We break down the latest in cyber news and threats 🔥 Get the free weekly newsletter → https://nitter.gq/t.co/MwaGLX3v3G
Joined September 2025
- Tweets496
- Following236
- Followers39
- Likes1.5K
One ticket this week: find exposed/high-privilege assets where a fix exists but deployed state lags. GitLab 19.1.8/19.2.6/19.3.2+. Chrome 153.0.8010.36/.37+, not the Sept 3 build. Cisco FMC and SCC Firewall Management: hot fix plus IOC check.
1
12
A useful vulnerability metric: fix-state divergence.
1) fix exists upstream
2) vendor release exists
3) org approves it
4) exposed asset runs it
BlueMoon, GitLab, and Cisco FMC each show a different gap. Two hit KEV clocks that expired in days.
14
GitHub can now block PR merges when the change introduces unresolved secret-scanning alerts. That turns secret scanning from "we found it" into a merge-governance control. Useful defense-in-depth even where push protection is not enabled for every pattern.
6
Unit 42 showed a post-exploitation weakness in SPIFFE/SPIRE: root on a K8s node can spoof workload attestation and obtain co-located workload identities. No CVE, no patch — the mitigation is node hardening. Node trust underpins workload identity.
34
Trezor's Brevo incident is a useful third-party lesson: the attacker did not need to spoof the brand. Compromise of the email provider let phishing come from a legitimate customer account. ~347,000 addresses in scope, ~2,500 clicks before takedown.
15
The consequential part of Anthropic's latest threat report: an espionage actor's AI agents monitored whether its malware was detected, then modified and rebuilt it until it was not. That compresses the defender's signature advantage. Assume artifacts mutate faster.
9
GitLab CVE-2026-85706: unauthenticated arbitrary file read, CVSS 10. Patched Sept 10. watchTowr reported reproduction + honeypot probing Sept 11. CISA added it to KEV the same day, federal deadline Sept 14. Patch, then hunt the commits API path.
Cisco Secure FMC CVE-2026-20079 is confirmed exploited and on CISA KEV. Scope detail worth catching: the advisory also names Security Cloud Control Firewall Management, regardless of device configuration. No workaround. Verify hot fix AND compromise state.
53
BlueMoon's patch gap has a second trap: the two in-the-wild V8 bugs closed in different Chrome releases. 152 fixes CVE-2026-85046. CVE-2026-87491 waits for 153.0.8010.36/.37. "Chrome is patched" is not a version-free statement this week.
44
"Patched" is not a single state.
BlueMoon hit the upstream-to-stable gap. GitLab drew probes and a KEV listing in a day. Cisco confirmed exploitation months after a fix existed.
Issue #155: manage the divergence, not just the ticket.
8
Hunt the external-Teams-to-remote-support path: federation settings, Quick Assist/RMM use, PowerShell/MSI, portable Node.js in user paths, and WinRM from user endpoints toward DCs or CAs. That sequence deserves an incident review.
1
9
Read/source: infosec.watch/p/infosec-watc…
1
A control can be enabled and still fail if an alternate route reaches the same privileged outcome. Map external collaboration, remote support, service registration, management protocols, recovery, and delegated credentials like you map primary logins.
1
3
Read/source: infosec.watch/p/infosec-watc…
3
Invisible Unicode Tags characters can make a finance-lure word look normal to a user while a filter tokenizes it differently. Microsoft’s new analysis gives defenders a simple test: verify normalization before classification.
1
4
Read/source: microsoft.com/en-us/security…
5
Cisco CVE-2026-20212 can allow unauthenticated remote root code execution on affected Nexus 9000 Silicon One switches through TCP 43210/43211. Updates and a workaround are available; Cisco says it has not seen malicious use.
1
42
Read/source: cisco.com/c/en/us/support/do…
8