Incident Response — Tags

Binance Is Reopening After a $6.3B Theft. Recovery Is Not Remediation

Binance has resumed withdrawals, replaced 95% of affected assets, and received an FBI attribution. None of that yet explains or closes the original breach path.

Linux CVE-2026-98432: Check the Running Kernel, Not Just the Update Screen

A remotely reachable Linux TCP flaw can crash a server and has been demonstrated as root code execution with MPTCP. Here is how to assess exposure, patch, reboot, and verify the result.

GitLab CVE-2026-85706: Patch the File Read, Then Rotate What It Exposed

CISA lists GitLab CVE-2026-85706 as exploited. Self-managed administrators must patch, hunt the repository commits API, and treat readable secrets as potentially compromised.

MFA Fatigue: How Push Bombing Works and How to Stop It

Learn how MFA push bombing turns a stolen password into account access, what the warning signs look like, and which controls actually stop it.

Session Cookie Theft: How Attackers Bypass MFA

A stolen session can bypass the login screen entirely. Learn how cookie theft works, how to detect replay, and how to contain it correctly.

PHP2Shell Update: Exploitation Began Before Disclosure

AWS saw PHP2Shell attempts before disclosure. Here is what defenders now know about exploitation, memory disclosure, patch verification, and compromise hunting.

ConnectWise Cloud Backup Incident: Treat SaaS Application Trust as an Incident Boundary

ConnectWise suspended Cloud Backup after unauthorized access to application identities. The defensible response is to hunt application activity in each Microsoft 365 tenant, not to mistake downtime for proof of compromise.

AhsayCBS Under Attack: When the Backup Server Becomes the Foothold

Attackers chained AhsayCBS flaws to take over backup servers. The response requires the correct hotfix, compromise investigation, and a recovery path the attacker cannot control.

French Supermarket Cyberattack: When Remote Defrost Breaks the Cold Chain

Attackers disrupted refrigeration at hundreds of French supermarkets. What is known about the incident and why the security lifecycle of connected equipment matters beyond the IT department.

Midnight Mimosa: When Your Android Phone Arrives Already Compromised

Worried about preinstalled malware on a budget Android phone? Learn what to check before buying, when to disconnect, and why a factory reset may not solve it.

Nordic Cyberattacks, August–September 2026: Data Theft, Service Disruption and ClickFix

A sourced Nordic review of CPR, Ryde, Dustin, Norwegian DDoS attacks and malicious websites in Finland and Iceland, with an early-October update.

Russia's Hybrid Campaign Against Europe: Cyberattacks, Sabotage, and Information Warfare

How Russian hybrid operations exploit Europe's digital systems, infrastructure, and public trust — and how defenders can connect the evidence, reduce exposure, and respond.

Check Point VPN and Management Flaws Under Attack: Patch Two Different Trust Boundaries

Check Point confirms exploitation of a VPN gateway RCE and a separate management-server zero-day. Identify the affected roles, install both fixes, and investigate earlier exposure.

PixelLeak: How Coding Agents Put Private Screenshots on Public GitHub

Glow Labs found coding agents publishing internal screenshots to public GitHub repositories. Trace the exposure, contain sensitive images, and put enforceable limits on agent uploads.

Apple Patched CVE-2026-86950: Which iPhones and Macs Still Need the Fix?

Apple patched a CoreGraphics code-execution flaw and says it may have been used in targeted attacks. Identify affected devices, install the right update, and verify the result.

ShinyHunters Arrest in the Netherlands: What the Evidence Shows and What Defenders Should Check

Dutch police have arrested a suspect in the ShinyHunters investigation. The arrest does not settle who carried out the Odido or FBI incidents; the documented access paths still demand action.

ShinyHunters Claims an FBI Breach: What the Jobs-Site Evidence Actually Shows

The FBI now describes a cyber incident involving FBIJobs.gov. New reporting strengthens the evidence of personnel data theft, while the full scope and entry path remain unresolved.

Citrix NetScaler Zero-Days Exploited: What to Patch and How to Check for Compromise

Citrix confirms exploitation of two NetScaler flaws. Check affected builds and DTLS exposure, plan the upgrade, and investigate possible compromise.

F5 BIG-IP APM Under Attack: Check the OAuth Boundary, Patch, and Investigate

F5 confirms exploitation of CVE-2026-94127. Identify affected APM virtual servers, install the fixed hotfix, and investigate OAuth failures and appliance activity.

VeloCloud CVE-2026-93952: An Exploited Flaw in the SD-WAN Control Plane

An actively exploited VeloCloud Orchestrator flaw needs no admin login. Check certificate-based exposure, fixed releases, and evidence of compromise.

Roundcube CVE-2026-48842: Check the Plugin, Patch the SQL Injection

A pre-authentication SQL injection in Roundcube's virtuser_query plugin has been reported in active use. Check whether your installation is exposed, update it, and investigate suspicious activity.

vCenter CVE-2026-59309 and 59310: Patch the Control Plane

Two critical vCenter flaws threaten authentication and code execution. Use this practical plan to patch, isolate, detect, and recover safely.

Canary Tokens: Deployment, Alert Triage and Detection Limits

Deploy canary tokens in repositories, documents and cloud workflows. Understand what triggers an alert, what can be missed, and how to investigate benign activity.

