Author: HackWatchit

OPKSSH (OpenPubkey SSH) makes it easy to authenticate to servers over SSH using OpenID Connect (OIDC), allowing developers to ditch manually configured SSH keys in favor of identity provider-based access. By tightly integrating with identity providers (IdPs) and avoiding any additional trusted third party, OPKSSH offers a streamlined and secure way to manage SSH authentication. This week, OPKSSH was officially open-sourced under the umbrella of the OpenPubkey project. While OpenPubkey itself became a Linux Foundation open-source initiative in 2023, OPKSSH remained closed-source until now. Originally developed and maintained by BastionZero (now part of Cloudflare), Cloudflare has gifted the code for…

U.S. Federal agencies and their vendors are challenged to protect their workloads against increasingly sophisticated cyberthreats throughout the application lifecycle. Additionally, the need to drive efficiency through cost-effective platforms is becoming apparent. Palo Alto Networks has achieved Federal Risk and Authorization Management Program (FedRAMP) High Authorization across its network, cloud and security operations (SecOps) platforms, ensuring the highest level of protection for sensitive government data, via integrated best of breed products. This enhanced certification complements AWS GovCloud (US) regions, specifically designed to handle sensitive data and workloads that require stringent security and compliance, including FedRAMP High. These organizations must protect…

Palo Alto, USA, March 28th, 2025, CyberNewsWire From WannaCry to the MGM Resorts Hack, ransomware remains one of the most damaging cyberthreats to plague enterprises. Chainalysis estimates that corporations spend nearly $1 billion dollars on ransom each year, but the greater cost often comes from the reputational damage and operational disruption caused by the attack. Ransomware attacks typically involve tricking victims into downloading and installing the ransomware, which copies, encrypts, and/or deletes critical data on the device, only to be restored upon the ransom payment. Traditionally, the primary target of ransomware has been the victim’s device. However, thanks to the…

Silent Push uncovers an alleged Russian intelligence phishing campaign impersonating the CIA, targeting Ukraine supporters, anti-war activists and informants. Cybersecurity researchers at Silent Push have discovered a complex and extensive phishing operation, allegedly launched by Russian Intelligence Services or a similarly motivated entity, targeting individuals who support Ukraine and oppose the Russian government. The campaign, which surfaced in early 2025, employed fake website lures to gather personal information from Russian citizens and informants. This was a particularly sensitive endeavour given the illegality of anti-war activities within the Russian Federation. The phishing sites collected user input using a combination of static…

(LLMs) are improving in efficiency and are now able to understand different data formats, offering possibilities for myriads of applications in different domains. Initially, LLMs were inherently able to process only text. The image understanding feature was integrated by coupling an LLM with another image encoding model. However, gpt-4o was trained on both text and images and is the first true multimodal LLM that can understand both text and images. Other modalities such as audio are integrated into modern LLMs through other AI models, e.g., OpenAI’s Whisper models. LLMs are now being used more as information processors where they can…

Information takes many forms. Some of these forms are easy to understand and others less so. Some are hardly even recognizable. How do you know when you’ve found something interesting? When is that string of random-looking gibberish actually random gibberish and when is it something you can pick apart and make use of? What about that giant blob of text that may or may not have interesting parts inside it? CyberChef – a free browser-based tool from GCHQ – is a great place to start. It knows about lots of different data formats and encoding rules and lets you string…

Mozilla fixed critical Firefox vulnerability CVE-2025-2857 Pierluigi Paganini March 28, 2025 Mozilla addressed a critical vulnerability, tracked as CVE-2025-2857, impacting its Firefox browser for Windows. Mozilla has released security updates to address a critical flaw, tracked as CVE-2025-2857, impacting its Firefox browser for Windows. Recently, Google addressed a similar vulnerability, tracked as CVE-2025-2783, in Chrome that has been actively exploited in the wild as a zero-day. The vulnerability CVE-2025-2857 is an incorrect handle that could lead to a sandbox escape. “Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised…

A U.S. Coast Guard Station Fort Lauderdale law enforcement boat crew seized approximately 550 pounds of cocaine, worth an estimated $6.3 million, from a suspected drug smuggling venture near Port Everglades, Saturday. The law enforcement crew took custody of the 36-foot vessel, Bella Vita, and transferred the suspected smuggler to Coast Guard Investigative Service agents ashore to face federal prosecution. “Protecting our maritime borders from illicit drug trafficking and transnational criminal organizations remains one of our highest priorities,” said Lt. Daniel Sunday, Coast Guard Sector Miami‘s deputy enforcement chief. “The Coast Guard and our federal, state and local law enforcement…

The healthcare industry is particularly vulnerable to cybersecurity threats due to the valuable data it processes; Protected Health Information (PHI) is among the most sensitive and valuable data in existence. As the past few years have shown, the consequences of a breach can be costly and, in the most severe cases, impact patient care, highlighting the critical need for standardized industry practices and regulations to uphold accountability. Organizations often develop their cybersecurity measures internally since legislative direction has been limited and typically is written to be flexible and technology-agnostic. Seeing this gap, several groups are attempting to establish the most…