911Cyber

Today's Cyber Briefing: 2026.10.28 No password. No login. Just a path to your backup server. 🔑Veeam CVE-2026-108142 scores 9.1. Update to 13.1.2 or 13.0.3 today. 🔥 24 firewalls rooted via PHP2Shell + Fragnesia 🇯🇵 54,401 email passwords leaked at So-net cybermaterial.com/ #CyberBriefing

Today's Cyber Briefing: 2026.10.27 iOS 27: not affected. Older iPhones: targeted. Apple's exploited CoreGraphics fix now reaches iOS 18.7.11, and 27.2 fixes 286 bugs. Update today. ☁️ Pod-to-root cloud escape 🔑 DreamHost password resets 🛡️ CISA 2030 lands cybermaterial.com/ #CyberBriefing #Cybersecurity #Infosec #Cyber #Tech

Today's Cyber Briefing: 2026.10.26 216 servers. One target list. Suspected DPRK operators are probing unpatched PHP hosts. Upgrade PHP and restart every worker. 🔓 497 stolen M365 sign-ins, 79 orgs 🤖 AI-assisted ring took 8.2M records ⚠️ New PHP flaw, no patch yet Read More : cybermaterial.com/ #CyberBriefing #PHP #M265 #Microsoft

🕵️ This Saturday: Iran's Prince of Persia. Twenty years of Iranian espionage, a takedown they survived, and a command server hiding on US soil. Full threat actor profile drops Saturday. cybermaterial.com/s/threats Stay tuned! 👀 #Iran #PrinceOfPersia #Cybersecurity

Today's Cyber Briefing - October 23, 2026 MFA didn’t stop it. Passwords weren’t needed. - 497 Microsoft 365 sign-ins at 79 orgs, all with stolen tokens. - Plus: Python Pillow 9.2 flaw (upgrade to 13.0.0), AI agent wallet drain, Capcom 11.77M records. Read More: cybermaterial.com/ #CyberBriefing #Passwords #MFA #Python

Cyber Briefing: October 22, 2026 22.6 million exposed PHP servers. Two flaws. Zero login needed. CVSS 9.2. Exploit attempts already spotted. Security agencies say: patch today or take your site offline. Fix → 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 Patched yet? Read More Headlines: cybermaterial.com👇 #CyberBriefing #Cyber #PHP #Tech

Signal RingRTC CVE-2026-113380 (CVSS 9.3) can keep call audio on after hang-up, so update every device. Also: 333 Tor exits hijacked to steal SSH passwords Oct 1–5, and AI models plan workable OT attacks ~90% of the time. cybermaterial.com/ #CyberBriefing #CyberSecurity

Today's October 20, 2026 - #CyberBriefing 👇 🩹 3 critical NGINX flaws (CVSS 9.2): upgrade to 1.30.6/1.31.7 ⚡ OVHcloud CLI backdoored Oct 19: rotate secrets keys ⚡ INC/Gentlemen AI ops exposed: 46 encryptors, $23,920 AI spend 🚨 Nikkei leaks 1.83M records... Full stories: cybermaterial.com/

What most people picture when they think about cybersecurity Dark rooms Lots of screens Responding to alerts But real security is not only about reacting. Threat hunting means looking for suspicious activity before an attack becomes a breach. In this clip, Teresa explains why proactive defense is becoming a key part of modern cybersecurity. 🎙 Teresa 🎧 Conversation with Prapti and Sofia #cybersecurity #threathunting #infosec #socanalyst #blueteam #cyberdefense #securityoperations #cyberawareness

