Sophos Urges Rules at Sensitive Uploads Before AI Judges Intent
Endpoint AI can flag unusual access, but a familiar-looking transfer may still be harmful. Put explicit policy at the upload and measure the review queue.
Latest articles
Google BoringSSL Fixes Two Certificate Name-Constraint Bypasses
Two legacy BoringSSL name checks were fixed in March; a URI case remains under coordination. Find the validator your product actually uses.
UAT-6275 uses a WinRAR flaw to plant a shell in CIS government attacks
Cisco Talos traces four delivery routes across nine countries. Hunt Startup-folder changes and unexpected PowerShell, then update affected Windows archive tools.
FBI Disrupts Laptop Farms Behind North Korean Remote Hires
CrowdStrike says fake employees used U.S. homes to run company laptops remotely. Inspect shipping changes, remote-access tools and hiring records together.
Fortinet FortiSIEM Flaw Lets Remote Attackers Run Code
Crafted packets can cross a file-path restriction in FortiSIEM 7.5.0. Upgrade to 7.5.1 and limit access to TCP/27918 while scheduling the change.
Bank Intruder Targets Update Server After Third-Party Gateway Entry
At a European bank, compromised credentials opened a third-party gateway route; months of scanning and password guessing preceded a blocked attempt against WSUS.
Attackers Hid PEERSTITCH in Fortinet Firewalls After Manager Breach
A stolen FortiManager archive helped attackers reach managed FortiGates; a memory-only implant linked logging and VPN processes. Check revisions and rotate trust material.
Microsoft and NVIDIA Map Open-Weight Model Risk to Enterprise Deployments
The joint guidance separates model evaluations from the permissions, data access and tools of the application that uses a model.
Volexity Volcano Recovers Browser Exploit Traces After Cleanup
A replayed Chrome-to-Windows intrusion left encoded script in free memory. Capture RAM early, then use host artifacts to guide wider collection.
Fortinet CLI Flaw Lets Privileged Attackers Change Appliance Files
CISA added a flaw affecting four Fortinet products to KEV. Match installed releases to Fortinet's fixes, then examine privileged CLI access and file changes.
ConnectWise Backup Credential Opens Graph Access in 162 Tenants
An abused vendor-held Cloud Backup credential obtained app-only Graph tokens. Find the service principal, disable sign-in, then inspect roles and added secrets.
Cisco Email Gateway Attachment Flaw Gives Attackers Root Access
Exploited file-write flaw reaches gateways using File Reputation and older scanner tools. Check each appliance's logs and scanner version before choosing an update or rebuild.
CL-UNK-1211 Plants PHP Web Shells on Government Linux Servers
Attackers changed PHP configuration to reload a web shell, stole passwords through a sudo alias and searched government mailboxes for social media access.