This Linux Backdoor Hides Its Commands in Ordinary MQTT Traffic
MQTT is normal in many connected environments. That makes the protocol useful cover, but the implant still leaves distinctive topic, process and file-transfer behaviour.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
A Valid Red Hat Key ID Could Still Deliver a Forged OpenShift Release
The signature check could trust the right key identity before it had proved that the signature covered the complete release body.
Public Exploit Code Can Turn a Local Veeam User Into SYSTEM
The attacker already needs local code execution. The danger is converting a restricted foothold into the account that controls the Windows machine and its backups.
A Virtual Machine Could Keep Writing to Host Memory After the Page Was Freed
The condition is narrow, but the boundary it crosses is the one multi-tenant virtualisation is built to protect.
This PowerShell Backdoor Watches Every New Document You Create
Removing the first script is not enough. Four scheduled tasks, a Startup launcher and two mutually monitored payloads can reconstruct the backdoor.
One SharePoint Type Check Stood Between a Web Request and an In-Memory Shell
The published chain is more dangerous than a generic authenticated RCE, but the pre-authentication route depends on an additional path and server configuration.
The File That Turns One Windows Breach Into Every Password in the Domain
This was a controlled simulation, not a newly disclosed victim breach. Its value is showing where defenders can still break the chain before domain credentials leave.
AI Agents Attacked 105 Retailers in Six Days for About $25 Each
The operator supplied short instructions. The agents did the patient probing, exploitation and persistence at a pace most defenders were not built to match.
CISA Gave Zyxel Switch Owners Until Thursday to Fix an Exploited LAN Flaw
The flaw is reachable from the local network, not necessarily the public internet. That makes internal exposure and earlier compromise the questions that matter.
KATARU Bundled Four Linux Root Tricks That Did Not All Fit the Device
The malware looks ambitious: encrypted control, persistence, DDoS and multiple root exploits. The analysed ARM sample also carried x86 shellcode and inert checks.