Intel Feed
Cyber Threat IntelligencePage 2
Reports
Reporting archive — page 2
Showing 25–48 of 611 reports
KeyDrift on Cisco SD-WAN: Patch the Entry Point, Investigate the Controller
Talos's new KeyDrift analysis shows why Cisco SD-WAN response must pair verified fixes with controller compromise review and recovery of exposed trust material.
Postiz Token Forgery: Patch the Publisher, Review Organization Access
Postiz fixes a critical registered-user token-forgery flaw in 2.25.3. Upgrade, review organization authority and plan session and API-key recovery.
Brotli Enters CISA KEV: Patch Node.js and Trace Every Decompression Path
CISA now lists the Brotli flaw as known exploited. Update affected Node.js runtimes and inspect both inbound request decoding and externally fetched responses.
Wasmtime Sandbox Escape: Patch the Engine Behind Your Wasm Workloads
A critical Cranelift flaw can let crafted WebAssembly escape Wasmtime containment. Find embedded runtimes, deploy a fixed version and review host privileges.
Quest Quanum Incident: Protect Patient Data While Keeping Orders Moving
Quest confirms patient information was affected in the Quanum LSM incident. Separate confirmed exposure from unknown scope, and use verified continuity channels.
Pulsar Token Bypass: Check Anonymous Fallback and Patch Brokers
Apache fixes a critical Pulsar broker bypass involving unverified token roles and anonymous fallback. Check the required settings, patch, and validate authorization failures.
Cisco Expressway Root RCE: Patch the Cluster and Check Service Reachability
Cisco’s critical clustered Expressway flaw requires persistent cookies and database-service access. Upgrade to the documented fixed release and review cluster trust boundaries.
Pulsar Manager Is Retired: Remove the Console and Recover Cluster Credentials
Every released Pulsar Manager version is affected by a critical unauthenticated credential-exposure flaw. No fix is planned: remove the console and assess cluster credential recovery.
Arista VCO Exploitation: Patch the Orchestrator, Review Every Portal Role
Arista confirms active exploitation of CVE-2026-114625. Even read-only VCO tenant access can escalate; patch the correct on-premises branch and preserve control-plane evidence.
SafePay Warning: Prove Your Backups Can Survive an Administrator Compromise
The joint SafePay warning describes credential-driven entry, data theft and backup disruption. Test whether recovery survives the loss of production administrator accounts.
TeamUpdraft Compromise: Check Every Connected WordPress Site for Persistence
TeamUpdraft’s October 22 update expands practical site checks after stolen cloud connection keys enabled malicious plugins and accounts. Key revocation is not proof of cleanup.
Railway Secrets Incident: Rotate Credentials, Then Check What They Could Reach
Railway urges all users to rotate secrets after possible environment-variable exposure. Map downstream access, verify revocation and investigate cloud persistence.
LiteLLM 1.107.0 Compromise: Rebuild the Environment, Recover the Credentials
Malicious LiteLLM wheels can steal secrets at Python startup. Scope exact artifacts, avoid retriggering suspect environments, and recover credentials separately from rebuilding.
GitLab Regex RCE: Patch the Server, Verify the Delivery Chain
GitLab’s CVSS 10.0 regex compiler flaw reaches back to version 7.0. Verify the correct fixed branch, plan migrations, and review CI/CD trust where compromise is suspected.
eMudhra CA Key Compromise: Check the Trust Stores Beyond Your Browser
Eight weak eMudhra intermediate CA keys exposed a trust gap beyond browsers. Inventory application verifiers, update CA bundles and runtimes, and confirm running workloads consume the fixes.
PHP2Shell: Patch the Runtime Behind Your Websites
Emergency PHP releases address two unauthenticated RCE flaws. Prioritize the serving runtime, replace vulnerable workers, and verify vendor backports—not just CMS updates or WAF coverage.
Trusted Notifications, Untrusted Instructions: Close the Email Content Gap
Cisco Talos reports phishing carried by legitimate order notifications and delivery reports. Practical controls for email inspection, callback verification and response.
BRONZE SANDCASTLE: Hunt the DLL Load Chain, Not the Trusted Executable
Sophos details BRONZE SANDCASTLE DLL sideloading and memory-resident payloads. Practical hunting and response priorities for lean security teams.
One Stolen Identity, Several SaaS Platforms: Respond Beyond the Mailbox
A Sophos case connects vishing, password recovery and a device-backed session to SharePoint downloads and a ServiceNow export. A practical cross-SaaS response plan.
Siemens Software Center ClickFix Attacks: Hunt Beyond the Trusted Signature
Siemens confirms active DLL-sideloading attacks. Update Software Center, investigate unexpected signed copies, and correlate process paths, persistence and network evidence.
BeyondTrust Authentication Bypass: Patch the Appliance, Review the Access
CISA confirms exploitation of BeyondTrust CVE-2026-102764. A practical response sequence for remote-support owners: verify remediation, preserve evidence, and investigate earlier access.
PEERSTITCH: Recover the Management Trust, Not Just the Firewall
PEERSTITCH research highlights the recovery gap after firewall-management compromise: patch the entry point, investigate managed devices, and replace exposed trust material.
CikaBika Bot: Detect the Document-to-Discord Attack Chain
CikaBika Bot turns a document lure into Discord-based remote control. Practical detection priorities for lean security teams, from shortcut execution to outbound service access.
ConnectWise Cloud Backup Incident: Revocation Is Not Tenant Recovery
ConnectWise suspended Cloud Backup after application identities were abused. A practical tenant-response guide covering persistence, evidence preservation, and backup continuity.