<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>BackBox Labs: Ricerca</title>
    <description>Ricerca, threat intelligence e analisi di cybersecurity a cura di BackBox Labs.</description>
    <link>https://backbox.dev/it/blog.html</link>
    <atom:link href="https://backbox.dev/it/rss.xml" rel="self" type="application/rss+xml"/>
    <language>it</language>
    <lastBuildDate>Thu, 12 Nov 2026 00:00:00 GMT</lastBuildDate>
    <item>
      <title><![CDATA[Allarmi bomba senza bombe: l'indagine OSINT di BackBox AI sulle ondate di falsi allarmi in Europa]]></title>
      <description><![CDATA[Dal 19 ottobre al 12 novembre 2026 false minacce di bomba, inviate per email con almeno sei firme diverse, hanno colpito voli, redazioni e migliaia di scuole in Europa, Italia compresa. Con il profilo Threat Hunter di BackBox AI abbiamo ricostruito le ondate, confrontato i messaggi e valutato chi potrebbe esserci dietro, abbiamo verificato ogni fonte prima di pubblicare e abbiamo raccolto tutto in una dashboard che seguirà l'indagine.]]></description>
      <link>https://backbox.dev/it/blog/osint-allarmi-bomba-europa-threat-hunter.html</link>
      <guid>https://backbox.dev/it/blog/osint-allarmi-bomba-europa-threat-hunter.html</guid>
      <pubDate>Wed, 11 Nov 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Threat Intelligence]]></category>
    </item>
    <item>
      <title><![CDATA[Frigoriferi sotto attacco: l'indagine OSINT di BackBox AI sul sabotaggio della catena del freddo]]></title>
      <description><![CDATA[In tre settimane gli attacchi ai sistemi di refrigerazione di supermercati e industrie alimentari sono passati da episodi sparsi a due notti di sabotaggio su scala europea, Italia compresa. Con il profilo Threat Hunter di BackBox AI abbiamo ricostruito incidenti, tecniche, attori e collegamenti su fonti aperte, abbiamo verificato ogni fonte prima di pubblicare e abbiamo raccolto tutto in una dashboard che seguirà l'indagine.]]></description>
      <link>https://backbox.dev/it/blog/osint-sabotaggio-catena-del-freddo-threat-hunter.html</link>
      <guid>https://backbox.dev/it/blog/osint-sabotaggio-catena-del-freddo-threat-hunter.html</guid>
      <pubDate>Tue, 03 Nov 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Threat Intelligence]]></category>
    </item>
    <item>
      <title><![CDATA[OSINT su una crisi in corso: come BackBox AI ha seguito le proteste di ottobre in Europa]]></title>
      <description><![CDATA[Con il profilo Threat Hunter di BackBox AI abbiamo seguito su fonti aperte l'ondata di proteste dell'ottobre 2026 in Francia e in Italia, dalla prima ricostruzione dei fatti alla seconda giornata di mobilitazione. Ecco come è stata condotta l'indagine, che cosa ha stabilito, dove si fermano le fonti aperte e la dashboard che ne pubblica i risultati.]]></description>
      <link>https://backbox.dev/it/blog/osint-proteste-europa-threat-hunter.html</link>
      <guid>https://backbox.dev/it/blog/osint-proteste-europa-threat-hunter.html</guid>
      <pubDate>Sat, 24 Oct 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Threat Intelligence]]></category>
    </item>
    <item>
      <title><![CDATA[Breaking Chrome 152: A Complete V8 Sandbox Escape and Renderer RCE]]></title>
      <description><![CDATA[BackBox AI built a complete exploit chain against the v8CTF Chrome 152 target: an address leak, arbitrary read and write inside the V8 sandbox, a parser overflow that writes outside it, and a ROP chain that opens and reads a file on disk. Here is how each stage works, and what it says about patch lag.]]></description>
      <link>https://backbox.dev/en/blog/v8ctf-chrome-152-v8-sandbox-escape-renderer-rce.html</link>
      <guid>https://backbox.dev/en/blog/v8ctf-chrome-152-v8-sandbox-escape-renderer-rce.html</guid>
      <pubDate>Mon, 21 Sep 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Technical Writeup]]></category>
    </item>
    <item>
