Author: HackWatchit

Vulnhuntr is an open-source tool that finds remotely exploitable vulnerabilities. It uses LLMs and static code analysis to trace how data moves through an application, from user input to server output. This helps it spot complex, multi-step vulnerabilities that traditional tools often miss. “Vulnhuntr is basically one of the first LLM agents, before people were even talking about LLM agents. The core challenge is that you can’t just feed an entire codebase to an LLM. The context window is too limited, and the more irrelevant code you include, the more likely it is to miss real vulnerabilities or start hallucinating,”…

In this Help Net Security interview, Gonçalo Magalhães, Head of Security at Immunefi, discusses the legal and ethical implications of hacking back in cross-border cyber incidents. He warns that offensive cyber actions risk violating international law, escalating conflicts, and harming innocent third parties. Instead, Magalhães advocates for legally sanctioned frameworks, such as bug bounty programs, to strengthen security without crossing dangerous lines. How do international laws complicate the use of hacking back, especially in cross-border incidents involving actors in hostile or uncooperative jurisdictions? The real issue is that cyber operations don’t respect borders, but laws absolutely do. If a company…

In brief ASIC has accused Bitget of offering unlicensed crypto futures to Australians, lacking an AFS licence and bypassing investor protections. Bitget’s products offer up to 125x leverage, far above ASIC’s 2:1 limit, exposing users to major financial risks, ASIC said. Global regulators have issued similar warnings since 2022, with actions taken in Spain, Japan, Germany, and other jurisdictions. The Australian Securities and Investments Commission has issued a public warning against Bitget, accusing the crypto exchange of offering high-risk crypto futures products without a license.ASIC said Bitget and its parent company, BTG Technology Holdings Limited, are promoting “unlicensed cryptocurrency futures…

When asked How do you approach problems at work?, have you ever stopped and wondered “What is this, a trick question?” These questions put you on the spot because you need to come up with a story fast. Plus, it’s always a bit uncomfortable to speak about negative work experiences. But every (and I mean every) job comes with problems, and solving them in a respectful, professional, and assertive way is a skill employers love seeing in job candidates. That’s why in 9 out of 10 interviews, you’ll get questions about deadlines, issues, and teamwork. However, there’s a way to…

Topic: Bridging Ethics and Security: The Impact of Ethical Hacking on GRC Watch Now Abstract:  As organizations navigate an evolving digital landscape, complex cybersecurity measures and infrastructure are required to comply with regulatory norms across the globe. With data security and privacy being primary concerns for individuals and nations worldwide, Governance, Risk, and Compliance (GRC) frameworks play a crucial role in safeguarding data and adhering to regulations. One closely aligned aspect of all risk management mandates is proactive security. Ethical hacking and penetration testing have begun as strategic approaches to strengthen security posture. Ethical hacking enables proactive identification of vulnerabilities…

Third-party involvement in data breaches has doubled this year from 15 percent to nearly 30 percent. In response, many organizations have sharpened their focus on third-party risk management, carefully vetting the security practices of their vendors. However, a critical gap remains that many organizations overlook: fourth-party risk. The silent threat of fourth-party vendors Most organizations focus only on the vendors directly in their orbit, while neglecting to dig one step deeper into who those vendors rely on to deliver their services. Fourth-party risks are particularly challenging because they’re harder to see. You may not even know they exist unless your…

Maritime ports, responsible for 80 percent of global trade and serving as critical NATO logistics hubs, are facing a surge in cyberattacks from state-linked actors, according to a new policy brief from the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE). The report highlights a sharp rise in threats targeting European and Mediterranean port facilities, with many attacks traced to Russia, Iran, and China. It revealed that nearly all surveyed countries have experienced cyber attacks within the past five years, with access control systems and vessel traffic management systems identified as the main reported risks. As cyber operations increasingly disrupt…

Microsoft has removed a compatibility hold that prevented some Easy Anti-Cheat users from installing the Windows 11 2024 Update because of a known issue that triggers restarts with blue screen of death (BSOD) errors. When it acknowledged the bug last month, the company confirmed the issue impacted devices running Easy Anti-Cheat, a popular anti-cheating service installed with hundreds of multiplayer games, including Apex Legends, War Thunder, Dead by Daylight, ELDEN RING, Rust, Squad, NBA 2K25, and many others. Redmond released an emergency update (KB5063060) for Windows 24H2 systems on June 11 to address this incompatibility issue after a wave of…

Overview CVE-2025-27136 is an XML External Entity (XXE) injection vulnerability in the CreateBucketConfiguration endpoint of  LocalS3, a local AWS S3 emulator. By sending specially crafted XML payloads, attackers can exploit this flaw to read arbitrary files from the server’s filesystem. CVE ID: CVE-2025-27136 Severity: Medium CVSS Score: 5.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) EPSS Score: 0.11% Published: April 12, 2025 Impact: Information Disclosure Attack Vector: Remote Authentication Required: No Vulnerable Component: CreateBucketConfiguration XML parsing This vulnerability affects any application using vulnerable versions of LocalS3 that are exposed to XML bucket creation requests. Technical Breakdown The CreateBucketConfiguration API endpoint accepts XML input to configure new…