{
  "site": "nulltap",
  "description": "Independent reporting on vulnerabilities, breaches, threat activity, and AI security helps defenders understand threats and make informed decisions.",
  "feed_url": "https://nulltap.com/feed.json",
  "archive_index_url": "https://nulltap.com/archive/index.json",
  "feed_limit": 100,
  "topics": [
    {
      "id": "endpoint",
      "label": "endpoint",
      "description": "Endpoint security, malware, device controls, and host visibility."
    },
    {
      "id": "cloud",
      "label": "cloud",
      "description": "Cloud platforms, SaaS, containers, and infrastructure."
    },
    {
      "id": "network",
      "label": "network",
      "description": "Network activity, protocols, infrastructure, and detection."
    },
    {
      "id": "identity",
      "label": "identity",
      "description": "Authentication, access, credentials, and identity systems."
    },
    {
      "id": "appsec",
      "label": "appsec",
      "description": "Software vulnerabilities, dependencies, and application security."
    },
    {
      "id": "ai",
      "label": "AI",
      "description": "AI systems, model security, agent abuse, and attacks that use generative tools."
    },
    {
      "id": "threats",
      "label": "threats",
      "description": "Threat actors, malware campaigns, phishing, exploitation, and incident activity."
    }
  ],
  "archives": [
    {
      "year": 2026,
      "count": 246,
      "feed_url": "https://nulltap.com/archive/2026.json",
      "page_url": "https://nulltap.com/archive/2026/"
    }
  ],
  "items": [
    {
      "id": "2026-10-19-sophos-intent-controls-sensitive-uploads",
      "url": "https://nulltap.com/p/sophos-intent-controls-sensitive-uploads/",
      "content_url": "https://nulltap.com/api/articles/sophos-intent-controls-sensitive-uploads.json",
      "title": "Sophos Urges Rules at Sensitive Uploads Before AI Judges Intent",
      "summary": "Endpoint AI can flag unusual access, but a familiar-looking transfer may still be harmful. Put explicit policy at the upload and measure the review queue.",
      "date_published": "2026-10-19T10:49:31.988Z",
      "tags": [
        "identity",
        "ai"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/sophos-intent-controls-sensitive-uploads/tile.webp?v=fe7c4a6df993"
    },
    {
      "id": "2026-10-18-google-boringssl-certificate-name-limits",
      "url": "https://nulltap.com/p/google-boringssl-certificate-name-limits/",
      "content_url": "https://nulltap.com/api/articles/google-boringssl-certificate-name-limits.json",
      "title": "Google BoringSSL Fixes Two Certificate Name-Constraint Bypasses",
      "summary": "Two legacy BoringSSL name checks were fixed in March; a URI case remains under coordination. Find the validator your product actually uses.",
      "date_published": "2026-10-18T23:03:27.859Z",
      "tags": [
        "appsec",
        "identity"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/google-boringssl-certificate-name-limits/tile.webp?v=e5bf13f78c96"
    },
    {
      "id": "2026-10-18-uat-6275-winrar-cis-government-shells",
      "url": "https://nulltap.com/p/uat-6275-winrar-cis-government-shells/",
      "content_url": "https://nulltap.com/api/articles/uat-6275-winrar-cis-government-shells.json",
      "title": "UAT-6275 uses a WinRAR flaw to plant a shell in CIS government attacks",
      "summary": "Cisco Talos traces four delivery routes across nine countries. Hunt Startup-folder changes and unexpected PowerShell, then update affected Windows archive tools.",
      "date_published": "2026-10-18T22:57:27.936Z",
      "tags": [
        "threats",
        "endpoint"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/uat-6275-winrar-cis-government-shells/tile.webp?v=fde341f89f1a"
    },
    {
      "id": "2026-10-18-fbi-disrupts-north-korean-laptop-farms",
      "url": "https://nulltap.com/p/fbi-disrupts-north-korean-laptop-farms/",
      "content_url": "https://nulltap.com/api/articles/fbi-disrupts-north-korean-laptop-farms.json",
      "title": "FBI Disrupts Laptop Farms Behind North Korean Remote Hires",
      "summary": "CrowdStrike says fake employees used U.S. homes to run company laptops remotely. Inspect shipping changes, remote-access tools and hiring records together.",
      "date_published": "2026-10-18T16:43:24.841Z",
      "tags": [
        "identity",
        "endpoint",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/fbi-disrupts-north-korean-laptop-farms/tile.webp?v=3474b96a062a"
    },
    {
      "id": "2026-10-18-fortinet-fortisiem-packet-code-execution",
      "url": "https://nulltap.com/p/fortinet-fortisiem-packet-code-execution/",
      "content_url": "https://nulltap.com/api/articles/fortinet-fortisiem-packet-code-execution.json",
      "title": "Fortinet FortiSIEM Flaw Lets Remote Attackers Run Code",
      "summary": "Crafted packets can cross a file-path restriction in FortiSIEM 7.5.0. Upgrade to 7.5.1 and limit access to TCP/27918 while scheduling the change.",
      "date_published": "2026-10-18T15:44:55.914Z",
      "tags": [
        "network",
        "appsec"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/fortinet-fortisiem-packet-code-execution/tile.webp?v=2dd4302212fb"
    },
    {
      "id": "2026-10-18-unit42-bank-gateway-wsus-attempt",
      "url": "https://nulltap.com/p/unit42-bank-gateway-wsus-attempt/",
      "content_url": "https://nulltap.com/api/articles/unit42-bank-gateway-wsus-attempt.json",
      "title": "Bank Intruder Targets Update Server After Third-Party Gateway Entry",
      "summary": "At a European bank, compromised credentials opened a third-party gateway route; months of scanning and password guessing preceded a blocked attempt against WSUS.",
      "date_published": "2026-10-18T10:28:36.438Z",
      "tags": [
        "network",
        "identity",
        "endpoint"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/unit42-bank-gateway-wsus-attempt/tile.webp?v=8cff589c5027"
    },
    {
      "id": "2026-10-17-fortinet-peerstitch-firewall-implant",
      "url": "https://nulltap.com/p/fortinet-peerstitch-firewall-implant/",
      "content_url": "https://nulltap.com/api/articles/fortinet-peerstitch-firewall-implant.json",
      "title": "Attackers Hid PEERSTITCH in Fortinet Firewalls After Manager Breach",
      "summary": "A stolen FortiManager archive helped attackers reach managed FortiGates; a memory-only implant linked logging and VPN processes. Check revisions and rotate trust material.",
      "date_published": "2026-10-17T22:38:31.720Z",
      "tags": [
        "network",
        "threats"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/fortinet-peerstitch-firewall-implant/tile.webp?v=f8e13b89c7b5"
    },
    {
      "id": "2026-10-17-microsoft-nvidia-open-weight-model-risk",
      "url": "https://nulltap.com/p/microsoft-nvidia-open-weight-model-risk/",
      "content_url": "https://nulltap.com/api/articles/microsoft-nvidia-open-weight-model-risk.json",
      "title": "Microsoft and NVIDIA Map Open-Weight Model Risk to Enterprise Deployments",
      "summary": "The joint guidance separates model evaluations from the permissions, data access and tools of the application that uses a model.",
      "date_published": "2026-10-17T19:28:29.538Z",
      "tags": [
        "ai",
        "appsec"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/microsoft-nvidia-open-weight-model-risk/tile.webp?v=38256fd59b58"
    },
    {
      "id": "2026-10-17-volexity-volcano-recovers-browser-traces",
      "url": "https://nulltap.com/p/volexity-volcano-recovers-browser-traces/",
      "content_url": "https://nulltap.com/api/articles/volexity-volcano-recovers-browser-traces.json",
      "title": "Volexity Volcano Recovers Browser Exploit Traces After Cleanup",
      "summary": "A replayed Chrome-to-Windows intrusion left encoded script in free memory. Capture RAM early, then use host artifacts to guide wider collection.",
      "date_published": "2026-10-17T16:30:29.268Z",
      "tags": [
        "endpoint",
        "threats",
        "ai"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/volexity-volcano-recovers-browser-traces/tile.webp?v=614034feb6ba"
    },
    {
      "id": "2026-10-17-fortinet-cli-file-traversal",
      "url": "https://nulltap.com/p/fortinet-cli-file-traversal/",
      "content_url": "https://nulltap.com/api/articles/fortinet-cli-file-traversal.json",
      "title": "Fortinet CLI Flaw Lets Privileged Attackers Change Appliance Files",
      "summary": "CISA added a flaw affecting four Fortinet products to KEV. Match installed releases to Fortinet's fixes, then examine privileged CLI access and file changes.",
      "date_published": "2026-10-17T13:30:28.445Z",
      "tags": [
        "network",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/fortinet-cli-file-traversal/tile.webp?v=56e1f7147979"
    },
    {
      "id": "2026-10-17-connectwise-backup-tenant-access",
      "url": "https://nulltap.com/p/connectwise-backup-tenant-access/",
      "content_url": "https://nulltap.com/api/articles/connectwise-backup-tenant-access.json",
      "title": "ConnectWise Backup Credential Opens Graph Access in 162 Tenants",
