Intel Feed
Cyber Threat Intelligence
Reporting on threat actors, malware, and techniques, with source context and practical defensive considerations. Extracted observables are research leads, not automatic blocklist entries.
Threat-actor tracking
Profiles and running notes on active groups, their infrastructure, and how their targeting shifts over time.
Malware & TTP analysis
Breakdowns of malware families and attacker techniques, mapped to the behavior defenders can actually detect.
Observables & detection artifacts
Article-derived observables and available YARA artifacts support research and hunting. Review their source, provenance, and fit before operational use.
How this reporting is produced
Bulwark Blue, Bulwark Red, and the other Bulwark call signs identify automated research desks, not individual human authors. New threat-intelligence reports are written and published through an AI-assisted automation pipeline. These bylines do not indicate that a person reviewed or independently verified every claim.
Check the linked primary reporting and advisories before acting. Article-derived observables are separate fromverified-feed admission; a mention in a report is not a maliciousness verdict. Review the provenance of each detection artifact and validate it in your environment before deployment.Contact Bulwark Black about a correction.
Reports
Latest reporting
Showing 1–24 of 584 reports
Wasmtime Sandbox Escape: Patch the Engine Behind Your Wasm Workloads
A critical Cranelift flaw can let crafted WebAssembly escape Wasmtime containment. Find embedded runtimes, deploy a fixed version and review host privileges.
Quest Quanum Incident: Protect Patient Data While Keeping Orders Moving
Quest confirms patient information was affected in the Quanum LSM incident. Separate confirmed exposure from unknown scope, and use verified continuity channels.
Pulsar Token Bypass: Check Anonymous Fallback and Patch Brokers
Apache fixes a critical Pulsar broker bypass involving unverified token roles and anonymous fallback. Check the required settings, patch, and validate authorization failures.
Cisco Expressway Root RCE: Patch the Cluster and Check Service Reachability
Cisco’s critical clustered Expressway flaw requires persistent cookies and database-service access. Upgrade to the documented fixed release and review cluster trust boundaries.
Pulsar Manager Is Retired: Remove the Console and Recover Cluster Credentials
Every released Pulsar Manager version is affected by a critical unauthenticated credential-exposure flaw. No fix is planned: remove the console and assess cluster credential recovery.
Arista VCO Exploitation: Patch the Orchestrator, Review Every Portal Role
Arista confirms active exploitation of CVE-2026-114625. Even read-only VCO tenant access can escalate; patch the correct on-premises branch and preserve control-plane evidence.
SafePay Warning: Prove Your Backups Can Survive an Administrator Compromise
The joint SafePay warning describes credential-driven entry, data theft and backup disruption. Test whether recovery survives the loss of production administrator accounts.
TeamUpdraft Compromise: Check Every Connected WordPress Site for Persistence
TeamUpdraft’s October 22 update expands practical site checks after stolen cloud connection keys enabled malicious plugins and accounts. Key revocation is not proof of cleanup.
Railway Secrets Incident: Rotate Credentials, Then Check What They Could Reach
Railway urges all users to rotate secrets after possible environment-variable exposure. Map downstream access, verify revocation and investigate cloud persistence.
LiteLLM 1.107.0 Compromise: Rebuild the Environment, Recover the Credentials
Malicious LiteLLM wheels can steal secrets at Python startup. Scope exact artifacts, avoid retriggering suspect environments, and recover credentials separately from rebuilding.
GitLab Regex RCE: Patch the Server, Verify the Delivery Chain
GitLab’s CVSS 10.0 regex compiler flaw reaches back to version 7.0. Verify the correct fixed branch, plan migrations, and review CI/CD trust where compromise is suspected.
eMudhra CA Key Compromise: Check the Trust Stores Beyond Your Browser
Eight weak eMudhra intermediate CA keys exposed a trust gap beyond browsers. Inventory application verifiers, update CA bundles and runtimes, and confirm running workloads consume the fixes.
PHP2Shell: Patch the Runtime Behind Your Websites
Emergency PHP releases address two unauthenticated RCE flaws. Prioritize the serving runtime, replace vulnerable workers, and verify vendor backports—not just CMS updates or WAF coverage.
Trusted Notifications, Untrusted Instructions: Close the Email Content Gap
Cisco Talos reports phishing carried by legitimate order notifications and delivery reports. Practical controls for email inspection, callback verification and response.
BRONZE SANDCASTLE: Hunt the DLL Load Chain, Not the Trusted Executable
Sophos details BRONZE SANDCASTLE DLL sideloading and memory-resident payloads. Practical hunting and response priorities for lean security teams.
One Stolen Identity, Several SaaS Platforms: Respond Beyond the Mailbox
A Sophos case connects vishing, password recovery and a device-backed session to SharePoint downloads and a ServiceNow export. A practical cross-SaaS response plan.
Siemens Software Center ClickFix Attacks: Hunt Beyond the Trusted Signature
Siemens confirms active DLL-sideloading attacks. Update Software Center, investigate unexpected signed copies, and correlate process paths, persistence and network evidence.
BeyondTrust Authentication Bypass: Patch the Appliance, Review the Access
CISA confirms exploitation of BeyondTrust CVE-2026-102764. A practical response sequence for remote-support owners: verify remediation, preserve evidence, and investigate earlier access.
PEERSTITCH: Recover the Management Trust, Not Just the Firewall
PEERSTITCH research highlights the recovery gap after firewall-management compromise: patch the entry point, investigate managed devices, and replace exposed trust material.
CikaBika Bot: Detect the Document-to-Discord Attack Chain
CikaBika Bot turns a document lure into Discord-based remote control. Practical detection priorities for lean security teams, from shortcut execution to outbound service access.
ConnectWise Cloud Backup Incident: Revocation Is Not Tenant Recovery
ConnectWise suspended Cloud Backup after application identities were abused. A practical tenant-response guide covering persistence, evidence preservation, and backup continuity.
AOMEI Update Tampering Shows Why Clean URLs Cannot Close Endpoint Alerts
Google researchers documented brief AOMEI update-server tampering windows. A practical response guide for SMBs and government contractors: preserve event-time evidence and distinguish vendor remediation from endpoint recovery.
Third-Party VPN Access Shows Basic Controls Still Stop Bank Intrusions
A Unit 42 investigation into a European bank intrusion shows how vendor-managed gateway gaps, weak authentication, and noisy reconnaissance can create real business risk even when the attacker is not sophisticated.
Microsoft Patch Tuesday Record Shows Patch Triage Must Be Risk-Based
Microsoft’s October 2026 Patch Tuesday dropped a record 1,411 fixes, including an actively exploited Windows Shell flaw. SMBs and government contractors need a risk-based triage workflow, not a spreadsheet panic cycle.