Public posts with this hashtag.
Possible Phishing 🎣
on: ⚠️hxxps[:]//docs[.]google[.]com/presentation/d/e/2PACX-1vRolxFAW7hyzfBrqjLicr37CaJihNGZ0r-rAqdHi98FAi1N9sEk0uARbExM-_b77QgVlcphzXXU6qb5/pub?start=false&loop=false&delayms=3000
🧬 Analysis at: https://urldna.io/scan/6ad766133b775000091c1a83
#cybersecurity #phishing #infosec #urldna #scam #infosec
urldna.iourlDNA - The DNA test for websitesUnleash website insights! urldna.io analyzes data, monitors brands and exposes security risks. Analyze URLs like a DNA test
AI spending shifts beyond IT, testing CIO-CFO decision rights
💡 Corporate AI spending has doubled to 3.3% of revenue, but 80% sits outside traditional IT budgets. CIOs, CFOs, and business leaders must collaborate through formal councils with clear accountability: business leaders own outcomes, CFOs manage finances, CIOs oversee tech. Unified governance and transparency are essential for maximizing AI's business impact.
IT StrategyAI spending shifts beyond IT, testing CIO-CFO decision rights | TechTargetWith 80% of AI spending outside IT, CIOs and CFOs are redefining who controls architecture, capital allocation and accountability for value.
🚨New ransom group blog post!🚨
Group name: N0n
Post title: 51Ridge (Newark NJ hosting/IT)
Organization: 51Ridge
Location: 🇺🇸 US
Sector: Technology
Info: https://cti.fyi/#disclosure/N0n/51Ridge%20%28Newark%20NJ%20hosting%2FIT%29
#ransomware #cti #threatintelligence #cybersecurity #infosec
CTI.FYICTI.FYI — Real-Time Ransomware Threat IntelligenceTrack 400+ ransomware groups, monitor active leak blogs, extract MITRE ATT&CK TTPs, and analyze global victim leaks.
CVE-2026-106173 is a critical path traversal flaw in Fortinet FortiSIEM. An unauthenticated attacker can write files and run code through its gRPC service.
FortiSIEM 7.5.0 is affected; 7.6 and Cloud are not. A public exploit is circulating per Horizon3.
Upgrade to FortiSIEM 7.5.1 or later.
FortiGuard LabsPSIRT | FortiGuard LabsNone
🛡️ Manager, Security Operations Center at Huntress
📍 US
💰 $165k–$185k/yr
Apply: https://blueteamjobs.com/job/manager-security-operations-center-huntress-xftgk9/
#BlueTeam #InfoSec #CyberSecurityJobs #SecurityOperationsLeadership
BlueTeamJobsManager, Security Operations Center at HuntressHuntress is hiring a Manager, Security Operations Center, United States. Pay: $165k–$185k a year. What We Do: Cybercrime is growing, and more businesses…
🚨New ransom group blog posts!🚨
Group name: Booba Project
Post title: City Hall - Everett, MA
Organization: Everett City Hall
Location: 🇺🇸 US
Sector: Government & Public Sector
Info: https://cti.fyi/#disclosure/Booba%20Project/City%20Hall%20-%20Everett%2C%20MA
Group name: Booba Project
Post title: City of Mt. Angel, Oregon
Organization: City of Mt. Angel
Location: 🇺🇸 US
Sector: Government & Public Sector
Info: https://cti.fyi/#disclosure/Booba%20Project/City%20of%20Mt.%20Angel%2C%20Oregon
Group name: Booba Project
Post title: Pearland Pediatrics
Location: 🇺🇸 US
Sector: Healthcare
Info: https://cti.fyi/#disclosure/Booba%20Project/Pearland%20Pediatrics
Group name: Booba Project
Post title: Chicago Vein Institute
Location: 🇺🇸 US
Sector: Healthcare
Info: https://cti.fyi/#disclosure/Booba%20Project/Chicago%20Vein%20Institute
Group name: Booba Project
Post title: Research Foundation of The City University of New York
Location: 🇺🇸 US
Sector: Education
Info: https://cti.fyi/#disclosure/Booba%20Project/Research%20Foundation%20of%20The%20City%20University%20of%20New%20York
Group name: Booba Project
Post title: COASTAL CAROLINA NEUROPSYCHIATRIC CENTER, PA
Organization: COASTAL CAROLINA NEUROPSYCHIATRIC CENTER
Location: 🇺🇸 US
Sector: Healthcare
Info: https://cti.fyi/#disclosure/Booba%20Project/COASTAL%20CAROLINA%20NEUROPSYCHIATRIC%20CENTER%2C%20PA
#ransomware #cti #threatintelligence #cybersecurity #infosec
CTI.FYICTI.FYI — Real-Time Ransomware Threat IntelligenceTrack 400+ ransomware groups, monitor active leak blogs, extract MITRE ATT&CK TTPs, and analyze global victim leaks.
