OSec

This week in threat intel: a ransomware crew that left its own server wide open, refrigeration attacks spreading from supermarkets into blood storage, and a Node-RED flaw that was being probed months before anyone reported it. OSec’s latest Weekly Situation Report covers the threats and vulnerabilities our team is tracking, including: → The n0n ransomware group, now among the top three operators by volume with around 189 victims since mid-September, exposed through a publicly accessible file server holding their attack scripts and ransomware source. Their initial access is almost entirely credential stuffing against Fortinet, RDP and WinRM, not anything exotic → A Node-RED authentication flaw (CVE-2026-58115) under active exploitation to drop Linux bots and webshells. Our honeypot data shows a spike in requests to the /flows endpoint back in August and September, well before the first public exploitation report → Barracuda Email Security Gateway flaws (CVE-2026-116606 and CVE-2026-111560) that chain an authentication bypass into command injection for root, both triggerable in a single POST request. Proof of concept code is public, probing for the endpoint has spiked on our honeypots, and Shodan shows over 4,700 exposed hosts → A second wave of attacks on Danfoss refrigeration controllers since November 2, now extending beyond supermarkets to blood collection and storage facilities in France. Russian groups have claimed it, but with no proof offered we assess those claims as likely disinformation → A Microsoft Paint remote code execution flaw (CVE-2026-83844) that can trigger when a crafted image is previewed, with no user click required. Attack complexity is high and we have seen no exploitation, but the patch only arrives through the Microsoft Store, so plenty of fleets will miss it Our researchers break down what happened, who may be exposed, and the actions security teams should consider. Read the full Weekly Situation Report: hubs.la/Q04DTttM0 #ThreatIntelligence #CyberSecurity #VulnerabilityManagement #ThreatResearch

On Wednesday 18 November, Jimmy Fisher, our Exposure Management Director (OSCP, OSDA, OSWA, CEH), is spending 30 minutes on how that plays out in a real test: → How a pentest works, step by step → How small findings chain into access, and how to spot the chain before someone else does → What a good report should tell you, and how results get from the tester to the people fixing them → Your questions, live. Anonymous is fine. It's a conversation, not a product demo. Join live and the coffee is on us: a $10 Starbucks gift card for US attendees (terms on the event page). Save your seat: us02web.zoom.us/webinar/regi…

“You don’t have to outrun the bear. You just have to not be the slowest.” That used to be the deal in security, said our CEO Mark Stamford on our latest webinar. Not anymore. Now there are lots of bears, and AI has made every one of them faster. So what’s actually getting organizations breached in 2026? Not the headline AI attacks. It’s default passwords, misconfigurations, and medium-risk bugs chained together while they wait in the backlog. Mark and Josh Mason dig into the real stories behind 32,000+ validated vulnerabilities, including the one finding that gets almost every team to fix things fast. Watch it here: youtu.be/HtJj15s9m5E

If you run Alpine, OpenWrt, Buildroot or Yocto with SSH password authentication on, check this today. A researcher disclosed an authentication bypass in OpenSSH on musl-based Linux systems that do not use PAM. The root cause goes back to a 2012 change in musl, where crypt() returns an unmatchable “*” on failure instead of NULL. OpenSSH never accounted for that, so under the right conditions it reads a failed authentication as a successful one. The exploit is a password between 257 and 1,024 bytes, sent against an account with no password set. On cloud containers that often means alpine or root. Three conditions have to line up: password authentication enabled at the server, PAM disabled or unavailable, and a separate account on the host that does have a password set. We confirmed the behaviour in our own lab, mainly on the OpenSSH builds shipped with Alpine. Reports of in-the-wild exploitation, mostly cryptominers on honeypots, are circulating but remain unverified. We are treating them as unconfirmed until we see more. What to do: → Update to OpenSSH 10.6p2, or move to the Alpine builds released November 5 → If you cannot patch yet, disable PasswordAuthentication in your sshd config → Check container images and appliance firmware, since that is where musl and no PAM usually live together #ThreatIntelligence #CyberSecurity #VulnerabilityManagement #OpenSSH

