#incidentresponse

Oneonta City School District in New York canceled two days of classes after an attack that Superintendent Thomas F. Brindley identified as ransomware, The Daily Star reported. The technology team acted to limit unauthorized access, and the district is preparing for students to return, but the compromise's scope remains unresolved.

Athletics and full-day Board of Cooperative Educational Services programs will continue during the closures; morning and afternoon programs will not. Neither cited report establishes whether information was stolen or a ransom was demanded or paid.

#Oneonta #Ransomware #SchoolClosures #K12Education #IncidentResponse #NewYork #Cyberattack

https://dysruptionhub.com/oneonta-new-york-schools-ransomware-attack/

The same suspicious installer appeared in two unrelated client environments. Antivirus quarantined it, but I still needed to understand how it arrived.

I wrote up the case for fellow MSPs and defenders: where browser history helped, where my collector fell short, and what remained unresolved. Client details are anonymized.

https://www.kylereddoch.me/blog/client-case-study-tracing-a-suspicious-download-after-quarantine/

#MSP #IncidentResponse

We are getting reports of #php2shell attempts against web servers a day before the public announcement as seen in logs.

How is your Thursday going?

#incidentresponse #infosec #php

If I had a € for every time someone moans about "not being informed about <EVENT>" #incidentresponse for a total of X €,

and had to subract every time I've asked, insisted, thrown-policy-at, or outright begged them to share information about <EVENT>-like things themselves but getting told "Fuck off, you can't make me",

I'd still have X €.

(Also, I *can* make them, but Adversarial #CISO:ing is not a success recipe)

GMO Internet halted its Onamae Desktop Cloud VPS in Japan after unauthorized access led to malware deployment on customer servers. With up to 26,739 servers potentially exposed, tenants should assume compromise and hunt for persistence. #CloudSecurity #IncidentResponse #Malware

https://cyberworldops.eu/en/gmo-halts-desktop-cloud-after-intrusion-puts-26739-servers-at-risk

Happy PHP Wednesday.

"In the last hour, two remote code execution vulnerabilities in PHP have been leaked. These vulnerabilities were previously scheduled under embargo and due for release on Thursday at 11 am ET," watchTowr CEO Benjamin Harris told BleepingComputer.

https://www.bleepingcomputer.com/news/security/php-warns-admins-of-two-critical-flaws-emergency-patches-coming-tomorrow/

#php #vulnerability #patchmanagement #infosec #incidentresponse

Reward: You've received a Chargeback Coupon — void where applicable, which is everywhere.

https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/

#Cybersecurity #APIsecurity #OpenCode #AccountCompromise #AITools #IncidentResponse (3/3)

📢 DEF CON Training is now accepting course submissions for 2027!

Whether you’re an experienced instructor or bringing a new course to the community, we’re looking for high-quality, hands-on training that helps security professionals build real-world skills.

Submit your training material today for the opportunity to teach alongside the DEF CON community in locations around the world including Las Vegas, the Middle East, and Singapore!

For more details, see the application. The deadline to apply is November 13, 2026.

Apply here today 🔗: https://forms.cloud.microsoft/r/z2f4igJPuu

Already submitted your course for Singapore March 2027? As long as you selected your other sessions of interest at the end of the application form, you don’t need to reapply! We have your application on file.

Questions? Email us at [email protected]

#DEFCON #DEFCON35 #DEFCONSG #DEFCONME #DEFCONTraining #training #cybersecurity #handsonlearning #infosec #AI #incidentresponse #threathunting #cloud #IoT #hacking