George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].
Someone stole an Azure service principal and wiped storage in seven minutes

Someone stole an Azure service principal and wiped storage in seven minutes

Storm-3168 used compromised workload identities to delete Azure Storage, Key Vaults, and Function Apps. Check your service principals before standup....
Tuesday’s brief: PeopleSoft attackers slip past WAFs, then Kiteworks, iPhones, and leaky Supabase apps

Tuesday’s brief: PeopleSoft attackers slip past WAFs, then Kiteworks, iPhones, and leaky Supabase apps

ShinyHunters is back on unpatched PeopleSoft, Kiteworks’ weekend shutdown, an iPhone fix for targeted attacks, and 16,326 open Supabase databases....
The app your team built with AI may be leaking its users table. Check Supabase today

The app your team built with AI may be leaking its users table. Check Supabase today

UpGuard found 16,326 Supabase databases with tables anyone can read. If someone shipped a quick app on Supabase, check row…
iPhones still on iOS 26 need Apple’s new update after targeted attacks

iPhones still on iOS 26 need Apple’s new update after targeted attacks

Apple says a CoreGraphics bug may have been used against specific people on iOS before 27. Update to 26.7.1 or…
Kiteworks told customers to power down for a weekend. Check your version and Advanced Forms

Kiteworks told customers to power down for a weekend. Check your version and Advanced Forms

A federal tip led Kiteworks to recommend a weekend shutdown. The flaw sits in Advanced Forms, and every customer should…
PeopleSoft attackers are walking past WAF rules. Patch HR and payroll servers now

PeopleSoft attackers are walking past WAF rules. Patch HR and payroll servers now

ShinyHunters changed one letter in the URL and got past the WAF rules protecting PeopleSoft. Oracle’s June fix is the…
Monday’s brief: NetScaler zero-days, then SharePoint’s deadline, Zimbra OnlyOffice, and a WSO2 JWT bypass

Monday’s brief: NetScaler zero-days, then SharePoint’s deadline, Zimbra OnlyOffice, and a WSO2 JWT bypass

Exploited NetScaler RCEs after Saturday’s patch, SharePoint KEV due today, Zimbra OnlyOffice public-share RCE, and WSO2 JWT auth bypass....
WSO2’s JWT bypass missed Sunday’s deadline — apply the gateway update today

WSO2’s JWT bypass missed Sunday’s deadline — apply the gateway update today

An unsupported JWT algorithm can become an admin session on WSO2 API Manager and Universal Gateway. KEV due was September…
Zimbra OnlyOffice can turn a public Briefcase link into a shell

Zimbra OnlyOffice can turn a public Briefcase link into a shell

Unauthenticated RCE when OnlyOffice meets a public Briefcase document. Patch to 10.1.21 or turn the feature off....
SharePoint’s federal clock runs out today — confirm the August builds

SharePoint’s federal clock runs out today — confirm the August builds

CISA’s SharePoint KEV is due Monday September 28. Microsoft already confirmed observed attacks — verify the farm builds....
NetScaler zero-days were exploited before the patch — upgrade every ADC and Gateway today

NetScaler zero-days were exploited before the patch — upgrade every ADC and Gateway today

Citrix confirmed two NetScaler RCEs were exploited before Saturday’s fix. One hits every appliance in the default config....
Friday’s brief: TeamCity ransomware, then Roundcube, cPanel, GitLab

Friday’s brief: TeamCity ransomware, then Roundcube, cPanel, GitLab

Friday's 5-minute cyber brief: ransomware on TeamCity build servers, exploited Roundcube webmail, cPanel root for any account, and a risky GitLab email token.
Your GitLab issue-email address can push code — rotate it today

Your GitLab issue-email address can push code — rotate it today

GitLab's issue-by-email address carries an account-wide token that can push code and run CI jobs past IP allowlists. How to rotate it and check for misuse.