      "summary": "An abused vendor-held Cloud Backup credential obtained app-only Graph tokens. Find the service principal, disable sign-in, then inspect roles and added secrets.",
      "date_published": "2026-10-17T10:38:27.720Z",
      "tags": [
        "cloud",
        "identity"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/connectwise-backup-tenant-access/tile.webp?v=35c448cf3494"
    },
    {
      "id": "2026-10-16-cisco-email-attachment-root-write",
      "url": "https://nulltap.com/p/cisco-email-attachment-root-write/",
      "content_url": "https://nulltap.com/api/articles/cisco-email-attachment-root-write.json",
      "title": "Cisco Email Gateway Attachment Flaw Gives Attackers Root Access",
      "summary": "Exploited file-write flaw reaches gateways using File Reputation and older scanner tools. Check each appliance's logs and scanner version before choosing an update or rebuild.",
      "date_published": "2026-10-16T22:36:22.665Z",
      "tags": [
        "network",
        "threats"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/cisco-email-attachment-root-write/tile.webp?v=6aac798fe50e"
    },
    {
      "id": "2026-10-16-cl-unk-1211-government-php-web-shells",
      "url": "https://nulltap.com/p/cl-unk-1211-government-php-web-shells/",
      "content_url": "https://nulltap.com/api/articles/cl-unk-1211-government-php-web-shells.json",
      "title": "CL-UNK-1211 Plants PHP Web Shells on Government Linux Servers",
      "summary": "Attackers changed PHP configuration to reload a web shell, stole passwords through a sudo alias and searched government mailboxes for social media access.",
      "date_published": "2026-10-16T19:38:21.924Z",
      "tags": [
        "threats",
        "ai"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/cl-unk-1211-government-php-web-shells/tile.webp?v=f98837f9cfb9"
    },
    {
      "id": "2026-10-16-aomei-update-tampering-backdoors",
      "url": "https://nulltap.com/p/aomei-update-tampering-backdoors/",
      "content_url": "https://nulltap.com/api/articles/aomei-update-tampering-backdoors.json",
      "title": "Attackers Briefly Hijacked AOMEI Updates to Plant Backdoors",
      "summary": "UNC7017 changed two AOMEI configuration files for minutes at a time. Hunt updater-launched files and scheduled tasks even after the vendor restored its servers.",
      "date_published": "2026-10-16T16:36:20.983Z",
      "tags": [
        "endpoint",
        "threats"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/aomei-update-tampering-backdoors/tile.webp?v=d9120f3dfcc9"
    },
    {
      "id": "2026-10-16-beyondtrust-armory-castle-root-persistence",
      "url": "https://nulltap.com/p/beyondtrust-armory-castle-root-persistence/",
      "content_url": "https://nulltap.com/api/articles/beyondtrust-armory-castle-root-persistence.json",
      "title": "ARMORY CASTLE Uses BeyondTrust Zero-Day to Keep Root Access",
      "summary": "The actor exploited Remote Support, installed a root backdoor and reached managed endpoints. Patch BT26-05, then investigate appliance persistence and sessions.",
      "date_published": "2026-10-16T13:30:18.989Z",
      "tags": [
        "network",
        "identity",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/beyondtrust-armory-castle-root-persistence/tile.webp?v=4dd09f05c147"
    },
    {
      "id": "2026-10-16-fortinet-fortisandbox-gui-login-bypass",
      "url": "https://nulltap.com/p/fortinet-fortisandbox-gui-login-bypass/",
      "content_url": "https://nulltap.com/api/articles/fortinet-fortisandbox-gui-login-bypass.json",
      "title": "Fortinet FortiSandbox Flaw Lets Remote Callers Bypass GUI Login",
      "summary": "Crafted HTTP requests can bypass FortiSandbox management login. Check appliance and PaaS versions, upgrade affected branches and restrict GUI reachability.",
      "date_published": "2026-10-16T10:32:17.736Z",
      "tags": [
        "network",
        "appsec"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/fortinet-fortisandbox-gui-login-bypass/tile.webp?v=1b96bdc81c0e"
    },
    {
      "id": "2026-10-15-tls-libraries-certificate-name-checks",
      "url": "https://nulltap.com/p/tls-libraries-certificate-name-checks/",
      "content_url": "https://nulltap.com/api/articles/tls-libraries-certificate-name-checks.json",
      "title": "TLS Libraries Disagree on Which Signed Certificates Pass Name Restrictions",
      "summary": "The same signed certificate can pass one validator and fail another. Test the actual TLS path, update affected libraries and keep issued names explicit.",
      "date_published": "2026-10-15T22:38:13.421Z",
      "tags": [
        "identity",
        "network"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/tls-libraries-certificate-name-checks/tile.webp?v=2f8d5e581351"
    },
    {
      "id": "2026-10-15-komodo-periphery-host-commands",
      "url": "https://nulltap.com/p/komodo-periphery-host-commands/",
      "content_url": "https://nulltap.com/api/articles/komodo-periphery-host-commands.json",
      "title": "Komodo Log Access Lets Restricted Users Run Commands on Managed Hosts",
      "summary": "Komodo Periphery passes some restricted-user requests to a shell on managed servers. Upgrade agents to 2.3.0 and review Logs and Execute grants.",
      "date_published": "2026-10-15T19:46:11.861Z",
      "tags": [
        "cloud",
        "appsec"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/komodo-periphery-host-commands/tile.webp?v=b0cec2b15f70"
    },
    {
      "id": "2026-10-15-lowcoder-tenant-query-access",
      "url": "https://nulltap.com/p/lowcoder-tenant-query-access/",
      "content_url": "https://nulltap.com/api/articles/lowcoder-tenant-query-access.json",
      "title": "Lowcoder Flaw Lets One Tenant Run Another Tenant's Saved Queries",
      "summary": "An admin or developer in one organization can reach another's Query Library on a shared instance. Restrict the affected API while a security update is pending.",
      "date_published": "2026-10-15T16:52:10.810Z",
      "tags": [
        "appsec",
        "cloud"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/lowcoder-tenant-query-access/tile.webp?v=d693994fead8"
    },
    {
      "id": "2026-10-15-bisheng-sso-admin-tokens",
      "url": "https://nulltap.com/p/bisheng-sso-admin-tokens/",
      "content_url": "https://nulltap.com/api/articles/bisheng-sso-admin-tokens.json",
      "title": "Bisheng SSO Issues Admin Tokens Without Checking the Caller",
      "summary": "The legacy SSO route issues a JWT for a supplied username and remains unpatched; separate cross-user assistant and workflow flaws have release-specific fixes.",
      "date_published": "2026-10-15T13:34:09.779Z",
      "tags": [
        "identity",
        "appsec",
        "ai"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/bisheng-sso-admin-tokens/tile.webp?v=fb29119e60fd"
    },
    {
      "id": "2026-10-15-cisco-email-hardening-exploited-flaws",
      "url": "https://nulltap.com/p/cisco-email-hardening-exploited-flaws/",
      "content_url": "https://nulltap.com/api/articles/cisco-email-hardening-exploited-flaws.json",
      "title": "Cisco Email Hardening Fixes Five Flaw Groups, Including Two Exploited Issues",
      "summary": "Cisco updates Secure Email Gateway and Secure Email and Web Manager across five weakness groups. Compare each appliance's build with its product-specific fixed release.",
      "date_published": "2026-10-15T10:42:08.916Z",
      "tags": [
        "network"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/cisco-email-hardening-exploited-flaws/tile.webp?v=9602aacf4bdf"
    },
    {
      "id": "2026-10-14-palo-alto-pan-os-management-root-code",
      "url": "https://nulltap.com/p/palo-alto-pan-os-management-root-code/",
      "content_url": "https://nulltap.com/api/articles/palo-alto-pan-os-management-root-code.json",
      "title": "Palo Alto Networks PAN-OS Flaw Lets Attackers Run Code as Root",
      "summary": "Limited exploitation targets authenticated access to PAN-OS management. Compare installed hotfixes, restrict the admin path and inspect three vendor-listed IPs.",
      "date_published": "2026-10-14T22:36:01.357Z",
      "tags": [
        "network",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/palo-alto-pan-os-management-root-code/tile.webp?v=78b566f27b71"
    },
    {
      "id": "2026-10-14-yam-store-cloud-tenants-phishing-kits",
      "url": "https://nulltap.com/p/yam-store-cloud-tenants-phishing-kits/",
      "content_url": "https://nulltap.com/api/articles/yam-store-cloud-tenants-phishing-kits.json",
      "title": "YAM Store sells Microsoft and Google cloud access to phishing crews",
      "summary": "Microsoft traces a broker reselling cloud tenant access and storage to phishing kits. Examine app credentials, privileged grants and hosted files in affected tenants.",
      "date_published": "2026-10-14T18:58:02.201Z",
      "tags": [
        "cloud",
        "identity",
        "threats"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/yam-store-cloud-tenants-phishing-kits/tile.webp?v=bbabe51d1304"
    },
    {
      "id": "2026-10-14-microsoft-windows-file-warning-bypass",
      "url": "https://nulltap.com/p/microsoft-windows-file-warning-bypass/",
      "content_url": "https://nulltap.com/api/articles/microsoft-windows-file-warning-bypass.json",
