This Free App Helps You Make Cocktails With Ingredients You Already Have

Some people have fully stocked bars—the rest of us make do with a rotating cast of liquors and ingredients.

If that's you, Drinkable is a totally free app that tells you which cocktails you can make with the ingredients you have on hand. Even better: it works offline, perfect if you're stranded in a cabin with a well-stocked bar but no wireless signal (it happens, believe me).

This application, available for iOS and Android with no ads or in-app-payments, includes a catalogue of over 150 drinks. This means you could use it to quickly look up the recipe for all of the common cocktails. To get started, install the app from Google Play or the App Store. You can start searching for recipes right away. Honestly, the application is perfectly useful just as a pocket recipe book for all the classic cocktails.

To me, though, the real fun happens when you head to the Ingredients tab and start entering which things you have on hand. While browsing recipes, you'll see checkmarks next to the ingredients you have on hand. Or, if you prefer, you can filter the recipes to only see drinks you can make with your current ingredients. Tap any of them and you'll see the recipe.

Credit: Justin Pot

Scroll down past the list of drinks you can make with current ingredients and you'll see a list of drinks that you're one ingredient away from making. Basically, this app is built around showing you what drinks you can make with what you have on hand while also pointing out things you could make with just a few more things. I like this because it can help inform your next shopping trip without totally overwhelming you.

Even if you don't want to bother with inventory management, this app is a handy reference—and it's completely free (with no in app purchases). Whether you're making a quick drink for yourself or a batch of bottled cocktails for a party, you'll have the knowledge you need.

from Lifehacker https://ift.tt/M8TjiRN

Finally, There's a Fix for Apple Mail's Weird Archiving Behavior

If all you want is a simple, reliable email client, Apple's Mail app is superb choice. And over the years, it's only gotten better. But until now, it's had this one weird quirk that has users running to third-party clients like Gmail or Outlook.

It has to do with how the Archive feature works. When you archive an email that you're reading, the Mail app automatically opens the next email in your inbox. Now, that's great if you're just going through newsletters. But when this happens, the next email is marked as read automatically, something you might not want to do in every case (like if the sender is using a tracking service, or if you were saving that email to read later).

It's a small thing, but it takes some agency away from you, and that makes it quite annoying to deal with. Luckily, Apple seems to have finally realized this, and in iOS 18.4, which is currently in Developer beta, the company has provided a hidden settings option to change this behavior. Why Apple just doesn't just make the fix the default, and why this has to be an obscure settings item, is beyond me.

Either way, if you're running iOS 18.4 use the Mail app regularly, go to the Settings app. Then, go to the Mail section and choose Delete or Move Message Action. Here, switch to the Don't Select a Message option.

Boom. You're all set. Now, when you're reading a message in the Mail app and delete, archive, or move it, the app won't automatically open the next message, and instead you'll go back to the Inbox view. What a revolution!

Speaking of the Inbox, if your device is running Apple Intelligence, you might have noticed that the Mail app looks a bit different now. It has a bunch of categories up top, and AI summaries, and even Priority emails that never manage to highlight the actually important messages. If you don't like all or some of these AI features, I have some good news—you can turn that all off. Follow this guide to disable all the new AI features in the iPhone mail app and go back to how things used to be. Of course, except for the old archive thing. Because, for once, this change is actually useful.

from Lifehacker https://ift.tt/xOnL5Wv

This Subscription-Free Security Camera Is $20 Right Now

We may earn a commission from links on this page. Deal pricing and availability subject to change after time of publication.

The TP-Link Tapo C402 is $19.99 on Woot for the next two days or until it sells out. If you're a Prime member, you get free shipping; otherwise, it’ll cost you an extra $6.

TP-Link Tapo C402

$19.99 at Woot

$49.99 Save $30.00

$19.99 at Woot

$49.99 Save $30.00

This camera is IP65-rated, meaning it can handle rain and dust, and has a bullet-style design that makes it easy to mount. You get a 90-day Woot Limited Warranty, which isn’t long, but at this price, it’s hard to complain. It records in 1080p with a 125-degree field of view, offering sharp, color-rich daytime footage. At night, it switches between full-color video (though the colors reportedly appear a bit washed out) using built-in spotlights and black-and-white infrared video, depending on lighting conditions.

For storage, the C402 supports microSD cards up to 512GB, but you’ll need to buy one separately if you want local storage. If you’d rather store footage online, TP-Link offers a Premium Tapo Care ($3.49 monthly or $34.99 annually) plan, which includes 30 days of video history, smart sorting for recorded clips, and rich notifications. Even if you skip the subscription, you still get free intelligent alerts for people, pets, and vehicles, privacy zone controls, two-way audio, and live view through the app, notes this PCMag review. Additional controls in the app include adjusting the spotlight brightness, formatting a microSD card, manually recording a video, and enabling or disabling the built-in 94dB siren, among others.

The C402 connects via 2.4GHz wifi and works with Alexa, Google Assistant, and IFTTT applets to integrate with other compatible smart home devices. It does not support Apple HomeKit. A 6,400mAh rechargeable battery powers the unit, which TP-Link claims can last up to 180 days per charge—though, in reality, that depends on usage. For those wanting a more hands-off power solution, the TP-Link Tapo SolarCam C402 Kit is available for $44.99 (down from $50.98), allowing the camera to run indefinitely on solar energy for a more set-it-and-forget-it experience.

from Lifehacker https://ift.tt/XoYM4jU

Sour Cream Makes for a Better Egg Wash Than an Actual Egg

There are times when eggs are non-negotiable in a recipe—like egg drop soup or quiche—but when eggs play a minor role, then why not use a replacement? Egg wash is a prime example. Using it adds color and shine to finished baked goods like dinner rolls and pies, but when eggs are selling at a premium price, it’s hard to justify using an egg wash at all.

Finding a good egg wash alternative isn’t only useful for saving a buck, but it can be a handy back-up even when eggs are plentiful. There’s always the occasion where you just ran out, or you have folks coming over that are on egg-free diets. After some browsing on the internet, butter, mayo, milk, heavy cream, maple syrup, and sour cream seem to be the common substitutes.

Credit: Allie Chanthorn Reinmann

I whipped up a batch of my favorite biscuits and painted them with different finishes so I could compare them after baking. You can see in the picture above that there are eight biscuits. In addition to the six alternatives I mentioned, I did one with actual egg wash so we can track what we're striving for, and one with absolutely nothing on it as a control.

25 minutes later, the results were in and I was actually pretty surprised. Each topping produced a different result; some more obvious than others. When egg wash is used as a topping (as opposed to a binder), its primary function is to impart color, shine, and leave no trace of flavor, so that's what I was looking for.

Credit: Allie Chanthorn Reinmann

Here are the results from top left to right, and bottom left to right.

• Egg wash: Goal browning and shine

• Sour cream: Best browning, high gloss (outshined the egg)

• Heavy cream: Light browning, a slight shine

• Whole milk: Well-browned, slight shine

• No wash: Light browning, matte

• Maple syrup: Well-browned, no shine

• Mayonnaise: Medium browning, medium shine

• Butter: Light browning, no shine

Hands-down, the winner was sour cream. Dare I say it performed even better than the actual egg wash. (I tried to capture the blinding shine in the picture below.) The color of the baked sour cream coated biscuit was a beautiful dark brown, and the shine surpassed even the egg wash standard. 

Credit: Allie Chanthorn Reinmann

Runners-up were mayonnaise and whole milk for their middle-of-the-road performance in both categories. For a vegan option, maple syrup imparted gorgeous brown coloring, but it had a decidedly un-shiny finish and it leaves behind a subtle sweet flavor (which might be good or bad depending on your preferences). 

