Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
Intelligence reports
Loading the current evidence view. Navigation and account controls remain available.
Ordering reports and their extracted indicators.
Applying the current filters and ordering.
Forensia intelligence desk · 4,094 source documents · 4,063 stories
Live reporting, advisories and research arranged by editorial readiness. Thin sources stay visible, but they are clearly marked instead of being presented as complete analysis.
On this page
40 documents
Briefs ready now
40
Multi-source clusters
0
Publisher text withheld
27
Berlin says it won’t pay ransom after hackers steal government data
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Netdev 0x1A videos and slides are now live
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
[$] The rest of the 7.3 merge window
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
ServiceNow Patches 3 Critical Code Injection Vulnerabilities
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
McKesson Confirms Data Breach as Attacker Deadline Looms
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Security updates for Monday
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
31th August – Threat Intelligence Report
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Pharmaceutical giant McKesson warns of 'service degradation' following cyberattack
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Slovenian casinos reopen after cyberattack knocked gaming systems offline
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
What the Hugging Face Incident Teaches Security Leaders About AI Agent Access
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Anthropic Warns Claude Users of Infostealer Malware Infections
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Boston Scientific Still Recovering From Cyberattack
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Extortion Group Claims Manchester Airports Group Data Breach
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Judge Says Pentagon’s Measures Against Anthropic Were ‘Illegal and Baseless’
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
This month in security with Tony Anscombe – August 2026 edition
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
Berlin Won’t Pay Extortion Group Claiming Data Theft
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
More Details Emerge on Exploited PaperCut Vulnerabilities
An evidence-built Forensia brief is ready now; publisher prose remains at the original source.
CamoDocs: A Poisoning Attack Against Retrieval-Augmented Language Models Using Camouflaged Documents
arXiv:2608.28389v1 Announce Type: new Abstract: Retrieval-augmented generation (RAG) augments LLMs with external documents, but public or user-editable sources expose RAG systems to data poisoning: attackers can inject malicious documents to steer outputs toward targeted answers. Existing poisoning attacks often rely on query inclusion, inserting the target query into poisoned documents to improve retrieval; however, this creates lexical and embedding-space artifacts that mak…
Optimal Adversarial Testing: Extracting Honest Test Results from Dishonest Test Takers
arXiv:2608.28362v1 Announce Type: new Abstract: In applications, it is often required to test objects or people to determine their qualities in terms of certain metrics. However, besides being naturally noisy, the test results can be corrupted by adversarial behaviors of objects or people being tested (test takers). For example, dishonest test takers can cheat in the exams to distort the test results. With the development of AI technologies, such distortions driven by cheatin…
False-CSI Attacks in Power-Domain NOMA for 6G: A Threat Taxonomy and System-Level Impacts
arXiv:2608.28351v1 Announce Type: new Abstract: Power-domain non-orthogonal multiple access (NOMA) remains a widely studied technique for improving spectral efficiency and supporting dense connectivity in beyond-5G and 6G networks. Its main operating mechanisms, however, depend on the integrity of channel-state information (CSI). Power allocation, user ordering, pairing, clustering, and beamforming can all be distorted when the CSI consumed by the base station is deliberately…
Layered LLM Defenses as an Ensemble: Access Tiers, Inference Cost, and the Measured Failure Correlation Between Defense Layers
arXiv:2608.28327v1 Announce Type: new Abstract: Practitioners defend large language models (LLMs) by stacking defenses, assuming the layers compound. A stack is an ensemble, and ensembles compound only under a condition the LLM security literature recommends but never measures: the members must fail on different inputs. Two instruments make that measurable. The Adversary Access-Tier Model (AATM) grades an adversary by the access it holds, from system-only (A0) to influence ov…
TagZilla: Automated Owner and Abuse Type Tagging for Indicators of Compromise in Threat Reports
arXiv:2608.28124v1 Announce Type: new Abstract: Cyber Threat Intelligence (CTI) reports often describe Indicators of Compromise (IoCs) such as IP addresses, URLs, file hashes, and cryptocurrency wallets involved in cyberattacks. Those IoCs are typically described in the unstructured report's text, or listed at the end of the report with little context, limiting their usefulness. This paper presents TagZilla, a platform that, given a threat report, automatically analyzes its t…
Compared to What? A Human-Anchored Security Benchmark for LLM-Generated Infrastructure-as-Code
arXiv:2608.28021v1 Announce Type: new Abstract: Large language models are increasingly used to author Infrastructure-as-Code (IaC), where a single insecure default can be deployed directly into production. Prior evaluations report raw vulnerability counts for model-generated IaC, but without a human baseline they cannot determine whether models are actually worse than engineers. We introduce GenIaC-SecBench, a benchmark of 100 deployment scenarios stratified by architectural…
The Impact of Magma: A Ground-Truth Fuzzing Benchmark
arXiv:2608.28016v1 Announce Type: new Abstract: Magma is an open-source and ground-truth fuzzing benchmark that enables uniform fuzzer evaluation and comparison. Magma was originally released with a research paper published at ACM SIGMETRICS 2021. This short paper explains the motivation, the design, and the impact of Magma, with a description of extensions to the original benchmark.
