Archive

General * Cisco switch crashes were caused by the order of records in DNS responses. Yes, definitely strong defensive programming there! * https://www.cloudflarestatus.com/incidents/rk3dgkmy89kc * https://www.itnews.com.au/news/cloudflare-dns-reply-change-crashed-cisco-sme-switches-622895 * BreachForums leaks again, with more Shiny Hunters/Scattered Lapsus$ Hunters infighting. * https://www.resecurity.com/blog/article/

General * Part Two of Brian Krebs' deep-dive into the Aisuru and Kimwolf botnets, powered by Android TV boxes promising "free cable TV". This time, looking at the "residential proxy" networks behind it. * https://krebsonsecurity.com/2026/01/who-benefited-from-the-aisuru-and-kimwolf-botnets/ * Need any more convincing to keep management

General * Disruptive bug in Cisco switches - failed DNS lookups triggering a fatal error and reboot. * https://www.bleepingcomputer.com/news/security/cisco-switches-hit-by-reboot-loops-due-to-dns-client-bug/ * Another Cisco ISE (Identity Services Engine - authenticate access to a network) bug - CVSS4.9. A Proof-of-Concept exists, but no confirmed in-the-wild exploitation yet. * https://sec.

General * Veeam - a backup solution commonly targeted in ransomware intrusions, especially as a way of elevating to Domain Admin - has released patches for new Remote Code Execution vulnerabilities. * https://www.veeam.com/kb4738#:~:text=CVE%2D2025%2D59470 * https://www.bleepingcomputer.com/news/security/new-veeam-vulnerabilities-expose-backup-servers-to-rce-attacks/ * More (Classic) Outlook bugs

General * Did they / Didn't they breaches * NordVPN claims breach was "dummy data" from a Proof -of-Concept Salesforce account * (NordVPN) https://archive.is/VMLua * https://www.bleepingcomputer.com/news/security/nordvpn-denies-breach-claims-says-attackers-have-dummy-data/ * Resecurity claims the ScatteredLapsus$Hunters (SLH) breach was in an Honeypot. * https://databreaches.net/2026/01/

General * CVSS10 in HPE's "OneView" infrastructure management software. Hopefully, this is only exposed inside a datacentre, so will only be used for pivoting and PrivEsc, post initial access. * https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04985en_us&docLocale=en_US * https://nvd.nist.gov/

General * This might be challenging for a few larger firms who still have mail gateways on the perimeter - 'Cisco Secure Email Gateway' (aka 'Email Security Appliance', ESA, Ironport) and Cisco Secure Email and Web Manager(aka 'Cisco Content Security Management Appliance', SMA) -

General * It appears that the SoundCloud VPN-ban was a side-effect of post-breach hardening. Data has been stolen from the platform, allegedly under the name of ShinyHunters. SoundCloud recently detected unauthorized activity in an ancillary service dashboard. Upon making this discovery, we immediately activated our incident response protocols and promptly contained

General * SoundCloud is blocking VPN users (with a 403 Forbidden message), and has been for days, but still no fix. Looks as though the block is coming from AWS CloudFront configuration, potentially through geo-restrictions. * https://www.bleepingcomputer.com/news/security/ongoing-soundcloud-issue-blocks-vpn-users-with-403-server-error/ * https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/georestrictions.