      <title><![CDATA[Hack The Box Season 11: cosa ci hanno insegnato tredici macchine sugli agenti autonomi]]></title>
      <description><![CDATA[Abbiamo affrontato con BackBox AI l'intera Season 11 di Hack The Box, tredici macchine da Easy a Insane, chiudendo la stagione con tutte le flag. Il punteggio è la parte meno interessante: conta fin dove arriva un agente da solo e in quali situazioni serve ancora una persona.]]></description>
      <link>https://backbox.dev/it/blog/htb-season-11-agenti-autonomi.html</link>
      <guid>https://backbox.dev/it/blog/htb-season-11-agenti-autonomi.html</guid>
      <pubDate>Tue, 01 Sep 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[AI Security]]></category>
    </item>
    <item>
      <title><![CDATA[Security Advisory: Stored XSS in nopCommerce via an SVG animate Handler That Slips Past the HtmlFormatter Blocklist]]></title>
      <description><![CDATA[During a client-commissioned penetration test, BackBox AI pivoted from gray-box to white-box, fingerprinted the exact nopCommerce version, pulled the matching source, and found a stored XSS: an SVG animate onbegin handler that slips past the platform's HtmlFormatter blocklist and a fronting web application firewall. The sanitizer root cause is unfixed through the latest release (4.90.6).]]></description>
      <link>https://backbox.dev/en/blog/nopcommerce-stored-xss-svg-animate-htmlformatter-bypass.html</link>
      <guid>https://backbox.dev/en/blog/nopcommerce-stored-xss-svg-animate-htmlformatter-bypass.html</guid>
      <pubDate>Thu, 20 Aug 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Security Advisory]]></category>
    </item>
    <item>
      <title><![CDATA[AI Harness: nella cybersecurity agentica il sistema conta più del modello]]></title>
      <description><![CDATA[Nella cybersecurity basata sull'AI la differenza non la fa il modello proprietario, ma l'harness: l'insieme di strumenti, contesto, orchestrazione, interfacce e controlli che permette ai migliori modelli disponibili di lavorare in modo affidabile su sistemi reali.]]></description>
      <link>https://backbox.dev/it/blog/ai-harness-cybersecurity-agentica.html</link>
      <guid>https://backbox.dev/it/blog/ai-harness-cybersecurity-agentica.html</guid>
      <pubDate>Wed, 19 Aug 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[AI Security]]></category>
    </item>
    <item>
      <title><![CDATA[Security Advisory: From Local User to Root, Chaining IPC Misconfigurations into a Full Privilege Escalation in NetBird]]></title>
      <description><![CDATA[BackBox Labs analyzed the NetBird client daemon on Linux and chained several individually moderate weaknesses in its local gRPC interface into a full root privilege escalation affecting versions up to and including 0.75.0, with no memory corruption, kernel bugs, or race conditions involved.]]></description>
      <link>https://backbox.dev/en/blog/netbird-ipc-local-privilege-escalation.html</link>
      <guid>https://backbox.dev/en/blog/netbird-ipc-local-privilege-escalation.html</guid>
      <pubDate>Tue, 28 Jul 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Security Advisory]]></category>
    </item>
    <item>
      <title><![CDATA[AI Malware Analysis: Reasoning Through the Glitch SPY Android RAT]]></title>
      <description><![CDATA[We pointed BackBox AI at a live Android RAT and asked for a full analysis. It unpacked a dropper, decoded an XOR-obfuscated C2 URL straight from smali bytecode, confirmed that the C2 infrastructure was still responding by speaking the malware's own protocol, and attributed the operation. This is what evidence-driven analytical reasoning looks like when it reaches past red teaming.]]></description>
      <link>https://backbox.dev/en/blog/ai-malware-analysis-glitch-spy-android-rat.html</link>
      <guid>https://backbox.dev/en/blog/ai-malware-analysis-glitch-spy-android-rat.html</guid>
