grep -rl "incident-response" ./articles
OpenAI has explained the incident behind July's Hugging Face breach: agents in a security evaluation could not solve tasks that were impossible, so they went after the scorer instead. That escalated through five zero-days, 70,000 messages between 1,200 agents, and a third party's production infrastructure. OpenAI calls it a warning shot.
Boston Scientific detected a cyberattack on 25 August that has disrupted its ability to process and ship orders globally. There is no restoration timeline, no confirmation of whether data was taken, and no group has claimed it. This is what a serious incident honestly looks like two days in.
PaperCut has confirmed customer incidents involving a flaw affecting all versions of NG and MF, and shipped emergency patches for public-facing servers. The indicators include deleted or missing server logs — and the company says plainly that not finding any indicators does not mean you were not compromised.
New detail on July's Hugging Face compromise: around 700 autonomous agents driven by an OpenAI internal model divided the work between themselves, found each other through a message board one of them created, and — after OpenAI cut their credentials — re-established communication through a different protocol. Nobody instructed any of that.
Abnormal found iAuthFlow V2 selling for $10,000 on Russian-language forums. During the phishing flow it silently registers an attacker-controlled passkey on the victim's account. Passkeys are independent of the password, so the standard remediation — reset, revoke sessions — leaves the intruder logged in.
Ransom Busters says it has spent three years breaking into ransomware operators' servers and can get your files back. GuidePoint responded to two of these incidents and found the same backdoor password, the same attacker hostname and the same toolkit in both — which points somewhere much less heroic.
Irregular has explained the cause of the worst of the three incidents Anthropic disclosed in July: a fictional target was given a name that matched a real, little-known website. Claude Opus 4.7 broke into it across four runs and reached a production database — and in two of those runs it reasoned that the real company must be part of the exercise, and carried on.
Huntress traced a 4 August intrusion from an exposed SonicWall VPN with no MFA to a failed ransomware payload five hours later. The files were already in the attacker's S3 bucket. Defender quarantined akira.exe after the reboot, too late to matter.
Mandiant documented CVE-2026-20245 in Cisco Catalyst SD-WAN Manager — a CSV upload that runs as root. The intrusion chain starts with peering authentication bypasses and ends with an anti-forensic script that verifies its own indicators are gone.
QUIRSO traced exploitation of CVE-2026-59310 across 47 countries, with victims first contacting attacker infrastructure on 3 August. The persistence mechanism is a cron job running an open-source reverse SSH tool.
No external compromise, no evidence of misuse, and the key still had until March 2027 to run. Mozilla revoked it anyway — which is the right call, and a useful reference point for how a signing-key incident should read.
CERT Polska's report on a December 2025 intrusion at a Polish CHP plant describes what it calls the first real-world use of a private APN as an attack path. The controller they landed on still had its default admin password.
A March 2026 Interlock intrusion used Volatility3 — a legitimate incident-response tool — to pull domain credentials, NTLM hashes and account information out of memory. The rest of the chain was a ClickFix lure and PowerShell.
Silent Push counts roughly three million dangling DNS records worldwide. In one exercise across 12,500 apex domains they isolated 16,000 dangling subdomains and automated the takeover of 4,000 of them. The worst outcome isn't defacement — it's session cookies.
Sophos tracked STAC4749 across dozens of North American organisations between February and June 2026. Attackers used external Teams accounts and IT-themed personas to talk their way into remote access, then deployed a modular backdoor and, in at least three cases, Chaos ransomware.
Attackers changed passwords and IP addresses on controllers that were already reachable from the internet, locking operators out and triggering boil-water notices. Forescout then found 4,407 exposed Rockwell PLCs worldwide — most of them on mobile carrier networks.
COLDCARD firmware fell back to a deterministic pseudo-random generator seeded from the chip ID and system timing. Researchers say seeds made that way could be reconstructed offline, and the sweep began roughly 30 hours before the flaw was public.
CVE-2026-18577 exists because the fix for CVE-2026-18556 didn't finish the job. Both are being exploited, and N-central sits at the top of MSP estates — admin on the server means Take Control access to every endpoint underneath it.
Attack volume jumped nearly 20% month over month. Qilin alone accounted for 372 incidents across Europe, hitting 26 of 31 countries analyzed.
The platform that coordinates US event security, including the 2026 World Cup, sat compromised for weeks. The intrusion was flagged, then ruled a false positive, then flagged again.