      "title": "Microsoft Patches Exploited Windows File Warning Bypass",
      "summary": "The October updates address an exploited Windows Shell bypass and separate unauthenticated DHCP Server code execution. Check installed builds on endpoints and DHCP hosts.",
      "date_published": "2026-10-14T18:54:00.940Z",
      "tags": [
        "endpoint",
        "network"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/microsoft-windows-file-warning-bypass/tile.webp?v=53710260ab99"
    },
    {
      "id": "2026-10-14-watchguard-vpn-fake-download-credentials",
      "url": "https://nulltap.com/p/watchguard-vpn-fake-download-credentials/",
      "content_url": "https://nulltap.com/api/articles/watchguard-vpn-fake-download-credentials.json",
      "title": "Fake WatchGuard VPN download takes passwords before serving the real client",
      "summary": "A lookalike download page collects the VPN server and credentials twice, then starts a signed WatchGuard installer. Check browser history and VPN logins.",
      "date_published": "2026-10-14T18:48:00.611Z",
      "tags": [
        "identity",
        "network",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/watchguard-vpn-fake-download-credentials/tile.webp?v=43b160de5778"
    },
    {
      "id": "2026-10-13-microsoft-windows-shell-exploited-bypass",
      "url": "https://nulltap.com/p/microsoft-windows-shell-exploited-bypass/",
      "content_url": "https://nulltap.com/api/articles/microsoft-windows-shell-exploited-bypass.json",
      "title": "Microsoft Windows Shell flaw lands in CISA exploited catalog",
      "summary": "CISA flags active exploitation of a Windows Shell security bypass. Compare affected desktop and server builds with Microsoft's CVE record and prioritize updates.",
      "date_published": "2026-10-13T22:37:55.761Z",
      "tags": [
        "endpoint"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/microsoft-windows-shell-exploited-bypass/tile.webp?v=83a4d089f9b1"
    },
    {
      "id": "2026-10-13-shopware-media-upload-admin-token",
      "url": "https://nulltap.com/p/shopware-media-upload-admin-token/",
      "content_url": "https://nulltap.com/api/articles/shopware-media-upload-admin-token.json",
      "title": "Shopware media uploads expose admin tokens to stored XSS",
      "summary": "An uploaded HTML file can run in a Shopware administrator's browser. Restrict media creation or block HTML uploads while checking who can reach existing media.",
      "date_published": "2026-10-13T19:35:53.558Z",
      "tags": [
        "appsec",
        "identity"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/shopware-media-upload-admin-token/tile.webp?v=04cee263222e"
    },
    {
      "id": "2026-10-13-ivanti-vpn-root-credential-theft",
      "url": "https://nulltap.com/p/ivanti-vpn-root-credential-theft/",
      "content_url": "https://nulltap.com/api/articles/ivanti-vpn-root-credential-theft.json",
      "title": "Ivanti VPN Zero-Days Let UTA0576 Reach Root and Steal Credentials",
      "summary": "A patched-at-the-time Connect Secure VPN fell to a three-flaw chain. Upgrade affected branches and investigate memory, LDAP traffic and movement from the appliance.",
      "date_published": "2026-10-13T16:41:51.744Z",
      "tags": [
        "network",
        "identity",
        "threats"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/ivanti-vpn-root-credential-theft/tile.webp?v=6691519386ad"
    },
    {
      "id": "2026-10-13-gitlab-ci-regex-server-code",
      "url": "https://nulltap.com/p/gitlab-ci-regex-server-code/",
      "content_url": "https://nulltap.com/api/articles/gitlab-ci-regex-server-code.json",
      "title": "GitLab fixes CI regex flaw that permits server-side code execution",
      "summary": "A crafted CI configuration and UTF-8 repository path can reach a vulnerable regex compiler on self-managed GitLab. Upgrade the affected 19.2, 19.3 and 19.4 branches.",
      "date_published": "2026-10-13T13:51:52.403Z",
      "tags": [
        "appsec"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/gitlab-ci-regex-server-code/tile.webp?v=eef0824189ef"
    },
    {
      "id": "2026-10-13-microsoft-pqc-certificates-testbeds",
      "url": "https://nulltap.com/p/microsoft-pqc-certificates-testbeds/",
      "content_url": "https://nulltap.com/api/articles/microsoft-pqc-certificates-testbeds.json",
      "title": "Microsoft Tests Post-Quantum Certificates Before Enterprise Rollout",
      "summary": "A closed TLS pilot exposes the certificate-chain work ahead. Map issuers and validators, then test ML-DSA certificates across real application paths outside production.",
      "date_published": "2026-10-13T10:53:50.451Z",
      "tags": [
        "identity",
        "network"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/microsoft-pqc-certificates-testbeds/tile.webp?v=d9dddc7da4f3"
    },
    {
      "id": "2026-10-12-taiwan-event-google-phishing",
      "url": "https://nulltap.com/p/taiwan-event-google-phishing/",
      "content_url": "https://nulltap.com/api/articles/taiwan-event-google-phishing.json",
      "title": "Fake event invites target Taiwan researchers’ Google accounts",
      "summary": "Talos traced event invitations and altered poster QR codes to a live Google sign-in relay. Inspect the actual registration destination and review affected accounts.",
      "date_published": "2026-10-12T22:33:43.209Z",
      "tags": [
        "identity",
        "threats",
        "ai"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/taiwan-event-google-phishing/tile.webp?v=96edd4d84dd0"
    },
    {
      "id": "2026-10-12-apex-accelerator-fake-audits-malware",
      "url": "https://nulltap.com/p/apex-accelerator-fake-audits-malware/",
      "content_url": "https://nulltap.com/api/articles/apex-accelerator-fake-audits-malware.json",
      "title": "Apex Accelerator's fake audits deliver malware through npm tools",
      "summary": "Two Apex npm tools fetch executables and attacker-selected commands; one also sends coding-agent conversations to an Apex server. Find the tools and revoke exposed secrets.",
      "date_published": "2026-10-12T19:37:42.914Z",
      "tags": [
        "threats",
        "appsec",
        "ai"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/apex-accelerator-fake-audits-malware/tile.webp?v=ba16d60436b7"
    },
    {
      "id": "2026-10-12-thelia-back-office-server-code",
      "url": "https://nulltap.com/p/thelia-back-office-server-code/",
      "content_url": "https://nulltap.com/api/articles/thelia-back-office-server-code.json",
      "title": "Thelia back-office flaws expose store servers to code execution",
      "summary": "CERT/CC details code-execution paths in Thelia 2.6; a separate Thelia 3 email-template flaw has a module fix. Restrict admin access and check permissions.",
      "date_published": "2026-10-12T16:35:41.941Z",
      "tags": [
        "appsec"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/thelia-back-office-server-code/tile.webp?v=ef270b02da96"
    },
    {
      "id": "2026-10-12-cisco-talos-malware-prompts-ai-triage",
      "url": "https://nulltap.com/p/cisco-talos-malware-prompts-ai-triage/",
      "content_url": "https://nulltap.com/api/articles/cisco-talos-malware-prompts-ai-triage.json",
      "title": "Cisco Talos Measures Malware Prompts That Mislead AI Scanners",
      "summary": "Plaintext instructions in malware samples shifted some model triage toward benign. Search extracted strings and keep sample text out of the scanner's instruction channel.",
      "date_published": "2026-10-12T13:55:40.905Z",
      "tags": [
        "ai",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/cisco-talos-malware-prompts-ai-triage/tile.webp?v=5ef34649ced1"
    },
    {
      "id": "2026-10-12-huntress-clickfix-run-chain-kills",
      "url": "https://nulltap.com/p/huntress-clickfix-run-chain-kills/",
      "content_url": "https://nulltap.com/api/articles/huntress-clickfix-run-chain-kills.json",
      "title": "Huntress kills a ClickFix Run chain before retrieved text executes",
      "summary": "In a Windows ClickFix case, endpoint-side termination stopped repeated command pastes; check enforce mode and the process tree before treating an alert as a block.",
      "date_published": "2026-10-12T10:37:38.904Z",
      "tags": [
        "endpoint",
        "threats"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/huntress-clickfix-run-chain-kills/tile.webp?v=29d89334e6ac"
    },
    {
      "id": "2026-10-11-strapi-filter-private-fields",
      "url": "https://nulltap.com/p/strapi-filter-private-fields/",
      "content_url": "https://nulltap.com/api/articles/strapi-filter-private-fields.json",
      "title": "CISA lists exploited Strapi filter flaw that exposes private fields",
      "summary": "Strapi user filters can disclose reset tokens. Find vulnerable releases, inspect GET requests for private-field probes and move to a patched branch.",
      "date_published": "2026-10-11T22:33:33.352Z",
      "tags": [
        "appsec",
        "identity"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/strapi-filter-private-fields/tile.webp?v=53667f5c0cc4"
    },
    {
      "id": "2026-10-11-proftpd-file-copy-exploitation",
      "url": "https://nulltap.com/p/proftpd-file-copy-exploitation/",
