Author: HackWatchit

Palo Alto, USA, March 18th, 2025, CyberNewsWire Groundbreaking initiative reveals browser vulnerabilities in understudied yet critical attack surface SquareX, a pioneer in Browser Detection and Response (BDR) space, announced the launch of the “Year of Browser Bugs” (YOBB) project today, a year-long initiative to draw attention to the lack of security research and rigor in what remains one of the most understudied attack vectors – the browser. The browser has evolved from a simple web rendering engine to be the new “endpoint” — the primary gateway through which users interact with the Internet, for work, leisure, and transactions. Yet, traditional…

Applications developed by citizen developers are on the rise. Low-code and no-code (LCNC) platforms are reshaping the development ecosystem. These tools are broadening horizons and enabling citizen developers to create powerful applications. LCNC development is a way of developing apps in which developers use existing system design elements that can be added onto a visual interface. These platforms focus on swift development that can automate processes, empowering users with minimal or no technical knowledge to build their apps innovatively. However, security is not often at the forefront of app development when using LCNC platforms, as business users often lack a…

A member of the U.S. House Committee on Homeland Security has reached out to the federal government, urging the administration to examine, through a report, the structure of the Cyber Safety Review Board (CSRB) to address concerns about transparency, accountability, and efficacy as it considers reconstituting the Board. The Board, which was first set up under the administration of former president Joe Biden administration by Executive Order following the 2021 SolarWinds intrusion, was tasked with investigating major cyber incidents. However, the Board has faced several challenges since its inception. Andrew Garbarino, a Republican from New York and chairman of the…

Static Application Security Testing (SAST) found favor among security teams as an easy way to deploy security testing without really engaging developers. With the ability to analyze source code early in the software delivery lifecycle, SAST solutions offered a more proactive approach to finding security issues prior to production. But this came with a cost. Many of the findings of SAST tools are potential vulnerabilities – meaning that a lot of manual effort and time is required to evaluate and prioritize the risks. Developers are left to parse through thousands of alerts with minimal context into which issues are most…

With Android devices deeply embedded in business operations, it’s no surprise that cybercriminals are increasingly targeting them. Businesses are now prime targets, facing threats like banking trojans, spyware, ransomware, and ad fraud, all designed to steal sensitive company data, compromise financial systems, and disrupt operations. The problem is, that many security tools aren’t built to catch these threats fast enough, leaving people and businesses vulnerable. To help with this, ANY.RUN has added Android OS support to its interactive sandbox. Cybersecurity professionals can now run and analyze APK files in real-time, spot threats more quickly, and get a much clearer picture…

Ean Meyer // This post is for attendees of Wild West Hackin’ Fest: Deadwood 2022 POGs? Yes, POGs! If you aren’t familiar with POGs, this game started decades ago, reaching the peak of its popularity in the 1990s. The game is simple: players have stacks of cardboard discs with logos, memes, and other graphic (“POGs”) that they place face down, as well as a “slammer.” To start, two players contribute an equal number of POGS from their collection to create a combined stack of 10-14 POGs. They then take turns throwing their slammer at the stack. The POGs explode up when hit. The ones…

At ReliaQuest, our mindset is focused on getting a little bit better every day by living our values of accountability, adaptability, focus, and helpfulness. For the last four years, ReliaQuest has been sharing this mindset with students and teaching them life skills through the game of golf—all while raising awareness of cybersecurity and cybersecurity careers. Since 2022, ReliaQuest has sponsored the PGA TOUR’s Valspar Championship, and specifically the Valspar’s youth golf clinic, in partnership with youth golf program First Tee of Tampa Bay. First Tee of Tampa Bay serves more than 70,000 students every year, allowing ReliaQuest to make an…

Breaking Silos — The Modern SOC Imperative 10s 10s 10s 10s Seek Slider Given the volume and sophistication of threats, that old SOC model is starting to show real issues, Clay Brothers warns in a recent eye-opening Threat Vector podcast. Brothers, a senior director at Palo Alto Networks Unit 42, pulls back the curtain on the future of security operations in his conversation with David Moulton, marketing director and host of the Threat Vector podcast. Brothers doesn’t mince…

ChatGPT SSRF bug quickly becomes a favorite attack vector Pierluigi Paganini March 18, 2025 Threat actors exploit a server-side request forgery (SSRF) flaw, tracked as CVE-2024-27564, in ChatGPT, to target US financial and government organizations. Cybersecurity firm Veriti reports that threat actors are exploiting a server-side request forgery (SSRF) vulnerability, tracked as CVE-2024-27564 (CVSS score of 6.5), in ChatGPT to target financial and government organizations in the US. The flaw resides in pictureproxy.php and attackers could exploit the issue to inject URLs via the url parameter to trigger arbitrary requests. “A Server-Side Request Forgery (SSRF) in pictureproxy.php of ChatGPT commit…