Newsletter
Two themes today: supply chain trust keeps snapping (LiteLLM shipped malware through official channels) and “minor” logic bugs turn into major privacy failures (Signal calls that won’t die). Also, a 6.38M-member disclosure reminds us how fast consumer datasets become phishing fuel.
Newsletter
Healthcare portals, school nonprofits, and your web stack all took hits in the same 48 hours. The theme is simple: attacker-controlled input is everywhere, and “edge” now includes your dependencies.
Newsletter
Edge access is the new perimeter again: SafePay’s 600+ victim runbook, Zeabur’s 3.2M environment-variable spill, and PHP2Shell’s unauth RCE are all the same story. Plus: Collabora RCE backdooring Nextcloud, and SonicWall SMA SSRF exploitation attempts.
Newsletter
When a certificate authority’s intermediate keys are recoverable, the blast radius is everything that forgot to update. Plus: NEC’s vendor account abuse with encryption, Siemens ClickFix abusing a signed app, and a FortiSIEM RCE PoC you can’t ignore.
Newsletter
Today’s theme is “trusted paths betrayed”: media servers exposed for convenience, signed installers used as carriers, and official plugin and CLI distribution channels quietly poisoned. Patch fast, then hunt like you were already late.
Newsletter
Extortion crews are doing finance-grade ops without ransomware, counties are getting bulk file-theft at terabyte scale, and web platforms are back in the “patch window is the exploit window” era. Plus: Drupal core RCE and a critical LearnPress deserialization bug.
Newsletter
Supply-chain trust got abused three different ways: a backup app jumped tenants, a testing vendor’s SFTP got scraped, and a court-critical contractor outage broke statutory workflows. Plus, new PoCs keep turning “client-side” bugs into exec paths.
Newsletter
Fast food apps are now breach-grade identity stores: 11.18M Burger King Japan accounts exposed, U.S. municipalities are back on the incident treadmill, and researchers keep turning “fixed last month” bugs into today’s weaponized playbooks.
Newsletter
Healthcare keeps leaking at population scale, while attackers quietly pivot from laptops to appliances and AI gateways. Today: 1.4M COPC patients, BeyondTrust zero-day post-exploitation tradecraft, LiteLLM takeover chains, and an exploited Cisco email gateway bug.
Daily newsletter for CISOs
A stolen employee credential turned Meta’s GitHub into an unexpected HR data leak. Palo Alto shipped an exploited PAN-OS management RCE, while Linux vhost “Vghost” raised the VM-escape stakes. Plus, Docker Hub’s PAT transfer bug is a supply-chain nightmare in disguise.
Patch Tuesday broke the odometer at 1,411 fixes, while Ivanti’s Connect Secure got hit with an in-the-wild auth bypass chain. Plus: a Trump Phone customer leak claim and the Mark-of-the-Web bypass you really do not want in your inbox.
Retail and OT had a rough night: attackers remotely defrosted refrigeration at up to 350 French supermarkets, Ahold Delhaize pulled systems offline, GitLab dropped a max-severity RCE fix, and SonicWall SMA exploits are already knocking.
A contractor PC exposed 8.6M karaoke fan records in Japan, cloud ransomware ripple effects keep growing, Zenity shows how one prompt can yank cloud creds from AWS agents, and Citrix SAML configs get a critical RCE/DoS bulletin.
Today’s thread: attackers keep skipping “endpoints” and going straight for the control plane, identity flows, and notification rails. Extortion crews name-name-shame, while exploited network and mail server bugs keep giving them an easy on-ramp.
Today’s thread is “trusted third parties, trusted defaults.” iRhythm’s breach is a reminder that attackers don’t need your core systems if they can reach your hosted apps, your vendors, or your employee HR stack. Plus: Frontline’s K-12 ripple, Live Nation’s silent filing, and a critical Atlassian Da
Credential theft is back on top: Oracle Health’s Cerner blast radius jumps to nearly 20M, utilities lose 400K accounts via a portal, and ASOS gets popped by straight-up impersonation. Plus: Atlassian file-read scans, FortiBleed lockouts, and a CVSS 10 SonicWall SSRF.
A bad day for “trusted third parties”: an IR vendor allegedly paid ransoms in secret, a forgotten analytics box leaked 1M emails, and ccTLD operators let attackers mint Google TLS certs. Plus: Atlassian exploitation, SonicWall SSRF, and fresh pods.
Arizona courts say 1.3M people had data copied after one click. ASOS pushes “HACKED” alerts via its own app stack. Atlassian drops a critical file-read across eight Data Center products. Plus: Citrix SAML NetScaler DoS and npm malware that hid for years.
Identity data keeps leaking through “trusted access” and “trusted login” paths: Denmark’s CPR registry, Nikkei’s M365 mailbox, and a medical school ransomware case. Plus: Citrix SAML DoS zero-day, Rejetto HFS RCE scanning, and Google pauses OSS bug bounties due to AI spam.
Today’s theme is “control-plane trust.” One stolen user mailbox, one unauth API endpoint, one edge appliance feature, and one WAF rule gap are all it takes to turn “we’re fine” into “we’re filing notices.”
Identity systems keep failing loud and wide: a Danish university IAM breach hits 200,000, K-12 staff SSNs spill via a vendor flaw, and a hospice manager loses PHI for 35,916 Texans. Meanwhile, law enforcement squeezes extortion crews, and AI features ship with command execution footguns.