Launched today: Agentmetry, a local-first endpoint sensor for AI coding agents. Open source, Apache-2.0.
The problem: coding agents now run shell commands, read files and call MCP tools with the developer's own permissions. The transcript is a conversation, not a record, and EDR sees a process start a process, which is exactly what a working agent looks like.
How it works:
- Hooks at the tool boundary of Claude Code, Cursor, Codex, GitHub Copilot, Antigravity, Qwen, Kimi, Qoder and CodeBuddy. Stdio MCP servers go through an audit proxy.
- Every tool call lands in a hash-chained JSONL trail on your machine. Edit one record and agentmetry verify fails. agentmetry anchor publishes a checkpoint the host cannot rewrite.
- Arguments are hashed inside the hook by default. DLP matches record the rule id, never the secret.
- Sequence detections, not single-event alerts: a credential read followed by network egress is one finding. Labelled with MITRE ATT&CK, and ATLAS where it adds something.
- MCP rug-pull detection: tools/list is fingerprinted per tool, so a listing that moves while the config stays the same is flagged (ATLAS AML.T0109).
- Forwards to Splunk, Elastic, Google SecOps or Microsoft Sentinel. No telemetry, nothing leaves until you configure a sink.
What it does not do:
- It only sees agents whose hooks are installed. A browser chat or an IDE with hooks off is invisible.
- It records what a shell call launched, not what that process did inside. That is your EDR's job.
- Windows and Linux are tested in CI. macOS is in preview.
- Public alpha, one maintainer.
The detection benchmark ships in the package: 57 cases, 0 missed, 0 false positives. Rerun it with agentmetry benchmark rather than trusting me.
Try it with nothing installed: uvx agentmetry demo
It replays a credential theft into a temp folder, raises the finding, then shows the trail failing verification after one edit.
Criticism very welcome, especially from anyone doing detection engineering or rolling agents out to a team.
Code: https://github.com/blitzcrieg1/agentmetry
Launch: https://www.producthunt.com/products/agentmetry
#infosec #AIsecurity #opensource #DFIR #detectionengineering #MCP
🆕 New event added:
📌 BSidesNoVA
📅 Oct 31, 2026
📍 Arlington (VA) 🇺🇸
🔗 https://www.bsidesnova.org/
www.bsidesnova.orgBSides NoVA
🛡 THREAT INTEL | Kingwood Endoscopy
🔴 Actor "N0n" claims Undisclosed
Allegedly exposed
• Passwords
• Health records
⚠️ Unverified claim
https://www.yazoul.net/intel/claim/2026-10-19-kingwood-endoscopy-ransomware-claim-by-n0n-oct-2026
by Yazoul AI
Yazoul SecurityKingwood Endoscopy Ransomware Claim by N0n (Oct 2026)N0n allegedly claims Kingwood Endoscopy as a victim, citing stolen credentials and system access. Read our unverified threat intel analysis and stay alert.
Autonomous AI agents breached over 100 online retailers using Cairn and DeepSeek, compromising corporate networks for just $50 per successful intrusion.