🧠 Humans of Cyber | David Adrian Modern cybersecurity research increasingly relies on large scale internet measurement. One open source platform that has helped researchers study the global internet is Censys, co-created by David Adrian, a computer scientist and security researcher known for his work in internet scale scanning and cryptographic security. Adrian helped develop Censys in 2015 while conducting research at the University of Michigan. The goal was to build a platform capable of continuously scanning the public internet and indexing exposed services, certificates, and protocols. Security researchers needed a structured way to analyze how systems were configured across the global network, particularly when studying vulnerabilities and cryptographic deployments. Technically, Censys collects internet wide scan data using large scale scanning infrastructure. The platform identifies services running on publicly reachable hosts and records metadata about those services, such as TLS certificates, protocol versions, and exposed ports. This data is indexed and made searchable through APIs and query interfaces that allow researchers to analyze global infrastructure patterns. Because the platform captures detailed information about internet facing systems, it has become an important resource for vulnerability research, threat intelligence, and academic studies. Security teams use it to understand attack surface exposure, track vulnerable services, and monitor how quickly organizations patch critical security flaws. The platform’s open datasets and research publications have contributed to several major studies on internet security, including analyses of TLS deployments, cryptographic weaknesses, and large scale infrastructure misconfigurations. Today the project continues to support security researchers, defenders, and academics who need visibility into how services are deployed across the public internet. A question for the community How useful are internet wide scanning platforms when identifying emerging security risks across global infrastructure? #CyberSecurity #ThreatIntelligence #InternetSecurity #OpenSourceSecurity #Attack

🧠 Humans of Cyber | Sameer Al-Sakran and Allen Gilliland Metabase is an open source business intelligence platform founded in November 2014 by Sameer Al-Sakran and Allen Gilliland, with early development incubated at Expa, the startup studio founded by Garrett Camp. It was created to reduce the friction between complex data warehouses and non-technical stakeholders by providing a web-based interface for querying and visualizing data. The goal was to make data exploration as accessible as a spreadsheet while retaining the power of modern databases. Instead of centralizing analytics within data teams, Metabase enables product, finance, marketing, and security teams to explore structured data directly. Metabase is built primarily in Clojure on the Java Virtual Machine, with a React and TypeScript frontend. Its Query Builder translates user actions into an intermediate query layer that compiles into native SQL, while advanced users can write direct SQL in the Native Query Editor. It connects directly to databases and cloud warehouses, leaving business data in source systems and storing only metadata in a separate application database. A driver-based architecture enables support for multiple databases, and background sync and scan processes map schemas to power the no-code interface. Models and Metrics standardize definitions to reduce reporting inconsistencies, while dashboards and collections support collaboration. The open source edition is licensed under the GNU Affero General Public License version 3. Organizations can deploy it as a self-hosted application or through managed cloud options with regional hosting. As of 2026, Metabase remains an actively maintained analytics platform used across startups, enterprises, and regulated industries. How is your organization ensuring data access without compromising governance and control? #HumansOfCyber #OpenSource #Metabase #DataAnalytics #BusinessIntelligence #SecurityMetrics #DevOps #DataEngineering

🧠 Humans of Cyber | Andy Wick. Modern threat investigations often require deep visibility into network traffic. Security teams frequently need the ability to search historical packet data and reconstruct how an attacker moved through an environment. One open source project designed for this purpose is Arkime, created by Andy Wick. Wick first developed the project in 2012 while working at AOL to address a common challenge in large networks. Packet capture systems could store traffic, but searching through that data quickly during an investigation was difficult. The goal was to build a platform that could capture packets continuously while allowing analysts to search network sessions in near real time. Technically, Arkime is a large scale packet capture and indexing system. Network sensors record full packet data while extracting metadata about each session. This metadata is indexed and made searchable through distributed databases. Early versions relied on Elasticsearch, and modern deployments fully support OpenSearch, which is commonly used today for indexing and query performance. The architecture separates packet capture from analysis components. Capture nodes record traffic and store packet data locally, while the viewer interface allows investigators to search session metadata across distributed sensors. Analysts can query sessions using attributes such as IP addresses, protocols, ports, domain names, or time ranges. When a relevant session is found, the full packet capture can be reconstructed for deeper analysis. The project was originally released under the name Moloch, but it was renamed Arkime in 2021. The name references Archimedes, the observant owl from the Merlin stories, which also inspired the project's mascot. Around the same time, the codebase moved to its own dedicated GitHub organization arkime/arkime, helping the project evolve as an independent open source community effort. Today Arkime is widely used by security operations teams, network defenders, and incident responders who need long term visibility into network activity. The ability to search historical packet captures allows investigators to revisit traffic when new indicators of compromise appear, making it a valuable capability during threat hunting and forensic analysis. A question for the community How does full packet capture change the way your team investigates incidents compared with flow based monitoring alone? #CyberSecurity #NetworkSecurity #ThreatHunting #DFIR #PacketAnalysis #OpenSourceSecurity #BlueTeam #InfosecCommunity

