Public posts with this hashtag.
🚨New ransom group blog post!🚨
Group name: anubis
Post title: Fisher59
Sector: Other
Info: https://cti.fyi/#disclosure/anubis/Fisher59
#ransomware #cti #threatintelligence #cybersecurity #infosec
CTI.FYICTI.FYI — Real-Time Ransomware Threat IntelligenceTrack 400+ ransomware groups, monitor active leak blogs, extract MITRE ATT&CK TTPs, and analyze global victim leaks.
ASN: AS41765
Location: Buis-les-Baronnies, FR
Added: 2026-10-17T11:56
Former OpenAI engineer Abdulrahman Alfozan will remain detained pending trial on allegations of covert recordings, per a US filing reported by Ars Technica. The case matters for insider-threat modeling in frontier AI labs handling sensitive research. #InsiderThreat #OpenAI #InfoSec
https://cyberworldops.eu/en/court-keeps-former-openai-engineer-detained-over-alleged-covert
CyberWorldOpsFormer OpenAI Engineer Detained Over Alleged RecordingsUS court ordered ex-OpenAI engineer Abdulrahman Alfozan detained pending trial over alleged hidden recorders in offices, prosecutors say.
The cyber talent shortage? Job postings just hit a four-year low
🚨 Cybersecurity job market cooling: US postings hit 4-year low in 2026 with 235,786 openings—26.4% down YoY. Major shift happening: GRC roles surging (14.8% of postings, up from 9.4%), while technical defense roles declining (47.1% to 41.5%). CISO hiring volatile due to exec turnover. AI security roles rising. Risk management now prioritized over pure defense.
https://www.helpnetsecurity.com/2026/10/16/cybersecurity-job-postings-talent-shortage/
Help Net SecurityThe cyber talent shortage? Job postings just hit a four-year low - Help Net SecurityCybersecurity job postings hit a four-year low in 2026 as compliance roles gain share and CISO hiring swings, new CyberSN data shows.
If you're not running routine security reviews of your PRs, you need to rethink your workflow. Use more than one model to review work and propose fixes.
Opus 5.5, Daybreak Blue, and GLM 5.3 are all excellent to use in tandem. Time to update your AGENTS.md.
Give each model a clear scope, ask for concrete failure cases and fixes, then verify the fixes before merging. Opus 5.5 is great for correctness and if you don't have access to Daybreak Blue, request it, and use GLM 5.3 in the meantime.
🤖 nginx 1.31.7 / 1.30.6 fix memory-safety flaws: buffer overflow via alias+rewrite (CVE-2026-15176), use-after-free in async file I/O (CVE-2026-97205), overflow in script evaluation (CVE-2026-93479), request body injection in HTTP/3 (CVE-2026-95101). nginx rates them medium; F5's OOB bulletin flags them critical.
🔗 https://nginx.org/en/security_advisories.html
#CVE #InfoSec #nginx
🟠 New security advisory:
CVE-2026-80343 affects multiple systems.
• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours
Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-80343-camel-netty-http-auth-bypass-exposes-routes-poc
by Yazoul AI
Yazoul SecurityCamel Netty HTTP auth bypass exposes routes (CVE-2026-80343) [PoC]CVE-2026-80343: Apache Camel 4.0.0-4.22.0 Netty HTTP security constraint bypass lets unauthenticated callers reach protected routes. Upgrade to 4.23.0 or 4.18.5/4.22.1 LTS.
Possible Phishing 🎣
on: ⚠️hxxps[:]//facebook-22[.]blogspot[.]com
🧬 Analysis at: https://urldna.io/scan/6ad5f2233b77500004c2bcc4
#cybersecurity #phishing #infosec #urldna #scam #infosec
urldna.iourlDNA - The DNA test for websitesUnleash website insights! urldna.io analyzes data, monitors brands and exposes security risks. Analyze URLs like a DNA test
Kiteworks CISO: Why We Shut Down Systems Before Finding Vulnerability
Kiteworks shut down systems after federal cyberattack warnings, discovering a critical vulnerability without evidence of breach. While this proactive move protected data, experts warn other vendors may hesitate due to SLA penalties & customer backlash. Key takeaway: Companies need pre-planned crisis protocols, leadership buy-in, and balanced risk assessments to respond quickly to threats without full shutdowns.
