Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
4 sources: 0 stale, 0 needing attention, 0 paused, 0 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
It's been a couple of days since Apple's big smart home announcement, and we have some more information - and a bunch of new questions - about the Apple HomeView. The device has plenty of computing oomph, is always connected to power, and looks like a perfect place to run a bunch of apps. And […]
First reported Oct 16, 2026 15:38 UTCCatalog metadata updated Oct 17, 2026 02:54 UTCOpen evidence recordWhy Pentest Proposals Never Seem to Match A compliance officer receives a request for a penetration test, contacts several providers, and receives proposals that appear to describe completely different services. One covers external IP addresses, another includes applications and APIs, and a third promises audit-ready evidence without explaining what was tested. This guide to penetration […] The post Penetration Testing for Compliance Officers: A Non-Technical Buyer’s Guide appeared first on Synack.
First reported Sep 30, 2026 09:09 UTCCatalog metadata updated Oct 17, 2026 02:53 UTCOpen evidence recordSynack was named a Leader in G2's Fall 2026 Grid® and Enterprise Grid® Reports for Penetration Testing. The reviews show what customers value in a pentesting partner: visibility into testing, access to experts, findings they can fix and verify, and a partner that acts on feedback. The post What Customers Value in a Penetration Testing Partner: Insights from G2 Reviews appeared first on Synack.
First reported Oct 02, 2026 06:01 UTCCatalog metadata updated Oct 17, 2026 02:53 UTCOpen evidence recordBefore you build an AI pentesting agent, run it through 5 tests for production readiness. Mark Kuhr breaks down what separates a prototype from a system. The post Build or Buy AI Pentesting? 5 Tests to Judge Production Readiness appeared first on Synack.
First reported Oct 01, 2026 17:46 UTCCatalog metadata updated Oct 17, 2026 02:53 UTCOpen evidence recordAWS penetration testing is scoped by accounts, identities, and exposed workloads, not IP ranges. AWS lets customers test a defined list of services without prior approval, but it prohibits flooding, DNS attacks, and takeovers, and it requires approval for command-and-control and simulated events. Budget follows two drivers: account and IAM complexity for the cloud control plane, and the number of internet-facing applications for workload testing. The post AWS Penetration Testing for Enterprises: What to Scope and How to Budget appeared first on Synack.
First reported Oct 07, 2026 14:37 UTCCatalog metadata updated Oct 17, 2026 02:53 UTCOpen evidence recordContinuous penetration testing runs against your live attack surface on an ongoing basis. Annual penetration testing gives you a deep, point-in-time snapshot once a year. Neither model is universally correct. The right choice depends on release velocity, attack surface volatility, and which compliance framework is driving the requirement. Enterprises shipping code weekly typically outgrow annual testing alone. The post Continuous Penetration Testing vs. Annual Pentests: What Enterprises Need to Know appeared first on Synack.
First reported Oct 13, 2026 16:49 UTCCatalog metadata updated Oct 17, 2026 02:53 UTCOpen evidence recordWhy Two “Penetration Testing” Quotes Rarely Mean the Same Thing Most comparisons of penetration testing vendors begin too late. Buyers shortlist several providers, collect proposals, and then try to compare services that were never equivalent in the first place. One vendor may quote for a single application and a final report, while another may include […] The post Penetration Testing Vendor Comparison: What Enterprises Should Compare appeared first on Synack.
First reported Sep 29, 2026 12:51 UTCCatalog metadata updated Oct 17, 2026 02:53 UTCOpen evidence recordTim Nordvedt shares the top takeaways from his Dark Reading webinar with KeyCaliber’s Roselle Safran: AI has made finding vulnerabilities cheap, but fixing them still takes limited people, so the real advantage is knowing which exposures matter and showing leadership you’re reducing them. The post Discovery Has Scaled. Remediation Hasn’t: Top Takeaways on Threat Exposure Analytics appeared first on Synack.
First reported Oct 15, 2026 13:14 UTCCatalog metadata updated Oct 17, 2026 02:53 UTCOpen evidence recordThe meaningful differences between web application penetration testing companies rarely show up on the homepage. They show up in who performs the testing, how the methodology is documented, what the retest policy covers, and how scope changes get priced once a contract is signed. Use the eight-criteria scorecard below to evaluate providers on substance rather than marketing language. The post Web Application Penetration Testing Companies: What Enterprise Buyers Should Compare appeared first on Synack.
First reported Oct 08, 2026 16:12 UTCCatalog metadata updated Oct 17, 2026 02:53 UTCOpen evidence recordSecurity testing and exposure management have run on separate tracks for years, leaving a blind spot between what a scanner flags and what an attacker can exploit. Synack's new integration with Wiz closes that disconnect, feeding continuously validated pentest findings directly into Wiz's exposure management view. The post Unifying Security Testing and Exposure Management: Introducing the Synack and Wiz Integration appeared first on Synack.
