Independent reporting on vulnerabilities, breaches, threat activity, and AI security helps defenders understand threats and make informed decisions.https://nulltap.com/en-ushttps://nulltap.com/p/sophos-intent-controls-sensitive-uploads/https://nulltap.com/p/sophos-intent-controls-sensitive-uploads/Endpoint AI can flag unusual access, but a familiar-looking transfer may still be harmful. Put explicit policy at the upload and measure the review queue.Mon, 19 Oct 2026 10:49:31 GMTidentityaiJustin Howehttps://nulltap.com/p/google-boringssl-certificate-name-limits/https://nulltap.com/p/google-boringssl-certificate-name-limits/Two legacy BoringSSL name checks were fixed in March; a URI case remains under coordination. Find the validator your product actually uses.Sun, 18 Oct 2026 23:03:27 GMTappsecidentityJustin Howehttps://nulltap.com/p/uat-6275-winrar-cis-government-shells/https://nulltap.com/p/uat-6275-winrar-cis-government-shells/Cisco Talos traces four delivery routes across nine countries. Hunt Startup-folder changes and unexpected PowerShell, then update affected Windows archive tools.Sun, 18 Oct 2026 22:57:27 GMTthreatsendpointJustin Howehttps://nulltap.com/p/fbi-disrupts-north-korean-laptop-farms/https://nulltap.com/p/fbi-disrupts-north-korean-laptop-farms/CrowdStrike says fake employees used U.S. homes to run company laptops remotely. Inspect shipping changes, remote-access tools and hiring records together.Sun, 18 Oct 2026 16:43:24 GMTidentityendpointthreatsJustin Howehttps://nulltap.com/p/fortinet-fortisiem-packet-code-execution/https://nulltap.com/p/fortinet-fortisiem-packet-code-execution/Crafted packets can cross a file-path restriction in FortiSIEM 7.5.0. Upgrade to 7.5.1 and limit access to TCP/27918 while scheduling the change.Sun, 18 Oct 2026 15:44:55 GMTnetworkappsecJustin Howehttps://nulltap.com/p/unit42-bank-gateway-wsus-attempt/https://nulltap.sh/p/unit42-bank-gateway-wsus-attempt/At a European bank, compromised credentials opened a third-party gateway route; months of scanning and password guessing preceded a blocked attempt against WSUS.Sun, 18 Oct 2026 10:28:36 GMTnetworkidentityendpointJustin Howehttps://nulltap.com/p/fortinet-peerstitch-firewall-implant/https://nulltap.sh/p/fortinet-peerstitch-firewall-implant/A stolen FortiManager archive helped attackers reach managed FortiGates; a memory-only implant linked logging and VPN processes. Check revisions and rotate trust material.Sat, 17 Oct 2026 22:38:31 GMTnetworkthreatsJustin Howehttps://nulltap.com/p/microsoft-nvidia-open-weight-model-risk/https://nulltap.sh/p/microsoft-nvidia-open-weight-model-risk/The joint guidance separates model evaluations from the permissions, data access and tools of the application that uses a model.Sat, 17 Oct 2026 19:28:29 GMTaiappsecJustin Howehttps://nulltap.com/p/volexity-volcano-recovers-browser-traces/https://nulltap.sh/p/volexity-volcano-recovers-browser-traces/A replayed Chrome-to-Windows intrusion left encoded script in free memory. Capture RAM early, then use host artifacts to guide wider collection.Sat, 17 Oct 2026 16:30:29 GMTendpointthreatsaiJustin Howehttps://nulltap.com/p/fortinet-cli-file-traversal/https://nulltap.sh/p/fortinet-cli-file-traversal/CISA added a flaw affecting four Fortinet products to KEV. Match installed releases to Fortinet's fixes, then examine privileged CLI access and file changes.Sat, 17 Oct 2026 13:30:28 GMTnetworkthreatsJustin Howehttps://nulltap.com/p/connectwise-backup-tenant-access/https://nulltap.sh/p/connectwise-backup-tenant-access/An abused vendor-held Cloud Backup credential obtained app-only Graph tokens. Find the service principal, disable sign-in, then inspect roles and added secrets.Sat, 17 Oct 2026 10:38:27 GMTcloudidentityJustin Howehttps://nulltap.com/p/cisco-email-attachment-root-write/https://nulltap.sh/p/cisco-email-attachment-root-write/Exploited file-write flaw reaches gateways using File Reputation and older scanner tools. Check each appliance's logs and scanner version before choosing an update or rebuild.Fri, 16 Oct 2026 22:36:22 GMTnetworkthreatsJustin