NeedyMantis Is Hiding Behind Poedit, curl, Vim and TightVNC
Microsoft found NeedyMantis hiding beside legitimate software in targeted intrusions. The real hunt starts before the backdoor appears.
Security
Vulnerabilities, defensive security, architecture and operational security.
Researchers Read a Linux Root Hash With Spectre Defences Still On
Branch Target Reuse recovered a Linux root hash on Intel test systems, exposing a local JIT weakness that Linux updates now target.
A Real ChatGPT Page Led Users Into a Fake Verification Trap
An attacker-built Custom GPT used a real ChatGPT page to lead people to a fake check on Google Sites. The practical boundary is the instruction to run code outside the browser.
DIVD’s Intrusion Trail Did Not Settle the Damage
Preserve the sequence, verify the installed build and keep preliminary exposure findings separate from confirmed losses.
DC’s Public Health Reports Carried Hidden Data on Nearly 400,000 People
A public summary can still carry private records. DC's Medicaid agency says two website reports contained hidden beneficiary information potentially reachable between 2023 and July 2026.
A Password Reset Cannot Take Back the Identity Data Stolen From Times Car
Times Car says an intruder acquired data linked to about 6.6 million accounts. Identity-document information, including driving licence images, is in the variable field list. The number of images and any later misuse remain unconfirmed.
Adobe Commerce’s August Patch Now Comes With a Reason to Hunt for Intruders
Adobe's August bulletin said it knew of no exploitation. CISA has now placed the unauthenticated privilege-escalation flaw in KEV and called for forensic triage.
Apple’s File Fix Is Not a Clean Bill of Health
Verify the installation and preserve evidence when prior targeting is suspected.
Your Clean Threat Hunt Might Be a Broken Data Pipeline
Half of the hunters in a new SANS survey say data is their biggest obstacle. A clean search result means little until the team has proved the evidence path works.
OpenShift’s Translation Endpoint Can Read Files Without a Login
An unauthenticated OpenShift console request can escape the locale directory and read JSON files or reach plugin backends. Red Hat lists no fixed build.