Withdrawals on multiple networks were temporarily suspended after Binance confirmed a security incident and reports of funds leaving its wallets. The exchange said customer funds were safe and that it was investigating. External estimates placed the potential loss between at least $2 billion and as much…
Internet-exposed PHP systems face active exploitation of two critical weaknesses collectively called PHP2Shell. Telemetry identified over 22.6 million exposed instances potentially vulnerable, while separate monitoring recorded successful exploitation. Attackers have chained PHP2Shell with a Linux…
Attackers exploited Cisco SD-WAN controllers to gain privileged access and deploy malware built for persistence and key theft. The KeyDrift framework operated inside legitimate control-plane processes, intercepted decrypted traffic and collected material believed to protect data-plane communications. The…
Attackers turned exposed firewalls into a route toward credentials and internal administration. A reported China-linked operation scanned 19,000 internet-facing devices, narrowed the set to 240 potential targets, and exploited 25 during October 23-24, reportedly placing root webshells on 24. Activity…
AudioBlocked malicious workflows did not eliminate the accounts behind the GhostAction supply-chain campaign. Attackers pushed 72,000 commits to 23,000 public repositories between October 13 and 21, including 8,000 new targets. GitHub prevented the workflows from executing, yet researchers found persistent…
Organizations using Cisco Catalyst SD-WAN face both a critical access path and evidence of purpose-built post-compromise tooling. A peering authentication weakness can let an unauthenticated remote attacker gain a high-privileged internal account and change fabric configuration through NETCONF. Separate…
Patient care and teaching were interrupted after a cyberattack hit the University of New Mexico Health Sciences Center. UNM temporarily diverted ambulances, limited admissions, suspended outpatient procedures and canceled classes. It later said critical electronic systems were back online, hospitals were…
AudioInternet-facing PHP systems are under active attack through two critical memory-safety weaknesses. Successful exploitation can let an unauthenticated attacker execute code on an affected server. The flaws were added to the US government’s known-exploited list after researchers reported working remote code…
AudioEmployees are being flooded with email and then contacted through external Microsoft Teams chats by attackers posing as internal IT support. More than 400 incidents followed a recurring pattern, with targets contacted in short windows and malware sometimes running in under 15 minutes. The impostors…
AudioA memory-corruption issue in the Brotli compression library reaches far beyond Node.js. Any application that decompresses attacker-controlled Brotli data with a vulnerable decoder may be exposed, including .NET, Python clients, proxies and data platforms. Public exploit code exists, and threat sensors…
AudioA chained attack against Oracle PeopleSoft can turn an externally reachable integration feature into code execution on the server. Technical analysis describes three weaknesses spanning the Integration Gateway and Environment Management Hub. One issue lets an attacker make a request appear to come from…
AudioWeaknesses disclosed in Tailscale SSH could let an attacker expand access after compromising an authorized device. In laboratory testing, chained issues produced root access on reachable servers and exposed keys that could add rogue devices. An automated attack moved between policy-approved servers…
Security telemetry has become a major recurring cost. The feature asks leaders to decide which signals actually reduce meaningful risk instead of collecting everything by default.
Read on Bare Metal Cyber →
Purple teaming matters most when exercises change real decisions, ownership, architecture, and spending instead of ending as another technical report.
Read on Bare Metal Cyber →
Detection engineering shifts security operations from impressive dashboards and alert counts toward deliberate, testable coverage of attacker behavior.
Read on Bare Metal Cyber →
Sensitive information accumulates in logs, analytics platforms, collaboration suites, and AI stores, creating concentrated risk outside traditional systems of record.
Read on Bare Metal Cyber →
Rapid API growth turns interfaces into a strategic attack surface, requiring explicit ownership, secure defaults, partner controls, and risk-based measurement.
Read on Bare Metal Cyber →
Control checklists can look complete while missing how modern systems actually work. The feature argues for evidence and controls grounded in architecture and risk.
Read on Bare Metal Cyber →
Decision Point CISO executive sceneStep into the role of a cybersecurity executive and navigate evolving company crises through hundreds of branching decisions, with voice, audio, imagery, consequences, and achievements.
BMC ChallengesChallenge paths, certification testing, games, and educator tools for hands-on cybersecurity practice.
Deep dive: Exposure. Exposure is the condition of being reachable, visible, accessible, or otherwise subject to loss or attack because assets, identities, data, or services are presented to a threat.
BMC MagazineLong-form analysis and commentary for deeper context.
