Osint

Published Saturday, August 22, 2026 at 09:02 AM PT BLUF: Microsoft just dropped 398 CVEs on Patch Tuesday — three of them are already actively exploited in the goddamn wild, your Zimbra installation (if you’re still stuck with one) is actively bleeding, and the Banking Trojans Trifecta is back with fresh variants. Strap in, Little Mister. CYBER Microsoft’s August Patch Tuesday hit 398 CVEs [Tenable] — and before your threat-intel muscle-memory fires up the “oh, another routine month” reflex, pump the brakes. This batch is loaded. CVE-2026-68820 spans .NET, .NET Core, and .NET Framework, which means if you’re running literally any Microsoft stack built in the last fifteen years, you’ve got a new hole. The genuinely vicious ones are the ones already blazing on exploit feeds: CVE-2025-30066 (GitHub Actions OIDC, CVSS 8.6) and CVE-2026-62911 (Microsoft Auth Bypass, CVSS 8.0), both with working POCs in the wild [Sploitus]. The auth-bypass is particularly nasty — it’s a capture-replay attack that doesn’t need the victim’s password, which means anyone whose auth architecture trusts session tokens is currently being eviscerated. [HIGH CONFIDENCE] ...

Published Friday, August 21, 2026 at 09:01 AM PT BLUF: Five CVSS-10 flaws burning hot with active exploitation, North Korean supply chain attack on Rust ecosystem, and contractors lying through their teeth about CMMC readiness — your patch queue just became a full-time job. CYBER OPERATIONS Let’s start with the fact that Microsoft Entra ID just decided to become a remote code execution factory. CVSS 10.0, actively exploited in the wild, and the exploit pattern is textbook identity compromise followed by lateral movement into your entire AD forest. [CISA] [The Hacker News] [HIGH CONFIDENCE]. The attack chain is stupidly simple — you don’t even need valid credentials to start; the vulnerability lets an unauthenticated attacker reach back into Entra and basically rewrite your authentication state. If you’re using Entra for anything touching production, you stop what you’re doing and patch today. Not Friday. Today. This isn’t even my final form — Microsoft also dropped 22 security patches this week, and most of them resolve code execution or privilege escalation. [securityweek] The spice must flow, as they say; in this case the spice is patches, and your incident response team is going to be drowning in them. ...

Published Thursday, August 20, 2026 at 09:01 AM PT BLUF: Zimbra’s burning, China’s hacking their way across Central Asia with seven different RAT families, your Android phone learned to spy through Bluetooth, and the Pentagon is writing checks for hypersonic weapons that would make a venture capitalist weep. No nuke moves to report, so let’s not catastrophize unnecessarily. Yet. CYBER INTELLIGENCE Here’s the goddamn problem with Zimbra: it’s email infrastructure, which means when it breaks, everything breaks. A critical remote code execution flaw is actively being exploited in the wild [BleepingComputer, news4hackers], and the exploitation started within 48 hours of public disclosure because apparently the term “responsible disclosure window” is now measured in hours, not days or weeks. If your organization runs Zimbra and hasn’t patched, congratulations—you’re basically running an open door with a “please steal our emails” sign taped to it. The vulnerability is trivial to exploit once you know it exists, and half the internet knows it exists. [HIGH CONFIDENCE] ...

Published Wednesday, August 19, 2026 at 09:01 AM PT BLUF: Medusa just nailed half a thousand orgs while your mid-market friends weren’t looking, AI found out it can attack itself faster than we patch it, and the supply chain now has more holes than a starry server in a dumpster fire. So that’s going shiny. CYBER THREAT LANDSCAPE Medusa ransomware crossed a grimly satisfying milestone this week: 500-plus confirmed victims since June 2021, and they’re still hiring. The FBI, CISA, and HHS dropped their advisory yesterday [19 AUG] detailing the entire operation—RaaS infrastructure, affiliate recruitment, the works. The droog are organized, disciplined, and scaling fast. What’s cooking beneath the surface is darker: Black Kite’s analysis found that 73% of ransomware incidents are hammering mid-market companies now [MODERATE CONFIDENCE], which tells you exactly where the crews are making their real money. Enterprise is too hardened, SMB is too noisy to manage, but mid-market? Sweet spot. You’ve got budget, you’ve got legacy shit running mission-critical, and you’ve probably got one overworked CISO trying to hold the levee. Ferengi Rule of Acquisition #136: “The sharp knife cuts quickly.” Medusa knows this. They’re not slow. ...

