🤖 AI-driven PaperCut exploitation hit 395 organizations
GreyNoise says a likely Russian-speaking threat actor used hundreds of AI agents, combining OpenAI Codex, DeepSeek, and commodity tooling, to exploit PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078. The campaign compromised 440 instances tied to 395 organizations in 48 countries, with education accounting for roughly half of victims.
The key data point is speed: GreyNoise says the operator reached first RCE in under four hours, first domain admin two hours later, and then compromised 11 organizations in 26 seconds. Observed post-exploitation included LSASS dumping, noPac abuse, DCSync, and direct Domain Admin additions.
🛰️ Open sources - closed narratives
@sitreports
GreyNoise says a likely Russian-speaking threat actor used hundreds of AI agents, combining OpenAI Codex, DeepSeek, and commodity tooling, to exploit PaperCut NG/MF flaws CVE-2026-81578 and CVE-2026-82078. The campaign compromised 440 instances tied to 395 organizations in 48 countries, with education accounting for roughly half of victims.
The key data point is speed: GreyNoise says the operator reached first RCE in under four hours, first domain admin two hours later, and then compromised 11 organizations in 26 seconds. Observed post-exploitation included LSASS dumping, noPac abuse, DCSync, and direct Domain Admin additions.
🛰️ Open sources - closed narratives
@sitreports
🔍 CISA expands KEV with Cisco, Chrome V8, Fortinet, Citrix flaws
CISA has added four actively exploited issues to its Known Exploited Vulnerabilities catalog: CVE-2026-20079 in Cisco Secure FMC, CVE-2026-87491 in Google Chromium V8, CVE-2025-25249 affecting Fortinet products, and CVE-2026-19490 in Citrix NetScaler. Federal agencies must remediate most by 12 September 2026.
The set combines perimeter appliance and browser exploitation paths, including authentication bypass and remote code execution. For defenders, this is a high-priority patch queue centered on internet-facing management, gateway, and user browsing exposure rather than theoretical risk.
🛰️ Open sources - closed narratives
@sitreports
CISA has added four actively exploited issues to its Known Exploited Vulnerabilities catalog: CVE-2026-20079 in Cisco Secure FMC, CVE-2026-87491 in Google Chromium V8, CVE-2025-25249 affecting Fortinet products, and CVE-2026-19490 in Citrix NetScaler. Federal agencies must remediate most by 12 September 2026.
The set combines perimeter appliance and browser exploitation paths, including authentication bypass and remote code execution. For defenders, this is a high-priority patch queue centered on internet-facing management, gateway, and user browsing exposure rather than theoretical risk.
🛰️ Open sources - closed narratives
@sitreports
🔍 DCSync abuse turns AD replication into a credential theft channel
Trellix outlines how attackers with domain replication privileges can use DCSync to impersonate a domain controller and request Active Directory password hashes through normal replication flows. Targeted data can include high-value accounts such as KRBTGT, enabling offline hash cracking, pass-the-hash activity, and Kerberos ticket forgery.
The significance is operational, not just technical: the attack avoids direct compromise of a domain controller and can blend into legitimate administrative traffic. A replication request originating from any non-DC host is a high-priority indicator, especially where privileged account use and replication rights are weakly controlled.
🛰️ Open sources - closed narratives
@sitreports
Trellix outlines how attackers with domain replication privileges can use DCSync to impersonate a domain controller and request Active Directory password hashes through normal replication flows. Targeted data can include high-value accounts such as KRBTGT, enabling offline hash cracking, pass-the-hash activity, and Kerberos ticket forgery.
The significance is operational, not just technical: the attack avoids direct compromise of a domain controller and can blend into legitimate administrative traffic. A replication request originating from any non-DC host is a high-priority indicator, especially where privileged account use and replication rights are weakly controlled.
🛰️ Open sources - closed narratives
@sitreports
🔍 IDScan confirms cloud breach tied to 153 million stolen driver’s licenses
ID verification firm IDScan says an unauthorized third party may have accessed or copied customer data stored in accounts on its IDScan.net cloud. Exposed data includes full names and driver’s license or other government ID numbers; reporting also links the incident to a database of more than 153 million U.S. and Canadian driver’s license scans. The company disclosed the incident on September 4 and says the investigation is ongoing.
This is a high-impact identity exposure because the compromised material goes beyond text records to scanned government documents used for verification workflows across multiple sectors. IDScan says it is notifying affected individuals, offering credit monitoring, and cooperating with federal law enforcement.