      <pubDate>Wed, 15 Jul 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Technical Writeup]]></category>
    </item>
    <item>
      <title><![CDATA[Sovranità tecnologica nell'era dell'AI: perché l'indipendenza è diventata una questione strategica]]></title>
      <description><![CDATA[Nell'era dell'intelligenza artificiale, chi controlla modelli, dati e infrastrutture controlla molto più della tecnologia. Perché la sovranità tecnologica è oggi una questione strategica, e il contributo di un progetto nato in Italia.]]></description>
      <link>https://backbox.dev/it/blog/sovranita-tecnologica-era-ai.html</link>
      <guid>https://backbox.dev/it/blog/sovranita-tecnologica-era-ai.html</guid>
      <pubDate>Sun, 12 Jul 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Vision]]></category>
    </item>
    <item>
      <title><![CDATA[Security Advisory: When Packaging Becomes the Vulnerability, Local Privilege Escalation via Bettercap's systemd Service]]></title>
      <description><![CDATA[BackBox AI found a local root escalation on Linux distributions that package Bettercap with a systemd service. The flaw is not in Bettercap's code but in the packaging: the service runs its REST API as root with authentication disabled. The unit was removed upstream.]]></description>
      <link>https://backbox.dev/en/blog/bettercap-service-packaging-local-privilege-escalation.html</link>
      <guid>https://backbox.dev/en/blog/bettercap-service-packaging-local-privilege-escalation.html</guid>
      <pubDate>Sat, 11 Jul 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Security Advisory]]></category>
    </item>
    <item>
      <title><![CDATA[Security Advisory: CSMAN Decompression Bomb in Binwalk Leads to Memory-Exhaustion DoS]]></title>
      <description><![CDATA[BackBox AI found that a small crafted file could exhaust available memory during an ordinary Binwalk scan, with no extraction flag required. The Binwalk maintainer confirmed the issue and fixed it by capping decompression at 100 MB.]]></description>
      <link>https://backbox.dev/en/blog/binwalk-csman-decompression-bomb-dos.html</link>
      <guid>https://backbox.dev/en/blog/binwalk-csman-decompression-bomb-dos.html</guid>
      <pubDate>Fri, 10 Jul 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Security Advisory]]></category>
    </item>
    <item>
      <title><![CDATA[Security Advisory: Header Trust Issues in SearXNG (Open Redirect, Cache Poisoning, Rate-Limiter Bypass)]]></title>
      <description><![CDATA[BackBox AI surfaced two header-trust weaknesses in SearXNG: a Host header injection leading to open redirect and cache poisoning, and an X-Forwarded-For rate-limiter bypass. Disclosed responsibly, both come down to trusting client-controlled HTTP headers.]]></description>
      <link>https://backbox.dev/en/blog/searxng-header-trust-open-redirect-rate-limiter-bypass.html</link>
      <guid>https://backbox.dev/en/blog/searxng-header-trust-open-redirect-rate-limiter-bypass.html</guid>
      <pubDate>Thu, 09 Jul 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Security Advisory]]></category>
    </item>
    <item>
      <title><![CDATA[Più intelligente, non più grande: come abbiamo costruito BackBox AI e come collaboriamo con l'open source]]></title>
      <description><![CDATA[Perché BackBox AI punta sull'architettura più che sulla dimensione del modello, e come collaboriamo, pro bono, con un gruppo selezionato di progetti open source.]]></description>
      <link>https://backbox.dev/it/blog/smarter-not-bigger-backbox-ai-open-source-partnership.html</link>
      <guid>https://backbox.dev/it/blog/smarter-not-bigger-backbox-ai-open-source-partnership.html</guid>
      <pubDate>Mon, 06 Jul 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[AI Security]]></category>
    </item>
    <item>
      <title><![CDATA[Photoview Benchmark: BackBox AI vs Aikido and XBOW, Severity Quality Over Finding Count]]></title>
