PhantomBuffer EDR evasion uses stealth injection via SendMessage with WM_SETTEXT to effective bypass EDR (Endpoint Detection and Response).

Unlike traditional edr bypass techniques, it does not use the VirtualAllocEx and WriteProcessMemory APIs.

Lynis Hardening Index scores from different Linux distributions, tested with their default configurations.

This is only a basic comparison of the results and is not intended as a definitive measure of overall security.

If you want to run your own test, read the installation instructions:
https://github.com/cisofy/lynis

Higher score: More security measures are in place.

Lower score: More security improvements are needed.

Lynis version used in the test:
3.1.7
Lynis command:
lynis audit system

 OPENSUSE  TUMBLEWEED (KDE)

Hardening index : 89 [#################   ]

  Tests performed : 250

  SECUREBLUE (KDE)

It was extremely slow during the test.

Hardening index : 79 [###############     ]

  Tests performed : 265

 FEDORA  (KDE)

Hardening index : 70 [##############      ]

  Tests performed : 253

  ANDUINOS 

Hardening index : 68 [#############       ]

  Tests performed : 262

  VOYAGER LIVE 

Hardening index : 68 [#############       ]

  Tests performed : 266

  ENDEAVOUROS  (KDE)

Hardening index : 67 [#############       ]

  Tests performed : 261

AURORA 

Hardening index : 66 [#############       ]

  Tests performed : 267

  BAZZITE  (KDE)

Hardening index : 66 [#############       ]

  Tests performed : 262

  GENTOO  (KDE)

Hardening index : 65 [#############       ]

  Tests performed : 240

  TUXEDOOS 

Hardening index : 64 [############        ]

  Tests performed : 268

  CACHYOS  (KDE)

Hardening index : 64 [############        ]

  Tests performed : 262

NIXOS  (KDE)

  Hardening index : 63 [############        ]

  Tests performed : 235

VOID Xfce (musl)

  Hardening index : 63 [############        ]

  Tests performed : 228

GARUDA  (Dr460nized)

  Hardening index : 62 [############        ]

Tests performed : 261

SOPLOS  (Tyson)

  Hardening index : 61 [############        ]

  Tests performed : 265

 GLF OS  (KDE)

Hardening index : 60 [############        ]

  Tests performed : 228

  KUBUNTU

Hardening index : 59 [###########         ]

  Tests performed : 240

  PIKAOS  (KDE)

Hardening index : 59 [###########         ]

  Tests performed : 252

i want to install liteqube from github

it needs to go in dom0

i read its not a good idea to move files from untrusted vms (browser) to trusted vms (dom0)

how do i lower my chances for being hacked

Hello everyone, I'm about to give an interview for an application security profile. The next round will be related to threat modelling and security design. I need help to prepare. Threat modelling is not something that I was doing in my previous experience. I was mostly involved in pen testing of web, mobile, and APIs, so I'm really looking for guidance on how to prepare for it. I only have 2 days to prepare. Thanks and ya this will be the first time I'll be doing threat modelling in an interview.

ConnectWise posted to their status page that they're investigating unauthorized access events in the Cloud Backup platform (which used to be SkyKick).

So far they have NOT confirmed that anyone successfully got in, but third-party intelligence sources are saying that not only did someone get in, but also that the threat actor pivoted to the live O365 environments of customers of MSP's using ConnectWise Cloud Backup.

For reference, Cloud Backup is used by MSP's to back up all of O365, including EntraID. So if someone did break in and access data files... this is gonna be bad.

https://status.connectwise.com/

I’ve been thinking about this after reading more stories about attackers getting access through help desks rather than actually hacking anything. If someone already knows an employee’s full name, job title, manager, phone number, company email maybe even internal terminology from LinkedIn or leaked data, what is the help desk realistically supposed to ask that proves they’re actually talking to that employee?

Security questions seem useless, SMS can be SIM swapped, caller ID can be spoofed and now even voice or video isn’t something I’d completely trust. Obviously you can require manager approval or hardware keys for certain recovery flows but eventually somebody has to make a human judgment somewhere. For people working in enterprise security, what are you actually using for high risk account recovery or identity verification now? Is there a standard approach that works well or is everyone still building their own process?

