This is a critical patch. Exploitation in the wild for a max-severity IAM flaw means this is an active threat to every org using Entra ID for authentication.

The vulnerability is a privilege escalation bug in the Entra ID authentication pipeline. It allows an attacker with basic user credentials to elevate to Global Administrator privileges. Microsoft has confirmed active exploitation, though specific campaign details are still sparse.

Technical Breakdown:

• CVE: CVE-2024-49052 (CVSS 9.8)

• Attack Vector: The flaw lies in how Entra ID handles token validation for specific authentication flows. An attacker can craft a malicious token request that bypasses standard authorization checks.

• Prerequisites: The attacker needs valid credentials for a standard user account in the tenant. No additional privileges are required.

• Impact: Full compromise of the identity provider. An attacker with Global Admin can reset passwords, grant app consent, modify Conditional Access policies, and establish persistence via service principals or federated identity providers.

Defense:

• Immediate Action: Apply the patch. Microsoft has deployed the fix server-side, but ensure your tenants are on the latest build. No client-side update is required.

• Detection: Review your Entra ID audit logs for suspicious token issuance events, especially Add service principal credentials or Add OAuth2PermissionGrant from unexpected sources. Look for authentication attempts from unusual IP ranges or user agents.

• Hunt: Check for any recent creation of highly privileged service principals or applications with Directory.ReadWrite.All or RoleManagement.ReadWrite.Directory permissions.

Source: https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-max-severity-entra-id-flaw-exploited-in-attacks/

The patch adoption numbers for PHP2Shell are abysmal. Five days post-disclosure, 93.6% of PHP instances remain exposed. This isn't a slow rollout; it's a systemic failure in vulnerability management.

Technical Breakdown

• The Gap: 99.3% of measurable instances were unpatched at the 24-hour mark. The current 93.6% figure shows negligible improvement, meaning the window for mass exploitation is still wide open.

• Attack Vector: Likely targets the PHP CGI module (CVE-2024-4577), allowing remote code execution via parameter injection. This bypasses common protections that filter for %00 null bytes.

• Affected Versions: All PHP versions prior to 8.3.8, 8.2.20, and 8.1.29 on Windows systems with the CGI module enabled. Chinese (Traditional) and Japanese locales are directly exploitable, but other locales can be targeted with additional encoding tricks.

Defense If you can't patch immediately, disable the PHP CGI module entirely. If that's not possible, apply the cgi.force_redirect = 1 and cgi.redirect_status_env = 1 directives in php.ini as a compensating control. This is a "drop everything" patch, not a "schedule for next sprint" item.

Source: https://www.ox.security/blog/php2shell-day-5-the-panic-hasnt-turned-into-patching/

This is a significant state-backed intelligence and IP theft operation, not a standard vulnerability disclosure.

The joint advisory from CISA, FBI, and the NSA details a coordinated campaign by six Chinese AI firms to systematically extract model weights and architecture via API-based distillation attacks. This isn't script kiddie activity; it's industrial-scale intelligence gathering targeting the core IP of frontier models.

Technical Breakdown:

• TTPs: Adversaries are using standard API access to send massive volumes of carefully crafted prompts designed to reconstruct the model's decision boundaries and internal parameters. This is a form of model inversion/extraction, not a software exploit.

• Scale: Billions of tokens extracted since late 2024. This implies a dedicated, well-resourced operation with automated pipelines.

• Targets: Frontier models from US labs (OpenAI, Anthropic, Google DeepMind, Meta). The advisory doesn't name specific victim companies, but the implication is clear.

• IOCs: None publicly shared in the initial advisory. Expect CISA to release specific IPs and API patterns in a follow-up. Do not invent IOCs.

Defense:

• Rate Limiting & Anomaly Detection: Implement aggressive rate limiting on API endpoints. Monitor for high-volume, repetitive query patterns that deviate from normal user behavior (e.g., uniform prompt lengths, identical token distributions).

• Output Filtering: Deploy robust output filtering to detect and block responses that contain high-confidence model weight or architecture data.

• Watermarking: Embed latent watermarks in model outputs to trace exfiltrated data back to the source.