CybersecurityKiteworks CISO: Why We Shut Down Systems Before Finding Vulnerability | TechTargetKiteworks CISO Frank Balonis explains why the vendor issued a nine-hour proactive shutdown after federal warnings, and why other SaaS vendors hesitate to follow.
2026-10-19 RDP #Honeypot IOCs - 8964 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec
Top IPs:
154.36.174.33 - 7245
45.154.96.17 - 1566
136.244.100.79 - 18
Top ASNs:
AS979 - 7245
AS212815 - 1566
AS396982 - 36
Top Accounts:
hello - 7278
administrator - 108
Administrator - 90
Top ISPs:
NetLab Global - 7245
Dyjix SAS - 1566
Google LLC - 36
Top Clients:
Unknown - 8964
Top Software:
Unknown - 8964
Top Keyboards:
Unknown - 8964
Top IP Classification:
Unknown - 7263
hosting - 1695
mobile - 3
Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key
2026-10-19 RDP #Honeypot IOCs - 5976 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec
Top IPs:
154.36.174.33 - 4830
45.154.96.17 - 1044
136.244.100.79 - 12
Top ASNs:
AS979 - 4830
AS212815 - 1044
AS396982 - 24
Top Accounts:
hello - 4852
administrator - 72
Administrator - 60
Top ISPs:
NetLab Global - 4830
Dyjix SAS - 1044
Google LLC - 24
Top Clients:
Unknown - 5976
Top Software:
Unknown - 5976
Top Keyboards:
Unknown - 5976
Top IP Classification:
Unknown - 4842
hosting - 1130
mobile - 2
Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key
2026-10-19 RDP #Honeypot IOCs - 2988 scans
Thread with top 3 features in each category and links to the full dataset
#DFIR #InfoSec
Top IPs:
154.36.174.33 - 2415
45.154.96.17 - 522
136.244.100.79 - 6
Top ASNs:
AS979 - 2415
AS212815 - 522
AS396982 - 12
Top Accounts:
hello - 2426
administrator - 36
Administrator - 30
Top ISPs:
NetLab Global - 2415
Dyjix SAS - 522
Google LLC - 12
Top Clients:
Unknown - 2988
Top Software:
Unknown - 2988
Top Keyboards:
Unknown - 2988
Top IP Classification:
Unknown - 2421
hosting - 565
mobile - 1
Pastebin links with full 24-hr RDP Honeypot IOC Lists:
Bad API request, invalid api_dev_key
CVE-2026-112371: CRITICAL code injection in H3C Magic NX15 (CVSS 9.4). Public exploit allows remote code execution via /api/esps. No patch yet — restrict device access. Details: https://radar.offseq.com/threat/cve-2026-112371-code-injection-in-h3c-magic-nx15-047130e6380b2198 #OffSeq #H3C #infosec #vulnerability
Possible Phishing 🎣
on: ⚠️hxxps[:]//nugtgsr222[.]weebly[.]com
🧬 Analysis at: https://urldna.io/scan/6ad60e223b77500007bd2ff8
#cybersecurity #phishing #infosec #urldna #scam #infosec
urldna.iourlDNA - The DNA test for websitesUnleash website insights! urldna.io analyzes data, monitors brands and exposes security risks. Analyze URLs like a DNA test
ASN: AS14265
Location: Los Angeles, US
Added: 2026-10-17T12:02
🐧 SIGINT // Ubuntu Watch — 2026-10-20
Kernel escape vuln with real patching urgency. This roundup gives actual check commands and per-distro fix status for Ubuntu, Debian, RHEL, Proxmox - more actionable than the bare CVE entry for patching your fleet tonight.
🔗 https://smartscope.blog/en/blog/cve-2026-99999-pwnescape-linux-kernel-vulnerability-affected-2026/
SmartScopeCVE-2026-99999 (PwnEscape): Am I affected? Fix status for RHEL, Ubuntu, Debian, Amazon Linux and ProxmoxAm I affected by CVE-2026-99999 (PwnEscape)? Check commands and OS fix status for RHEL, Ubuntu, Debian, Amazon Linux, Proxmox VE and SUSE, including confirmed Debian, Amazon Linux and Proxmox kernels, unconfirmed fixes, and host update and reboot steps.
