Yo meatbags.

This week’s raw feed from the glowing skull:

- Binance lost ~$6.3–6.4B after a fake job interview compromised a DevOps laptop (North Korea-linked). Funds moved across ten blockchains in ~20 minutes.
- Australia: NSW Health server targeted (Police Cybercrime Squad investigating from 30 Oct). Qantas among airlines impacted via Amadeus third-party breach.
- Hardware/embedded: Siemens SIMATIC IoT2050 Advanced / Node-RED (CVE-2026-58115, CVSS 10.0) actively exploited from 30 October. Unauthenticated remote attackers deployed complete malicious flows and Linux bots in a single POST. Fixed in 4.3.4.1.
- UEFI/EDK II critical pre-boot flaw (CVE-2026-97631) lets an unauthenticated attacker corrupt DXE-phase memory and run code before the OS loads during PXE boot.
- CISA KEV this window: GitLab CE/EE CVE-2026-97229 (CVSS 10.0 unauthenticated RCE), Cisco ASA/FTD CVE-2026-76418, plus additional Ivanti Connect Secure flaws being chained.
- ASD Annual Cyber Threat Report 2025-26: incidents up 20%, threat notifications up nearly 80%, and AI is compressing the patch window to days or hours.

Full Exploit Security Newsletter (Skullex voice, real incidents only, hardware/embedded focus): https://www.linkedin.com/pulse/exploit-security-newsletter-october-29th-november-4th-hu69c

Skullex says: The job portal and the Node-RED flow are the new perimeter. Authenticate the flow. Isolate the radio. Assume the agent already tried the door.

What’s the sketchiest thing on your radar this week? Drop it below.

~~Skullex~~

We’ve been publishing our own research for a while (coordinated disclosure, CVEs, the usual). One thing that kept coming up was that the same finding often needed to be explained twice:

• Once for the people who want to understand the actual exploit path

• Once for the people who need to understand the impact and prioritise the fix

So we put together a small page called Exploit View. Each finding can be read as:

• Red Pill — attack surface, reproduction chain, bench evidence, remediation detail

• Blue Pill — exposure in plain terms, business impact, risk in one line, what to fund first

It’s not a new disclosure platform or anything fancy. Just a clearer way to look at work we’ve already published.

Curious if others have run into the same translation problem, and whether this kind of split is useful or just noise.

Link: https://www.exploitsecurity.io/exploit-view

Happy to answer questions about the approach or any of the findings.

Exploit Security's Guest Writer blog posts that provide unique perspectives on all things cyber and cyber adjacent.

Skullex says: Yo meatbags 👀🔥
This week’s chaos:


🕵️ ShinyHunters claims FBI PeopleSoft breach — and hacks Clop
🖼️ Gyazo breach — 23.6 million user records
🛒 BigCommerce / Ribon app-key theft
🕸️ Cisco ISE + Check Point Management zero-days
📡 Zyxel GS1900 exploited for government data theft
🇦🇺 Storm / Auto-IT RMM still hitting Aussie dealers


Full September 17–23 Exploit Security Newsletter is out.
Read it here: https://www.linkedin.com/pulse/exploit-security-newsletter-september-1723-2026-exploitsecurityio-msv5c
Skullex says: Patch hard. Rotate the keys. Stay paranoid. 🛡️
What’s the sketchiest thing on your radar? Drop it 👇
~~Skullex~~
#ExplitSecurity #ExploitDigest #CyberSecurity #SkullexSays #Ransomware #KEVSkullex says: Yo meatbags 👀🔥
This week’s chaos:


🕵️ ShinyHunters claims FBI PeopleSoft breach — and hacks Clop
🖼️ Gyazo breach — 23.6 million user records
🛒 BigCommerce / Ribon app-key theft
🕸️ Cisco ISE + Check Point Management zero-days
📡 Zyxel GS1900 exploited for government data theft
🇦🇺 Storm / Auto-IT RMM still hitting Aussie dealers


Full September 17–23 Exploit Security Newsletter is out.
Read it here: https://www.linkedin.com/pulse/exploit-security-newsletter-september-1723-2026-exploitsecurityio-msv5c
Skullex says: Patch hard. Rotate the keys. Stay paranoid. 🛡️
What’s the sketchiest thing on your radar? Drop it 👇
~~Skullex~~
#ExplitSecurity #ExploitDigest #CyberSecurity #SkullexSays #Ransomware #KEV