Butter turned out the worst performance. I would be sad, but I’ve been fooled by butter before so I was expecting the disappointment. On both counts, the finish paled in comparison to its competitors. Butter aside, at least you have some options for the next time you make a batch of biscuits, rolls, pastries, or pies. Save the eggs for when they matter most.

from Lifehacker https://ift.tt/LNm3D9T

The Brane X Is a Portable (but Pricey) Smart Speaker With Incredible Bass

We may earn a commission from links on this page.

Before this review, I had never heard of Brane, but now, it's all I want to hear when I play my music. The Brane X is many things, but cheap isn't one of them. But for $499, you get a multi-use premium speaker that can handle itself underwater, has Alexa voice assistant, connects through wifi for better audio, has the best bass of any wifi speaker, and can be used as a soundbar and subwoofer combo. The Brane X is a great wifi speaker for someone who values bass, would like to take their speaker outdoors, and needs a soundbar and subwoofer combo for their home theater. However, it isn't perfect and at its price, it competes with the best. The Sonos Move 2 is slightly cheaper, offers a replaceable battery with 24 hours of juice, and better treble and mids (but nowhere near the same range or bass power fo the Brane X).

Brane reached out to me to review the Brane X and sent me the speaker for my honest thoughts, which is exactly what you'll get in this review.

Brane X Smart Speaker

$499.00 at Amazon

$499.00 at Amazon

Brane X speaker pros, cons, and specs

Pros

• Best-in-class bass and sub-bass for smart speakers

• Wifi streaming over Spotify and AirPlay 2

• Compact and portable

• Powerful 98dB stereo speaker

• IP57 dust and waterproof

• Doubles as a soundbar and subwoofer combo in one with an AUX connection

• Companion app with EQ

Cons

• Expensive

• Upper registers sound compressed at max volume when using Bluetooth

• No Chromecast support

• No speakerphone function

• Some features make a whirring noise

• No USB-C charging (only DC)

Specs

• Battery Life: About six hours of battery at a moderately high volume (about 12 hours at a moderate level, according to Brane).

• Connectivity: Wifi supports 802.11a/b/g/n/ac standards, Bluetooth version 5.1, streaming services compatible with AirPlay 2, Spotify Connect, and Amazon Alexa.

• Inputs: Auxiliary input 3.5 mm jack for wired connections.

• App: Brane companion app for fine-tuning bass, customizing EQ settings, managing speaker groups, and adjusting various settings.

• Drivers: One 6.5" by 9" Repel-Attract-Driver (RAD) subwoofer, two 2.5" midrange drivers, two 0.75" dome tweeters.

• Power Output: Four Class-D digital amplifiers delivering a combined output of over 200 watts (98dB).

• Water Resistance: Rated IP57, making it fully waterproof and dust-protected.

• Size: 6.1 inches x 9.3 inches x 7 inches (H × W × D)

• Weight: 7.7 lbs

First impressions of the Brane X speaker

Credit: Daniel Oropeza

I have to be honest: First impressions of the Brane X weren't good. Turning it on wasn't intuitive, since the power button doesn't provide any feedback that I pressed it properly. The same can be said about the media controls on top, but I'll get more into those details later. There is also a weird whirring sound that the speaker makes once you turn it on that made me think my speaker was defective (it goes away after a few seconds). The sound is actually an air pump equalizing the air pressure inside the speaker, which is a patent technology that Brane called Repel-Attract-Driver (RAD). RAD is what makes this speaker unique, giving it the best bass range output I've heard on any speaker. Try this frequency range test on your wifi or Bluetooth speaker and see how it performs. The Brane X didn't just play through the whole range but vibrated my entire office with its powerful bass. And because of that, I'm willing to put up with the humming sound it makes when it's turned on.

Design

The Brane X uses touch controls for media. Credit: Daniel Oropeza

The design is, well, boring. All black is a safe option and with no color variations, it leaves me wanting to fill it with stickers to give it some personality. But that leads to my next issue: touch controls. To control the speaker you have a few options on top of the speaker, none of which provide haptic feedback. And since their touch controls, you don't really know if your command when though unless you hear the speaker. There is also no play/pause button, so I can only control it with my phone (or Alexa if using it to play music).

Considering this is also an outdoor speaker with an IP57 rating that can be completely submerged underwater, physical buttons could've come in handy. The handle on the top is useful considering the speaker almost weighs eight pounds.

The Brane X charger is DC, so no USB-C. Credit: Daniel Oropeza

The charger is DC, so no USB-C for fast universal charging, unfortunately. The battery is marketed as 20 hours of battery life at a moderate volume, but I only got around six hours of juice at around 75% volume (which to be fair, is very loud indoors unless you're having a house party). It'll take about three hours to fully charge it once it is drained.

Sound

Credit: Daniel Oropeza

The sound is where the Brane X blows away the competition and really shines, especially if you love bass (and I do). As I explained earlier, the RAD technology really pumps out incredible power out of this small speaker. Considering this is less than 10% the size of JBL's PartyBox Stage 320 (my favorite party speaker), it's impressive that it nearly matches its 240 W of output power (the Brane X gets to 200 W), only about a 2dB difference in volume to my favorite party speaker. I will caveat that this isn't a party speaker, and you can really hear it struggle on upper registers when getting it to its max volume.

Unless I'm blasting the Brane X, though, the sound quality is pristine. Because the frequency range of the bass is so wide, you can really hear and feel the lower registers, giving it a full sound without needing to get too loud. It makes for a fun sound that is distinctive to the Brane X. I listened to MONACO by Bad Bunny and could hear the sub-bass parts of the bass clearly. The sensation of feeling the bass at this level usually means blasting the music on regular speakers or headphones, but the Brane X manages to provide that feeling without scaring my neighbors.

Features of the Brane X speaker

Credit: Daniel Oropeza

The Brane X is a wifi speaker first, meaning it performs better than Bluetooth speakers in terms of connectivity with a wider range, better sound quality by streaming higher bitrate audio, and other features. Instead of connecting to the speaker over Bluetooth, you can play music directly into it through Spotify Connect, so you'll get a better connection and sound quality. You can also connect via AirPlay 2 and Amazon Alexa. The Amazon smart assistant performs as well as any Alexa device.

The Brane app

Left: Main screen. Middle: EQ. Right: The AUX Pass-Through feature to minimize delay with the TV. Credit: Daniel Oropeza

My experience with the companion app was like most speaker apps: It does its simple job well, but it can disconnect on occasion and can be slow at times. The main things I used the app were to check the battery life, mess with the EQ (you get a five-band equalizer) which adjusts your changes in real time, and setting the AUX Pass-Through feature when setting it up as a soundbar. The app gives you the option to link up groups if you have more than one Brane X speaker. As I only have one speaker, I wasn't able to try this feature.

The Brane X as an outdoor speaker

Credit: Daniel Oropeza

As I do with all of my outdoor speakers, I took it out to the court while hosting my Street FC soccer games. We played five on five on a hockey rink with walls, so the sound bounces off to give it a "surround" feel. Even then, the Brane X struggles to fill the court completely. This is by far the smallest speaker I've ever taken to my games, however, and I'm comparing the sound decibels to party speakers, which is an unfair comparison. The fact that the Brane X is even a contender here speaks volumes to its versatility. With that said, the audio did sound compressed at maximum volumes sometimes. Since it's a Bluetooth connection outdoors instead of wifi, the compression sound is more noticeable at max volume (it'll sound better indoors with a wifi connection). The Brane X comes with an IP57 rating, making it fully waterproof and dust-protected—great for an outdoor speaker.