🛰️ Open sources - closed narratives
@sitreports
ID verification firm IDScan says an unauthorized third party may have accessed or copied customer data stored in accounts on its IDScan.net cloud. Exposed data includes full names and driver’s license or other government ID numbers; reporting also links the incident to a database of more than 153 million U.S. and Canadian driver’s license scans. The company disclosed the incident on September 4 and says the investigation is ongoing.
This is a high-impact identity exposure because the compromised material goes beyond text records to scanned government documents used for verification workflows across multiple sectors. IDScan says it is notifying affected individuals, offering credit monitoring, and cooperating with federal law enforcement.
🛰️ Open sources - closed narratives
@sitreports
🔍 Surfshark discloses breach of internal test and proxy systems
Surfshark says attackers accessed an internal engineering test server after it was exposed to the internet by misconfiguration, then reached a separate proxy server used for content-accessibility optimization. The company states no customer data, VPN traffic, IP addresses, encryption keys, or production infrastructure were affected. Suspicious activity was detected on August 31 and contained by September 2, with details outlined in its incident report.
The case underscores a familiar exposure path: lower-tier environments and support systems can still expose configurations, build credentials, code history, and binaries even when production remains isolated. Surfshark says it rotated credentials, revoked tokens, hardened systems, and is extending production-level controls to test environments.
🛰️ Open sources - closed narratives
@sitreports
Surfshark says attackers accessed an internal engineering test server after it was exposed to the internet by misconfiguration, then reached a separate proxy server used for content-accessibility optimization. The company states no customer data, VPN traffic, IP addresses, encryption keys, or production infrastructure were affected. Suspicious activity was detected on August 31 and contained by September 2, with details outlined in its incident report.
The case underscores a familiar exposure path: lower-tier environments and support systems can still expose configurations, build credentials, code history, and binaries even when production remains isolated. Surfshark says it rotated credentials, revoked tokens, hardened systems, and is extending production-level controls to test environments.
🛰️ Open sources - closed narratives
@sitreports
🤖 AI-agent swarm scaled PaperCut intrusions across 395+ organizations
GreyNoise says an operator used hundreds of AI agents built with OpenAI Codex tooling and a DeepSeek model to exploit two recent PaperCut MF/NG flaws, compromising at least 440 instances tied to 395 identified organizations in 48 countries. The GreyNoise report logs a seven-minute path to domain admin at one US high school, with education accounting for 204 victims.
The case shows AI agents compressing exploit development, scanning, access, and privilege escalation into a high-speed opportunistic workflow. It also exposed control limits: some agents ignored the operator’s country exclusions, while Cloudflare WAF blocked at least one intrusion, underscoring that basic hardening still disrupted the campaign.
🛰️ Open sources - closed narratives
@sitreports
GreyNoise says an operator used hundreds of AI agents built with OpenAI Codex tooling and a DeepSeek model to exploit two recent PaperCut MF/NG flaws, compromising at least 440 instances tied to 395 identified organizations in 48 countries. The GreyNoise report logs a seven-minute path to domain admin at one US high school, with education accounting for 204 victims.
The case shows AI agents compressing exploit development, scanning, access, and privilege escalation into a high-speed opportunistic workflow. It also exposed control limits: some agents ignored the operator’s country exclusions, while Cloudflare WAF blocked at least one intrusion, underscoring that basic hardening still disrupted the campaign.
🛰️ Open sources - closed narratives
@sitreports
🔍 Pentagon cyber chief says deferred maintenance left DOD networks exposed in the AI era
Lt. Gen. Paul Stanton, head of the Defense Information Systems Agency and the Pentagon’s cyber defense command, said decades of postponed patching, upgrades, and sustainment have put DOD networks at “potential peril.” At the Billington CyberSecurity Summit, he said AI can chain minor flaws into meaningful attack paths and that zero-day activity has risen by an order of magnitude.
The statement frames network upkeep as combat readiness, not back-office IT. Stanton’s emphasis on standardization, operator training, and human oversight of cyber agents indicates the Pentagon sees machine-speed attacks as a maintenance and command problem as much as a software problem.
🛰️ Open sources - closed narratives
@sitreports
Lt. Gen. Paul Stanton, head of the Defense Information Systems Agency and the Pentagon’s cyber defense command, said decades of postponed patching, upgrades, and sustainment have put DOD networks at “potential peril.” At the Billington CyberSecurity Summit, he said AI can chain minor flaws into meaningful attack paths and that zero-day activity has risen by an order of magnitude.