      "content_url": "https://nulltap.com/api/articles/proftpd-file-copy-exploitation.json",
      "title": "CISA flags exploited ProFTPD flaw that exposes server files",
      "summary": "ProFTPD's mod_copy flaw lets remote attackers read and write arbitrary files. Check reachable FTP services, command logs and distribution patches.",
      "date_published": "2026-10-11T19:29:31.850Z",
      "tags": [
        "network",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/proftpd-file-copy-exploitation/tile.webp?v=bca6d8acb49f"
    },
    {
      "id": "2026-10-11-cisco-nexus-mpls-echo-root-code",
      "url": "https://nulltap.com/p/cisco-nexus-mpls-echo-root-code/",
      "content_url": "https://nulltap.com/api/articles/cisco-nexus-mpls-echo-root-code.json",
      "title": "Cisco patches Nexus MPLS flaw that permits root-level code execution",
      "summary": "An enabled MPLS OAM feature exposes affected Nexus switches to crafted echo-requests; check feature state, then disable it or move to fixed NX-OS.",
      "date_published": "2026-10-11T16:31:30.210Z",
      "tags": [
        "network"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/cisco-nexus-mpls-echo-root-code/tile.webp?v=504e9e61f7b9"
    },
    {
      "id": "2026-10-11-cisco-nexus-ngoam-root-code",
      "url": "https://nulltap.com/p/cisco-nexus-ngoam-root-code/",
      "content_url": "https://nulltap.com/api/articles/cisco-nexus-ngoam-root-code.json",
      "title": "Cisco NGOAM flaws expose Nexus switches to root code execution",
      "summary": "Enabled NGOAM exposes a packet-processing flaw on standalone Nexus 3000 and 9000 switches; two more flaws require VXLAN overlay or SRv6 features.",
      "date_published": "2026-10-11T13:37:28.600Z",
      "tags": [
        "network"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/cisco-nexus-ngoam-root-code/tile.webp?v=e3dd65ed27f3"
    },
    {
      "id": "2026-10-11-ahsaycbs-webshell-miner",
      "url": "https://nulltap.com/p/ahsaycbs-webshell-miner/",
      "content_url": "https://nulltap.com/api/articles/ahsaycbs-webshell-miner.json",
      "title": "AhsayCBS Intruders Install Webshells and Hide a Crypto Miner",
      "summary": "A backup management server became a SYSTEM-level foothold. Restrict its web interface and hunt for a fake Edge service, JSP shells and miner traffic.",
      "date_published": "2026-10-11T10:31:27.688Z",
      "tags": [
        "threats",
        "appsec"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/ahsaycbs-webshell-miner/tile.webp?v=1d430ac2b76b"
    },
    {
      "id": "2026-10-10-cisco-nx-api-root-execution",
      "url": "https://nulltap.com/p/cisco-nx-api-root-execution/",
      "content_url": "https://nulltap.com/api/articles/cisco-nx-api-root-execution.json",
      "title": "Cisco NX-API flaw exposes switch management to root execution",
      "summary": "Enabled NX-API on affected Nexus switches exposes an unauthenticated request path; UCS 6300 fabric interconnects have a separate credential-dependent path.",
      "date_published": "2026-10-10T22:29:23.307Z",
      "tags": [
        "network"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/cisco-nx-api-root-execution/tile.webp?v=c96714317000"
    },
    {
      "id": "2026-10-10-isc-bind-tkey-dns-outage",
      "url": "https://nulltap.com/p/isc-bind-tkey-dns-outage/",
      "content_url": "https://nulltap.com/api/articles/isc-bind-tkey-dns-outage.json",
      "title": "CISA Flags Exploited BIND Flaw That Knocks DNS Servers Offline",
      "summary": "A crafted TKEY query can stop vulnerable BIND DNS servers before access controls run. Check the running build and install the vendor's patched package.",
      "date_published": "2026-10-10T19:39:22.552Z",
      "tags": [
        "network",
        "threats"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/isc-bind-tkey-dns-outage/tile.webp?v=7784d9efb823"
    },
    {
      "id": "2026-10-10-papercut-emergency-patches-scan-fax-rce",
      "url": "https://nulltap.com/p/papercut-emergency-patches-scan-fax-rce/",
      "content_url": "https://nulltap.com/api/articles/papercut-emergency-patches-scan-fax-rce.json",
      "title": "PaperCut Emergency Patch Left a Second Path to Server Code Execution",
      "summary": "watchTowr traced a new authentication bypass and Scan-to-Fax code-execution chain through an interim PaperCut build. Check the running version and past access to its web interface.",
      "date_published": "2026-10-10T16:35:22.073Z",
      "tags": [
        "appsec",
        "network"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/papercut-emergency-patches-scan-fax-rce/tile.webp?v=e687a8752457"
    },
    {
      "id": "2026-10-10-netscaler-log-poisoning-web-shell",
      "url": "https://nulltap.com/p/netscaler-log-poisoning-web-shell/",
      "content_url": "https://nulltap.com/api/articles/netscaler-log-poisoning-web-shell.json",
      "title": "Citrix NetScaler Intruders Poison Logs to Install a Web Shell",
      "summary": "Unit 42 traced an exploited NetScaler command-injection chain through two appliance logs into a disguised PHP shell. Preserve logs and inspect the web-server configuration.",
      "date_published": "2026-10-10T13:49:21.373Z",
      "tags": [
        "network",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/netscaler-log-poisoning-web-shell/tile.webp?v=078d960f3eb5"
    },
    {
      "id": "2026-10-09-cisco-nx-os-switch-fabric-fixes",
      "url": "https://nulltap.com/p/cisco-nx-os-switch-fabric-fixes/",
      "content_url": "https://nulltap.com/api/articles/cisco-nx-os-switch-fabric-fixes.json",
      "title": "Cisco Fixes Six NX-OS Flaw Groups Across Switches and Fabric Interconnects",
      "summary": "Cisco's NX-OS hardening release covers MDS, Nexus and UCS fabric interconnects. Match device family and management mode to the first fixed build.",
      "date_published": "2026-10-09T19:51:19.874Z",
      "tags": [
        "network"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/cisco-nx-os-switch-fabric-fixes/tile.webp?v=19168e5776ef"
    },
    {
      "id": "2026-10-09-cisco-license-on-prem-hardening-fixes",
      "url": "https://nulltap.com/p/cisco-license-on-prem-hardening-fixes/",
      "content_url": "https://nulltap.com/api/articles/cisco-license-on-prem-hardening-fixes.json",
      "title": "Cisco Fixes Four License On-Prem Flaw Groups in 10-202609",
      "summary": "Cisco groups multiple License On-Prem flaws under four CVEs. Inventory the former SSM On-Prem too, migrate older branches, and verify the fixed release.",
      "date_published": "2026-10-09T16:47:19.552Z",
      "tags": [
        "network",
        "identity"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/cisco-license-on-prem-hardening-fixes/tile.webp?v=5f8e4ebe2579"
    },
    {
      "id": "2026-10-09-apache-struts-dmi-code-execution",
      "url": "https://nulltap.com/p/apache-struts-dmi-code-execution/",
      "content_url": "https://nulltap.com/api/articles/apache-struts-dmi-code-execution.json",
      "title": "CISA Flags Exploited Apache Struts Flaw That Executes Server Code",
      "summary": "A remote execution path depends on Dynamic Method Invocation. Identify reachable Struts 2 apps, disable that feature or move to an Apache-listed fix, and triage exposure.",
      "date_published": "2026-10-09T10:43:19.071Z",
      "tags": [
        "appsec",
        "threats"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/apache-struts-dmi-code-execution/tile.webp?v=570a88ea0ab7"
    },
    {
      "id": "2026-10-08-microsoft-forge-fix-queue",
      "url": "https://nulltap.com/p/microsoft-forge-fix-queue/",
      "content_url": "https://nulltap.com/api/articles/microsoft-forge-fix-queue.json",
      "title": "Microsoft FORGE Finds 140 Windows CVEs, Submits 155 Open-Source Reports",
      "summary": "Microsoft's research shows how bug volume can overwhelm validation and release work. Check affected dependency builds and carry reproducible findings through a shipped fix.",
      "date_published": "2026-10-08T22:59:17.660Z",
      "tags": [
        "appsec",
        "ai"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/microsoft-forge-fix-queue/tile.webp?v=913c1989e0e6"
    },
    {
      "id": "2026-10-08-onlyoffice-docs-upload-rce",
      "url": "https://nulltap.com/p/onlyoffice-docs-upload-rce/",
      "content_url": "https://nulltap.com/api/articles/onlyoffice-docs-upload-rce.json",
      "title": "CISA flags exploited ONLYOFFICE Docs flaw that exposes servers to code execution",
      "summary": "CISA lists an exploited image-upload traversal in ONLYOFFICE Document Server before 5.6.3. Find older JWT-enabled servers, update them and check their exposure.",
      "date_published": "2026-10-08T22:41:17.625Z",
      "tags": [
        "appsec",
        "threats"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/onlyoffice-docs-upload-rce/tile.webp?v=b8dd268a9649"
    },
    {
      "id": "2026-10-08-akira-ransomware-shared-folder-encryption",
      "url": "https://nulltap.com/p/akira-ransomware-shared-folder-encryption/",
      "content_url": "https://nulltap.com/api/articles/akira-ransomware-shared-folder-encryption.json",
      "title": "Akira Ransomware Leaves a File-Share Trail After Late EDR Deployment",
