SecLists.Org Security Mailing List Archive
Any hacker will tell you that the latest news and exploits are not found on any web site—not even Insecure.Org. No, the cutting edge in security research is and will continue to be the full disclosure mailing lists such as Bugtraq. Here we provide web archives and RSS feeds (now including message extracts), updated in real-time, for many of our favorite lists. Browse the individual lists below, or search them all using the Site Search box above.
Insecure.Org Lists
Nmap Development — Unmoderated technical development forum for debating ideas, patches, and suggestions regarding proposed changes to Nmap and related projects. Subscribe to nmap-dev here.
Current Quarter
Archived Posts
RSS Feed
About ListQuestion about Nmap and GSoC 2026 Sweekar (Jan 29)
Hi Nmap developers,
I am a student contributor and have previously worked on Nmap. I am
preparing for Google Summer of Code 2026 and wanted to ask whether Nmap is
considering participating as a mentoring organization this year, or if
there are no plans at this time.
Thank you for your time and for maintaining such an important project.
Best regards,
Sweekar
PR #3277: Clean up and harden POP3 helper login functions Sweekar (Jan 23)
Hello Nmap Developers,
As suggested in CONTRIBUTION.md i am writing this mail to notify about my PR
https://github.com/nmap/nmap/pull/3277
This PR refactors and fixes the POP3 authentication helper functions used
by NSE scripts, including pop3-brute.nse.
Main changes:
-
Hardened SASL LOGIN handling
-
Improved SASL PLAIN and CRAM-MD5 logic
-
Corrected APOP handling and report missing OpenSSL support
-
Normalized...
HTTP2 cleartext service probe Harrison Neal (Dec 24)
Good day,
In instances where HTTP2 is used cleartext without TLS+ALPN (a.k.a., h2c,
prior knowledge), nmap does not appear to have a service probe.
The following is something really simple based on RFC7540, which covers the
initial client message and the server's initial SETTINGS frame. The match
regex below ignores the length (RFC says the server's initial SETTINGS
frame can be empty, nghttpd appears to provide a single entry for...
dev () nmap org judy Wallace (Dec 19)
dev () nmap org
Re: [Battery-svn] r39303 - Kalinux/nselib Trinidad JR Cristian (Nov 28)
Sent from my T-Mobile 5G Device
Get Outlook for Android
https://github.com/the-tcpdump-group/tcpdump/commit/32027e199368dad9508965aae8cd8de5b6ab5231?diff=unified#:~:text=static%20void,%7B
________________________________
From: Trinidad JR Cristian <Employment404 () outlook com>
Sent: Friday, November 28, 2025 6:20:32 PM
To: dev () nmap org <dev () nmap org>
Subject: Re: [Battery-svn] r39303 - Kalinux/nselib...
Re: dev Digest, Vol 233, Issue 1 Trinidad JR Cristian (Nov 01)
Last Login: SAT NOV 01 2025 11:06:09 CDT
Authentication-Results: mail.ctmartinez5.ch; dkim=pass (Good 1024 bit
rsa-sha256 596) header.d=cert.org header.a=rsa-sha256; dkim=pass
(Good 1024 bit rsa-sha256 596) header.d=amazonses.com
header.a=rsa-sha256
Authentication-Results: mail.ctmartinez5.ch; dmarc=pass (p=none dis=none)
header.from=cert.org
Authentication-Results: mail.outlook.ch;...
Fw: dev Digest, Vol 233, Issue 1 Trinidad JR Cristian (Oct 31)
JE6ar71cU61f: [CARTER[338NYROC14617]ROCHESTER] --Cristian A Trinidad
NET Wrapper for Npcap <- Package delivery for bothe itmes 1&2 .
1-["Lenss":"Eyes-drops","Battery":["Interface":"TjRQouCJ"(1737645151)
Zenmap Nmap @NeonNox Samsung 8 Galaxy kalinux 2&2
2-("KALI":"162.5 mm × 74.8 mm × 8.6...
GitHub PR #3214: Add compatibility fixes for various OSes + multiplatform autobuilds Jordan Ritter (Oct 30)
Just submitted https://github.com/nmap/nmap/pull/3214 — I think the contributing guidelines say to give an extra heads
up via email, so this is that email.
The PR adds compilation fixes for FreeBSD, NetBSD, OpenBSD, Solaris, macOS, and Windows, against current master (on
GitHub, which I understand is synced read-only with SVN).
I got the sense you guys may not have broad OS coverage in the existing TravisCI setup — given all the problems...
RE: Nmap Zenmap version mismatch via Windows .exe installer EXT-Modrell, Anthony via dev (Oct 30)
Hello,
I was looking for an update. I see that the media has not changed via hash since we downloaded and found the mismatch.
Any update would be appreciated.
Thank you,
Tony
From: EXT-Modrell, Anthony
Sent: Wednesday, September 24, 2025 1:42 PM
To: 'dev () nmap org' <dev () nmap org>
Cc: Herren (US), Tracy J <tracy.j.herren () boeing com>; EXT-Baker, Mark A <mark.a.baker2 () boeing com>; EXT-Rivera,
Alexander R...
Re: .NET Wrapper for Npcap Daniel Miller (Oct 30)
Steve,
Npcap ought to work with any existing WinPcap wrapper, since the API is
backwards-compatible. I have not used any C# wrappers myself, though I am
aware of SharpPcap (https://github.com/dotpcap/sharppcap) as another.
Dan
On Wed, Jun 11, 2025 at 6:44 AM Altaffer, Steven via dev <dev () nmap org>
wrote:
Nmap Announce — Moderated list for the most important new releases and announcements regarding the Nmap Security Scanner and related projects. We recommend that all Nmap users subscribe to stay informed.
Npcap Version 1.82 Released with VLAN Tagging and More Gordon Fyodor Lyon (Apr 28)
Dear Nmap Community,
In preparation for an imminent Nmap release (hopefully this week!), we have
released Version 1.82 of our Npcap Windows packet capture and transmission
driver. It builds upon the recent 1.81 release to add support for VLAN
tagging. This allows you to select for packets directed to a certain VLAN
or just inspect the VLAN headers on any packets received. It's especially
useful for Wireshark users. You can also now send...
Nmap 7.95 released: OS and service detection signatures galore! Gordon Fyodor Lyon (May 05)
Dear Nmap Community,
I just arrived in San Francisco for the RSA conference and am delighted to
announce our Nmap Version 7.95 release! I'm most excited that we finally
tackled our backlog of OS and service detection fingerprint submissions.