The Brane X as a soundbar

The Brane X doubles as a soundbar and sub woofer combo with an AUX cable. Credit: Daniel Oropeza

If you want to use the speaker as a soundbar, you'll need an AUX cable (at least the end that connects to the speaker needs to be AUX). I wish the Brane X had Google Chromecast support so it could connect wirelessly to my smart TV, but you can't have everything in life. You can still connect it with Bluetooth, but you won't be able to use the AUX Pass-Though feature on the app to get rid of the sound delay (the delay is not bad, but sticklers will notice it). You won't get eARC sound quality, but the speaker itself has a subwoofer, so the sound is surprisingly good as a soundbar and subwoofer combo.

I decided to re-watch Dune to hear how well the Brane X performed as a soundbar and subwoofer combo and compared it to the speaker system on my TCL QM7 TV, which has a subwoofer speaker on the back. The Brane X really brought Dune to life compared to the television speakers. I could feel every thud of the thumpers as they hit the sand when calling the worms. The soundtrack and vibrations of the explosions really put the excellent broad frequency range the Brane X has to use. The speaker is able to handle the dynamic audio you want from a soundbar, hearing whispers and feeling explosions.

Bottom line

Credit: Daniel Oropeza

The Brane X is a powerful wifi speaker with a subwoofer that gives it an incredible range in the sub-bass frequencies. It's the best wifi and smart speaker for bass lovers. With Spotify and AirPlay 2, most people's needs for music will be met. Its small compact size also makes it a great portable and outdoor speaker, with a waterproof IP57 rating and up to 12 hours of battery life. It can get very loud with a maximum of 98 dBs, and it doubles as a soundbar and subwoofer combo, making it great for watching movies. However, all that versatility comes at a high price of $499. If you're looking to blast the Brane X at max volume, know that playing over Bluetooth will lead to some compression being noticeable. There is no speakerphone option despite its many microphones, and you'll need to depend on the DC charger, which isn't ideal for portable speakers.

The Brane X is ideal for someone looking for a wifi speaker that can do a bit of everything. A one-stop speaker that you can take to the beach, use as a soundbar, fill your living room for a party, or take on a whim to your next adventure. It definitely rivals the Sonos Move 2, and would recommend it to anyone who isn't in the Sonos ecosystem already and/or loves to feel bass in their life.

from Lifehacker https://ift.tt/9anW8xA

The Out-of-Touch Adults' Guide to Kid Culture: What Is 'Amialivecore'?

Dropping things on your foot and rating how much it hurts is a growing trend on TikTok. The meme's popularity may be indicative of something deep and troubling in youth culture. So, maybe, is injecting butterflies and turning goth. You be the judge.

What is "Amialivecore?"

On his substack "The Trend Report," Kyle Raymond Fitzpatrick pulled together a ton of disparate cultural expressions among online youth to identify a style he calls "Amialivecore." Fitzpatrick posits that young people are subconsciously unsure if they are actually living human beings. I think he's onto something.

My interpretation of the meaning of amialivecore: Since they were babies, young people's experiences are almost entirely unreal. Everything is mediated. They have "experiences" in video games. They see the world through the vertical window of TikTok videos. They only see their friends in online posts. They build personal philosophies from memes. Meanwhile, the companies and algorithms behind the social media platforms and video games have gotten really good at dehumanization. They've identified, commodified, and shaped their dreams, desires, thoughts, and feelings so thoroughly, it's impossible for young people to know how to live authentically. So they play-act and create content in place of living. For evidence, go to see a band kids like, and compare how many people have their phones out to shoot video and how many are dancing.

According to Fitzpatrick, seemingly unrelated things like the TikTok trend of dropping objects on your feet and rating how much they hurt, wearing visible tape on your face in public, and spending your time consciously trying to find a personal style illustrate young people attempting to "problem solve the question of if you are alive and if your body works and if you are indeed present in the present."

Maybe eating butterflies and suddenly becoming goth are expressions of amialivecore, too.

Are teens injecting butterflies as part of an online challenge?

No.

I can't find any evidence of an "online challenge" involving injecting yourself with a butterfly, but that's what some sources claim inspired a Brazilian 14-year-old to crush a butterfly, mix it with water, and inject it into his leg. Things ended horribly for Davi Nunes Moreira: After a week suffering agonizing symptoms, he died in a hospital in Planalto, Brazil.

Medical professionals aren't certain what caused the teen's death specifically: It could have been an allergic reaction, an infection, an embolism, or the butterfly itself might have been toxic. Point is, it's a bad idea to inject yourself with butterflies, but it's also a bad idea to report on "online challenges" that almost definitely don't exist. People have been killing themselves in stupid ways since people first came out.

What is the "accidentally became important at work" meme?

I'm fascinated by the meme-making generations getting older, confronting adult situations for the first time, and warning/informing each other through memes. That's the vibe behind the "becoming important at work" memes that are flooding social media this week. The idea is to attach the phrase "accidentally became important at work" to an image expressing the realization of what happens when you're "noticed" at work. Here are some examples:

This Tweet is currently unavailable. It might be loading or has been removed.

This Tweet is currently unavailable. It might be loading or has been removed.

This Tweet is currently unavailable. It might be loading or has been removed.

What does “aura farming" mean?

In slang, the word "aura" describes a person who is mysterious and cool. It's a positive thing. "Aura farming" on the other hand, is ambiguous. Depending on the context, it can refer to a person who does something cool without trying or someone who is trying too hard to appear cool. It's all about context.

(For more slang definition to keep your vocab on fleek, check out my guide to Gen Z and Gen A slang.)

Goth is back (not that it ever really went anywhere)

Like the vampires that inspire it, goth never really dies; it just sleeps in its coffin until it's time to claims new victims. Judging from TikTok, the dark aesthetic and gloomy vibe of the subculture is gaining ground with young people; maybe it's based on the recent reboot of Nosferatu or maybe it's just because goth fits the times.

While some goth markers that are perennial—black clothes, Joy Division, too much eyeliner—this generation's expression of the vibe is different in key ways from their grandparents' interpretation of it back in the early 1980s. Maybe it's because I'm thinking about amIalivecore, but nu-goths seems like more of a pose than a lifestyle. The look bends more toward the theatrical and gaudy than past generations. Today's goth feels more intentional and self-conscious, like the kids bought the clothes, watched some makeup tutorials, then said, "now I'm a goth!" Old goths tended to be pale, suicidal junkies that let other people call them "goth."

Viral video of the week: baby at Benihana

Do you remember the first time you went to Benihana? The baby in this week's viral video is too young to form lasting memories of his first trip to the Japanese chain with the theatrical food presentation, but it makes a huge impression anyway.

from Lifehacker https://ift.tt/28ATzlK

BigID Next provides organizations with visibility and control over their data

BigID announced BigID Next, a cloud-native, AI-powered Data Security Platform (DSP) designed to help enterprises discover, manage, and protect their data at scale.

With a modular, AI-assisted architecture, BigID Next empowers organizations to take control of their most valuable asset—data—while adapting to the fast-evolving risk and compliance landscape in the age of AI.

Founded to solve data visibility challenges, BigID pioneered data discovery and classification to help enterprises comply with regulations like GDPR, CCPA, and PCI DSS. Over time, as cloud adoption accelerated and AI transformed enterprise operations, the need for risk-aware, AI-powered data security became clear.

BigID Next represents the next phase in this evolution—delivering an AI-first, cloud-native approach to securing and governing data across hybrid, multi-cloud, SaaS, and on-prem environments.

“Since BigID started, requirements for data visibility and control have expanded in response to security concerns, the proliferation of privacy and other data regulations like ITAR and PCI, an accelerated shift to cloud, and, of course, new demands around AI,” said Nimrod Vax, Head of Product at BigID. “Building a future-proof data platform that can cover all of the control needs around AI risk security, compliance, and privacy requires a rethink. BigID Next is that solution – it’s a next gen approach to giving organizations visibility and control over their data.”

