Телеграм канал «CyberSecurityTechnologies»

#Analytics
#Threat_Research
An analytical review of the main cybersecurity events for the week (May 23-30, 2026)

1⃣ Privilege Escalation via a Page UaF in Qualcomm's AI Accelerator Linux Kernel Driver
// bug lives in Qualcomm's Cloud AI Accelerator kernel driver, qaic, which is present in mainline Linux
2⃣ The Word 'Toad' Gave Any Website Full Control of Chrome's Most Popular VPN
// Urban VPN's extension deliberately sets up a postMessage listener - a channel that lets any script on any page you visit send it messages
3⃣ Vaultjacking: One Captured PIN, the Entire Google Password Manager Vault
4⃣ A cryptojacking campaign abusing ScreenConnect and Microsoft .NET utilities
// ASR Rules
5⃣ Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace
// Tycoon 2FA bypasses MFA on Entra ID and Google Workspace...
6⃣ CIFSwitch - vulnerability in Linux kernel's CIFS subsystem that allows root privileges to be gained
7⃣ PuTTY 0.84 released
8⃣ PyFory - Insecure Pickle Deserialization to RCE
// CVE-2025-61622
9⃣ Drupal PostgreSQL SQLI
// SELECT-only SQLi to RCE when the injected expression runs as a PostgreSQL superuser
🔟 Suricata 8.0.5 and 7.0.16 released

]-> Analytical review (May 16-23, 2026)

#SCA
#Hardware_Security
"FROST: Fingerprinting Remotely using
OPFS-based SSD Timing", 2026.

// SSD contention side channels can be mounted by a remote attacker from within the browser, without native code execution. FROST attack targets the Origin Private File System API in JavaScript, allowing us to create and access files on the disk, within the browser’s sandboxed environment

#exploit
#Kernel_Security
An AI audit of FreeBSD
https://blog.calif.io/p/an-ai-audit-of-freebsd

]-> setcred (CVE-2026-45250)
]-> ptrace (CVE-2026-45253)
]-> procdesc (CVE-2026-45251)
]-> Bonus

// Disclaimer

#tools
#NetSec
#hardening
Puck - Autonomous endpoint investigation via MCP
https://github.com/puck-security/puck-scout
// Puck is a three-component system that enables AI-driven, read-only endpoint investigation. The AI client asks questions, the MCP server orchestrates, and endpoint agents execute read-only commands

#tools
#NetSec
#hardening
Puck - Autonomous endpoint investigation via MCP
https://github.com/puck-security/puck-scout

// Puck is a three-component system that enables AI-driven, read-only endpoint investigation. The AI client asks questions, the MCP server orchestrates, and endpoint agents execute read-only commands

#tools
#Whitepaper
#Blue_Team_Techniques
"SIEM Detection Logic Conversion with LLMs", 2025.

]-> Scripts used to convert Splunk detections to Elastic Security using OpenAI and Google Gemini

// This research explores how LLMs and automation scripts can expedite the translation of detection logic between SIEMs, converting detections in minutes instead of hours

#tools
#DFIR
#Malware_analysis
#Blue_Team_Techniques
MalShark - AI-powered malware traffic analysis
and network forensics tool via MCP
https://github.com/MohitDabas/malshark
// Most pcap tools require an analyst to know exactly what to look for. This server bridges the gap...