Moirae: A Multimodal Agent Collaborative Framework for Dynamic Android Malware Detection
arXiv:2608.27994v1 Announce Type: new Abstract: The Android ecosystem faces persistent and rapidly evolving malware threats. Existing machine learning detectors are vulnerable to concept drift because they rely on implementation-specific features whose distributions change over time. Large language models (LLMs) offer strong semantic understanding and zero-shot reasoning, but current LLM-based detectors typically depend on code-centric or single-dimensional evidence, making t…
CAITLYN: Can LLM Agents Autonomously Synthesize Defenses against Emerging Injection Attacks?
arXiv:2608.27990v1 Announce Type: new Abstract: Prompt injection attacks on Large Language Model (LLM) agents seek to introduce malicious instructions or content into external text sources retrieved by agents, forcing the underlying LLMs to execute harmful actions outside their benign scope. While current defenses effectively counter known injection attacks, deploying them in LLM agent environments remains challenging due to attack variants and emerging threats. Moreover, exi…
CHISEL-ing Back Source Code with AI-enabled Iterative Recovery
arXiv:2608.27981v1 Announce Type: new Abstract: Decompilation aims to recover high-level, compilable, and semantically equivalent code from binaries. Traditional decompilers produce pseudo-C that is difficult to read and does not compile, while the recent LLM-assisted approaches generate readable, but semantically incorrect code. LLM-aided iterative recovery is an emerging branch of research, but prior works rely on supplied test suites for semantic recovery. In this work, we…
DisCTI: Who Needs to Know Timely? Automated Sector-Aware Cyber Threat Intelligence Dissemination
arXiv:2608.27967v1 Announce Type: new Abstract: The timely dissemination of cyber threat intelligence (CTI) is critical for organizations to mount swift and effective incident response. When valid CTI is delivered to the right sector at the right time, identical attacks can often be contained or mitigated. However, today's rapidly expanding CTI landscape overwhelms analysts, who must sift through massive and heterogeneous feeds. Existing platforms such as the Malware Informat…
Not to Break, but to Attest: Adversarial Probes for Privacy-Preserving LLM Verification
arXiv:2608.27954v1 Announce Type: new Abstract: Post-deployment changes to large language models can alter behavior while leaving routine outputs largely unchanged, creating a challenge for AI governance when model weights are proprietary. We present a privacy-preserving zk-SNARK-based audit framework that searches for probes designed in the spirit of adversarial examples to amplify logit drift between an approved model and a modified deployment. Our framework explores comple…
GraftyVul: Synthesising Insecure Programs Through Real-World Vulnerability Grafting
arXiv:2608.27928v1 Announce Type: new Abstract: Vulnerability datasets underpin a wide range of security research, including vulnerability detection, automated remediation, and secure code generation. However, existing datasets sacrifice at least one of three desirable properties: diversity (of language or vulnerability type), reproducibility/executability, or realism. We therefore present GraftyVul, a system that constructs vulnerable programs by grafting real-world vulnerab…
story desk
clustered evidenceWatchGuard Patches Critical Vulnerabilities
developing · new
Microsoft Rolls Out 22 Fresh Security Patches
source only · new
Google Patches 6th Chrome Zero-Day of 2026
developing · new
Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities
developing · new
Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities
source only · new
filter by source
sharing classification
TLP describes sharing sensitivity, not copyright permission. Reader text is limited to source-provided descriptive material; original reporting stays with its publisher.