Category Archive
General CTI
401 reports·All intelligence
Bulwark Black cyber threat intelligence filed under General CTI.
Showing 1–24 of 401 reports
D-Link DDP Flaws: Disable Discovery, Keep the Firmware Review Open
D-Link’s unpatched switch findings call for disabling DDP and verifying management controls. Keep separate firmware risks open; controlled tests are not proof of active attacks.
OpenSSH on musl: Patch the Server, Verify Key-Only Accounts Stay Key-Only
OpenSSH 10.6p2 addresses a conditional musl/no-PAM password bypass. Check key-only account enforcement, deploy fixed packages and investigate unexpected logins.
GhostMap Android Crash Loop: Prepare for Phone Loss Before the App Runs
Bitdefender demonstrates an Android crash loop triggered by app installation, not launch. Restrict unapproved APKs and verify data, identity and phone-loss recovery.
Exploited CVEs: Prioritize the Reachable Path to Privileged Access
Microsoft’s exploitation analysis argues for patching reachable takeover paths first, while reducing the service-account authority and trusted connections behind them.
VOLTA Infostealer: Recover the Access Behind the AI-Ranked Dossier
Talos's VOLTA analysis shows AI ranking stolen victim data. Recover sessions, tokens and workstation secrets—not just the deleted malware executable.
Help-Desk Vishing: Verify the Caller Before Opening Remote Access
Talos's Q3 incident-response report shows how voice phishing turns trusted support tools into access. Verify callers, constrain remote sessions and preserve evidence off-device.
Fake Downloads, Multiple Payloads: Investigate the Whole Installer Session
Microsoft's fake-download investigation shows why a blocked offer is not a clean endpoint. Review the whole installer session, unexpected software and privileged persistence.
XCPE Firmware Backdoor: Recover Device Trust Beyond the Botnet Takedown
Google's XCPE investigation describes persistent firmware backdoors in set-top boxes. Inventory suspect devices, isolate exposure and verify recovery rather than equating a takedown with cleanup.
GitLab Enters CISA KEV: Patch the Compiler, Review the Build Trust
CISA confirms exploitation of GitLab CVE-2026-97229. Verify the server fix, preserve evidence and assess the credentials and release paths the instance could reach.
Q3 Internet Disruptions: Test the Dependencies Behind Your Backup Connection
Cloudflare’s Q3 retrospective shows why backup connectivity needs dependency testing: power, upstream routes, cloud identity and approved data handling must survive together.
Crime Stoppers Vendor Breach: Protect Confidentiality When Reporting Routes Change
Peel police's October 22 statement on the Crime Stoppers vendor breach highlights a practical response gap: fallback reporting channels may not preserve anonymity.
Binance Estimates $6.3 Billion Impact: Separate Frozen Funds From Recovery
Binance estimates $6.3 billion in impact and approximately $3 billion frozen. Its preliminary DevOps-access account calls for careful separation of containment, recovery and business continuity.
Signal RingRTC Hang-Up Flaw: Update the Client, Verify the Call Ends
RingRTC before 2.72.0 can fail to end media when a call peer floods its event queue. Update Signal clients and separate the disclosed risk from unproven exploitation.
Pillow Image-Processing Flaw: Patch the Worker Behind the Upload
Pillow's critical multi-frame flaw is fixed in 13.0.0. Find the deployed upload workers, verify patched dependencies and distinguish demonstrated execution from confirmed attacks.
Wasmtime on Arm: Check the Separate br_table Sandbox Escape
A separate Wasmtime compiler flaw affects aarch64 deployments. Verify fixes for CVE-2026-115893 rather than relying on remediation for the earlier SSA defect.
Blastmail Breach: Protect the Audience Data Behind Your Newsletter
Blastmail confirms theft of contract-holder records and some mailing lists. Scope customer exposure, prepare for impersonation and separate data response from delivery continuity.
KeyDrift on Cisco SD-WAN: Patch the Entry Point, Investigate the Controller
Talos's new KeyDrift analysis shows why Cisco SD-WAN response must pair verified fixes with controller compromise review and recovery of exposed trust material.
Postiz Token Forgery: Patch the Publisher, Review Organization Access
Postiz fixes a critical registered-user token-forgery flaw in 2.25.3. Upgrade, review organization authority and plan session and API-key recovery.
Brotli Enters CISA KEV: Patch Node.js and Trace Every Decompression Path
CISA now lists the Brotli flaw as known exploited. Update affected Node.js runtimes and inspect both inbound request decoding and externally fetched responses.
Wasmtime Sandbox Escape: Patch the Engine Behind Your Wasm Workloads
A critical Cranelift flaw can let crafted WebAssembly escape Wasmtime containment. Find embedded runtimes, deploy a fixed version and review host privileges.
Quest Quanum Incident: Protect Patient Data While Keeping Orders Moving
Quest confirms patient information was affected in the Quanum LSM incident. Separate confirmed exposure from unknown scope, and use verified continuity channels.
Pulsar Token Bypass: Check Anonymous Fallback and Patch Brokers
Apache fixes a critical Pulsar broker bypass involving unverified token roles and anonymous fallback. Check the required settings, patch, and validate authorization failures.
Cisco Expressway Root RCE: Patch the Cluster and Check Service Reachability
Cisco’s critical clustered Expressway flaw requires persistent cookies and database-service access. Upgrade to the documented fixed release and review cluster trust boundaries.
Pulsar Manager Is Retired: Remove the Console and Recover Cluster Credentials
Every released Pulsar Manager version is affected by a critical unauthenticated credential-exposure flaw. No fix is planned: remove the console and assess cluster credential recovery.