Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
34 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
intelligence_src_04a2c4d5d7c7c0ff94Recent successful batchLast successful batch: Last attempt:
intelligence_src_061cefd6c0c4163f27Recent successful batchLast successful batch: Last attempt:
intelligence_src_08225c2d3f1c653468Recent successful batchLast successful batch: Last attempt:
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Exclusive: Official UK security assessment found Microsoft cloud platform storing files was at potential risk from hostile hackersVast troves of highly sensitive police data are lying on Microsoft cloud platforms which an official UK security assessment deemed to be vulnerable to “compromise” by foreign actors and the US government, a Guardian investigation can reveal.The files include criminal records, victim statements, internal emails and sensitive information held by more than 40 police forces across the UK. Continue reading...
First reported Sep 18, 2026 17:00 UTCCatalog metadata updated Oct 14, 2026 17:49 UTCOpen evidence record
Thalha Jubair, 20, and Owen Flowers, 19, sentenced to five and a half years each for cyber-attack that cost Transport for London £39mThe data of millions of commuters was stolen, Londoners were left out of pocket and 27,000 Transport for London staff were forced to reset their passwords.Over four days in 2024 a pair of teenage hackers had London’s transport network at their mercy. Thalha Jubair and Owen Flowers had burrowed into the heart of Transport for London’s IT systems and held the “keys to the kingdom”. Continue reading...
First reported Jul 16, 2026 12:01 UTCCatalog metadata updated Oct 14, 2026 17:49 UTCOpen evidence record
David Robinson joins other insiders in urging industry to take more care over rapidly developing technologyA safety leader at OpenAI has quit the company, warning that its culture was broken and that AI firms were not “being nearly careful enough” about developing the technology.David Robinson, who led the writing of safety reports that accompanied the ChatGPT developer’s product releases, explained his resignation in an essay headlined: “I quit OpenAI because its culture is broken.” Continue reading...
First reported Oct 04, 2026 07:48 UTCCatalog metadata updated Oct 14, 2026 17:49 UTCOpen evidence record
Tech company says it ‘caught and disrupted’ NSO Group’s attempts to access accounts in Jordan and Lebanon A spyware firm has been targeting WhatsApp users with malicious links in contravention of a US court order forbidding it from doing so, Meta has said.In a post, Meta said WhatsApp had “caught and disrupted spear phishing attempts” by NSO Group, which a spokesperson said targeted a handful of users in Jordan and Lebanon. It had also caught the group creating “test accounts and groups” on WhatsApp. Continue reading...
First reported Jun 09, 2026 16:20 UTCCatalog metadata updated Oct 14, 2026 17:49 UTCOpen evidence record
Kanishka Narayan, concerned by Australian incident, says British cyber defences could be bypassed by artificial intelligence agentUK politics live – latest updatesAn AI-driven cyber-attack similar to the OpenAI breach of Australia’s healthcare system is likely, “if not inevitable”, in the UK, according to a senior minister.Kanishka Narayan, the UK AI minister, indicated that the British government’s own cyber defences would be bypassed by a technology that has developed highly sophisticated skills in cybersecurity. Continue reading...
First reported Oct 12, 2026 13:52 UTCCatalog metadata updated Oct 14, 2026 17:49 UTCOpen evidence record
Writing my own virtualized loader is something I’ve been wanting to do since I first read Microsoft’s deep dive on FinFisher’s multi-layered VM obfuscation back in 2018. FinFisher didn’t just use one layer of protection, it implemented a custom virtual machine with 32 opcode handlers, wrapped that in spaghetti code and anti-debug checks, and then buried a second VM […] The post Centurion: Bring Your Own Execution Environment appeared first on Praetorian.
First reported Jun 09, 2026 19:14 UTCCatalog metadata updated Oct 14, 2026 17:47 UTCOpen evidence record
The Bluetooth Low Energy (BLE) tooling space is fragmented and decaying. Picture a typical BLE testing session: you spin up bettercap to run ble.recon and ble.enum, your trusty (but deprecated) gatttool to read and write handles, and, when it’s time to fuzz that one writable characteristic, dig up that custom Bleak script you copy-paste between […] The post Bluetooth Low Energy Security Testing, Consolidated: Introducing Caeruleus appeared first on Praetorian.
First reported Jul 10, 2026 20:27 UTCCatalog metadata updated Oct 14, 2026 17:47 UTCOpen evidence record
How we built a procedural engine that learns your real cloud environment, generates decoy environments indistinguishable from production, and converts every attacker interaction into signal. In the myth, Daedalus built the Labyrinth of Knossos so well that he nearly couldn’t escape it himself. The corridors looked real. The paths felt purposeful. And the deeper you […] The post Knossos: Procedurally Generated Decoy Environments appeared first on Praetorian.
First reported Jul 02, 2026 17:41 UTCCatalog metadata updated Oct 14, 2026 17:47 UTCOpen evidence record
Overview In the first installment of this series, I walked through how I leveraged large language models to assist in identifying several vulnerabilities in the FreeBSD kernel, including a stack-based buffer overflow assigned CVE-2026-3038. This raised a natural follow-up question. Can language models effectively write exploits for memory corruption vulnerabilities? This article explores that question. […] The post FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 2 of 2) appeared first on Praetorian.