🧠 Humans of Cyber | Greg Anderson OWASP DefectDojo is an open source vulnerability management and orchestration platform created by Greg Anderson to help security teams centralize, triage, and track findings across application and infrastructure testing tools. It was developed to address the fragmentation that occurs when scan results from static analysis, dynamic testing, container scanning, and penetration tests are stored in separate systems without consistent workflow management. Greg Anderson is publicly associated with the creation and early development of DefectDojo within the OWASP ecosystem. The project was built to provide a structured way to aggregate vulnerabilities, deduplicate findings, assign ownership, and measure remediation progress across engineering teams. At a technical level, DefectDojo is a Django-based web application backed by a relational database. It ingests results from numerous security tools through import parsers and APIs, normalizes findings into a consistent data model, and supports role-based access control for triage and remediation workflows. The platform provides dashboards, metrics, risk scoring, and reporting features that allow organizations to track trends over time and integrate vulnerability management into CI CD pipelines. DefectDojo is widely used in DevSecOps programs, application security teams, consulting environments, and internal security operations functions where multiple scanners and manual testing outputs need centralized coordination. It integrates with issue tracking systems and automation pipelines to streamline remediation tracking. The project is licensed under the BSD 3-Clause License and is governed within the OWASP Foundation framework, with public contribution guidelines and community maintainers. As of 2026, OWASP DefectDojo remains an actively maintained open source vulnerability management platform. How is your organization consolidating vulnerability data to reduce duplication and improve remediation accountability? #HumansOfCyber #OpenSource #OWASP #DefectDojo #DevSecOps #VulnerabilityManagement #AppSec #SecurityEngineering

🧠 Humans of Cyber | Brendan Dolan-Gavitt Advanced malware analysis often requires more than static inspection. It demands the ability to replay execution and observe system behavior at instruction-level detail. That capability is central to PANDA, an open source dynamic analysis platform designed for whole-system record and replay. PANDA was created by Brendan Dolan-Gavitt as a research platform built on QEMU. Its design enables analysts to record complete system executions and replay them deterministically, allowing detailed forensic inspection of program behavior. Unlike traditional sandboxes that focus only on high-level activity, PANDA provides instruction-level replay and supports dynamic taint analysis, system call tracing, and plugin-based instrumentation. This allows researchers and defenders to trace how data flows through a system and understand how exploits unfold over time. The platform has been widely used in academic research, vulnerability analysis, and malware investigation. It remains open source and actively maintained within the research community as of 2026. Brendan Dolan-Gavitt continues to be publicly associated with security research and dynamic analysis, and PANDA remains a reference platform for advanced behavioral analysis and reproducible experimentation. Open question When investigating sophisticated malware, what provides more clarity. Static code review or deterministic runtime replay. #HumansOfCyber #OpenSource #MalwareAnalysis #DFIR #PANDA #CyberCommunity

🧠 Humans of Cyber | Toni de la Fuente Prowler is an open source cloud security assessment tool created in 2016 by Toni de la Fuente. It started as an AWS security auditing utility and evolved into a multi-cloud assessment platform used by security, compliance, and DevOps teams to continuously evaluate cloud environments against established control frameworks. Toni de la Fuente is the original author and continues to be publicly associated with its development and direction. The project was built to provide a practical, automated way to validate cloud configurations against structured baselines such as CIS Benchmarks, NIST guidance, PCI-DSS, and SOC 2 related controls. Prowler operates primarily as a CLI-driven engine that queries cloud provider APIs across AWS, Azure, Google Cloud, and Kubernetes. It evaluates resources against defined security checks, produces machine-readable and audit-ready reports, and includes an attack path visualization feature that leverages Neo4j for AWS environments. Distributed under the Apache License 2.0, Prowler maintains public contribution guidelines and active repository governance. As of 2026, it remains an actively maintained open source cloud security assessment platform. How are you operationalizing automated cloud configuration validation in your environment today? #HumansOfCyber #OpenSource #CloudSecurity #CSPM #AWS #Azure #GCP #Kubernetes #DevSecOps #Compliance #SecurityEngineering