Hunt SAWFLY and BARECLAW on BeyondTrust After CVE-2026-102764
Public Mandiant IOCs turned into lab greps: mangoapi.php, _c94mfe, ingredi_ws, /uidchanarge, zz-root-persist. Patch first. Hunt off-box logs. Rebuild if trust is gone.
Read Full News
That ClickFix Paste Just Installed Variola, Not a “Fix”
ClickFix to Windows Terminal to GitHub sha payload to Variola core. Hunt 4A-D3, uid.dat, smallpox section, mutexes. Stop pasting ‘fixes’ from webpages.
Hunt PAN-OS CVE-2026-0322: Three Attacker IPs and Management Plane Logs
Authenticated root RCE on the management interface, KEV the day of disclosure, three IPs in the advisory. Here is a lab grep session so you can hunt before the jump box excuse wears thin.
Fortinet CLI Path Traversal Hit CISA KEV 185 Days After Fortinet Already Patched It
April advisory, October KEV. CVSS 6.0 authenticated CLI write/delete. Upgrade 7.6.5/7.4.10 trains, migrate dead ones, due Oct 19.
Atlassian Just Handed Strangers Your WEB-INF and CISA Put It on the Calendar
Unauthenticated file read across eight Atlassian Data Center products. KEV on October 15, due October 18. Patch, mitigate, rotate Crowd secrets.
SQL Injection 101: Dump Your Own Lab Database Before Someone Else Dumps Yours
Stop reading about SQL injection and dump a database on purpose. Local Flask lab, real sqlmap output, and the one rule that keeps you out of jail: only test what you own.
Fake WatchGuard VPN Site Steals Creds Then Hands You the Real Installer
No malware file. Just a browser form, a forced retry, and WatchGuard’s own signed client from the CDN. Endpoint tools see nothing. Your VPN gateway sees everything.
Citrix NetScaler Is On Fire Again and Everyone Is Shocked, Shocked I Tell You
Another week, another NetScaler zero-day being kicked to death in the wild. CVE-2026-88779 is on CISA KEV, it needs SAML to bite, and no previous patch fixes it.
Kimsuky Is Sending Fake Resumes That End In Funhouse Ransomware
A Hangul resume drops Quasar RAT and ends in .Funhouse encryption. ASEC ties it to Kimsuky and earlier Endpoint ransomware cases.
That Party RSVP Installs ScreenConnect, Not Confetti
Vague invite, baby-domain CAPTCHA, zip, legitimate remote-support installer. Your tray icon is their shell.