Daily Cyber News coverage tagged Threat Intelligence.
Microsoft issued an out-of-band Windows update to remove trust from certificates connected to compromised eMudhra authorities. Eight intermediate certificate private keys were found to be recoverable within seconds because of an error during key generation. Microsoft removed seven associated certificates…
An active campaign is using stolen GitHub tokens to extract secrets from private repositories. More than 13,500 malicious branches were recovered across over 850 compromised accounts. The attacker plants a workflow that encodes secrets, writes them into a run log, downloads the log through GitHub’s API…
The systems that verify domain records may need significant changes before quantum computers can challenge conventional encryption. Internet governance bodies are accelerating preliminary work on quantum-safe protections for DNSSEC. Larger keys are one option, but they create larger zones, packets and…
Toronto Crime Stoppers halted operations after reporting showed that supposedly anonymous tip data had exposed identifiable people. More than 1.5 million tips from Canadian chapters were involved, and about half contained personal information. The Toronto chapter said the vendor identified 176,859 Toronto…
Self-managed GitLab servers require urgent updates because an unauthenticated attacker could execute arbitrary code under certain conditions. The issue affects Community and Enterprise editions and sits in the regular-expression compiler. GitLab.com and specified Dedicated tenants were already protected…
Cloud intrusions moved from initial targeting to privileged access in less than three hours in some attacks attributed to China-aligned Storm-0940. The group used the ARTEX AI penetration-testing framework and stolen ConnectWise Cloud Backup credentials to target Microsoft 365 environments. Activity…
Cisco Expressway devices could give attackers root-level command execution if exposed systems remain unpatched. An unauthenticated remote attacker with network access and possession of persistent cookies could connect to the database service and invoke specific commands. The issue affects Expressway Core…
Self-managed GitLab servers could be taken over if administrators delay a new critical patch. Under certain conditions, an unauthenticated user could execute arbitrary code by submitting a specially crafted regular expression. The affected range extends across many GitLab releases beginning with version…
Customer access and service availability were disrupted after attackers used a ConnectWise supply-chain path to reach Microsoft 365 environments. Microsoft attributed the activity to China-aligned Storm-0940, which used the ARTEX agentic AI framework to accelerate scanning, password spraying, and OAuth…
Organizations are facing intrusion campaigns in which AI agents can choose actions and execute commands at machine speed. CrowdStrike documented four previously unreported actors whose exposed frameworks showed different levels of automation and autonomy. Reported victims included healthcare, government…