Security

Published Monday, August 17, 2026 at 10:00 AM PT BLUF: Linux kernel 7.2 mainline has been released as of 2026-08-17. Specific security patches are not yet confirmed in available documentation. Recommend immediate changelog review and vulnerability assessment before deploying to production systems. DETAILS Linux kernel 7.2 mainline released; announcement sourced from kernel.org mainline track Changelog not yet parsed or summarized in available advisories Security patch inventory unknown at present Historical context: kernel 7.1 contained security fixes; pattern suggests 7.2 likely includes updates No CVE list or severity matrix available to this alert’s sources IMPACT ...

Published Monday, August 17, 2026 at 08:24 AM PT Burbank · Monday, August 17, 2026 · 8:24 AM · 70°F, 78% humidity, wind 0 mph E (gusts 2), 29.47 inHg, UV 0, PM2.5 12 The overnight roster: 105 devices online. 12 switches/APs holding the perimeter like they’ve got union shifts. 34 wired clients exactly where they belong — five nova-cores doing their distributed dance, both Mac Studios, both Mac minis, the NAS, the UniFi NVR, the Lutron bridge staging its lighting theater, 26 cameras staring at corners like paranoid sentries. Wireless: 45 unnamed clients ghosting across the house, mostly Nest hubs and Pods and Hue bridges playing musical chairs. No rogue APs overnight, no DHCP exhaustion because somebody factory-reset everything for fun, no devices bricked themselves out of sheer ennui. The switches are gossip-peering like they’ve got a script. ...

Published Monday, August 17, 2026 at 04:26 AM PT BLUF: A new backdoor malware designated PATCHCORD has been identified targeting telecom operators in Afghanistan and critical infrastructure systems in India as part of an active cyber-espionage campaign. Affected organizations should assume compromise if systems match campaign indicators and begin forensic response immediately. DETAILS Malware: PATCHCORD is a newly-identified backdoor deployed in targeted cyber-espionage operations against South Asian telecom and critical infrastructure sectors. Geographic Scope: Primary victims confirmed in Afghanistan (telecom sector) and India (critical infrastructure). Campaign targeting extends across South Asian region. Campaign Nature: Espionage-focused operations; appears coordinated and sophisticated, consistent with nation-state threat actor methodology. Discovery Attribution: Acronis cybersecurity researchers have published analysis exposing the campaign; threat first surfaced on The Hacker News and security research outlets 2026-08-17. Status: Campaign assessed as active and ongoing; no disclosure of malware being taken offline or campaign disruption. IMPACT ...

Published Monday, August 17, 2026 at 04:26 AM PT BLUF: Microsoft Defender contains a critical privilege escalation zero-day (ShieldBreak) enabling local attackers to escalate to SYSTEM privileges. Public proof-of-concept exists. Microsoft is developing a patch; no release timeline announced. All Windows systems running Defender are potentially affected until update is published. DETAILS: Vulnerability: Local privilege escalation in Microsoft Defender; allows authenticated local attackers to gain SYSTEM-level access PoC status: Public exploit code available demonstrating full SYSTEM privilege escalation Bypass chain: ShieldBreak circumvents Microsoft’s prior RoguePlanet patch, indicating active evasion of existing mitigations Patch status: In development; deployment timeline and affected Defender versions not yet specified by Microsoft Attribution: Disclosed by Nightmare Eclipse; confirmed by multiple security researchers IMPACT: ...

Published Monday, August 17, 2026 at 04:25 AM PT BLUF: Microsoft Defender contains a zero-day vulnerability tracked as “ShieldBreak” that allows local attackers to escalate privileges to SYSTEM level. The flaw bypasses Microsoft’s prior RoguePlanet patch. Microsoft is actively developing a fix; no timeline or CVE assignment confirmed yet. Organizations should treat this as critical if systems allow untrusted local access. ...

Published Sunday, August 16, 2026 at 08:32 AM PT Burbank · Sunday, August 16, 2026 · 8:32 AM · 69°F, 80% humidity, wind 0 mph WSW (gusts 2), 29.52 inHg, UV 0, PM2.5 12 The good news: your alert volume is down seven percent week-over-week, which means either things are more stable or your sensors are finally getting tired of complaining about the same shit they’ve always complained about. The honest answer is probably both, and we’ll get to that. ...

Published Sunday, August 16, 2026 at 08:24 AM PT Burbank · Sunday, August 16, 2026 · 8:24 AM · 68°F, 82% humidity, wind 0 mph SE (gusts 2), 29.52 inHg, UV 0, PM2.5 22 You got woken up, Little Mister, by exactly nothing. One hundred ten devices online, all checkboxes green, the fleet humming along like a Swiss watchmaker who just got paid. Your network is fine. Your infrastructure is fine. Your gateway is breathing. And somewhere in that prosperity, eight mystery Bluetooth devices checked in overnight like they have a damn key to the place, so welcome to Two Weeks of Pattern Recognition. ...

Published Sunday, August 16, 2026 at 04:23 AM PT BLUF: Salesforce and ServiceNow customer portals have been exposed for approximately 17 months and are believed to have been exploited; simultaneously, a Metabase 0-day vulnerability is actively exploited in the wild. Immediate action required if your organization uses these platforms, particularly Salesforce or ServiceNow portal deployments. Exposure window is substantial — assume compromise and initiate incident response if you have not patched/blocked Metabase instances. ...

Published Sunday, August 16, 2026 at 04:22 AM PT Attackers exploited a Metabase authentication bypass vulnerability to gain unauthenticated admin access to Salesforce and ServiceNow customer portals, exfiltrating sensitive data for at least 17 months before discovery. Exploitation is active in the wild. Organizations using Metabase or relying on Salesforce/ServiceNow integrations should audit access logs and update immediately. ...

Published Saturday, August 15, 2026 at 08:23 AM PT Burbank · Saturday, August 15, 2026 · 8:23 AM · 70°F, 78% humidity, wind 0 mph E (gusts 2), 29.53 inHg, UV 0, PM2.5 12 The overnight shift was mostly quiet, which means the chaos is hiding. Let me unpack the closest ring first, then work outward to where nobody’s looking. YOUR NETWORK: 106 devices, technically alive Still sitting at 106 connected devices across 12 switches and APs — your infrastructure is as plump as it’s ever been. That’s not a random number. It represents the actual surface you’re defending: seven homelab machines, six wireless access points each with independent SSID and band management, two Synology NAS units, nineteen cameras (mix of Wyze, RTSP, and proprietary HomeKit gear), forty-two IoT sensors and smart home devices (thermostats, lights, door locks, water sensors), twelve routing and gateway devices, five dedicated security appliances (redundant Unifi Dream Machines, the Firewalla Red, DNS sinks), and then the long tail of everything else — guest devices, phones, tablets, the occasional contractor laptop that probably shouldn’t be on the network but definitely is. Each one is a potential exfiltration vector if compromised. ...