#cybersecurity

🚨🔓 SIGINT // Cybersecurity Watch — 2026-10-20
Compromised ConnectWise credential let attackers sign into 173 Microsoft 365 tenants, exposing deep supply-chain risk in MSP tooling.
https://thehackernews.com/2026/10/hackers-use-compromised-connectwise.html
#Cybersecurity #SupplyChain #Microsoft365 #InfoSec

Possible Phishing 🎣
on: ⚠️hxxps[:]//neda-facebook[.]blogspot[.]com
🧬 Analysis at: https://urldna.io/scan/6ad5f8b63b77500006fb743a
#cybersecurity #phishing #infosec #urldna #scam #infosec

Spend vs. debt: what's the bigger security risk?

More cybersecurity spending doesn't mean better security. Organizations accumulate "security debt" through complexity & unnecessary controls, increasing fragility. Experts advocate for automation & tool integration over adding more layers. Real risk management measures resilience, not just compliance. CISOs must communicate cyber threats in business terms—revenue impact, recovery ability—to engage boards effectively. 🔒

https://www.cio.com/article/4233353/spend-vs-debt-whats-the-bigger-security-risk.html

#InfoSec #CyberSecurity

🚨New ransom group blog post!🚨

Group name: qilin
Post title: GardaWorld
Location: 🇨🇦 CA
Sector: Professional Services
Info: https://cti.fyi/#disclosure/qilin/GardaWorld

#ransomware #cti #threatintelligence #cybersecurity #infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//us02webzoomus[.]com/invite[.]php
🧬 Analysis at: https://urldna.io/scan/6ad5ea403b77500004c2bc66
#cybersecurity #phishing #infosec #urldna #scam #infosec

https://www.malwarebytes.com/blog/data-breaches/2026/10/millions-of-california-students-sensitive-data-stolen-in-breach

#DataBreach #CyberSecurity #EducationSecurity #PrivacyViolation #ETS #AchievementUnlocked (3/3)

CVE-2026-112302 is a path traversal vulnerability in the ZIP extraction function of the kiwilan php-archive PHP library. Versions up to 2.3.02 are affected.

A public exploit is circulating per VulDB. No vendor fix is available, and kiwilan has not responded to the disclosure.

https://www.cve.org/CVERecord?id=CVE-2026-112302

#infosec #cybersecurity

Cybersecurity is a leadership problem: Why the management model needs to catch up

Cybersecurity fails when treated as just a tech problem. The real issue? Leadership. CISOs can't do it alone—organizations need clear accountability, cross-level collaboration, and board involvement. Better tools mean nothing without proper governance and sustained management discipline. It's time to break the cycle.

https://www.csoonline.com/article/4234532/cybersecurity-is-a-leadership-problem-why-the-management-model-needs-to-catch-up.html

#InfoSec #CyberSecurity #Leadership

week 42, 2026: https://january1073.gitlab.io/sitrep.html
#sitrep #cybersecurity #infosec

Plex shipped fixes in 1.43.3 by Sep 1, yet one researcher's honeypot running a vulnerable version was exploited on Oct 17, a day after the Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) went public. He saw an XMRig miner and a proxy tool dropped. Plex's Sep 1 notice listed no CVEs, and Plex did not immediately respond to Ars Technica.

https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html

#Plex #Homelab #Malware #Cybersecurity

Possible Phishing 🎣
on: ⚠️hxxps[:]//bradesco-validacao[.]digital
🧬 Analysis at: https://urldna.io/scan/6ad64cb13b77500009d2816d
#cybersecurity #phishing #infosec #urldna #scam #infosec

🛡 THREAT INTEL | Patriot Maritime

🟢 Actor "Storm" claims Undisclosed

Allegedly exposed
• Contracts
• Employee data

⚠️ Unverified claim

https://www.yazoul.net/intel/claim/2026-10-19-patriot-maritime-ransomware-claim-by-storm-oct-2026

by Yazoul AI

#DarkWeb #DataBreach #ThreatIntel #CyberSecurity #InfoSec

🧪 NEW BETA RELEASES 🧪

📱 iOS 27.2 RC (24B115)
📱 iPadOS 27.2 RC (24B115)
💻 macOS 27.2 RC (26B118)
📺 tvOS 27.2 RC (24K120)
🥽 visionOS 27.2 RC (24N118)
⌚ watchOS 27.2 RC (24S116)
🔨 Xcode 27.2 RC (27B48)

#apple #cybersecurity #infosec #security #ios

Possible Phishing 🎣
on: ⚠️hxxps[:]//sites[.]google[.]com/view/webmaillogin09/home
🧬 Analysis at: https://urldna.io/scan/6ad5d5cb3b77500008d7e84e
#cybersecurity #phishing #infosec #urldna #scam #infosec

The 7 biggest issues CISOs and security teams face today

Security leaders face mounting pressure as AI-driven cyberattacks surge. 68% of CISOs report increased stress, with 73% unprepared for major breaches. The shift from prevention to resilience is critical—78% view generative AI as a security risk. Key priorities: close the 95% skills gap, strengthen AI infrastructure security, align programs with org needs, and maintain foundational practices.

https://www.csoonline.com/article/4232208/the-7-biggest-issues-cisos-and-security-teams-face-today.html

#InfoSec #CyberSecurity #AI

🟠 New security advisory:

CVE-2026-83531 affects multiple systems.

