Archive

General * Microsoft finally gets around to patching its SQLite3 DLL (WinSqlite3.dll), patched upstream in June 2025 (3.50.2). * https://www.bleepingcomputer.com/news/microsoft/microsoft-updates-windows-dll-that-triggered-security-alerts/ * https://www.sqlite.org/cves.html * Microsoft agrees to pay for the electricity and water its data-centres use, and even pay their fair

General * Google Mandiant has released a security testing tool for Salesforce Experience Cloud. This is for testing of the low-code sites (the ‘older’ way information was leaked out of Salesforce instances), rather than checking for permissions to connect data-exfiltration tools (the more recently exploited mechanism, as used by Shiny Lapsus$

General * Cisco switch crashes were caused by the order of records in DNS responses. Yes, definitely strong defensive programming there! * https://www.cloudflarestatus.com/incidents/rk3dgkmy89kc * https://www.itnews.com.au/news/cloudflare-dns-reply-change-crashed-cisco-sme-switches-622895 * BreachForums leaks again, with more Shiny Hunters/Scattered Lapsus$ Hunters infighting. * https://www.resecurity.com/blog/article/

General * Part Two of Brian Krebs' deep-dive into the Aisuru and Kimwolf botnets, powered by Android TV boxes promising "free cable TV". This time, looking at the "residential proxy" networks behind it. * https://krebsonsecurity.com/2026/01/who-benefited-from-the-aisuru-and-kimwolf-botnets/ * Need any more convincing to keep management

General * Disruptive bug in Cisco switches - failed DNS lookups triggering a fatal error and reboot. * https://www.bleepingcomputer.com/news/security/cisco-switches-hit-by-reboot-loops-due-to-dns-client-bug/ * Another Cisco ISE (Identity Services Engine - authenticate access to a network) bug - CVSS4.9. A Proof-of-Concept exists, but no confirmed in-the-wild exploitation yet. * https://sec.

General * Veeam - a backup solution commonly targeted in ransomware intrusions, especially as a way of elevating to Domain Admin - has released patches for new Remote Code Execution vulnerabilities. * https://www.veeam.com/kb4738#:~:text=CVE%2D2025%2D59470 * https://www.bleepingcomputer.com/news/security/new-veeam-vulnerabilities-expose-backup-servers-to-rce-attacks/ * More (Classic) Outlook bugs

General * Did they / Didn't they breaches * NordVPN claims breach was "dummy data" from a Proof -of-Concept Salesforce account * (NordVPN) https://archive.is/VMLua * https://www.bleepingcomputer.com/news/security/nordvpn-denies-breach-claims-says-attackers-have-dummy-data/ * Resecurity claims the ScatteredLapsus$Hunters (SLH) breach was in an Honeypot. * https://databreaches.net/2026/01/

General * CVSS10 in HPE's "OneView" infrastructure management software. Hopefully, this is only exposed inside a datacentre, so will only be used for pivoting and PrivEsc, post initial access. * https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US * https://nvd.nist.gov/

General * This might be challenging for a few larger firms who still have mail gateways on the perimeter - 'Cisco Secure Email Gateway' (aka 'Email Security Appliance', ESA, Ironport) and Cisco Secure Email and Web Manager(aka 'Cisco Content Security Management Appliance', SMA) -

General * It appears that the SoundCloud VPN-ban was a side-effect of post-breach hardening. Data has been stolen from the platform, allegedly under the name of ShinyHunters. SoundCloud recently detected unauthorized activity in an ancillary service dashboard. Upon making this discovery, we immediately activated our incident response protocols and promptly contained