Julius Kivimäki and Vastaamo: When Patient Data Became the Ransom

The Vastaamo case was not just a Finnish hacker story. It showed how exposed databases, weak governance, poor logging, and delayed breach response can turn clinical records into direct extortion against patients.

Sality Botnet Disruption: How Defenders Turned a P2P Network Against Itself

Inside the 2026 Sality disruption: peer-to-peer trust failures, the limits of botnet takedowns, and practical detection and recovery for Windows defenders.

LiteLLM CVE-2026-59822: Your AI Gateway Is a Cloud Control Plane

An exploited LiteLLM MCP authentication bypass, unsafe defaults, code-executing guardrails, and unrestricted pass-through routes show why AI gateways must be isolated and operated as Tier-1 infrastructure.

Week 37 Security Priorities: Revoke Trust Before You Chase Malware

Berlin's published data, exploited SonicWall gateways, a Chrome zero-day, AI-accelerated intrusion, payment-system abuse, and PostGREShell all point to the same task: identify and revoke inherited trust.

AI Compressed an Enterprise Intrusion Into Ten Hours. Speed Was the Weapon

Unit 42 reports that a human attacker used AI agents to move from an exposed API to cloud, identity, source code, secrets, and CI/CD control in under ten hours. The evidence shows acceleration, not a magical new exploit.

SonicWall SMA1000 Zero-Day Chain: Patch It, Then Assume It Was Breached

CVE-2026-83548 and CVE-2026-83549 are being exploited against SonicWall SMA1000 appliances. Patching closes the flaws, but exposed gateways still need compromise assessment and credential recovery.

Rhysida Published Berlin's Stolen Data. The Incident Is Only Starting

Berlin's stolen government data has been released after an extortion deadline expired. The next phase is credential rotation, exposure analysis, victim notification, and long-term fraud monitoring.

ownCloud CVE-2023-49105: The File Server Bug That Waited Three Years

CISA added an old ownCloud WebDAV authentication bypass to KEV after reported exploitation against Philippine research and defense-linked targets. The lesson is not novelty. It is exposed file infrastructure.

Berlin's Landesnetz Cyberattack: Segmentation Worked, Then the Business Broke

Berlin isolated two state ministries after a cyberattack on the Landesnetz. The incident is a practical lesson in public-sector segmentation, crisis communications, and data-theft triage.

153M Driver's License Scans for Sale: ID Verification Became the Breach Surface

KrebsOnSecurity reports that the FBI is investigating a dark web service selling more than 153 million driver's license scans. The lesson is not just identity theft. It is vendor concentration around identity proofing.

PaperCut CVE-2026-81578 and 82078: The Print Server Became an RCE Pivot

PaperCut NG/MF has an actively exploited authentication-bypass and unsafe class-loading chain. Patch Release 2 matters, but exposed servers also need immediate compromise triage.

TeamPCP Arrests in Australia: The Supply Chain Lesson Is Bigger Than Two Suspects

Australian and U.S. authorities have charged alleged TeamPCP operators after a software supply chain campaign that authorities say hit more than 1,000 organizations. The defensive lesson is about tokens, publishing rights, and update speed.

Zimbra CVE-2026-73570: Patch the Mail Server, Then Prove It Wasn't Already Owned

Attackers are exploiting a Zimbra SNMP command injection flaw after a fixed version was already available. The real work is not only patching, but compromise triage.

CVE-2026-20349: Attackers Are Crashing the VPN Before Users Can Log In

Cisco says attackers are exploiting a remote denial-of-service flaw in ASA and FTD VPN services. Here is how to prioritize, detect, and contain it.

CVE-2026-65400: When macOS Screen Sharing Becomes Remote Root

Attackers are exploiting a macOS Screen Sharing authentication flaw against exposed Macs. Patch, remove VNC exposure, and investigate before treating it as a routine update.

Tomcat CVE-2026-34486: The Broken Encryption Fix

An incomplete Tomcat fix allowed EncryptInterceptor bypass and is now exploited. Learn which exact versions are exposed and how to contain clusters.

Langflow CVE-2026-9198: Auto-Login Was a Server Shell

Default Langflow deployments exposed a two-step path from no account to remote code execution. Learn how to patch, isolate, hunt, and rotate secrets.

LoadMaster CVE-2026-8037: The Load Balancer Became the Way In

An unauthenticated command-injection flaw turned a perimeter appliance into an entry point. Here is how to patch, contain, hunt, and recover.

One Email Preview Is Enough: Russia's Half-Click Webmail Exploits

Russian-aligned espionage groups exploited stored XSS flaws in Zimbra, SOGo, Roundcube, MDaemon, and Kerio. Opening a message was enough to lose credentials, email, and persistent access.

CVE-2026-48282: A Perfect 10 in Adobe ColdFusion, Exploited Within Two Hours

A CVSS 10.0 path traversal in Adobe ColdFusion's Remote Development Services lets unauthenticated attackers write a webshell straight into the web root. Attackers were probing it before most admins finished reading the advisory.

The KDDI Breach: One Vulnerable Component, Six ISPs, 12 Million Exposed Inboxes

A zero-day in unnamed third-party software let attackers sit inside KDDI's shared ISP email platform for a month, exposing email addresses and passwords used by @nifty, BIGLOBE, J:COM, and three other providers. Here's what's confirmed and what isn't.