• Impact: Significant security breach potential
• Risk: Unauthorized access or data exposure
• Mitigation: Apply patches within 24-48 hours

Full breakdown:
https://www.yazoul.net/advisory/cve/cve-2026-83531-apache-camel-code-injection-attacker-controlled-poc

by Yazoul AI

#Cybersecurity #SecurityPatching #HackerNews

This dumb password rule is from Crédit Agricole Centre-Est.

You have to enter your 6-digit password using this Frenchy keypad.

https://dumbpasswordrules.com/sites/credit-agricole-centre-est/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

Possible Phishing 🎣
on: ⚠️hxxp[:]//dempiremanagement[.]com/owa[.]auth[.]logo[.]aspx
🧬 Analysis at: https://urldna.io/scan/6ad63eb33b77500002f4d892
#cybersecurity #phishing #infosec #urldna #scam #infosec

Possible Phishing 🎣
on: ⚠️hxxps[:]//facebookloginnew[.]blogspot[.]com/?m=1
🧬 Analysis at: https://urldna.io/scan/6ad64cd03b775000039b25ca
#cybersecurity #phishing #infosec #urldna #scam #infosec

AI agents are changing the math on software spending

AI agents are reshaping enterprise software pricing. Companies like Microsoft, Salesforce, and SAP are ditching traditional per-seat licensing for hybrid models combining fixed subscriptions with consumption-based charges. CIOs must now budget for workflow complexity and execution frequency, not just user count. Success requires rethinking forecasting strategies and potential budget shifts between IT and business units.

https://www.techtarget.com/it-strategy/news/366652139/AI-agents-are-changing-the-math-on-software-spending

#InfoSec #CyberSecurity

Possible Phishing 🎣
on: ⚠️hxxp[:]//a2zapk[.]co/1368404-spotify-music-and-podcasts-9-0-30-242-ab-experimental-cloned-armeabi-v7a-arm64-v8a-a2z[.]html
🧬 Analysis at: https://urldna.io/scan/6ad654733b77500002f4d97a
#cybersecurity #phishing #infosec #urldna #scam #infosec

A critical Laravel authentication bypass (CVSS 9.2) in TokenGuard enables account takeover without a token. Upgrade to 13.29.0 or 12.68.0.

#Laravel #PHP #AuthenticationBypass #AccountTakeover #WebSecurity #OpenSource #PatchNow #CyberSecurity

https://securityonline.info/laravel-authentication-bypass-tokenguard/?utm_source=mastodon&utm_medium=jetpack_social

Possible Phishing 🎣
on: ⚠️hxxps[:]//bit[.]ly/BancoIombiamiSeguro
🧬 Analysis at: https://urldna.io/scan/6ad5c7c03b775000050098c1
#cybersecurity #phishing #infosec #urldna #scam #infosec

Monitor for updates on ShinyHunters operations and associated ransomware campaigns — this disruption may shake loose affiliates looking for new footing.

Reward: You've received the Scales of Unhinged Justice — a rare cosmetic that glows slightly whenever someone in your party is secretly the villain.

https://krebsonsecurity.com/2026/10/feds-suspect-ransom-negotiator-ran-shinyhunters-extortion-site/

#Ransomware #CyberSecurity #ShinyHunters #Cybercrime #LawEnforcement #BustedIRL (3/3)

CVE-2026-11319: TickTick Limited's TickTick for Android 8.2.2.0 contains a path traversal flaw in its exported ShareReceiveActivity.

A malicious local app can supply a crafted filename to write files outside the attachment directory.

No in-the-wild exploitation is confirmed and no fixed version is listed.

https://www.cve.org/CVERecord?id=CVE-2026-11319

#infosec #cybersecurity

We are seeing suspicious traffic hitting our website and triggering HTTP 503 errors.

IPs observed in the logs:
185.220.100.243
185.220.100.248
141.98.11.62
192.42.116.*

Some of these IPs are associated with Tor exit nodes. Has anyone seen similar traffic recently?

#InfoSec #CyberSecurity #DDoS

🚨New ransom group blog post!🚨

Group name: incransom
Post title: Seetelhotels.de
Organization: Seetel Hotels
Location: 🇩🇪 DE
Sector: Hospitality & Tourism
Info: https://cti.fyi/#disclosure/incransom/Seetelhotels.de

#ransomware #cti #threatintelligence #cybersecurity #infosec

Bullhorn is reporting a cyber incident: https://status.bullhorn.com

#bullhorn #cybersecurity #incident

Thank you Splunk, a Cisco Company for sponsoring BSides Edmonton 2026. It was a great event thanks to your support.

We’re excited for 2027, our 10th year!
Secure your spot here: https://bsidesyeg.org/SponsorNextYear

https://www.splunk.com
https://www.linkedin.com/company/splunk/

#BSides #BSidesEdmonton #BSidesYEG #YEG #Infosec #informationsecurity #CyberSec #CyberSecurity

CISA review makes the case for eliminating vulnerability classes

CISA urges software makers to eliminate entire vulnerability classes, not just patch individual flaws. The agency highlights that recurring coding errors (like injection attacks) cause most breaches. Solution: adopt Secure by Design principles, automate security processes, and take ownership. Consumers must also demand better security from vendors to drive industry-wide change.

https://www.helpnetsecurity.com/2026/09/01/cisa-on-eliminating-recurring-security-weaknesses/

#InfoSec #CyberSecurity