We're not talking about dozens or hundreds of them-we processed more than
6,500 fingerprints!
For OS detection, we added 336 signatures, bringing the new total to 6,036.
Additions include iOS 15...
Full Disclosure — A public, vendor-neutral forum for detailed discussion of vulnerabilities and exploitation techniques, as well as tools, papers, news, and events of interest to the community. The relaxed atmosphere of this quirky list provides some comic relief and certain industry gossip. More importantly, fresh vulnerabilities sometimes hit this list many hours or days before they pass through the Bugtraq moderation queue.
SEC Consult SA-20260218-0 :: Multiple Critical Vulnerabilities in NesterSoft WorkTime (on-prem/cloud) SEC Consult Vulnerability Lab via Fulldisclosure (Feb 22)
SEC Consult Vulnerability Lab Security Advisory < 20260218-0 >
=======================================================================
title: Multiple Critical Vulnerabilities
product: NesterSoft WorkTime (on-prem/cloud)
vulnerable version: <= 11.8.8
fixed version: No patch available, vendor unresponsive.
CVE number: CVE-2025-15563, CVE-2025-15562, CVE-2025-15561...
[KIS-2026-04] SmarterMail <= 9518 (MailboxId) Reflected Cross-Site Scripting Vulnerability Egidio Romano (Feb 22)
----------------------------------------------------------------------------
SmarterMail <= 9518 (MailboxId) Reflected Cross-Site Scripting Vulnerability
----------------------------------------------------------------------------
[-] Software Link:
https://www.smartertools.com/smartermail/business-email-server
[-] Affected Versions:
Build 9518 and prior builds.
[-] Vulnerability Description:
User input passed through the...
SEC Consult SA-20260212-0 :: Multiple Vulnerabilities in various Solax Power Pocket WiFi models SEC Consult Vulnerability Lab via Fulldisclosure (Feb 16)
SEC Consult Vulnerability Lab Security Advisory < 20260212-0 >
=======================================================================
title: Multiple Vulnerabilities
product: Various Solax Power Pocket WiFi models
vulnerable version: See section below
fixed version: See section below
CVE number: CVE-2025-15573, CVE-2025-15574, CVE-2025-15575
impact: High...
[Full Disclosure] CVE-2025-69690 & CVE-2025-69691 — Authenticated RCE in Netgate pfSense CE 2.7.2 and 2.8.0 privexploits via Fulldisclosure (Feb 16)
Advisory: Authenticated Remote Code Execution in pfSense CECVEs: CVE-2025-69690, CVE-2025-69691
Researcher: Nelson Adhepeau (privexploits () protonmail com)
Date: February 2026
== RESPONSIBLE DISCLOSURE NOTICE ==
This advisory is published in accordance with responsible disclosure practices.
The vendor was notified on December 2, 2025, acknowledged the reports, and indicated no patches would be issued.
Publication follows standard 90-day...
APPLE-SA-02-11-2026-9 Safari 26.3 Apple Product Security via Fulldisclosure (Feb 16)
APPLE-SA-02-11-2026-9 Safari 26.3
Safari 26.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/126354.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
CFNetwork
Available for: macOS Sonoma and macOS Sequoia
Impact: A remote user may be able to write arbitrary files
Description: A path...
APPLE-SA-02-11-2026-8 visionOS 26.3 Apple Product Security via Fulldisclosure (Feb 16)
APPLE-SA-02-11-2026-8 visionOS 26.3
visionOS 26.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/126353.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
AppleMobileFileIntegrity
Available for: Apple Vision Pro (all models)
Impact: An app may be able to access sensitive user data...
APPLE-SA-02-11-2026-7 watchOS 26.3 Apple Product Security via Fulldisclosure (Feb 16)
APPLE-SA-02-11-2026-7 watchOS 26.3
watchOS 26.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/126352.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Bluetooth
Available for: Apple Watch Series 6 and later
Impact: An attacker in a privileged network position may be able to
perform...
APPLE-SA-02-11-2026-6 tvOS 26.3 Apple Product Security via Fulldisclosure (Feb 16)
APPLE-SA-02-11-2026-6 tvOS 26.3
tvOS 26.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/126351.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Bluetooth
Available for: Apple TV HD and Apple TV 4K (all models)
Impact: An attacker in a privileged network position may be able to...
APPLE-SA-02-11-2026-5 macOS Sonoma 14.8.4 Apple Product Security via Fulldisclosure (Feb 16)
APPLE-SA-02-11-2026-5 macOS Sonoma 14.8.4
macOS Sonoma 14.8.4 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/126350.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
AppleMobileFileIntegrity
Available for: macOS Sonoma
Impact: An app may be able to access sensitive user data...
APPLE-SA-02-11-2026-4 macOS Sequoia 15.7.4 Apple Product Security via Fulldisclosure (Feb 16)
APPLE-SA-02-11-2026-4 macOS Sequoia 15.7.4
macOS Sequoia 15.7.4 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/126349.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
AppleMobileFileIntegrity
Available for: macOS Sequoia
Impact: An app may be able to access sensitive user data...
APPLE-SA-02-11-2026-3 macOS Tahoe 26.3 Apple Product Security via Fulldisclosure (Feb 16)
APPLE-SA-02-11-2026-3 macOS Tahoe 26.3
macOS Tahoe 26.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/126348.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Admin Framework
Available for: macOS Tahoe
Impact: An app may be able to access sensitive user data
Description: A parsing...
APPLE-SA-02-11-2026-2 iOS 18.7.5 and iPadOS 18.7.5 Apple Product Security via Fulldisclosure (Feb 16)
APPLE-SA-02-11-2026-2 iOS 18.7.5 and iPadOS 18.7.5
iOS 18.7.5 and iPadOS 18.7.5 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/126347.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accessibility
Available for: iPhone XS, iPhone XS Max, iPhone XR, iPad 7th generation
Impact: An...
APPLE-SA-02-11-2026-1 iOS 26.3 and iPadOS 26.3 Apple Product Security via Fulldisclosure (Feb 16)
APPLE-SA-02-11-2026-1 iOS 26.3 and iPadOS 26.3
iOS 26.3 and iPadOS 26.3 addresses the following issues.
Information about the security content is also available at
https://support.apple.com/126346.
Apple maintains a Security Releases page at
https://support.apple.com/100100 which lists recent
software updates with security advisories.
