🖋️ Calendar Invites and Live Proxies: Inside a Google Session Hijacking Campaign 🖋️
📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
Since midAugust 2026, a phishing operation has been stealing live Google sessions from corporate users. Every check defenders normally lean on to judge a link came back clean, and the operator designed it that way on purpose. The Threat Research team at Material Security spotted the campaign and has since taken down hundreds of attacker domains in an effort the team calls Operation CloudFire.📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
🖋️ PTC Patches Critical Windchill and FlexPLM Flaw That Could Enable Remote Code Execution 🖋️
📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
PTC has released patches for a new critical vulnerability impacting Windchill and FlexPLM software that, if successfully exploited, could result in remote code execution. The security flaw, tracked as CVE2026126325, carries a CVSS v4 score of 9.2 out of a maximum of 10.0. It has been described as a case of improper input validation and deserialization of untrusted data that could result in.📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
🖋️ Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover 🖋️
📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
A critical flaw in MongoDB Server allows an unauthenticated attacker to send two requests that trigger a crash on the database server. The crash occurs only if that server is later chosen to take over as the main server while it still lacks some recent changes. MongoDB, the company that makes the database, released fixed versions earlier this week. The affected servers are members of a replica.📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
🖋️ Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data 🖋️
📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
A flaw fixed in Node.js this week lets unauthenticated clients crash servers that use the runtime's builtin HTTP2 support on the 24.x and 26.x release lines. A second HTTP2 flaw can cause a server to send a client pieces of its memory, including responses intended for other connections. Fixed versions were released for all three supported lines 22.23.5, 24.22.3, and 26.13.1. The crash.📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
🖋️ Attacker Used 4,837 Hijacked GitHub Accounts to Run a CI Secret Stealer in 1,806+ Repositories 🖋️
📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
Starting Tuesday, an attacker used stolen credentials for 4,837 GitHub accounts to plant a secret stealer in repositories those accounts could write to, according to Aikido Security, a security software company. The stealer is built to take the secrets and cloud credentials that a repository's CI workflows can reach. It ran in at least 1,806 repositories, where the attacker has likely collected.📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
🖋️ Critical Apache HTTP/2 Flaw Could Let Unauthenticated Attackers Execute Code Remotely 🖋️
📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
A critical flaw in Apache HTTP Server's HTTP2 module, modhttp2, can let a remote attacker run code on the server. Tracked as CVE2026119618, it affects versions 2.4.55 through 2.4.70 and is fixed in version 2.4.71, released yesterday. Only servers with HTTP2 enabled are affected, according to Red Hat, which ships the server as part of Red Hat Enterprise Linux. An attacker who can reach the.📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
🖋️ ScreenConnect Attacks Target at Least 288 Endpoints Across 48 Organizations With Rogue Clients 🖋️
📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
ConnectWise has taken the precautionary step of disabling five thirdparty extensions in partner environments following reports of unauthorized access. In an advisory posted on its site, the company said there is no evidence that the incident involves a compromise of its infrastructure or a vulnerability in the ScreenConnect software. "Our initial assessment suggests the activity may involve.📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
📔 Weak Passwords Expose SQL Servers to Cryptominer and Gh0st RAT 📔
📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
Fortinet finds weak SQL Server passwords used to deliver a miner and Gh0st RAT.📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
Infosecurity Magazine
Weak Passwords Expose SQL Servers to Cryptominer and Gh0st RAT
Fortinet finds weak SQL Server passwords used to deliver a miner and Gh0st RAT
❤2
📔 Hacked Asian Telcos Used to Intercept Taiwanese Calls and Texts 📔
📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
Enea linked SilentAir and Liminal Panda to attacks on Asian mobile operators.📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
Infosecurity Magazine
Hacked Asian Telcos Used to Intercept Taiwanese Calls and Texts
Enea linked SilentAir and Liminal Panda to attacks on Asian mobile operators
📔 Lego Takes BrickLink Marketplace Offline After Detecting Unusual Activity 📔
📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
Lego has taken its BrickLink Marketplace offline after detecting unusual activity as the company investigates the incident.📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
Infosecurity Magazine
Lego Takes BrickLink Marketplace Offline
Lego has taken its BrickLink Marketplace offline after detecting unusual activity as the company investigates the incident
📔 Security Teams Must Shift from Patching to Mitigation in the AI Era 📔
📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
Symantecs Dick OBrien says the rapid closure of the patch window means organizations must move beyond patching and adopt an assume exploit mindset.📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
Infosecurity Magazine
Security Teams Must Shift from Patching to Mitigation in the AI Era
Symantec’s Dick O’Brien says the rapid closure of the patch window means organizations must move beyond patching and adopt an assume exploit mindset
📔 NCSC Launches Cyber Adversary Testing to Boost Resilience 📔
📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
The UKs National Cyber Security Centre has launched a new Cyber Adversary Simulation CyAS scheme.📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
Infosecurity Magazine
NCSC Launches Cyber Adversary Testing to Help Build Resilience
The UK’s National Cyber Security Centre has launched a new Cyber Adversary Simulation (CyAS) scheme
📔 Maersk Reveals Data Breach as Extortion Group Demands $5m 📔
📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
Maersk has revealed a threat actor extracted data from one of its legacy systems.📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
Infosecurity Magazine
Maersk Reveals Data Breach as Extortion Group Demands $5m
Maersk has revealed a threat actor extracted data from one of its legacy systems
🦅 Can Agentic AI Investigate a Phishing Campaign? Evidence Walkthrough 🦅
📖 Read more.
