The Phishing Email Really Came From Trezor. That Was the Problem.
Brevo closed the SSO path behind the Trezor phishing incident. Four days later, the attackers returned through a Cloudflare key and reached scripts embedded across customer websites.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
The Vendor Credentials Opened One API. Patient Social Security Numbers Left Through It.
The attacker did not need broad network access. Veradigm says credentials stolen from a third-party vendor were enough to copy patient data through one customer-service API.
A Malformed XML Request Can Give an Attacker Root on Palo Alto Hardware Firewalls
Palo Alto Networks has fixed a high-severity XML-processing flaw. The same request can crash VM-Series systems or enable root-level code execution on affected PA-Series hardware.
Europe Just Started the 24-Hour Cyber Reporting Clock for Digital Products
ENISA's CRA Single Reporting Platform is now live, and the first 24-hour reporting clock is running. Manufacturers need more than a portal login to meet it.
The Helpdesk Asked You to Upgrade Your Passkey. Then the Quiet Download Began.
The passkey was only the pretext. Microsoft says attackers are calling personal phones, capturing cloud sessions and quietly collecting files and email for hours or days.
A Certificate Can Make Your Check Point VPN Run an Attacker’s Code Before Login
Two critical certificate-processing flaws can expose Check Point gateways and management servers to unauthenticated remote code execution. Supported systems have fixes. Several older releases do not.
The Phishing Site Was Never Online. It Was Built Inside Your Browser.
The attacker did not need to host a conventional phishing page. Microsoft redirects, a blob URL and a service worker assembled the fake login inside the victim’s browser.
Attackers Turned FortiGate Into a Pivot Server. CISA Just Started the Clock.
CISA has set a 12 September deadline for CVE-2025-25249 as researchers describe attackers using compromised FortiGate devices for tunnelling, credential harvesting and internal discovery.
SmartHRMS Ransomware Left Payroll Customers With No Recovery Point
SmartHRMS says ransomware encrypted its SQL databases and every attached backup set. Customers have no recovery point, while missing network-flow logs leave possible data theft unresolved.
Can You Defend This Access Decision?
Keep a reviewable record of evidence, limits and decisions.