Category: Interesting Stuff

This week’s Cybersecurity Pulse covers runaway AI coding agents that deleted production data at PocketOS and the governance gaps that enabled the blast radius, alongside major incidents and high‑severity vulnerabilities such as a DPRK-linked $577M crypto theft by Citrine Sleet and critical flaws in cPanel and GitHub. It also highlights defensive wins and industry moves—Azure AD Graph logs landing in Sentinel, Rippling’s Automated Compliance and AJ Yawn joining, CrowdStrike extending OverWatch to Microsoft Defender, and OpenAI’s passkey‑only Advanced Account Security—urging continuous threat modeling and AI agent governance for CISOs and security teams. #PocketOS #CitrineSleet

Garak is NVIDIA’s open-source LLM vulnerability scanner that automates hundreds of attack probes—prompt injection, DAN-family jailbreaks, encoding bypasses, data leakage, toxicity, and more—against any model reachable via common APIs. It runs repeated generations, scores responses with detectors, and outputs structured JSONL reports so teams can map vulnerabilities and prioritize fixes. #Garak #NVIDIA

Offensive AI exemplified by Anthropic’s Claude Mythos and early GPT-5.5 testing is compressing attackers’ discovery and exploit timelines, enabling autonomously executed corporate network takeovers in a fraction of the time a human would need. Security teams must shift to continuous investigation, continuous detection evaluation, and hunt programs that reason about first-party exposure to operationalize context and keep pace; #ClaudeMythos #GPT5.5

Having the right cybersecurity skills won’t get you hired if your resume fails to communicate them clearly. A hiring Cybersecurity Manager explains that four specific resume mistakes routinely push qualified candidates into the reject pile—one of those is a surprising habit that applicants often think makes them look more qualified. #Resume #CybersecurityManager

Anthropic’s Mythos AI has rapidly discovered and enabled exploits for thousands of vulnerabilities across major operating systems and browsers, revealing risk at a scale far beyond current discovery processes. Its combination of fast vulnerability discovery, automated exploit creation, and vulnerability chaining threatens to overwhelm defenders and critical infrastructures unless organizations rapidly adopt AI-driven defensive measures. #Mythos #Anthropic

This article provides an end-to-end Metasploit-based walkthrough showing how an attacker can chain thirteen Active Directory attack phases to escalate from a low-privileged user to full domain compromise on a Windows Server 2019 environment. Each phase includes exact Metasploit commands, module output, and a mapped mitigation playbook that defenders can use to neutralize primitives like certificate template abuse, RBCD, Kerberos ticket forging, and Golden Ticket attacks. #Metasploit #GoldenTicket

Phishing has matured to the point where it can deceive both users and legacy email defenses, often acting as the initial access vector for longer ransomware campaigns that move laterally before triggering disruption. Stopping these attacks requires modern email security that detects malicious intent and a strong BCDR strategy to restore operations without paying attackers. #GoogleDrive #Datto

This article argues that choosing the right cybersecurity career path matters far more than accumulating certifications, and that certifications should support the path, not define it. It recommends practical, path-aligned credentials—like eJPT → PenTest+ → OSCP for offensive roles, Security+ → CySA+ for SOC, cloud-specific certs for cloud roles, CRISC/CISM/CISA for GRC, and CISSP for management—and emphasizes building the skills and experience to back them up. #OSCP #CISSP

Anthropic’s new AI model, Mythos, is changing vulnerability management by identifying security flaws in hours or days and uncovering thousands of sensitive defects across every major operating system and web browser. It can generate precise exploits and chain vulnerabilities at machine speed—making traditional patching windows obsolete and threatening critical infrastructure, so defenders must move to continuous, real-time defenses #Mythos #PowerGrid

This issue of The Cybersecurity Pulse summarizes major supply-chain and data-exfiltration incidents—most notably Lapsus$ dumping a 96GB archive from Checkmarx via credentials stolen in the TeamPCP/Trivy compromise—and covers new AI-driven security tooling and vendor developments from Google, Wiz, and Amazon. It also highlights critical vulnerabilities and breaches, including the Copy Fail Linux LPE, ShinyHunters’ claims on Medtronic and Carnival, and insurer data showing misconfigured MFA as a significant loss driver. #Lapsus #Checkmarx

This article demonstrates how impacket-net uses three authentication paths—NTLM hash (Pass-the-Hash), Kerberos tickets, and AES keys—to enumerate and modify Active Directory objects against a domain controller in the ignite.local lab. It details user, group, computer, and local group operations, attacker persistence techniques, and mitigation strategies such as disabling machine account creation and monitoring directory change events. #impacket-net #ignite.local

This article documents sixteen techniques and tools for enumerating Active Directory users across LDAP, SAMR, RPC, LSARPC, and native Windows APIs, demonstrating commands and outputs against the ignite.local lab domain as the low-privileged user raj. It provides a comprehensive reference for offensive tradecraft while advising defenders on detection and mitigation strategies to harden and monitor Active Directory environments. #Impacket #BloodHound

This article presents a focused GRC study roadmap to replace aimless learning with a clear plan that covers cybersecurity fundamentals, GRC basics, and practical application. It outlines prioritized topics, exercises, and an offer for personalized guidance if you comment your target role and current level. #DecodedSecurity #CISSP

The article argues that the browser has evolved into a secondary operating system where compute, storage, identity, I/O, and communication converge, creating an opaque layer traditional security tools cannot fully observe. That blind spot breaks the assumption that authenticated sessions equal human agency, so detection and governance must move into the browser itself to prevent attacks like ClickFix and provide meaningful context. #KeepAware #ClickFix

AI coding assistants often suggest plausible-sounding packages that do not exist, and attackers pre-register those hallucinated names on PyPI and npm to deliver malicious install hooks when developers copy-paste install commands. Research shows nearly 20% of AI-generated code references fake packages and 43% of hallucinations repeat across runs, and slopcheck stops nonexistent or suspicious packages at the install boundary. #Slopsquatting #slopcheck