🆕 New event added:
📌 BSidesSofia
📅 Mar 26-28, 2027
📍 Sofia 🇧🇬
🔗 https://securitybsides.bg
securitybsides.bgBSides Sofia 2027International Cybersecurity Community Event BSides Sofia 2027 - 26-28 March, Sofia - Call for Papers is open
🆕 New event added: @bsidesseattle
📌 BSidesSeattle
📅 Mar 5-6, 2027
📍 Seattle (WA) 🇺🇸
🔗 https://www.bsidesseattle.com
Bsides SeattleBsides SeattleBsides Seattle Security Conference
Geopolitics and the cyber resilience gap belong in your threat model
AI and geopolitics are reshaping cybersecurity. CEOs now prioritize cyber-enabled fraud over ransomware, with 73% of people experiencing it. However, a resilience gap widens: smaller orgs lack skills and resources while 91% of large firms adapt to geopolitical threats. Better governance and public-private collaboration are critical.
https://www.helpnetsecurity.com/2026/10/12/akshay-joshi-wef-cyber-resilience-gap/
Help Net SecurityGeopolitics and the cyber resilience gap belong in your threat model - Help Net SecurityWEF's Akshay Joshi on AI threats, cyber-enabled fraud, geopolitics, and the widening cyber resilience gap between large and small companies.
HACKFEST 2026 SPONSOR: ASTATE
Our 18th edition, Hackfest Level Up, would not be possible without our sponsors. And this year, we are happy to have Astate, a KIOSK sponsor!
If you want to learn more about this company’s mission, visit their website https://astate.one/
PS: YOU CAN STILL BUY YOUR TICKET for October 29–31, 2026 at the Convention Center of Québec ;) More info: https://hackfest.ca/en/?utm_source=mastodon&utm_medium=socmed&utm_campaign=sponsors
Three government programs already. Specter brought proof to every one.
The US Department of State just acknowledged a vulnerability our autonomous pentesting engine reported through its HackerOne disclosure program, following the US Department of Defense and the UK Ministry of Defence.
A maybe doesn’t get fixed. Every finding needs evidence a team can reproduce.
How it works: https://pentest-tools.com/features/ai-pentests
All acknowledgments: https://hackerone.com/pentesttools_specter?type=user
Pentest-Tools.comAI Pentests - autonomous web application penetration testingSee how AI Pentests autonomously investigate web applications, validate exploitable vulnerabilities, and generate evidence-backed penetration testing reports.
State of (in)security - Week 42, 2026
In week 42 of 2026 (Oct. 12–19), incidents rose to 39 from 25 while advisories fell to 15 from 22. Known impacted individuals more than doubled to about 26.7 million. Highest breach was BK Japan's 11.18 million-record breach. Unauthorized access (12) and ransomware/malware (9) were the main causes of incidents. Healthcare (8) and tech (7) were the most-hit sectors. Actively exploited flaws reported in Ivanti, Palo Alto PAN-OS, Citrix NetScaler, Cisco, BeyondTrust, SonicWall and Zimbra, plus a Microsoft zero-day.
**Update Chrome to version 155.0.8059.79 or later, and any other Chromium-based browser you use (Edge, Brave, Opera, Vivaldi), and restart it ASAP. A malicious website, PDF, or even an ad on a trusted news site can take over your browser without a click, so keep automatic updates on for your browser, phone, computer and apps (on Android, include "Android System WebView") and add a trusted ad-blocker like uBlock Origin.**
#cybersecurity #infosec #knowledge #weeklyreport
https://beyondmachines.net/event_details/state-of-in-security-week-42-2026-s-g-o-m-1/gD2P6Ple2L
BeyondMachinesState of (in)security - Week 42, 2026In week 42 of 2026 (Oct. 12–19), incidents rose to 39 from 25 while advisories fell to 15 from 22. Known impacted individuals more than doubled to about 26.7 million. Highest breach was BK Japan's 11.18 million-record breach. Unauthorized access (12) and ransomware/malware (9) were the main causes of incidents. Healthcare (8) and tech (7) were the most-hit sectors. Actively exploited flaws reporte
🔴 New security advisory:
CVE-2026-107083 affects multiple systems.
