OneNote File Extraction
Recently, I had to extract embedded files from a set of OneNote files (extension .one). 
Search Intelligence
Wireshark 5.0.0rc1 Release
Wireshark Release Candidate 5.0.0 was published : soon we can expect a new major version of Wireshark. 
YARA-X 1.22.1 Release
YARA-X&#;x26;#;39;s 1.22.1 is a bugfix version, it brings 2 bugfixes. 
Inside a malicious Claude Code-branded extension and its persistent SSH backdoor
Microsoft analyzes a malicious Claude Code–branded extension, its persistent SSH backdoor, and guidance to detect and remediate it. The post Inside a malicious Claude Code-branded extension and its pe
China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days
Vapor Panda targeted more than 200 organizations spanning at least 14 countries, according to CrowdStrike. The ongoing campaign is remarkably successful and operating at shocking speed. The post China
Friday Squid Blogging: Bigfin Squid Off California Coast
Neat video : The sighting, announced September 2, marks the first time anyone has spotted a live bigfin squid, which belongs to the Magnapinna genus, in the northeastern Pacific Ocean. As usual, you c
Apple notifications alert victims in 99 countries about mercenary spyware infections
The notifications come shortly before the Pall Mall Process is nearing final negotiations on guidelines for the use of commercial hacking tools. The post Apple notifications alert victims in 99 countr
From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
Teams support impersonation led to remote access, malicious runtime execution, and Certificate Services abuse through authentication relay and Kerberos. The post From help desk impersonation to AD CS
What Exactly Is ISOC? And What Does It Mean for You?
Why Integrated Security Operations Centers Are the Future of AI-Driven Security – Aimei Wei, Founder, CTO at Stellar Cyber San Jose, Calif. – Oct. 30, 2026 Gartner recently released a new category of
Defense contractor pleads guilty to aiding North Korean remote worker scheme
The 62-year-old allowed co-conspirators to use his identity and top secret security clearance to apply for almost 100 jobs last year. The scheme’s success rate was limited. The post Defense contractor
Syrian hacker who served Assad regime gets 42 months in US prison
Ahmad Umar Agha is best known for posting a fake Associated Press tweet claiming President Obama was injured in a White House bombing. The post Syrian hacker who served Assad regime gets 42 months in
Into the Breach: A New Cybersecurity Docuseries Hosted By Kari Byron
This week in cybersecurity from the editors at Cybercrime Magazine Sausalito, Calif. – Oct. 30, 2026 – Watch Into the Breach on YouTube Hosted by Kari Byron (MythBusters) and produced by Cyber King Pr
Binance hit by largest-ever crypto theft, with $6.3 billion stolen
Attackers stole about $6.3 billion in cryptocurrency from Binance in what analysts say is the largest crypto theft on record.
Hackers steal and publish data on 41,000 Homeland Security workers
A hacker group claims it stole data on 41,000 DHS employees, exposing work contact details and internal group memberships.
Filter generation in practice: from algorithms to LLMs
We automate filter generation for security alerts using an algorithm, a large language model, and a group of LLM agents.
ISC Stormcast For Friday, October 30th, 2026
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release
TL;DR: WordPress 7.1.4 was released on October 28, 2026. According to WordPress, it includes fixes for 22 security vulnerabilities. The most serious is an unauthenticated race condition in the Core up
DefenderKiller: How Vulnerable Drivers Are Being Abused to Disable Endpoint Security
Flashpoint analysts examine an open-source EDR killer that exploits a legacy Microsoft driver to terminate security processes, including modified variants of the original proof of concept. The post De
Wordfence Bug Bounty Program Monthly Report – July 2026
In July 2026, the Wordfence Bug Bounty Program received 1077 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPre
Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party Script
HUDSON ROCKINFOSTEALERS.COM · THREAT RESEARCH Developing investigation Polymarket / Third-party JavaScript Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party Script A script associat