First reported Sep 23, 2026 18:37 UTCCatalog metadata updated Oct 17, 2026 02:53 UTCOpen evidence recordA year since launching Synack’s integration with Qualys, the partnership now includes broader platform support, more AI-led testing, and a shared presence at Qualys ROCon Americas 2026. The post Turn Scanner Findings into Validated Risk with Synack and Qualys appeared first on Synack.
First reported Oct 05, 2026 09:28 UTCCatalog metadata updated Oct 17, 2026 02:53 UTCOpen evidence recordIn September, hackers from a group called ShinyHunters announced that they stole a trove of FBI data about its own agents. It was an intelligence disaster. Last week, the FBI arrested (alternate link) someone associated with that crime.
First reported Oct 12, 2026 15:01 UTCCatalog metadata updated Oct 17, 2026 02:51 UTCOpen evidence recordMatthew Green has a new site that tries to estimate the number of cryptanalyst-hours that have been spent analyzing different public-key algorithms: Abstract: We estimate how much public cryptanalysis each public-key assumption has received, using the literature itself as the instrument. From roughly sixteen thousand candidate papers we classify cryptanalytic work on ECDLP, structured and plain lattices, syndrome decoding and their comparators, then convert papers into estimated research-allocation years through a person-level author map. These publication-based estimates may substantially overstate actual time spent. Lattices have overtaken elliptic curves in this cumulative measure only recently; we express that history as inference budgets under stated productivity assumptions. The study was conducted by AI models: Claude Fable 5.1 and Claude Opus 5.5 built the pipeline, ran the analysis and wrote this page, with contributions from GPT-6 Astra. Matthew Green set the questions, made the key methodological decisions and oversaw the work...
First reported Oct 15, 2026 16:24 UTCCatalog metadata updated Oct 17, 2026 02:51 UTCOpen evidence recordThis essay was written with Seva Gunitsky, and originally appeared in Foreign Affairs. Two weeks after Moscow’s full-scale invasion of Ukraine in March 2022, the Russian TV Channel One editor Marina Ovsyannikova burst onto the set of the evening newscast. She held up a hand-drawn sign behind the anchor’s head that read: “Stop the war. Don’t believe propaganda. They’re lying to you!” She shouted, “No to war!” until she was dragged away. No one has protested the war on Russian television since then, partly as a result of tighter security and a general climate of fear. But in October 2024, Margarita Simonyan, one of Russia’s chief propagandists, gave another explanation. A growing number of the RT network’s anchors, she explained to an interviewer, are not real. “That face doesn’t exist. We generated the voice and everything else.” They were, she meant, produced by artificial intelligence. In a follow-up interview with the newspaper ...
First reported Oct 08, 2026 11:07 UTCCatalog metadata updated Oct 17, 2026 02:51 UTCOpen evidence recordMatthew Green has been writing a rather pessimistic series of posts about the potential for AI systems to vastly outperform humans in cryptanalysis of both symmetric and public-key ciphers. I am more optimistic than he is. That is, I have stronger faith in the over-engineering cryptographers tend to do. I am trying to write this up in more detail.
First reported Oct 14, 2026 14:24 UTCCatalog metadata updated Oct 17, 2026 02:51 UTCOpen evidence recordApple just released a system called “Reference Image.” It can verify the image is exactly as taken by an iPhone—new models only—without tying it to a specific iPhone or photographer. It can also verify that multiple images came from the same iPhone. Other industry solutions require a photographer or institution to vouch for an image using their own credentials. We are concerned this puts some photographers, such as those operating in conflict zones, in a difficult position; it should not be necessary to forgo anonymity in order to prove image authenticity. We built Apple Reference Image to avoid using an explicit, public credential for photographers, and to avoid even implicit public association between different photos taken by the same sensor. The final reference image is instead signed by Apple’s signing service, after validation by PCC. That signature is backed by Apple’s strongest technical guarantees...
First reported Oct 07, 2026 11:07 UTCCatalog metadata updated Oct 17, 2026 02:51 UTCOpen evidence recordNew research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.
First reported Oct 16, 2026 21:06 UTCCatalog metadata updated Oct 17, 2026 02:51 UTCOpen evidence recordOn Wednesday I spent a day fishing, on a small boat out of Gloucester, MA. We caught many cod (none of which we could keep), and a bunch of hake and mackerel (all of which we could keep). And…I caught a squid! Near as I can tell, it’s a longfin squid, sometimes called a Boston squid (Doryteuthis (Amerigo) pealeii). That night I cooked it over a barbecue grill—hot and fast. Delicious.
