Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
24 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
intelligence_src_6412d2c1d40002d136Recent successful batchLast successful batch: Last attempt:
intelligence_src_678029bd403a547b0cRecent successful batchLast successful batch: Last attempt:
intelligence_src_6c4986274fbcd01a16Recent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Today, I published the following diary on isc.sans.edu: “Python Malware Using Postgresql for C2 Communications“: For modern malware, having access to its C2 (Command and control) is a crucial point. There are many ways to connect to a C2 server using tons of protocols, but today, HTTP remains very common The post [SANS ISC] Python Malware Using Postgresql for C2 Communications appeared first on /dev/random.
First reported Aug 25, 2023 08:57 UTCCatalog metadata updated Oct 14, 2026 10:55 UTCOpen evidence record
[Edit: Sorry for the “bullet-point” style, it was a lot of details to compile in this blog post] We were back at the Alvisse Parc Hotel after a break of four years! In 2022, only a light CTI summit was organized (see my wrap-up), but this year, hack.lu was back The post Hack.lu 2023 Wrap-Up appeared first on /dev/random.
First reported Oct 19, 2023 21:36 UTCCatalog metadata updated Oct 14, 2026 10:55 UTCOpen evidence record
Today, I published the following diary on isc.sans.edu: “Show me All Your Windows!“: It’s a key point for attackers to implement anti-debugging and anti-analysis techniques. Anti-debugging means the malware will try to detect if it’s being debugged (executed in a debugger or its execution is slower than expected). Anti-analysis refers The post [SANS ISC] Show me All Your Windows! appeared first on /dev/random.
First reported Aug 11, 2023 09:02 UTCCatalog metadata updated Oct 14, 2026 10:55 UTCOpen evidence record
Today, I published the following diary on isc.sans.edu: “Have You Ever Heard of the Fernet Encryption Algorithm?“: In cryptography, there is a gold rule that states to not develop your own algorithm because… it will be probably weak and broken! They are strong algorithms (like AES) that do a great job The post [SANS ISC] Have You Ever Heard of the Fernet Encryption Algorithm? appeared first on /dev/random.
First reported Aug 22, 2023 08:35 UTCCatalog metadata updated Oct 14, 2026 10:55 UTCOpen evidence record
Today, I published the following diary on isc.sans.edu: “From a Zalando Phishing to a RAT“: Phishing remains a lucrative threat. We get daily emails from well-known brands (like DHL, PayPal, Netflix, Microsoft, Dropbox, Apple, etc). Recently, I received a bunch of phishing emails targeting Zalando customers. Zalando is a German The post [SANS ISC] From a Zalando Phishing to a RAT appeared first on /dev/random.
First reported Aug 18, 2023 06:22 UTCCatalog metadata updated Oct 14, 2026 10:55 UTCOpen evidence record
At Mozilla, we consider security to be a paramount aspect of the web. This is why not only does Firefox have a long running bug bounty program but also mature … Read more The post Firefox Security Response to pwn2own 2025 appeared first on Mozilla Security Blog.
First reported May 17, 2025 21:17 UTCCatalog metadata updated Oct 14, 2026 10:46 UTCOpen evidence record
The GPG key used to sign the Firefox release manifests is expiring soon, and so we’re going to be switching over to a new signing subkey shortly. The GPG fingerprint … Read more The post Updated GPG key for signing Firefox Releases appeared first on Mozilla Security Blog.
First reported Apr 01, 2025 08:31 UTCCatalog metadata updated Oct 14, 2026 10:46 UTCOpen evidence record
To provide transparency into our ongoing efforts to protect your privacy and security on the Internet, we are releasing a security audit of Mozilla VPN that Cure53 conducted earlier this … Read more The post Mozilla VPN Security Audit 2023 appeared first on Mozilla Security Blog.
First reported Dec 06, 2023 17:00 UTCCatalog metadata updated Oct 14, 2026 10:46 UTCOpen evidence record
At Mozilla, we believe in an open web that is safe to use. To that end, we improve and maintain the security of people using Firefox around the world. This … Read more The post Rapidly Leveling up Firefox Security appeared first on Mozilla Security Blog.
