Entra app permissions in the ConnectWise incident let one app credential reach 173+ Microsoft 365 tenants without password or MFA. The video also shows what to check today.
Key points
Credential spread: one app credential reached 173+ Microsoft 365 tenants.
Security gap: the credential had no password or MFA.
Sources
- Original post
- youtube.com - Linked in the post
REMnux adds Apple Silicon and arm64 support with prebuilt VMs
REMnux now runs natively on Apple Silicon and other arm64 hardware. It also provides prebuilt virtual machines for VMware, VirtualBox, Proxmox, UTM, and an EC2 AMI.
Key points
Native support for Apple Silicon and arm64 systems, including containers and VMs
Prebuilt VMs available for VMware, VirtualBox, Proxmox, UTM, and an EC2 AMI
Sources
- Original post
- docs.remnux.org - Linked in the post
SiteGuard Server Edition OS command injection exploited (CVE-2026-106931)
SiteGuard Server Edition web application firewall has an OS command-injection flaw (CVE-2026-106931) that lets attackers run commands as root or SYSTEM. The vulnerability resides in the statistics feature, which is enabled by default, and is being exploited in the wild. A patch replaces the statistics processing files, and administrators are advised to download diagnostic information before updating.
Key points
CVE-2026-106931 enables OS command injection with root or SYSTEM privileges.
Affected versions: SiteGuard Server Edition 2.20+ before 8.00 Update 5 (Apache, Nginx, IIS) and 2.20+ before 7.00 Update 6 (FreeBSD).
Sources
semantic_firewall generates deterministic semantic fingerprints for Go functions
semantic_firewall generates deterministic semantic fingerprints for Go functions. It can detect xz-style backdoors and verify semantic equivalence using SSA analysis and Scalar Evolution.
Key points
Generate deterministic semantic fingerprints for Go functions
Detect xz-style backdoors and verify semantic equivalence using SSA analysis and Scalar Evolution
Sources
- Original post
- ktp.sh - Linked in the post
Broadcom Wi-Fi bug runs code on routers, 1.5M exposed
Broadcom Wi-Fi bug lets anyone in range run code on routers without the password, affecting about 1.5M devices in Belgium. Quentin Kaiser demonstrated it on Proximus, Orange and VOO routers; the bug dates to 2010 and Broadcom will not assign a CVE.
Key points
Bug lets anyone in range run code on routers without the password.
About 1.5M routers in Belgium are exposed, none patched.
Sources
NaSuno AI audio watermark removal toolkit announced
NaSuno is an AI audio watermark removal and forensic anti-attribution toolkit. It claims to neutralize Suno, Udio, and neural fingerprints using ISO 226 perceptual masking.
Key points
Toolkit: AI audio watermark removal & forensic anti-attribution toolkit.
Capability: Neutralizes Suno, Udio, and neural fingerprints with ISO 226 perceptual masking.
Sources
- Original post
- ktp.sh - Linked in the post
Black Hat Arsenal USA 2026 lists 101 security tools by track
Black Hat Arsenal USA 2026 presents a catalog of 101 security tools organized by track. Tracks include red teaming, exploitation, reverse engineering, cloud security, AI/ML, OSINT, and detection. The list provides tool descriptions and project links where available.
Key points
101 security tools compiled for Black Hat Arsenal USA 2026.
Tools grouped into seven tracks: red teaming, exploitation, reverse engineering, cloud security, AI/ML, OSINT, detection.
Sources
- Original post
- github.com - Linked in the post
