MITRE ATT&CK
9 posts
Count Binface breaks your correlation rule
Count Binface names a detection-pipeline attack: targeted noise injection exploits data-aggregation bias to bury true positives and poison UEBA baselines.
Springer Nature unpinned two papers, no log
Springer Nature removed two Max Planck studies. The real exposure is a research supply chain with no integrity log - the same trust gap as CI/CD poisoning.
This isn't a bug. It's the default.
Codex writes unbounded session logs to local SSDs. Mapped correctly to MITRE T1499, not T1071 - a disk-exhaustion DoS primitive EDR baselines miss.
Social engineering is a misconfiguration
Human error in identity workflows is a misconfiguration, not incompetence - how Scattered Spider, 0ktapus and MFA fatigue exploit the validation gap.
Removing curl and wget stops nothing
Bash /dev/tcp opens TCP sockets and sends HTTP with no curl or wget, evading process-name detection while leaving cleartext on the wire.
Ring 0, fed a stranger's save file
The US directive suspending Fable 5 and Mythos 5, analyzed: why game clients are privileged code, how asset and netcode bugs work, and why trust is the flaw.
Editorial independence is a failed control
UK media failed to disclose defence sector ties in nearly 60 percent of cases. The disclosure gap is an information supply chain vulnerability - and it is exploitable.
CERT-IN's 12-hour patch window is not arbitrary
CERT-IN's 12-hour patch window for internet-facing flaws responds to AI-compressed exploitation timelines - what the threshold means operationally.
axios CVE-2025-3891: What the Advisories Don't Say About Immutable Images
CVE-2025-3891 in axios allows prototype pollution leading to RCE. This post reveals why deployed container images remain at risk even after patching, due to missing artifact provenance and immutable verification.