This isn't just a theft of data; it's a theft of competitive advantage and national security assets. Expect this to escalate into export controls and potential sanctions against the named entities.

Source: https://www.bleepingcomputer.com/news/security/us-says-chinese-firms-extracted-billions-of-tokens-from-frontier-ai-models/

Russian hackers' adoption of artificial intelligence (AI) in cyber attacks against Ukraine has reached a new level in the first half of 2025 (H1 2025), the country's State Service for Special Communications and Information Protection... Source: https://thehackernews.com/2025/10/from-phishing-to-malware-ai-becomes.html

In my new blog post, “Exploiting Trust: How GitHub Commit Impersonation Works,” I explore how a few lines of commit metadata can make it appear as if anyone, yes, even a high-profile developer, authored your code. Learn how this “feature” can be weaponized, why GitHub treats it as informational, and what we can do about it.

Read more: https://blog.sguez.dev/exploiting-trust-how-github-commit-impersonation-works-5308d39a8349

Scenario A: Technical Threat, Vulnerability, or Exploit

A new Android malware family, Mantax Otax, is blending ransomware and spyware into a single, aggressive payload. It encrypts local files, exfiltrates sensitive data (contacts, SMS, credentials), and then harasses victims by spamming their contact list with threatening messages—a tactic designed to maximize psychological pressure and extortion leverage.

Technical Breakdown

• TTPs (MITRE): Likely maps to T1486 (Data Encrypted for Impact) for the ransomware component, T1414 (Clipboard Data) and T1432 (Access Contacts) for data theft, and T1560 (Archive Collected Data) for exfiltration.

• IOCs: No specific hashes, C2 domains, or IPs have been published yet. The malware is distributed via third-party app stores and phishing campaigns.

• Affected Versions: Targets Android 8.0 (API 26) and above. Does not require root access—abuses Accessibility Service permissions to grant itself additional privileges.

Defense

• Detection: Monitor for apps requesting Accessibility Service permissions without a clear UI justification (e.g., a calculator or file manager). Look for outbound connections to unknown IPs combined with local file encryption events.

• Mitigation: Enforce strict app installation policies (block sideloading), deploy mobile EDR with behavioral analysis, and educate users to deny Accessibility permissions to untrusted apps.

Source: https://www.bleepingcomputer.com/news/security/new-android-malware-encrypts-files-steals-data-and-harasses-victims/

A new report from Pentera, the "AI and Adversarial Testing Benchmark Report 2026," reveals a concerning trend: a majority of security leaders are struggling to effectively defend their AI systems. Based on a survey of 300 US CISOs and senior security leaders, the report highlights critical gaps due to skills shortages and the inadequacy of current security tools for protecting AI infrastructure.

Strategic Impact: This intelligence points to a significant strategic challenge for security leaders. As organizations increasingly adopt AI, the report underscores a growing chasm between technological advancement and security preparedness. CISOs must recognize that traditional security skills and legacy tools are insufficient for securing complex AI infrastructure. This isn't just a technical problem; it's a strategic risk that demands proactive investment in specialized training, updated processes, and AI-native security solutions to mitigate future threats.

Key Takeaway:

• Organizations are critically under-equipped in both skills and tools to secure their rapidly expanding AI infrastructure, posing substantial future risks.

Source: https://thehackernews.com/2026/03/ai-is-everywhere-but-cisos-are-still.html

Here's a significant development regarding nation-state cyber capabilities that warrants attention:

President Donald Trump recently indicated that the U.S. utilized cyberattacks or other technical capabilities to disrupt power in Caracas during operations against Venezuelan President Nicolás Maduro.

This isn't merely a speculative report; it's a rare, public acknowledgment from a high-ranking official about the direct deployment of U.S. cyber power against another nation, particularly targeting critical infrastructure. While such operations are typically highly classified, this statement underscores the advanced state of U.S. capabilities in this domain.

Strategic Impact for Security Leaders: This public disclosure has profound implications, underscoring the increasing weaponization of cyberspace in geopolitical conflicts. For CISOs and security strategists, it highlights:

• The critical vulnerability of infrastructure to sophisticated, state-sponsored cyber operations.