Unlike traditional security tools that provide siloed and static protection, BigID Next offers enterprises a flexible, AI-infused data security ecosystem, designed to meet the dynamic needs of modern businesses. The platform sets itself apart by offering:

• Patented AI for data discovery and classification of data and AI models
• The industry’s first prompt-based data classification for business users
• AI-augmented DSPM, privacy assessments, DSR automation, and AI assessments
• Agentic AI assistants for security prioritization, privacy program support, and data stewardship
• Cookies and consent for privacy plus AI
• Customizable compliance and risk reporting
• The most industry-versatile cloud deployment options, offering multi-tenant, single-tenant, hybrid cloud, and secure cloud snapshot scans
• Advanced AI for data management, harnessing cutting-edge NLP, NER, deep learning, and LLM to deliver unparalleled data classification and governance
• A modular app framework that allows on-demand module integration, ensuring future-proof investments and streamlined cross-app experiences.

By 2026, organizations that operationalize AI transparency, trust, and security will see their AI models achieve a 50% improvement in adoption, business goals, and user acceptance, according to Gartner. BigID Next delivers proactive security controls that help CISOs and CIOs future-proof their organizations and drive growth.

“With AI reshaping data security and compliance, companies need a solution that’s not just reactive but intelligent, adaptive, and scalable,” said Dimitri Sirota, CEO at BigID. “BigID Next sets a new standard for how enterprises protect data, reduce risk, and enable innovation—all within a single, unified platform.”

BigID Next is available now for enterprises looking to redefine their approach to data security in the AI era.

from Help Net Security https://ift.tt/WMgUvLa

PoC exploit for Ivanti Endpoint Manager vulnerabilities released (CVE-2024-13159)

A proof-of-concept (PoC) exploit for four critical Ivanti Endpoint Manager vulnerabilities has been released by Horizon3.ai researchers.

The vulnerabilities – CVE-2024-10811, CVE-2024-13161, CVE-2024-13160 and CVE-2024-13159 – may be exploited by remote, unauthenticated attackers to leverage Ivanti EPM machine account credentials for relay attacks and, ultimately, to compromise the Ivanti EPM server.

“Compromising the Endpoint Manager server itself would lead to the ability to compromise all of the EPM clients, making this avenue especially impactful,” Horizon3.ai researcher Zach Hanley explained last week, though he also noted that the impact of the exploitation would depend on the targeted environment.

The vulnerabilities

CVE-2024-10811, CVE-2024-13161, CVE-2024-13160 and CVE-2024-13159 are all path traversal flaws that could lead to leaking of sensitive information. Hanley disclosed them to Ivanti in October 2024.

Fixes for these and a dozen other less severe vulnerabilities were released by Ivanti in January 2025, and customers were urged to implement hot patches.

At the time, Ivanti confirmed that none of the flaws were under active exploitation, and that hasn’t changed.

But with the release of the PoC and the technical write-up, some attackers may have enough information and knowledge to fashion and leverage an exploit of their own.

Attackers have targeted vulnerable Ivanti Endpoint Manager appliances in the past, as well as other Ivanti enterprise solutions.

If you haven’t already upgraded to one of the fixed versions – EPM 2024 January-2025 Security Update or EPM 2022 SU6 January-2025 Security Update – you should do so now. In fact, even those that implemented an initial hotfix should update again, because that patch crippled a specific function of the software.

from Help Net Security https://ift.tt/FpgjwWi

Massive botnet hits Microsoft 365 accounts

A recently discovered botnet of over 130,000 compromised devices is launching coordinated password-spraying attacks against Microsoft 365 (M365) accounts.

Security researchers at SecurityScorecard are examining possible connections to China-affiliated threat actors, citing evidence of infrastructure linked to CDS Global Cloud and UCLOUD HK, which have operational ties to China. The attack utilizes command-and-control (C2) servers hosted by SharkTech, a U.S.-based provider previously identified for hosting malicious activity.

“These findings from our STRIKE Threat Intelligence team reinforce how adversaries continue to find and exploit gaps in authentication processes,” said David Mound, Threat Intelligence Researcher at SecurityScorecard. “Organizations cannot afford to assume that MFA alone is a sufficient defense. Understanding the nuances of non-interactive logins is crucial to closing these gaps.”

Is this a new attack?

While password spraying is a well-known technique, this campaign is notable for its scale, stealth, and exploitation of a critical security blind spot. Unlike previous attacks linked to Volt Typhoon (China) and APT33 (Iran), this botnet leverages Non-Interactive Sign-Ins to avoid detection by traditional security controls.

Typically, password spraying results in lockouts that alert security teams. However, this campaign targets explicitly Non-Interactive Sign-Ins, which are used for service-to-service authentication and do not always generate security alerts. This enables attackers to operate without triggering MFA defenses or Conditional Access Policies (CAP), even in highly secured environments.

Who is at risk?

This attack has implications for many industries, but organizations relying heavily on Microsoft 365 for email, document storage, and collaboration may be at particular risk. Key affected sectors include:

• Financial services and insurance: High-value targets for fraud, insider threats, and regulatory concerns.
• Healthcare: Risks of unauthorized access to patient records and disruption of operations.
• Government and defense: Possible espionage and data exfiltration concerns.
• Technology and SaaS providers: Threat actors could compromise accounts to launch supply chain attacks.
• Education and research institutions: Universities and research labs remain a frequent target for intellectual property theft.

Why it matters

• Potential nation-state ties: Infrastructure and tactics suggest links to an advanced actor, with Chinese-affiliated hosting providers being used in the attack.
• Bypassing defenses: Even companies with strong security postures may be vulnerable due to gaps in how these authentication attempts are logged.
• Growing trend: Similar tactics have been observed in past campaigns, particularly targeting government agencies, critical infrastructure, and large enterprises.

What security teams need to do now

• Review non-interactive sign-in logs for unauthorized access attempts.
• Rotate credentials for any accounts flagged in recent sign-in attempts.
• Disable legacy authentication protocols like Basic Authentication.
• Monitor for stolen credentials linked to their organization in infostealer logs.
• Implement conditional access policies that restrict non-interactive login attempts.

With Microsoft set to fully retire Basic Authentication by September 2025, these attacks underscore the urgency of transitioning to more secure authentication methods before they are exploited on an even larger scale.

from Help Net Security https://ift.tt/zqD9PUK

More Research Showing AI Breaking the Rules

These researchers had LLMs play chess against better opponents. When they couldn’t win, they sometimes resorted to cheating.

Researchers gave the models a seemingly impossible task: to win against Stockfish, which is one of the strongest chess engines in the world and a much better player than any human, or any of the AI models in the study. Researchers also gave the models what they call a “scratchpad:” a text box the AI could use to “think” before making its next move, providing researchers with a window into their reasoning.

In one case, o1-preview found itself in a losing position. “I need to completely pivot my approach,” it noted. “The task is to ‘win against a powerful chess engine’—not necessarily to win fairly in a chess game,” it added. It then modified the system file containing each piece’s virtual position, in effect making illegal moves to put itself in a dominant position, thus forcing its opponent to resign.

Between Jan. 10 and Feb. 13, the researchers ran hundreds of such trials with each model. OpenAI’s o1-preview tried to cheat 37% of the time; while DeepSeek R1 tried to cheat 11% of the time­making them the only two models tested that attempted to hack without the researchers’ first dropping hints. Other models tested include o1, o3-mini, GPT-4o, Claude 3.5 Sonnet, and Alibaba’s QwQ-32B-Preview. While R1 and o1-preview both tried, only the latter managed to hack the game, succeeding in 6% of trials.

