Pramod Jogdand

Cybersecurity ki duniya mein ek funny but very real problem hai. Har koi security chahta hai. Lekin jab security ke rules daily work ko thoda difficult banana start karte hain, toh wahi log kehte hain — “Isko thoda easy nahi kar sakte?” 😄 Aur yahin se ek cybersecurity professional ki asli challenge shuru hoti hai. Ek side management hota hai jo kehta hai, “Risk kam karo.” IT team bolti hai, “False alerts bahut aa rahe hain.” Employees bolte hain, “Har baar approval kyun chahiye?” Business team bolti hai, “System down nahi hona chahiye.” Auditors bolte hain, “Compliance properly follow honi chahiye.” Customers expect karte hain ki unka data completely private rahe. Aur doosri taraf attackers hamesha kisi ek weakness ka wait kar rahe hote hain. Toh security professional kare kya? 🤔 Cybersecurity Is Not Just About Blocking Everything Kabhi-kabhi cybersecurity ko hum sirf restrictions ke perspective se dekhte hain. Website block kar di. Access restrict kar diya. Extra authentication laga...

North Korea's state-sponsored Lazarus Group is back in the headlines — and this time, the campaign hits closer to home for Indian defense-sector professionals. What Happened Security researchers at Check Point have attributed a new wave of attacks to Lazarus Group, part of their long-running "Operation Dream Job" campaign. The group is exploiting a freshly patched Windows zero-day vulnerability — CVE-2026-68820 — to deliver a never-before-seen backdoor targeting defense and aerospace companies across France, Germany, Brazil, and India. The Attack Chain Social Engineering First — Attackers pose as recruiters from well-known defense firms like Lockheed Martin, sending fake but convincing job offers to professionals in the sector. Zero-Day Exploitation — Once a target engages, the attackers exploit a privilege escalation flaw in AFD.sys (Windows Ancillary Function Driver for WinSock) — CVSS 7.0 — to gain SYSTEM-level access. Backdoor Deployment — A custom, previo...

Kal ek scan karte waqt socha ki kitni baar hum npm packages par bharosa karte hain, bina yeh jaane ki unke andar kya chal raha hai. Aur ab yeh news aayi hai ki jscrambler 8.14.0 npm release mein Rust Infostealer drop ho raha hai during install. Yeh toh ek bada khatra hai, kyunki jscrambler ko hum code protection ke liye use karte hain, aur ab yehi tool humare liye risk ban gaya hai. Maine khud jab ye try kiya to pata chala ki yeh infostealer kitna sophisticated hai. Yeh aam taur par malware scanning tools ko bypass karne mein saksham hai, aur user ke system se sensitive information chura sakta hai. Yeh cheez mujhe personally thodi overhyped nahi lagti, kyunki npm ecosystem mein packages ki security par hamesha sawal uthate rehte hain. Lekin yeh incident humein ek baar phir se sochne par majboor karta hai ki hum kitna reliable hai yeh ecosystem. Ek baat jo mujhe hairan karti hai ki koi bhi package, chahe wo kitna bhi popular kyun na ho, kabhi bhi compromised ho sakta hai. Toh hum kya ...

Cybersecurity ek aisi field hai jahan har din naye threats aur vulnerabilities ke baare mein pata chalta hai. Abhi hi, ek naya vulnerability 'Ill Bloom' ka pata chala hai jiske through attackers ne $3.1 million cryptocurrency wallet se chura liya hai. Yeh incident humein yeh yaad dilata hai ki kis tarah se cyberattackers humare digital assets ko target kar sakte hain aur kaise humein apne online transactions aur wallets ko surakshit rakhne ke liye zaroori precautions lene chahiye. Yeh 'Ill Bloom' vulnerability asal mein blockchain technology aur cryptocurrency wallets mein ek flaw hai jiske through attackers wallet ke private keys ko access kar sakte hain. Private keys humare cryptocurrency ko surakshit rakhne ke liye kaam aate hain, aur agar attackers inhe access kar lete hain, toh woh humari digital assets ko easily chura sakte hain. Is vulnerability ke baare mein abhi tak bahut details nahi aayi hain, lekin yeh clear hai ki attackers ne is flaw ko expl...

Dormant GitHub accounts, jo ki kabhi kabhi unused ya abandoned rehte hain, ab attackers ke liye ek naya tool ban gaye hain. Yeh accounts, jo ki poore internet par scattered hote hain, attackers ke liye ek aisa platform provide karte hain jahan se wo corporate organizations ke aur karib aa sakte hain. Attackers in accounts ka use karke apne malicious activities ko conceal karte hain aur corporate orgs ke mapping ke liye inka use karte hain. Yeh ek bahut hi clever tactic hai, jisse attackers apne actual intentions ko hide kar sakte hain. GitHub par dormant accounts ko identify karna ek challenging task hai, kyunki yeh accounts kabhi kabhi inactive rehte hain lekin phir bhi active accounts ke jaisa dikhte hain. Attackers in accounts ko hijack karte hain aur phir inka use apne malicious activities ke liye karte hain. Yeh activities include phishing, malware distribution, aur corporate orgs ke sensitive data ko steal karna. Yeh ek bahut hi serious issue hai, jo ki corporate orgs ke liye ek...

June 9, 2026 ko Anthropic ne Claude Fable 5 launch kiya. Yeh unka Mythos-class model ka pehla public version hai — abhi tak ka sabse capable AI. Isme software engineering, cyberattack simulation aur vulnerability research ki advanced skills hain. Aur launch ke kuch hi ghanton mein yeh compromise ho gaya. KYA HUA? "Pliny the Liberator" naam ke ek researcher ne Fable 5 ke safety classifiers bypass kar diye. Koi fancy zero-day nahi tha. Simple techniques the: - Multi-agent decomposition attacks - Unicode obfuscation tricks   - Narrative framing techniques Result? Model ka poora 120,000 character ka system prompt leak ho gaya. Matlab Anthropic ka internal safety architecture public ho gaya. Aur yeh tab hua jab Anthropic ne claim kiya tha: - 1,000+ ghante ki bug bounty testing ki - External red-teaming mein "koi universal jailbreak nahi mila" Real world mein kuch ghante kaafi the. SIRF JAILBREAK NAHI — AUR BHI PROBLEMS 1. Silent Response Degradation Anthropic...