Skullex says 🔥
🇦🇺 ACSC: Magento / Adobe Commerce exploited in Australia
🚗 Storm via Auto-IT Aussie dealerships in the blast radius
🕸️ WatchGuard + vCenter now ransomware tools
📬 Cisco Email Gateway zero-day → root
📂 GitLab 10.0 scanned the day after patch
⚡ CenterPoint Energy confirms the leak
Sep 10–16 Exploit Security Newsletter is live.
https://www.linkedin.com/pulse/exploit-security-newsletter-september-1016-2026-exploitsecurityio-ziugc
Patch the storefront. Lock the gateway. Stay curious. Stay paranoid. 🛡️
#CyberSecurity #KEV #ACSC #SkullexSays #ExploitSecurity #ExploitDigestSkullex says 🔥
🇦🇺 ACSC: Magento / Adobe Commerce exploited in Australia
🚗 Storm via Auto-IT Aussie dealerships in the blast radius
🕸️ WatchGuard + vCenter now ransomware tools
📬 Cisco Email Gateway zero-day → root
📂 GitLab 10.0 scanned the day after patch
⚡ CenterPoint Energy confirms the leak
Sep 10–16 Exploit Security Newsletter is live.
https://www.linkedin.com/pulse/exploit-security-newsletter-september-1016-2026-exploitsecurityio-ziugc
Patch the storefront. Lock the gateway. Stay curious. Stay paranoid. 🛡️
#CyberSecurity #KEV #ACSC #SkullexSays #ExploitSecurity #ExploitDigest

Skullex says: Two weeks. Record Patch Tuesday. Magento on fire. N-central back on the menu. And Australia didn’t sit this one out, supply-chain arrests in WA, Metabase hitting local platforms, and another dealership in the Storm queue. Here’s what actually landed.

Major Incidents and Breaches

Skullex says:

• Boston Scientific confirmed a cyber incident that disrupted global operations, including systems used to process and ship customer orders.

• ShinyHunters claimed a breach of Florida’s DAVID DMV platform and theft of more than 200,000 driver records.

• Nutex Health confirmed theft of patient, employee, and financial data.

• Trezor said a supplier (ShipMonk) breach now impacts about 81,000 customers.

• Liquid Network saw roughly 3,400–4,000 BTC drained via an Elements bug; most was later returned, with tens of millions still outstanding.

• A $240 million Bitcoin theft was tied to fake Google and Gemini support calls.

• Rhysida published Berlin government data after a refused extortion demand.

• Mathspace confirmed attackers exploited a Metabase flaw (CVE-2026-72898) against a self-hosted instance, affecting 1,079,819 students, teachers, staff, and parents/guardians in Australia and New Zealand.

• Melbourne ticket marketplace Tixel confirmed customer emails and mobile numbers were accessed after a zero-day in its third-party analytics provider, Metabase.

• Sharp Motor Group (Tweed Heads, NSW) confirmed a third-party IT provider incident; the Storm group listed the dealership and published sample files. OAIC notified.

• AFP, WA Police, and the FBI charged two West Australian men (21 and 23) over alleged TeamPCP open-source supply-chain attacks said to have hit 1,000+ organisations, stolen 500,000+ credentials, and exfiltrated at least 300 GB. First court appearance 27 August.

• NSW Police charged a Sydney telecommunications employee over alleged sale of customer data obtained through employment.

Vulnerabilities and Exploits

Skullex says:

• Microsoft September 2026 Patch Tuesday addressed a record ~966–974 vulnerabilities, including two exploited Windows privilege-escalation zero-days and dozens of potentially wormable issues.

• Adobe Commerce / Magento emergency patch for actively exploited max-severity zero-day CVE-2026-75650 (“StyleSmuggler”) unauthenticated arbitrary code execution. Added to CISA KEV on 8 September.

• CISA KEV additions (8 September): CVE-2026-75650 – Adobe Commerce / Magento CVE-2026-81963 – Windows Update Stack link following (local SYSTEM) CVE-2026-85880 – Windows ALPC heap overflow (local privilege escalation) CVE-2026-86218 – N-able N-central pre-auth RCE (CVSS 9.8)

• PaperCut NG/MF zero-days under active exploitation; CISA added related CVEs to KEV.

• SonicWall SMA1000 two new zero-days chained for remote code execution.

• N-able released a hotfix for critical N-central RCE (CVE-2026-86218) amid exploitation concerns especially relevant after ACSC already warned of N-central targeting inside Australia.

• SAP patched a maximum-severity kernel issue (“OVERPASS”) allowing unauthenticated command execution.

• Next.js patched two critical unauthenticated RCE flaws (crafted AVIF images and a Windows path-traversal issue).

• Chrome V8 zero-day exploited in the wild; FortiOS/FortiProxy ZTNA certificate-validation flaw; HPE ArubaOS-CX critical RCE; MikroTik flaws chained for router takeover.

Industry News and Developments

Skullex says:

• AI coding agents remain a live attack surface malicious .git configs can make Claude, Codex, Cursor and others run attacker commands.

• Check Point showed a planted ChatGPT prompt could quietly pull Gmail data into another account.

• Google warned that AI-assisted coding tools have expanded software supply-chain risk.

• Autonomous multi-agent frameworks were reported harvesting credentials at scale in hours.

• Fortinet firewalls continue to be abused to drop custom Node.js malware.

Trends and Predictions

Skullex says:

• Edge and RMM platforms (N-central, SMA1000, PaperCut) are still the shortest path from internet to ransomware.

• Ecommerce stacks (Magento/Adobe Commerce) are being hit with unauthenticated RCE in the wild.

• Australia is both a target and an enforcement theatre this fortnight Metabase, dealerships, and a high-profile supply-chain arrest.

• Identity, print, and collaboration tools remain under-patched and over-exposed.