Accessibility
Available for: iPhone 11 and later, iPad Pro 12.9-inch 3rd generation
and later, iPad Pro...
Blind XXE in Electronic Invoice online tools (validator.invoice-portal.de, xrechnung.rib.de) Hanno Böck (Feb 16)
During tests of electronic invoicing tools, I discovered multiple XXE
and Blind XXE vulnerabilities in online tools parsing electronic
invoices in XML formats.
While most of the affected tools have fixed these vulnerabilities, two
online tools remain vulnerable to Blind XXE attacks, allowing
exfiltration of files. Disclosure to the affected operators happened
more than 90 days ago.
Vulnerable tools:
https://validator.invoice-portal.de/...
🚨 Public Disclosure: Remote BitLocker Bypass via Intel AMT — SYSTEM Access Without Login Darsh Naik (Feb 16)
🔓 The Attack Path — No Login, SYSTEM Access
1. Boot into setup.exe (via USB, PXE, or OOBM like Intel vPro).
2. Click “Repair your computer” → Enter WinRE.
3. Press Shift + F10 → SYSTEM-level Command Prompt.
4. From there, attacker can:
- Run `net user` to create new admin accounts
- Use `diskpart` to wipe or reformat drives
- Use `manage-bde -off` or `bcdedit` to disable BitLocker
- Replace `utilman.exe` to bypass login...
Other Excellent Security Lists
Bugtraq — The premier general security mailing list. Vulnerabilities are often announced here first, so check frequently!
Security Basics — A high-volume list which permits people to ask "stupid questions" without being derided as "n00bs". I recommend this list to network security newbies, but be sure to read Bugtraq and other lists as well.
Penetration Testing — While this list is intended for "professionals", participants frequenly disclose techniques and strategies that would be useful to anyone with a practical interest in security and network auditing.
Info Security News — Carries news items (generally from mainstream sources) that relate to security.
IDS Focus — Technical discussion about Intrusion Detection Systems. You can also read the archives of a previous IDS list
Web App Security — Provides insights on the unique challenges which make web applications notoriously hard to secure, as well as attack methods including SQL injection, cross-site scripting (XSS), cross-site request forgery, and more.
Daily Dave — This technical discussion list covers vulnerability research, exploit development, and security events/gossip. It was started by ImmunitySec founder Dave Aitel and many security luminaries participate. Many posts simply advertise Immunity products, but you can't really fault Dave for being self-promotional on a list named DailyDave.
RE//verse, DistrictCon, an Anole Friend Dave Aitel via Dailydave (Feb 02)
Last month was DistrictCon, a great conference that I did not attend
because the sky decided to dump snow on Washington, DC. Anyone who has
spent more than ten minutes in that city knows this is how you cancel every
flight out of DCA and turn the roads into skating rinks filled with deeply
furious government contractors. Life is short, so I remained in Miami where
it was 80 degrees and everyone was pretending winter is a myth.
Today it is...
feeling the air Dave Aitel via Dailydave (Jan 05)
For reasons I still don’t fully understand, Miami Beach has enormous
colonies of turkey vultures. You’ll see them circling over the city and the
interstates, perched like huge awkward toddlers on lampposts, or standing
motionless as a shadow in the strip of grass between the road and the blue
water of the bay. If you look up at almost any moment, there’s a column of
them somewhere overhead, wings spread wide, fingers splayed, feeling the...
Re: Defense ? Dean Pierce via Dailydave (Nov 16)
I like the idea of having a software supply chain that people can pay into
that basically funds a universal bug bounty system for anything that
matters.
You can put systems in place that utilize zero knowledge exploitability
proofs to automate bounty triage, so it doesn't even need to be run by a
central trusted entity. As the bounty markets stabilize, what you're left
with is a software ecosystem where anyone can build what they need...
Re: Defense ? Chris Anley via Dailydave (Nov 16)
(gingerly raises head above parapet)
Historically, “we’ve” moved the bar in defense.
- Everything is now in the cloud, accessible 24/7 via APIs whose keys are stored in plaintext alongside code, or via
preauthenticated sessions
- Everything has ~40 dependencies, each of which has ~40 dependencies, etc, which, combined with a published CVE rate
of 1 per 15 minutes (calendar year 2024), means that patching an enterprise before an...
Re: Defense ? Alfonso De Gregorio via Dailydave (Nov 16)
Imbalances in the skills and workforce are real. The gap remains hard
to bridge also in the presence of greater degrees of automation that
AI buys us, because, at this stage, we want humans to be in the loop –
and for good reasons – and, also, cause we are not going to grow the
skillset faster than the attack surface, I am afraid.
I hate to sound like a broken record, but I will take a bite
regardless: those imbalances are a byproduct of the...
Re: Defense ? Conan Dooley via Dailydave (Nov 16)
Reduce complexity, duplication, and scope in your infrastructure. Your
developers and infrastructure staff would need to agree on standardized
libraries, frameworks, etc, and you'd need skilled technical staff to
validate when people said doing something wasn't possible within that
scope, and make them accountable for making sure adding that level of
complexity led to business value that was greater than that overhead (vs,
say, just...
Re: Defense ? etojake--- via Dailydave (Nov 16)
The content of this message was lost. It was probably cross-posted to
multiple lists and previously handled on another list.
Defense ? Dave Aitel via Dailydave (Nov 15)
How would one actually move the actual bar in defense? A big part of me
thinks that you're just not going to patch your way out of the problem. But
the number of organizations that you can rely on to actually make a
difference seems pretty small? Like even converting every Linux binary to
rust would only make sense if you could find a team that could actually
maintain and support that code base, which I don't know that you could.
Like...
Offensive AI Con Dave Aitel via Dailydave (Oct 08)
So I just got back from "Offensive AI Conference" in San Diego and it was a
great event - for a first time conference it ran especially smoothly, the
attendees were an amazing crowd, and many of the talks were extremely
strong. There's something about a conference that is not recording the
talks that gets people to actually sit and listen to them via the magic of
FOMO, but also, when a conference is "invite only" then you...
PaulDotCom — General discussion of security news, research, vulnerabilities, and the PaulDotCom Security Weekly podcast.
Honeypots — Discussions about tracking attackers by setting up decoy honeypots or entire honeynet networks.
Microsoft Sec Notification — Beware that MS often uses these security bulletins as marketing propaganda to downplay serious vulnerabilities in their products—note how most have a prominent and often-misleading "mitigating factors" section.