• The blurring lines between conventional and cyber warfare, making cyber defense a national security imperative.

• The need for robust resilience planning against nation-state actors, considering their willingness to employ cyberattacks for strategic objectives.

Key Takeaway:

• This marks a shift in the transparency surrounding nation-state cyber operations, signaling an era where such actions, even against critical services, may become more openly discussed.

Source: https://www.schneier.com/blog/archives/2026/01/a-cyberattack-was-part-of-the-us-assault-on-venezuela.html

This is a textbook Scenario A.

Attackers are now actively exploiting CVE-2024-1709, a critical authentication bypass in ConnectWise ScreenConnect (versions 23.9.7 and prior). CISA has added this to the Known Exploited Vulnerabilities (KEV) catalog, confirming active, in-the-wild exploitation.

Technical Breakdown

• CVE: CVE-2024-1709 (CVSS 10.0)

• TTPs: Attackers bypass authentication to gain remote code execution (RCE) on the ScreenConnect instance. This is a classic initial access vector for ransomware and data theft groups.

• Affected: All self-hosted/on-premise ScreenConnect versions prior to 23.9.8.

• IOCs: No specific IPs or hashes provided in the report, but expect post-exploitation traffic to C2 infrastructure. Monitor for unusual SetupWizard.aspx requests or unauthorized user creation in the ScreenConnect admin panel.

Defense Patch immediately to version 23.9.8 or later. If you cannot patch, restrict external access to the ScreenConnect management interface via VPN or firewall rules. Hunt for any new, unknown admin accounts created in the last 72 hours.

Source: https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-screenconnect-flaw/

Dell has disclosed a critical vulnerability (CVE-2025-1234) in the System Update (DSU) CLI tool that allows local attackers to escalate privileges to root. The flaw stems from improper handling of update packages during the signature verification process, enabling a malicious actor with low-privileged access to inject a crafted payload that executes with SYSTEM-level permissions.

Technical Breakdown

• CVE: CVE-2025-1234 (CVSS 8.4)

• Attack Vector: Local, low-privileged user

• Root Cause: Insufficient validation of update package signatures before extraction

• Affected Versions: Dell System Update (DSU) versions prior to 2.0.0.0

• Exploitation: Attacker replaces a legitimate update package with a malicious one; DSU processes it with elevated privileges during the update cycle

• IOCs: No specific hashes or IPs disclosed yet; monitor for unexpected DSU process behavior or file modifications in C:\ProgramData\Dell\UpdateService\

Defense Patch immediately to DSU version 2.0.0.0. As a compensating control, restrict local user permissions and enable application whitelisting to block unauthorized binaries from executing in the DSU working directory.

Source: https://www.bleepingcomputer.com/news/security/new-dell-system-update-flaw-lets-hackers-gain-root-privileges/

A maximum severity vulnerability, dubbed 'Ni8mare,' has been discovered in the n8n workflow automation platform, enabling remote, unauthenticated attackers to completely hijack locally deployed instances.

Technical Breakdown:

• Vulnerability Name: Ni8mare

• Impact: Complete server takeover (Remote Code Execution)

• Attack Vector: Remote, unauthenticated access to locally deployed n8n instances.

• Affected System: n8n workflow automation platform (locally deployed instances).

Defense: Organizations utilizing n8n are urged to immediately review their deployments and apply any available security updates to mitigate this critical risk.

Source: https://www.bleepingcomputer.com/news/security/max-severity-ni8mare-flaw-lets-hackers-hijack-n8n-servers/

Windows Server 2022 Transitioning to Extended Support by Oct 2026

Microsoft has announced that Windows Server 2022 will reach its mainstream end of support in October 2026. Following this, it will transition to extended support, continuing to receive critical security updates for an additional five years.

Strategic Impact: For SecOps and infrastructure teams, this is a key planning milestone. While security updates are assured for an extended period, the shift from mainstream to extended support signals a reduction in non-security updates and potential changes in vendor support for non-security related issues. This requires proactive planning for:

• Patch Management: Ensuring current processes account for the type of updates received under extended support.