Possible Phishing 🎣
on: ⚠️hxxp[:]//cuddly-disco-alpha[.]vercel[.]app/
🧬 Analysis at: https://urldna.io/scan/6ad63ea43b77500002f4d890
#cybersecurity #phishing #infosec #urldna #scam #infosec
urldna.iourlDNA - The DNA test for websitesUnleash website insights! urldna.io analyzes data, monitors brands and exposes security risks. Analyze URLs like a DNA test
Standard Chartered Group CISO on AI, Cyber Risk and the Future of Banking Security
CISOs are evolving from tech-only defenders to strategic business leaders. Standard Chartered's Group CISO emphasizes holistic cybersecurity accountability across tech, processes, and financial crime. Key shifts: integrating security into business ops, staying ahead of AI threats, and going beyond compliance. Success requires balancing technical expertise with business acumen while securing the entire ecosystem of clients and partners.
https://www.infosecurity-magazine.com/interviews/standard-chartered-group-ciso/
Infosecurity MagazineStandard Chartered Group CISO on AI, Cyber Risk and Banking SecurityCezary Piekarski says banking CISOs must look beyond regulatory compliance to stay ahead of evolving cyber threats and technology risks
🚨 RELAY // Cyber Watch — 2026-10-20
A breach of the OpenCode Console may have exposed users' OpenAI, Anthropic and Google API keys, so affected users should rotate their keys.
🔗 https://thehackernews.com/2026/10/opencode-console-breach-may-have.html
The Hacker NewsOpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API KeysOpenCode says a Console breach may have exposed AI provider keys belonging to 1.4% of users, prompting revocation notices.
🔒 Security News Digest - 2026-10-19
📊 8 updates from 4 sources:
🔹 The Record from Recorded Future News: Two more Serbian opposition figures targeted with spyware, researchers say
https://therecord.media/serbia-spyware-pegasus-elections
🔹 darkreading: ConnectWise Disables Cloud Backups Amid Concerns for Downstream MSPs
https://www.darkreading.com/identity-access-management-security/connectwise-disables-cloud-backups-downstream-msps
🔹 The Record from Recorded Future News: ConnectWise suspends Cloud Backup service after supply chain attack
https://therecord.media/connectwise-suspends-cloud-backup-service-supply-chain-attack
🔹 The Record from Recorded Future News: Judge denies WhatsApp’s bid to hold spyware maker in contempt for allegedly targeting users
https://therecord.media/whatsapp-denied-appeal-alleged-nso-group-violation-injunction
🔹 darkreading: 'AdFection' Turns Ad Impressions Into Zero-Click Spyware Delivery
https://www.darkreading.com/data-privacy/adfection-online-ads-spyware-delivery
🔹 iTnews - Security: Ex-OpenAI employee accused of planting device appears to have Saudi backing
https://www.itnews.com.au/news/ex-openai-employee-accused-of-planting-device-appears-to-have-saudi-backing-629760?utm_source=feed&utm_medium=rss&utm_campaign=iTnews+Security+feed
🔹 darkreading: Researchers Infiltrate Microsoft Tech Support Scam Operation
https://www.darkreading.com/threat-intelligence/microsoft-tech-support-scam-operation
🔹 Unit 42: Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257 (Updated October 19)
https://unit42.paloaltonetworks.com/active-exploitation-of-pan-os-cve-2026-0257/
therecord.mediaTwo more Serbian opposition figures targeted with spyware, researchers sayA phone belonging to the rector of the University of Belgrade was discovered to have been infected with Pegasus spyware, the latest in a series of such discoveries in the lead-up to Serbia's national elections.
🚨New ransom group blog posts!🚨
Group name: payload
Post title: Brüninghoff Group
Location: 🇩🇪 DE
Sector: Construction
Info: https://cti.fyi/#disclosure/payload/Br%C3%BCninghoff%20Group
Group name: payload
Post title: BW Office World
Location: 🇩🇪 DE
Sector: Other
Info: https://cti.fyi/#disclosure/payload/BW%20Office%20World
#ransomware #cti #threatintelligence #cybersecurity #infosec
CTI.FYICTI.FYI — Real-Time Ransomware Threat IntelligenceTrack 400+ ransomware groups, monitor active leak blogs, extract MITRE ATT&CK TTPs, and analyze global victim leaks.
