On July 11th, around 5AM UTC, DeepSource was notified by the GitHub Security Team that they were tracking potentially malicious activity related to the DeepSource Github application.  The GitHub Security team had observed a large number of requests from unusual IP addresses for many distinct DeepSource users starting in mid-June, which stood out as anomalous. At this time, GitHub wasn’t sure about the source of the compromise.  By 7AM UTC, we had rotated all user tokens, client secrets and priva...

Вы выбираете сферу, зарплату и город — мы рассказываем, какие возможности у вас есть.

Last Updated:  October 1, 2020

Contribute to Onapsis/CVE-2020-6287_RECON-scanner development by creating an account on GitHub.

Исследователи из лаборатории SAND при Чикагском университете разработали инструментарий Fawkes с реализацией метода искажения фотографий, препятствующего их использованию для обучения систем распознавания лиц и идентификации пользователей. В изображение вносятся пиксельные изменения, которые незаметны при просмотре людьми, но приводят к формированию некорректных моделей при использовании для тренировки систем машинного обучения. Код инструментария написан на языке Python и опубликован под лицензией BSD. Сборки подготовлены для Linux, macOS и Windows.

A curated list of amazingly awesome open source sysadmin resources inspired by Awesome PHP. - kahun/awesome-sysadmin

This article describes instructions on how to upgrade from Red Hat Enterprise Linux 6.10 to Red Hat Enterprise Linux 8 using the redhat-upgrade-tool and Leapp utilities.

Sys-Adm.in - Сайт для сисадминов и не только. Здесь собраны различные материалы основанные на личной практике. Блог Евгения Гончарова.

A massive security breach forced GEDmatch to shut down its site and exposed the DNA profiles of more than a million people who use the online service to law enforcement agencies.

A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and read sensitive files on a targeted system.
The vulnerability is due to a lack of proper input validation of URLs in HTTP requests processed by an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request containing directory traversal character sequences to an affected device. A successful exploit could allow the attacker to view arbitrary files within the web services file system on the targeted device. As an example, this could allow an attacker to impersonate another VPN user and establish a Clientless SSL VPN or AnyConnect VPN session to the device as that user.
The web services file system is enabled when the affected device is configured with either WebVPN or AnyConnect features. This vulnerability cannot be used to obtain access to…

The upcoming Terraform 0.13 release includes powerful new meta-arguments for modular workflows including count, for_each and depends_on. These language features can simplify and streamline Terraform configurations at the resource-level, and they are now available for module-centric workflows.

Emotet is back… and is being hijacked by James Franco (sort of).

SCP is an old and inflexible protocol, the OpenSSH project recommends the use of rsync and sftp. This article provides a migration guide for users of scp.

This Azure DevOps tutorial will teach you what is Azure DevOps and the various services it provides. Azure DevOps helps developers and the team in creating and deploying applications with either Azure DevOps Service or on-premise Azure DevOps Server.

Attack targeting misconfigured containerized environments in the cloud.