Funsec — While most security lists ban off-topic discussion, Funsec is a haven for free community discussion and enjoyment of the lighter, more humorous side of the security community
CERT Advisories — The Computer Emergency Response Team has been responding to security incidents and sharing vulnerability information since the Morris Worm hit in 1986. This archive combines their technical security alerts, tips, and current activity lists.
Apple Releases Security Updates for Multiple Products CISA (Mar 28)
Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow
You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated and is now available.
Apple Releases Security Updates for Multiple Products [
https://www.cisa.gov/news-events/alerts/2023/03/28/apple-releases-security-updates-multiple-products ] 03/28/2023 01:00
PM EDT
Apple...
CISA Releases Six Industrial Control Systems Advisories CISA (Mar 23)
Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow
You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.
CISA Releases Six Industrial Control Systems Advisories [
https://www.cisa.gov/news-events/alerts/2023/03/23/cisa-releases-six-industrial-control-systems-advisories ] 03/23/2023
08:00 AM EDT...
CISA Releases Eight Industrial Control Systems Advisories CISA (Mar 21)
Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow
You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.
CISA Releases Eight Industrial Control Systems Advisories [
https://www.cisa.gov/news-events/alerts/2023/03/21/cisa-releases-eight-industrial-control-systems-advisories ]
03/21/2023 08:00 AM...
CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management CISA (Mar 21)
Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow
You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.
CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management [...
Open Source Security — Discussion of security flaws, concepts, and practices in the Open Source community
Re: Telnetd Vulnerability Report Albert Veli (Feb 26)
Hello,
I agree to this, but I can add that telnet remains widely used for login
in OT (Operational Technology) environments, including sites running
critical infrastructure. While operators often justify this by relying
on network isolation, this reasoning breaks down the moment the air gap
is bridged.
Re: Re: Telnetd Vulnerability Report Florian Weimer (Feb 26)
* Marco Moock:
Part of that is that the industry has moved to a threat model where it
is considered more secure to use an unauthenticated, unencrypted channel
rather than one that uses (for example) an HMAC based on SHA-1 for
integrity protection.
Thanks,
Florian
CVE-2026-27900 - Sensitive Information Exposure in Debug Logs of Terraform Provider for Linode Liang, Zhiwei (Feb 25)
Impact
The Terraform Provider for Linode versions prior to v3.9.0 logged sensitive information including some passwords,
StackScript content, object storage data, and NodeBalancer TLS keys in debug logs without redaction.
Important: Provider debug logging is not enabled by default.
This issue is exposed when debug/provider logs are explicitly enabled (for example in local troubleshooting, CI/CD
jobs, or centralized log collection). If enabled,...
Re: Telnetd Vulnerability Report Steffen Nurpmeso (Feb 25)
Marco Moock wrote in
<20260225210354.2bbf0d04 () stinkedores dorfdsl de>:
|Am 25.02.2026 um 20:47:09 Uhr schrieb Steffen Nurpmeso:
|
|> It seems to me one reason to use telnet(1) arises from the fact
|> that there is no nc(1) around. busybox has one, but it is not
|> feature rich enough. And the one of LibreSSL, which is, as it
|> says, a swiss-army-knife, is very often not available at all.
|
|IIRC this issue is only...
Re: Telnetd Vulnerability Report Lyndon Nerenberg (VE7TFX/VE6BBM) (Feb 25)
kf503bla () duck com writes:
You still seem to completely miss the point of what telnet is/does.
It provedes a network terminal. Nothing more, nothing less. What
the telnet servver does with the connection is strictly an
implementation detail of the server.
If your telnetd implementation runs login(1) on a UNIX server, in
this day and age, that's bad. But the solution is not to burn
telnet, any more than the solution to DOS attacks is...
Re: Telnetd Vulnerability Report Marco Moock (Feb 25)
Am 25.02.2026 um 20:47:09 Uhr schrieb Steffen Nurpmeso:
IIRC this issue is only about the telnetd telnet server daemon, not the
client. This service is only in use if enabled in inetd (or
replacements) by the administrator.
Re: Telnetd Vulnerability Report Steffen Nurpmeso (Feb 25)
Solar Designer wrote in
<20260225165449.GA23380 () openwall com>:
|On Wed, Feb 25, 2026 at 07:46:07AM -0500, kf503bla () duck com wrote:
|> telnet is extremely old and just because there is still widespread \
|> use of telnet or the daemon, doesn't provide a valid reason to keep \
|> using it. these trivial vulnerabilities keep popping up and if you \
|> still insist of using telnet, you deserve getting pwned
|
|I...
Re: OpenSSL Security Advisory (updated text for CVE-2025-15467) Tomas Mraz (Feb 25)
We have updated the advisory text for CVE-2025-15467 based on findings
by Jan Lübbe (Pengutronix).
Stack buffer overflow in CMS (Auth)EnvelopedData parsing (CVE-2025-15467)
=========================================================================
Severity: High
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with
maliciously crafted AEAD parameters can trigger a stack buffer overflow.
Impact summary: A stack buffer...
Re: Telnetd Vulnerability Report Solar Designer (Feb 25)
I mostly let these messages through so far (rejecting only one, which
had even less value), but as a moderator I declare end of sub-thread
now. Further messages on "Who uses telnet anyway?" will be rejected by
default, unless they truly add something new.
Messages on actual security issues/fixes in telnet are still desirable.
Alexander
P.S. I first wrote the above in a confusing manner, not clarifying it's
only end of...
Re: Telnetd Vulnerability Report kf503bla (Feb 25)
telnet is extremely old and just because there is still widespread use of telnet or the daemon, doesn't provide a valid
reason to keep using it. these trivial vulnerabilities keep popping up and if you still insist of using telnet, you
deserve getting pwned
Re: Re: Telnetd Vulnerability Report Marco Moock (Feb 25)
In certain situations telnet is still being used, because it is
supported on a wide range of systems, regardless of key (exchange)
algorithms or hash algorithms.
It can also be used in conjunction with a secured tunnel (e.g. stunnel
or IPsec) to provide a mechanism against eavesdropping.
Re: Telnetd Vulnerability Report Eddie Chapman (Feb 24)
Well, every cloud has a silver lining ... for some of these devices,
this vulnerability, together with other ones, just might make it
possible for owners to completely replace that cesspit of a firmware
with an OSS one that can be updated :-) (if they have lots of time and
patience!)
