ls ./archive --page 3
ReliaQuest names Qilin and a newer operation called Settra as exploiting a GlobalProtect authentication bypass that Palo Alto disclosed in May. Nothing about the vulnerability is new. What is worth reading is that patching does not close the sessions a forged cookie already opened.
Socket's latest GhostAction wave commits a credential-stealing GitHub Actions workflow straight to default branches. The payload is reusable, but the attackers read each repository's existing workflows first to learn which secret names to ask for. The October variant also sweeps the full git history.
Attackers used stolen credentials to reach DTU's identity system and pulled records going back two decades. The 200,000 figure in every headline is the size of the database, not a count of victims. DTU is notifying employees directly and leaving 160,000 former users to find out from the news.
Huntress saw attackers chaining two AhsayCBS flaws into SYSTEM-level code execution on 7 October, three days after NVD published them. There is no patch, every version through 10.3.4 is affected despite earlier reporting, and the remediation advice is to re-image from a trusted backup.
Comparitech's third-quarter ransomware count is the highest it has recorded. Nine out of ten entries in it are unconfirmed claims posted by the gangs themselves, which makes the number a measure of how much they are claiming as much as how much they are doing.
The FBI seized seven domains behind scanning and malware-delivery platforms run by a Chinese contractor, and CISA added five identifiers to its exploited-vulnerabilities catalog the same week. No coverage we found named them. They are in CISA's own feed, and most of them are a decade old.
The owner of MonsterCloud, a firm that sold ransomware recovery as an alternative to paying, has been charged with wire fraud. The indictment alleges he paid the attackers 8 million dollars for keys and billed victims 19 million. He has pleaded not guilty.
A critical flaw in LMCache, the key-value cache layer used in front of vLLM inference servers, lets an unauthenticated attacker run code with a single crafted message. There is a public proof of concept, no patched release, and the container images run as root.
CrowdStrike traced a data-theft campaign against South Korean financial firms to an operator driving ARTEX, an open-source agentic pentesting tool, across several large language models. The research exists because the attacker left their own working directories readable.
Three country-code registries were compromised and unauthorized HTTPS certificates were obtained for Google domains and others. No certificate authority broke a rule. Domain control validation proves control of a name, and for a while the attackers had it.
ESET's samples of MATCHBOIL, a downloader used by the Russia-aligned group UAC-0099 against Ukrainian targets, carry timestamps from April 2024 — more than a year before CERT-UA first documented the tool. Newer builds poll for a fresh payload every two minutes and refuse to run under analysis.
Apiiro counts 17,610 GitHub repositories in the revived FakeGit campaign, more than double July's figure. The scale did not come from mass registration: in about 34 hours the operator re-pointed repos that were already there, and in 97 percent of sampled commits the only thing touched was the README.
Bitdefender found an ad-fraud component shipped inside the firmware of low-cost Android handsets, posing as a core system app with permissions to install and remove software silently. Thousands of devices in more than 150 countries, and no way for the owner to uninstall it.
Double Counter, an anti-abuse bot used across large Discord communities, was breached on 4 October through a publicly reachable Metabase instance on an old host from its previous setup. The attacker forged an admin session, reached a cloud key, and copied records on about 28 million accounts.
Socket found sixteen Firefox extensions impersonating crypto wallets. Four were built from Rabby Wallet's actual codebase with the recovery-phrase import hooked to send secrets out; twelve were lighter copies of an OKX-styled interface. Both sets exfiltrated to Cloudflare Workers, and Mozilla has unpublished all sixteen.
Sungrow's iSolarCloud accepted a login request with login_type set to 5 and authenticated whoever the request named, ignoring the password. All four regional clouds were affected, no notification was sent, and the researcher's own line about continent-wide blackouts has been quoted into the official CVE description.
CloudSEK documents a Gentlemen ransomware affiliate who wired Model Context Protocol into his attack chain as an execution channel, reached every victim through stolen CI/CD secrets, and published the proceeds on his own leak site rather than the gang's. The investigation started with an open directory he left unauthenticated.
Danish authorities say unidentified parties misused a private company's legitimate access to the Central Person Register and stayed inside the limits that access permits. Names, addresses and CPR numbers for 8.8 million people, roughly four fifths of the register, were retrieved over about ten days in September.
Lumen's Black Lotus Labs tracked a malware family that does not carry its command-and-control address. It fetches a poem from GitHub, pulls four words out of fixed positions, and looks them up in a dictionary compiled into the binary. The operator has rewritten the poem eleven times since April.
A Kibana user with delegated package-management rights, and no Elasticsearch administrative privileges, could install a package that claimed a data stream identifier already belonging to someone else. Ownership was never checked, so another tenant's telemetry could be redirected through infrastructure the attacker controlled.
wolfSSH never verified that the elliptic curve in a server's host key matched the algorithm both sides had just negotiated. A machine-in-the-middle could swap in a key on a different curve, sign with its own private key, and be accepted with no error. Fixed in 1.6.0 — and it needs one more condition that is common in embedded code.
watchTowr published technical detail and working exploit code for the Atlassian file-read flaw. Previdian's honeypots saw exploitation attempts within two hours. Yesterday we argued the advisory's stated limitation was not one; what has changed since is that nobody even has to work the path out.
Checkmarx has documented an npm campaign running since August 2023 that delivered a remote access trojan and an information stealer through twelve packages. What kept it alive is not stealth. It is that the advisory databases security tooling reads never caught up, and three of the packages are still there.
Anthropic has folded Project Glasswing into a three-tier Cyber Verification Program, giving qualifying security professionals access to its models with reduced blocking on cyber tasks. It reports Glasswing partners found at least 129,000 verified vulnerabilities between April and July. The capability granted is the capability an attacker wants.