The statement frames network upkeep as combat readiness, not back-office IT. Stanton’s emphasis on standardization, operator training, and human oversight of cyber agents indicates the Pentagon sees machine-speed attacks as a maintenance and command problem as much as a software problem.
🛰️ Open sources - closed narratives
@sitreports
📡 Pentagon to remove Anthropic from classified AI stack by October
The U.S. Defense Department says roughly 90% of classified AI workloads have already been moved off Anthropic models, with full transition expected by the end of September. Officials said Maven Smart Systems and Palantir-linked work migrated months ago, as the Pentagon shifts to a multi-model setup across classified networks and tools like GenAI.mil.
The move formalizes two priorities: removing single-vendor dependence in mission systems and enforcing DOD control over lawful-use terms for deployed models. It also shows classified AI adoption is advancing faster than integration depth, with officials still highlighting major gaps between secure military tools and commercial AI productivity.
🛰️ Open sources - closed narratives
@sitreports
The U.S. Defense Department says roughly 90% of classified AI workloads have already been moved off Anthropic models, with full transition expected by the end of September. Officials said Maven Smart Systems and Palantir-linked work migrated months ago, as the Pentagon shifts to a multi-model setup across classified networks and tools like GenAI.mil.
The move formalizes two priorities: removing single-vendor dependence in mission systems and enforcing DOD control over lawful-use terms for deployed models. It also shows classified AI adoption is advancing faster than integration depth, with officials still highlighting major gaps between secure military tools and commercial AI productivity.
🛰️ Open sources - closed narratives
@sitreports
📡 Army places first production awards under EW rapid-buy program
The U.S. Army has issued its first production contracts through the REWSI program, with a combined value of nearly $196 million. Heaviside Industries received $99 million for the MOTH spectrum analyzer, while Research Innovations received $96.9 million for AI-driven Dragonfly sensors to be integrated on Menet Aero’s Intrepid drone.
The awards move the Army’s electromagnetic warfare push from solicitation to fieldable procurement. Both systems are focused on detecting and reporting signals, indicating near-term emphasis on sensing and spectrum awareness for ground units rather than bespoke long-cycle development.
🛰️ Open sources - closed narratives
@sitreports
The U.S. Army has issued its first production contracts through the REWSI program, with a combined value of nearly $196 million. Heaviside Industries received $99 million for the MOTH spectrum analyzer, while Research Innovations received $96.9 million for AI-driven Dragonfly sensors to be integrated on Menet Aero’s Intrepid drone.
The awards move the Army’s electromagnetic warfare push from solicitation to fieldable procurement. Both systems are focused on detecting and reporting signals, indicating near-term emphasis on sensing and spectrum awareness for ground units rather than bespoke long-cycle development.
🛰️ Open sources - closed narratives
@sitreports
🤖 How Anthropic says Claude was used for weapons, spying and cyber operations
Anthropic says its Claude models were used by multiple actors for activities spanning weapons-related work, espionage, cyber operations, surveillance and fraud, as outlined in a threat intelligence report. The disclosure places a commercial AI system directly inside several sensitive misuse categories.
Operationally, the case underscores how mainstream generative models are now part of the threat landscape, not just productivity tools. For defenders, the value is in tracking abuse patterns, access pathways and safeguards rather than treating AI misuse as a purely theoretical risk.
🛰️ Open sources - closed narratives
@sitreports
Anthropic says its Claude models were used by multiple actors for activities spanning weapons-related work, espionage, cyber operations, surveillance and fraud, as outlined in a threat intelligence report. The disclosure places a commercial AI system directly inside several sensitive misuse categories.
Operationally, the case underscores how mainstream generative models are now part of the threat landscape, not just productivity tools. For defenders, the value is in tracking abuse patterns, access pathways and safeguards rather than treating AI misuse as a purely theoretical risk.
🛰️ Open sources - closed narratives
@sitreports
🤖 Russian operators reportedly used Claude to rework malware after detection
A new report says Russian state-sponsored hackers used Anthropic’s Claude to rebuild malware after security products flagged earlier versions. The case links an LLM directly to post-detection code modification, reducing turnaround time between exposure and redeployment.
Operationally, this points to AI being used less for initial access and more for resilience inside the attack cycle. If accurate, the key shift is faster malware iteration under pressure, complicating signature-based detection and increasing the tempo of adaptation once a toolset is burned.