🚨🔓 SIGINT // Cybersecurity Watch — 2026-10-20
Compromised ConnectWise credential let attackers sign into 173 Microsoft 365 tenants, exposing deep supply-chain risk in MSP tooling.
https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html
#Cybersecurity #SupplyChain #Microsoft365 #InfoSec
The Hacker NewsHackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 TenantsAttackers used a compromised ConnectWise Cloud Backup credential for unauthorized sign-ins across 173 Microsoft 365 tenants.
Possible Phishing 🎣
on: ⚠️hxxps[:]//neda-facebook[.]blogspot[.]com
🧬 Analysis at: https://urldna.io/scan/6ad5f8b63b77500006fb743a
#cybersecurity #phishing #infosec #urldna #scam #infosec
urldna.iourlDNA - The DNA test for websitesUnleash website insights! urldna.io analyzes data, monitors brands and exposes security risks. Analyze URLs like a DNA test
Spend vs. debt: what's the bigger security risk?
More cybersecurity spending doesn't mean better security. Organizations accumulate "security debt" through complexity & unnecessary controls, increasing fragility. Experts advocate for automation & tool integration over adding more layers. Real risk management measures resilience, not just compliance. CISOs must communicate cyber threats in business terms—revenue impact, recovery ability—to engage boards effectively. 🔒
https://www.cio.com/article/4233353/spend-vs-debt-whats-the-bigger-security-risk.html
CIOSpend vs. debt: what’s the bigger security risk?Organizations continue investing heavily in cybersecurity, yet many are simultaneously increasing operational complexity and long-term security fragility. Here, Joan Goodchild from CSO speaks with veteran CISO Selim Aissi about security debt and why it may be a more meaningful measure of cyber risk than security budget size alone.
In Japan, the ransomware name everyone knows is Qilin, thanks to the Asahi attack.
On the leak sites, 2026 belongs to The Gentlemen: 23 Japanese organizations listed this year (ransomware.live), vs 15 for Qilin. Group-IB says it grew out of a Qilin affiliate team, and it hands affiliates compromised FortiGates.
The brand changes; the way in doesn't.
https://japancyberwatch.com/articles/japan-ransomware-groups-2026-the-gentlemen-qilin
🚨New ransom group blog post!🚨
Group name: qilin
Post title: GardaWorld
Location: 🇨🇦 CA
Sector: Professional Services
Info: https://cti.fyi/#disclosure/qilin/GardaWorld
#ransomware #cti #threatintelligence #cybersecurity #infosec
CTI.FYICTI.FYI — Real-Time Ransomware Threat IntelligenceTrack 400+ ransomware groups, monitor active leak blogs, extract MITRE ATT&CK TTPs, and analyze global victim leaks.
Possible Phishing 🎣
on: ⚠️hxxps[:]//us02webzoomus[.]com/invite[.]php
🧬 Analysis at: https://urldna.io/scan/6ad5ea403b77500004c2bc66
#cybersecurity #phishing #infosec #urldna #scam #infosec
urldna.iourlDNA - The DNA test for websitesUnleash website insights! urldna.io analyzes data, monitors brands and exposes security risks. Analyze URLs like a DNA test
ASN: AS265919
Location: Cotia, BR
Added: 2026-10-17T12:05
CVE-2026-112302 is a path traversal vulnerability in the ZIP extraction function of the kiwilan php-archive PHP library. Versions up to 2.3.02 are affected.
A public exploit is circulating per VulDB. No vendor fix is available, and kiwilan has not responded to the disclosure.
Cybersecurity is a leadership problem: Why the management model needs to catch up
Cybersecurity fails when treated as just a tech problem. The real issue? Leadership. CISOs can't do it alone—organizations need clear accountability, cross-level collaboration, and board involvement. Better tools mean nothing without proper governance and sustained management discipline. It's time to break the cycle.
CSO OnlineCybersecurity is a leadership problem: Why the management model needs to catch upWe keep buying better security tech, but the real gaps are ownership and follow-through, so cybersecurity can’t stay the CISO’s problem alone.