First reported Apr 04, 2024 19:27 UTCCatalog metadata updated Oct 14, 2026 10:46 UTCOpen evidence record
Today, we moved to a new GPG signing subkey used to sign certain Firefox and Thunderbird artifacts (namely Linux tarballs, RPM packages, checksums files) after an unencrypted copy of the … Read more The post Updated GPG key for signing Firefox and Thunderbird Releases appeared first on Mozilla Security Blog.
First reported Aug 10, 2026 18:37 UTCCatalog metadata updated Oct 14, 2026 10:46 UTCOpen evidence record
Mozilla remains committed to fostering a secure, agile, and transparent Web PKI ecosystem. The new Mozilla Root Store Policy (MRSP) v3.0, effective March 15, 2025, introduces critical updates to strengthen … Read more The post Enhancing CA Practices: Key Updates in Mozilla Root Store Policy, v3.0 appeared first on Mozilla Security Blog.
First reported Mar 12, 2025 16:14 UTCCatalog metadata updated Oct 14, 2026 10:46 UTCOpen evidence record
Online security is constantly evolving, and thus we are excited to announce the publication of MRSP version 2.9, demonstrating that we are committed to keep up with the advancement of … Read more The post Version 2.9 of the Mozilla Root Store Policy appeared first on Mozilla Security Blog.
First reported Sep 13, 2023 17:56 UTCCatalog metadata updated Oct 14, 2026 10:46 UTCOpen evidence record
At Mozilla, browser security is a critical mission, and part of that mission involves responding swiftly to new threats. Tuesday, around 8 AM Eastern time, we received a heads-up from … Read more The post Behind the Scenes: Fixing an In-the-Wild Firefox Exploit appeared first on Mozilla Security Blog.
First reported Oct 11, 2024 12:14 UTCCatalog metadata updated Oct 14, 2026 10:46 UTCOpen evidence record
Mozilla remains committed to maintaining a secure, trustworthy, and transparent Web PKI. Today we are announcing the publication of Mozilla Root Store Policy (MRSP) version 3.1, effective July 1, 2026. … Read more The post Improving Transparency and Assurance in the Web PKI: Mozilla Root Store Policy v3.1 appeared first on Mozilla Security Blog.
First reported Jun 29, 2026 11:33 UTCCatalog metadata updated Oct 14, 2026 10:46 UTCOpen evidence record
Most of the web already supports HTTPS: In fact, 93% of requests made by Firefox are already HTTPS. As a reminder, HTTP over TLS (HTTPS) fixes the security shortcoming of HTTP … Read more The post Firefox will upgrade more Mixed Content in Version 127 appeared first on Mozilla Security Blog.
First reported Jun 05, 2024 13:05 UTCCatalog metadata updated Oct 14, 2026 10:46 UTCOpen evidence record
chore(cmake): bump libs to `0.26.0-rc2` Pin `FALCOSECURITY_LIBS_VERSION` to the `0.26.0-rc2` tag, cut from the libs `release/0.26.x` branch. `DRIVER_VERSION` stays at `11.0.0-rc1+driver` (no driver changes since `0.26.0-rc1`). Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
First reported Sep 11, 2026 08:19 UTCCatalog metadata updated Oct 14, 2026 10:45 UTCOpen evidence record
Packages Download rpm-x86_64 deb-x86_64 tgz-x86_64 tgz-static-x86_64 rpm-aarch64 deb-aarch64 tgz-aarch64 Images docker pull docker.io/falcosecurity/falco:0.45.0 docker pull public.ecr.aws/falcosecurity/falco:0.45.0 docker pull docker.io/falcosecurity/falco-driver-loader:0.45.0 docker pull docker.io/falcosecurity/falco-driver-loader:0.45.0-buster docker pull docker.io/falcosecurity/falco:0.45.0-debian v0.45.0 Released on 2026-09-21 Breaking Changes ⚠️ feat(userspace)!: evaluate rule conditions on raw field bytes (invalid and non-printable UTF-8 sequences are now matchable with string operators, single bytes with the new \xHH escape sequence), let regex operate on sanitized input, and escape non-printable characters / replace invalid UTF-8 sequences at output encoding time; FALCO_ENGINE_VERSION bumped from 0.62.0 to 0.63.0; rules that matched the replacement character with non-regex operators must be reviewed [#3942] - @ekoops Major Changes new(chart): add serviceAccount.labels to set custom labels on the ServiceAccount [#3946] - @Goutham-Annem feat(falco): Expose reload status through GET /reload and add optional reload control over a protected Unix socket on Linux. Preserve SIGHUP reception and pending requests across reloads. [#4005] - @c2ndev feat(userspace/falco): suggest --dry-run when --validate receives a Falco configuration file [#3947] - @AkashKumar7902 Minor Changes update(build): bump falcoctl to 0.14.2 [#3996] - @leogr update(chart): bump the falcosidekick subchart constraint to 0.14.