Re: Telnetd Vulnerability Report Justin Swartz (Feb 24)
There're also serial port concentrators, programmable automation
controllers, remote telemetry units, protocol gateways, data
aggregators, and PXI/LXI instrumentation out there that run some of
telnet daemon - and you can be sure that it's not always busybox's
telnetd implementation.
Re: Telnetd Vulnerability Report Eddie Chapman (Feb 24)
Yes. I would hazard a guess that the largest cohort of devices running a
telnet server are enterprise switches, gateways & routers. So many times
over the years I've been surprised to find a switch I'm configuring has
a telnet as well as the obligatory http(s) server available for the
admin to login via.
Albeit to a lesser extent these days, and more likely BusyBox telnetd
than InetUtils. But switches are one of the most...
Re: Telnetd Vulnerability Report Vincent Lefevre (Feb 24)
Here, this is not just about telnet, but about telnetd, which
involves a login process:
https://man.freebsd.org/cgi/man.cgi?query=telnetd&sektion=8&format=html
Secure Coding — The Secure Coding list (SC-L) is an open forum for the discussion on developing secure applications. It is moderated by the authors of Secure Coding: Principles and Practices.
Educause Security Discussion — Securing networks and computers in an academic environment.
Internet Issues and Infrastructure
NANOG — The North American Network Operators' Group discusses fundamental Internet infrastructure issues such as routing, IP address allocation, and containing malicious activity.
AS3356 Lumen/Level3 contact Marco Moock via NANOG (Feb 26)
Hello!
I noticed some issues with the AS-Set AS-GBLX, as it is missing some of
their transit customers. Other ISPs filter based on that.
Does anyone here know a way to contact their network operators?
Re: How long AS-PATH policies have you used Saku Ytti via NANOG (Feb 26)
Yes. But let's say I am tier1. It is likely entirely kosher for me to lock every
other tier1 from non tier1 ports. Maybe this is anticompetitive to tier2, but
maybe it is kosher.
However, if I offer peerlock to say AMZN, META or GOOG, now it is definitely
anticompetitive. I am choosing winners and losers, which is not my position
as tier1 to do. Worse, I am providing superior services to market leaders.
Now what would fair peerlock look...
Re: OT: Routers with highest uptime Markus via NANOG (Feb 26)
Am 25.02.2026 um 22:33 schrieb Bryan Fields via NANOG:
Thanks Bryan, this is basically what I was looking for :) Thanks to you
I found: https://www.reddit.com/r/uptimeporn/
Re: How long AS-PATH policies have you used Job Snijders via NANOG (Feb 26)
Both efforts represent multiple years of work, you are welcome :)
I think you may be holding some of this upside down: by locking a select
few ASNs in such that they can only appear behind specific BGP sessions,
your autonomous system helps protect the global Internet routing system.
Save the cheerleader, save the world. ;-)
For example, by locking in a large peer you not only help your own
customers, but also their customers, and as a result...
Re: OT: Routers with highest uptime John Kristoff via NANOG (Feb 26)
I looked for Slammer on lots of different vantage points a few years
ago and no evidence it was still running anywhere on the public
Internet. I'd be interested to see evidence to the contrary. I think
it is dead unless someone can show me otherwise.
I'm not sure if the Conficker sinkholes are still running. We had one
while I was at Team Cymru and it was still running as of about 2016 or
so, but I'd be surprised if they have...
Re: OT: Routers with highest uptime Mike Simpson via NANOG (Feb 26)
Point your ids onto the outside your inet interface and you’ll still see slammer, nimda (SadminD), comficker and all
the other worms still scanning , still propagating.
Re: How long AS-PATH policies have you used Saku Ytti via NANOG (Feb 26)
Mind, this is not rhetorical question. I want answers from Nanog.
Are you comfortable for your tier1 to stop honoring AS-SET? Is it fine
that AS-SET violating customer advertises your prefix to us, and we
propagate it? Rare enough occurrence that is not worth the complexity
of honouring AS-SET?
Because if you are, I'll happily stop honouring it, saves me lot of ache.
Re: How long AS-PATH policies have you used Saku Ytti via NANOG (Feb 26)
Your other post is saying just ignore AS-SET.
Your solution is actually below AS-SET security. Which I would need to
market internally. I am trying to get rid of the prefix-list while
maintaining AS-SET compliance.
Let's say that my own AS43792 advertises google's prefix to us, with
correct ASN. Accidentally, no malice. Today we stop this, because
prefix-list. Can I explain to my managers and the Internet how we
allowed google from...
Securing EBGP while getting rid of big IRR-based prefix-list-filters (Was: How long AS-PATH policies have you used) Job Snijders via NANOG (Feb 26)
Dear all,
Securing one's EBGP perimeter is a challenge: how to do it?
(Some slides: https://bsd.nl/publications/irr_out_rpki_in.pdf)
Much of the information used to construct safe pass/nopass EBGP filters
comes in unwieldly formats and from questionable provenance. I can share
some detail of the approach I implemented at my previous $employer,
perhaps it'll help some of you get rid of excessively large IRR-based
prefix-filters! :-)...
Re: How long AS-PATH policies have you used Saku Ytti via NANOG (Feb 26)
Either you generate
a) prefix-list from AS-SET
b) as-path filter from AS-SET
c) fill RPKI /gaps/ with slurm from AS-SET
In each case, the quality of the check is as good as AS-SET, which is
bad. But in no case are you diluting the quality for prefixes which
have RPKI.
But in case of c) you are not just checking that the prefix comes from
the right port, you are also checking that prefix has the same origin
as route object.
So yes c) is...
Re: How long AS-PATH policies have you used Job Snijders via NANOG (Feb 26)
Dear Saku,
Yes, you do. But the below plan probably is not it. Some comments &
questions below.
What is the purpose of this? What do you envision you could put in SLURM
to trick your routers that wouldn't dillute the purpose of the RPKI?
I strongly advise against this course of action. What network operators
currently do (both small and large) is to reject ROV INVALID. That's it.
The fail-safe is to fail open. The philosophy is...
Re: How long AS-PATH policies have you used Saku Ytti via NANOG (Feb 25)
Thank you, very useful. I assume you've previously used. non-EOS
platform, were you running a similar scale there?
And much larger than I expected from a regex based solution, so highly
encouraging that this could work even for pathological AS-SETs.
Is EOS using ASN as atom or character as atom? Your example has some
ambiguity to me.
permit (1|2|3|4|5|6|7|8)$ any
This would work with both atoms. But
permit (11|22|33|44|55|66|77|88)$ any...