First reported Jul 06, 2026 20:42 UTCCatalog metadata updated Oct 14, 2026 17:47 UTCOpen evidence record
Autonomous penetration testing in the Praetorian Guard Platform has changed shape. Hannibal started as a hunt agent for external and cloud attack surfaces. Today, it’s something your security team can run entirely on its own terms. Web applications and LLM endpoints are now first-class attack surfaces. Hunts can authenticate into applications, test what a real […] The post Hannibal Puts Autonomous Penetration Testing Under Your Control appeared first on Praetorian.
First reported Sep 23, 2026 16:02 UTCCatalog metadata updated Oct 14, 2026 17:47 UTCOpen evidence record
In the previous post we walked through WasmForge, our Go-to-WebAssembly loader that takes existing signatured Go tools and ships them as opsec-safe binaries. This approach doesn’t just apply to Go, however, as there are many languages that can compile to WebAssembly. Another language of interest to us, especially regarding legacy tools which have been over-signatured, […] The post GhostPack Necromancy: Reforging C# Tools with WasmForge appeared first on Praetorian.
First reported Jun 19, 2026 01:55 UTCCatalog metadata updated Oct 14, 2026 17:47 UTCOpen evidence record
Overview Earlier this year, a team at Praetorian was building Constantine, our automated 0-day discovery engine. I wanted to find techniques worth folding into it, so on the side I started poking at the FreeBSD kernel with Claude Code, running on Opus 4.6, which was the latest Opus model at the time. A few days […] The post FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs (Part 1 of 2) appeared first on Praetorian.
First reported Jun 17, 2026 19:15 UTCCatalog metadata updated Oct 14, 2026 17:47 UTCOpen evidence record
Block Kit alerts, threaded conversations with Marcus, and every action tied to a verified Guard identity. The alert that matters usually lands in Slack. Someone sees it, someone else asks what it affects, and a third person opens another tab to find out. Every context switch is time an attacker spends inside the window you […] The post Hunt, Triage, and Act on Guard Findings in Slack appeared first on Praetorian.
First reported Oct 09, 2026 17:15 UTCCatalog metadata updated Oct 14, 2026 17:47 UTCOpen evidence record
TL;DR: Sulla is an open source SMB secret scanner for discovering credentials exposed in SMB shares across enterprise networks. It leverages our recently released Titus Go library, resulting in an easy-to-use, adaptable, and highly performant standalone binary. Every network penetration tester knows the struggle: reviewing network shares for sensitive material is a painful must-do. With […] The post Sharing is Caring: SMB Secret Scanning with Sulla appeared first on Praetorian.
First reported Jun 16, 2026 15:15 UTCCatalog metadata updated Oct 14, 2026 17:47 UTCOpen evidence record
How Brutus grew into an engine that finds your identities, tests them everywhere they’re accepted, and remembers what it confirms. An attacker rarely needs a novel exploit when a valid username and password pair is sitting in a breach dump, reused across a dozen internal services, or left at a vendor default nobody changed. Brutus […] The post Credentials Are Still the Shortest Path In appeared first on Praetorian.
First reported Sep 17, 2026 01:40 UTCCatalog metadata updated Oct 14, 2026 17:47 UTCOpen evidence record
update(falco_rules): exclude systemd helpers from Read sensitive file… … untrusted systemd spawns short-lived helper processes that legitimately read sensitive account and PAM files during normal operation. Because these helpers report a bare-number or comm-truncated proc.name, they cannot be matched by name, so the existing systemd exclusions in the rule do not cover them and the rule fires a false positive on every affected host. This adds a systemd_sensitive_file_readers macro that matches on proc.exepath (kernel-resolved and unspoofable) anchored to the expected systemd parent, covering two observed helpers: - systemd-executor (unit re-exec deserialize handoff) - systemd-userwork (userdb User/Group Record Lookup worker) The systemd-userwork case was reproduced locally on systemd 259 / Falco 0.44.1 and verified by deterministic capture replay. The systemd-executor case is reported in #291 and falcosecurity/falco#3480. Signed-off-by: MayankSekhar <mayankshekharsingh@gmail.com>
First reported Sep 07, 2026 07:45 UTCCatalog metadata updated Oct 14, 2026 17:46 UTCOpen evidence record
update(falco_rules): exclude systemd helpers from Read sensitive file… … untrusted systemd spawns short-lived helper processes that legitimately read sensitive account and PAM files during normal operation. Because these helpers report a bare-number or comm-truncated proc.name, they cannot be matched by name, so the existing systemd exclusions in the rule do not cover them and the rule fires a false positive on every affected host. This adds a systemd_sensitive_file_readers macro that matches on proc.exepath (kernel-resolved and unspoofable) anchored to the expected systemd parent, covering two observed helpers: - systemd-executor (unit re-exec deserialize handoff) - systemd-userwork (userdb User/Group Record Lookup worker) The systemd-userwork case was reproduced locally on systemd 259 / Falco 0.44.1 and verified by deterministic capture replay. The systemd-executor case is reported in #291 and falcosecurity/falco#3480. Signed-off-by: MayankSekhar <mayankshekharsingh@gmail.com>
First reported Sep 07, 2026 07:44 UTCCatalog metadata updated Oct 14, 2026 17:46 UTCOpen evidence record
fix(rules): fixed `container_started` macro adapting to new container… … plugin. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
First reported Jun 17, 2025 10:45 UTCCatalog metadata updated Oct 14, 2026 17:46 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.