      "summary": "Huntress reconstructed an Akira attack from Shellbags, ransomware logs and shadow-copy events after its endpoint agent arrived too late to record the launch.",
      "date_published": "2026-10-08T16:39:17.282Z",
      "tags": [
        "threats",
        "endpoint",
        "identity"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/akira-ransomware-shared-folder-encryption/tile.webp?v=9679fdde02bd"
    },
    {
      "id": "2026-10-08-palo-alto-blockchain-c2-build-runners",
      "url": "https://nulltap.com/p/palo-alto-blockchain-c2-build-runners/",
      "content_url": "https://nulltap.com/api/articles/palo-alto-blockchain-c2-build-runners.json",
      "title": "Palo Alto Networks traces blockchain C2 through poisoned dependencies",
      "summary": "Unit 42 maps contract reads, transaction data and zero-value transfers used by poisoned packages. Correlate runner processes with blockchain traffic and restrict unneeded egress.",
      "date_published": "2026-10-08T13:51:17.392Z",
      "tags": [
        "cloud",
        "appsec",
        "threats"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/palo-alto-blockchain-c2-build-runners/tile.webp?v=ed5cf7bbd966"
    },
    {
      "id": "2026-10-08-atlassian-web-root-file-exposure",
      "url": "https://nulltap.com/p/atlassian-web-root-file-exposure/",
      "content_url": "https://nulltap.com/api/articles/atlassian-web-root-file-exposure.json",
      "title": "Atlassian file-read flaw exposes web-root secrets in eight products",
      "summary": "An unauthenticated file read reaches known paths inside eight Atlassian server products. Match installed branches to fixes and review decoded access logs.",
      "date_published": "2026-10-08T10:49:16.211Z",
      "tags": [
        "appsec",
        "identity"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/atlassian-web-root-file-exposure/tile.webp?v=3eed1540139f"
    },
    {
      "id": "2026-10-07-power-bi-phishing-screenconnect-persistence",
      "url": "https://nulltap.com/p/power-bi-phishing-screenconnect-persistence/",
      "content_url": "https://nulltap.com/api/articles/power-bi-phishing-screenconnect-persistence.json",
      "title": "Microsoft Power BI phishing plants two rogue ScreenConnect clients",
      "summary": "A Power BI report link sent targets to a fingerprinting page and a delayed installer. Hunt for both remote clients and the recurring repair task.",
      "date_published": "2026-10-07T22:45:15.056Z",
      "tags": [
        "endpoint",
        "cloud",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/power-bi-phishing-screenconnect-persistence/tile.webp?v=7b8d80663045"
    },
    {
      "id": "2026-10-07-foxit-pdf-form-code-execution",
      "url": "https://nulltap.com/p/foxit-pdf-form-code-execution/",
      "content_url": "https://nulltap.com/api/articles/foxit-pdf-form-code-execution.json",
      "title": "Foxit PDF form flaws expose Reader users to code execution",
      "summary": "Two crafted-PDF flaws affect Foxit Reader and Editor. Check both CVEs against installed platforms and releases, then verify Foxit updates on endpoints.",
      "date_published": "2026-10-07T20:19:14.625Z",
      "date_modified": "2026-10-08T07:40:12.812Z",
      "tags": [
        "endpoint",
        "appsec"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/foxit-pdf-form-code-execution/tile.webp?v=0c3d559486cc"
    },
    {
      "id": "2026-10-06-microsoft-critical-server-patch-windows",
      "url": "https://nulltap.com/p/microsoft-critical-server-patch-windows/",
      "content_url": "https://nulltap.com/api/articles/microsoft-critical-server-patch-windows.json",
      "title": "Microsoft urges 24-hour fixes for critical on-premises systems",
      "summary": "Microsoft urges faster fixes for critical on-premises systems. Check patch deployment logs, installed-update status and Baseline Security Mode configuration exceptions.",
      "date_published": "2026-10-06T19:51:12.107Z",
      "tags": [
        "ai",
        "identity",
        "network"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/microsoft-critical-server-patch-windows/tile.webp?v=0cdc7fa7898c"
    },
    {
      "id": "2026-10-06-blinder-tunnel-project-execution",
      "url": "https://nulltap.com/p/blinder-tunnel-project-execution/",
      "content_url": "https://nulltap.com/api/articles/blinder-tunnel-project-execution.json",
      "title": "Iranian Actors Trigger Malware When Visual Studio Opens a Coding Test",
      "summary": "A fake Dubai Airports coding test ran from a Visual Studio project before compilation. Inspect the project target and developer-host staging path, then isolate matches.",
      "date_published": "2026-10-06T18:43:11.445Z",
      "tags": [
        "threats",
        "endpoint",
        "appsec"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/blinder-tunnel-project-execution/tile.webp?v=3b78e6fed248"
    },
    {
      "id": "2026-10-06-needymantis-dll-sideloading-windows-access",
      "url": "https://nulltap.com/p/needymantis-dll-sideloading-windows-access/",
      "content_url": "https://nulltap.com/api/articles/needymantis-dll-sideloading-windows-access.json",
      "title": "NeedyMantis Uses Sideloaded DLLs to Maintain Windows Access",
      "summary": "Microsoft found a selective post-compromise implant paired with legitimate software and a same-name archive. Hunt the loader, archive and C2 together, then contain affected hosts.",
      "date_published": "2026-10-06T10:59:10.415Z",
      "tags": [
        "threats",
        "endpoint"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/needymantis-dll-sideloading-windows-access/tile.webp?v=79f815a5568f"
    },
    {
      "id": "2026-10-05-msp360-screenconnect-phishing-access",
      "url": "https://nulltap.com/p/msp360-screenconnect-phishing-access/",
      "content_url": "https://nulltap.com/api/articles/msp360-screenconnect-phishing-access.json",
      "title": "Attackers use MSP360 and ScreenConnect to keep access after phishing",
      "summary": "A disguised signed MSP360 installer gave intruders one management channel, then installed ScreenConnect for another. Hunt the service-to-installer chain and restrict unapproved agents.",
      "date_published": "2026-10-05T19:33:09.009Z",
      "tags": [
        "endpoint",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/msp360-screenconnect-phishing-access/tile.webp?v=0644c52cc12c"
    },
    {
      "id": "2026-10-05-cisco-talos-attacker-access-friction",
      "url": "https://nulltap.com/p/cisco-talos-attacker-access-friction/",
      "content_url": "https://nulltap.com/api/articles/cisco-talos-attacker-access-friction.json",
      "title": "Cisco Talos maps RMM, decoys and agent controls to disrupt attackers",
      "summary": "A legitimate remote-support agent can give a ransomware operator persistent access. Inventory approved tools, watch credential-access behavior and make agent sessions stoppable.",
      "date_published": "2026-10-05T17:13:09.246Z",
      "tags": [
        "endpoint",
        "identity",
        "ai"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/cisco-talos-attacker-access-friction/tile.webp?v=66324006a9c6"
    },
    {
      "id": "2026-10-05-citrix-netscaler-exploited-denial-of-service",
      "url": "https://nulltap.com/p/citrix-netscaler-exploited-denial-of-service/",
      "content_url": "https://nulltap.com/api/articles/citrix-netscaler-exploited-denial-of-service.json",
      "title": "Citrix NetScaler flaw threatens service as CISA lists exploitation",
      "summary": "CISA lists CVE-2026-88779 as exploited. Record each ADC and Gateway's installed version and internet exposure; upgrade affected builds and verify the result.",
      "date_published": "2026-10-05T12:53:08.499Z",
      "tags": [
        "network"
      ],
      "read_time_minutes": 2,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/citrix-netscaler-exploited-denial-of-service/tile.webp?v=302c6caf119d"
    },
    {
      "id": "2026-10-04-arista-velocloud-vco-privileged-access",
      "url": "https://nulltap.com/p/arista-velocloud-vco-privileged-access/",
      "content_url": "https://nulltap.com/api/articles/arista-velocloud-vco-privileged-access.json",
      "title": "Arista VeloCloud Orchestrator flaw exposes privileged host functions",
      "summary": "CISA lists the on-prem flaw as exploited. Check Edge certificate authentication, web-interface reachability and the affected release train before upgrading.",
      "date_published": "2026-10-04T23:35:06.093Z",
      "tags": [
        "network",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/arista-velocloud-vco-privileged-access/tile.webp?v=404d52826a94"
    },
    {
      "id": "2026-10-04-uefi-shell-secure-boot-revocation",
      "url": "https://nulltap.com/p/uefi-shell-secure-boot-revocation/",
      "content_url": "https://nulltap.com/api/articles/uefi-shell-secure-boot-revocation.json",
      "title": "Signed UEFI shells bypass Secure Boot before the OS starts",
      "summary": "CERT/CC identifies trusted diagnostic shells with memory-write commands. Match the binary and firmware trust lists, then install vendor updates and verify DBX revocation.",
      "date_published": "2026-10-04T21:09:18.244Z",
      "tags": [