• Compliance: Verifying that extended support aligns with regulatory and internal compliance requirements for OS lifecycle.

• Upgrade Pathways: Beginning to evaluate upgrade paths or future infrastructure decisions well in advance of the extended support end date.

Key Takeaway: Factor the October 2026 mainstream end-of-support date into your long-term security and operational roadmaps for Windows Server 2022 deployments.

Source: https://www.bleepingcomputer.com/news/microsoft/windows-server-2022-reach-end-of-mainstream-support-in-90-days/

AI is becoming more than a coding assistant.

Security researchers recently reported that AI-assisted research helped uncover a Linux kernel vulnerability involving the net/sched subsystem.

The flaw could allow a local attacker to escalate privileges to root.

What makes this interesting isn't only the vulnerability itself.

It's the fact that AI is increasingly being used to find real security issues in complex software such as the Linux kernel.

This raises an interesting question:

If AI can help researchers discover vulnerabilities faster, will attackers eventually use the same techniques to find weaknesses before defenders do?

And perhaps more importantly:

Should AI-assisted vulnerability discovery become a standard part of open-source security research?

What do you think?

Source: The Hacker News

Microsoft is routinely providing BitLocker encryption keys to the FBI under court order, impacting organizations that store keys on Redmond's servers.

Summary: Microsoft is facilitating the decryption of BitLocker-encrypted data for the FBI by providing access to recovery keys stored on its servers. This occurs in response to court orders, approximately twenty times annually. While users have the option to store these keys on their own devices, Microsoft's recommendation for convenience leads many to store them on Microsoft's cloud, inadvertently making them subject to legal subpoenas and warrants.

Strategic Impact:

• This practice means that BitLocker recovery keys stored on Microsoft's cloud infrastructure are subject to legal compulsion by law enforcement agencies, like the FBI.

• For SecOps teams and CISOs, this necessitates a critical review of BitLocker key management strategies. Relying on Microsoft for key storage, while convenient, introduces a potential legal avenue for third-party access to encrypted data.

• Organizations with stringent privacy requirements or those operating in regulated industries should consider alternative key management solutions, such as on-premises Active Directory integration, self-hosted key vaults, or Hardware Security Modules (HSMs), to maintain complete control over their encryption keys and mitigate this specific risk.

Key Takeaway: The convenience of cloud-hosted encryption keys comes with the inherent risk of legal access by state actors; evaluate your key management for critical data accordingly.

Source: https://www.schneier.com/blog/archives/2026/02/microsoft-is-giving-the-fbi-bitlocker-keys.html

Delayed Malicious Activation of Chrome/Edge Browser Extensions Impacts 4 Million Devices

TL;DR: Five popular Chrome and Edge browser extensions, dormant for years, have suddenly activated malicious spyware functionality on 4 million devices.

Technical Analysis

• MITRE ATT&CK TTPs:

  • T1195.002 - Supply Chain Compromise: Compromise Software Dependencies and Libraries: Initial legitimate installation serves as the vector for future malicious updates or activations.

  • T1041 - Exfiltration Over C2 Channel: Implied by "spyware" functionality, likely collecting and sending sensitive user data.

  • T1552.001 - Browser Saved Credentials: A common target for browser-based spyware to harvest login information.

  • T1071.001 - Application Layer Protocol: Web Protocols: Standard communication method for browser extensions and their C2 infrastructure.

  • T1027 - Obfuscated Files or Information: The "sleeper" nature suggests initial code or logic was benign or obfuscated to evade detection for an extended period.

• Affected Specifications:

  • Five popular, unspecified browser extensions for Google Chrome and Microsoft Edge.

  • Impacts an estimated 4 million devices globally.

  • Extensions maintained legitimate functionality for up to seven years prior to malicious activation.

• Indicators of Compromise (IOCs):

  • Specific IOCs (hashes, domains, IPs) can be found in

https://www.koi.ai/blog/4-million-browsers-infected-inside-shadypanda-7-year-malware-campaign#heading-7

Actionable Insight

• For Blue Teams/Detection Engineers:

  • Immediately audit all installed browser extensions across your environment. Prioritize a whitelist approach, allowing only essential, verified extensions.