First reported Oct 09, 2026 20:24 UTCCatalog metadata updated Oct 17, 2026 02:51 UTCOpen evidence recordAnother IoT cyberattack, this one in France: Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected. […] Normally, supermarket freezers go through a short period of defrosting overnight, in which temperatures rise slightly. But the hackers ordered the units to heat up and stay hot, although Danfoss did not confirm any reports about just how warm the fridges and freezers could become in that process. Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified...
First reported Oct 14, 2026 14:10 UTCCatalog metadata updated Oct 17, 2026 02:51 UTCOpen evidence recordThis is a current list of where and when I am scheduled to speak: I’m speaking at ATTENTION: Democracy, Rebuilt in Montreal, Quebec, Canada. The event runs October 21–23, 2026, and my talk is on Wednesday, October 21. I’m speaking at the University of Toronto in Toronto, Ontario, Canada, at 5 PM ET on October 22, 2026. I’m speaking at [un]prompted in San Francisco, California. The event runs October 27–29, 2026, and my talk is at 11:35 AM PT on Thursday, October 29. I’m speaking at the Catalyst Summit in Brampton, Ontario, Canada, on Wednesday, November 18, 2026...
First reported Oct 14, 2026 16:02 UTCCatalog metadata updated Oct 17, 2026 02:51 UTCOpen evidence recordThis is a problem: Any open model whose weights have been edited can carry a backdoor, whether it’s a task-specific fine-tune, a merged adapter or an abliterated build. We have abliterated models in the title because it’s the most popular reason people download modified weights without verifying what’s inside. Abliteration is a cheap fine-tune that takes away a model’s ability to refuse. You find the direction in the weights that carries “no” and subtract it. The model then answers things a safety-tuned version would turn down. It began as a research trick and it’s now routine before people upload a model to Hugging Face, where you’ll find abliterated builds of most of the popular open weights: Qwen, Llama, even OpenAI’s gpt-oss...
First reported Oct 16, 2026 11:04 UTCCatalog metadata updated Oct 17, 2026 02:51 UTCOpen evidence recordAdded Features Include Ubuntu 26.04 "resolute" in distro codenames [#3397 @anchore-oss-update-bot] source RPM filtering on Hummingbird [#3410 @willmurphyscode] Bug Fixes use relatedVulnerabilities description as fallback in SARIF output [#3271 @axidex] improve platform CPE determination logic [#3470 @westonsteimel] normalize uppercase V in semantic version comparison [#3461 @immanuwell] purl handling in cgr maven libs [#3420 @willmurphyscode] Treat uppercase V prefixes the same as lowercase v prefixes in fuzzy version comparison [#3037 #3089 @wasup-yash] Add Runtime Warnings When TLS Verification Is Disabled or HTTP Is Enabled [#3101 #3396 @Dashtid] Add support for the aarch64 architecture when parsing the version of Ruby gems in lockfiles [#3442 #3475 @msnandhis] zsh completion fails [#2933 #3433 @brandtkeller] (Full Changelog)
First reported Jun 03, 2026 14:19 UTCCatalog metadata updated Oct 17, 2026 02:49 UTCOpen evidence recordAdded Features Expose distro-fixed dropped matches via ignoredMatches so --show-suppressed can surface them [Issue #3450] [PR #3705 @philroche] Licensing: copyright owner missing, needed for Debian packaging [Issue #3501] Bug Fixes fixes typo in cpe example input for cpe-direct scan [PR #3679 @zhill] --by-cve: which advisory record survives the merge varies between runs [Issue #3630] Additional Changes OpenVEX transformer drops the namespace from Go module PURLs [Issue #3680] [PR #3683 @arpitjain099] Docs missing for include-aliases [Issue #3663] [PR #3671 @dev-rehaann] Dependencies 54 dependency changes (54 updated). 6 vulnerabilities remediated. 