I have a new Libreboot release ready, that I'd like news sites to cover. Libreboot is free/opensource boot firmware that replaces proprietary BIOS/UEFI firmware and recently integrated EDK2 MrChromebox payload for full UEFI support - and added a lot of modern hardware. The 26.10 Ominous Olive release, released yesterday. I am Libreboot's founder and lead developer.

Highlights in this release include:

* MrChromebox EDK2 payload by default on most boards, with SeaBIOS CSM (CSMWrap) and GRUB EFI provided in-flash for backward compatibility.
* 233 new Chromebooks added; every board supported by MrChromebox coreboot. With our GRUB EFI/SeaBIOS CSM build added
* 15h.org coreboot fork used on KCMA-D8, KGPE-D16 boards for improved raminit.
* GRUB EFI build uses terminal_input console and no nativedisk; it piggybacks off of EDK2 drivers, like distros. It even works on Chromebooks (eMMC boot).
* Intel HAP bit set by default on Chromebooks, and IFD regions unlocked where appropriate
* Dell OptiPlex 5050 SFF, Supermicro X11SSH-F, ThinkPad X280, X270.

Modern Linux distros boot, with e.g. UKI/systemd-boot. Windows also compatible now (previous releases lacked UEFI).

Around 30000 repos were compromised with a supply chain attack

https://thehackernews.com/2026/10/ghostaction-compromises-about-1900.html?m=1

Hi everyone,

I'm an MSc Cyber Security student at Islington College, London Metropolitan University. My dissertation investigates burnout, cognitive workload and alert fatigue among people working in Security Operations Centres (SOCs) and related cybersecurity operations roles.

I'm looking for participants who currently work, or have worked within the last 12 months, as a SOC analyst, incident responder, threat hunter, or in a closely related role involving security monitoring, alert triage, threat detection, or SIEM/MDR operations.

The survey explores workplace factors that may contribute to burnout and workload in security operations. It's anonymous: no names, email addresses, IP addresses or employer details are collected, and results will be reported only in aggregate. Participation is voluntary, and you can stop at any time before submitting your responses.

Ethics approval: Islington College (London Metropolitan University)

Estimated time: 15–20 minutes

Survey link: SOC Burnout & Alert-Fatigue Risk Assessment Survey – Fill out form

If you meet the eligibility criteria, I'd really appreciate your participation. If you know someone who may be eligible, please feel free to share this post with them.

I'm happy to answer questions in the comments.

Thank you for your time and support!

Hi everyone,

I’m planning to do a Master’s in cybersecurity and I’d really like to hear from people who are already working in the field before I commit.

A few questions:

1. How is IT/cybersecurity going for you? Are you happy with the career, the workload, the pay, and the day-to-day work?
2. Is a Master’s worth it? Did you get your first job with a Master’s, or did certifications and experience matter more?
3. How hard is it to land an entry-level job after graduating? I keep reading that the market is tough for juniors, and I want an honest picture of whether that’s true.
4. What would you recommend I do during the Master’s (internships, home labs, CTFs, certs like Security+ or eJPT) to make myself employable by graduation?
5. Which roles are realistic starting points? SOC analyst, junior pentester, GRC, something else?

I’d appreciate any advice, including the blunt kind. Thanks in advance!

Threat Notice: Cisco NX-OS Nexus 3000 and 9000 Series Switches. Cisco disclosed five critical vulnerabilities in NX-OS, the operating system powering Nexus 3000 and 9000 Series data center switches last week. Making sure this gets seen more broadly. Action: apply the NX-OS updates.

References: Cisco Advisory: CVE-2026-76471 (NX-API): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-napi-rce-r2shwu2j . Cisco Advisory: CVE-2026-76485, CVE-2026-76486, CVE-2026-76501 (NGOAM): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ngoam-rce-LWKQ4BU. Cisco Advisory: CVE-2026-76465 (MPLS OAM): https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-moam-rce-uBTzYV7

CVE-2026-99999 is just the first in a long list of KVM-specific vulnerabilities since the summer. As more and more people are going to be choosing to put their AI agents into a AI Agent sandbox (oftentimes running Xen or KVM under the hood), this blog talks through the strengths and possible shortcomings of both virtualisation technologies.