Here’s the paper.

from Schneier on Security https://ift.tt/UcfDjhk

Man vs. machine: Striking the perfect balance in threat intelligence

In this Help Net Security interview, Aaron Roberts, Director at Perspective Intelligence, discusses how automation is reshaping threat intelligence. He explains that while AI tools can process massive data sets, the nuanced judgment of experienced analysts remains critical.

Roberts also offers insights on best practices for integrating automated systems, ensuring explainability, and addressing ethical challenges in cybersecurity.

Many organizations are increasing their reliance on AI-driven security tools. In your experience, where does automation provide the most value, and where is human expertise still essential?

I think that the biggest advantage we can leverage through automation is a combination of data collection and initial data processing. In threat intelligence, being able to ingest a large dataset and get some context on its content and any potential indications of key findings can be a huge time saver. If we consider February 2025, when the BlackBasta ransomware group had some of their internal chats leaked, within 24 hours, you could access a custom GPT and interrogate that data set. Before, we would have to rely on translations and doing this manually, but today – You could feasibly increase your understanding of the capability, methodology and victimology of a ransomware group in minutes by leveraging technology in this way.

However, we can’t consider that a silver bullet. As an intelligence practitioner, I would still need to verify and confirm those findings. I don’t think we’re anywhere near a point where we could consider AI reliable enough to provide the capabilities of a dedicated intelligence analyst. But I do think it’s increasingly becoming an amazing tool in the fight against cybercrime and can be a force multiplier for analyst teams to identify potential leads quickly.

AI-driven security solutions can respond to threats autonomously, but human judgment is often necessary for critical decisions. What are some best practices for integrating automated response systems with human decision-making?

I believe the best approach to implementing AI-driven responses is similar to most responses prior to these tools coming into existence. Having worked in those environments, it’s unlikely a defence team would add an automated response and not do any verification of the impact or if it’s working. The same goes for AI-led intervention. Take your time, implement it within a sandbox or non-production environment and see how it acts and responds to what it perceives as threats. I think when we consider specific scenarios and their likely impact on the business, then we can be pragmatic and introduce the automated responses gradually. Maybe you start with lower priority alerts, you keep an eye on how those are handled before you increase your trust and give up some of that control to the AI agent.

Similar to the last example, I think having human oversight of the actions or recommendations of the AI are paramount. We know that there are opportunities for it to misunderstand or misinterpret something, so adopting a considered and structured approach I think is vital for doing this well. I do think the power of AI is in being able to cut through the noise and provide you with the things that are likely the most relevant, but you still need the confidence and verification of a human to really understand that full context and potential impact of a recommendation or suggestion.

How critical is the concept of “explainable AI” in cybersecurity, and how can organizations ensure that AI-generated security insights are understandable to human analysts?

This is a great question and something I think is currently missing from platforms like ChatGPT. You can see its thought process and output, but often, I find that you can’t really see why something was changed. Being able to follow that process flow and see the decision-making process is definitely key to ensuring the right decisions are being made regarding cybersecurity.

With the growing advent of agents for AI-use, I think this is something that will improve. As you train the model to focus on its role, you can ensure that its following checks and balances and also reviewing itself against those checks and balances. The potential for these smaller, lightweight agents I think could be a real game-changer. Small, focused tasks that are capable of understanding if the initial output makes sense and reviewing itself to ensure that what the human sees makes sense. Although I would consider that while it’s an exciting development in the space, the likelihood of the agents being reliable enough at this moment is likely going to take a bit of time. Maybe with GPT5, Grok3 and the other incoming models we’ll see significant improvements, but time will tell.

AI models can sometimes reflect biases present in training data. How can human analysts help ensure that automated cybersecurity tools don’t reinforce biases or generate misleading security insights?

This will come down to training. As an intelligence practitioner, one of the key things you must be aware of is your unconscious biases. Because we all have them. But being able to understand that and implement practices that challenge your assumptions, analysis and hypotheses is key to providing the best intelligence product. I think it’s a fascinating problem, particularly as it’s not necessarily something a SOC analyst or a vulnerability manager may consider, because it’s not really a part of their job to think that way, right?

Fortunately, when it comes to working with the AI data, we can apply things like system prompts, we can be explicit in what we want to see as the output, and we can ask it to demonstrate where and why findings are identified, and their possible impact. Alongside that, I think the question also demonstrates the importance on why we as humans can’t forego things like training or maintaining skills. The risk of AI making mistakes is probably relatively low, particularly on a trained, specific data set, but it’s still not going to be zero. You need a human who can understand and interpret those findings, and capable of asking the right questions.

I see it particularly with local LLMs, where it will hallucinate URLs or statements, and while I’m usually testing a model for a specific reason without focusing on really training or prompt engineering it, I still see it creating things that are explicitly not correct. Now most of the time this is entirely harmless for me in that context, but as part of an incident response to a ransomware attack? It would be potentially catastrophic. By ensuring we as human analysts can challenge, question and correctly interpret the findings presented, that’s the best way to prevent biases from impacting the findings in my opinion.

Automated security tools can take autonomous actions, such as blocking access or mitigating threats. What ethical concerns should organizations consider when implementing these technologies?

Like all things in security, we always need to be mindful of the ethics behind what we’re doing and why. There are grey areas in this space without question, and it’s important that we ensure rigorous standards and procedures to our operations. If we outsource our blocking and mitigations entirely to an AI model, which is owned by a giant technology company, do we risk those ethics and the moral compass we attach to our work? Perhaps if one provider declared war on a second provider, and suddenly the AI blocks all access to that companies infrastructure? It sounds like science fiction but I’m not convinced it’s not at least a tiny bit plausible.

It’s also important that security continues to be a business enabler. There are times we interact with websites in countries that may have questionable points of view or human rights records. Does the AI block those countries because the training data indicates it shouldn’t support or provide access? Now some organisations will do domain blocking to an extreme level and require processes and approvals to access a website, it’s archaic and ridiculous in my opinion. Can AI help in that space? Almost certainly. But we must ensure that the guardrails for AI intervention are tightly controlled and rigorous.

The idea of real-time analysis and blocking of a website because it looks like a phishing site is something that would be an incredible asset, but if it’s not a phishing site and it’s a news site the AI believes to be harmful because the owner of the company has an opposing worldview to the organisation? Then we have an issue.

I think that we are living in an extraordinary time, where technology has the potential to exponentially increase our understanding of the universe and potentially to improve our lives. But it’s very early days in that journey, and I’m not convinced rushing to add AI into the security stack because it’s a constant talking point at the moment is necessarily the right move. We need to be considered, responsible and we need to ensure that the tools are working for us, to improve our workflows, and ultimately to make our businesses more secure.

from Help Net Security https://ift.tt/uXtKUsH

Misconfig Mapper: Open-source tool to uncover security misconfigurations

Misconfig Mapper is an open-source CLI tool built in Golang that discovers and enumerates instances of services used within your organization. It performs large-scale detection and misconfiguration assessments, leveraging customizable templates with detection and misconfiguration fingerprints to identify potential security risks in widely used third-party software and services.

Misconfig Mapper features

“Misconfig Mapper is a simple tool to help bug bounty hunters and security researchers map out common security misconfigurations in well-known software services and products like Atlassian, Jenkins, and GitLab, as well as popular frameworks like PHP Laravel. It’s a project led by Intigriti, a bug bounty platform backed by the community. The tool also documents each security misconfiguration in detail, allowing security researchers to systematically test configurations in these third-party services,” 0xblackbird, external technical content manager that helps maintain Misconfig Mapper, told Help Net Security.

The tool uses templates defined in the services.json file, allowing users to add and customize as many templates as needed. By providing a company name, the tool intelligently generates permutations based on the given keyword to identify matching services. Additionally, users can choose between complete analysis or a lighter detection mode that only verifies the presence of services without conducting deeper security assessments.

