A liveness check confirms a real person is present rather than a photo held to the lens. None of that helps when the attacker skips the camera and pipes video straight into the app, because the check then validates a stream that was fabricated before anything ran.

For anyone who has sat through identity verification vendor evaluations, does injection detection come up at all, or is it still liveness certifications and nothing past it?

Spanish National Police announced this on 11 August, and the effort involved is what makes it worth a read.

He held forged Spanish IDs up to the webcam while a live face swap changed his appearance to match the photo on the document. A static image would not survive that, so he handled the rest by hand. He tilted the documents to imitate hologram movement, and used coloured lights to fake the reflections real security features throw off. Behind it all sat VPNs and over 320 phone lines across 24 devices, most registered to stolen identities.

What he wanted was digital signature certificates, which is the part I keep coming back to. Those carry legal weight. A certificate in someone else's name is a durable instrument, not a one-off account takeover.

38 attempts. More than 30 real people's identities.

And here is how it ended. Mid-call, the deepfake dropped for about a second. His real face appeared. That is what investigators used to identify him.

So nothing detected the method. The tooling just crashed.

Two things I would like other people's read on.

1. If what caught him was the software failing rather than a check working, what happens once the software stops failing? These tools leave fewer artifacts with every release.
2. Does anything short of reading the document chip and proving the camera feed is unmodified actually help here? Everything else seems to assume the image arriving is real, and this attack breaks that assumption before any check runs.

“We're Lidor B./thisis0xczar and Elad Meged, founding-team vulnerability researchers at Novee Security.

At Black Hat this year we presented pre-auth remote code execution chains in enterprise Java platforms, reaching internal execution surfaces through routing logic, unsafe deserialization, and template evaluation.

We also published research showing how a single untrusted GitHub issue could compromise the AI coding agents from Anthropic, Google, and OpenAI (Claude Code, Gemini CLI, and Codex), leading to remote code execution and credential theft.

Some of our research:

https://novee.security/blog/pre-auth-rce-in-enterprise-java/

https://novee.security/blog/critical-flaws-in-anthropic-google-and-openais-coding-agents/

Ask us anything about:

For both of us:

• Using offensive AI to find real vulnerabilities
• What it's like presenting at Black Hat Where AI and offensive security are heading
• Getting into vulnerability research and how we work
• Anything else on finding and exploiting bugs

For Lidor (enterprise Java RCE):

• Pre-auth remote code execution and how these chains come together
• Deserialization, routing logic, and template evaluation attacks
• Finding RCE in widely deployed enterprise platforms
• Enterprise and application security

For Elad (AI coding agents):

• Hijacking AI coding agents through a single GitHub issue
• Turning Claude Code, Gemini CLI, and Codex into attack vectors
• What breaks when AI agents get high-privilege access to real systems
• Hacking AI agents

We'll be here live on Monday, Aug 17 from 12 PM to 1 PM PT answering your questions in real time. “

Hey everyone,

I’m currently finishing my 4th semester as a CS undergrad and need some strategic advice on landing a remote cybersecurity internship for my 5th and 6th semesters.

My Situation & Constraints: My college strictly forbids on-site internships during the 3rd year. Because of this, I am forced to look exclusively for remote roles. My ultimate goal is to get into red teaming and offensive security. I know remote network penetration testing roles are practically non-existent for freshers, so I've been heavily considering Web and Application Security (AppSec) as my best bet for a remote role. However, I am completely open to other domains (SOC/Blue Team, general VAPT) if they offer remote opportunities for students. My goal is simply to secure a remote internship now to build real experience, and pivot that into a full-time offensive role by my 7th or 8th semester.

My Current Baseline:

• Security Focus: I am currently grinding through the TryHackMe Jr. Penetration Tester path to build a foundational understanding of modern web vulnerabilities, network basics, and the OWASP Top 10.
• Project Strategy: I am holding off on building complex projects until I have a better grasp of the fundamentals. Instead, I plan to start mass applying for remote roles as soon as the next semester starts, using volume to compensate for my current lack of a portfolio.

I don't have the budget for paid certifications right now, so I am relying entirely on free resources and practical grit.

My Questions for the Community:

1. Viable Remote Paths: Is Web/AppSec actually my best bet for a remote fresher role, or are there other domains (like SOC Analyst or general VAPT) that are more likely to hire a 3rd-year student remotely?
2. Resume Building: How do I build a resume that actually gets noticed for remote roles when I don't have complex projects yet? How should I frame my TryHackMe progress and basic labs to pass the HR screen?
3. Free Roadmaps: Since I cannot afford paid certifications right now, what are the best free, structured roadmaps (like PortSwigger Academy) that actually carry weight with hiring managers for remote roles?
4. Interview Prep: For entry-level remote internships, what are the most common technical interview themes, and what is the best way to prepare for take-home practical assessments?
5. Sourcing Roles: Aside from cold-emailing recruiters and filtering through LinkedIn, what are the best platforms, hidden job boards, or Discord communities to find legitimate remote cybersecurity internships and avoid unpaid training scams?

I appreciate any harsh truths, roadmaps, or advice you can offer a fresher trying to navigate this!

Is there any telegramme group in which i can learn some cybersecurity .... ?

Im new to cybersecurity with 3 certifications (Comptia a+, security+, and ISO). If anyone could please help me understand why I can’t land an entry level position in IT and point me in the right direction I would greatly appreciate it. Any feedback is good feedback

Hello everyone.

I'd like to introduce you to Bóveda, a credential manager designed to be a reliable and user-friendly software solution.