🔗 Via "CYBLE"
----------
👁️ Seen on @cibsecurity
Yes, with a human signing off. An agentic AI can run most of a phishing investigation on its own. It can pull domain registration records, open the lure safely, pivot to related infrastructure, extract indicators and write up a verdict with the evidence attached. What it shouldn't do yet is act on that verdict unchecked, because attackers are already hiding instructions inside phishing emails meant for the AI doing the reading. The evidence for both halves of that answer is now public. Microsoft's randomized trial of 167 security analysts found that its phishing triage agent made them faster and more accurate. Barracuda reported on Oct. 7, that one phishing email can carry a lure for the human and a hidden prompt for the AI in the same message. This post walks through what an ag...📖 Read more.
🔗 Via "CYBLE"
----------
👁️ Seen on @cibsecurity
🕵️♂️ Getting Past the Post-Quantum Cryptography Discovery Phase 🕵️♂️
📖 Read more.
🔗 Via "Dark Reading"
----------
👁️ Seen on @cibsecurity
Most organizations haven't sorted out their cryptographic estate enough to even know where they'd start with postquantum cryptography PQC.📖 Read more.
🔗 Via "Dark Reading"
----------
👁️ Seen on @cibsecurity
Dark Reading
Getting Past the Post-Quantum Cryptography Discovery Phase
Most organizations haven't sorted out their cryptographic estate enough to even know where they'd start with post-quantum cryptography (PQC).
👍1
🖋️ Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files 🖋️
📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously reported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA. The activity, detailed by Check Point, began on October 30, 2026, and targeted Israeli organizations, with a broader followup wave.📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
🖋️ Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files 🖋️
📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously reported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA. The activity, detailed by Check Point, began on October 30, 2026, and targeted Israeli organizations, with a broader followup wave.📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
🖋️ Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files 🖋️
📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
An unknown threat actor has been observed targeting unpatched Check Point Security Gateways to obtain initial access via the PHP2Shell vulnerabilities and then a previously reported local privilege escalation flaw in Gaia OS to deploy a backdoor called TSGA. The activity, detailed by Check Point, began on October 30, 2026, and targeted Israeli organizations, with a broader followup wave.📖 Read more.
🔗 Via "The Hacker News"
----------
👁️ Seen on @cibsecurity
📔 AI Set to Revolutionize Ransomware Following “Stagnant” Few Years 📔
📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
TrendAIs Bob McArdle said ransomware techniques will change significantly in the next year, with AI making attacks more dangerous and profitable.📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
Infosecurity Magazine
AI Set to Revolutionize Ransomware Following “Stagnant” Few Years
TrendAI’s Bob McArdle said ransomware techniques will change significantly in the next year, with AI making attacks more dangerous and profitable
📔 AI Set to Revolutionize Ransomware Following “Stagnant” Few Years 📔
📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
TrendAIs Bob McArdle said ransomware techniques will change significantly in the next year, with AI making attacks more dangerous and profitable.📖 Read more.
🔗 Via "Infosecurity Magazine"
----------
👁️ Seen on @cibsecurity
Infosecurity Magazine
AI Set to Revolutionize Ransomware Following “Stagnant” Few Years
TrendAI’s Bob McArdle said ransomware techniques will change significantly in the next year, with AI making attacks more dangerous and profitable