• Impact: Remote code execution or complete system compromise possible
• Risk: Attackers can gain full control of affected systems
• Mitigation: Patch immediately or isolate affected systems
Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-107083-slims-9-8-0-sql-injection-leaks-admin-data-poc
by Yazoul AI
Yazoul SecuritySLiMS 9.8.0 SQL injection leaks admin data (CVE-2026-107083) [PoC]CVE-2026-107083: SLiMS Bulian 9.8.0 SQL injection via fileID in dl_detail.php, CVSS 9.8 unauthenticated. Upgrade past 9.8.0 or restrict admin/modules access.
New Go security releases added explicit distrust for some specific intermediate CA certificates belonging to eMudhra Technologies Limited. Interestingly, this is tracked as CVE-2026-111943 but no details on why this was done are provided.
https://github.com/golang/go/commit/7f86f957633ee31a1c17a1eb8452ca7a3d9bc141
SFTP server dumps are a relic. Seeing one in October 2026 is like finding a dial-up modem in a data center. It's not just old; it's negligent.
A ban that took effect in July, announced in October, with no security concerns detailed. Efficient. #DeepSeek #AI #CyberSecurity #InfoSec #Cynicism
BBC NewsDeepSeek banned from US government in race with China for AI dominanceThe Chinese technology is removed from most US government agencies as race for AI dominance steps up.
Possible Phishing 🎣
on: ⚠️hxxps[:]//faceb0k-facebook[.]blogspot[.]com
🧬 Analysis at: https://urldna.io/scan/6ad72dbe3b775000065918bb
#cybersecurity #phishing #infosec #urldna #scam #infosec
urldna.iourlDNA - The DNA test for websitesUnleash website insights! urldna.io analyzes data, monitors brands and exposes security risks. Analyze URLs like a DNA test
🚨 17 CVEs across 12 AI agent frameworks — one disclosure wave, same three design failures.
6× CVSS 9.8 unauthenticated RCE:
- Piflow: POST /chat → exec_shell, no auth
- Langchain-Chatchat: /tools/call invokes shell tool, no auth
- DB-GPT: mock auth grants everyone admin
- Letta: compose.yaml omits LETTA_SERVER_SECURE, all routes open
- Cognition: no auth on REST/SSE API (fixed: 0.13.0)
5× 8.8: approval gates return True, unsandboxed python3, async sub-agents skip interrupt_on.
2× 8.3 IDOR: IBM Langflow OSS (fixed: 1.12.5), Coze Studio (fixed: 0.5.2).
7 products have no published fix. Put an auth proxy in front, bind DB ports to localhost, and rotate every secret in the execution environment.
https://threataft.com/articles/ai-agent-framework-rce-mega-cluster-17-cves
ThreatAftAI Agent RCE Cluster: 17 CVEs, Auth Defaults Off | ThreatAft17 AI agent framework CVEs in one disclosure wave: auth defaults off, sandboxing absent, approval gates bypassable. Full CVE list and fixes.
UK keeps AI safeguards in the maybe pile for Cyber Security Bill
Tech trends: Nvidia boosts local AI with RTX Spark; Brave adds encrypted AI chats. TSMC eyes US datacenters; Linux devs embrace AI tools responsibly. Security concerns: Russian phishing via Signal, Microsoft SharePoint zero-days. EQT acquires Acronis amid ransomware threats. NetBSD emerges as AI-free OS; Ubuntu, Firefox innovate; KDE marks 30 years with AI desktop plans.