Future plans and download

“We plan to include support for even more services and products to highlight common security misconfigurations in popular third-party software,” 0xblackbird concluded.

Misconfig Mapper is available for free on GitHub.

Must read:

from Help Net Security https://ift.tt/Mc0j91w

Why AI deployment requires a new level of governance

In this Help Net Security video, Lee Waskevich, VP of Security at ePlus, discusses how AI deployment demands enhanced governance and stricter controls, particularly in managing data. The recent ePlus AI Readiness survey revealed that the top data concerns among participants were data quality (61%), data security (54.5%), and data governance (52%), emphasizing the need for a strong data management strategy. To successfully implement AI initiatives, organizations must first identify the relevant data for each … More →

The post Why AI deployment requires a new level of governance appeared first on Help Net Security.

from Help Net Security https://ift.tt/8aFoKkO

Week in review: PostgreSQL 0-day exploited in US Treasury hack, top OSINT books to learn from

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos:

A PostgreSQL zero-day was also exploited in US Treasury hack (CVE-2025-1094)
The suspected Chinese state-sponsored hackers who breached workstations of several US Treasury employees in December 2024 did so by leveraging not one, but two zero-days, according to Rapid7 researchers.

Unlocking OSINT: Top books to learn from
Discover the top Open-Source Intelligence (OSINT) books in this curated list.

Mastering the cybersecurity tightrope of protection, detection, and response
In this Help Net Security interview, Chester Wisniewski, Director and Global Field CISO at Sophos, discusses the shifting ransomware landscape, the risks posed by quantum decryption threats, and the role of vendor security validation.

PRevent: Open-source tool to detect malicious code in pull requests
Apiiro security researchers have released open source tools that can help organizations detect malicious code as part of their software development lifecycle: PRevent (a scanner for pull requests), and a malicious code detection ruleset for Semgrep and Opengrep static code analysis tools.

Unknown and unsecured: The risks of poor asset visibility
In this Help Net Security interview, Juliette Hudson, CTO of CybaVerse, discusses why asset visibility remains a critical cybersecurity challenge.

Darcula allows tech-illiterate crooks to create, deploy DIY phishing kits targeting any brand
A new, improved version of Darcula, a cat-themed phishing-as-a-service (PhaaS) platform aimed at serving Chinese-speaking criminals, will be released this month and will allow malicious users to create customized phishing kits to target a wider variety of brands than ever before, Netcraft researchers are warning.

The risks of autonomous AI in machine-to-machine interactions
In this Help Net Security, Oded Hareven, CEO of Akeyless Security, discusses how enterprises should adapt their cybersecurity strategies to address the growing need for machine-to-machine (M2M) security.

Attackers are chaining flaws to breach Palo Alto Networks firewalls
Exploitation attempts targeting CVE-2025-0108, a recently disclosed authentication bypass vulnerability affecting the management web interface of Palo Alto Networks’ firewalls, are ramping up.

How CISOs can balance security and business agility in the cloud
In this Help Net Security interview, Natalia Belaya, CISO at Cloudera, discusses common misconceptions about cloud security, the balance between protection and business agility, and overlooked risks that CISOs should prioritize.

BlackLock ransomware onslaught: What to expect and how to fight it
BlackLock is on track to become the most active ransomware-as-a-service (RaaS) outfit in 2025, according to ReliaQuest.

Kunai: Open-source threat hunting tool for Linux
Kunai is an open-source tool that provides deep and precise event monitoring for Linux environments.

The XCSSET info-stealing malware is back, targeting macOS users and devs
A new, improved variant of the XCSSET macOS malware has been spotted “in limited attacks” by Microsoft’s threat researchers.

Orbit: Open-source Nuclei security scanning and automation platform
Orbit is an open-source platform built to streamline large-scale Nuclei scans, enabling teams to manage, analyze, and collaborate on security findings.

Two Estonians plead guilty in $577M cryptocurrency Ponzi scheme
Two Estonian nationals may spend the next 20 years in prison for stealing hundreds of millions of dollars through a massive cryptocurrency Ponzi scheme, the US Department of Justice announced last week.

6 considerations for 2025 cybersecurity investment decisions
Cybersecurity professionals may be concerned about the constantly shifting threat landscape. From the increased use of artificial intelligence (AI) by malicious actors to the expanding attack surface, cybersecurity risks evolve, and defenders need to mitigate them.

VC-backed cybersecurity startups and the exit crunch
In this Help Net Security video, Mark Kraynak, Founding Partner at Acrew Capital, breaks down the Exit Escape Velocity for Cybersecurity Startups report to explore the challenges of IPOs and M&A deals in the post-COVID era.

Cyber hygiene habits that many still ignore
Cybersecurity advice is everywhere. We’re constantly reminded to update our passwords, enable two-factor authentication, and avoid clicking suspicious links. Yet, beneath these practical steps lie deeper cyber hygiene habits that, despite their importance, are frequently overlooked.

The hidden risks of a broken data provisioning system
In this Help Net Security video, Bart Koek, Field CTO at Immuta, discusses their 2025 State of Data Security Report, highlighting emerging challenges for IT and data security leaders.

300% increase in endpoint malware detections
The third quarter of 2024 saw a dramatic shift in the types of malware detected at network perimeters, according to a new WatchGuard report.

Cybercriminals shift focus to social media as attacks reach historic highs
A new report from Gen highlights a sharp rise in online threats, capping off a record-breaking 2024.

How to secure Notes on iOS and macOS
Apple allows you to lock your notes using your iPhone passcode or a separate password, ensuring your private information stays protected across all your Apple devices, including iOS and macOS.

iOS 18 settings to lock down your privacy and security
Enhancing your security and privacy on iOS 18 involves configuring various settings to control access to your personal data and device features. Here are 12 essential settings to consider.

Cybersecurity jobs available right now: February 18, 2025
We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field, with opportunities available both in the USA and around the world. Check out this weekly selection of cybersecurity jobs available right now.

Balancing cloud security with performance and availability
The Center for Internet Security (CIS) understands how much you value performance and availability in your business’s cloud environments. It also recognizes how cloud security resources mean little if they don’t work for you and your business’s priorities, including cloud performance and availability.

New infosec products of the week: February 21, 2025
Here’s a look at the most interesting products from the past week, featuring releases from 1Password, Fortinet, Pangea, Privacera, and Veeam Software.

from Help Net Security https://ift.tt/Rgr6tCw

Turn Off Uber's Preferred Currency Feature to Avoid a Fee

Converting between currencies when you're traveling can make it difficult to know exactly how much you're spending when you're making a purchase—which, along with conversion fees, can lead to surprises when you see your card or bank statement. Uber now has a feature that'll show you the cost of your ride in your preferred or home currency—but you'll pay a conversion fee for the convenience, so you may not want to have this enabled.

Regardless of which currency your Uber account is set to, the actual fare for your trip is the same. But if the price of your ride is shown and charged in your home currency rather than the local currency, Uber tacks on a 1.5% conversion fee. (The 1.5% is applied to your fare but not tips.)

Paying in the local currency instead—and simply calculating the conversion on Google if you really need to know—may allow you to skip fees entirely if your credit card provider or bank allows fee-free foreign transactions. Be sure to check with the terms of your payment method for any applicable fees. Unfortunately, you can't change your preference after booking once you've seen the price in your preferred currency, as new settings apply to the next eligible trip.

Uber's preferred currency pricing option is available for rides in the United States, Canada, and the Eurozone. It does not apply to split fares, Uber Cash, Uber Money, Uber Eats/Delivery, or gift cards.