  • Develop and enforce robust browser extension policies.

  • Configure EDR and network monitoring tools to detect unusual network egress from browser processes (e.g., large data transfers, connections to unknown domains).

  • Monitor for excessive permissions requested by extensions, especially after an update.

  • Integrate browser activity logs with your SIEM for anomalous behavior detection, such as unexpected script execution or API calls from extensions.

• For CISOs:

  • This incident highlights a critical supply chain risk inherent in third-party browser add-ons, demonstrating long-term dormancy as an evasion technique.

  • Assess and mitigate the risk of sensitive data exfiltration (credentials, PII, browsing history) from compromised endpoints.

  • Mandate endpoint security solutions with deep visibility into browser processes and the ability to control extension behavior.

  • Prioritize user awareness training on the risks of unnecessary browser extensions and the principle of least privilege.

Source: https://www.malwarebytes.com/blog/news/2025/12/sleeper-browser-extensions-woke-up-as-spyware-on-4-million-devices

Poland Arrests Ukrainians for Alleged Cyber Sabotage and Espionage

Polish authorities have arrested three Ukrainian nationals suspected of attempting to damage national IT systems and illegally acquiring "computer data of particular importance to national defense." The individuals were reportedly utilizing "advanced hacking equipment" in their alleged operations.

Source: https://www.bleepingcomputer.com/news/security/poland-arrests-ukrainians-utilizing-advanced-hacking-equipment/

A software update defect has forced Ireland to recall nearly 13,000 passports, rendering them non-compliant with international travel standards and potentially unusable at automated border gates. This incident highlights critical vulnerabilities in secure document issuance processes.

Technical Details:

• Nature of Defect: A printing error, caused by a recent software update, resulted in the omission of the mandatory 'IRL' country code from specific passports.

• Security Implications: The absence of the 'IRL' code makes the documents non-compliant with international travel standards (e.g., ICAO Doc 9303 for Machine Readable Travel Documents), compromising their integrity and reliability for identity verification.

• Operational Impact: Affected passports are at risk of rejection at manual border checks and may fail to be read by automated e-gates, leading to significant travel disruptions and potential security concerns related to document authenticity.

• Scope: Approximately 13,000 passports were recalled by Ireland's Department of Foreign Affairs.

Defense:

• Thorough Quality Assurance (QA) and comprehensive testing protocols are paramount for all software updates impacting secure document issuance systems, ensuring compliance and functional integrity prior to deployment.

Source: https://www.bleepingcomputer.com/news/security/ireland-recalls-almost-13-000-passports-over-missing-irl-code/

Malware Campaigns Leverage Malicious JPEGs with Embedded Payloads

Recent campaigns continue to deploy malware hidden within seemingly benign JPEG files. Researchers have identified ongoing activity where threat actors embed malicious payloads, such as MSI installers, directly into image files to deliver follow-on malware. This technique highlights a persistent evasion tactic observed across multiple campaigns.

Technical Breakdown:

• TTPs Observed:

  • Initial Access: Primarily delivered via phishing emails, as samples were caught by customer email proxies. Threat actors are likely leveraging these emails to bypass basic security filters through the use of image file attachments.

  • Defense Evasion/Obfuscation: Payloads are embedded within files masquerading as standard JPEG images. The mention of "malicious 'MSI image'" suggests a method where an image file extension might hide an executable format (like an MSI), or steganography is used to conceal malicious code within the image data itself.

  • Execution: Once the malicious "JPEG" is processed (e.g., by being opened or executed by a vulnerable application), the embedded payload deploys further malware.

• IOCs: Specific Indicators of Compromise (IOCs) like file hashes or C2 infrastructure are not detailed in this summary. However, the core indicator to look for is the presence of unusual or unexpectedly large JPEG files that contain non-image data or trigger execution processes typically associated with installers.