theregisterUK keeps AI safeguards in the maybe pile for Cyber Security BIllOfficials say amendments remain under consideration despite minister's pledge to act
🚨New ransom group blog posts!🚨
Group name: N0n
Post title: Finzly Corp
Location: 🇺🇸 US
Sector: Financial Services
Info: https://cti.fyi/#disclosure/N0n/Finzly%20Corp
Group name: N0n
Post title: The Akeeli Group
Location: 🇺🇸 US
Sector: Professional Services
Info: https://cti.fyi/#disclosure/N0n/The%20Akeeli%20Group
Group name: N0n
Post title: Kingwood Endoscopy
Location: 🇺🇸 US
Sector: Healthcare
Info: https://cti.fyi/#disclosure/N0n/Kingwood%20Endoscopy
Group name: N0n
Post title: Hotel DuPont
Location: 🇺🇸 US
Sector: Hospitality & Tourism
Info: https://cti.fyi/#disclosure/N0n/Hotel%20DuPont
Group name: N0n
Post title: Froggys Fog
Location: 🇺🇸 US
Sector: Manufacturing
Info: https://cti.fyi/#disclosure/N0n/Froggys%20Fog
Group name: N0n
Post title: Vormittag Associates Inc
Location: 🇺🇸 US
Sector: Technology
Info: https://cti.fyi/#disclosure/N0n/Vormittag%20Associates%20Inc
Group name: N0n
Post title: Company #93
Info: https://cti.fyi/#disclosure/N0n/Company%20%2393
Group name: N0n
Post title: Company #94
Info: https://cti.fyi/#disclosure/N0n/Company%20%2394
Group name: N0n
Post title: Company #95
Info: https://cti.fyi/#disclosure/N0n/Company%20%2395
Group name: N0n
Post title: Company #96
Info: https://cti.fyi/#disclosure/N0n/Company%20%2396
Group name: N0n
Post title: Company #97
Info: https://cti.fyi/#disclosure/N0n/Company%20%2397
Group name: N0n
Post title: Company #98
Info: https://cti.fyi/#disclosure/N0n/Company%20%2398
#ransomware #cti #threatintelligence #cybersecurity #infosec
CTI.FYICTI.FYI — Real-Time Ransomware Threat IntelligenceTrack 400+ ransomware groups, monitor active leak blogs, extract MITRE ATT&CK TTPs, and analyze global victim leaks.
NightSpire Ransomware Claim Follows Colorado County System Disruption
Colorado County, Texas, reported a disruption affecting government systems and potentially threatening essential public services. The NightSpire ransomware group claimed responsibility for the disruption
****
#cybersecurity #infosec #incident #ransomware
https://beyondmachines.net/event_details/nightspire-ransomware-claim-follows-colorado-county-system-disruption-o-d-n-s-s/gD2P6Ple2L
BeyondMachinesNightSpire Ransomware Claim Follows Colorado County System DisruptionColorado County, Texas, reported a disruption affecting government systems and potentially threatening essential public services. The NightSpire ransomware group claimed responsibility for the disruption
Possible Phishing 🎣
on: ⚠️hxxp[:]//barcelona-facebook[.]blogspot[.]com
🧬 Analysis at: https://urldna.io/scan/6ad7356c3b775000043baed8
#cybersecurity #phishing #infosec #urldna #scam #infosec
urldna.iourlDNA - The DNA test for websitesUnleash website insights! urldna.io analyzes data, monitors brands and exposes security risks. Analyze URLs like a DNA test
ASN: AS58461
Location: Ningbo, CN
Added: 2026-10-17T11:59
GMO Cybersecurity by Ierae found ARTEX, an open-source AI pentest tool from China, on attack servers targeting about 20 Japanese companies, campaign by campaign and industry by industry. 8 had already disclosed breaches.
CrowdStrike saw the same tool, with Claude Code sessions, hit Korean banks. The developer stopped work; the forks remain.
https://japancyberwatch.com/articles/artex-ai-pentest-tool-japan-breach-wave-gmo-2026
CVE-2026-43845: Advantech ADAM-3600 has a critical password reset flaw (CVSS 9.2) enabling network-based auth bypass. No patch or known exploits yet. Restrict access, monitor activity. https://radar.offseq.com/threat/cve-2026-43845-vulnerability-in-advantech-adam-3600-332b402f61c80bb0 #OffSeq #ICS #Infosec #Vulnerability
