Cephalosec
cephalosec.com
Actively hiring
Information Security
Cybersecurity
Follow
Overview
News
Salaries
Products
People
Growth
Offices
Financials
News
Pass-the-Passkey: It doesn't matter that the protocol is foolproof if its implementation is flawed
SpecterOps released a paper on their Pass-the-Passkey presentation from Black Hat, with a family of 15 Passkey-related attacks.Long story short, most issues are based on two premisesThe attacker relies on a compromised device with access to those passkeys
Read more
Report
Cybersec in AI is getting more exciting by the day
The latest video from AI Explained as well as OpenAI's Blackhat talk about the Hugging Face hack are fascinating to go through. A few notes:The UK AI Security Institute (AISI) released a report on their own cybersecurity issues when they ran benchmark wit
Read more
Report
Figma showing a virtuous circle between bug bounty, AI security scans and fixes
Excellent, detailed article by Figma security engineers on how they stay ahead of vulnerabilities with agents.Let's start with the key vocabulary you need to know to understand the rest of the article:Precision is the share of reported findings that are r
Read more
Report
Approval fatigue demonstrated in a simple game
Alex Wauters recently commented the results of a game he published a few months ago, where the player has to review approval requests from a fictitious Claude Code session. While this was just a game and not a proper research experiment, the sample size i
Read more
Report
Cloudflare OS: Insights on embracing internal AI growth securely
As part of their newly created "Agent Week", Cloudflare published interesting titbits about how they addressed the exploding demand for AI-assisted workloads internally, embracing innovation while keeping a proper security posture.They released Cloudflare
Read more
Report
Chaindrop: Shai-Hulud, here we go again!
Microsoft published a detailed analysis of the new ChainDrop supply chain attack affecting NPM packages and adopting self-replicating, worm behaviour, similar to Shai-hulud:The malware typically executes automatically through an npm preinstall lifecycle h
Read more
Report
LLMs hugging the CVE system to death
Interesting side effects of everyone going ham with LLM-based security scans. Someone released security advisories for SQLite, which the NIST National Vulnerability Database (NVD) promptly registered as CVE with a "Critical" CVSS score, acknowledged by CI
Read more
Report
Beyond Zero: Google's next step on Zero Trust Architecture reads like science fiction
Google recently released a research article on Beyond Zero: Enterprise security for the AI era. If the name Beyond Zero sounds familiar, it's because this is a mix of Zero Trust and Beyond Corp, Google's own spin of Zero Trust Architecture (ZTA). Announce
Read more
Report
Confused Deputy Copilot in three examples
I just stumbled upon an excellent 3-parts series of (responsibly disclosed) attacks impacting Microsoft Copilot.The first one is poisoning Copilot memory via an attacker-controlled webpage, which allowed the instruction to gain persistence in the victim's
Read more
Report
Cybersecurity harnesses everywhere
After Microsoft's own release of Project Perception, I'm seeing a lot of cybersecurity-focused harnesses popping as open source. One of the oldest and most well known is Strix, which I initially thought was all about offence with vulnerability discovery a
Read more
Report
Show more news