Author: HackWatchit

We were recently testing a web application that used ASP.NET cookieless sessions. This meant that the session token was part of the URL as shown in the example below. http://www.blackhillsinfosec.com/(S(hd73kdjf780sndyfn23elomzqd5ghwa))/login.html In this case, the session token is of the form (S(LongRandomToken), where LongRandomToken is a long, randomly generated alpha-numeric string and takes the place of  the session cookie. This implementation makes for a messy site map when testing with Burp Suite because the changing tokens make it appear that there are limitless content paths in the application. For example, a site map that has one login page would show up…

tools like dbt make constructing SQL data pipelines easy and systematic. But even with the added structure and clearly defined data models, pipelines can still become complex, which makes debugging issues and validating changes to data models difficult. The increasing complexity of data transformation logic gives rise to the following issues: Traditional code review processes only look at code changes and exclude the data impact of those changes. Data impact resulting from code changes is hard to trace. In sprawling DAGs with nested dependencies, discovering how and where data impact occurs is extremely time-consuming, or near impossible. Gitlab’s dbt DAG…

Overview CVE-2025-29306 is a critical remote code execution (RCE) vulnerability affecting FoxCMS version 1.2.5. The flaw stems from unsafe handling of the id parameter, which is passed directly into PHP’s unserialize() function without validation. Attackers can supply malicious serialized PHP objects that trigger arbitrary command execution via system(). CVE ID: CVE-2025-29306 Severity: Critical CVSS Score: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) EPSS Score: 71.52% Affected Version: FoxCMS ≤ 1.2.5 Patched Version: None released as of writing Authentication Required: No Impact: Remote Code Execution Technical Breakdown FoxCMS uses unserialize() directly on user-supplied input from the id parameter. When a malicious serialized PHP object is supplied,…

As artificial intelligence continues to evolve from narrow applications to autonomous agents, one foundational question becomes increasingly urgent: how can we trust what we can’t fully understand or control? This is not just a philosophical concern. In real-world systems—from finance to medicine, supply chains to governance—AI is making decisions with real consequences. But without a robust trust layer, these systems become vulnerable to manipulation, error, and opacity. Blockchain is not just a financial tool or decentralized database — it is a necessary trust infrastructure for the AI-powered world. Here’s why. 1. 🔐 Trust Without Intermediaries The problem: When AI agents…

Cloud security isn’t just about having the right solutions in place — it’s about determining whether they are functioning correctly. The post Validation is an Increasingly Critical Element of Cloud Security   appeared first on Security Boulevard.

The Space Information Sharing and Analysis Center (Space ISAC) issued a TLP: CLEAR public update on its threat level assessment. The release aims to raise awareness among the space industry, government agencies, and international partners about the current threat landscape. Increased targeting, proliferation of hacktivism and geopolitically motivated attacks, and social engineering TTPs increase efficacy of initial access were among some of the factors that are commensurate with the specified criteria for Level 3: High. The space threat landscape remains active, characterized by disruptive cyber activity and electronic warfare (EW). These factors are exacerbated by geopolitical conflicts in the Middle…

ChatGPT Deep Research, which is an AI research tool to automate research, is getting support for new connectors (integrations), including Slack. Deep Research is an AI agent that automates research for you. You just need to give it a brief prompt with all the necessary details, and it will crawl the internet to write a research paper. As spotted by Tibor on X, ChatGPT has references to a new connector called ‘Slack.’ Once integrated, ChatGPT can crawl your Slack messages and use them in the context of research. References to Slack as a connector on ChatGPT It’s unclear if OpenAI…

To ensure resilience across the internet stack, organizations need to protect and manage four key areas: reachability, availability, reliability, and performance, according to Catchpoint. The negative economic impact of incidents 51% report monthly losses of over $1 million due to internet outages or degradations, up from 43% in 2024. And 1 in 8 now lose over $10 million each month, a noticeable rise since last year. One way to justify the cost of resilience is to recognize that you’re already paying for it, every time an incident happens. That impact is real, whether it shows up as downtime, lost revenue,…

One of the more difficult aspects of getting started in any new field is knowing where to begin.  When I got started in this field in 2000 there was very little in the way of getting started.  We had some weird websites and lots of posturing and belittlement. That, and we had a lot of odd folks asking you to “Cyber”…. So yea…  It pretty much blew. We also hear this industry is going to grow by 200-400% over the next few years.  That is a lot of new people coming in.  And for all that is holy and right…