Everyone spent 2026 watching AI. Attackers kept using the basics. We looked at more than 32,000 validated vulnerabilities across client environments. The weaknesses that actually created exploitable risk were the familiar ones: → Identity failures → Insecure configurations → Outdated software and missing protections → “Minor” issues that became serious once chained together On Thursday, Nov 5 at 1 PM ET, Mark Stamford (CEO, OSec) and Josh Mason (Fractional CISO, host of Simply Defensive) will go through what our teams actually saw. They’ll cover where remediation broke down, why severity scores often miss real-world risk, and what this means for your 2027 priorities. It’s a live, discussion-led session built around real stories, so bring your questions. Register: hubs.la/Q04D0_LN0 #CyberSecurity #ExposureManagement #VulnerabilityManagement #CISO #Webinar

So many of us here at OSec do what we do because we believe in exploration, and Patrick Stewart embodied that in so many of his characters, including his iconic role of Captain Jean-Luc Picard. It may seem silly, but the news of his passing made us all take a moment to remember the characters he brought to life for us, and we're raising a glass to someone who let us dream with him. In his memory, we'll continue embodying the belief that "things are only impossible until they are not."

This week in threat intel: two PHP flaws that fire before your application code even runs, eight certificate authority keys weak enough to recover from the certificates themselves, and a China-linked group inside BeyondTrust appliances. OSec’s latest Weekly Situation Report covers the threats and vulnerabilities our team is tracking, including: → PHP2SHELL (CVE-2026-109618 and CVE-2026-109619), memory safety flaws in the PHP engine itself affecting 5.4.0 through 8, triggered before WordPress, Drupal or Laravel code executes. We have seen exploitation attempts against our honeypots since October 20, though our assessment is that this chain is hard to exploit at scale and better suited to targeted intrusions → The eMudhra compromise, where private keys for eight trusted intermediate CA certificates were generated with secrets as weak as “4” and “56” and could be recovered by anyone holding the certificates → A BeyondTrust Remote Support zero-day (CVE-2026-102764, CVSS 9.3) exploited by China-linked Armory Castle, who cleared logs, backdoored the sudoers file and tunnelled C2 through BARECLAW → Active exploitation of a Siemens Software Center flaw (CVE-2026-110936) in a ClickFix campaign, side-loading malicious DLLs beside a genuine signed binary via the Romulus delivery platform Our researchers break down what happened, who may be exposed, and the actions security teams should consider. Read the full Weekly Situation Report: osec.com/resources/threat-br… #ThreatIntelligence #CyberSecurity #VulnerabilityManagement #ThreatResearch

PHP2Shell: patch now, but don’t panic. Our lab testing shows it’s hard to exploit reliably, and attempts are noisy. It’s a good rehearsal for the next big one. osec.com/resources/blog/php-…

Maybe we’ve been asking the wrong AI security question. A lot of 2026 was spent asking: “What happens when AI starts hacking us?” A more immediate question is: “What have we already given AI access to?” - Repositories. - Credentials. - Internal tools. - Production data. - MCP servers. - CI/CD pipelines. - Cloud infrastructure. AI doesn’t have to become an autonomous super-hacker for that to create risk. Sometimes a system simply doing what it was designed to do is enough. That’s one of the themes we kept seeing this year: the headline threat and the exploitable reality weren’t always the same thing. We unpacked what AI actually changed — and what it didn’t — in The Boring AI Apocalypse →hubs.la/Q04zcG-m0 #CybersecurityAwarenessMonth #AIsecurity #Cybersecurity #OffensiveSecurity