Re: OT: Routers with highest uptime Jon Lewis via NANOG (Feb 25)
In the real world, bugs force reboots, either to upgrade to code with
different bugs or the bugs simply cause the reboot "automatically".
Anyone else having fun with ACX7024 iTCO Watchdog Crashes recently?
----------------------------------------------------------------------
Jon Lewis, MCP :) | I route
Blue Stream Fiber, Sr. Neteng | therefore you are
_________ http://www.lewis.org/~jlewis/pgp for PGP public...
Re: Backhoes surround AT&T office in Arlington VA Rusty Dekema via NANOG (Feb 25)
I don't know about the 5ESS, but there is at least one DMS-100 in private hands:
http://www.dms-100.net/telephony/nortel/dms-100/story/ (site does not
support SSL; change it back to http if your browser decides https
would be better)
Its owner turns it on when electricity prices are favorable and he
feels like it. You can dial into/through it at those times via C*Net
(https://www.ckts.info/).
-Rusty
Re: Backhoes surround AT&T office in Arlington VA virendra rode via NANOG (Feb 25)
------------
Almost extinct. You could try reaching out to Phil McCartier
(https://stepswitch.us/). is known among telephone switch collectors.
He still might have one in the back of his truck :) He donated a ton of
stuff to the Connections Museum.
good luck
/vrode
Interesting People — David Farber moderates this list for discussion involving internet governance, infrastructure, and any other topics he finds fascinating
The RISKS Forum — Peter G. Neumann moderates this regular digest of current events which demonstrate risks to the public in computers and related systems. Security risks are often discussed.
(no subject) RISKS List Owner (Feb 20)
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
precedence: bulk
Subject: Risks Digest 34.88
RISKS-LIST: Risks-Forum Digest Friday 20 February 2026 Volume 34 : Issue 88
ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator
***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <...
(no subject) RISKS List Owner (Feb 20)
(no subject) RISKS List Owner (Feb 14)
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
precedence: bulk
Subject: Risks Digest 34.87
RISKS-LIST: Risks-Forum Digest Saturday 14 February 2026 Volume 34 : Issue 87
ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator
***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <...
(no subject) RISKS List Owner (Feb 07)
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
precedence: bulk
Subject: Risks Digest 34.86
[RESEND. I DID NOT GET MY COPy... PGN]
RISKS-LIST: Risks-Forum Digest Friday 6 February 2026 Volume 34 : Issue 86
ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator
***** See last item for further information, disclaimers, caveats, etc. *****
This...
(no subject) RISKS List Owner (Jan 10)
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
precedence: bulk
Subject: Risks Digest 34.83
RISKS-LIST: Risks-Forum Digest Friday 9 January 2026 Volume 34 : Issue 83
ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator
***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org...
(no subject) RISKS List Owner (Jan 10)
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
precedence: bulk
Subject: Risks Digest 23.83
RISKS-LIST: Risks-Forum Digest Wednesday 6 April 2005 Volume 23 : Issue 83
ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, moderator, chmn ACM Committee on Computers and Public Policy
***** See last item for further information, disclaimers, caveats, etc. *****
This issue is...
(no subject) RISKS List Owner (Jan 09)
(no subject) RISKS List Owner (Jan 03)
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
precedence: bulk
Subject: Risks Digest 34.82
RISKS-LIST: Risks-Forum Digest Saturday 3 January 2026 Volume 34 : Issue 82
ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still modera!>
***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <...
(no subject) RISKS List Owner (Nov 28)
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
precedence: bulk
Subject: Risks Digest 34.81
RISKS-LIST: Risks-Forum Digest Friday 28 October 2025 Volume 34 : Issue 81
ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator
***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org...
(no subject) RISKS List Owner (Oct 25)
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
precedence: bulk
Subject: Risks Digest 34.78
RISKS-LIST: Risks-Forum Digest Saturday 25 October 2025 Volume 34 : Issue 78
ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator
***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <...
(no subject) RISKS List Owner (Oct 16)
(no subject) RISKS List Owner (Oct 11)
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
precedence: bulk
Subject: Risks Digest 34.77
RISKS-LIST: Risks-Forum Digest Saturday 11 October 2025 Volume 34 : Issue 77
ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator
***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <...
BreachExchange — BreachExchange focuses on all things data breach. Topics include actual data breaches, cyber insurance, risk management, metrics and more. This archive includes its predecessor, the Data Loss news and discussion lists.
Healthcare organizations face rising ransomware attacks – and are paying up Matthew Wheeler (Jun 03)
https://www.theregister.com/2022/06/03/healthcare-ransomware-pay-sophos/
Healthcare organizations, already an attractive target for ransomware given
the highly sensitive data they hold, saw such attacks almost double between
2020 and 2021, according to a survey released this week by Sophos.
The outfit's team also found that while polled healthcare orgs are quite
likely to pay ransoms, they rarely get all of their data returned if they
do...
A digital conflict between Russia and Ukraine rages on behind the scenes of war Matthew Wheeler (Jun 03)
https://wskg.org/npr_story_post/a-digital-conflict-between-russia-and-ukraine-rages-on-behind-the-scenes-of-war/
SEATTLE — On the sidelines of a conference in Estonia on Wednesday, a
senior U.S. intelligence official told British outlet Sky News that the
U.S. is running offensive cyber operations in support of Ukraine.
“My job is to provide a series of options to the secretary of defense and
the president, and so that’s what I do,” said...
Researchers Uncover Malware Controlling Thousands of Sites in Parrot TDS Network Matthew Wheeler (Jun 03)
https://thehackernews.com/2022/06/researchers-uncover-malware-controlling.html
The Parrot traffic direction system (TDS) that came to light earlier this
year has had a larger impact than previously thought, according to new
research.
Sucuri, which has been tracking the same campaign since February 2019 under
the name "NDSW/NDSX," said that "the malware was one of the top infections"
detected in 2021, accounting for more than...
FBI, CISA: Don't get caught in Karakurt's extortion web Matthew Wheeler (Jun 03)
https://www.theregister.com/2022/06/03/fbi_cisa_warn_karakurt_extortion/
The Feds have warned organizations about a lesser-known extortion gang
Karakurt, which demands ransoms as high as $13 million and, some
cybersecurity folks say, may be linked to the notorious Conti crew.
In a joint advisory [PDF] this week, the FBI, CISA and US Treasury
Department outlined technical details about how Karakurt operates, along
with actions to take,...
