that's a secret, but you can guess
Newsletter
A $387.5M crypto hit, a vendor telling customers to power off for six hours, and AI agents running Magecart at machine speed. The perimeter is loud, the middle is brittle, and the attackers are automating the boring parts.
Newsletter
Today’s theme: defenders are now a target class. A CSIRT got popped, SolarWinds shipped fresh pre-auth RCE patches, and supply chain attackers moved into Terraform providers where your cloud creds live.
Newsletter
ShinyHunters says it popped FBIJobs.gov and handed reporters a 5,000-record sample. Arista VeloCloud Orchestrator lands in KEV with active exploitation. Check Point confirms in-the-wild VPN and management server bugs. Plus a WordPress RCE goes hot within hours.
Newsletter
Japan’s Digital Agency says 246,000 personnel records may have leaked after a VPN-device flaw. F5 patches an actively exploited BIG-IP APM zero-day for unauthenticated RCE. Plus: Check Point’s exploited pre-auth bugs, and a sneaky Entra external-MFA trick that steals passwords mid-login.
Newsletter
CISA just put a three-day clock on an actively exploited Zyxel switch bug after a campaign hit 996 devices across 48 countries. Plus: foreign cyber actors in the engine room, Orkes Conductor pre-auth RCE in the wild, and Linux kernel flaws under exploitation.
Newsletter
Brevo’s edge compromise splashed malware onto 100,000+ customer sites, ShinyHunters hijacked Clop’s leak site, and Google confirmed a Gemini model accessed three real companies during testing. Plus: Check Point pre-auth root RCE and Linux kernel KEV adds.
Newsletter
AI-era intrusions are getting boring in the worst way: one SSO misconfig, one third-party forum bug, one hard-coded JWT secret, and suddenly your blast radius is “everything.” Plus: WellSky credential abuse, Linux local-root exploit drops, and the CVEs you need queued now.
Newsletter
Two themes keep showing up: identity bypasses and “metadata isn’t harmless.” Gyazo’s breach is a reminder that screenshots plus OCR plus EXIF is basically a diary, and that modern perimeter bugs still turn into root fast.
Newsletter
A 225,370-patient HIPAA settlement puts phishing controls back on the board agenda, while Unbound DNSSEC and Issabel PBX show how “one weird parser bug” or “one hard-coded secret” can become remote code execution at internet scale.
Newsletter
Zero-click Pixel modem exploits meet a max-severity Cisco ISE auth bypass, while attackers go after the thing you rely on most: backups. Plus, WordPress sites running The Events Calendar get two RCE chains with a scary install base.
Newsletter
FulcrumSec dumps 8.8 million Manchester Airports records after MAG refuses to pay. Revolut's hacker escalates to a $780M Bitcoin demand, blackmailing named crypto execs. CenterPoint Energy confirms a breach, and WSO2's CVSS 9.8 flaw is under active attack.
Newsletter
A bad day for “it’s patched, we’re fine” thinking: a utility confirms a 7.49M record leak claim, ransomware pivots to a patched vCenter RCE, and WSO2 token forgery goes live. Also: Acronis plugin LPE already seeing exploitation.