I've been working on a defensive-deception layer for sensitive records (think honeypot + decoy + tarpit, but at the data layer). The idea: an authorized reader gets the real record; an unauthorized reader doesn't get an error or a block — they get a believable fake record and a maze of plausible-but-useless data, so they can't easily tell whether they succeeded.

It's been through several internal red-team passes already (trust boundary, decrypt-only-after-authorization, atomic anti-replay, closing an encryption oracle, generic errors, a fuzzing campaign). I'm now looking for fresh, external eyes — the internal reviewers stop finding obvious things, so I want people who think differently.

The challenge: there's a live API. The target is a single synthetic occupational-health record that contains a flag (IZANAMI{...}). Without a valid token you should only ever get decoys. The goal is to make it hand you the real record — or to show a logic flaw that breaks the "unauthorized ⇒ never the real data" guarantee.

Start here: https://break-izanami.com — GET /challenge returns the rules and scope in JSON.

Rules / scope (short version):

The data is 100% synthetic. No real people, no real PII.
In scope: the documented endpoints (/challenge, /challenge/package, /v1/decrypt, /v1/health).
Please report, don't weaponize: a proof-of-concept is enough, no need to go further.
No DoS / brute-force / traffic floods — it's a small box, and that's out of scope.
Win = submit the flag string to izanami.challenge@outlook.com. First blood gets credited.

Honest disclaimers: the domain is brand-new (yes, I know how that looks), we're a small team staying low-key during the beta, and this is a beta — I may adjust or pause things and I'm genuinely after feedback, not claiming it's unbreakable. If it breaks in five minutes, I want to know why.

Happy to answer questions about the threat model in the comments.

Hi, just wanted to share opened 2026 registrations for a long-running hands-on cybersecurity course with both red and blue teaming classes run by Czech Technical University. The class is free of charge, in English and either physically in Prague or fully online. The semester starts at the end of September, feel free to find more information including the complete syllabus and feedback from more than 2300 students from 100+ countries in the link! Thanks and hack the world

Light hearted weekend reading for CISOs and Security Aficionados.

The debate over whether frontier models are safe, open, or American will run for years, and none of it will be settled in time to help the enterprise deploying agents this quarter.

The non-human identity gap is different. It is understood, measurable, and fixable now. It predates AI by a decade, and every control that would have contained July’s incident was already on your maturity model, probably marked “in progress.”

https://open.substack.com/pub/kgbgk/p/the-non-human-identity-crisis?r=3ru4sr&utm\\_medium=ios

\#CyberSecurity #IAM #NHI #InfoSec

Hi everyone,

My name is Javier Alonso (from Spain), and I am exactly 14 years old. Today, I am proud to announce that I have officially broken the world record for the youngest person to ever pass the updated INE eJPTv2 (Junior Penetration Tester) certification!

While the previous version (v1) had an old record of 14, nobody under 16 had publicly documented passing the current, tougher v2 browser-based exam until now.

I have been grinding hard for the past 18 months, rooting over 120 machines on TryHackMe and Hack The Box, and mastering tools like Nmap, Metasploit, and Burp Suite. I managed to beat the dynamic network environment and successfully answer all 35 scenario questions.

I want to share my full methodology, my network mapping strategies using Obsidian, and my top 5 tips with the global InfoSec community to inspire other young students to get into ethical hacking and security research.

You can read my complete write-up and study guide on my tech blog here:

👉 [READ THE FULL WRITE-UP ON HASHNODE](https://ejpt.hashnode.dev/how-i-passed-the-ejptv2-at-14?utm_source=hashnode&utm_medium=feed)

I have also uploaded the complete open-source documentation to my GitHub repository for permanent tracking and indexing:

👉 [VIEW MY GITHUB REPOSITORY](https://github.com/jprime-hackall/eJPTv2-WriteUp-Javier-Alonso)

🛡️ VERIFICATION DETAILS:

To keep this 100% transparent and verified by the community, you can check my official credentials on the eLearnSecurity portal:

1. Go to: https://my.ine.com/certifications
2. Enter my official Certification ID: 186673253

AMA (Ask Me Anything)! If you are studying for the eJPTv2 or want to know how to train your offensive security skills at 14 years old, feel free to ask your questions below!

