Microsoft Defender’s Cleanup Driver Can Become the Tool That Removes Defender.
BTR Reforged shows how Microsoft Defender’s own signed boot-time cleanup driver can be redirected to remove endpoint protection after administrative compromise.
Rob Nidschelm
Tech tinkerer who spends too much time with home labs and Docker stacks. Into AI, Roman & Medieval history, and all things sci-fi. Avid traveller, reader and writer, with a passion for good food.
The Load Balancer Was Supposed to Distribute Traffic. Attackers Used It to Run Commands.
A critical LoadMaster command-injection flaw is being exploited. Because the appliance controls traffic at the edge, defenders should patch quickly and investigate what the device could reach or expose.
The Firewall Manager Shipped With a Password Attackers Already Knew.
Cisco has documented three distinct FMC attack campaigns, including no-login root access, Sandworm-linked tooling and ransomware preparation. Patch exposed managers and investigate each cluster separately.
NetScaler’s Authentication Bypass Is Now Drawing Live Attack Traffic
A public proof of concept for CVE-2026-19490 is now drawing exploit-matching traffic. The evidence shows active targeting, not confirmed compromise.
The Outage Lasted Eight Hours. The Patient Exposure Reached 3.75 Million.
CareCloud first described an eight-hour disruption affecting one of six electronic health record environments. The same incident is now listed as affecting 3,756,469 people.
You Changed the Camera Password. The Attacker Account Was Still There.
CameraSwarm compromised more than 14,500 Dahua devices. A hidden account and vendor relay paths can survive the remediation steps defenders normally trust.
They Did Not Steal Passwords. They Stole the Map of Who to Attack Next.
Alleged Entra directory theft exposed organisational maps rather than passwords. Treat bulk directory reads as a high-impact identity event.
A Failed WordPress Login Could Become Code Execution.
WordPress fixed a pre-auth reflected XSS that can be chained to server-side code execution when a logged-in administrator is drawn into the attack. The chain is contextual, but the update is urgent.
The Private Keys Were Safe. The Address of the Person Holding Them Was Not.
SafePal says private keys and funds were not exposed, but order records linked wallet ownership to names, contact details and home addresses.
They Never Became Customers. Their Identity Data Was Still in the Breach.
A Heights Finance cloud-platform breach reached borrowers, applicants and people who only enquired. Data retention turned a past interaction into a present risk.