Arista VeloCloud SQL Flaw Lets Read-Only Users Claim Operator Rights
CISA lists the on-prem VCO flaw as exploited. An authenticated tenant reader can reach operator privileges; compare your release with Arista's fixed builds.
Read article →Threat Analysis for Defenders
Nulltap™ reports on vulnerabilities, breaches, threat activity, and AI security, with practical guidance to help defenders act.
Latest Articles
Aokigahara Stealer Targets AI Sessions and Developer Credentials
Check Point maps local AI-tool sessions, Git and cloud secrets to a Windows stealer; a host match calls for credential rotation from a clean machine.
Read article →
PHP Advises Disabling Upload Progress After Emergency RCE Fixes
PHP patched two request-processing flaws, then warned of another rare code-execution path. Check the serving build and the upload-progress setting in every worker.
Read article →
Cisco Flags PHP Code-Execution Flaws in Expressway and Wireless Backhaul
Cisco names Expressway and URWB as affected by the PHP2shell flaws, with product releases still ahead. Sort deployed products by advisory status and protect administrator access.
Read article →
eMudhra CA Compromise Prompts pip and uv Trust Updates
Compromised intermediate keys threaten Python dependency downloads when a client trusts the affected chain. Update the downloader, its CA bundle, and the interpreter that seeds new environments.
Read article →
Palo Alto Networks Traces VPN Intrusion to Domain Controller Disk
GlobalProtect bypass reached vCenter in one Unit 42 case. Find successful gateway sessions, check cookie settings and update every cookie-using portal and gateway.
Read article →
Pathrunner Maps AWS IAM Paths to Other Identities’ Credentials
Datadog’s new framework tests whether one AWS identity can reach another. Use controlled tests to narrow permissions, then compare its event predictions with CloudTrail.
Read article →
Cisco Expressway Cluster Flaw Exposes Root Command Path
A persistent database cookie and unchecked cluster client certificates put clustered Expressway-C and Expressway-E devices at risk. Move affected releases to X15.5.20.
Read article →
eMudhra Weak Intermediate Keys Expose TLS and Code-Signing Trust
Eight eMudhra intermediate keys were recoverable. Browser blocks cover six TLS keys; check separately managed trust paths and rebuild Go services with fixed releases.
Read article →
LiteLLM Release Planted Credential Stealer in Seven Wheels
Python startup hooks in LiteLLM 1.107.0 wheels and container images collected secrets and launched a second, hourly code loader. Trace image digests, rebuild and rotate reachable keys.
Read article →
Attacker Using DeepSeek Steals Thousands of University Records
An AI-assisted actor stole more than 5,200 university records after accessing a weakly protected database. Trace WordPress login attempts and database exports separately.
Read article →
PHP Schedules Emergency Fixes for Two Leaked Critical Flaws
Two PHP flaws rated 9.2 leaked before fixes. Locate PHP in exposed sites and bundled software, watch worker child processes, and prepare for the vendor release.
Read article →
Plex Media Server Attacks Install Miners and Proxies on Exposed Hosts
Attackers chain four Plex flaws to run code on unpatched servers. Check the installed build, investigate Plex child processes and Codecs files, and rebuild compromised hosts.
Read article →Showing 1–13 of 264
Reader formats
Choose how you read.
Follow Nulltap by RSS or JSON, use the e-reader edition, browse the archive, or read from the terminal.
Command line
Read nulltap in your terminal.
Install once, then browse, search, and read without opening a browser.
Recommended
pipx install nulltapPython 3.10+pip:
python -m pip install nulltapStart reading
$ nulltap
Browse or search
$ nulltap topics
$ nulltap search "token theft"
Use the short view
$ nulltap read 2 --short
Get help
$ nulltap --help