DOJ Seizes 3 Web Domains Used to Sell Stolen Data and DDoS Services Matthew Wheeler (Jun 02)
https://thehackernews.com/2022/06/doj-seizes-3-web-domains-used-to-sell.html
The U.S. Department of Justice (DoJ) on Wednesday announced the seizure of
three domains used by cybercriminals to trade stolen personal information
and facilitate distributed denial-of-service (DDoS) attacks for hire.
This includes weleakinfo[.]to, ipstress[.]in, and ovh-booter[.]com, the
former of which allowed its users to traffic hacked personal data and
offered a...
Chinese Hackers Begin Exploiting Latest Microsoft Office Zero-Day Vulnerability Matthew Wheeler (Jun 02)
https://thehackernews.com/2022/05/chinese-hackers-begin-exploiting-latest.html
An advanced persistent threat (APT) actor aligned with Chinese state
interests has been observed weaponizing the new zero-day flaw in Microsoft
Office to achieve code execution on affected systems.
"TA413 CN APT spotted [in-the-wild] exploiting the Follina zero-day using
URLs to deliver ZIP archives which contain Word Documents that use the
technique,"...
US military hackers conducting offensive operations in support of Ukraine, says head of Cyber Command Matthew Wheeler (Jun 02)
https://www.three.fm/news/world-news/us-military-hackers-conducting-offensive-operations-in-support-of-ukraine-says-head-of-cyber-command/
US military hackers have conducted offensive operations in support of
Ukraine, the head of US Cyber Command has told Sky News.
In an exclusive interview, General Paul Nakasone also explained how "hunt
forward" operations were allowing the United States to search out foreign
hackers and identify...
SideWinder Hackers Launched Over a 1, 000 Cyber Attacks Over the Past 2 Years Matthew Wheeler (May 31)
https://thehackernews.com/2022/05/sidewinder-hackers-launched-over-1000.html
An "aggressive" advanced persistent threat (APT) group known as SideWinder
has been linked to over 1,000 new attacks since April 2020.
"Some of the main characteristics of this threat actor that make it stand
out among the others, are the sheer number, high frequency and persistence
of their attacks and the large collection of encrypted and obfuscated...
Hackers are Selling US University Credentials Online, FBI Says Matthew Wheeler (May 31)
https://tech.co/news/hackers-are-selling-us-university-credentials-online-fbi-says
The Federal Bureau of Investigation has warned US universities and colleges
that it has found banks of login credentials and other data relating to VPN
access circulating on cybercriminals forums.
The fear is that such data will be sold and subsequently used by malicious
actors to orchestrate attacks on other accounts owned by the same students,
in the hope...
Interpol Nabs 3 Nigerian Scammers Behind Malware-based Attacks Matthew Wheeler (May 31)
https://thehackernews.com/2022/05/interpol-nabs-3-nigerian-scammers.html
Interpol on Monday announced the arrest of three suspected global scammers
in Nigeria for using remote access trojans (RATs) such as Agent Tesla to
facilitate malware-enabled cyber fraud.
"The men are thought to have used the RAT to reroute financial
transactions, stealing confidential online connection details from
corporate organizations, including oil and gas...
U.S. Warns Against North Korean Hackers Posing as IT Freelancers Matthew Wheeler (May 18)
https://thehackernews.com/2022/05/us-warns-against-north-korean-hackers.html
Highly skilled software and mobile app developers from the Democratic
People's Republic of Korea (DPRK) are posing as "non-DPRK nationals" in
hopes of landing freelance employment in an attempt to enable the regime's
malicious cyber intrusions.
That's according to a joint advisory from the U.S. Department of State, the
Department of the...
FBI and NSA say: Stop doing these 10 things that let the hackers in Matthew Wheeler (May 18)
https://www.zdnet.com/article/fbi-and-nsa-say-stop-doing-these-10-things-that-let-the-hackers-in/
Cyber attackers regularly exploit unpatched software vulnerabilities, but
they "routinely" target security misconfigurations for initial access, so
the US Cybersecurity and Infrastructure Security Agency (CISA) and its
peers have created a to-do list for defenders in today's heightened threat
environment.
CISA, the FBI and National...
Fifth of Businesses Say Cyber-Attack Nearly Broke Them Matthew Wheeler (May 18)
https://www.infosecurity-magazine.com/news/fifth-of-businesses-cyber-attack/
A fifth of US and European businesses have warned that a serious
cyber-attack nearly rendered them insolvent, with most (87%) viewing
compromise as a bigger threat than an economic downturn, according to
Hiscox.
The insurer polled over 5000 businesses in the US, UK, Ireland, France,
Spain, Germany, the Netherlands and Belgium to compile its annual Hiscox
Cyber...
Hacker And Ransomware Designer Charged For Use And Sale Of Ransomware, And Profit Sharing Arrangements With Cybercriminals Matthew Wheeler (May 18)
https://www.shorenewsnetwork.com/2022/05/16/hacker-and-ransomware-designer-charged-for-use-and-sale-of-ransomware-and-profit-sharing-arrangements-with-cybercriminals/
A criminal complaint was unsealed today in federal court in Brooklyn, New
York, charging Moises Luis Zagala Gonzalez (Zagala), also known as
“Nosophoros,” “Aesculapius” and “Nebuchadnezzar,” a citizen of France and
Venezuela who resides in Venezuela, with attempted...
State of Ransomware shows huge growth in threat and impacts Matthew Wheeler (May 04)
https://www.continuitycentral.com/index.php/news/technology/7275-state-of-ransomware-shows-huge-growth-in-threat-and-impacts
Sophos has released its annual survey and review of real-world ransomware
experiences in its ‘State of Ransomware 2022’ report. This shows that 66
percent of organizations surveyed were hit with ransomware in 2021, up from
37 percent in 2020.
The average ransom paid by organizations that had data encrypted in their...
Open Source Tool Development
Metasploit — Development discussion for Metasploit, the premier open source remote exploitation tool
Wireshark — Discussion of the free and open source Wireshark network sniffer. No other sniffer (commercial or otherwise) comes close. This archive combines the Wireshark announcement, users, and developers mailing lists.
Snort — Everyone's favorite open source IDS, Snort. This archive combines the snort-announce, snort-devel, snort-users, and snort-sigs lists.
Snort Subscriber Rules Update 2026-02-26 Research via Snort-sigs (Feb 26)
Talos Snort Subscriber Rules Update
Synopsis:
This release adds and modifies rules in several categories.
