Exclusive Cybersecurity News & Analysis | We follow people whose work we want to learn from ! | Actively connecting with Cybersecurity Professionals #hacking
India
Joined April 2024
- Tweets1.1K
- Following458
- Followers775
- Likes1.8K
Pinned Tweet
🔥 How a Web Application Firewall (WAF) Works
A Web Application Firewall (WAF) is a specialized security layer that protects web applications by monitoring, filtering, and blocking HTTP/HTTPS traffic between users and the server.
Unlike traditional firewalls that operate at the network layer, a WAF works at the application layer (OSI Layer 7), understanding web traffic structure: URLs, headers, cookies, sessions, and payloads.
Here’s how it works step by step 👇
🌐 1. Users Send Requests
Users send HTTP/HTTPS requests to access the web application.
Traffic passes through the WAF before reaching the server (security checkpoint).
🛑 2. Request Interception
The WAF intercepts and parses each request into components:
- HTTP headers
- Cookies
- URL parameters
- Query strings
- Request body (payload)
🧠 3. Rule-Based Inspection
The WAF checks requests against predefined rules:
- Signature matching (known attack patterns)
- URL pattern validation
- Header validation
This blocks common attacks such as:
- SQL Injection
- Cross-Site Scripting (XSS)
- Command Injection
- Local File Inclusion (LFI)
📊 4. Behavioral Analysis
Modern WAFs also analyze behavior by:
- Comparing requests to normal traffic baselines
- Detecting bot activity
- Identifying abnormal API usage
- Recognizing automated attack tools
This stops:
- Brute-force attempts
- Credential stuffing
- Bot scraping
- Enumeration attacks
🔍 5. Payload Analysis
The WAF deeply inspects the request body by:
- Decoding encoded or obfuscated payloads
- Examining input fields for malicious scripts
- Identifying hidden attack vectors
Example: It detects <script>alert(1)</script> in a form field before it reaches the application.
🚨 6. Decision Engine
The WAF decides:
- 🟢 Allow → forwards safe requests
- 🔴 Block → drops malicious requests (often returns 403 Forbidden)
- 🟡 Challenge → triggers CAPTCHA or other verification
🖥 7. Server Processing & Response Handling
Allowed requests are processed by the server. Responses pass back through the WAF, which may inspect them to prevent:
- Data leakage
- Sensitive information exposure
- Malicious response injection
📈 8. Logging & Reporting
The WAF logs all activity:
- Allowed traffic
- Blocked attacks
- Suspicious behavior
- Security events
This data supports monitoring, threat intelligence, incident response, and compliance.
🔥 Why WAF Is Critical Today
Modern web applications face constant threats:
- Zero-day vulnerabilities
- API abuse
- Bot attacks
- Layer 7 DDoS
- OWASP Top 10 risks
A WAF serves as:
- A protective shield
- A virtual patching mechanism
- A traffic intelligence system
- A compliance support layer
🧩 Types of WAF
- Network-based (hardware appliance)
- Host-based (installed on server)
- Cloud-based (most common today)
Cloud WAFs offer scalability and easier management.
Cyber Edition retweeted
Current information I have on php2Shell:
- The RCEs requires the attacker to obtain memory addresses which are typically protected by ASLR.
- I suspect the original author (lcfr_hax) likely has a reliable exploit which leads to stable code execution.
- Most of the PoCs being posted are completely non-functional AI slop.
- There is at least 1 working non-slop exploit being passed around, but it's reliant on bruteforcing for ASLR bypass, so not particularly impactful.
- Rumor of ITW exploitation are patchy. There are attempts being seen using the non-functional leaked RCE, or variants that are config / system specific.
- Some rumors point towards a known-working exploit being used by threat actors (I've personally confirmed this specific exploit works, but the ASLR bypass technique is unreliable at best and massively limits the potential impact).
- I'd expect heavy ITW exploitation in the next few weeks based on how many people are looking at this. Though, success rates will vary heavily based on the specific exploit chain.
Cyber Edition retweeted
🚨 Claude Sessions Stolen by Infostealer Malware
A Claude user has shared what appears to be a security notification sent by the Claude Team warning that threat actors are actively stealing authenticated Claude login sessions using commodity infostealer malware.
According to the notification:
* Infostealers are stealing Claude login sessions directly from infected computers
* Attackers are then replaying those sessions to access Claude accounts and consume victims' usage
* Anthropic says the activity is NOT related to malware distributed through Claude
* Phones and tablets do not currently appear to be involved
The malware families identified in the campaign so far reportedly include:
* Vidar
* Lumma / LummaC2
* StealC
* RedLine
* Acreed
* Atomic Stealer (AMOS) on a small number of Macs
For affected accounts, Anthropic says it has:
* Invalidated the compromised Claude sessions
* Removed stored payment methods
* Refunded charges identified as unauthorized
* Recommended that affected users scan their computers and secure associated accounts
⚠️ Analyst Note:
This is another example of why MFA alone cannot solve the infostealer problem.
Instead of stealing a password and attempting a new authentication, an attacker can steal an already-authenticated browser session. That session may allow the attacker to effectively "become" the authenticated user until the session is revoked.
The bigger trend is worth watching:
Infostealer → browser/session theft → authenticated SaaS access → account abuse
AI platforms are becoming another valuable target within this ecosystem.
