[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"author:marcus-lenngren":3},{"author":4,"posts":27},{"slug":5,"name":6,"job_title":7,"short_bio":8,"photo_url":9,"linkedin_url":10,"same_as":11,"bio_md":12,"location":13,"expertise":14,"credentials":22,"updated_at":26},"marcus-lenngren","Marcus Lenngren","Founder, ThreatNoir","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],"Marcus leads a security engineering team that supports the security operations centre of a global retailer: detection, data ingestion and the automation around it. He reshaped that team into a lean, self-sustaining organisation.\n\n## Earlier roles\n\n- **CTO and CISO, Entraction**: an online gaming company in a heavily regulated market, later acquired by IGT.\n- **CTO, Fenix \u002F Framtidsmedia**\n- **Head of Applications, Network and Data Centre, Schibsted Sverige**\n- **Co-founder, Sportway**: sports coverage with AI-driven cameras.\n\nResponsible for PCI compliance, ISO 27001 (IT-Operations and DevOps), Nevada Gaming Comission, Hearing for DOJ representatives, Upscaling R&D, Transforming business to Cloud from DC\u002FOnPrem (Monolith to MicroServices etc).  And some more.\n\n## Leading teams\n\nHe has led teams of 5 as well as departments of 70 people across IT, R&D and security operations, including nearshore and offshore delivery. He has built organisations up and reshaped them into smaller, self-sufficient ones.\n\n## Hands-on\n\nHe has written software since the mid-1980s, in C, C++, C#, Python and Go, and still writes code for his own projects.\n\n## Why ThreatNoir\n\nHe started ThreatNoir to turn the daily flood of security news into something defenders and boards can act on: which controls matter, what NIS2 and DORA ask for, and what to ask a vendor.","Stockholm, Sweden",[15,16,17,18,19,20,21],"Security operations and detection","NIS2 and DORA","AI security","PCI DSS","Security leadership and governance","Risk management","Choosing security controls and vendors",[23,24,25],"CISSP","CISM","AAISM","2026-10-17T21:18:56.388+00:00",[28,37,44,51,58,65,72,79,86,93,100,107,114,121,128,135,144,152,159,166,173,180,187,195,202,209,216],{"slug":29,"kind":30,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":6,"published_at":35,"reading_minutes":36},"check-point-gaia-under-attack-php2shell-chained-to-root-for","rapid-alert","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","2026-11-13T11:18:49.874+00:00",3,{"slug":38,"kind":30,"title":39,"excerpt":40,"cover_image_url":41,"cover_image_alt":42,"author_name":6,"published_at":43,"reading_minutes":36},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","2026-11-13T08:52:08.367+00:00",{"slug":45,"kind":30,"title":46,"excerpt":47,"cover_image_url":48,"cover_image_alt":49,"author_name":6,"published_at":50,"reading_minutes":36},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","2026-11-12T08:02:16.435+00:00",{"slug":52,"kind":30,"title":53,"excerpt":54,"cover_image_url":55,"cover_image_alt":56,"author_name":6,"published_at":57,"reading_minutes":36},"sparrow-framework-china-linked-clusters-use-fake-chrome-cert","Sparrow framework: China-linked clusters use fake Chrome cert warnings and Linux footholds","Check Point links three China-nexus espionage clusters through the Sparrow framework, run by a supplier it calls CopperDragon. Watering holes push fake Chrome certificate fixes that install the SquadC backdoor, while Linux servers are used as entry points.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fsparrow-framework-china-linked-clusters-use-fake-chrome-cert-54104957-cover.png","Sparrow \u002F SquadC rapid alert: Got a 'Certificate Fix' prompt? That installer is a backdoor.","2026-11-11T14:07:03.811+00:00",{"slug":59,"kind":30,"title":60,"excerpt":61,"cover_image_url":62,"cover_image_alt":63,"author_name":6,"published_at":64,"reading_minutes":36},"microsoft-november-2026-patch-tuesday-exploited-outlook-ntlm","Microsoft November 2026 Patch Tuesday: exploited Outlook NTLM zero-day among 1,093 fixes","Microsoft's November 2026 Patch Tuesday fixes 1,093 CVEs, including CVE-2026-124194, an actively exploited Outlook spoofing flaw that leaks a user's NTLMv2 hash when a crafted file is opened. Patch Outlook first and block outbound NTLM.