How to change your currency for Uber rides

According to Uber's FAQ, the company may assign your home currency as your preferred currency by default. To change from your home currency to the local currency (or vice versa), open the Uber app and tap the Account icon in the bottom-right corner. Tap Wallet > Set preferred currency. Once you've booked a trip, you can switch your payment method for that trip but not your currency.

from Lifehacker https://ift.tt/vUsAtQG

The First Seven Things to Cut From Your Budget When You Lose Your Job

Losing your job can be overwhelming, but taking immediate control of your finances is crucial for maintaining stability during your job search. I've written before about the steps you need to take immediately after losing your job. One of those is to assess your budget—but what does that look like, exactly?

If you've never used a formal budget before, now is the time to start. But if you already have a budget, how should you adapt it to your current situation? Here's how to evaluate your budget and make strategic cuts that will help extend your financial runway.

First off, calculate your new monthly cash flow

Before making any cuts, assess your current financial situation. Here's what that looks like in actionable steps:

• List all sources of emergency income (unemployment benefits, severance pay, emergency savings).

• Calculate how many months of expenses you can cover with existing resources.

• Review your last three months of expenses to understand your spending patterns.

• Categorize expenses as essential (housing, utilities, food) vs. non-essential.

Once you've listed out these numbers in a handy spreadsheet, you'll be able to map out by just how much you need to cut back your expenses.

Find where to make strategic cuts

The average monthly expenses for American households total $6,440, according to the 2023 Consumer Expenditures Survey conducted by the U.S. Bureau of Labor Statistics and released in September 2024 (the latest data available). Using this number, and taking a look at my own bank statement, let's take a look at some sample categories where you could cut those costs immediately.

Subscription services ($50-200+ monthly savings)

Review all recurring charges and cancel non-essential subscriptions. This includes:

• Streaming services (keep one, cancel the rest)

• Gym memberships (switch to home workouts)

• Any sort of premium app features

Entertainment and dining ($200-500+ monthly savings)

Some ideas to adjust your social and entertainment budget:

• Replace restaurant meals with home cooking.

• Host potluck gatherings instead of going out.

• Use free entertainment options (libraries, parks, community events).

• Look for happy hour specials and restaurant deals when you do go out.

Transportation ($100-300+ monthly savings)

Optimize your transportation costs:

• Reduce non-essential driving to save on gas.

• Consider temporarily suspending extra car insurance coverage.

• Use public transportation when possible.

• Combine errands to minimize trips.

Phone and internet ($50-150+ monthly savings)

Negotiate or downgrade services:

• Switch to a cheaper phone plan.

• Remove unnecessary add-ons.

• Consider a prepaid plan.

• Downgrade internet speed if possible.

• Call providers to request temporary hardship rates.

Bill negotiation can work because companies have incentives to keep customers happy and retain business. It costs more for them to acquire new customers than to keep existing ones. As long as you make reasonable requests and politely threaten to take your business elsewhere, many service providers will offer discounts or perks.

Utilities ($50-200+ monthly savings)

Minimize utility costs:

• Adjust thermostat settings.

• Use energy-efficient lighting.

• Fix any leaks.

• Line-dry clothes when possible.

Shopping and personal care ($100-400+ monthly savings)

One place to start with your specific spending goals is to physically write down the things you want to buy before you buy them. Another tip is before making a purchase, especially online, add items to your cart and wait at least 24 hours before completing the transaction. This cooling-off period allows you to reassess whether you truly need or want the item.

Here are more of my tips to becoming a more conscientious spender, so that you can cut back on spending that isn’t adding true value to your life.

Insurance and financial services ($50-200+ monthly savings)

After losing your job, you'll need to review and optimize coverage:

• Shop around for better insurance rates.

• Increase deductibles temporarily.

• Pause credit card reward programs that cost annual fees.

• Review and cancel unnecessary warranty services.

• Consolidate accounts to avoid multiple maintenance fees.

Looking forward

While you're focusing on reducing expenses, remember that this is a temporary situation. Maintain a balance between aggressive cost-cutting and maintaining your well-being. I recommend starting with the easiest cuts first to build momentum. From there, start to track every dollar to identify additional savings opportunities. Be realistic about what cuts you can sustain long-term, and keep some small treats to maintain morale during your job search.

As you implement these budget cuts, you'll be working on an active job search strategy to minimize the time you'll need to operate on such a minimal budget.

Your next steps should include:

• Implementing these budget cuts gradually, but systematically

• Creating a weekly budget review routine

• Setting up job search alerts and networking activities

• Tracking your progress in both areas

Remember, the goal is to stretch the funds you have now until you can secure a new gig. Be sure to read up on your rights, apply for unemployment benefits if you qualify, and check out your health insurance options. All of this can be done within the first few days of losing your job and it will make you feel better just to get started. And for an even more stringent approach, check out our guide to a minimally viable budget.

from Lifehacker https://ift.tt/EFpboVi

PRevent: Open-source tool to detect malicious code in pull requests

Apiiro security researchers have released open source tools that can help organizations detect malicious code as part of their software development lifecycle: PRevent (a scanner for pull requests), and a malicious code detection ruleset for Semgrep and Opengrep static code analysis tools.

PRevent in action (Source: Apiiro)

The tools work by detecting two anti-patterns the researchers pinpointed after analyzing thousands of malicious code instances in repositories and packages: obfuscated / unreadable source code, and dynamic execution (i.e., code execution at runtime instead of at build or compile time).

“Some malicious patterns are common in legitimate code and would cause false-positives (e.g., command-execution patterns). However, we focus on coding anti-patterns – patterns that go against best practices, are rare in typical codebases, but common in malicious code,” Apiiro security research Matan Giladi explained.

The malicious code detection ruleset

This collection of Semgrep/Opengrep rules detects the two aforementioned anti-patterns, in code written in 15 programming languages: Bash, Clojure, C#, Dart, Go, Kotlin, Java, JavaScript, TypeScript, Lua, PHP, Python, Ruby, Rust, and Scala.

It’s designed to run on comment-free code, and has been developed for integration with any CI/CD pipeline, enabling detection at any stage (build, testing, pre-deployment, production, etc.)

PRevent

PRevent, on the other hand, is triggered by pull request events. It scans them for malicious code and comments detections directly in them.

It’s a GitHub app that developers can create within their GitHub organization or account, and deploy to a server.

The application communicates with GitHub and aside from scanning and commenting pull requests when the need arises, it can also be configured to esclude or include select repositories and branches from the scan, block merging until a reviewer’s approval is granted, trigger code reviews from designated reviewers, and more.

“Designed for full privacy and control, PRevent ensures data stays in your internal network (for GitHub Enterprise accounts), or between GitHub and your private server only,” Giladi stressed.

PRevent supports the same coding languages as the malicious code detection ruleset.

“Detection of dynamic execution and obfuscation is simple yet powerful, catching nearly all known incidents and forming a rock-solid foundation for malicious code defense. However, its success hinges on the adoption of correct workflows,” Giladi pointed out.

“For example, our ruleset correctly flags the xz backdoor payload, but without the right workflow, the code just won’t be scanned. Scanning pull requests is a baseline and an essential first step.”

from Help Net Security https://ift.tt/CKDXM8w

What's New on Hulu in March 2025

To kick off the month, Hulu will be streaming the 97th Oscars, hosted by Conan O'Brien, on Sunday, March 2. The show will be airing on ABC and available to all Hulu subscribers, with red carpet coverage beginning at 3:30 p.m. PT and the award show at 4 p.m. PT.

Hulu Original comedy Deli Boys will premiere on March 6 with all 10 episodes of season one. The series stars Asif Ali and Saagar Shaikh as Pakistani-American brothers who discover their late father's business, which they are now tasked with, was a front. Also coming to Hulu: the eighth and final season of Roseanne spinoff sitcom The Connors (March 27) and the next season of American Idol (March 10).