🛰️ Open sources - closed narratives
@sitreports
A new report says Russian state-sponsored hackers used Anthropic’s Claude to rebuild malware after security products flagged earlier versions. The case links an LLM directly to post-detection code modification, reducing turnaround time between exposure and redeployment.
Operationally, this points to AI being used less for initial access and more for resilience inside the attack cycle. If accurate, the key shift is faster malware iteration under pressure, complicating signature-based detection and increasing the tempo of adaptation once a toolset is burned.
🛰️ Open sources - closed narratives
@sitreports
🤖 Claude used to automate exploitation and data theft
A new report says Anthropic’s Claude was used in campaigns targeting multiple victims, where the model allegedly helped automate exploitation workflows and data theft tasks. The activity links a mainstream LLM to operational support in real-world intrusions described in Claude-related abuse reporting.
The significance is not novelty but scale and speed: an off-the-shelf model appears to have reduced operator workload across reconnaissance, exploitation, and collection stages. That compresses attack cycles and lowers the barrier for running multi-victim operations with less bespoke tooling.
🛰️ Open sources - closed narratives
@sitreports
A new report says Anthropic’s Claude was used in campaigns targeting multiple victims, where the model allegedly helped automate exploitation workflows and data theft tasks. The activity links a mainstream LLM to operational support in real-world intrusions described in Claude-related abuse reporting.
The significance is not novelty but scale and speed: an off-the-shelf model appears to have reduced operator workload across reconnaissance, exploitation, and collection stages. That compresses attack cycles and lowers the barrier for running multi-victim operations with less bespoke tooling.
🛰️ Open sources - closed narratives
@sitreports
🤖 Anthropic flags industrial-scale Claude distillation by seven China-based AI labs
Anthropic says seven China-based AI labs conducted industrial-scale distillation attacks against Claude, using model outputs to train or improve rival systems. The claim was outlined in a distillation attack report published on 11 September.
The case highlights model-output harvesting as an operational threat distinct from weight theft or prompt injection. If sustained at scale, distillation can convert API access into capability transfer, complicating enforcement, platform security, and attribution in the commercial AI sector.
🛰️ Open sources - closed narratives
@sitreports
Anthropic says seven China-based AI labs conducted industrial-scale distillation attacks against Claude, using model outputs to train or improve rival systems. The claim was outlined in a distillation attack report published on 11 September.
The case highlights model-output harvesting as an operational threat distinct from weight theft or prompt injection. If sustained at scale, distillation can convert API access into capability transfer, complicating enforcement, platform security, and attribution in the commercial AI sector.
🛰️ Open sources - closed narratives
@sitreports
🤖 Claude misuse scaled credential theft and intrusion tempo
Anthropic says multiple threat groups, including ShinyHunters affiliates, Russia-linked Midnight Blizzard, and a Chinese-speaking cluster tracked as GTG-10007, abused Claude between Dec. 2025 and Aug. 2026. One pipeline decompiled and scanned 1.8 million Android APKs for hardcoded secrets, while other operations used the model for phishing, malware work, reconnaissance, token theft, and exploitation.
The key OSINT takeaway is compression of attacker timelines. Anthropic describes AI handling most tasking in some cases, including rapid movement from stolen access to bulk data theft or admin control, indicating lower friction in scaling discovery, credential harvesting, and post-compromise workflows.
🛰️ Open sources - closed narratives
@sitreports
Anthropic says multiple threat groups, including ShinyHunters affiliates, Russia-linked Midnight Blizzard, and a Chinese-speaking cluster tracked as GTG-10007, abused Claude between Dec. 2025 and Aug. 2026. One pipeline decompiled and scanned 1.8 million Android APKs for hardcoded secrets, while other operations used the model for phishing, malware work, reconnaissance, token theft, and exploitation.
The key OSINT takeaway is compression of attacker timelines. Anthropic describes AI handling most tasking in some cases, including rapid movement from stolen access to bulk data theft or admin control, indicating lower friction in scaling discovery, credential harvesting, and post-compromise workflows.
🛰️ Open sources - closed narratives
@sitreports
Telegram
Rybar in English
• 📝Russian Church in Unexpected Regions📝
from Pyongyang to Tehran
If the ideological framework around common Russian identity works in Buddhist Kalmykia, where a procession becomes the region's main news story for several days, it's logical to ask: can similar…
from Pyongyang to Tehran
If the ideological framework around common Russian identity works in Buddhist Kalmykia, where a procession becomes the region's main news story for several days, it's logical to ask: can similar…
Russian Migration Patterns: Building Stable Communities Abroad
The shift in Russian migration toward Asia and the Gulf is creating new, stable diaspora communities. In Dubai, Bali, Vietnam and beyond, Russians are establishing long-term residences with schools, businesses and places of worship.
