LG webOS vulnerabilities: testing Smart TVs on a corporate network
Meeting room televisions need owners and access boundaries too. This analysis turns webOS research into an inventory, update and network testing workflow with observable evidence.
Blog
Практические руководства по пентесту, исследованию уязвимостей и инструментам безопасности на базе ИИ.
Статьи публикуются на английском и португальском языках.
Исследования
135 публикаций
Docker Hub GhostPat: reviewing tokens and trust in container images
A Docker Hub fix highlights the importance of knowing who can publish container images. An original review workflow for credentials, ownership changes and integrity evidence throughout software delivery.
Semiconductor supply chains: the risk a supplier register can hide
A supplier's headquarters does not reveal every equipment dependency. Map support, replacement paths and alternatives before an urgent migration.
Technical team continuity: who can operate when the specialist is away?
Use the PERM announcement as a prompt to review dependence on individuals, without inferring risk from a worker's nationality.
GhostAction on GitHub Actions: protecting secrets and reviewing workflows
An automation with a security label can still carry dangerous behavior. Our analysis proposes authorized tests for workflow changes, secret exposure and runner boundaries.
Cybersecurity Startups: The Application Security Opportunity
NFX sees an opening for security startups as software changes. Our analysis turns that thesis into a practical evidence checklist for evaluating application security, AI integrations and pentest providers.
The AI “Super Bubble” Warning Is a Filter, Not a Funeral
Two of China's most respected hedge fund managers called the global AI rally a super bubble. Here is why that warning is actually good news for security and what a correction would do to the companies running on narrative versus the ones solving real problems.
Novo Nordisk Breach: How a Leaked GitHub Token Exposed the Exact Ozempic Formula
FulcrumSec claims 1.3 TB stolen from Novo Nordisk, including source code, the exact Ozempic formula and clinical trial data on roughly 11,500 patients. Initial access came from one GitHub token, two months of dwell time, and a lot of lessons every engineering org should take from it.
iFood “Mega Leak” Alert: What This Kind of Case Teaches Every Business About Data Security
A threat actor claims to hold a massive iFood customer database and is demanding payment to suppress it. The pay-or-leak model, why CPF and contact data is dangerous, and concrete steps for businesses and customers.