Category Archive
General CTI
379 reports·All intelligence
Bulwark Black cyber threat intelligence filed under General CTI.
Showing 1–24 of 379 reports
Cisco Expressway Root RCE: Patch the Cluster and Check Service Reachability
Cisco’s critical clustered Expressway flaw requires persistent cookies and database-service access. Upgrade to the documented fixed release and review cluster trust boundaries.
Pulsar Manager Is Retired: Remove the Console and Recover Cluster Credentials
Every released Pulsar Manager version is affected by a critical unauthenticated credential-exposure flaw. No fix is planned: remove the console and assess cluster credential recovery.
Arista VCO Exploitation: Patch the Orchestrator, Review Every Portal Role
Arista confirms active exploitation of CVE-2026-114625. Even read-only VCO tenant access can escalate; patch the correct on-premises branch and preserve control-plane evidence.
SafePay Warning: Prove Your Backups Can Survive an Administrator Compromise
The joint SafePay warning describes credential-driven entry, data theft and backup disruption. Test whether recovery survives the loss of production administrator accounts.
TeamUpdraft Compromise: Check Every Connected WordPress Site for Persistence
TeamUpdraft’s October 22 update expands practical site checks after stolen cloud connection keys enabled malicious plugins and accounts. Key revocation is not proof of cleanup.
Railway Secrets Incident: Rotate Credentials, Then Check What They Could Reach
Railway urges all users to rotate secrets after possible environment-variable exposure. Map downstream access, verify revocation and investigate cloud persistence.
LiteLLM 1.107.0 Compromise: Rebuild the Environment, Recover the Credentials
Malicious LiteLLM wheels can steal secrets at Python startup. Scope exact artifacts, avoid retriggering suspect environments, and recover credentials separately from rebuilding.
GitLab Regex RCE: Patch the Server, Verify the Delivery Chain
GitLab’s CVSS 10.0 regex compiler flaw reaches back to version 7.0. Verify the correct fixed branch, plan migrations, and review CI/CD trust where compromise is suspected.
eMudhra CA Key Compromise: Check the Trust Stores Beyond Your Browser
Eight weak eMudhra intermediate CA keys exposed a trust gap beyond browsers. Inventory application verifiers, update CA bundles and runtimes, and confirm running workloads consume the fixes.
PHP2Shell: Patch the Runtime Behind Your Websites
Emergency PHP releases address two unauthenticated RCE flaws. Prioritize the serving runtime, replace vulnerable workers, and verify vendor backports—not just CMS updates or WAF coverage.
Trusted Notifications, Untrusted Instructions: Close the Email Content Gap
Cisco Talos reports phishing carried by legitimate order notifications and delivery reports. Practical controls for email inspection, callback verification and response.
BRONZE SANDCASTLE: Hunt the DLL Load Chain, Not the Trusted Executable
Sophos details BRONZE SANDCASTLE DLL sideloading and memory-resident payloads. Practical hunting and response priorities for lean security teams.
One Stolen Identity, Several SaaS Platforms: Respond Beyond the Mailbox
A Sophos case connects vishing, password recovery and a device-backed session to SharePoint downloads and a ServiceNow export. A practical cross-SaaS response plan.
Siemens Software Center ClickFix Attacks: Hunt Beyond the Trusted Signature
Siemens confirms active DLL-sideloading attacks. Update Software Center, investigate unexpected signed copies, and correlate process paths, persistence and network evidence.
BeyondTrust Authentication Bypass: Patch the Appliance, Review the Access
CISA confirms exploitation of BeyondTrust CVE-2026-102764. A practical response sequence for remote-support owners: verify remediation, preserve evidence, and investigate earlier access.
PEERSTITCH: Recover the Management Trust, Not Just the Firewall
PEERSTITCH research highlights the recovery gap after firewall-management compromise: patch the entry point, investigate managed devices, and replace exposed trust material.
CikaBika Bot: Detect the Document-to-Discord Attack Chain
CikaBika Bot turns a document lure into Discord-based remote control. Practical detection priorities for lean security teams, from shortcut execution to outbound service access.
ConnectWise Cloud Backup Incident: Revocation Is Not Tenant Recovery
ConnectWise suspended Cloud Backup after application identities were abused. A practical tenant-response guide covering persistence, evidence preservation, and backup continuity.
AOMEI Update Tampering Shows Why Clean URLs Cannot Close Endpoint Alerts
Google researchers documented brief AOMEI update-server tampering windows. A practical response guide for SMBs and government contractors: preserve event-time evidence and distinguish vendor remediation from endpoint recovery.
Third-Party VPN Access Shows Basic Controls Still Stop Bank Intrusions
A Unit 42 investigation into a European bank intrusion shows how vendor-managed gateway gaps, weak authentication, and noisy reconnaissance can create real business risk even when the attacker is not sophisticated.
Microsoft Patch Tuesday Record Shows Patch Triage Must Be Risk-Based
Microsoft’s October 2026 Patch Tuesday dropped a record 1,411 fixes, including an actively exploited Windows Shell flaw. SMBs and government contractors need a risk-based triage workflow, not a spreadsheet panic cycle.
Ivanti Connect Secure Zero-Day Shows Edge Gateways Need Patch-and-Hunt Discipline
An actively exploited Ivanti Connect Secure authentication-bypass zero-day reinforces a hard lesson: edge gateways must be patched fast, checked for compromise, and monitored like privileged infrastructure.
LiteLLM Gateway Flaws Show AI Infrastructure Needs Real Access Control
Check Point Research found LiteLLM gateway vulnerabilities that could let lower-privileged users alter runtime configuration, read files, take over admin access, or reach RCE paths. Here is what defenders should do now.
LiteLLM Gateway Flaws Show AI Proxies Need Control-Plane Security
Check Point found LiteLLM gateway vulnerabilities that could let low-privileged users tamper with configuration, read files, take over admin access, execute code, and leak provider keys. The defense is treating AI gateways like privileged infrastructure.