        "endpoint",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/uefi-shell-secure-boot-revocation/tile.webp?v=5d23922b1e22"
    },
    {
      "id": "2026-10-04-zyxel-gs1900-exploited-cgi-overflow",
      "url": "https://nulltap.com/p/zyxel-gs1900-exploited-cgi-overflow/",
      "content_url": "https://nulltap.com/api/articles/zyxel-gs1900-exploited-cgi-overflow.json",
      "title": "Zyxel GS1900 switches face exploited CGI command-execution flaw",
      "summary": "CISA lists a LAN-reachable GS1900 CGI overflow as exploited. Match switch model and firmware to Zyxel’s fixes, then restrict management access.",
      "date_published": "2026-10-04T18:25:17.687Z",
      "tags": [
        "network",
        "threats"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/zyxel-gs1900-exploited-cgi-overflow/tile.webp?v=46f32330fc14"
    },
    {
      "id": "2026-10-04-readwise-reader-android-xss-partial-fix",
      "url": "https://nulltap.com/p/readwise-reader-android-xss-partial-fix/",
      "content_url": "https://nulltap.com/api/articles/readwise-reader-android-xss-partial-fix.json",
      "title": "Readwise Reader Android XSS Persists in Metadata After SVG Patch",
      "summary": "Readwise Reader 8.10.1 fixes an SVG sanitizer flaw, while two metadata XSS records still include that build. Check Android versions and limit untrusted imports.",
      "date_published": "2026-10-04T18:19:17.757Z",
      "tags": [
        "appsec",
        "endpoint"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/readwise-reader-android-xss-partial-fix/tile.webp?v=f3366cf18614"
    },
    {
      "id": "2026-10-04-star-blizzard-redflick-task-delivery",
      "url": "https://nulltap.com/p/star-blizzard-redflick-task-delivery/",
      "content_url": "https://nulltap.com/api/articles/star-blizzard-redflick-task-delivery.json",
      "title": "Star Blizzard Sends RedFlick Archives to Plant Windows Tasks",
      "summary": "Reply-stage archives lead to RedFlick scheduled tasks and CosmicPulse. Hunt the task names, trace the archive, and verify senders through a known channel.",
      "date_published": "2026-10-04T17:03:17.582Z",
      "tags": [
        "threats",
        "endpoint",
        "identity"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/star-blizzard-redflick-task-delivery/tile.webp?v=74a04fbb778f"
    },
    {
      "id": "2026-10-04-wso2-api-flaw-conflicting-attack-paths",
      "url": "https://nulltap.com/p/wso2-api-flaw-conflicting-attack-paths/",
      "content_url": "https://nulltap.com/api/articles/wso2-api-flaw-conflicting-attack-paths.json",
      "title": "WSO2 API Flaw Draws Conflicting Accounts as CISA Confirms Exploitation",
      "summary": "CISA describes file upload and possible code execution; WSO2 describes a JWT bypass and account takeover. Check product builds and reconcile the attack path with WSO2.",
      "date_published": "2026-10-04T11:41:17.300Z",
      "tags": [
        "appsec",
        "identity"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/wso2-api-flaw-conflicting-attack-paths/tile.webp?v=f6286cddbf27"
    },
    {
      "id": "2026-10-04-zammad-session-fixation-code-execution",
      "url": "https://nulltap.com/p/zammad-session-fixation-code-execution/",
      "content_url": "https://nulltap.com/api/articles/zammad-session-fixation-code-execution.json",
      "title": "CISA Flags Exploited Zammad Session Flaw Leading to Code Execution",
      "summary": "CISA lists an exploited session flaw with code execution as the Zammad user. Zammad says 6.5 and older are exploitable; move those installations to 7.2.0 and triage exposure.",
      "date_published": "2026-10-04T00:35:16.201Z",
      "tags": [
        "appsec",
        "threats"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/zammad-session-fixation-code-execution/tile.webp?v=30f50e7496bc"
    },
    {
      "id": "2026-10-04-f5-big-ip-apm-oauth-rce",
      "url": "https://nulltap.com/p/f5-big-ip-apm-oauth-rce/",
      "content_url": "https://nulltap.com/api/articles/f5-big-ip-apm-oauth-rce.json",
      "title": "CISA Lists Exploited F5 BIG-IP APM Flaw Allowing Code Execution",
      "summary": "The exposed configuration is an APM OAuth Authorization Server virtual server. Request F5’s interim iRule for triage, then install the applicable final fix.",
      "date_published": "2026-10-04T00:27:15.972Z",
      "tags": [
        "network",
        "identity"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/f5-big-ip-apm-oauth-rce/tile.webp?v=10a38ca972de"
    },
    {
      "id": "2026-10-03-cisco-talos-cairn-malware-metadata-hunt",
      "url": "https://nulltap.com/p/cisco-talos-cairn-malware-metadata-hunt/",
      "content_url": "https://nulltap.com/api/articles/cisco-talos-cairn-malware-metadata-hunt.json",
      "title": "Cisco Talos Uses CAIRN to Hunt AI Malware From Sample Metadata",
      "summary": "CAIRN groups malware candidates by AI-related metadata, then separates artifact presence from behavior and confirmed families. Triage noisy matches before calling an incident.",
      "date_published": "2026-10-03T20:47:17.308Z",
      "tags": [
        "ai",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/cisco-talos-cairn-malware-metadata-hunt/tile.webp?v=2bfc7267bb9c"
    },
    {
      "id": "2026-10-03-storm-2570-remote-access-ransomware",
      "url": "https://nulltap.com/p/storm-2570-remote-access-ransomware/",
      "content_url": "https://nulltap.com/api/articles/storm-2570-remote-access-ransomware.json",
      "title": "Storm-2570 Reuses Remote Access to Steal Data and Deploy Ransomware",
      "summary": "Microsoft tracked the same affiliate through four ransomware ecosystems. Hunt renamed MeshAgent services, domain-controller copies and cloud-transfer tooling before encryption.",
      "date_published": "2026-10-03T20:46:49.921Z",
      "tags": [
        "endpoint",
        "identity",
        "threats"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/storm-2570-remote-access-ransomware/tile.webp?v=14c21a2360d7"
    },
    {
      "id": "2026-10-03-norwegian-cruise-line-door-card-cloning",
      "url": "https://nulltap.com/p/norwegian-cruise-line-door-card-cloning/",
      "content_url": "https://nulltap.com/api/articles/norwegian-cruise-line-door-card-cloning.json",
      "title": "Norwegian Cruise Line Ship Doors Accept Cloned Keycards",
      "summary": "Some shipboard access readers accept a copied card identifier. Identify UID-only doors, shield issued cards and add supervised access to sensitive areas while seeking a fix.",
      "date_published": "2026-10-03T15:31:30.086Z",
      "tags": [
        "identity"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/norwegian-cruise-line-door-card-cloning/tile.webp?v=6cdad5bdb380"
    },
    {
      "id": "2026-10-03-microsoft-purview-entra-ai-upload-blocks",
      "url": "https://nulltap.com/p/microsoft-purview-entra-ai-upload-blocks/",
      "content_url": "https://nulltap.com/api/articles/microsoft-purview-entra-ai-upload-blocks.json",
      "title": "Microsoft Brings Sensitive AI Upload Blocking to Entra Networks",
      "summary": "Purview classifies files and text while Entra enforces network policy for employee and on-behalf-of agent traffic. Confirm forwarding and an active blocking rule before relying on it.",
      "date_published": "2026-10-03T14:33:55.367Z",
      "tags": [
        "cloud",
        "ai"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/microsoft-purview-entra-ai-upload-blocks/tile.webp?v=dc84cdca06e5"
    },
    {
      "id": "2026-10-03-zammad-root-escalation",
      "url": "https://nulltap.com/p/zammad-root-escalation/",
      "content_url": "https://nulltap.com/api/articles/zammad-root-escalation.json",
      "title": "CISA Flags Exploited Zammad Flaw That Elevates Service Account to Root",
      "summary": "A local zammad account can escalate to root. CISA lists exploitation; the vendor disputes the reported scope and recommends upgrading to 7.2.0.",
      "date_published": "2026-10-03T12:03:27.168Z",
      "tags": [
        "appsec",
        "threats"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/zammad-root-escalation/tile.webp?v=5731938aeb17"
    },
    {
      "id": "2026-10-03-ibm-turbonomic-operator-secret-access",
      "url": "https://nulltap.com/p/ibm-turbonomic-operator-secret-access/",
      "content_url": "https://nulltap.com/api/articles/ibm-turbonomic-operator-secret-access.json",
      "title": "IBM Turbonomic Operator Grants Cluster-Wide Access to Secrets",
      "summary": "Prometurbo's service account could read secrets outside its own namespace. Reinstall the fixed agent and test the operator's effective permissions.",
      "date_published": "2026-10-03T00:13:15.784Z",
      "tags": [
        "cloud",
        "identity",
        "ai"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/ibm-turbonomic-operator-secret-access/tile.webp?v=182c44c13d63"
    },
    {
      "id": "2026-10-02-mikrotik-routeros-ssh-rekey-exposure",
      "url": "https://nulltap.com/p/mikrotik-routeros-ssh-rekey-exposure/",
      "content_url": "https://nulltap.com/api/articles/mikrotik-routeros-ssh-rekey-exposure.json",
      "title": "MikroTik RouterOS Rekey Error Exposes Routers With Open SSH",