Howehttps://nulltap.com/p/cl-unk-1211-government-php-web-shells/https://nulltap.sh/p/cl-unk-1211-government-php-web-shells/Attackers changed PHP configuration to reload a web shell, stole passwords through a sudo alias and searched government mailboxes for social media access.Fri, 16 Oct 2026 19:38:21 GMTthreatsaiJustin Howehttps://nulltap.com/p/aomei-update-tampering-backdoors/https://nulltap.sh/p/aomei-update-tampering-backdoors/UNC7017 changed two AOMEI configuration files for minutes at a time. Hunt updater-launched files and scheduled tasks even after the vendor restored its servers.Fri, 16 Oct 2026 16:36:20 GMTendpointthreatsJustin Howehttps://nulltap.com/p/beyondtrust-armory-castle-root-persistence/https://nulltap.sh/p/beyondtrust-armory-castle-root-persistence/The actor exploited Remote Support, installed a root backdoor and reached managed endpoints. Patch BT26-05, then investigate appliance persistence and sessions.Fri, 16 Oct 2026 13:30:18 GMTnetworkidentitythreatsJustin Howehttps://nulltap.com/p/fortinet-fortisandbox-gui-login-bypass/https://nulltap.sh/p/fortinet-fortisandbox-gui-login-bypass/Crafted HTTP requests can bypass FortiSandbox management login. Check appliance and PaaS versions, upgrade affected branches and restrict GUI reachability.Fri, 16 Oct 2026 10:32:17 GMTnetworkappsecJustin Howehttps://nulltap.com/p/tls-libraries-certificate-name-checks/https://nulltap.sh/p/tls-libraries-certificate-name-checks/The same signed certificate can pass one validator and fail another. Test the actual TLS path, update affected libraries and keep issued names explicit.Thu, 15 Oct 2026 22:38:13 GMTidentitynetworkJustin Howehttps://nulltap.com/p/komodo-periphery-host-commands/https://nulltap.sh/p/komodo-periphery-host-commands/Komodo Periphery passes some restricted-user requests to a shell on managed servers. Upgrade agents to 2.3.0 and review Logs and Execute grants.Thu, 15 Oct 2026 19:46:11 GMTcloudappsecJustin Howehttps://nulltap.com/p/lowcoder-tenant-query-access/https://nulltap.sh/p/lowcoder-tenant-query-access/An admin or developer in one organization can reach another's Query Library on a shared instance. Restrict the affected API while a security update is pending.Thu, 15 Oct 2026 16:52:10 GMTappseccloudJustin Howehttps://nulltap.com/p/bisheng-sso-admin-tokens/https://nulltap.sh/p/bisheng-sso-admin-tokens/The legacy SSO route issues a JWT for a supplied username and remains unpatched; separate cross-user assistant and workflow flaws have release-specific fixes.Thu, 15 Oct 2026 13:34:09 GMTidentityappsecaiJustin Howehttps://nulltap.com/p/cisco-email-hardening-exploited-flaws/https://nulltap.sh/p/cisco-email-hardening-exploited-flaws/Cisco updates Secure Email Gateway and Secure Email and Web Manager across five weakness groups. Compare each appliance's build with its product-specific fixed release.Thu, 15 Oct 2026 10:42:08 GMTnetworkJustin Howehttps://nulltap.com/p/palo-alto-pan-os-management-root-code/https://nulltap.sh/p/palo-alto-pan-os-management-root-code/Limited exploitation targets authenticated access to PAN-OS management. Compare installed hotfixes, restrict the admin path and inspect three vendor-listed IPs.Wed, 14 Oct 2026 22:36:01 GMTnetworkthreatsJustin Howehttps://nulltap.com/p/yam-store-cloud-tenants-phishing-kits/https://nulltap.sh/p/yam-store-cloud-tenants-phishing-kits/Microsoft traces a broker reselling cloud tenant access and storage to phishing kits. Examine app credentials, privileged grants and hosted files in affected tenants.Wed, 14 Oct 2026 18:58:02 GMTcloudidentitythreatsJustin Howehttps://nulltap.com/p/microsoft-windows-file-warning-bypass/https://nulltap.sh/p/microsoft-windows-file-warning-bypass/The October updates address an exploited Windows Shell bypass and separate unauthenticated DHCP Server code execution. Check installed builds on endpoints and DHCP hosts.Wed, 14 Oct 2026 18:54:00 GMTendpointnetworkJustin Howehttps://nulltap.com/p/watchguard-vpn-fake-download-credentials/https://nulltap.sh/p/watchguard-vpn-fake-download-credentials/A lookalike download page collects