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fmicrosoft-november-2026-patch-tuesday-exploited-outlook-ntlm-ff3584f4-cover.png","CVE-2026-124194 rapid alert: Still trust an .msg from a stranger? One open leaks your NTLMv2 hash.","2026-11-10T20:19:01.411+00:00",{"slug":66,"kind":30,"title":67,"excerpt":68,"cover_image_url":69,"cover_image_alt":70,"author_name":6,"published_at":71,"reading_minutes":36},"google-patches-eighth-exploited-chrome-zero-day-of-2026-xml","Google patches eighth exploited Chrome zero-day of 2026: XML use-after-free CVE-2026-125350","Google has shipped an emergency Chrome update for CVE-2026-125350, a high-severity use-after-free in the XML component that attackers are already exploiting. Update to 157.0.8103.50 and relaunch tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fgoogle-patches-eighth-exploited-chrome-zero-day-of-2026-xml-8d70dfbb-cover.png","Chrome 157.0.8103.50 rapid alert: Is Chrome your daily browser? One bad page can run their code.","2026-11-10T11:41:11.865+00:00",{"slug":73,"kind":30,"title":74,"excerpt":75,"cover_image_url":76,"cover_image_alt":77,"author_name":6,"published_at":78,"reading_minutes":36},"sshole-cve-2026-123158-openssh-authentication-bypass-hits","SSHole (CVE-2026-123158): OpenSSH authentication bypass hits Alpine and musl systems, exploited within hours","An OpenSSH flaw lets attackers log into passwordless accounts on Alpine Linux and other musl-based systems using an oversized password. One connection, no retries. Patched in 10.6p2 on 5 Nov, exploited in the wild within nine hours. What to do tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fsshole-cve-2026-123158-openssh-authentication-bypass-hits-0144dfdb-cover.png","OpenSSH 10.6p2 rapid alert: Your container built on Alpine? One SSH connection and root is theirs.","2026-11-06T13:21:25.555+00:00",{"slug":80,"kind":30,"title":81,"excerpt":82,"cover_image_url":83,"cover_image_alt":84,"author_name":6,"published_at":85,"reading_minutes":36},"openai-s-ai-pipeline-built-948-working-linux-kernel-root","OpenAI's AI pipeline built 948 working Linux kernel root exploits in one run: what admins should do now","OpenAI says an autonomous pipeline on an unreleased cyber model produced 1,169 working local root exploits for 948 unique Linux kernel flaws in a mid-October run. Patches are landing upstream in stages. Treat any unpatched box as root-exposed and update now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fopenai-s-ai-pipeline-built-948-working-linux-kernel-root-95462f16-cover.png","Linux Kernel LPEs rapid alert: Running an unpatched Linux box? A normal user account is now root.","2026-11-06T10:33:12.697+00:00",{"slug":87,"kind":30,"title":88,"excerpt":89,"cover_image_url":90,"cover_image_alt":91,"author_name":6,"published_at":92,"reading_minutes":36},"apt29-watering-holes-hit-ios-and-android-with-zero-click-n","APT29 watering holes hit iOS and Android with zero-click n-day exploit chains","Sekoia links a large watering hole campaign to Russia's APT29. Poisoned and cloned sites, plus a one-week compromise of the Plerdy analytics tracker, served n-day exploit chains to outdated iPhones and Android Chrome. No click needed. Update now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fapt29-watering-holes-hit-ios-and-android-with-zero-click-n-e6d884f7-cover.png","APT29 WateringHole rapid alert: Phone one version behind? One page view and it's drained.","2026-11-05T12:57:11.234+00:00",{"slug":94,"kind":30,"title":95,"excerpt":96,"cover_image_url":97,"cover_image_alt":98,"author_name":6,"published_at":99,"reading_minutes":36},"barracuda-esg-pre-auth-bypass-chains-with-root-command","Barracuda ESG: pre-auth bypass chains with root command injection across six product lines","Barracuda disclosed CVE-2026-116606 (CVSS 9.3) and CVE-2026-111560 (CVSS 8.6) on 2 Nov 2026. Chained, they bypass authorization and give root on affected appliances. Patches are out. No active exploitation reported yet.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fbarracuda-esg-pre-auth-bypass-chains-with-root-command-dbf2dea8-cover.png","Barracuda ESG rapid alert: Your email gateway is a Barracuda? Chained, it may be root with no login.","2026-11-04T15:14:35.355+00:00",{"slug":101,"kind":30,"title":102,"excerpt":103,"cover_image_url":104,"cover_image_alt":105,"author_name":6,"published_at":106,"reading_minutes":36},"node-red-cve-2026-58115-exploited-in-the-wild-one-http","Node-RED CVE-2026-58115 exploited in the wild: one HTTP request drops Linux bots and webshells","A missing authentication flaw in Node-RED (CVSS 10.0) is under active exploitation. Attackers send a single POST to deploy a flow that runs arbitrary code, planting a Linux bot and persistent webshells. Check whether your instance is reachable and whether adminAuth is set.