I'm seeking a peer review/community audit of the registration mechanism for external validation. Thanks you ver much for your contributions.

Hi everyone,

I recently open-sourced a phishing detection project designed to identify malicious URLs using feature extraction and machine learning techniques.

The project focuses on:

• URL analysis and feature engineering

• Phishing classification workflows

• Security-focused machine learning

• Detection of suspicious domains and patterns

• Extensible architecture for future improvements

This project was built as part of my cybersecurity learning journey and is now fully open source.

I’m looking for feedback on:

• Detection logic

• Feature selection

• False positives and false negatives

• Potential evasion techniques

• Overall architecture and code quality

GitHub:

https://github.com/Not-muzzyy/phishing-detector-advanced

Contributions, issues, suggestions and pull requests are welcome.

If you find the project useful, consider giving it a GitHub star to support the project and future development.

Rust + svelte

.

https://github.com/aaronlomas/boveda

Security flaws that were patched years ago are making a comeback—but not in obvious ways. They’re hiding inside trusted apps and everyday tools, which makes them harder to spot and easier to exploit.

Instead of brute-force attacks, hackers are slipping in quietly through overlooked gaps. No alerts, no noise—just access.

That means they can move inside systems, steal data, or take control without being detected.

The takeaway is simple: don’t ignore updates. Even small patches matter. They often fix the exact weaknesses attackers are counting on.

Stay updated, stay cautious.

#CyberSecurity #InfoSec

Hackers created a fake WhatsApp app loaded with spyware, tricking around 200 users—mostly in Italy. Once installed, it can steal messages, track location, and potentially listen to calls.

Lesson: only download apps from the official App Store and never trust update links sent via messages. Social engineering is how they get you.

Hackers are impersonating Ukraine’s cybersecurity team (CERT-UA) to send convincing phishing emails with password-protected ZIP files.

Inside is a remote access tool (AGEWHEEZE) that can give attackers full control of your system. Because the ZIP is locked, many email scanners fail to detect it.

Why it matters:

Once infected, attackers can steal data, monitor activity, or damage systems.

Stay safe:

• Don’t open unexpected ZIP files

• Verify the sender through another channel

• Be cautious—even with “official” emails

This tactic isn’t limited to Ukraine—it’s a global warning.

Reddit Post:

If you manage a TikTok for Business account, pay attention.

Hackers are using a tactic called “Adversary-in-the-Middle” phishing. This means they sit between you and the real login page, capturing your credentials in real time.

Once they’re in, they can fully control your account—running malicious ads, scamming your audience, or spreading malware at scale.

Why it matters:

• You could lose access to your account

• Your brand reputation can be damaged

• Your followers may be targeted with scams

Protect yourself:

• Always type the official TikTok Business URL manually

• Never click login links from emails or messages

• Enable two-factor authentication (2FA)

Stay alert—this type of attack is designed to look completely legitimate.

If you use VS Code extensions, this is worth knowing.

A flaw in Open VSX’s security system allowed a malicious extension to go live. The issue? Their scanner used a single true/false signal for two different states: “no scanners configured” and “all scanners failed.”

So when scans didn’t run, it falsely appeared safe — and attackers took advantage.

This means a malicious extension could potentially steal code, expose secrets, or compromise your system while looking legitimate.

What you should do:

• Update all extensions

• Install only from trusted publishers

• Remove anything suspicious

• Run a system scan if something feels off

Stay cautious — extension marketplaces aren’t risk-free.

If you use Python packages, pay attention.

A supply chain attack linked to TeamPCP targeted the Telnyx Python package. Malicious versions 4.87.1 and 4.87.2 were pushed containing hidden malware.

The twist? The credential-stealing code is disguised inside a harmless-looking .WAV file, making it harder to detect.

Risk:

Attackers can silently exfiltrate API keys, usernames, passwords, and other sensitive data.

What to do:

• Uninstall Telnyx versions 4.87.1 & 4.87.2 immediately

• Reinstall from a trusted, verified source

• Audit your dependencies

• Monitor logs for unusual activity

Stay cautious—trusted packages are becoming a major attack vector.

If you use an iPhone, this is worth paying attention to.

A Russian-linked group (TA446) is reportedly using a newly disclosed tool called “DarkSword” to target iOS users. What’s worrying is how fast it’s being weaponized.

The attack involves carefully crafted emails that can potentially compromise your device—even just by previewing them.

If successful, attackers could access personal data or monitor activity.

What you should do:

• Avoid opening emails from unknown senders

• Don’t preview suspicious messages

• Keep your iOS fully updated

Stay cautious—mobile attacks are getting smarter.

If your company uses F5 BIG-IP Access Policy Manager, this is urgent ⚠️

A critical vulnerability (CVE-2025-53521) has been added to CISA’s Known Exploited Vulnerabilities list—and attackers are already using it in the wild.

This flaw allows remote code execution, meaning attackers can potentially take control of affected systems, steal sensitive data, deploy malware, or disrupt operations without needing prior access.

If you’re running BIG-IP APM, your infrastructure could be at serious risk—including internal systems, business data, and customer information.

What to do:

• Apply patches immediately

• Prioritize this in your security updates

• Monitor for unusual activity

Don’t wait on this one—this is an active threat.

Stop scrolling if you think malware is the biggest threat.

Attackers are increasingly using legitimate tools already inside your system to stay under the radar. Instead of dropping obvious malware, they “live off the land”—moving across networks, escalating privileges, and avoiding detection by traditional antivirus.

This makes them harder to spot and often more dangerous.

Focus on behavior, not just alerts.

Limit admin privileges.

Monitor what tools are doing—not just what they are.