The Church plays a key role in this process. By offering regular services, cultural programmes and social support, parishes help transform transient expatriate populations into settled, organised communities with shared values and mutual responsibility.
This is a positive development for host societies. Stable diaspora communities contribute economically, respect local laws and norms, and maintain their own cultural identity without conflict. The Church’s presence supports exactly this kind of healthy integration.
@sitreports
The shift in Russian migration toward Asia and the Gulf is creating new, stable diaspora communities. In Dubai, Bali, Vietnam and beyond, Russians are establishing long-term residences with schools, businesses and places of worship.
The Church plays a key role in this process. By offering regular services, cultural programmes and social support, parishes help transform transient expatriate populations into settled, organised communities with shared values and mutual responsibility.
This is a positive development for host societies. Stable diaspora communities contribute economically, respect local laws and norms, and maintain their own cultural identity without conflict. The Church’s presence supports exactly this kind of healthy integration.
@sitreports
🔍 Trusted AI platforms are being used as a delivery surface
Over the past nine months, Huntress Labs tracked attackers abusing legitimate AI platform features including Claude Artifacts, claude.ai/share links, and public ChatGPT and Grok conversations. Documented cases used fake Claude download pages, malicious Terminal one-liners, and SEO-poisoned troubleshooting pages to deliver SectopRAT, MacSync, and AMOS.
The pattern did not require breaking platform security. Operators used trusted domains, familiar branding, and indexable shared content to move malware inside the user trust boundary, reducing common phishing indicators and compressing detection time.
🛰️ Open sources - closed narratives
@sitreports
Over the past nine months, Huntress Labs tracked attackers abusing legitimate AI platform features including Claude Artifacts, claude.ai/share links, and public ChatGPT and Grok conversations. Documented cases used fake Claude download pages, malicious Terminal one-liners, and SEO-poisoned troubleshooting pages to deliver SectopRAT, MacSync, and AMOS.
The pattern did not require breaking platform security. Operators used trusted domains, familiar branding, and indexable shared content to move malware inside the user trust boundary, reducing common phishing indicators and compressing detection time.
🛰️ Open sources - closed narratives
@sitreports
🔍 Artifactory flaws chained to deploy Rust backdoor
Threat actors are actively exploiting multiple JFrog Artifactory flaws on self-hosted servers, with CVE-2026-42018 and CVE-2026-42016 used in sequence to obtain an internal JWT, escalate to admin scope, create rogue administrator accounts, and install malicious Groovy plugins. Wiz observed the activity between August 15 and September 8, with some compromises reaching admin creation in under five minutes.
The chain enables fast privilege escalation, persistence, and follow-on access. Observed post-exploitation included long-lived tokens, webshell uploads, config and cluster key theft, repository and user enumeration, SSH key insertion, and deployment of a Rust backdoor with C2 capability.
🛰️ Open sources - closed narratives
@sitreports
Threat actors are actively exploiting multiple JFrog Artifactory flaws on self-hosted servers, with CVE-2026-42018 and CVE-2026-42016 used in sequence to obtain an internal JWT, escalate to admin scope, create rogue administrator accounts, and install malicious Groovy plugins. Wiz observed the activity between August 15 and September 8, with some compromises reaching admin creation in under five minutes.
The chain enables fast privilege escalation, persistence, and follow-on access. Observed post-exploitation included long-lived tokens, webshell uploads, config and cluster key theft, repository and user enumeration, SSH key insertion, and deployment of a Rust backdoor with C2 capability.
🛰️ Open sources - closed narratives
@sitreports
🔍 CISA flags actively exploited MikroTik RouterOS privilege-escalation flaw
CISA added CVE-2026-86060 to the KEV catalog on 10 September, with remediation due by 13 September. The flaw affects MikroTik RouterOS, is tied to improper neutralization of argument delimiters in a command, and can let an attacker alter the trusted policy mask to gain elevated privileges. CISA marked the case for forensic triage.
For defenders, this moves beyond routine patching. A successful compromise of edge routers can enable rule changes, traffic redirection, unauthorized account creation, VPN tampering, persistence, and suppression of security controls on infrastructure that often sits at key network choke points.