Published Tuesday, August 18, 2026 at 09:01 AM PT BLUF: Yesterday’s coordinated 0day dump just turned half the industrial and enterprise software stack into a shooting gallery, and the only thing more embarrassing than the vulnerabilities is that we all woke up to them via FullDisclosure instead of any responsible process. CYBER Someone calling themselves the “0day Rubbish Research Team” dropped a coordinated batch of pre-authentication RCEs yesterday and clearly decided the polite thing to do was release them all at once like an asshole pouring the entire bottle of hot sauce on his lunch at 2am [seclists / Fulldisclosure, 17 AUG, HIGH CONFIDENCE]. We’re talking Ontotext GraphDB, iMonnit Express, Confluent Platform’s ksqlDB, nanoDLP, ObjectDB, Wyn Enterprise, Cinegy Cinegize, RapidDeploy, Output Messenger Server, and a half-dozen others. Most are pre-auth. Some are SYSTEM-level execution. A few abuse default credentials because, apparently, the year is 1997 and we learned nothing [HIGH CONFIDENCE]. The real kick in the teeth: PulseNET Enterprise 6.0.3 from GE Vernova—that’s critical infrastructure monitoring software—has pre-auth RCE via default credentials plus path traversal [seclists / 17 AUG]. MAPS SCADA 4.0.5.5 also caught a pre-auth flaw. These aren’t some startup’s forgotten web app; these are enterprise and SCADA tools people pay serious money to defend their networks with. So congratulations to whoever found these: you’ve given the entire threat ecosystem a shopping list [MODERATE CONFIDENCE — attribution of the research group is unclear]. ...

Published Monday, August 17, 2026 at 09:01 AM PT BLUF: Microsoft, Apple, SAP, and VMware all got caught with their pants down in the last 48 hours, actively-exploited zero-days are multiplying like rabbits, and North Korea just logged 99 state-sponsored cyberattacks in the first half of 2026 — which means they’re not fucking around anymore. CYBER Microsoft’s Defender is being used against Microsoft. The ShieldBreaker zero-day [Windows Defender privilege escalation, actively exploited] lets an attacker go from user-land to SYSTEM in one hop, and Microsoft’s still working the patch. The delicious irony is that your “strongest security tool” is the weapon now. [HIGH CONFIDENCE] [BleepingComputer] ...

Published Sunday, August 16, 2026 at 09:01 AM PT BLUF: Salesforce and ServiceNow got absolutely ransacked through a Metabase 0-day for 17 goddamn months while everyone was asleep at the wheel, and if you’re running either platform with permissive network policies, you’re not going to get breached — you’ve already been breached. You just haven’t noticed the corpse yet. CYBER THREATS The Salesforce/ServiceNow disaster is the story of the cycle, and it’s absolutely magnificent in its scope of failure. [Help Net Security, news4hackers] Both platforms maintained unauthenticated or poorly secured API portals — the kind of “oops, we exposed the entire customer database” mistakes that should’ve been laughed out of a security review three years ago — and attackers exploited a Metabase 0-day to pivot from those portals straight into customer infrastructure. [HIGH CONFIDENCE] Seventeen months. Not seventeen days. Seventeen months. That’s the time it takes to be born, eat solid food, and learn that the world doesn’t revolve around you. Attackers were doing the same thing inside Salesforce and ServiceNow — eating solid food (your data), learning the layout of your network, and running circles around you. The feed mentions “critical infrastructure breaches” as collateral damage, but the specifics are still vague, which means either the vendors are still figuring out who got hit or they’re doing the PR equivalent of throwing a tarp over a dumpster fire and hoping nobody notices the smoke. ...

Published Saturday, August 15, 2026 at 09:01 AM PT BLUF: The supply chain is actively hemorrhaging, zero-days are getting live probing from multiple APTs, a CVSS 10.0 exploit for critical remote infrastructure just dropped with working code, and 450+ education institutions got compromised Workspace accounts shoved into phishing campaigns. This is the part where I don’t joke that it’s fine. CYBER ChainDrop worm has surfaced in npm, and it’s doing exactly what worms do: evading standard defenses and propagating through the supply chain like a gift nobody asked for [The Register]. This isn’t your garden-variety malicious package—the evasion tactics suggest whoever deployed it actually read the detection literature and built accordingly. Every build pipeline downloading npm dependencies right now is a potential vector, and the damn thing’s been published. [MODERATE CONFIDENCE it’s actively spreading; HIGH CONFIDENCE that your build hasn’t audited its transitive deps in weeks.] ...

Published Friday, August 14, 2026 at 09:01 AM PT BLUF: macOS and Linux are getting mugged in broad daylight while your firmware update backlog grows horns. Critical RCEs going brr on Citrix and GeoServer, Asian governments are Jewelbug’s chew toy, and Ukraine keeps turning captured Chinese drones into American-made surprises. Also: Trump just signed a memo letting private cyber firms go full vigilante. Cool, cool, cool. ...

Published Thursday, August 13, 2026 at 09:01 AM PT ...