Category: Interesting Stuff

This issue of The Cybersecurity Pulse details a massive software supply-chain campaign by TeamPCP that poisoned widely used open-source security and runtime tools, triggering cascading compromises and exposing sensitive data from downstream victims. It also summarizes RSAC 2026’s focus on agentic AI—dozens of product launches and large funding rounds—while highlighting high-impact incidents like the Mercor breach, Codex command-injection, Handala’s Gmail compromise, and Intoxalock’s outage. #TeamPCP #Mercor

Google now allows users to change their primary Gmail username while keeping the underlying account intact and turning the original address into an alias. While convenient, this change could let spammers and phishers bypass personal blocks and resume campaigns unless mitigated by Google’s renaming limits. #Google #Gmail

This article provides a step-by-step technical walkthrough of abusing Kerberos Constrained Delegation (KCD) with Protocol Transition (S4U2Self + S4U2Proxy) in Active Directory to impersonate high-privilege users and access a SQL Server. It demonstrates exploiting a misconfigured service account (kavish) using tools like Impacket and outlines detection strategies and mitigations for defenders. #KerberosConstrainedDelegation #Impacket

The Artemis II mission successfully launched today, marking a major milestone in returning humans to the Moon and showcasing a world-class team’s management of immense risks. Cybersecurity can learn from this achievement by adopting strategic capabilities—prediction, prevention, detection, and response—with clear objectives, resources, accountability, and continuous feedback to build an enduring defense. #ArtemisII #NASA

Most candidates fail CompTIA Security+ because they try to cover everything instead of focusing on what actually matters for the exam. This article breaks down the SY0-701 exam into five domains, highlights the core topics to prioritize, and points to Decoded Security resources to help you build a focused four-week study plan. #SY0-701 #CompTIA

Semgrep’s Remediation at Scale report analyzed remediation patterns across 50,000+ repositories in 2025 and found large, category-specific fix-rate gaps between high-performing “leaders” and the rest (“field”). The biggest gaps are in OWASP categories that require architectural changes—especially Authentication Failures and Cryptographic Failures—and leaders close more issues by using PR-level scanning, blocking rules, reachability analysis, and a 90-day escalation policy. #Semgrep #OWASPTop10

Vulnerability management has evolved from periodic scanning to a continuous, threat-aware process that prioritizes exploit activity, asset criticality, and real-time detection. Wazuh enables this proactive model by unifying vulnerability visibility, threat intelligence, and telemetry to detect exploitation attempts and validate remediation. #Wazuh #CVE-2025-55182

The Cybersecurity Club hosted a global workshop led by Ross Young to introduce OWASP’s Threat and Safeguard Matrix (TaSM), a practical framework that maps material threats to safeguards aligned with the NIST Cybersecurity Framework. Attendees worked through phishing, ransomware, web application attacks, third‑party data loss, and AI data‑leak scenarios involving ChatGPT and Google Gemini to identify coverage gaps, prioritize investments, and explore AI automation from Clear Capabilities. #OWASP #TaSM #RossYoung #ClearCapabilities #ChatGPT #GoogleGemini #NIST

ARC-AGI-3 is an interactive benchmark that drops agents into novel 64×64 grid environments with no instructions, exposing that frontier models score below 1% while humans solve 100% of the tasks. Anthropic’s Claude Dispatch ships the ability for a phone to control a live desktop Claude session with full filesystem reach, amplifying prompt-injection risk and highlighting that these models lack the abstract reasoning needed to safely interpret adversarial context. #ARC-AGI-3 #ClaudeDispatch

Darwin Salazar of The Cybersecurity Pulse summarizes RSAC/BSidesSF takeaways on AI security, covering build-vs-buy tradeoffs, MCP-enabled agents, data lakes, and shifting SOC architectures. He highlights rising attack velocity, data security concerns, and recent supply chain compromises that underscore the need for composable, data-aware defenses. #TeamPCP #LiteLLM

This guide demonstrates how an attacker can use a stolen administrator.pfx certificate or a derived administrator.ccache Kerberos ticket to authenticate via PKINIT and obtain remote command execution or interactive shells in an Active Directory domain. Techniques use NetExec for direct PFX authentication and Impacket/Evil-WinRM for CCACHE-based authentication across SMB, WMI, WinRM, and MSSQL, and the article includes detection opportunities and defensive recommendations. #PassTheCertificate #administrator_pfx

This article explains, step by step, what happens from URL parsing to browser rendering when you open a website, outlining the dependency chain DNS → TCP → TLS → HTTP → Rendering. It also breaks down the TCP three-way handshake, the TLS certificate and key-exchange process, and offers a Docker-based lab to practice DNS resolution, HTTP requests, and TLS negotiation. #DNS #TLS

Global regulators and courts have intensified scrutiny on data processing, publishing detailed guidance on legitimate interest, data reuse, sector-specific protections, and AI content provenance. Notable outcomes include the EDPB’s legitimate interest case digest, the ICO’s reuse and RLI guidance, CNIL’s limits on audio in video surveillance, the Dutch AP’s cloud rules for health data, Washington’s AI provenance law, Utah’s genetic sequencing restrictions, and the KGM verdict against Meta and YouTube. #EDPB #KGM

Ross Young, a former CIA and NSA officer and ex-CISO at Caterpillar Financial and Capital One, will teach his TaSM threat-centric framework in a live virtual workshop on March 31, 2026. The session provides hands-on exercises, templates, and a budget-justification approach to prioritize material threats and align security with business outcomes. #TaSM #CapitalOne

This post reviews common LSASS credential-dumping techniques—both remote and local—detailing tools and workflows attackers use to extract NT hashes, Kerberos tickets, cleartext passwords, and DPAPI keys from memory. It also covers parsing dumps with pypykatz, network-level detection for DRSUAPI/DCSync and anomalous SMB activity, and mitigations such as Credential Guard and LSASS Protected Process Light. #lsassy #nanodump #impacket #pypykatz #CredentialGuard