BFScan is a powerful tool to extract URLs, paths, and secrets from JAR, WAR, and APK files, generating raw HTTP requests and OpenAPI specs for security analysis.

I was in Cloudflare the other day and I saw this:

Scan for secrets using regex+entropy with LLM

Microsoft reveals Russian state actor Secret Blizzard is targeting foreign embassies in Moscow with ISP-level AiTM attacks, deploying ApolloShadow malware to spy on diplomats.

In the age of cloud-native development, a single leaked API key can cost thousands — or worse, lead to a breach.
From AWS access keys to…

A new report reveals a data broker owned by major U.S. airlines is selling billions of passenger records to government agencies for warrantless searches.

MI6 has launched Silent Courier, a darknet portal and YouTube channel that allows anyone to securely and anonymously contact British intelligence.

The Secret Service has dismantled a massive, covert network near the UN in NYC, capable of disrupting mobile towers and launching devastating cyberattacks.

The Secret Service has dismantled a vast telecom network near the UN capable of disabling cell towers, disrupting communications, and aiding foreign threats.

Researchers extracted the Intel SGX DCAP attestation key using a sub-$1k hardware interposer. This attack breaks the root of trust, allowing attackers to forge quotes and compromise Web3 ecosystems.

Cybersecurity is like a game where the Security Implementers try to protect computers, but the malicious actors keeps finding the new ways…

Jenkins warned of a Critical SAML Plugin flaw (CVE-2025-64131) that allows session replay/hijacking due to a missing cache. Multiple plugins also expose API tokens in plaintext.

JS Analyzer A powerful Burp Suite extension for JavaScript static analysis. Extracts API endpoints, URLs, secrets, and email addresses from JavaScript files with intelligent noise filtering. The g…

Critical Ingress-Nginx flaws (CVE-2026-1580) allow RCE and secret theft via config injection. Upgrade to v1.13.7 or v1.14.3 immediately to secure K8s.

Vercel investigates a major breach by ShinyHunters. With Next.js source code and tokens at risk, developers must rotate secrets immediately. Stay updated.

Bitwarden CLI v2026.4.0 compromised in "Dune"-themed supply chain attack. Malware steals cloud secrets and SSH keys. Rotate your credentials immediately.

Socket uncovers a massive Mini Shai-Hulud breach in the Intercom PHP SDK. Malicious version 5.0.2 steals cloud secrets and GitHub tokens. Rotate keys now!

Microsoft Threat Intelligence exposes a massive overhaul of the Kazuar backdoor. Secret Blizzard weaponizes a modular, multi-tiered P2P botnet.