Netcrook
Aujourd'hui
Hidden Pressure, Public Claims: ScarlettGroup Bets on Fear Before Proof
A reportedly emerging extortion crew is leaning on a Tor leak site and timed threats, but the alleged compromise behind the pressure remains unverified.
Reported Credential Exposure Puts FortiGate, FortiWeb, and GlobalProtect on Alert
A claimed investigation into internet-facing security and remote-access systems points to more than 70,000 exposed credentials and records, but the mechanism, validity, and impact remain unconfirmed.
When the Hunt Shifts from Crypto to Cloud: The Huione Case and the New Pressure Point
U.S. authorities are increasingly treating backend infrastructure as a crime target in its own right, not just a side effect of a crypto investigation.
PHP2Shell Put Patch Teams on the Clock Before the Fix Was Even Public
Observed exploit attempts reportedly began before the PHP runtime fixes landed, while later mass activity reinforced how fast critical code flaws can attract opportunistic probing.
Inside the Reported AI Attack Crew That Treated Banks Like a Workflow
A vendor investigation describes a system called CARLIY0S as a coordinated, multi-tool operation aimed at financial institutions in Latin America, but the evidence publicly available still leaves key questions about model roles, success, and victims unanswered.
Signal's Call-Silence Problem: A Hang-Up That May Not Stop the Stream
A reported flaw in RingRTC, the calling layer behind Signal, raises a sharp privacy question: what happens when a call appears to end, but media handling does not fully shut down?
Artifact Trapdoor: How the LiteLLM Supply-Chain Attack Put AI Secrets at Risk
A compromised release pipeline reportedly shipped malicious wheels and container images, but public evidence does not establish successful theft of credentials or secrets.
When AI Becomes a Force Multiplier: The Cloud Intrusion Story That Is Not Quite a Breach
Tooling can accelerate investigations and testing, but the evidence still matters: automation, attribution, and persistence are separate claims that should never be collapsed into one.
When AI Workspaces Start to Look Like Attack Infrastructure
A reported workflow tying ARTEX to multiple model requests shows how shared instructions, persistent records, and handoffs between AI sessions can turn automation into a security problem.
PHP’s Core Patch Race Exposes a Hidden RCE Risk Beneath the Web
Two critical PHP-core flaws reportedly touch the request lifecycle itself, making runtime inventory and version control as important as application patching.
When Municipal AI Speeds Paperwork, It Can Also Hide the Hand That Decides
AI in local government may shorten queues and sort requests faster, but it can also shift control toward software, vendors, and opaque workflows if oversight, logs, and human review are not built in from the start.
When a Hang-Up May Not Be Final: The Signal Calling Flaw That Could Leave Audio Alive
A reported weakness in Signal’s RingRTC calling layer raises a narrow but serious question: in some conditions, does ending a call actually stop the media stream, or only the screen state?
How Compliance Can Become Obsolete Without a Rule Change
A control set can look complete on paper while the people, vendors, and processes around it have already moved on, leaving GDPR and DORA safeguards less reliable than they appear.
A Certificate Purge Can Break the Web Faster Than an Attack
A large revocation wave shows how one compliance failure can become an availability risk for websites that depend on TLS to stay reachable.
When Cloud Servers Go Dark: The Onamae.com Incident and the Data Question Nobody Can Yet Answer
A reported intrusion into Onamae.com Desktop Cloud forced a broad service suspension, but the hardest question remains unresolved: what, if anything, was actually seen inside the affected environments?
When Climate Stress Becomes an Innovation Security Problem
ISO 56001 frames climate pressure as something organizations can manage through structured innovation governance, with PDCA turning change into an iterative process instead of a reactive scramble.
When a Cloud Provider Pulls the Plug, the Real Story Is What It Still Cannot Prove
GMO Internet’s server shutdown shows how fast a cloud incident can turn into a containment crisis, while the hardest questions - scope, access path, and data impact - remain unsettled.
GitLab CE and EE Patch Wave Lands After 12 Vulnerabilities Were Flagged
Security updates for GitLab’s community and enterprise editions address one critical issue and two high-severity flaws, but no confirmed exploitation has been established.
Ransomware Claim Casts Doubt Over an Unnamed California Family Law Target
A victim listing marked pending exposure names an unidentified legal-services organization, but the existence of a real breach has not been independently confirmed.
Unnamed diamond trader appears in a ransomware claim, but the case is still unproven
A numbered company tied to diamond trading in New York has surfaced in a reported N0n victim listing, with exposure marked pending and no independent confirmation of a breach.