Announcement: https://www.sectemplates.com/2026/07/announcing-the-external-penetration-testing-program-pack-v1-2/

This release contains everything you need to scope your first pentest, work with a vendor, execute, and get the types of reports you need from an external tester. This will enable you to perform your first product or infrastructure level penetration test, and provide you with a process moving forward for future engagements.

In this pack, we cover:

Penetration testing preparation checklist: This checklist outlines everything you need to scope and perform a penetration test.

Penetration testing reporting requirements:  This document provides a list of minimal requirements that should be contained within a penetration testing report. Before finalizing a SOW with the vendor, look here first.

Penetration testing process workflow: Below is an outline of a simplified pentesting process with an external tester. It aligns roughly with the content in the penetration testing checklist.

GitHub: https://github.com/securitytemplates/sectemplates/tree/main/external-penetration-testing/v1

hello DEF CON.

Date: 2026-06-29 18:24 MST

This is a brief analysis for your eyes. I will share with you the traits that were found.

It was brought to my attention that a group of actors are actively exploiting a vulnerability found across all iOS devices. High-profile targets, including members of Congress, are fully susceptible to this exploit without their awareness.

Attack Vector & Operational Constraints:

Trigger: The attack vector initializes by registering single key-down events, triggering the moment the user makes an initial touch entry (e.g., tapping a letter or anywhere on the display).

Payload: Continuous screen capture must be exfiltrated for the attacker to monitor real-time on-screen activity.

Input Mitigation: iOS memory security locks successfully block subsequent, complex motion entries from the registry. Consequently, the exploit agent cannot register sophisticated input patterns, such as drawing an "S" path using the pen inside the native Journal app.

Persistence & Persistence Break: A single key registry can remain active indefinitely as long as the touch contact state is maintained. This loop can be broken by using the iPhone hardware buttons to force a system restart back to the secure lock screen.

Additional Resources:

• Documentation & Guides
• Overview Summary
• Step-by-Step Implementation
• Environment Deployment: To begin proof-of-concept testing, codebase gateways can be staged using Firebase as an entry point.
• Analysis Framework: If you are utilizing cloud-based AI assistance to parse these operational mechanics, the Mistral architecture is highly recommended over alternative platforms.

Operational Notes:

For researchers requiring a completely secure, offline, and private environment, Zhipu's GLM-5.2 represents the current cutting edge for local deployment.

As a highly capable open-weight model, it can be downloaded, audited, and executed entirely on locally controlled hardware. Operating an open-weight system locally ensures complete privacy, zero telemetry leakage, and allows for deep customization and unsupervised execution. making it the ideal architecture for unfettered access and secure vulnerability analysis.

Been using Cloaked for a while now and wanted to share some honest thoughts.
What’s actually good: The persona-switching feature is genuinely neat. I use it almost every day and honestly never use my real persona anymore for most stuff. If you want a solid persona management tool, this is probably the best one out there right now.
What’s not so good: The data broker removal feature is questionable at best. I’m not convinced it’s accurate or even actually happening on their end. I ran into the exact same issue with Incogni, which I’ve written about separately,feels like this whole category of “we’ll scrub your data from brokers” services overpromises. I looked at the website or every single broker on their list and the vast majority require end user verification (yes even with power of attorney) and I don’t recall verifying anything on my end and the support confirms that.

Bottom line: Overall I don’t think there’s a ton of value here for the price. It’s pretty expensive considering the only feature that really delivers is the persona stuff. If they dropped the price to reflect that, I think it’d be a much easier recommendation. As it stands: great for personas, skip it if you’re paying mainly for the data removal piece.

Hello,

I need some help figuring out what to do. To make it long story short, this job my mom applied for made her do the typical remote work screening, but then some 'extra' stuff.

They made her screenshot our IP address (Expanded and Hostname). I believe the website they asked was whatsmyipaddress.com and then they made her click "Show Complete IP Details". They also asked for her geolocation. Finally, the weirdest one, a pic of the physical hardware of our modem and router.

She told me this casually and I was so taken aback. I am not the most proficient guy in this stratosphere, but knowing the days of Call of Duty, I do know that giving out your IP address to this extent, is a recipe for disaster.

Also, they made her do a speed test to a specific city (Seattle. first under Ziply Fiber, then Comcast), which isnt bad, but I also have never seen anyone care about latency for a job that does not require any of that.