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fnode-red-cve-2026-58115-exploited-in-the-wild-one-http-e1d48fa9-cover.png","Node-RED CVE-58115 rapid alert: Node-RED reachable from outside? One POST and the box runs their code.","2026-11-04T12:56:21.464+00:00",{"slug":108,"kind":30,"title":109,"excerpt":110,"cover_image_url":111,"cover_image_alt":112,"author_name":6,"published_at":113,"reading_minutes":36},"linux-kernel-tcp-rce-cve-2026-98432-attackers-are-scanning","Linux kernel TCP RCE CVE-2026-98432: attackers are scanning now, Red Hat patched, Ubuntu fixes in testing","A critical use-after-free in the Linux kernel's IPv4 TCP code lets remote, unauthenticated attackers run code as root. Rated 9.8. Scanning began on 2 Nov. Red Hat has patched RHEL 8, 9 and 10; Ubuntu's fixes are still in -proposed.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Flinux-kernel-tcp-rce-cve-2026-98432-attackers-are-scanning-b4529a6f-cover.png","Linux TCP CVE-2026-98432 rapid alert: Running a Linux server on 443? One SYN packet gets root, no login.","2026-11-04T05:18:56.278+00:00",{"slug":115,"kind":30,"title":116,"excerpt":117,"cover_image_url":118,"cover_image_alt":119,"author_name":6,"published_at":120,"reading_minutes":36},"artex-ai-autonomous-agents-run-active-directory-attacks-at","ARTEX AI: autonomous agents run Active Directory attacks at machine speed against 200+ orgs","Chinese-linked actors are using the open-source ARTEX AI framework to automate Kerberoasting, DCSync and lateral movement. Google, Mandiant and CrowdStrike report attacks on over 200 organisations, with one breach reaching root in 12 minutes.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fartex-ai-autonomous-agents-run-active-directory-attacks-at-02704500-cover.png","ARTEX AI rapid alert: Still trust slow attacks to catch? A machine takes your domain in minutes","2026-11-03T04:23:57.557+00:00",{"slug":122,"kind":30,"title":123,"excerpt":124,"cover_image_url":125,"cover_image_alt":126,"author_name":6,"published_at":127,"reading_minutes":36},"xcpe-botnet-1-3m-android-tv-boxes-shipped-with-a-backdoor","XCPE botnet: 1.3M Android TV boxes shipped with a backdoor, Google and police disrupt it","Google, Japan's NPA and partners disrupted XCPE, a backdoor that OEM Videostrong allegedly built into Android TV box firmware, enrolling more than 1.3 million devices. Removing the app does not help: it reinstalls from a protected partition on reboot.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fxcpe-botnet-1-3m-android-tv-boxes-shipped-with-a-backdoor-305686fc-cover.png","XCPE botnet rapid alert: Bought a cheap Android TV box? The backdoor shipped inside it.","2026-11-03T04:18:31.219+00:00",{"slug":129,"kind":30,"title":130,"excerpt":131,"cover_image_url":132,"cover_image_alt":133,"author_name":6,"published_at":134,"reading_minutes":36},"coruna-and-darksword-zero-click-iphone-spyware-steals-data","Coruna and DarkSword: zero-click iPhone spyware steals data from a single web page visit","Two iPhone exploit kits, Coruna and DarkSword, infect phones from a single web page with no app and no prompt. Zimperium found 608 delivery domains. Apple has notified targeted users in 99 countries. Every CVE is already patched.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcoruna-and-darksword-zero-click-iphone-spyware-steals-data-9c36ddb3-cover.png","Coruna\u002FDarkSword rapid alert: Your iPhone on iOS 17 or 18? One web page visit and it is theirs.","2026-11-01T05:36:03.059+00:00",{"slug":136,"kind":137,"title":138,"excerpt":139,"cover_image_url":140,"cover_image_alt":141,"author_name":6,"published_at":142,"reading_minutes":143},"package-security-without-starting-on-the-laptop","analysis","Package security in three steps, and why you do not have to start on the laptop","AI coding agents now pick and install packages on engineering machines in seconds, and few teams can say what was pulled in. A threat feed you can search this week, a registry firewall that fits the network you already run, and the endpoint last. Notes from a session with Socket.