Important: This information comes from an apparent Claude customer security notification shared publicly. We have not identified a corresponding public Anthropic security advisory at this time.
Credit: Reddit user u/WorriedAssociate7029 for sharing the notification.
#DDW #CyberSecurity #Infostealer #Claude #Anthropic #ThreatIntelligence
If you run Switchvox:
→ Upgrade to 8.4.0.2 or later → Investigate /var/log/switchvox/db-quirks.log for suspicious SQL payloads
→ Review network activity involving the observed attacker infrastructure
→ Look for signs of post-exploitation activity
More: horizon3.ai/attack-research/…
🔓 Five high-risk flaws were found in Palo Alto GlobalProtect. CVE-2026-0251 can let local users gain SYSTEM/root access, while 4 PoCs are already public. One flaw remains unpatched. Organizations should update GlobalProtect now.
#CyberSecurity #VPN
Read more: thecyberedition.com/palo-alt…
🤖 NVIDIA’s NemoClaw has a high-severity flaw (CVE-2026-65105) that could let a malicious website hijack local AI agents via DNS rebinding. Attackers could poison model templates and influence future agent actions. Update now.
#CyberSecurity #AI
Read more: thecyberedition.com/nvidia-n…
🔓 Attackers are probing a Microsoft SharePoint RCE chain combining CVE-2026-55040 and CVE-2026-63520. The flaws can enable authentication bypass and remote code execution on exposed on-premises servers. Patch immediately.
#CyberSecurity #Microsoft
Read more: thecyberedition.com/microsof…
🐞 Google Chrome 152 patches 327 security flaws, including 10 Critical vulnerabilities. The update fixes serious memory-safety and code-execution risks across Chrome components. Users should update now.
#CyberSecurity #GoogleChrome
Read more: thecyberedition.com/google-c…
🚨 Two critical WatchGuard Agent flaws, CVE-2026-57909 and CVE-2026-57910, could let unauthenticated attackers execute code on Windows endpoints. WatchGuard urges users to update to Agent 1.25.13.000 or later.
#CyberSecurity #Windows
Read more: thecyberedition.com/critical…
🔥 CISA confirms active exploitation of CVE-2026-21962 in Oracle WebLogic and HTTP Server. The access-control flaw puts exposed enterprise systems at risk. Patch now and check logs for signs of compromise. #CyberSecurity #Oracle
Read more: thecyberedition.com/oracle-w…
⚠️ A decade-long BengalSEO scam is using fake tech-support pages to poison Google/Bing results. Victims may be pushed to scam calls or MayaBot malware. Researchers found 1,190+ pages and 84 GitHub accounts tied to the operation.
#Scam #CyberSecurity
Read more: thecyberedition.com/bengalse…
🔓 Tata Nexarc fixed a critical OTP flaw that exposed login codes through API responses. An attacker with a registered mobile number could potentially access business accounts without the victim’s phone.
#CyberSecurity #APIsecurity
Read more: thecyberedition.com/tata-nex…
🚨 Zscaler Client Connector has a critical Windows RCE flaw, CVE-2026-59568, with a CVSS 9.1 score. It can allow unauthenticated remote code execution, putting enterprise endpoints at risk. Update to a fixed version now.
#CyberSecurity #Windows
Read more: thecyberedition.com/zscaler-…
🤖 AI agents reportedly breached Asian government systems, compromised 85 employee accounts and exposed 2,564+ records in a four-day campaign. The attack shows how AI can automate recon, credential attacks and data theft.
#CyberSecurity #AI
Read more: thecyberedition.com/ai-agent…
Cyber Edition retweeted
5 US agencies published AA26-231A on the 19th August. It is the first government advisory to confirm AI-generated scripts being used against industrial control systems.
Threat actors are utilising Censys and ZoomEye to find controllers with port 102 exposed, then creating AI-generated Python built around snap7 to create scripts that look like OT monitoring software which give read and write access to data blocks, configuration and ladder logic.
For S7-300 and S7-400 there is no patch. The protocol implementation sits in hardware that cannot run S7CommPlus.
🔓 Kimsuky is targeting South Korea and Japan with phishing, PowerShell and a malicious Chrome extension built to steal Gmail messages and attachments. The campaign also abuses Chrome Remote Desktop and AnyDesk for access.
#CyberSecurity #Kimsuky
Read more: thecyberedition.com/kimsuky-…
🛡️ ReliaQuest stopped a targeted MFA phishing attack after an employee entered credentials and approved a fake MFA prompt. Device-trust controls blocked deeper access, keeping customer and internal systems safe.
#CyberSecurity #Phishing
Read more: thecyberedition.com/reliaque…
🧠 Ox Alpha, a stealth AI coding model, is raising security concerns over its autonomous capabilities and unknown origins. Long-running AI agents could access code, secrets and cloud systems, making sandboxing and least privilege critical.
#AI #CyberSecurity
Read more: thecyberedition.com/ox-alpha…
🤖 Google’s AI-powered security agents found 100+ real critical vulnerabilities in stolen corporate source code in just 2 days. The system combines AI agents with human validation to uncover exploitable flaws faster.
#CyberSecurity #AI
Read more: thecyberedition.com/google-a…