* and the falco-talon subchart constraint to 0.4.* [#3990] - @leogr chore(userspace/falco): drop the container_engines leftovers from the configuration JSON schema; configurations still setting this key now log a schema validation warning at startup [#3924] - @ekoops Bug Fixes fix(falco): no unsupported syscalls warning is printed anymore when replaying a capture [#4003] - @leogr fix(falco): the unsupported syscalls warning now points to base_syscalls.all instead of the removed -A flag [#4001] - @leogr fix(packaging): restore Falco services and persistent kernel modules after upgrades, migrate package-default driver pins, and clean up package-created systemd state on removal [#3994] - @leogr fix(chart): always mount an emptyDir at /etc/falco/config.d, and bump the default falcoctl image to 0.14.1, the container plugin to 0.7.4, and the k8smeta plugin to 0.4.2 [#3984] - @leogr fix(chart): mount the container engine socket directories instead of the socket files, so Falco keeps working after a container runtime restart [#3978] - @leogr fix(chart): support DaemonSet revision history limits and honor an explicit zero for both DaemonSet and Deployment controllers. [#3931] - @Goutham-Annem fix(chart): do not render the falcoctl config volume when falcoctl artifact install and follow are disabled [#3894] - @immanuwell fix(engine): falco --list no longer incorrectly labels the evt field class with a specific event source [#3936] - @Wahid7852 fix(cmake): add support for 64K kernel page to jemalloc on aarch64 [#3970] - @lekanjava fix(userspace): open the pidfile with O_NOFOLLOW to prevent a symlink TOCTOU when the pidfile path is in an attacker-writable directory. The pidfile content now ends with a trailing newline [#3871] - @alexmchughdev fix(chart): correct the inverted priority level mappings in the Grafana dashboard, so severity labels match Falco's numeric priorities (0=emergency ... 7=debug) [#3932] - @Goutham-Annem fix(engine): correctly match wildcard patterns when the literal segment that follows a * appears more than once in the input (e.g. *.yaml against backup.yaml.yaml, or wildcard enable/disable of rule names whose names repeat a literal segment). [#3913] - @tejgokani fix(userspace/falco): use the absolute modprobe path instead of a PATH lookup when falling back to loading the kernel module (untrusted search path, CWE-426) [#3943] - @BoxStrikesTeam fix: serve SIGHUP-triggered h
First reported Sep 21, 2026 13:10 UTCCatalog metadata updated Oct 14, 2026 10:45 UTCOpen evidence record
update(userspace/engine): bump engine version to 0.65.0 Bumping libs to `0.26.0-rc1` moves the driver `SCHEMA_VERSION` from `4.5.1` to `4.5.2`, which changes the engine checksum. The engine version must be bumped accordingly. Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
First reported Sep 09, 2026 09:42 UTCCatalog metadata updated Oct 14, 2026 10:45 UTCOpen evidence record
feat(falco): expose reload status and Unix socket control Add process identity, reload generations, and readiness observation through GET /reload for Falco Operator integration. Publish readiness after all enabled sources start and distinguish rejected validation from application. Add an opt-in Linux Unix socket listener. POST /reload queues a request and returns 202 with a generation baseline; clients poll GET /reload for the outcome. Keep POST exclusive to the Unix socket and document TCP observation independently of reload_control. Protect the socket with directory ownership, permissions, path checks, and exclusive listener ownership. Validate its directory during dry-run before stopping the active runtime, repeat checks at startup, and reject multipart bodies. Cover status semantics, HTTP behavior, credential isolation, cleanup, invalid directories, and real reloads with the existing C++ test suite. Signed-off-by: c2ndev <cannarella.dev@gmail.com>
First reported Sep 18, 2026 10:09 UTCCatalog metadata updated Oct 14, 2026 10:45 UTCOpen evidence record
fix(chart): update container plugin to 0.7.5 Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
First reported Oct 05, 2026 07:54 UTCCatalog metadata updated Oct 14, 2026 10:45 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.