Kiteworks Pulled the Plug and Found a Critical Flaw
Kiteworks says its shutdown uncovered a critical flaw in a capability enabled for fewer than 1% of customers. Service can resume, with separate support guidance for self-hosted Advanced Forms.
Incident Response
Attackers Copied Every Incoming Belnet Email for Two Months
A supplier zero-day let attackers copy every incoming email sent to Belnet and one customer for more than two months.
This Rogue MFA Provider Can Steal the Password You Just Reset
A password change can feed the new secret straight back to the attacker if the malicious authentication provider remains registered.
Bitget’s $388 Million Breach Now Points to a Third-Party Security Product
Bitget says its $388 million breach may have begun in a third-party security product, exposing credentials used to send fraudulent withdrawal commands.
The FBI Confirms Its Jobs Portal Was Compromised but Not What Was Taken
The compromise is confirmed. The route in and the alleged theft of employee data are not. The distinction matters because recruitment systems hold unusually revealing records.
Attackers Are Exploiting the System That Manages the Rest of Your Network
A compromised orchestrator is not just another vulnerable server. It is the trusted control point for the edge devices around it.
One OAuth Profile Can Turn BIG-IP APM Into a Remote Code Execution Target
F5 says attackers are already exploiting a critical BIG-IP APM flaw. The first job is not simply to patch, but to preserve evidence and find out whether the gateway has already been touched.
The Malicious npm Release Had Valid Provenance Because the Build System Worked
Provenance answered where the package was built. It could not answer whether the source reaching the trusted workflow was honest.
This Linux Backdoor Hides Its Commands in Ordinary MQTT Traffic
MQTT is normal in many connected environments. That makes the protocol useful cover, but the implant still leaves distinctive topic, process and file-transfer behaviour.
This PowerShell Backdoor Watches Every New Document You Create
Removing the first script is not enough. Four scheduled tasks, a Startup launcher and two mutually monitored payloads can reconstruct the backdoor.