2026-09-08T18:50:19Z https://njump.me IFIN - The Independent Federated Intelligence Network https://njump.me/npub16rex2q22km8zhpqu985vak5ahsztghj8delsmsdu6saff95nca5sh8mzyl https://media.infosec.exchange/infosec.exchange/accounts/avatars/115/741/367/687/413/652/original/8fc4c8a9eead7ead.png https://media.infosec.exchange/infosec.exchange/accounts/avatars/115/741/367/687/413/652/original/8fc4c8a9eead7ead.png https://njump.me/nevent1qqs0tcqx69utjfeupts8sulg4xwu28xqvskrkc64pd43juvqc6agj3qzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjqwxgp4 The recent Siemens Node-RED issue got us wondering; how many insecure Node-RED instances are there, and what happens to them?<br/><br/>In this original research, we examine the bustling malware landing zone that is Node-RED.<br/><br/><a href="https://ifin.network/t/ifin-special-report-what-happens-to-an-open-node-red-instance/973">https://ifin.network/t/ifin-special-report-what-happens-to-an-open-node-red-instance/973</a> 2026-11-10T16:29:57Z https://njump.me/nevent1qqsfkppyfuzsyyq8fnzsxc9l8danyvh6s8q7zzaedzalvz8dpryhxxqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjxvqcld How do you pronounce an asterisk? We&#39;re saying &#34;Shh&#34; for longer. Like &#34;Shhhole.&#34;<br/><br/>This no-CVE-yet vulnerability impacts unpatched musl builds of OpenSSH, including Alpine Linux. But there are a lot of required conditions for exploitation.<br/><br/><a href="https://ifin.network/t/sshole-ssh-auth-bypass-in-musl-based-linux-distros/965">https://ifin.network/t/sshole-ssh-auth-bypass-in-musl-based-linux-distros/965</a><br/><br/>#ThreatIntel #ThreatIntelligence 2026-11-05T20:49:24Z https://njump.me/nevent1qqswmzrehyhyzysuz639wwmjh9ysr0zhxcc9ft9mgwg2cz7cpqw7y9szyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjq8z6lf Sigh<br/><br/>This is a silly CVE. The Siemens devices shipped Node-RED without authentication, which is Node-RED&#39;s default state. It even says so in the docs and tells you to set it up. <br/><br/>Anyway apparently folks are attacking this now.<br/><br/><a href="https://ifin.network/t/cve-2026-58115-no-authentication-on-siemens-simatic-iot2050-node-red/964">https://ifin.network/t/cve-2026-58115-no-authentication-on-siemens-simatic-iot2050-node-red/964</a><br/><br/>#ThreatInte #ThreatIntelligence 2026-11-04T21:20:45Z https://njump.me/nevent1qqs84k6qepmgq840uu2xrgapjz5ep9fnzh9mfc84v4tjx7najwar9kszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjwt39a4 Think eMudhra was handled when you updated your browsers? Think again.<br/><br/><a href="https://ifin-intel.org/blog/emudhra/">https://ifin-intel.org/blog/emudhra/</a><br/><br/>#ThreatIntel #ThreatIntelligence 2026-11-03T19:57:15Z https://njump.me/nevent1qqs86k02xn3ypsmxm4zpau8pmmurex6phzqp2cj2kfpezwh6rqz5mzgzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjp27s7e <br/><br/>Check out our very own <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqzwg92puj94nxnhen0al0zg6583ptjlcsepawwmj7r969zq3p93zsgxvhtf" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqzwg92puj94nxnhen0al0zg6583ptjlcsepawwmj7r969zq3p93zsgxvhtf</span> (<span class="italic">nprofile…vhtf</span>)</a></span>&#39;s talk about building and maintaining community lists! <br/><br/>#ThreatIntelIsMutualAid<br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqnc0gm6qfzj7uprhxj0q5kpuc0tmx73l27w9u8muecux8v42dxn9qfcyfnw" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…yfnw</a></span> </div> Video and deck for Put Community Lists in Your Kill Chain at #BSidesPDX .<br/><br/>20 minutes isn’t a lot of time to cover the subject and based on the questions, I’ll be following up with practical implementation and deployment guides.<br/><br/>Thanks amazing <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqu0z79j2qtgvjrs5y0wls0dye2dd4v5vqvywdapu5wg33uxlug8pqpz46qq" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqu0z79j2qtgvjrs5y0wls0dye2dd4v5vqvywdapu5wg33uxlug8pqpz46qq</span> (<span class="italic">nprofile…46qq</span>)</a></span> team and audience. It made me so happy when multiple midsize orgs said, “this will absolutely help.”<br/><br/>And couldn’t have timed this “crypto is stupid” quote better.