polkit JavaScript rules in rules.d, systemdBlue Team Alerts
22 Sept, 12:17
How do you revoke an AI agent’s access at machine speed? If an AI agent is compromised, connected to a malicious tool server, or begins operating outside its expected boundaries, containment cannot depend on manually locating every API key, cloud role, OAuth grant, and workflow credential.A useful response path would disable the agent identity, block new credential issuance, revoke delegated authority, restrict access to particular tools or environments, and show which systems the agent could reach.Does anyone have a central containment model for agent identities, or is this still fragmented across IAM, cloud consoles, CI/CD, SaaS administration, and agent orchestration tools?Discuss on Reddit: https://ift.tt/6jPHWXs @blueteamalertsRedditFrom the blueteamsec community on RedditExplore this post and more from the blueteamsec communityBlue Team Alerts
22 Sept, 07:17
I’ve been working on an open-source RF/SDR analysis project called VULTURE Hey everyone, I’m black-210, the main developer of VULTURE.I started VULTURE around RF and SDR analysis, but over time it became much bigger than that. I wanted to build a platform where RF/signal processing, scientific computing, machine learning, digital forensics, chemistry, physics, mathematics, visualization, and research workflows could exist together instead of having each part live as a completely separate project.So VULTURE is now a modular intelligence and research platform, with Python APIs, a CLI, an optional PyQt6 GUI, analysis frameworks, reproducible/offline workflows, reporting and provenance, and a separate native C layer.What VULTURE actually coversRF / SDR / IQFFT and FFT-engine workflowsPSD analysisspectrograms and waterfall visualizationsignal detectionpeak and burst detectionoccupancyBlue Team Alerts
22 Sept, 07:17
Mapping out your unknown: A threat hunter’s guide to GitHub https://ift.tt/58VlRM7Discuss on Reddit: https://ift.tt/xVcWy4U @blueteamalertsDatadoghqMapping out your unknown: A threat hunter’s guide to GitHubIn this post, we walk through different threats to GitHub and how to detect them.Blue Team Alerts
22 Sept, 07:17
One does not simply defend agentically https://ift.tt/NTuIed1Discuss on Reddit: https://ift.tt/eCcqtSa @blueteamalertsNational Cyber Security CentreOne does not simply defend agenticallyDefenders can’t use AI in the same way attackers can, but there’s much they can do to unlock the potential of agentic cyber defence.Blue Team Alerts
22 Sept, 06:17
cryptoptic: The cryptoptic open-source project - uses CodeQL and GitHub Actions to scan a repository or an entire GitHub organisation and produce an inventory of every cryptographic function in use, the library it comes from, and where it is called. https://ift.tt/51DvptKDiscuss on Reddit: https://ift.tt/DHRUaOK @blueteamalertsGitHubGitHub - nationwide-group-oss/cryptoptic: The cryptoptic open-source projectThe cryptoptic open-source project. Contribute to nationwide-group-oss/cryptoptic development by creating an account on GitHub.Blue Team Alerts
22 Sept, 06:17
Struggling with noisy cloud security alerts in a hybrid zoo and my brain is the SIEM Hi, cloud security lead here whose entire personality rn is just clicking dismiss on alerts.We have this lovely hybrid setup, part aws and gcp, part on prem stuff that refuses to die, plus every vendor swearing their CNAPP and sensors and fancy ai will magically "reduce alert fatigue". Reality is my SecOps team gets a wall of "medium" and "suspicious" every hour and we all just play vibes roulette to figure out what is real.Runtime alerts from containers, identity weirdness from non human accounts, some ancient vm screaming about an old vuln, then our ai workloads start lighting up because apparently everything is "anomalous" when you run training jobs at night. Half the tools have zero context, just "this looks bad you deal with it" and I am lowkey tired of being the correlation engine with a coffeeRedditFrom the blueteamsec community on RedditExplore this post and more from the blueteamsec community
Related Channels
Other channels in the same section of the catalogue.