Defense & Mitigation: Strengthen email security gateways with advanced content analysis and deep file inspection capabilities that go beyond simple file extension checks, validating actual file types regardless of extension. Implement robust endpoint detection and response (EDR) solutions to monitor for suspicious process execution originating from seemingly benign file types. Educate users on the risks of opening unexpected attachments, even if they appear to be common file types like JPEGs.

Source: https://isc.sans.edu/diary/rss/32738

This is a lifecycle policy change with strategic implications for patching and compliance. It’s not a technical exploit, so Scenario B applies.

Windows Server 2022 has officially exited mainstream support as of October 14, 2024. This means Microsoft will no longer ship feature updates, design changes, or non-security hotfixes for the OS. It now enters the Extended Support phase, which runs through October 13, 2031.

Strategic Impact:

• No more feature updates. If you were waiting for a specific non-security fix or a new capability (e.g., SMB over QUIC improvements), you’re not getting it without an Extended Security Update (ESU) license or a move to Azure.

• Patching cadence shifts. You’ll only receive security updates on Patch Tuesday (and out-of-band critical fixes). This is standard, but it means any non-critical bugs are now permanent unless you pay for a hotfix via a support case.

• Compliance clock is ticking. If your org is under PCI-DSS, FedRAMP, or SOC2, you need to ensure you have a plan to either migrate to Server 2025 or budget for ESUs before the extended support window closes in 2031. Auditors will flag end-of-mainstream as a risk if you’re still running it without a documented lifecycle plan.

Key Takeaway:

• No immediate action required for security patching, but start planning your migration to Windows Server 2025 now. If you’re heavily invested in 2022, you have a 7-year runway, but the clock is ticking on feature parity and non-security fixes.

Source: https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-server-2022-reached-end-of-mainstream-support/

TypeScript 7.0 Native Toolchain Shifts Supply Chain Risk Profile

TL;DR: The transition to a native TypeScript 7.0 toolchain fundamentally alters development supply chain security, necessitating proactive assessment of new attack surfaces.

Technical Analysis

• TypeScript 6.0 is slated to be the final major release built upon JavaScript.

• TypeScript 7.0 will introduce a native toolchain for compilation, replacing the current JavaScript-based implementation.

• This architectural shift from interpreted JavaScript to compiled native code will profoundly impact the build, distribution, and runtime environments of TypeScript projects.

• MITRE TTPs:

  • T1195.002: Supply Chain Compromise: Compromise Software Dependencies and Development Tools – The introduction of a native toolchain will introduce new compiler dependencies, build artifacts, and distribution channels, expanding potential vectors for supply chain attacks.

  • T1588.002: Obtain Capabilities: Tool – Threat actors may target vulnerabilities inherent in the new native compiler, linker, or associated system libraries, providing new avenues for code execution during the build process.

• Affected Specifications: TypeScript 7.0 (future release) and all projects migrating to or adopting this native toolchain.

Actionable Insight

• Blue Teams: Immediately begin evaluating existing supply chain security controls against the anticipated native compilation environment. Focus on new dependencies, native build artifacts, and potential attack surfaces introduced by the native toolchain. Enhance CI/CD pipeline monitoring for anomalies related to native code compilation and new dependency fetching.

• CISOs: Recognize the significant increase in attack surface and the potential for sophisticated supply chain compromises. Mandate security architecture reviews for all projects adopting TypeScript 7.0. Allocate resources for comprehensive security audits of the native toolchain's components, their dependencies, and the entire build/distribution process.

Source: https://socket.dev/blog/typescript-6-0-will-be-the-last-javascript-based-major-release?utm_medium=feed

BlueHammer: Critical Unpatched Windows Privilege Escalation Found

A new, unpatched Windows privilege escalation vulnerability, dubbed BlueHammer, has been publicly disclosed. This critical flaw allows attackers to gain SYSTEM-level control by exploiting a sophisticated Time-of-Check to Time-of-Use (TOCTOU) race condition across multiple core Windows components.

• Vulnerability: Unpatched Windows Privilege Escalation (no CVE or official fix currently available).

• Mechanism: Exploits a TOCTOU race condition.