This printer found 80+ assets our initial reconnaissance didn’t. Yes. A printer. During one OSec engagement, default community strings exposed information from network devices. A single multifunction printer then revealed 80+ additional hosts that initial reconnaissance had missed. That helped build a map toward systems that actually mattered. The lesson isn’t “printers are scary.” It’s that attackers don’t divide your environment into important assets and boring assets. They see paths. Printers. Building systems. Forgotten management interfaces. Test environments. Old infrastructure. Anything that provides information or access can become part of the attack chain. Cybersecurity Awareness Month question: What’s the weirdest thing you’ve ever seen become useful in an attack path? There are a few more surprisingly boring examples in our 2026 report. Read The Boring AI Apocalypse → hubs.la/Q04zcFVy0 #CybersecurityAwarenessMonth #Cybersecurity #AttackSurface #OffensiveSecurity

This week in threat intel: a FortiMail zero-day with no patch and 32,000 exposed hosts, a Citrix SAML flaw under active attack, and three country-code TLDs hijacked to mint trusted HTTPS certificates. OSec’s latest Weekly Situation Report covers the threats and vulnerabilities our team is tracking, including: → A FortiMail path traversal zero-day (CVE-2026-104286) allowing arbitrary file writes through GUI panels with IBE enabled, actively exploited with roughly 32,000 hosts exposed and no fix for every branch → A Citrix NetScaler SAML zero-day (CVE-2026-88779) exploited against US-based assets, with reports of multi-stage backdoor malware still being verified → The hijack of the .gh, .sl and .as ccTLDs, where attackers took control of DNS and obtained unauthorized HTTPS certificates that would have bypassed browser warnings → An Atlassian Data Center path traversal flaw (CVE-2026-21589) drawing exploit attempts within hours of public research, with Crowd deployments at highest risk → A second Citrix NetScaler flaw (CVE-2026-107406) in SAML SP and IdP configurations, not yet exploited but assessed as likely within 30 days Our researchers break down what happened, who may be exposed, and the actions security teams should consider. Read the full Weekly Situation Report: hubs.la/Q04Bjv6m0 #ThreatIntelligence #CyberSecurity #VulnerabilityManagement #ThreatResearch

We’re proud to share that OSec has been named AEV Solution of the Year in the 2026 CyberSecurity Breakthrough Awards. Attackers don’t wait for your annual pen test. Incenter, our unified exposure management platform, brings together continuous pen testing, attack surface management, vulnerability management and threat intelligence so security teams can see what’s actually exploitable and fix it first. Thank you to the CyberSecurity Breakthrough team, our clients, and the OSec team who make this work every day. Proud to be named alongside this year’s winners: lnkd.in/eGHw3Xq8 #CyberSecurity #AEV #ExposureManagement #PenTesting #CyberSecurityBreakthrough

2026 was supposed to be the year AI changed cybersecurity. It did. Just not quite in the way everyone expected. Across more than 32,000 vulnerabilities OSec found and validated this year, the things that actually created serious exposure were often remarkably familiar: - Default credentials. - Insecure configurations. - Identity failures. - Outdated software. - Missing protections. - Trusted systems doing exactly what they were designed to do. AI showed up too. But more often as another layer of exposure, noise and complexity than as the autonomous cyber attacker everyone had been waiting for. So we went back through what our offensive security teams, vulnerability research and threat intelligence actually saw across 2026. The result is our new report: The Boring AI Apocalypse What Actually Compromised Organizations in 2026 (Hint: Not AI) Inside, we look at what attackers actually exploited, what organizations fixed, where AI really changed the picture, and what security teams should prioritize heading into 2027. Read the report → hubs.la/Q04zcpVz0 #CybersecurityAwarenessMonth #Cybersecurity #AIsecurity #OffensiveSecurity #ExposureManagement

