Archive

General * Android screen-lock scareware targeting Spanish-speaking users. Locks the screen, threatens to delete files (no file encryption, but does have wipe permissions), provides remote access via VNC. Not sure how effective monetisation will be - locking out the mobile channel may also lock out the user's abilities to

General * Some more info on allegedly how Aeroflot was hacked earlier this year - supplier with access into the environment, plus incomplete MFA coverage. * https://therecord.media/russia-flagship-airline-hacked-through-little-known-vendor * Anyone surprised that lots of Docker containers are leaking secrets? * https://flare.io/learn/resources/docker-hub-secrets-exposed/ * https://www.bleepingcomputer.com/news/security/

General * This is going to be interesting - two of the larger CVE providers have some interesting bugs for us * Ivanti Endpoint Manager. Straight-up XSS in the Device ID, Display Name, Host Name or OS Name fields. How did that pass any decent Penetration/Security Test? An attacker with unauthenticated

General * Examination of the SharePoint attacks from mid-year. What does it mean that three separate China-linked groups all moved on the same SharePoint vulnerabilities at nearly the same time? Were the three threat clusters truly independent, how did they all obtain workable exploits so quickly, and what were their ultimate

General * Cloudflare’s attempt to patch React2Shell in their WAF product, led to outages. The WAF update was a staged rollout, however disabling the WAF testing tool was not. This latter change caused the 500 errors. A change made to how Cloudflare's Web Application Firewall parses requests caused

General * Yes, there's a bug in React Server, no it's not that big a deal. React 19 only (1 year old), and in a new component (React Server). Most use of React is client-side only, with other code providing the server-side backend. Likely the biggest way

General * The Aisuru botnet keeps getting bigger - now just under 30Tbps, up from 22Tbps. * https://blog.cloudflare.com/ddos-threat-report-2025-q3/ * https://www.bleepingcomputer.com/news/security/aisuru-botnet-behind-new-record-breaking-297-tbps-ddos-attack/ * https://www.cybersecuritydive.com/news/ddos-rises-q3-aisuru-botnet-record-attack/806922/ * Google's expanding its in-call scam protection trial, with more UK banks, and now some

General * Supply-chain attacks just keep coming back - the 'Glassworm' attacks on Visual Studio Code extensions (in both the official Microsoft marketplace and the community OpenVSX marketplace) are back again. * https://www.bleepingcomputer.com/news/security/glassworm-malware-returns-in-third-wave-of-malicious-vs-code-packages/ * Android users - monthly patch reminder * https://source.android.com/docs/

General * An interesting side-effect of multi-tenant cloud architecture - Microsoft Teams security features are tied to the tenant hosting the conversation, not the participants. * https://www.ontinue.com/resource/blog-microsoft-chat-with-anyone-understanding-phishing-risk/ * [EU] German and Swiss authorities shutdown a bitcoin mixer service imaginatively named 'Cryptomixer'. Authorities obtain 12TiB of data

General * A nice little beginners OpSec guide from Wired. If you want more depth, try looking at Michael Bazzell's books. * https://www.wired.com/story/digital-opsec-for-teens/ * https://inteltechniques.com/books.html * It appears that GitLab Cloud was a fertile hunting ground for secrets in Git repositories. US$770