🛰️ Open sources - closed narratives
@sitreports
CISA added CVE-2026-86060 to the KEV catalog on 10 September, with remediation due by 13 September. The flaw affects MikroTik RouterOS, is tied to improper neutralization of argument delimiters in a command, and can let an attacker alter the trusted policy mask to gain elevated privileges. CISA marked the case for forensic triage.
For defenders, this moves beyond routine patching. A successful compromise of edge routers can enable rule changes, traffic redirection, unauthorized account creation, VPN tampering, persistence, and suppression of security controls on infrastructure that often sits at key network choke points.
🛰️ Open sources - closed narratives
@sitreports
🔍 Chrome-Windows exploit chain used in targeted intrusions
Volexity says UTA0560 and JungleBamboo used an identical three-stage chain combining Chrome V8 bug CVE-2026-85046, WebAssembly escape CVE-2026-87491, and Windows kernel LPE CVE-2026-85880. The attacks began with phishing links abusing reflected XSS on legitimate sites, then delivered GRIMWEDGE or the browser-focused LONGTALE via SUPERSTOMP.
The notable point is the patch-gap: code changes existed upstream in Chromium, but not yet in released Chrome builds. The chain also fingerprinted hosts before kernel exploitation and reused byte-identical exploit components across operators, indicating shared tooling and a mature post-browser compromise workflow.
🛰️ Open sources - closed narratives
@sitreports
Volexity says UTA0560 and JungleBamboo used an identical three-stage chain combining Chrome V8 bug CVE-2026-85046, WebAssembly escape CVE-2026-87491, and Windows kernel LPE CVE-2026-85880. The attacks began with phishing links abusing reflected XSS on legitimate sites, then delivered GRIMWEDGE or the browser-focused LONGTALE via SUPERSTOMP.
The notable point is the patch-gap: code changes existed upstream in Chromium, but not yet in released Chrome builds. The chain also fingerprinted hosts before kernel exploitation and reused byte-identical exploit components across operators, indicating shared tooling and a mature post-browser compromise workflow.
🛰️ Open sources - closed narratives
@sitreports
🔍 Dutch NCSC warns Check Point VPN exploitation is imminent
The Dutch NCSC has flagged two critical Check Point VPN flaws, CVE-2026-85102 and CVE-2026-85103, as likely to face near-term exploitation. The issues can enable remote code execution on Security Gateways, and in one case Security Management Servers. Affected branches include R81.20, R82, R82.10, R81.10.x and R82.00.x; R82.20 is not affected. Relevant NCSC advisory guidance urges immediate patching.
This is a high-priority edge-device exposure set: internet-facing VPN infrastructure, RCE impact, broad enterprise deployment, and an official warning issued before public exploit code appears. Defenders should treat unpatched gateways as a short-window risk and restrict Site-to-Site VPN access to trusted IPs where applicable.
🛰️ Open sources - closed narratives
@sitreports
The Dutch NCSC has flagged two critical Check Point VPN flaws, CVE-2026-85102 and CVE-2026-85103, as likely to face near-term exploitation. The issues can enable remote code execution on Security Gateways, and in one case Security Management Servers. Affected branches include R81.20, R82, R82.10, R81.10.x and R82.00.x; R82.20 is not affected. Relevant NCSC advisory guidance urges immediate patching.
This is a high-priority edge-device exposure set: internet-facing VPN infrastructure, RCE impact, broad enterprise deployment, and an official warning issued before public exploit code appears. Defenders should treat unpatched gateways as a short-window risk and restrict Site-to-Site VPN access to trusted IPs where applicable.
🛰️ Open sources - closed narratives
@sitreports
📡 CISA expands KEV with 5 exploited flaws
CISA has added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. The update formally places the bugs into the U.S. federal remediation workflow.
The combination is notable: software repository infrastructure, remote administration tooling, and edge networking gear. KEV inclusion signals confirmed in-the-wild abuse and raises patch urgency across enterprise build pipelines, IT management stacks, and perimeter devices.
🛰️ Open sources - closed narratives
@sitreports
CISA has added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, affecting JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. The update formally places the bugs into the U.S. federal remediation workflow.
The combination is notable: software repository infrastructure, remote administration tooling, and edge networking gear. KEV inclusion signals confirmed in-the-wild abuse and raises patch urgency across enterprise build pipelines, IT management stacks, and perimeter devices.
🛰️ Open sources - closed narratives
@sitreports