Daily briefings on critical security disclosures, vulnerabilities, and threat intelligence.
Threat actors are actively deploying the open-source EDRSilencer tool to identify endpoint detection agents and weaponize the Windows Filtering Platform to drop outbound telemetry, blinding security operations centers without terminating processes or triggering anti-tamper alarms.
Read briefing →Security researchers uncovered a new Linux variant of North Korea's FASTCash malware, dubbed libMyFc.so, engineered to inject into banking payment switch daemons and manipulate ISO 8583 transaction messages to authorize fraudulent ATM cash withdrawals.
Read briefing →HiddenLayer researchers unveiled ShadowLogic, an attack manipulating neural network computational graphs to embed persistent, codeless backdoors that survive model fine-tuning and format conversion.
Read briefing →CISA warned that threat actors are exploiting unencrypted persistence cookies in F5 BIG-IP Local Traffic Manager to map internal network infrastructure, decoding backend pool member IP addresses and ports to stage targeted downstream attacks.
Read briefing →CISA warned that threat actors are actively exploiting CVE-2024-43468, a critical unauthenticated SQL injection flaw in Microsoft Configuration Manager that allows remote attackers to execute arbitrary commands with sysadmin privileges and compromise entire enterprise device fleets.
Read briefing →US and UK intelligence agencies issued a joint advisory warning that Russian SVR actors tracked as APT29 are conducting mass-scale opportunistic scanning and exploitation of unpatched JetBrains TeamCity and Zimbra Collaboration servers to compromise global government and defense networks.
Read briefing →GitLab released security updates addressing CVE-2024-9164, a critical flaw allowing unauthorized users to trigger CI/CD pipelines on arbitrary branches, bypassing repository branch protections to execute unauthorized code and expose sensitive deployment secrets.
Read briefing →CISA added CVE-2024-23113, a critical remote code execution flaw in the FortiOS FGFM daemon, to its Known Exploited Vulnerabilities catalog after observing active in-the-wild attacks targeting internet-facing Fortinet perimeter appliances.
Read briefing →The Internet Archive suffered a massive breach exposing 31 million user records after threat actors leveraged an exposed GitLab authentication token to access internal repositories, harvest database credentials, and modify client-facing JavaScript assets.
Read briefing →Iranian state-sponsored actor OilRig exploited a Windows kernel race condition flaw tracked as CVE-2024-30088 to escalate privileges to SYSTEM, deploying the STEALHOOK backdoor and malicious LSA password filters to exfiltrate credentials via Microsoft Exchange servers.
Read briefing →