Fake event invites target Taiwan researchers’ Google accounts
Talos traced event invitations and altered poster QR codes to a live Google sign-in relay. Inspect the actual registration destination and review affected accounts.
Read article →identity
Authentication, access, credentials, and identity systems.
CISA lists exploited Strapi filter flaw that exposes private fields
Strapi user filters can disclose reset tokens. Find vulnerable releases, inspect GET requests for private-field probes and move to a patched branch.
Read article →
Cisco Fixes Four License On-Prem Flaw Groups in 10-202609
Cisco groups multiple License On-Prem flaws under four CVEs. Inventory the former SSM On-Prem too, migrate older branches, and verify the fixed release.
Read article →
Akira Ransomware Leaves a File-Share Trail After Late EDR Deployment
Huntress reconstructed an Akira attack from Shellbags, ransomware logs and shadow-copy events after its endpoint agent arrived too late to record the launch.
Read article →
Atlassian file-read flaw exposes web-root secrets in eight products
An unauthenticated file read reaches known paths inside eight Atlassian server products. Match installed branches to fixes and review decoded access logs.
Read article →
Microsoft urges 24-hour fixes for critical on-premises systems
Microsoft urges faster fixes for critical on-premises systems. Check patch deployment logs, installed-update status and Baseline Security Mode configuration exceptions.
Read article →
Cisco Talos maps RMM, decoys and agent controls to disrupt attackers
A legitimate remote-support agent can give a ransomware operator persistent access. Inventory approved tools, watch credential-access behavior and make agent sessions stoppable.
Read article →
Star Blizzard Sends RedFlick Archives to Plant Windows Tasks
Reply-stage archives lead to RedFlick scheduled tasks and CosmicPulse. Hunt the task names, trace the archive, and verify senders through a known channel.
Read article →
WSO2 API Flaw Draws Conflicting Accounts as CISA Confirms Exploitation
CISA describes file upload and possible code execution; WSO2 describes a JWT bypass and account takeover. Check product builds and reconcile the attack path with WSO2.
Read article →
CISA Lists Exploited F5 BIG-IP APM Flaw Allowing Code Execution
The exposed configuration is an APM OAuth Authorization Server virtual server. Request F5’s interim iRule for triage, then install the applicable final fix.
Read article →
Storm-2570 Reuses Remote Access to Steal Data and Deploy Ransomware
Microsoft tracked the same affiliate through four ransomware ecosystems. Hunt renamed MeshAgent services, domain-controller copies and cloud-transfer tooling before encryption.
Read article →
Norwegian Cruise Line Ship Doors Accept Cloned Keycards
Some shipboard access readers accept a copied card identifier. Identify UID-only doors, shield issued cards and add supervised access to sensitive areas while seeking a fix.
Read article →
IBM Turbonomic Operator Grants Cluster-Wide Access to Secrets
Prometurbo's service account could read secrets outside its own namespace. Reinstall the fixed agent and test the operator's effective permissions.
Read article →Showing 14–26 of 65