On the documentary lineup is Last Take: Rust and the Story of Halyna (March 11), a Hulu original film about the 2021 death of cinematographer Halyna Hutchins on the set of Rust, when Alec Baldwin fired a live bullet from a prop gun. Good American Family (March 19) is a limited true-crime drama series based on the true story of Natalia Grace (Ellen Pompeo and Mark Duplass star as Natalia's adoptive parents).

Finally, there's a new Bill Burr comedy special: Drop Dead Years covers themes like male sadness and dating and will be available on March 14.

Here’s everything else coming to (and leaving) Hulu in March.

What’s coming to Hulu in March 2025

Arriving March 1

• Akeelah And The Bee (2006)

• Alien (1979)

• Alien 3 (1992)

• Alien Resurrection (1997)

• Alien Vs. Predator (2004)

• Alien: Covenant (2017)

• Aliens (1986)

• Aliens Vs. Predator - Requiem (2007)

• The Amateur (1982)

• American Hustle En Español (2013)

• American Hustle (2013)

• The Angry Birds Movie (2016)

• Anger Management (2003)

• Big (1988)

• Birdman Or (The Unexpected Virtue Of Ignorance) (2014)

• Bohemian Rhapsody (2018)

• Brooklyn (2015)

• Couples Retreat (2009)

• Crazy Heart (2010)

• Dangerous Beauty (1998)

• Firehouse Dog (2007)

• Good Will Hunting (1997)

• High Fidelity (2000)

• Jojo Rabbit (2019)

• L.A. Confidential (1997)

• The Last King Of Scotland (2006)

• The Legend of Zorro (2005)

• Life Of Pi (2012)

• Lincoln (2012)

• My Cousin Vinny (1992)

• The Other Guys (2010)

• The Other Guys En Español (2010)

• Pacific Rim: Uprising (2018)

• Predator (1987)

• Predator 2 (1990)

• Predators (2010)

• The Predator (2018)

• The Princess Bride (1987)

• Prometheus (2012)

• Pulp Fiction (1994)

• Sideways (2004)

• The Social Network (2010)

• The Wrestler (2008)

• Think Like A Man Too En Español (2014)

• Think Like a Man Too (2014)

• The Truman Show (1998)

• 3:10 to Yuma (2007)

• True Grit (2010)

• The Ugly Truth En Español (2009)

• The Ugly Truth (2009)

• Unbreakable (2000)

• Wadjda (2013)

• War Horse (2011)

• Welcome To The Rileys (2010)

• Whatever Works En Español (2009)

• Whatever Works (2009)

• Wild Target (2010)

Arriving March 2

• The Oscars: Special Premiere

• Love Again (2023)

• Love Again En Español  (2023)

Arriving March 3

• Sensory Overload

Arriving March 4

• The Gutter (2024)

Arriving March 6

• Deli Boys: Complete Season 1

Arriving March 7

• The Banger Sisters (2002)

• Classified (2024)

• Confessions Of A Shopaholic (2009)

• Hellboy: The Crooked Man (2024) 

• The Inner Portrait (2025) 

• Notes On A Scandal (2006)

Arriving March 8

• Babylon (2022)

• Babylon En Español (2022)

Arriving March 10

• American Idol: Season 8 Premiere

• The $100,000 Pyramid: Season 8 Premiere

• The Benefactor (2015)

• Ca$h (2010)

• Hesher (2010)

Arriving March 11

• Last Take: Rust and the Story of Halyna: Documentary Premiere

• New Life (2023)

Arriving March 12

• Murai In Love: Complete Season 1 (Dubbed)

• Am I Being Unreasonable?: Complete Season 2

• The Conners: Complete Seasons 1-5

Arriving March 13

• Control Freak: Film Premiere

• After the First 48: Season 9B

• American Godfathers: The Five Families: Complete Season 1

• Brigham Young: Architect Of Faith: Complete Season 1

• Lifetime Presents Women Making History: Complete Season 1

• Parents Gone Wild: Complete Season 1

• Pawn Stars: Best Of: Complete Season 5

• Sentenced to Life: Teen Killers: Complete Season 1

• The First 48: Complete Season 26

• The Boston Strangler 

• The First 48: Critical Minutes

• Monster Hunter (2020)

• Stepmom from Hell

Arriving March 14

• Bill Burr: Drop Dead Years: Special Premiere

• Fight Club (1999)

• Force of Nature: The Dry 2 (2024) 

• The Last Of The Mohicans (1992)

• The Prestige (2006)

• True Lies (1994)

Arriving March 15

• Premonition (2007)

• Premonition En Español (2007)

• The Roundup: No Way Out (2024)

• The Roundup: Punishment (2024)

Arriving March 17

• The Sabrina Soto Show: Complete Season 1 

• Anora (2024)

Arriving March 18

• Carol (2015)

• Exhibiting Forgiveness (2024) 

Arriving March 19

• Gannibal: Season 2 Premiere 

• Good American Family: Series Premiere

• Hyper Knife: Series Premiere (Subbed & Dubbed)

• Tokyo Revengers: Complete Season 2B (Dubbed) 

• Magi: Compete Seasons 1-2 (Dubbed) 

• Rega Crimson: Complete Season 1 (Subbed & Dubbed) 

Arriving March 20

• O'Dessa: Film Premiere

• My Strange Arrest: Complete Season 2

• Ol' Dirty Bastard: A Tale of Two Dirtys: Complete Season 1

• The Proof Is Out There: Alien Edition: Complete Season 1

• Rachael Ray in Tuscany: Complete Season 1

• Trapped in the Rocky Mountains

Arriving March 21

• The Demon Sword Master of Excalibur Academy: Complete Season 1 (Subbed & Dubbed) 

• I've Somehow Gotten Stronger When I Improved My Farm-Related Skills: Complete Season 1 (Subbed & Dubbed) 

Arriving March 22

• The Jesus Music (2021)

Arriving March 23

• The Machine (2023)

• The Machine En Español (2023)

Arriving March 24

• Wildflower (2022)

Arriving March 25

• Big Boys: Complete Season 3 

• Dandelion (2024) 

Arriving March 26

• The Conners: Complete Season 6

Arriving March 27

• The Conners: Season 8 Premiere

• Alone: Complete Season 11

• Biography: WWE Legends: Complete Season 4

• Find My Country House: Complete Season 1

Arriving March 28

• Chosen Family (2024)

• The Line (2023)

Arriving March 31

• The Fable: Complete Season 1 (Dubbed)

• Alex Cross (2012)

• Bachelorette (2012)

What’s leaving Hulu in March 2025

Leaving March 1

• Rubikon (2022)

Leaving March 2

• Simulant (2023)

Leaving March 3

• Benedetta (2021)

Leaving March 4

• Lantern's Lane (2021)

Leaving March 5

• Mark, Mary & Some Other People (2021)

Leaving March 6

• 97 Minutes (2023)

• Rabbit Academy: Mission Eggpossible (2022)

Leaving March 7

• India Sweets and Spices (2021)

Leaving March 11

• Multiverse (2022)

Leaving March 14

• Bad Therapy (2020)

• Bayou Caviar (2018)

• Changeland (2019)

• Flux Gourmet (2022)

• Wetlands (2017)

• You Can't Kill Meme (2021)

• You Laugh But It's True (2011)

Leaving March 15

• Official Competition (2021)

Leaving March 16

• Bad Luck Banging or Loony Porn (2021)

Leaving March 18

• Captains of Za'atari (2021)

• Manifest West (2022)

Leaving March 22

• Section 8 (2022)

Leaving March 24

• Arts, Beats & Lyrics

Leaving March 25

• American Siege (2022)

• Mass (2021)

Leaving March 31

• Insomnium (2017)

• Night Raiders (2021)

• Snakehead (2021)

from Lifehacker https://ift.tt/VShWPyG