the VPN server and credentials twice, then starts a signed WatchGuard installer. Check browser history and VPN logins.Wed, 14 Oct 2026 18:48:00 GMTidentitynetworkthreatsJustin Howehttps://nulltap.com/p/microsoft-windows-shell-exploited-bypass/https://nulltap.sh/p/microsoft-windows-shell-exploited-bypass/CISA flags active exploitation of a Windows Shell security bypass. Compare affected desktop and server builds with Microsoft's CVE record and prioritize updates.Tue, 13 Oct 2026 22:37:55 GMTendpointJustin Howehttps://nulltap.com/p/shopware-media-upload-admin-token/https://nulltap.sh/p/shopware-media-upload-admin-token/An uploaded HTML file can run in a Shopware administrator's browser. Restrict media creation or block HTML uploads while checking who can reach existing media.Tue, 13 Oct 2026 19:35:53 GMTappsecidentityJustin Howehttps://nulltap.com/p/ivanti-vpn-root-credential-theft/https://nulltap.sh/p/ivanti-vpn-root-credential-theft/A patched-at-the-time Connect Secure VPN fell to a three-flaw chain. Upgrade affected branches and investigate memory, LDAP traffic and movement from the appliance.Tue, 13 Oct 2026 16:41:51 GMTnetworkidentitythreatsJustin Howehttps://nulltap.com/p/gitlab-ci-regex-server-code/https://nulltap.sh/p/gitlab-ci-regex-server-code/A crafted CI configuration and UTF-8 repository path can reach a vulnerable regex compiler on self-managed GitLab. Upgrade the affected 19.2, 19.3 and 19.4 branches.Tue, 13 Oct 2026 13:51:52 GMTappsecJustin Howehttps://nulltap.com/p/microsoft-pqc-certificates-testbeds/https://nulltap.sh/p/microsoft-pqc-certificates-testbeds/A closed TLS pilot exposes the certificate-chain work ahead. Map issuers and validators, then test ML-DSA certificates across real application paths outside production.Tue, 13 Oct 2026 10:53:50 GMTidentitynetworkJustin Howehttps://nulltap.com/p/taiwan-event-google-phishing/https://nulltap.sh/p/taiwan-event-google-phishing/Talos traced event invitations and altered poster QR codes to a live Google sign-in relay. Inspect the actual registration destination and review affected accounts.Mon, 12 Oct 2026 22:33:43 GMTidentitythreatsaiJustin Howehttps://nulltap.com/p/apex-accelerator-fake-audits-malware/https://nulltap.sh/p/apex-accelerator-fake-audits-malware/Two Apex npm tools fetch executables and attacker-selected commands; one also sends coding-agent conversations to an Apex server. Find the tools and revoke exposed secrets.Mon, 12 Oct 2026 19:37:42 GMTthreatsappsecaiJustin Howehttps://nulltap.com/p/thelia-back-office-server-code/https://nulltap.sh/p/thelia-back-office-server-code/CERT/CC details code-execution paths in Thelia 2.6; a separate Thelia 3 email-template flaw has a module fix. Restrict admin access and check permissions.Mon, 12 Oct 2026 16:35:41 GMTappsecJustin Howehttps://nulltap.com/p/cisco-talos-malware-prompts-ai-triage/https://nulltap.sh/p/cisco-talos-malware-prompts-ai-triage/Plaintext instructions in malware samples shifted some model triage toward benign. Search extracted strings and keep sample text out of the scanner's instruction channel.Mon, 12 Oct 2026 13:55:40 GMTaithreatsJustin Howehttps://nulltap.com/p/huntress-clickfix-run-chain-kills/https://nulltap.sh/p/huntress-clickfix-run-chain-kills/In a Windows ClickFix case, endpoint-side termination stopped repeated command pastes; check enforce mode and the process tree before treating an alert as a block.Mon, 12 Oct 2026 10:37:38 GMTendpointthreatsJustin Howehttps://nulltap.com/p/strapi-filter-private-fields/https://nulltap.sh/p/strapi-filter-private-fields/Strapi user filters can disclose reset tokens. Find vulnerable releases, inspect GET requests for private-field probes and move to a patched branch.Sun, 11 Oct 2026 22:33:33 GMTappsecidentityJustin Howehttps://nulltap.com/p/proftpd-file-copy-exploitation/https://nulltap.sh/p/proftpd-file-copy-exploitation/ProFTPD's mod_copy flaw lets remote attackers read and write arbitrary files. Check reachable FTP services, command logs and distribution patches.Sun, 11 Oct 2026 19:29:31 GMTnetworkthreatsJustin