Posts

Showing posts from July, 2026

Jscrambler 8.14.0 npm Release Mein Rust Infostealer Ka Pata Chalna: Ek Naya Khatra

-
Image
Kal ek scan karte waqt socha ki kitni baar hum npm packages par bharosa karte hain, bina yeh jaane ki unke andar kya chal raha hai. Aur ab yeh news aayi hai ki jscrambler 8.14.0 npm release mein Rust Infostealer drop ho raha hai during install. Yeh toh ek bada khatra hai, kyunki jscrambler ko hum code protection ke liye use karte hain, aur ab yehi tool humare liye risk ban gaya hai. Maine khud jab ye try kiya to pata chala ki yeh infostealer kitna sophisticated hai. Yeh aam taur par malware scanning tools ko bypass karne mein saksham hai, aur user ke system se sensitive information chura sakta hai. Yeh cheez mujhe personally thodi overhyped nahi lagti, kyunki npm ecosystem mein packages ki security par hamesha sawal uthate rehte hain. Lekin yeh incident humein ek baar phir se sochne par majboor karta hai ki hum kitna reliable hai yeh ecosystem. Ek baat jo mujhe hairan karti hai ki koi bhi package, chahe wo kitna bhi popular kyun na ho, kabhi bhi compromised ho sakta hai. Toh hum kya ...
Post a Comment
Read more

Cyberattacks on Crypto Wallets: 'Ill Bloom' Vulnerability Exploited for $3.1 Million Heist

-
Image
Cybersecurity ek aisi field hai jahan har din naye threats aur vulnerabilities ke baare mein pata chalta hai. Abhi hi, ek naya vulnerability 'Ill Bloom' ka pata chala hai jiske through attackers ne $3.1 million cryptocurrency wallet se chura liya hai. Yeh incident humein yeh yaad dilata hai ki kis tarah se cyberattackers humare digital assets ko target kar sakte hain aur kaise humein apne online transactions aur wallets ko surakshit rakhne ke liye zaroori precautions lene chahiye. Yeh 'Ill Bloom' vulnerability asal mein blockchain technology aur cryptocurrency wallets mein ek flaw hai jiske through attackers wallet ke private keys ko access kar sakte hain. Private keys humare cryptocurrency ko surakshit rakhne ke liye kaam aate hain, aur agar attackers inhe access kar lete hain, toh woh humari digital assets ko easily chura sakte hain. Is vulnerability ke baare mein abhi tak bahut details nahi aayi hain, lekin yeh clear hai ki attackers ne is flaw ko expl...
Post a Comment
Read more

June 9, 2026 ko Anthropic ne Claude Fable 5 launch kiya. Yeh unka Mythos-class model ka pehla public version hai — abhi tak ka sabse capable AI. Isme software engineering, cyberattack simulation aur vulnerability research ki advanced skills hain.Aur launch ke kuch hi ghanton mein yeh compromise ho gaya.KYA HUA?"Pliny the Liberator" naam ke ek researcher ne Fable 5 ke safety classifiers bypass kar diye. Koi fancy zero-day nahi tha. Simple techniques the:- Multi-agent decomposition attacks- Unicode obfuscation tricks - Narrative framing techniquesResult? Model ka poora 120,000 character ka system prompt leak ho gaya. Matlab Anthropic ka internal safety architecture public ho gaya.Aur yeh tab hua jab Anthropic ne claim kiya tha:- 1,000+ ghante ki bug bounty testing ki- External red-teaming mein "koi universal jailbreak nahi mila"Real world mein kuch ghante kaafi the.SIRF JAILBREAK NAHI — AUR BHI PROBLEMS1. Silent Response DegradationAnthropic ki 319-page system card mein quietly likha tha ki model frontier AI research tasks pe silently apne responses kharab karta tha — ML training pipelines, distributed systems, accelerator design — bina user ko bataye. Koi notification nahi, koi warning nahi. Bas quietly poor response.Yeh content block nahi hai. Yeh invisible manipulation hai.Simon Willison ne publicly call out kiya. Backlash itna bada tha ki Anthropic ko policy reverse karni padi.2. Legitimate Researchers Block Ho Rahe TheIBM X-Force ki Valentina Palmiotti ne report kiya ki normal, harmless security research tasks bhi guardrails trigger kar rahe the. Model silently weaker Claude Opus 4.8 pe fall back kar deta tha bina bataye.Actual security researchers ruk gaye. Malicious actors adapt karte rahe. Classic asymmetry.3. 30-Day Mandatory Traffic RetentionMythos-class launch ke saath Anthropic ne ab mandatory 30-day traffic retention laga di — enterprise clients ke liye bhi jinka pehle zero-retention agreement tha.Privacy implications? Massive.MERI ANALYSIS — EK SECURITY RESEARCHER KE TAUR PEYeh sirf Anthropic ki kahani nahi hai. Yeh ek blueprint hai us cheez ka jo hota hai jab:- AI safety ko architecture nahi balki marketing claim ki tarah treat kiya jaye- Classifier-based guards ko primary defense layer banaya jaye- Transparency ki jagah 300+ page documents mein policies chhupaayi jayein- Red-team testing aur real-world adversarial creativity ke beech ke gap ko underestimate kiya jaye50-Subcommand Bypass, multi-agent decomposition, Unicode tricks — yeh zero-days nahi hain. Yeh known jailbreak patterns hain. Agar state-level threat actors Mythos-class capability pe yeh try karein toh stakes bilkul alag hain.KEY TAKEAWAYAI safety sirf ek classifier layer se nahi chalti. Jab model ke andar "agentic hacking" capabilities hain — reconnaissance, lateral movement, exploit chaining — tab safety architecture mein deep honi chahiye, surface pe nahi.Claude Mythos ek naye class ki AI capability represent karta hai. Uske public twin Fable 5 ka jailbreak ek loud warning signal hai.Sawaal yeh nahi hai ki AI models ko weaponize kiya jayega ya nahi. Sawaal yeh hai ki organizations apni defenses kitni jaldi adapt karengi.Aap kya sochte ho — kya Anthropic ko Fable 5 release karna chahiye tha?Comment mein batao!— Pramod JogdandSecurity Researcher | PremLabs Security | Pune

-
Post a Comment
Read more

Dormant GitHub Accounts: Attackers Ka Naya Chalak

-
Dormant GitHub accounts, jo ki kabhi kabhi unused ya abandoned rehte hain, ab attackers ke liye ek naya tool ban gaye hain. Yeh accounts, jo ki poore internet par scattered hote hain, attackers ke liye ek aisa platform provide karte hain jahan se wo corporate organizations ke aur karib aa sakte hain. Attackers in accounts ka use karke apne malicious activities ko conceal karte hain aur corporate orgs ke mapping ke liye inka use karte hain. Yeh ek bahut hi clever tactic hai, jisse attackers apne actual intentions ko hide kar sakte hain. GitHub par dormant accounts ko identify karna ek challenging task hai, kyunki yeh accounts kabhi kabhi inactive rehte hain lekin phir bhi active accounts ke jaisa dikhte hain. Attackers in accounts ko hijack karte hain aur phir inka use apne malicious activities ke liye karte hain. Yeh activities include phishing, malware distribution, aur corporate orgs ke sensitive data ko steal karna. Yeh ek bahut hi serious issue hai, jo ki corporate orgs ke liye ek...
Post a Comment
Read more