Cybersecurity

CISA flagged a MikroTik web-management bug that can root the router with one request

CISA flagged a MikroTik web-management bug that can root the router with one request

Pre-auth integer underflow in RouterOS HTTP body handling. Keep management off the internet and move past 7.23 / onto 7.24....
Thursday’s brief: SD-WAN admin bypass due Saturday, then TeamViewer, OpenSSL, MikroTik

Thursday’s brief: SD-WAN admin bypass due Saturday, then TeamViewer, OpenSSL, MikroTik

Cisco Catalyst SD-WAN Manager is under active exploitation with a federal clock ending Saturday. Also: TeamViewer 15.82, an OpenSSL DTLS…
Your SD-WAN Manager has a Saturday deadline — and attackers already have admin

Your SD-WAN Manager has a Saturday deadline — and attackers already have admin

Cisco Catalyst SD-WAN Manager auth bypass is in the wild. CISA's federal due date is Saturday, October 3. Patch, then…
Someone stole an Azure service principal and wiped storage in seven minutes

Someone stole an Azure service principal and wiped storage in seven minutes

Storm-3168 used compromised workload identities to delete Azure Storage, Key Vaults, and Function Apps. Check your service principals before standup....
One link in Elementor 4.3 can make an admin create another admin

One link in Elementor 4.3 can make an admin create another admin

Versions 4.3.0 and 4.3.1 skip WordPress REST CSRF checks. Update to 4.3.2 before someone clicks the wrong email....
A new Spectre trick can pull a Linux root password hash in minutes

A new Spectre trick can pull a Linux root password hash in minutes

Branch Target Reuse works on modern CPUs. Kernel fixes are in; patch Linux hosts that share space with untrusted code....
Federal NetScaler clock ends today. Mandiant just published the web shells to hunt

Federal NetScaler clock ends today. Mandiant just published the web shells to hunt

CISA's due date is Wednesday. Mandiant documented WHIPSHOT and SLAPSHOT on appliances hit before the patch. Patch, then hunt....
Wednesday’s brief: Azure wiped in minutes, then Elementor, Spectre, and a NetScaler hunt

Wednesday’s brief: Azure wiped in minutes, then Elementor, Spectre, and a NetScaler hunt

Storm-3168 used stolen Azure service principals to delete storage in seven minutes. Also: Elementor CSRF, a new Spectre Linux leak,…
Security+ vs CySA+ (2026): Which CompTIA Cert to Take

Security+ vs CySA+ (2026): Which CompTIA Cert to Take

Security+ vs CySA+ in 2026: SY0-701 vs CS0-004 compared, difficulty, $439 exam cost, renewal, DoD 8140 work roles, jobs and which to take first.
DoD 8140 Approved Certifications (2026): Roles and Levels

DoD 8140 Approved Certifications (2026): Roles and Levels

DoD 8140 approved certifications for 2026: how DCWF work roles and levels replaced 8570 IAT/IAM, which certs qualify where in Matrix V2.1, and contractor rules.
PeopleSoft attackers are walking past WAF rules. Patch HR and payroll servers now

PeopleSoft attackers are walking past WAF rules. Patch HR and payroll servers now

ShinyHunters changed one letter in the URL and got past the WAF rules protecting PeopleSoft. Oracle’s June fix is the…
Kiteworks told customers to power down for a weekend. Check your version and Advanced Forms

Kiteworks told customers to power down for a weekend. Check your version and Advanced Forms

A federal tip led Kiteworks to recommend a weekend shutdown. The flaw sits in Advanced Forms, and every customer should…
iPhones still on iOS 26 need Apple’s new update after targeted attacks

iPhones still on iOS 26 need Apple’s new update after targeted attacks

Apple says a CoreGraphics bug may have been used against specific people on iOS before 27. Update to 26.7.1 or…