Howehttps://nulltap.com/p/cisco-nexus-mpls-echo-root-code/https://nulltap.sh/p/cisco-nexus-mpls-echo-root-code/An enabled MPLS OAM feature exposes affected Nexus switches to crafted echo-requests; check feature state, then disable it or move to fixed NX-OS.Sun, 11 Oct 2026 16:31:30 GMTnetworkJustin Howehttps://nulltap.com/p/cisco-nexus-ngoam-root-code/https://nulltap.sh/p/cisco-nexus-ngoam-root-code/Enabled NGOAM exposes a packet-processing flaw on standalone Nexus 3000 and 9000 switches; two more flaws require VXLAN overlay or SRv6 features.Sun, 11 Oct 2026 13:37:28 GMTnetworkJustin Howehttps://nulltap.com/p/ahsaycbs-webshell-miner/https://nulltap.sh/p/ahsaycbs-webshell-miner/A backup management server became a SYSTEM-level foothold. Restrict its web interface and hunt for a fake Edge service, JSP shells and miner traffic.Sun, 11 Oct 2026 10:31:27 GMTthreatsappsecJustin Howehttps://nulltap.com/p/cisco-nx-api-root-execution/https://nulltap.sh/p/cisco-nx-api-root-execution/Enabled NX-API on affected Nexus switches exposes an unauthenticated request path; UCS 6300 fabric interconnects have a separate credential-dependent path.Sat, 10 Oct 2026 22:29:23 GMTnetworkJustin Howehttps://nulltap.com/p/isc-bind-tkey-dns-outage/https://nulltap.sh/p/isc-bind-tkey-dns-outage/A crafted TKEY query can stop vulnerable BIND DNS servers before access controls run. Check the running build and install the vendor's patched package.Sat, 10 Oct 2026 19:39:22 GMTnetworkthreatsJustin Howehttps://nulltap.com/p/papercut-emergency-patches-scan-fax-rce/https://nulltap.sh/p/papercut-emergency-patches-scan-fax-rce/watchTowr traced a new authentication bypass and Scan-to-Fax code-execution chain through an interim PaperCut build. Check the running version and past access to its web interface.Sat, 10 Oct 2026 16:35:22 GMTappsecnetworkJustin Howehttps://nulltap.com/p/netscaler-log-poisoning-web-shell/https://nulltap.sh/p/netscaler-log-poisoning-web-shell/Unit 42 traced an exploited NetScaler command-injection chain through two appliance logs into a disguised PHP shell. Preserve logs and inspect the web-server configuration.Sat, 10 Oct 2026 13:49:21 GMTnetworkthreatsJustin Howehttps://nulltap.com/p/cisco-nx-os-switch-fabric-fixes/https://nulltap.sh/p/cisco-nx-os-switch-fabric-fixes/Cisco's NX-OS hardening release covers MDS, Nexus and UCS fabric interconnects. Match device family and management mode to the first fixed build.Fri, 09 Oct 2026 19:51:19 GMTnetworkJustin Howehttps://nulltap.com/p/cisco-license-on-prem-hardening-fixes/https://nulltap.sh/p/cisco-license-on-prem-hardening-fixes/Cisco groups multiple License On-Prem flaws under four CVEs. Inventory the former SSM On-Prem too, migrate older branches, and verify the fixed release.Fri, 09 Oct 2026 16:47:19 GMTnetworkidentityJustin Howehttps://nulltap.com/p/apache-struts-dmi-code-execution/https://nulltap.sh/p/apache-struts-dmi-code-execution/A remote execution path depends on Dynamic Method Invocation. Identify reachable Struts 2 apps, disable that feature or move to an Apache-listed fix, and triage exposure.Fri, 09 Oct 2026 10:43:19 GMTappsecthreatsJustin Howehttps://nulltap.com/p/microsoft-forge-fix-queue/https://nulltap.sh/p/microsoft-forge-fix-queue/Microsoft's research shows how bug volume can overwhelm validation and release work. Check affected dependency builds and carry reproducible findings through a shipped fix.Thu, 08 Oct 2026 22:59:17 GMTappsecaiJustin Howehttps://nulltap.com/p/onlyoffice-docs-upload-rce/https://nulltap.sh/p/onlyoffice-docs-upload-rce/CISA lists an exploited image-upload traversal in ONLYOFFICE Document Server before 5.6.3. Find older JWT-enabled servers, update them and check their exposure.Thu, 08 Oct 2026 22:41:17 GMTappsecthreatsJustin Howehttps://nulltap.com/p/akira-ransomware-shared-folder-encryption/https://nulltap.sh/p/akira-ransomware-shared-folder-encryption/Huntress reconstructed an Akira attack from Shellbags, ransomware logs and shadow-copy events after its endpoint agent arrived too late to record the launch.Thu, 08 Oct 2026 16:39:17 GMTthreatsendpointidentityJustin Howe