Showing 97–120 of 305 reports
Fileless PHP Rootkit Shows Why BIG-IP Incidents Need Process-Level Hunting
SophosLabs analysis of a BIG-IP APM-linked PHP web server rootkit shows why defenders need post-patch compromise review, process-level hunting, and edge appliance rebuild discipline.
OWAReaper Shows Why Exchange Mailboxes Need Post-Patch Compromise Review
Resecurity’s OWAReaper report shows why on-prem Exchange response cannot stop at patching: defenders need mailbox-permission audits, token revocation, OWA exposure control, and post-patch compromise review.
Apache Ant Path Traversal Shows Why Build Pipelines Need Sandboxes
Apache Ant CVE-2026-78254 is moderate on paper, but CI/CD context makes arbitrary file overwrite worth treating as build-pipeline integrity risk.
Teams Helpdesk Impersonation Shows Why Remote Support Needs Guardrails
Microsoft’s Teams helpdesk impersonation case shows why remote support sessions need verification, tool control, user-writable execution limits, and WinRM monitoring.
PaperCut RCE Shows Why Print Servers Need Compromise Review
Active exploitation of PaperCut NG/MF vulnerabilities shows why print-management servers need patching, exposure control, log review, and credential-access hunting.
Edge AI Moves the Trust Boundary Into Customer-Owned Environments
Microsoft’s edge AI guidance is a reminder that local AI systems need attestation, artifact provenance, least-privilege credentials, and deterministic policy gates before they touch sensitive data or take action.
Toy Ghouls Shows Why Custom C2 Needs Protocol-Aware Monitoring
Kaspersky reports that Toy Ghouls has added custom Windows backdoors using HiveMQ MQTT and Matrix/Element-style command channels. For SMBs and government contractors, the lesson is not just malware blocking — it is protocol-aware egress control, service persistence review, and post-compromise valida
Ted Backdoor Shows Why Edge Load Balancers Need Compromise Review
Rapid7’s DPRK-attributed ted backdoor and curlRAT research shows why HAProxy, SSH, cron, and other Linux edge services need integrity checks, centralized logs, and post-compromise review.
Nisos DPRK Investigation Shows Why Remote Hiring Is a Security Control
Nisos’ DPRK employment-fraud investigation shows why remote hiring, contractor onboarding, identity verification, and access control now belong in the same security conversation.
Fake Claude Opus 5 App Shows Why AI Tooling Needs Software Control
A fake Claude Opus 5 GitHub desktop app delivering RevStealer shows why AI experimentation needs approved software paths, endpoint controls, and credential-theft triage.
NodeRabbit and PollCat Show Why Developer Workstations Need Recruiting-Lure Controls
Mirage Kitten’s NodeRabbit and PollCat malware campaigns show why fake recruiter coding tests are a practical workstation, credential, and supply-chain risk for SMBs and government contractors.
JSCeal Shows Why Compiled Script Malware Needs Bytecode-Aware Defense
Check Point’s JSCeal research shows how compiled V8 bytecode can hide credential theft, browser theft, and local traffic interception from normal JavaScript inspection workflows.
Watershed 250 Shows Water Cybersecurity Needs Practical Field Tests
Project Watershed 250 is a practical test of water-sector cyber defense. The real value will be turning pilot work into repeatable playbooks for small utilities, SMBs, and government contractors.
Fire Ant Shows Why Trusted Infrastructure Needs First-Class Detection
Sygnia’s Fire Ant report shows how routers, TACACS, tunnels, and Linux management hosts can become attacker-controlled infrastructure. The defensive priority is treating the management plane as a monitored, hardened asset class.
LLM Safety Fragility Shows Why AI Workflows Need Runtime Guardrails
Unit 42 research on perturbation probing shows why built-in model alignment should be treated as one control layer, not the security boundary for enterprise AI workflows.
rsyslog Buffer Overflow Shows Why Logging Pipelines Need Availability Controls
CVE-2026-78002 can crash rsyslogd in exposed configurations that transform untrusted log data. The defensive priority is patching network-facing collectors, reviewing RainerScript rules, and monitoring log-pipeline health.
TerminalFix Shows Why Fake CAPTCHA Lures Are Network Access Problems
Microsoft’s TerminalFix campaign turns fake CAPTCHA social engineering into DLL sideloading, persistence, Active Directory reconnaissance, and reverse-tunnel access. The lesson for SMBs and government contractors: compromised workstations can become internal proxy nodes.
ServiceNow AI Platform Flaws Show Why SaaS Control Planes Need Emergency Patch Discipline
Three CVSS 10.0 ServiceNow AI Platform vulnerabilities show why enterprise SaaS platforms need emergency patch discipline, exposure review, and control-plane monitoring — especially for self-hosted or partner-managed instances.
Vault Secrets Operator Flaw Shows Why Kubernetes Controllers Need Egress Control
CVE-2026-8715 in HashiCorp Vault Secrets Operator shows how tenant-controlled custom resources can become a Kubernetes control-plane risk when privileged controllers lack tight input and egress boundaries.
PackClient Shows Why Phishing Defense Needs Execution Controls
Proofpoint reported TA4922 using PackClient in tax-themed phishing campaigns. The defensive lesson for SMBs and government contractors is to control the execution chain after the click.
macOS Screen Sharing Exploitation Shows Why Remote Access Needs Exposure Control
CVE-2026-65400 is being exploited against internet-exposed Macs running Screen Sharing. For SMBs and government contractors, this is a remote-access exposure problem, not just an Apple patch problem.
AI-Assisted Exploits Make OT Reachability the Real Control
AI-assisted exploit development is lowering the skill barrier for attacks against factory controllers. For SMBs and government contractors, the practical defense is shrinking what can reach OT assets.
White-Label Router Backdoors Show Why Edge Provenance Matters
ZBT white-label router backdoors are a reminder that SMBs and government contractors need real edge-device provenance, egress monitoring, and procurement controls.
PaperCut Zero-Day Exploitation Shows Why Print Servers Need Edge-Asset Discipline
PaperCut warned that NG/MF servers are being exploited in zero-day attacks. For SMBs and government contractors, public print-management servers need the same containment, patching, and compromise-assessment discipline as other edge assets.