<br/><br/><a href="https://m.youtube.com/live/6GGF1eAtmD0?si=eCWNwrz2IyqG63ax&t=4h42m50s">https://m.youtube.com/live/6GGF1eAtmD0?si=eCWNwrz2IyqG63ax&t=4h42m50s</a><br/><br/>#blueteam #etherhiding<br/><br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/547/561/813/304/174/original/b620904d9bb495fe.jpeg"> </blockquote> 2026-11-03T02:25:07Z https://njump.me/nevent1qqswu4mvuffsw9s8gj6q8cjuq9yzx37uz704stsr5m48xxswcemvwcgzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjpqwqfy Your periodic reminder that blocking api.telegram[.]org in your network is a defensive W so huge it needs a pilot car and police escorts. 2026-11-02T19:17:04Z https://njump.me/nevent1qqs8jr56dy5wnx434cv39rraed6ysqu66tchfmqgqrtvh5989v4dmxszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjfmvxur <br/><br/>In case you missed it over the weekend, this vulnerability is still being addressed. More patches are now available for RHEL and Rocky Linux.<br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqnzhesjppmpz3zrcpjjck7n3hjg8fdkwc5dyk6uurs22rrxrd260qk47cxj" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…7cxj</a></span> </div> Patching is taking some time on this potentially serious Linux kernel vulnerability. While we wait, we have a rundown of the partial mitigations for the known attack path.<br/><br/><a href="https://ifin.network/t/cve-2026-98432-unexpected-ipv4-options-lead-to-use-after-free-code-execution-in-linux/946">https://ifin.network/t/cve-2026-98432-unexpected-ipv4-options-lead-to-use-after-free-code-execution-in-linux/946</a><br/><br/>#ThreatIntel #ThreatIntelligence </blockquote> 2026-11-02T14:45:19Z https://njump.me/nevent1qqsrnyf00dvwkjhu5u5wchevsmp8hqljqvfwh3advp2dxtvfquz0e9czyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjjyfmqu We&#39;re hearing reports of insecure private keys in trick-or-treat candy. While these are unconfirmed, we recommend brute-forcing your kids&#39; candy for at least integers 0-255. This may require sampling the candy yourself. For security. 2026-11-01T02:08:22Z https://njump.me/nevent1qqsf3tucfqsas3g3puqefvt0fcmeyr5km8v2xjtdwwpc99p3npk4d8szyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj5l5v79 Patching is taking some time on this potentially serious Linux kernel vulnerability. While we wait, we have a rundown of the partial mitigations for the known attack path.<br/><br/><a href="https://ifin.network/t/cve-2026-98432-unexpected-ipv4-options-lead-to-use-after-free-code-execution-in-linux/946">https://ifin.network/t/cve-2026-98432-unexpected-ipv4-options-lead-to-use-after-free-code-execution-in-linux/946</a><br/><br/>#ThreatIntel #ThreatIntelligence 2026-10-31T05:54:03Z https://njump.me/nevent1qqs2tn5nm8yacuslc7hwc8wtvmkfqvwu0996lq9vaeeppvq2r9x32kszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj6m62nw For 11 hours yesterday, the Cursor Marketplace hosted a malicious version of the Claude Code extension. Up to 5000 users may have been impacted. Details, observables, and remediation steps here:<br/><br/><a href="https://ifin.network/t/anthropic-vs-code-extensions-compromised/943">https://ifin.network/t/anthropic-vs-code-extensions-compromised/943</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-10-30T12:54:47Z https://njump.me/nevent1qqsvy0erwmgnhhe46rf3a0y7fwm4exhc3ystphys8r26hnhhu6rf3agzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjgeeam7 We have now seen enough evidence to say that the Brotli decoder vulnerabilities affecting NodeJS and other platforms has kindasortamaybesometimes been exploited in the wild. At the very least, it should be treated as such.<br/><br/><a href="https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929">https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929</a><br/><br/>#ThreatIntel 2026-10-29T19:13:10Z https://njump.me/nevent1qqs9eqe3y8f9g0g4qv5x89eqt697tepsvycrzymhaaj9uff6dvcc8sgzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjwyt352 We have finally listed #PHP2Shell as exploited in the wild with the release of a report detailing the compromise of multiple firewall devices, including some used by the US government.