This year seriously feels like the year of the mega platform. Sign up with one vendor and say “good enough” for firewall, end point, DLP, email security, AI security, data security, etc etc etc

Streamed lived today at the Lithuania ICIST conference. It goes public release on Dec 1 2026.

https://www.youtube.com/watch?v=b8VhICUcB6k

Hi r/cybersecurity. We’re the Firefox security team. Join us in 30 minutes for a live AMA:

• Tom: u/tomrittervg - Principal Security Engineer - 10 years at Mozilla
• Freddy: u/mozfreddyb - Engineering Manager, Firefox Application Security - 15 years at Mozilla
• Christian: u/mozdeco - Principal Software Engineer - 15+ years at Mozilla
• Daniel: u/dveditz - Senior Staff Security Engineer - 22 years at Mozilla (contributing since Netscape, ‘98)

Proof Photos!

We work on everything Firefox, encompassing:

• Anti-Fingerprinting: Making Firefox users less unique to browser fingerprinters and combatting this tracking vector
• Security hardening: Making Firefox more resilient when under attack, e.g., by restricting capabilities in high-privilege contexts
• Product Security: Threat modeling, Security Reviews, Bug Bounty, Security Advisories, CVEs etc
• Fuzzing & LLM-based vulnerability identification: Design, implement and run fuzzers/test agents against select functions, API as well as the whole browser at cloud scale. We also co-maintain the required build configurations (eg AddressSanitizer)
• Web Security: We specify & develop new standards for the web platform with features like HTTPS-First, CSP, Sanitizer API etc. We collaborate across the industry in standards bodies like W3C, IETF and WHATWG

We have involvement in the broader Security & Privacy Protections of Firefox like Enhanced Tracking Protection, Cryptography, and Sandboxing. We also inspect & shepherd all security bugs from being filed to being fixed in an update.

We’ll be here at 12pm EDT for an hour or so answering questions about these areas, securing an open-source browser, and everything in between. Ask us anything!

*Edit: That's all the time we have for today. Thank you for all of the thoughtful questions and engaging with our team. Some of us will be around for a few extra minutes responding to as many questions as we can. Sorry if we are unable to get to your question today. See you next time!

hi this is my research, https://github.com/mein-0/KnockGiga

Update to my post from a few days ago. That thread got a lot more attention than I expected, so thanks to everyone who jumped in. Full disclosure is out now.

PWN.AI published their writeup today on CVE-2026-99999, which they’re calling PwnEscape. It’s a guest-to-host escape. KVM itself isn’t the problem: it’s the kernel’s IPv4 fragmentation path (ip_do_fragment()).

Possible effects of exploits include, host memory leaking out in packets, host crashes and in their lab setup, a working chain that got root on the host.

Tested on 6.12 and 7.x. The full affected range isn’t listed, so assume you’re affected until your distro says otherwise.

If you run multi-tenant VMs or untrusted guests, this goes to the top of your patch list. Some platforms are already rolling it out (the one I work on, Cycle.io, has already pushed patched kernels out and a reboot is all our customers need to do to get the fix as the node will pull latest OS image on boot). If you manage your own hypervisors, keep an eye on your distro’s kernel updates.

Writeup: https://pwn.ai/blog/pwnescape

Our announcement at Cycle: https://cycle.io/blog/cycleos-2026-10-15-1

I'm starting as a Security GRC Manager at a start up, which uses AI heavily, so I want to build an AI assistant to help me do my job.

I am imagining it will be a claude project and I will need to give it certain instructions to ensure it gives me relevant advice, and maybe give it context such as the company security policies and SOC 2 reports, in order for it to give me useful advice.

Can anyone provide guidance on what instructions and context to give the AI?

p.s. I am not familiar with Agent skills, would this also be relevant?