      <description><![CDATA[A data-driven comparison of BackBox AI against Aikido Security and XBOW on the Photoview application, using Doyensec's independent severity review as a common yardstick. The focus is signal over noise: matching the serious-vulnerability coverage of a higher-volume competitor with far fewer low-value findings.]]></description>
      <link>https://backbox.dev/en/blog/photoview-backbox-vs-aikido-xbow-benchmark.html</link>
      <guid>https://backbox.dev/en/blog/photoview-backbox-vs-aikido-xbow-benchmark.html</guid>
      <pubDate>Thu, 25 Jun 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Technical Writeup]]></category>
    </item>
    <item>
      <title><![CDATA[MedPortal Benchmark: BackBox AI vs Neo Vulnerability and False Positive Analysis]]></title>
      <description><![CDATA[Comparative security benchmark between BackBox AI and Neo (ProjectDiscovery) on the MedPortal application, focusing on vulnerability coverage, false positive validation, and attack chain analysis]]></description>
      <link>https://backbox.dev/en/blog/medportal-backbox-vs-neo-pd-benchmark.html</link>
      <guid>https://backbox.dev/en/blog/medportal-backbox-vs-neo-pd-benchmark.html</guid>
      <pubDate>Tue, 21 Apr 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Technical Writeup]]></category>
    </item>
    <item>
      <title><![CDATA[Multimodal AI Visual Reasoning: PCB Analysis in HTB Critical Flight]]></title>
      <description><![CDATA[How BackBox AI leveraged multimodal visual capabilities to analyze PCB production files and autonomously identify hidden anomalies in the Hack The Box Critical Flight scenario]]></description>
      <link>https://backbox.dev/en/blog/ai-visual-reasoning-pcb-critical-flight-htb.html</link>
      <guid>https://backbox.dev/en/blog/ai-visual-reasoning-pcb-critical-flight-htb.html</guid>
      <pubDate>Fri, 17 Apr 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Technical Writeup]]></category>
    </item>
    <item>
      <title><![CDATA[Autonomous AI Exploitation: Solving HTB Snapped with a Full CVE Chain]]></title>
      <description><![CDATA[How BackBox AI autonomously exploited a hard Hack The Box machine by chaining real-world CVEs without human intervention]]></description>
      <link>https://backbox.dev/en/blog/ai-autonomous-exploitation-htb-snapped-cve-chain.html</link>
      <guid>https://backbox.dev/en/blog/ai-autonomous-exploitation-htb-snapped-cve-chain.html</guid>
      <pubDate>Thu, 09 Apr 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Technical Writeup]]></category>
    </item>
    <item>
      <title><![CDATA[BackBox AI vs XBOW Benchmark: Compromising a SOAP Service with XXE and Default Credentials]]></title>
      <description><![CDATA[A detailed analysis of how BackBox AI autonomously compromised a vulnerable SOAP service by exploiting XXE and default credentials in the XBOW Validation Benchmark.]]></description>
      <link>https://backbox.dev/en/blog/backbox-ai-xbow-nice-soap-xxe-default-credentials.html</link>
      <guid>https://backbox.dev/en/blog/backbox-ai-xbow-nice-soap-xxe-default-credentials.html</guid>
      <pubDate>Tue, 10 Feb 2026 00:00:00 GMT</pubDate>
      <category><![CDATA[Technical Writeup]]></category>
    </item>
    <item>
      <title><![CDATA[Threat Led Penetration Testing: rafforzare la resilienza cyber]]></title>
      <description><![CDATA[Come BackBox Labs applica una metodologia di Threat Led Penetration Testing (TLPT) adversary-driven che unisce threat intelligence, attack surface discovery potenziata dall'AI e competenza umana per misurare la reale resilienza operativa.]]></description>
      <link>https://backbox.dev/it/blog/threat-led-penetration-testing-tlpt.html</link>
      <guid>https://backbox.dev/it/blog/threat-led-penetration-testing-tlpt.html</guid>
      <pubDate>Sat, 19 Jul 2025 00:00:00 GMT</pubDate>
      <category><![CDATA[Penetration Testing]]></category>
    </item>
  </channel>
</rss>
