Eslam Salem

The Shai-Hulud 2.0 npm worm: analysis, and what you need to know | Datadog Security Labs Learn more about the Shai-Hulud 2.0 npm worm.

It was an interesting 72 hours tracking down the second wave of Shai Hulud campaign. It's more sophisticated and aggressive than the first one. We published all what we know about it here securitylabs.datadoghq.com/articles/sha... #npm #shaihulud #malware

MUT-4831: Trojanized npm packages deliver Vidar infostealer malware | Datadog Security Labs Analysis of a threat actor campaign targeting Windows users with Vidar infostealer malware via malicious npm packages

Our team tracked down a malicious campaign in NPM deploying Vidar stealer. This is the first time we see Vidar stealer distributed via supply chain attack.
securitylabs.datadoghq.com/articles/mut...
#npm #malware #supplychainattack

I still didn't install bat yet but looks very good. I will do it now.

I'm in love with claude code. The way it handles code writing and automates bash tasks is amazing and so convenient to me.
if you are an experienced developer, know what you are doing, the tasks that usually take Weeks. You will be able to do it in Hours 🤯🤯 #claudecode #ai

Q for developers. Do you love/hate mandatory security training? And why?
#security #training #developers

The obfuscation game: MUT-9332 targets Solidity developers via malicious VS Code extensions | Datadog Security Labs Analysis of a threat actor campaign targeting Solidity developers via three malicious VS Code extensions

🚨 The obfuscation game: MUT-9332 targets Solidity developers via malicious VS Code extensions!

Deep dive analysis in this obfuscated campaign including (PowerShell & VBS scripts, PE malware, Malicious browser extensions even stegomalware)

Enjoy reading securitylabs.datadoghq.com/articles/mut...

Pretty interesting threat campaign have been discovered by our research team.
We will be disclosing it in couple of hours , stay tuned 😉
#threats #malicious #security_research #datadog

Recognizing employees for a job well done is just as important as giving constructive feedback when they underperform. Balance builds growth. #Leadership #Feedback

I don't like threat actors attribution that much because in most cases it's wrong and so easily to be forged. We still should cluster campaigns but there is no "high confidence" attribution IMHO.

How I Used AI to Create a Working Exploit for CVE-2025-32433 Before Public PoCs Existed A step-by-step walkthrough of how I leveraged AI to analyze, understand, and exploit the Erlang SSH pre-authentication vulnerability (CVE-2025-32433) without any existing public proof of concept. Lear...

Nice work for using AI to create POC by analysis the patch diff

platformsecurity.com/blog/CVE-202...

I have been told there will be a special announcement at 10am CET (that's 4am EDT btw) regarding this.

I will release the info I have at that time also. Thank you for the support.

Any idea what will happen to the CVE program after MITRE
x.com/0xTib3rius/s...

Picture of the tutorial room in Kubecon eu 2025

It’s the tutorial room at #kubecon where we’ll be hacking up a storm in just over 30 minutes!

Interesting to see secret leaks in git still one the biggest threats in SDLC.
github.blog/security/app...

I think it's time for me to start digging into AI and LLMs. I'm not sure where to start, any advice?

Seeing phrack magazine brings so much good memories. Good old days.

It's amazing how important one Phrack article from 27 years ago has been for web application security.

Covering what we now call SQL Injection and SSRF (amongst other things) problems we're still trying to handle today laid out in a couple of paragraphs

phrack.org/issues/54/8#...

Understanding CVE-2025-29927: The Next.js Middleware Authorization Bypass Vulnerability | Datadog Security Labs Learn how the Next.js middleware authorization bypass vulnerability works, and how to detect and remediate it.

This time we analyzed the Next.js middleware bypass vulnerability (CVE-2025-29927). Also included IP/UA trying to exploit this in the wild.
securitylabs.datadoghq.com/articles/nex...

The Learn how the Kubernetes Ingress NGINX Controller vulnerabilities work, how to detect and remediate them.

Our analysis and takeaways for IngressNightmare - Several vulnerabilities in the Kubernetes Ingress NGINX Controller. Enjoy!
securitylabs.datadoghq.com/articles/ing...

I love it when some people tells me that's is your limit, this is your ceiling. This is when I feel fire within me reignite!

YouTube video by AWS Events AWS re:Invent 2024 - Beyond just observing, protecting your whole software supply chain (SEC406)

Amazing presentation about supply chain security and the amazing work we do by our leaders @techy.detectionengineering.net
(Director of research) and Andrewkrug (Manager of advocacy) youtu.be/1b0RIi19qrw?...

Supply chain firewall in action
github.com/DataDog/supp...

Introducing Supply-Chain Firewall: Protecting Developers from Malicious Open Source Packages | Datadog Security Labs Release of Supply-Chain Firewall, an open source tool for preventing the installation of malicious PyPI and npm packages

We are happy to introduce our latest tool "Supply Chain Firewall" 🎉 by @ikretz.bsky.social
The tool detects & prevents installation of malicious packages in local development environment.

Read more
securitylabs.datadoghq.com/articles/int...

And give it a try github.com/DataDog/supp...

Supply-chain attack in the ultralytics PyPI package: github.com/ultralytics/...

An attacker opened a pull request and pushed a commit with a malicious name, leading to CI code injection.

They then backdoored versions 8.3.41 and 8.3.42 with code downloading a second-stage binary from GitHub

FBI Warns iPhone And Android Users—Stop Sending Texts US officials urge citizens to use encrypted messaging and calls wherever they can—here’s what you need to know.

Common reasoning is that SMS 2FA is bad due to the risk of SIM swapping. It’s also bad if the telecommunications networks are hostile 😬
www.forbes.com/sites/zakdof...

Awesome, Stratus Red Team v2.20.0 is now available 🎉

My Blackhat MEA arsenal presentation: "Detect Malicious Packages with Guarddog"
drive.google.com/file/d/11SAN...

Looks good, I will give it a try this weekend

We released Censeye today, an open source CLI tool that makes it dramatically easier to pivot and find related assets when threat hunting on Censys instead of manually checking for potential identifying characteristics like an SSH host key. github.com/Censys-Resea...

GitHub - stripe/smokescreen: A simple HTTP proxy that fogs over naughty URLs A simple HTTP proxy that fogs over naughty URLs - GitHub - stripe/smokescreen: A simple HTTP proxy that fogs over naughty URLs

Dns reminding attack is extremely hard to defend against without strict allow list policies. The best attempt so far IMO is stripe smokescreen github.com/stripe/smoke...