Details:
Talos has added and modified multiple rules in the browser-chrome,
file-other, os-windows, policy-other and server-webapp rule sets to
provide coverage for emerging threats from these technologies.
For a complete list of new and modified rules please see:
https://www.snort.org/advisories
Snort Subscriber Rules Update 2026-02-24 Research via Snort-sigs (Feb 24)
Talos Snort Subscriber Rules Update
Synopsis:
This release adds and modifies rules in several categories.
Details:
Talos has added and modified multiple rules in the malware-other and
server-webapp rule sets to provide coverage for emerging threats from
these technologies.
For a complete list of new and modified rules please see:
https://www.snort.org/advisories
Snort Subscriber Rules Update 2026-02-19 Research via Snort-sigs (Feb 19)
Talos Snort Subscriber Rules Update
Synopsis:
This release adds and modifies rules in several categories.
Details:
Talos has added and modified multiple rules in the file-pdf,
malware-cnc, malware-other and server-webapp rule sets to provide
coverage for emerging threats from these technologies.
For a complete list of new and modified rules please see:
https://www.snort.org/advisories
Snort Subscriber Rules Update 2026-02-17 Research via Snort-sigs (Feb 17)
Talos Snort Subscriber Rules Update
Synopsis:
This release adds and modifies rules in several categories.
Details:
Talos has added and modified multiple rules in the malware-other and
server-webapp rule sets to provide coverage for emerging threats from
these technologies.
For a complete list of new and modified rules please see:
https://www.snort.org/advisories
Snort Subscriber Rules Update 2026-02-12 Research via Snort-sigs (Feb 12)
Talos Snort Subscriber Rules Update
Synopsis:
This release adds and modifies rules in several categories.
Details:
Talos has added and modified multiple rules in the browser-other,
file-flash, file-pdf, os-windows, policy-other and server-webapp rule
sets to provide coverage for emerging threats from these technologies.
For a complete list of new and modified rules please see:
https://www.snort.org/advisories
Snort Subscriber Rules Update 2026-02-10 Research via Snort-sigs (Feb 10)
Talos Snort Subscriber Rules Update
Synopsis:
Talos is aware of vulnerabilities affecting products from Microsoft
Corporation.
Details:
Microsoft Vulnerability CVE-2026-21231:
A coding deficiency exists in Microsoft Windows Kernel that may lead to
an escalation of privilege.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with:
Snort 2: GID 1, SIDs 65895 through 65896,
Snort 3: GID 1, SID...
Snort Subscriber Rules Update 2026-02-05 Research via Snort-sigs (Feb 05)
Talos Snort Subscriber Rules Update
Synopsis:
This release adds and modifies rules in several categories.
Details:
Talos has added and modified multiple rules in the file-pdf,
malware-cnc, os-windows, policy-other, protocol-snmp and server-webapp
rule sets to provide coverage for emerging threats from these
technologies.
For a complete list of new and modified rules please see:
https://www.snort.org/advisories
Snort Subscriber Rules Update 2026-02-03 Research via Snort-sigs (Feb 03)
Talos Snort Subscriber Rules Update
Synopsis:
This release adds and modifies rules in several categories.
Details:
Talos has added and modified multiple rules in the malware-cnc,
malware-other, protocol-snmp and server-webapp rule sets to provide
coverage for emerging threats from these technologies.
For a complete list of new and modified rules please see:
https://www.snort.org/advisories
Snort Subscriber Rules Update 2026-01-29 Research via Snort-sigs (Jan 29)
Talos Snort Subscriber Rules Update
Synopsis:
This release adds and modifies rules in several categories.
Details:
Talos has added and modified multiple rules in the file-office,
file-pdf, policy-other and server-webapp rule sets to provide coverage
for emerging threats from these technologies.
For a complete list of new and modified rules please see:
https://www.snort.org/advisories
Snort Subscriber Rules Update 2026-01-27 Research via Snort-sigs (Jan 27)
Talos Snort Subscriber Rules Update
Synopsis:
This release adds and modifies rules in several categories.
Details:
Talos has added and modified multiple rules in the file-multimedia and
server-webapp rule sets to provide coverage for emerging threats from
these technologies.
For a complete list of new and modified rules please see:
https://www.snort.org/advisories
Snort Subscriber Rules Update 2026-01-22 Research via Snort-sigs (Jan 22)
Talos Snort Subscriber Rules Update
Synopsis:
This release adds and modifies rules in several categories.
Details:
Talos has added and modified multiple rules in the and server-webapp
rule sets to provide coverage for emerging threats from these
technologies.
For a complete list of new and modified rules please see:
https://www.snort.org/advisories
Snort Subscriber Rules Update 2026-01-20 Research via Snort-sigs (Jan 20)
Talos Snort Subscriber Rules Update
Synopsis:
This release adds and modifies rules in several categories.
Details:
Talos has added and modified multiple rules in the browser-ie,
file-multimedia, malware-cnc, malware-other, policy-other and
server-webapp rule sets to provide coverage for emerging threats from
these technologies.
For a complete list of new and modified rules please see:
https://www.snort.org/advisories
Snort Subscriber Rules Update 2026-01-15 Research via Snort-sigs (Jan 15)
Talos Snort Subscriber Rules Update
Synopsis:
This release adds and modifies rules in several categories.
Details:
Talos has added and modified multiple rules in the browser-ie,
file-multimedia, file-other and server-webapp rule sets to provide
coverage for emerging threats from these technologies.
For a complete list of new and modified rules please see:
https://www.snort.org/advisories
Snort Subscriber Rules Update 2026-01-13 Research via Snort-sigs (Jan 13)
Talos Snort Subscriber Rules Update
Synopsis:
Talos is aware of vulnerabilities affecting products from Microsoft
Corporation.
Details:
Microsoft Vulnerability CVE-2026-20805:
A coding deficiency exists in Microsoft Desktop Window Manager that may
lead to an information disclosure.
Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with:
Snort 2: GID 1, SIDs 65663 through 65664,
Snort 3: GID...
Re: Snort Version Dillon Hayutin via Snort-sigs (Jan 13)
Hey Team,
Are we using any specific lists with snort?
Dillon Hayutin
More Lists
We also maintain archives for these lists (some are currently inactive):
- Declan McCullagh's Politech
- TCPDump/LibPCAP Dev
- Security Incidents
- Vulnerability Development
- Vulnerability Watch
Related Resources
Read some old-school private security digests such as Zardoz at SecurityDigest.Org
We're always looking for great network security related lists to archive. To suggest one, mail Fyodor.