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fblog\u002Fai-1cc0747e-9558-4214-a9a4-10cae453ca38.png","A digital shield protects a data stream from threats, representing layered package security.","2026-10-31T07:07:36.208+00:00",4,{"slug":145,"kind":137,"title":146,"excerpt":147,"cover_image_url":148,"cover_image_alt":149,"author_name":6,"published_at":150,"reading_minutes":151},"cve-2026-98432-linux-kernel-tcp-what-to-do","CVE-2026-98432: a 9.8 Linux kernel flaw, a deferred fix and what to do in the gap","An AI-written remote root exploit, a bug in every kernel since 4.4, and vendors scoring it anywhere from 5.9 to 9.8. Ubuntu and RHEL have no fix yet. How to decide what to patch first and how to reduce the exposure while you wait.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fblog\u002Fai-4ee6c546-7fd1-43f2-9acd-02f62d04fbc5.png","A digital lockbox with a red vulnerability inside, surrounded by hesitant hands and a looming shadow.","2026-10-31T06:44:50.239+00:00",5,{"slug":153,"kind":30,"title":154,"excerpt":155,"cover_image_url":156,"cover_image_alt":157,"author_name":6,"published_at":158,"reading_minutes":36},"trojanised-claude-code-extension-2-1-313-planted-a","Trojanised Claude Code extension 2.1.313 planted a persistent SSH backdoor on developer machines","On 29 Oct 2026 a malicious build of the official Claude Code VS Code extension, version 2.1.313, reached Open-VSX and Cursor's marketplace. It plants an attacker SSH key, opens a reverse tunnel and installs persistence. Uninstalling alone does not clean it.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Ftrojanised-claude-code-extension-2-1-313-planted-a-9095d41a-cover.png","Claude Code 2.1.313 rapid alert: Did Cursor update your Claude Code? A stranger's SSH key is on your box.","2026-10-30T20:01:51.383+00:00",{"slug":160,"kind":30,"title":161,"excerpt":162,"cover_image_url":163,"cover_image_alt":164,"author_name":6,"published_at":165,"reading_minutes":36},"oracle-ebs-cve-2026-101767-unauthenticated-rce-now-being","Oracle EBS CVE-2026-101767: unauthenticated RCE now being probed, patch is the October CPU","Attackers began probing for CVE-2026-101767, a CVSS 9.8 SQL injection in Oracle E-Business Suite that chains to remote code execution, one week after Oracle patched it. Over 670 EBS instances are exposed. Apply the October 2026 CPU now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Foracle-ebs-cve-2026-101767-unauthenticated-rce-now-being-24318bd5-cover.png","Oracle EBS 101767 rapid alert: Oracle EBS on the internet? One request runs as the APPS user.","2026-10-28T14:44:21.327+00:00",{"slug":167,"kind":30,"title":168,"excerpt":169,"cover_image_url":170,"cover_image_alt":171,"author_name":6,"published_at":172,"reading_minutes":36},"microsoft-teams-it-support-scams-mail-bombing-fake-help","Microsoft Teams IT support scams: mail bombing, fake help desks, remote access and Chaos ransomware","Arctic Wolf documented more than 400 cases of attackers abusing Microsoft Teams external chat to pose as IT support, flood inboxes with spam, then talk staff into granting remote access. Some intrusions ended in data theft and ransomware. No Teams bug is involved.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fmicrosoft-teams-it-support-scams-mail-bombing-fake-help-6423377f-cover.png","Teams IT Scam rapid alert: Is Teams external chat on? A stranger can reach every employee.","2026-10-28T06:09:32.672+00:00",{"slug":174,"kind":30,"title":175,"excerpt":176,"cover_image_url":177,"cover_image_alt":178,"author_name":6,"published_at":179,"reading_minutes":36},"apple-ships-october-2026-updates-304-fixes-webkit-code","Apple ships October 2026 updates: 304 fixes, WebKit code execution and kernel bugs across every platform","Apple released its October 2026 security updates on 26 Oct, fixing 304 vulnerabilities. The WebKit set includes several code execution flaws plus sandbox escapes. No new zero-day, but a known exploited bug was back-ported to iOS 18. Patch now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fapple-ships-october-2026-updates-304-fixes-webkit-code-a18e4fbd-cover.png","iOS\u002FmacOS 27.2 rapid alert: iPhone or Mac on your network? A crafted web page can run code.","2026-10-28T06:09:17.067+00:00",{"slug":181,"kind":30,"title":182,"excerpt":183,"cover_image_url":184,"cover_image_alt":185,"author_name":6,"published_at":186,"reading_minutes":36},"gheist-campaign-abuses-stolen-github-tokens-to-dump-private","Gheist campaign abuses stolen GitHub tokens to dump private repo and cloud secrets via Actions logs","Since 15 Sep 2026, the Gheist campaign has planted a sync-check workflow in over 13,500 branches using stolen GitHub tokens, printing secrets to Actions logs and pulling them before deleting the run. Public repos are protected by a GitHub hold, but private repos and GitHub Enterprise Server are not.