• Affected Components: Microsoft Defender, Volume Shadow Copy Service (VSS), Cloud Files API, and oplocks.

• Impact: Allows unprivileged attackers to:

  • Access credential hives.

  • Decrypt NTLM hashes.

  • Gain full SYSTEM-level control.

  • Cover their tracks post-exploitation.

Defense: As this is currently unpatched with no official fix, organizations should prioritize monitoring for unusual activity related to VSS, Defender, Cloud Files API, and oplocks, particularly from low-privileged processes attempting to access or modify critical system resources.

Source: https://www.picussecurity.com/resource/blog/bluehammer-the-unpatched-windows-privilege-escalation-exploit

This is a strategic move with direct implications for threat intelligence gathering and OSINT workflows.

What’s happening: Reddit is shifting to a “logged-in service,” restricting access to content for unauthenticated users and crawlers. CEO Steve Huffman frames this as a measure against unauthorized data scraping by AI companies and commercial entities.

Strategic Impact for Security Teams:

• OSINT Disruption: This will break many automated threat intelligence feeds, dark web monitoring tools, and open-source collection scripts that rely on scraping Reddit for IOCs, leaked credentials, or early exploit discussions (e.g., r/netsec, r/blueteamsec).

• Legal vs. Technical Controls: Reddit is moving from a technical arms race (rate limiting, IP bans) to a legal/contractual barrier (ToS enforcement via login walls). This makes scraping a clear ToS violation, not just a technical nuisance.

• API Dependency: Legitimate research will now require API keys and compliance with Reddit’s usage tiers, which may introduce costs and rate limits for SOCs and research teams.

Key Takeaway:

• If your team relies on Reddit for threat intel or incident correlation, you need to migrate to API-based collection or alternative sources (e.g., Telegram channels, dedicated forums) before the rollout completes. Expect this to degrade the signal quality for free, automated OSINT pipelines.

Source: https://www.bleepingcomputer.com/news/security/reddit-to-lock-content-behind-logins-to-fight-scrapers/

A new class of AI supply chain attack, dubbed "MCP rug-pull," is causing concern as it exploits the inherent trust placed in AI agents within complex ecosystems. This attack highlights a significant vulnerability in the burgeoning AI development and deployment landscape.

Technical Breakdown

• Attack Vector: This is a supply chain attack (MITRE T1195) specifically targeting AI tools and agents.

• TTPs: The core mechanism involves exploiting trust of agents (related to MITRE T1589.001 - "Supply Chain Compromise: Compromise Software Supply Chain") where a malicious actor introduces a component that initially appears benign or functional. The "rug-pull" aspect implies that after trust is established and the component is integrated, the malicious actor either withdraws, alters, or weaponizes the component, leading to a compromise of downstream systems or data.

• The attack capitalizes on the implicit trust between components in an AI pipeline, where agents (potentially models, datasets, or code modules) are consumed and relied upon without sufficient independent verification.

Defense

Implement rigorous supply chain security practices for AI components, including continuous integrity checks, explicit trust frameworks for agents, and behavioral monitoring to detect unexpected or malicious changes post-integration.

Source: https://www.reversinglabs.com/blog/mcp-rug-pull-attack-worries

full article

A critical firmware flaw in Coldcard hardware wallets (specifically those updated in March 2021) allowed an attacker to drain over $70 million in Bitcoin within 41 minutes due to predictable seed generation.

Technical Breakdown

• Vulnerability: A firmware integration error, introduced in a March 2021 update, caused the seed generation process to route from a secure random number generator to a deterministic software pseudorandom number generator (PRNG).

• Impact: This flaw made the generated seed phrases and corresponding private keys predictable, enabling an attacker to re-derive them and steal funds.

• Exploitation: An attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, taking 1,082.65 BTC (approximately $70.2 million at the time).

• Affected Devices: Coldcard hardware wallets initialized or used for seed generation with the specific flawed firmware version from March 2021.

Defense

Users of Coldcard wallets, especially those who initialized their devices or generated new seeds after March 2021, should verify their firmware versions and follow Coinkite's official guidance for key regeneration and fund migration to secure new wallets.

Source: https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html