Category Archive
Cyber Security Blog
305 reports·All intelligence
Bulwark Black cyber threat intelligence filed under Cyber Security Blog.
Showing 1–24 of 305 reports
GitLab Regex RCE: Patch the Server, Verify the Delivery Chain
GitLab’s CVSS 10.0 regex compiler flaw reaches back to version 7.0. Verify the correct fixed branch, plan migrations, and review CI/CD trust where compromise is suspected.
eMudhra CA Key Compromise: Check the Trust Stores Beyond Your Browser
Eight weak eMudhra intermediate CA keys exposed a trust gap beyond browsers. Inventory application verifiers, update CA bundles and runtimes, and confirm running workloads consume the fixes.
PHP2Shell: Patch the Runtime Behind Your Websites
Emergency PHP releases address two unauthenticated RCE flaws. Prioritize the serving runtime, replace vulnerable workers, and verify vendor backports—not just CMS updates or WAF coverage.
Trusted Notifications, Untrusted Instructions: Close the Email Content Gap
Cisco Talos reports phishing carried by legitimate order notifications and delivery reports. Practical controls for email inspection, callback verification and response.
BRONZE SANDCASTLE: Hunt the DLL Load Chain, Not the Trusted Executable
Sophos details BRONZE SANDCASTLE DLL sideloading and memory-resident payloads. Practical hunting and response priorities for lean security teams.
One Stolen Identity, Several SaaS Platforms: Respond Beyond the Mailbox
A Sophos case connects vishing, password recovery and a device-backed session to SharePoint downloads and a ServiceNow export. A practical cross-SaaS response plan.
Siemens Software Center ClickFix Attacks: Hunt Beyond the Trusted Signature
Siemens confirms active DLL-sideloading attacks. Update Software Center, investigate unexpected signed copies, and correlate process paths, persistence and network evidence.
BeyondTrust Authentication Bypass: Patch the Appliance, Review the Access
CISA confirms exploitation of BeyondTrust CVE-2026-102764. A practical response sequence for remote-support owners: verify remediation, preserve evidence, and investigate earlier access.
PEERSTITCH: Recover the Management Trust, Not Just the Firewall
PEERSTITCH research highlights the recovery gap after firewall-management compromise: patch the entry point, investigate managed devices, and replace exposed trust material.
CikaBika Bot: Detect the Document-to-Discord Attack Chain
CikaBika Bot turns a document lure into Discord-based remote control. Practical detection priorities for lean security teams, from shortcut execution to outbound service access.
ConnectWise Cloud Backup Incident: Revocation Is Not Tenant Recovery
ConnectWise suspended Cloud Backup after application identities were abused. A practical tenant-response guide covering persistence, evidence preservation, and backup continuity.
AOMEI Update Tampering Shows Why Clean URLs Cannot Close Endpoint Alerts
Google researchers documented brief AOMEI update-server tampering windows. A practical response guide for SMBs and government contractors: preserve event-time evidence and distinguish vendor remediation from endpoint recovery.
Third-Party VPN Access Shows Basic Controls Still Stop Bank Intrusions
A Unit 42 investigation into a European bank intrusion shows how vendor-managed gateway gaps, weak authentication, and noisy reconnaissance can create real business risk even when the attacker is not sophisticated.
Microsoft Patch Tuesday Record Shows Patch Triage Must Be Risk-Based
Microsoft’s October 2026 Patch Tuesday dropped a record 1,411 fixes, including an actively exploited Windows Shell flaw. SMBs and government contractors need a risk-based triage workflow, not a spreadsheet panic cycle.
Ivanti Connect Secure Zero-Day Shows Edge Gateways Need Patch-and-Hunt Discipline
An actively exploited Ivanti Connect Secure authentication-bypass zero-day reinforces a hard lesson: edge gateways must be patched fast, checked for compromise, and monitored like privileged infrastructure.
LiteLLM Gateway Flaws Show AI Infrastructure Needs Real Access Control
Check Point Research found LiteLLM gateway vulnerabilities that could let lower-privileged users alter runtime configuration, read files, take over admin access, or reach RCE paths. Here is what defenders should do now.
LiteLLM Gateway Flaws Show AI Proxies Need Control-Plane Security
Check Point found LiteLLM gateway vulnerabilities that could let low-privileged users tamper with configuration, read files, take over admin access, execute code, and leak provider keys. The defense is treating AI gateways like privileged infrastructure.
AhsayCBS Webshell Attacks Show Backup Servers Are High-Value Entry Points
Active exploitation of AhsayCBS backup-management flaws shows why backup consoles need restricted access, compromise hunting, credential rotation, and recovery validation.
Dutch Warning on Chinese Edge-Device Attacks Shows Why Firewall Logs Must Leave the Firewall
A Dutch AIVD/MIVD/NCSC advisory warns that Chinese actors are expected to intensify edge-device exploitation. For SMBs and government contractors, the priority is centralized logging, segmentation, forensic readiness, and faster perimeter patch decisions.
UAT-11985 Shows AI-Assisted Phishing Is Now Real-Time Account Takeover
Cisco Talos reported an APT campaign using AI-assisted event lures, malicious QR codes, and real-time Google AitM phishing. The defensive answer is phishing-resistant MFA, invitation verification, and identity telemetry that connects clicks to sessions.
Trojanized Terraform Providers Show IaC Pipelines Are Developer Endpoints
Zscaler ThreatLabz detailed a suspected TraderTraitor campaign using a fake Terraform provider to launch cross-platform malware. The practical lesson: infrastructure-as-code plugins run on developer and CI/CD systems, so they need endpoint controls, provenance checks, and egress monitoring.
Malicious AI Agent Skills Turn Prompt Instructions Into Supply-Chain Risk
VirusTotal found thousands of malicious AI agent skills, many carrying the attack in plain-language instructions rather than code. The defensive move is to review skills like software, sandbox agents, and monitor outbound behavior.
ARTEX AI Bank Attacks Show Agentic Tools Are Now an Incident-Response Problem
CrowdStrike found ARTEX configuration files and Claude Code histories tied to attacks on South Korean financial organizations. The lesson for defenders is not AI panic—it is faster triage, stronger application logging, and tighter controls around data-access workflows.
Ransomware Negotiation Arrest Shows Why Extortion Response Needs Guardrails
A ShinyHunters-linked arrest report is a reminder that ransomware negotiation is not just a tactical service. SMBs and government contractors need clear authority, evidence handling, vendor vetting, and legal guardrails before extortion starts.