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fgheist-campaign-abuses-stolen-github-tokens-to-dump-private-1032a4f5-cover.png","Gheist rapid alert: Stolen GitHub token, private repo? Every secret in it got printed.","2026-10-27T05:06:27.466+00:00",{"slug":188,"kind":137,"title":189,"excerpt":190,"cover_image_url":191,"cover_image_alt":192,"author_name":6,"published_at":193,"reading_minutes":194},"honeypots-see-attacks-first","Honeypots see attacks before the patch, but how do companies act on it?","Amazon's decoys are probed within 90 seconds of going online. What deception and honeypots do for the security community, and six small steps that let an ordinary team act on early warnings with the people it has.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fblog\u002Fai-1f0002b6-fc7e-49f4-9d6c-fb41c50beb17.png","A decoy server is immediately surrounded by incoming attack probes and attempts on a dark digital background.","2026-10-26T06:27:00+00:00",8,{"slug":196,"kind":30,"title":197,"excerpt":198,"cover_image_url":199,"cover_image_alt":200,"author_name":6,"published_at":201,"reading_minutes":36},"node2shell-node-js-brotli-decoder-rce-cve-2026-111497","Node2Shell: Node.js Brotli decoder RCE (CVE-2026-111497) patched in all supported lines","Node.js fixed an out-of-bounds write in its bundled Brotli decoder on 21 October. Imperva's Node2Shell PoC ran code on an official 24.22.0 build. Upgrade to 22.23.4, 24.22.1 or 26.12.1. There is no workaround in Node.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fnode2shell-node-js-brotli-decoder-rce-cve-2026-111497-e52ba6df-cover.png","Node2Shell rapid alert: Does your service decode Brotli? One crafted stream can run code.","2026-10-23T16:42:51.248+00:00",{"slug":203,"kind":30,"title":204,"excerpt":205,"cover_image_url":206,"cover_image_alt":207,"author_name":6,"published_at":208,"reading_minutes":36},"arista-patches-third-exploited-velocloud-orchestrator-zero","Arista Patches Third Exploited VeloCloud Orchestrator Zero-Day in Four Months (CVE-2026-114625)","CVE-2026-114625 is a critical SQL injection in VeloCloud Orchestrator on-prem, CVSS 9.9, actively exploited. Any authenticated user with the lowest tenant role can become a superuser operator. Patch to 5.2.3.18, 6.1.3.10 or 6.4.2.12 and hunt for abuse now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Farista-patches-third-exploited-velocloud-orchestrator-zero-714429b3-cover.png","VeloCloud VCO rapid alert: Your SD-WAN runs VeloCloud? One low tenant login owns the box.","2026-10-23T15:26:13.908+00:00",{"slug":210,"kind":30,"title":211,"excerpt":212,"cover_image_url":213,"cover_image_alt":214,"author_name":6,"published_at":215,"reading_minutes":36},"php2shell-critical-pre-auth-rce-in-php-core-under-broad","PHP2Shell: Critical Pre-Auth RCE in PHP Core Under Broad Exploitation, Patch Now","Two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), allow unauthenticated remote code execution. Exploitation began four days before the 21 Oct patches. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fphp2shell-critical-pre-auth-rce-in-php-core-under-broad-f10ea3b4-cover.png","PHP2Shell rapid alert: Running PHP on the internet? One crafted request and code runs.","2026-10-23T12:58:01.88+00:00",{"slug":217,"kind":30,"title":218,"excerpt":219,"cover_image_url":220,"cover_image_alt":221,"author_name":6,"published_at":222,"reading_minutes":36},"litellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker","LiteLLM 1.107.0 supply chain attack: poisoned PyPI and Docker images steal cloud and AI credentials","On 21 Oct, LiteLLM 1.107.0 shipped a credential stealer and backdoor through all seven PyPI wheels and Docker images. The packages were live for about three hours and downloaded over 49,000 times. Just starting Python in an affected environment runs the malware. Clean version: 1.106.2.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Flitellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker-ceecec71-cover.png","LiteLLM 1.107.0 rapid alert: Ran LiteLLM 1.107.0 anywhere? Just starting Python leaked your keys.","2026-10-23T12:58:00.867+00:00"]