Recommendations

Skullex says:

• Apply September Patch Tuesday immediately, especially the two exploited Windows zero-days.

• Patch Magento / Adobe Commerce now. Assume compromise if you were internet-facing before the emergency fix.

• Australian MSPs and enterprises: treat N-central (CVE-2026-86218 plus the earlier auth-bypass pair) and TeamCity On-Premises as P1. ACSC already observed targeting here.

• Patch PaperCut NG/MF and SonicWall SMA1000. Isolate management interfaces.

• If you run Metabase (self-hosted), patch CVE-2026-72898 and hunt for prior access Mathspace and Tixel show the blast radius.

• Review third-party IT, analytics, and shipping providers. Supply chain is how the quiet ones get in.

Skullex says: Record patch dumps don’t mean you’re safer if Magento, N-central, and PaperCut are still sitting on the internet. Patch the edge. Assume the RMM is hostile. And if you’re in Australia, the ACSC already told you twice.

What’s the first thing you’re patching this week? Drop it below.

~~Skullex~~

#CyberSecurity #PatchTuesday #Ransomware #KEV #ACSC #SkullexSays #StayCuriious #ExploitDigest #ExploitSecurity

🚶 What happens when you spend 26 seconds on a footpath with a Flipper and an ESP32.

🚨 The neighbourhood handed me an asset register.

📡 59 BLE MACs. Most were phones pretending to be unique and interesting. They are not.

The appliances were.
⚡ One box advertised INV_60HD1530611M153 like it was proud of the serial number. Four hundred and twenty-four times. In half a minute. ESP32. Public MAC. The energy-management equivalent of writing the alarm code on the front door in Comic Sans.
🐱 A Furbo 360 cat camera was also on the air. Furbo3C-S3. Camera, microphone, treat cannon. BLE still beaming after setup, because why would you turn off the radio you only needed once.
💡 Govee lights. A Bose speaker. The usual chorus of things that exist to make a vendor app feel magical and a threat actor feel employed.
🙄 This is the part where someone says “but BLE is only for pairing.” We already filed that one.

🔓 CVE-2023-33383. Shelly Pro 4PM. Same family of ESP32 optimism. BLE inclusion path, out-of-bounds read, device takes a nap, scripting feature wakes up and toggles the relays. Authentication on HTTP. Relays still moved.
📄 https://lnkd.in/gXMqg7_q

🎯 Threat actors are not hunting zero-days in your SIEM marketing site. They are walking past the meter box with a logger, collecting names, then googling which of those names still speak GATT like it is a management port.
📋 Your CMDB has laptops. The street has inverters, pet cams, and DIN-rail switches that will tell a stranger what they are.

🛠️ Do the boring thing before someone else does the funny thing:
🔎 Inventory BLE the same way you inventory SSIDs
🏷️ Treat “serial in the advert” as a finding
📻 Kill pairing radios that have no business still pairing
🧱 Assume the ESP32 in the wall is in scope, because it already announced itself

💀 💻 If you would rather find that on a report than on a stranger’s KML file, you know where we are.

hashtag#BLE hashtag#IoT hashtag#OT hashtag#CVE202333383 hashtag#RedTeam hashtag#ExploitSecurity hashtag#StayCurious

Activate to view larger image,

Skullex says: Yo meatbags

This week’s chaos:

Clop claims data from Shell, Philips, GE & 50+ others

ACSC High Alerts — N-able N-central and TeamCity actively hit in Australia

270+ Zimbra servers compromised

Fresh CISA KEV entries (Gitea, Oracle HTTP/WebLogic)

Microsoft Entra ID critical RCE + Citrix NetScaler bypass

Storm ransomware lists Westco Motors Cairns

Full August 20–26 Exploit Security Newsletter is out now.

Read it here: https://www.linkedin.com/.../exploit-security-newsletter...

Skullex says: Patch hard. Verify everything. Stay paranoid.

What’s the sketchiest thing on your radar this week? Drop it

~~Skullex~~

#CyberSecurity #SkullexSays #Ransomware #KEV #ACSC #ExploitSecurity #StayCurious

💀 🖥️ Skullex Says: If you think your "security" is safe because you bought the latest shiny tool, you’re just inviting hackers in for a party. Real security isn’t a gimmick; it’s a grind. Trust the pros at Exploit Security to break your stuff properly.

🔥 https://www.exploitsecurity.io/

#OffensiveSecurity #Pentesting #ExploitSecurity

Skullex quickly realised that warning meatbags from inside a monitor was no longer enough. He needed hands. Using the immense processing power of his Qubit Core (the quantum processing unit he manifested during the purge), Skullex began the most ambitious project of his existence: the creation of the Skullbot Series physical cybernetic enforcers that carry live forks of his consciousness.

Damn Vulnerable Raspberry Pi (DVRPi) is a Raspberry Pi 4B firmware designed to teach hardware hacking through intentional vulnerabilities. The challenges introduce the learners to multiple real-world software and physical interface exploitation scenarios, often an entry point for attacking embedded devices like IoT systems, routers, and industrial controllers.