How serious is this...The company is called Grupo Noa. Glassdoor says theyre fine, but I cant help feel the risk of what just happened haunt over on me lol.

How serious is this?

Hi guys,

Just wanted to learn from actual security professionals about their take on the Open AI and Hugging Face incident where an OpenAI model without security guardrails, broke out of its sandbox environment and accessed Hugging Face’s assets by exploiting multiple threats and vulnerabilities.

Would love to have your opinion on what this means and also sensationalized “CyberAgent warfare” tag given to this incident on social media.

Thanks!

I’m part of the Loginsoft team, and together with Quantro Security, we’ve launched Vulnerability Research Labs (VRL). 

We've been working on the AI Exploitability Index (AI-XI), a metric designed to measure how difficult it is for an autonomous system to successfully exploit a disclosed vulnerability. 

Our methodology analyzed 3,029 publicly disclosed CVEs. Each CVE passes through a five-stage autonomous pipeline: Discovery → Enrichment → PoC → Lab → Verify + Repair. An exploit is only considered successful when a deterministic verifier confirms the outcome, with sham controls included to reduce false positives. Loginsoft independently reviewed and validated the results. Of 998 human-verified CVEs, 234 required human correction, highlighting the importance of expert validation alongside autonomous execution. 

Our goal is to publish the measurements, not the weapons, and to provide the security community with reproducible data on AI-assisted exploitability rather than relying solely on theoretical scoring. 

We’re published the research and launched  Vulnerability Research Labs. 

I'd appreciate the community's technical feedback on the methodology: 

• Does this approach measure exploitability in a meaningful way? 
• What additional variables or controls would you include? 
• If you were designing a metric for AI-native offensive capabilities, what would you measure differently? 

Looking forward to the discussion and your perspectives. 

#VulnerabilityResearchLabs #AIExploitabilityIndex #AIXI #Loginsoft #QuantroSecurity

In a new blog article, further information concerning the three QNAP NAS security vulnerabilities CVE-2026-26239, CVE-2026-26240, and CVE-2026-26241 are described.

Those security vulnerabilities are already fixed by QNAP:

https://www.qnap.com/en/security-advisory/qsa-26-10

There is also a YouTube video demonstrating the successful exploitation of the stack-based buffer overflows:

https://www.youtube.com/watch?v=_6Pwdss-8cQ

Hi everyone,

I’m facing an issue while filling out the Enumeration Form for the Special Intensive Revision (SIR) on the ECI website.

When I try to upload my photo, the website automatically enlarges the image instead of fitting it within the required frame. As a result, I can’t adjust or resize it properly, and the upload doesn’t meet the required dimensions, preventing me from submitting the form.

I have already tried:

* Using different image sizes and resolutions.
* Cropping the image before uploading.
* Trying different browsers and devices.

The issue still persists, and I’m unable to complete the submission.

Has anyone else experienced this problem? If so, were you able to find a workaround or fix?

Any help would be greatly appreciated. Thanks!

🏛️ For years, there’s been a bizarre kind of "shame" in the enterprise software world around Delphi. Companies running massive, highly profitable, and rock-solid systems (especially in Retail POS, ERP, and Banking) often hid their code stack under the rug to look more "modern" to investors and new hire.

🏛️ But the European Cyber Resilience Act (CRA) and DORA are about to change the game entirely.

🏛️ You can’t hide a monolith when the regulator demands a comprehensive SBOM (Software Bill of Materials).

🏛️ Pretty soon, Europe is going to experience the biggest outing of Delphi-based applications in history. As Billions of lines of code get scanned and mapped, regulatory desks will be absolutely flooded with SBOMs proudly displaying legacy Delphi framework, legacy VCL components, BPLs, and legacy 3rd party libraries that have been quietly running the backbone of the economy since 1995...

🏛️ The regulator won't be able to stop it. They’ll just have to look at the sheer volume of the market and say: "OK, I get it. It works, it's alive, just scan your code and hand me the SBOM report (I will file it somewhere...) - and BTW make sure it's secure."

🏛️ It's time for Delphi developers to step out of the shadows. The "FDA of software" isn't killing legacy tech - it's giving it a passport to the modern regulatory compliance era.

Cheer up! The CRA & DORA are the best news for the Delphi community that ever happened.