That PNG Is Also a ZIP and Your Gateway Only Checked the Magic Bytes
file says PNG. unzip extracts stage.sh. same bytes, two parsers, one content filter that trusted the greeting.
Read Full News
SSH Over ICMP Because Your Firewall Still Thinks Ping Is Harmless
ptunnel-ng turned echo request into a TCP pipe. your allow-list called it diagnostics. the shell called it tuesday.
Your C2 Is a DNS-over-HTTPS Lookup to Cloudflare and Your SIEM Does Not Care
port 53 is closed. the implant asked cloudflare-dns.com for a TXT and got tasking. your proxy logged browsing.
Hide a C2 Beacon Config in a PNG Pixel and Call It a Profile Pic
the implant downloaded a profile pic, flipped the LSBs, and recovered where to phone home. no PE. just pixels. here is the lab and the hunt.
GitHub Security Lab Shipped gh-secure So You Can Stop Shipping Open Source Naked
gh extension install GitHubSecurityLab/gh-secure. Dry-run, then enable the boring defaults. Green toggles are not a force field, but naked repos are worse.
That ClickFix Paste Just Installed Variola, Not a “Fix”
ClickFix to Windows Terminal to GitHub sha payload to Variola core. Hunt 4A-D3, uid.dat, smallpox section, mutexes. Stop pasting ‘fixes’ from webpages.
Fortinet CLI Path Traversal Hit CISA KEV 185 Days After Fortinet Already Patched It
April advisory, October KEV. CVSS 6.0 authenticated CLI write/delete. Upgrade 7.6.5/7.4.10 trains, migrate dead ones, due Oct 19.
Hunt SAWFLY and BARECLAW on BeyondTrust After CVE-2026-102764
Public Mandiant IOCs turned into lab greps: mangoapi.php, _c94mfe, ingredi_ws, /uidchanarge, zz-root-persist. Patch first. Hunt off-box logs. Rebuild if trust is gone.
BeyondTrust Remote Support Just Got Rooted by the People It Was Meant to Keep Out
Unauthenticated file ops on Remote Support, Mandiant zero-day abuse since late August, KEV Oct 16 due Oct 19. Patch BT26-05-RS, hunt SAWFLY/BARECLAW, rotate vaulted creds.
Data Centers Are War Targets Now and Dual-Use Is the Whole Punchline
Commercial racks hosting military gravity put civilian apps in the outage radius. Separate stacks, diversify regions, update the BCP slide.