🟢 Remediated (6) GHSA-2v4p-qf9q-27wj (High) — google.golang.org/grpc GHSA-7jxh-36q5-gcqv (Medium) — github.com/containerd/containerd/v2 GHSA-qc2q-p7wx-3px3 (Medium) — google.golang.org/grpc GHSA-vp52-pcj8-j9qc (High) — google.golang.org/grpc GO-2026-6354 (High) — golang.org/x/crypto GO-2026-6355 (High) — golang.org/x/crypto Updated (54 packages) cloud.google.com/go/auth v0.22.0 → v0.23.2 cloud.google.com/go/iam v1.11.0 → v1.12.0 cloud.google.com/go/logging v1.18.0 → v1.19.0 cloud.google.com/go/monitoring v1.29.0 → v1.30.0 cloud.google.com/go/storage v1.64.0 → v1.65.1 github.com/CycloneDX/cyclonedx-go v0.11.0 → v0.12.0 github.com/anchore/go-sync v0.1.1 → v0.1.2 github.com/anchore/stereoscope v0.3.1 → v0.3.2 github.com/anchore/syft v1.51.1 → v1.52.0 github.com/aws/aws-sdk-go-v2 v1.43.4 → v1.44.0 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16 → v1.7.20 github.com/aws/aws-sdk-go-v2/config v1.32.35 → v1.32.40 github.com/aws/aws-sdk-go-v2/credentials v1.19.34 → v1.19.39 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 → v1.18.40 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 → v1.4.40 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 → v2.7.40 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 → v1.4.41 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 → v1.13.19 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28 → v1.10.0 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 → v1.13.40 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36 → v1.19.41 github.com/aws/aws-sdk-go-v2/service/s3 v1.106.5 → v1.108.0 github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 → v1.6.0 github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 → v1.34.0 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 → v1.39.0 github.com/aws/aws-sdk-go-v2/service/sts v1.45.4 → v1.46.0 github.com/aws/smithy-go v1.27.6 → v1.28.1 github.com/containerd/containerd/v2 v2.3.4 → v2.3.5 (🟢 remediated GHSA-7jxh-36q5-gcqv) github.com/docker/cli v29.7.2+incompatible → v29.8.0+incompatible github.com/google/go-containerregistry v0.21.9 → v0.22.1 github.com/googleapis/enterprise-certificate-proxy v0.3.19 → v0.3.20 github.com/googleapis/gax-go/v2 v2.23.0 → v2.24.0 github.com/gpustack/gguf-parser-go v0.25.0 → v0.26.3 github.com/hashicorp/go-getter v1.8.8 → v1.8.9 github.com/klauspost/compress v1.19.2 → v1.20.0 github.com/moby/moby/api v1.55.0 → v1.56.0 github.com/moby/moby/client v0.5.1 → v0.6.0 github.com/pandatix/go-cvss v0.6.2 → v0.6.4 github.com/terminalstatic/go-xsd-validate v0.1.6 → v0.1.8 golang.org/x/crypto v0.55.0 → v0.56.0 (🟢 remediated GO-2026-6354, GO-2026-6355) golang.org/x/mod v0.40.0 → v0.41.0 golang.org/x/time v0.15.0 → v0.16.0 google.golang.org/api v0.292.0 → v0.294.0 google.golang.org/genproto v0.0.0-aa98bba → v0.0.0-e75dac1 google.golang.org/genproto/googleapis/api v0.0.0-925bb5d → v0.0.0-e75dac1 google.golang.org/genproto/googleapis/rpc v0.0.0-6ac0973 → v0.0.0-08b0e42 google.golang.org/grpc v1.83.0 → v1.83.2 (🟢 remediated GHSA-2v4p-qf9q-27wj, GHSA-qc2q-p7wx-3px3, GHSA-vp52-pcj8-j9qc) google.golang.org/protobuf v1.36.12-0.f2248ac → v1.36.12 modernc.org/cc/v4 v4.29.1 → v4.29.2 modernc.org/ccgo/v4 v4
First reported Sep 17, 2026 16:45 UTCCatalog metadata updated Oct 17, 2026 02:49 UTCOpen evidence recordAdded Features Include vulnerable ranges in CycloneDX output format [Issue #3512] [PR #3519 @somaz94] Bug Fixes honor match.rust.using-cpes configuration [PR #3611 @Dashtid] Dependencies 11 dependency changes (11 updated). 2 vulnerabilities remediated. 🟢 Remediated (2) GHSA-hc8v-wwc9-vgxm (High) — github.com/go-git/go-git/v5 GHSA-qgq7-7hm3-q39j (Medium) — github.com/go-git/go-git/v5 Updated (11 packages) github.com/anchore/syft v1.50.0 → v1.51.0 github.com/diskfs/go-diskfs v1.9.3 → v1.9.4 github.com/gabriel-vasile/mimetype v1.4.13 → v1.4.15 github.com/go-git/go-billy/v5 v5.9.0 → v5.9.1 github.com/go-git/go-git/v5 v5.19.1 → v5.19.2 (🟢 remediated GHSA-hc8v-wwc9-vgxm, GHSA-qgq7-7hm3-q39j) github.com/klauspost/compress v1.19.0 → v1.19.1 github.com/magiconair/properties v1.8.10 → v1.18.11 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 → v6.0.3 github.com/ulikunitz/xz v0.5.15 → v0.5.16 go.yaml.in/yaml/v3 v3.0.4 → v3.0.5 modernc.org/sqlite v1.54.0 → v1.55.0 (Full Changelog)
First reported Aug 10, 2026 16:54 UTCCatalog metadata updated Oct 17, 2026 02:49 UTCOpen evidence recordThe public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.