by Revel Aldwin (DevSecOps Consultant at ITSEC Asia)

Imagine this: you accidentally leave your house keys under the doormat, and a nosy neighbor spots them. You’re told about it, but instead…

We speak in emojis. Now, so do the threats.

Discover Varunastra, the powerful new tool for robust Docker security. Detect vulnerabilities, scan for secrets, and extract assets for enhanced protection.

Perform Registry Forensics to Investigate a case.

BFScan is a powerful tool to extract URLs, paths, and secrets from JAR, WAR, and APK files, generating raw HTTP requests and OpenAPI specs for security analysis.

I was in Cloudflare the other day and I saw this:

Scan for secrets using regex+entropy with LLM

Microsoft reveals Russian state actor Secret Blizzard is targeting foreign embassies in Moscow with ISP-level AiTM attacks, deploying ApolloShadow malware to spy on diplomats.

In the age of cloud-native development, a single leaked API key can cost thousands — or worse, lead to a breach.
From AWS access keys to…

A new report reveals a data broker owned by major U.S. airlines is selling billions of passenger records to government agencies for warrantless searches.

MI6 has launched Silent Courier, a darknet portal and YouTube channel that allows anyone to securely and anonymously contact British intelligence.

The Secret Service has dismantled a massive, covert network near the UN in NYC, capable of disrupting mobile towers and launching devastating cyberattacks.

The Secret Service has dismantled a vast telecom network near the UN capable of disabling cell towers, disrupting communications, and aiding foreign threats.

Researchers extracted the Intel SGX DCAP attestation key using a sub-$1k hardware interposer. This attack breaks the root of trust, allowing attackers to forge quotes and compromise Web3 ecosystems.

Cybersecurity is like a game where the Security Implementers try to protect computers, but the malicious actors keeps finding the new ways…

Jenkins warned of a Critical SAML Plugin flaw (CVE-2025-64131) that allows session replay/hijacking due to a missing cache. Multiple plugins also expose API tokens in plaintext.