Author: HackWatchit

of AI agents has taken the world by storm. Agents can interact with the world around them, write articles (not this one though), take actions on your behalf, and generally make the difficult part of automating any task easy and approachable.  Agents take aim at the most difficult parts of processes and churn through the issues quickly. Sometimes too quickly — if your agentic process requires a human in the loop to decide on the outcome, the human review stage can become the bottleneck of the process.  An example agentic process handles customer phone calls and categorizes them. Even a 99.95% accurate…

Joff Thyer// In this webcast, we talk about the 2020 End of Life for Python2. We address what the short and medium term impacts will likely be. Key language differences will be highlighted with techniques to modify your code to be forward compatible. Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-content/uploads/2020/09/SLIDES_P2K20Python2Python3.pdf As a SANS instructor teaching SEC573: Automating Information Security with Python, over the past three years, I have steadily moved my teaching materials, examples, demonstrations and personal code to Python3. In this process, I have had to break habits and learn new habits to write Python3 compatible scripts.…

U.S. CISA adds Yii Framework and Commvault Command Center flaws to its Known Exploited Vulnerabilities catalog Pierluigi Paganini May 03, 2025 U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Yii Framework and Commvault Command Center flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Qualitia Active! Mail, Broadcom Brocade Fabric OS, and Commvault Web Server flaws to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions for these flaws: CVE-2025-34028 Commvault Command Center Path Traversal Vulnerability CVE-2024-58136 Yiiframework Yii Improper Protection of Alternate Path Vulnerability The vulnerability CVE-2025-34028 (CVSS score of 10) is a path…

The United Kingdom’s National Cyber Security Centre warned that ongoing cyberattacks impacting multiple UK retail chains should be taken as a “wake-up call.” Part of the GCHQ British intelligence agency, the NCSC provides support and guidance to private and public sector entities following major cybersecurity incidents to protect the UK’s critical services. In a statement issued this week, the NCSC also confirmed that it’s working with affected organizations in the retail sector to assess the attacks’ nature and impact. “The disruption caused by the recent incidents impacting the retail sector are naturally a cause for concern to those businesses affected,…

“This World Password Day is a timely reminder that strong passwords are more than just a best practice, they are critical to safeguarding our personal and professional digital lives. In a world where our data is stored, processed, and accessed online, the strength and security of our credentials can determine whether we remain protected or become vulnerable to cyber threats. Strong passwords serve as the frontline defence against unauthorised access. They protect not only emails and personal files, but also critical infrastructure, cloud platforms, and autonomous systems that run in the background, such as service accounts, APIs, and automated workflows.…

WordPress sites are under threat from a deceptive anti-malware plugin. Learn how this malware grants backdoor access, hides itself, and even modifies core files like wp-cron.php for persistence. Stay protected. Security researchers at Wordfence recently uncovered a tricky piece of malware targeting WordPress websites. This malicious software is designed to look like a genuine anti-malware plugin, often appearing in the file system with names such as ‘WP-antymalwary-bot.php’. According to Wordfence Threat Intelligence Team’s technical blog post, this fake plugin contains several dangerous capabilities. Such as, it allows attackers to control an infected website, hide from the WordPress admin dashboard, and…

Anviz launched W2 Face, its latest hybrid biometric access control and attendance terminal. Designed to meet the needs of modern enterprises, the W2 Face combines facial recognition, fingerprint authentication, and RFID capabilities in a compact, intelligent device. Responding to market evolution As the access control landscape shifts toward integrated multi-biometric solutions, businesses increasingly seek systems that enhance security and operational efficiency. Market analysis conducted by Anviz has revealed key trends driving this demand: A growing preference for contactless and hygienic technologies Small and medium-sized enterprises are prioritizing cost-effective, reliable solutions An increased need for flexible authentication methods Rising expectations for…

Mike Felch// A Tale of Blue Destroying Red Let me start by sharing a story about a fairly recent red team engagement against a highly-secured technical customer that didn’t end so well for me. Their SOC was well-equipped with sophisticated in-house anomaly detection tools, incredible visibility across the organization, and a tenacious incident response team. They were a Google customer and leveraged G Suite to handle their cloud-based business applications which immediately made me excited. I’ve spent a considerable amount of time researching and learning how to weaponize Google products to target organizations, so I immediately had a number of…

On ThursdaY, Reuters published a photo depicting then-United States national security adviser Mike Waltz checking his phone during a cabinet meeting held by President Trump in the White House. If you enlarge the portion of the image that captures Waltz’s screen, it seems to show him using the end-to-end encrypted messaging app Signal. But if you look more closely, a notification on the screen refers to the app as “TM SGNL.” During a White House cabinet meeting on Wednesday, then, Waltz was apparently using an Israeli-made app called TeleMessage Signal to message with people who appear to be top US…