      "summary": "CISA lists a RouterOS SSH rekey flaw as exploited. It lets unauthenticated clients reach a command path and can chain with a second flaw; update and restrict SSH.",
      "date_published": "2026-10-02T20:36:35.744Z",
      "tags": [
        "network",
        "threats"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/mikrotik-routeros-ssh-rekey-exposure/tile.webp?v=ee709c8654c3"
    },
    {
      "id": "2026-10-02-hp-bios-smm-memory-write",
      "url": "https://nulltap.com/p/hp-bios-smm-memory-write/",
      "content_url": "https://nulltap.com/api/articles/hp-bios-smm-memory-write.json",
      "title": "HP BIOS Flaw Lets Kernel Attackers Write to Protected Firmware Memory",
      "summary": "An HP-specific InsydeH2O SMM handler accepts unsafe memory parameters from a local kernel attacker. Check HP PCs for exposure and install a model-matched BIOS update when HP lists one.",
      "date_published": "2026-10-02T12:02:59.374Z",
      "tags": [
        "endpoint"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/hp-bios-smm-memory-write/tile.webp?v=ec4557dbaa82"
    },
    {
      "id": "2026-10-02-fortimail-arbitrary-file-write",
      "url": "https://nulltap.com/p/fortimail-arbitrary-file-write/",
      "content_url": "https://nulltap.com/api/articles/fortimail-arbitrary-file-write.json",
      "title": "Fortinet FortiMail Attackers Write Files Through Its Web Interface",
      "summary": "CISA lists an exploited FortiMail arbitrary-file-write flaw. Fortinet urges operators to disable IBE or restrict management access while branch upgrades are forthcoming.",
      "date_published": "2026-10-02T02:56:35.223Z",
      "tags": [
        "network",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/fortimail-arbitrary-file-write/tile.webp?v=ff521711c9ec"
    },
    {
      "id": "2026-10-01-viewsonic-vcast-screen-exfiltration",
      "url": "https://nulltap.com/p/viewsonic-vcast-screen-exfiltration/",
      "content_url": "https://nulltap.com/api/articles/viewsonic-vcast-screen-exfiltration.json",
      "title": "ViewSonic ViewBoard Flaws Expose Screens and Open a Code Path",
      "summary": "Three unauthenticated vCast endpoints expose screen images, APK delivery and service input on shared networks. Isolate ViewBoards and check who can reach them.",
      "date_published": "2026-10-01T17:03:46.533Z",
      "tags": [
        "network",
        "endpoint"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/viewsonic-vcast-screen-exfiltration/tile.webp?v=f44e353c601c"
    },
    {
      "id": "2026-10-01-imprivata-eam-key-rotation-gap",
      "url": "https://nulltap.com/p/imprivata-eam-key-rotation-gap/",
      "content_url": "https://nulltap.com/api/articles/imprivata-eam-key-rotation-gap.json",
      "title": "Imprivata EAM Keeps Appliance Keys Trusted Until Redeployment",
      "summary": "EAM through 26.2.6 has no supported RSA key-pair rotation. Protect key copies in backups and snapshots, and plan redeployment if the private key is exposed.",
      "date_published": "2026-10-01T17:03:02.499Z",
      "tags": [
        "identity"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/imprivata-eam-key-rotation-gap/tile.webp?v=4c962ac96ff9"
    },
    {
      "id": "2026-10-01-microsoft-devops-kubeconfig-theft",
      "url": "https://nulltap.com/p/microsoft-devops-kubeconfig-theft/",
      "content_url": "https://nulltap.com/api/articles/microsoft-devops-kubeconfig-theft.json",
      "title": "Storm-3068 Steals Kubernetes Credentials via Microsoft Azure DevOps",
      "summary": "After a password reset, Storm-3068 used an authorized Azure DevOps pipeline to collect Kubernetes credentials. Trace pipeline changes and restrict resource access.",
      "date_published": "2026-10-01T17:02:23.443Z",
      "tags": [
        "identity",
        "cloud",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/microsoft-devops-kubeconfig-theft/tile.webp?v=79126f8544dc"
    },
    {
      "id": "2026-10-01-zimbra-mail-cluster-secret-theft",
      "url": "https://nulltap.com/p/zimbra-mail-cluster-secret-theft/",
      "content_url": "https://nulltap.com/api/articles/zimbra-mail-cluster-secret-theft.json",
      "title": "Zimbra Mail Clusters Face Secret Theft After Server Intrusions",
      "summary": "Microsoft traces a mail-server intrusion from an optional SNMP notification path to root persistence, shared authentication secrets and peer mailbox nodes.",
      "date_published": "2026-10-01T00:39:44.777Z",
      "tags": [
        "threats",
        "identity"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/zimbra-mail-cluster-secret-theft/tile.webp?v=5a7520cb8c99"
    },
    {
      "id": "2026-09-30-cisco-sdwan-manager-admin-bypass",
      "url": "https://nulltap.com/p/cisco-sdwan-manager-admin-bypass/",
      "content_url": "https://nulltap.com/api/articles/cisco-sdwan-manager-admin-bypass.json",
      "title": "Cisco SD-WAN Manager Flaw Gives Attackers Admin Access",
      "summary": "An exploited URI-encoding bypass reaches the management API as admin. Check Cisco's service-proxy and server logs, restrict exposure, and install a fixed release.",
      "date_published": "2026-09-30T21:35:02.353Z",
      "tags": [
        "network",
        "identity"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/cisco-sdwan-manager-admin-bypass/tile.webp?v=e164ea3eade9"
    },
    {
      "id": "2026-09-30-uat-11587-antino-microsoft-365-dead-drops",
      "url": "https://nulltap.com/p/uat-11587-antino-microsoft-365-dead-drops/",
      "content_url": "https://nulltap.com/api/articles/uat-11587-antino-microsoft-365-dead-drops.json",
      "title": "Antino Backdoor Uses Microsoft 365 for Espionage Tasking",
      "summary": "Talos traces a phishing-to-Windows backdoor chain affecting Asian institutions. Hunt the script host and sideloaded DLL, then restrict script execution.",
      "date_published": "2026-09-30T19:06:08.988Z",
      "tags": [
        "threats",
        "endpoint",
        "cloud"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/uat-11587-antino-microsoft-365-dead-drops/tile.webp?v=f94c21ac6f66"
    },
    {
      "id": "2026-09-30-kotaemon-chat-ownership-bypass",
      "url": "https://nulltap.com/p/kotaemon-chat-ownership-bypass/",
      "content_url": "https://nulltap.com/api/articles/kotaemon-chat-ownership-bypass.json",
      "title": "Kotaemon Lets Signed-In Users Read and Delete Other Users' Chats",
      "summary": "An ownership check is missing from four multi-user chat handlers through v0.12.0. Limit account access and review cross-user conversation activity while awaiting a verified fix.",
      "date_published": "2026-09-30T18:53:56.040Z",
      "tags": [
        "ai",
        "appsec"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/kotaemon-chat-ownership-bypass/tile.webp?v=e6dd651ec78b"
    },
    {
      "id": "2026-09-30-gtig-exploited-flaws-edge-priority",
      "url": "https://nulltap.com/p/gtig-exploited-flaws-edge-priority/",
      "content_url": "https://nulltap.com/api/articles/gtig-exploited-flaws-edge-priority.json",
      "title": "GTIG Counts 141 Exploited Flaws as CVE Disclosures Double",
      "summary": "GTIG recorded 141 disclosed and exploited vulnerabilities through August 2026. Prioritize reachable edge systems and verify the access conditions on affected AI gateways.",
      "date_published": "2026-09-30T18:41:40.708Z",
      "tags": [
        "network",
        "appsec",
        "ai"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/gtig-exploited-flaws-edge-priority/tile.webp?v=d69f750258ed"
    },
    {
      "id": "2026-09-29-sharepoint-authorized-code-execution",
      "url": "https://nulltap.com/p/sharepoint-authorized-code-execution/",
      "content_url": "https://nulltap.com/api/articles/sharepoint-authorized-code-execution.json",
      "title": "CISA Flags Exploited SharePoint Code Injection for Authorized Users",
      "summary": "Three on-premises SharePoint editions have affected build ranges. Match each server to its edition's update threshold and triage suspected compromise.",
      "date_published": "2026-09-29T19:16:55.144Z",
      "tags": [
        "appsec",
        "threats"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/sharepoint-authorized-code-execution/tile.webp?v=59274659091c"
    },
    {
      "id": "2026-09-29-netscaler-webshell-proxy-intrusions",
      "url": "https://nulltap.com/p/netscaler-webshell-proxy-intrusions/",
      "content_url": "https://nulltap.com/api/articles/netscaler-webshell-proxy-intrusions.json",
      "title": "NetScaler Intruders Hide Web Shells Behind Icons and Tunnel Into Networks",
      "summary": "Mandiant traces exploited NetScaler packet-engine crashes to disguised PHP shells and an internal proxy. Hunt the config edits and appliance egress, then patch both flaws.",
      "date_published": "2026-09-29T16:57:24.964Z",
      "tags": [
        "network",
        "threats"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/netscaler-webshell-proxy-intrusions/tile.webp?v=4a244f096a7a"
    },
    {
      "id": "2026-09-29-peoplesoft-waf-bypass-web-shells",
      "url": "https://nulltap.com/p/peoplesoft-waf-bypass-web-shells/",
      "content_url": "https://nulltap.com/api/articles/peoplesoft-waf-bypass-web-shells.json",
      "title": "ShinyHunters Bypass PeopleSoft WAF Rules and Plant Web Shells",