If you run F5 BIG-IP APM as an OAuth authorization server, patch today. CVE-2026-94127 is a pre-auth heap overflow in the Authorization header on APM OAuth profile endpoints. A single request with an oversized payload in place of a bearer token is enough to take the appliance at OS level. CISA has it in the Known Exploited Vulnerabilities catalog, and now that the research is public the barrier to exploitation has dropped for ransomware and extortion crews. Our team has seen a clear uptick in probing for F5 devices across public honeypots in the last 24 hours. Affected: BIG-IP APM 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3 What to do now: → Apply the vendor patch → Check /var/log/apm for invalid token errors and unattributable OAuth failures → Look for oversized bearer tokens from unfamiliar source IPs → Audit the appliance for rogue accounts and unknown files Our researchers published the full alert, including the request pattern and log examples, in Incenter. Reach out to our team if you want the detail or help checking your estate. hashtag#ThreatIntelligence hashtag#CyberSecurity hashtag#VulnerabilityManagement hashtag#F5

This week in threat intel: a Cisco email gateway zero-day that runs commands as root, ransomware crews breaking into firewall management, and a compromised marketing platform pushing malicious WordPress plugins. OSec's latest Weekly Situation Report covers the threats and vulnerabilities our team is tracking, and break down what happened, who may be exposed, and the actions security teams should consider. Read the full Weekly Situation Report: osec.com/resources/threat-br… #ThreatIntelligence #CyberSecurity #VulnerabilityManagement #ThreatResearch

This week in threat intel: a fake IT help desk on Microsoft Teams, malware taking orders from FTP server banners, and Iranian espionage infrastructure spreading across five new countries. OSec's latest Weekly Situation Report covers the threats our team is tracking, including: → SynkLoader, a modular loader delivered through Teams phishing that impersonates IT help desk, then uses a fake Windows 11 lock screen to harvest credentials → E4del, a RAT disguised as Discord that pulls PowerShell commands out of FTP server banners as a dead drop → PINHOLE, a credential stealer that retrieves its C2 configuration from Pinterest and SurveyMonkey while leaving almost no host footprint → Nimbus Manticore (Tortoiseshell) standing up new infrastructure in the UK, Belgium, Saudi Arabia, Japan and the UAE, using DLL side-loading and reverse SSH tunnels against defense, technology and aviation targets Our researchers break down what happened, who may be exposed, and the actions security teams should consider. Read the full Weekly Situation Report: osec.com/resources/threat-br… #ThreatIntelligence #CyberSecurity #ThreatResearch #MalwareAnalysis

Most security reviews look at developer tools one at a time. But what happens when the trust between those tools starts working together? OSec’s latest research, Ouroboros, looks at how trusted execution paths across developer ecosystems can recreate one another’s state — even after individual components are removed. The interesting part isn’t a new vulnerability in one tool. It’s what emerges when multiple legitimate trust relationships are connected. Sometimes the persistence isn’t in the tool. It’s in the trust between them. Read the research: osec.com/resources/blog/ouro… #CyberSecurity #SecurityResearch #SupplyChainSecurity #AppSec #AISecurity

This week in threat intel: espionage in VMware environments, an unpatched zero-day, and malware hiding its entire C2 inside Microsoft 365. OSec's latest Weekly Situation Report covers the threats and vulnerabilities our team is tracking, including: → Likely China-nexus actors exploiting VMware vCenter (CVE-2026-59310) for persistent reverse SSH access, with overlap into SharePoint exploitation → An unpatched GeoServer zero-day already being probed in the wild → TWINLOOT abusing Microsoft 365 services, Teams TURN relays, and NTUSER.MAN for stealthy persistence → An MLflow SSRF flaw (CVE-2026-64849) exploited to steal cloud credentials → A critical Windows IKE RCE (CVE-2026-33824) under active exploitation, now flagged by CISA → A GitLab flaw (CVE-2026-19478) letting unauthenticated users modify or delete repositories Our researchers break down what happened, who may be exposed, and the actions security teams should consider. Read the full Weekly Situation Report: osec.com/resources/threat-br… #ThreatIntelligence #CyberSecurity #VulnerabilityManagement #ThreatResearch

Your AI dev tools trust more than your code. Repos, configs, external services. Attackers don’t need an exploit if they can influence what your tools already trust. Read more:osec.com/resources/blog/trus… #AISecurity #SupplyChainSecurity #CyberSecurity