4 casos · pág. 1/1
TrustedSec's Justin Bollinger describes HashcatRosetta, an open-source tool for password-cracking practitioners (part 2 of a 3-part series on hatecrack). It translates dense hashcat rule syntax into plain-English, step-by-step explanations. It also analyzes --debug-mode 4/5 output to show which rules, basewords and wordlists actually prod…
The Hakai Security Research Team disclosed CVE-2026-44706, a SQL Injection in Chatwoot versions <= 4.11.1. Any authenticated user with agent privileges, the lowest access level, can read the entire PostgreSQL database. The flaw sits in the FilterService, where user input is interpolated directly into SQL. Exposed data includes bcrypt pass…
Unit 42 analyzed the operational environment of a previously unreported, financially motivated, English-speaking actor using the handle BUGSTER. The actor ran the Hermes Agent framework with DeepSeek V4 as its reasoning engine and the Cursor IDE as a secondary tool, with safety controls disabled in both. With AI-generated scripts and reco…
Unit 42 detailed a multi-stage intrusion in September 2024 against a telecommunications managed service provider, tracked as CL-STA-0954 (aka UNC5820). The attackers gained initial access by exploiting CVE-2024-47575 (FortiJump) on a central FortiManager and exfiltrated an archive with running configurations, credentials and private keys …