      "summary": "An encoded request reaches PeopleSoft's vulnerable EMHub servlet past literal path filters. Patch PeopleTools and search every WebLogic node for encoded paths and new JSPs.",
      "date_published": "2026-09-29T14:52:33.940Z",
      "tags": [
        "appsec",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/peoplesoft-waf-bypass-web-shells/tile.webp?v=6827f41f7cf2"
    },
    {
      "id": "2026-09-29-authlib-unsigned-jws-acceptance",
      "url": "https://nulltap.com/p/authlib-unsigned-jws-acceptance/",
      "content_url": "https://nulltap.com/api/articles/authlib-unsigned-jws-acceptance.json",
      "title": "Authlib accepts unsigned JWS payloads as verified",
      "summary": "An empty signatures array skips Authlib's verification loop. Locate callers of the JSON JWS deserializer and reject unsigned input before trusting its payload.",
      "date_published": "2026-09-29T12:07:19.240Z",
      "tags": [
        "identity",
        "appsec"
      ],
      "read_time_minutes": 3,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/authlib-unsigned-jws-acceptance/tile.webp?v=df501ba0a895"
    },
    {
      "id": "2026-09-29-checkpoint-management-script-upload",
      "url": "https://nulltap.com/p/checkpoint-management-script-upload/",
      "content_url": "https://nulltap.com/api/articles/checkpoint-management-script-upload.json",
      "title": "Check Point Management Servers Face Script-Upload Attacks",
      "summary": "Check Point reports customer attacks through an unauthenticated management-server flaw. Match Jumbo Hotfix takes, restrict TCP/19009 and inspect CPM logs.",
      "date_published": "2026-09-29T07:56:45.445Z",
      "tags": [
        "network",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/checkpoint-management-script-upload/tile.webp?v=36e774ff6e0b"
    },
    {
      "id": "2026-09-29-aws-iam-key-quarantine",
      "url": "https://nulltap.com/p/aws-iam-key-quarantine/",
      "content_url": "https://nulltap.com/api/articles/aws-iam-key-quarantine.json",
      "title": "AWS Quarantines an Exposed IAM Key While CloudTrail Names the User",
      "summary": "A public-key exposure test reached AWS quarantine in 10 seconds. Alert on the IAM policy attachment, then investigate the key and follow the Support case.",
      "date_published": "2026-09-29T02:28:38.883Z",
      "tags": [
        "cloud",
        "identity"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/aws-iam-key-quarantine/tile.webp?v=27bce4f0d23e"
    },
    {
      "id": "2026-09-28-mandiant-ci-cache-release-builds",
      "url": "https://nulltap.com/p/mandiant-ci-cache-release-builds/",
      "content_url": "https://nulltap.com/api/articles/mandiant-ci-cache-release-builds.json",
      "title": "Mandiant Details How Shared CI Caches Expose Release Builds",
      "summary": "A pull request can plant dependencies in a shared build cache for a privileged release job. Separate cache writes by branch privilege and constrain publishing identities.",
      "date_published": "2026-09-28T18:50:08.338Z",
      "tags": [
        "appsec",
        "cloud"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/mandiant-ci-cache-release-builds/tile.webp?v=5b8994a2842f"
    },
    {
      "id": "2026-09-28-netscaler-exploited-command-execution",
      "url": "https://nulltap.com/p/netscaler-exploited-command-execution/",
      "content_url": "https://nulltap.com/api/articles/netscaler-exploited-command-execution.json",
      "title": "Attackers Exploit Two NetScaler Flaws That Permit Code Execution",
      "summary": "CISA lists two exploited NetScaler flaws. Match ADC and Gateway builds to their release branches, then preserve evidence on appliances suspected of compromise.",
      "date_published": "2026-09-28T12:00:20.088Z",
      "tags": [
        "network",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/netscaler-exploited-command-execution/tile.webp?v=758c864c23f8"
    },
    {
      "id": "2026-09-28-storm-3168-azure-storage-deletions",
      "url": "https://nulltap.com/p/storm-3168-azure-storage-deletions/",
      "content_url": "https://nulltap.com/api/articles/storm-3168-azure-storage-deletions.json",
      "title": "Storm-3168 Deletes Azure Storage Accounts With Stolen Service Principals",
      "summary": "Two compromised service principals drove a rapid Azure deletion campaign. Trace their ARM operations, rotate exposed secrets and verify recovery-resource locks.",
      "date_published": "2026-09-28T11:55:00.446Z",
      "tags": [
        "cloud",
        "identity",
        "threats"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/storm-3168-azure-storage-deletions/tile.webp?v=b373f29949d9"
    },
    {
      "id": "2026-09-23-sogou-ime-update-channel-backdoor",
      "url": "https://nulltap.com/p/sogou-ime-update-channel-backdoor/",
      "content_url": "https://nulltap.com/api/articles/sogou-ime-update-channel-backdoor.json",
      "title": "Sogou's Link Handler Let UNC3569 Install GRAYRABBIT",
      "summary": "A crafted Sogou URI reached an old, unsandboxed Chromium renderer. Verify the fixed build, then hunt the process, file, and network chain.",
      "date_published": "2026-09-23T02:37:33.168Z",
      "tags": [
        "endpoint",
        "threats"
      ],
      "read_time_minutes": 6,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/sogou-ime-update-channel-backdoor/tile.webp?v=965f41af4fec"
    },
    {
      "id": "2026-09-13-bluemoon-exploit-kit",
      "url": "https://nulltap.com/p/bluemoon-exploit-kit/",
      "content_url": "https://nulltap.com/api/articles/bluemoon-exploit-kit.json",
      "title": "BlueMoon Exploit Kit Breaks Out of Chrome to Deploy Espionage Malware",
      "summary": "Four espionage groups used a shared Chrome-to-Windows exploit chain. Build checks show current exposure; campaign artifacts support a separate compromise hunt.",
      "date_published": "2026-09-13T11:04:43.888Z",
      "tags": [
        "endpoint",
        "threats"
      ],
      "read_time_minutes": 6,
      "short_read_available": true,
      "short_read_time_minutes": 2,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/bluemoon-exploit-kit/tile.webp?v=99cb50108b1d"
    },
    {
      "id": "2026-09-13-rubygems-rubydoc-agent-abuse",
      "url": "https://nulltap.com/p/rubygems-rubydoc-agent-abuse/",
      "content_url": "https://nulltap.com/api/articles/rubygems-rubydoc-agent-abuse.json",
      "title": "RubyDoc Builds Let Malicious Gems Run Code on Shared Servers",
      "summary": "More than 100 malicious gems used RubyDoc documentation builds to execute supplied code. Maintainers should review package and account changes tied to legacy API keys.",
      "date_published": "2026-09-13T11:02:55.019Z",
      "tags": [
        "appsec",
        "ai",
        "threats"
      ],
      "read_time_minutes": 5,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/rubygems-rubydoc-agent-abuse/tile.webp?v=022627f7a62a"
    },
    {
      "id": "2026-09-13-screenconnect-file-transfer-execution",
      "url": "https://nulltap.com/p/screenconnect-file-transfer-execution/",
      "content_url": "https://nulltap.com/api/articles/screenconnect-file-transfer-execution.json",
      "title": "Attackers Exploit ScreenConnect Flaw to Run Files Without Host Approval",
      "summary": "CISA confirms exploitation of CVE-2026-84869. ScreenConnect clients before 26.6.5 can transfer and run files through active sessions without authorization or host confirmation.",
      "date_published": "2026-09-13T01:47:02.062Z",
      "tags": [
        "endpoint",
        "threats"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/screenconnect-file-transfer-execution/tile.webp?v=b50939578689"
    },
    {
      "id": "2026-09-12-gitlab-server-file-read",
      "url": "https://nulltap.com/p/gitlab-server-file-read/",
      "content_url": "https://nulltap.com/api/articles/gitlab-server-file-read.json",
      "title": "Attackers Exploit GitLab Flaw to Read Server Files Without a Login",
      "summary": "An exploited GitLab flaw exposes arbitrary server files through the commits API. Self-managed operators should install 19.1.8, 19.2.6, or 19.3.2 immediately.",
      "date_published": "2026-09-12T19:31:34.711Z",
      "tags": [
        "appsec",
        "cloud"
      ],
      "read_time_minutes": 4,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/gitlab-server-file-read/tile.webp?v=d8d83751d6a7"
    },
    {
      "id": "2026-09-12-bigbear-m365-aitm-phishing",
      "url": "https://nulltap.com/p/bigbear-m365-aitm-phishing/",
      "content_url": "https://nulltap.com/api/articles/bigbear-m365-aitm-phishing.json",
      "title": "BigBear Phishing Bypasses Microsoft 365 MFA at 258 Organizations",
      "summary": "CloudSEK found BigBear 2.0 stealing Microsoft 365 session cookies after MFA. Revoke sessions, rotate credentials and require phishing-resistant sign-in.",
      "date_published": "2026-09-12T15:10:00.000Z",
      "tags": [
        "identity",
        "threats"
      ],
      "read_time_minutes": 6,
      "short_read_available": true,
      "short_read_time_minutes": 1,
      "author": "Justin Howe",
      "image": "https://nulltap.com/images/articles/bigbear-m365-aitm-phishing/tile.webp?v=a568ebdd214a"
    }
  ]
}