<br/><br/><a href="https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914">https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914</a><br/><br/>#ThreatIntel 2026-10-28T19:29:57Z https://njump.me/nevent1qqsx507nn8adnmgv9ly75fay73p8sppj3c68tfyxpnpnz0zpgjqxdnszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjhw954r Do you use mutual TLS with your network appliances? You might want to check whether they use a vulnerable version of the GoAhead web server, which has some significant weaknesses in its client certificate verification.<br/><br/><a href="https://ifin.network/t/goahead-tls-vulnerabilities-break-certificate-validation-session-encryption/934">https://ifin.network/t/goahead-tls-vulnerabilities-break-certificate-validation-session-encryption/934</a><br/><br/>#ThreatIntel #IFIN 2026-10-27T22:59:34Z https://njump.me/nevent1qqsr2q3lq28zk3e5y3gz5wpk79rxxfyye8mqpjlt6k6hjg0ddltthgczyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjeds9g6 CISA has added the Brotli vulnerability to the KEV list. While evidence of successful exploitation outside labs is scarce, we have detection opportunities in our thread.<br/><br/><a href="https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929">https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929</a><br/><br/>#ThreatIntel 2026-10-27T20:05:51Z https://njump.me/nevent1qqs9c500h30fp3fh4jz3jqx84scmmdclp2ruujaezd096al870y7argzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjcw4hqj Wanna know more about IFIN? Executive Director <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq7yf7cxzxz4kwf24zmflvyqqtrylsjwm5q9a074u5ger57rmzz0aqe544dh" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq7yf7cxzxz4kwf24zmflvyqqtrylsjwm5q9a074u5ger57rmzz0aqe544dh</span> (<span class="italic">nprofile…44dh</span>)</a></span> was just at JawnCon to explain how we started and what we&#39;re about.<br/><br/><a href="https://www.youtube.com/live/CK-7M5YDf_Y?t=21524s">https://www.youtube.com/live/CK-7M5YDf_Y?t=21524s</a><br/><br/>#ThreatIntelIsMutualAid 2026-10-27T16:48:24Z https://njump.me/nevent1qqsfn7h03tye0jnhsymp8zvhyjm5p7ene9pstgrn3uk4l5kd3jal6xqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjcdf22z When IFIN started, we used a legacy server hosted with Digital Ocean for reverse proxy services. Their recent choices to support fascist-adjacent tech and cease supporting open source projects have made that relationship untenable for us. As of tonight, IFIN infrastructure has moved entirely off DO. 2026-10-27T06:57:50Z https://njump.me/nevent1qqs2a4yxny9stnus8c26czuxfqmfcjx5urhd6r50eg6j6ynk93pttwqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjxw5r9w While everyone (including us) was losing their heads about PHP and Brotli, our community was tracking a widespread WhatsApp Phishing campaign in Europe. Domains and TTPs in this excellent thread.<br/><br/><a href="https://ifin.network/t/whatsapp-ghostpairing-attacks-in-europe-using-the-wa-fisher-phishing-kit/924">https://ifin.network/t/whatsapp-ghostpairing-attacks-in-europe-using-the-wa-fisher-phishing-kit/924</a><br/><br/>#ThreatIntel #IFIN 2026-10-26T18:16:47Z https://njump.me/nevent1qqstkcctser9t2r5ffv5xz4jeq9ta9ztrq5jdmfkc230m0xmcvw4q4gzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj6wwkzq <br/><br/>We&#39;ve updated this story to reflect the wider impact of the vulnerable Google Brotli library, Action is likely necessary.<br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqhf66qq2vj3mj007nd9qz2qm4ga5qdzslyqv0er35tm0rf8uu0ggqjkt8gq" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…t8gq</a></span> </div> Node and Python were feeling left out, so here's an RCE that needs attention. The Node issue, referred to as #Node2Shell, appears fairly exploitable. Check your Node versions and update. Check for affected Python packages as well.<br/><br/><a href="https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929">https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929</a><br/><br/>#ThreatIntel </blockquote> 2026-10-24T14:01:22Z https://njump.me/nevent1qqszveamr20ytg2zpppc3zeyqfrajduq2stzmdfzg05wcgmknhqq37gzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjqkqvgh Hey, has IFIN been valuable to you this week? We sure would appreciate some support of the mission. We&#39;re a registered nonprofit and rely on community support to keep the lights on!<br/><br/><a href="https://ifin-intel.org/support">https://ifin-intel.org/support</a><br/><br/>#ThreaIntelIsMutualAid 2026-10-23T19:10:12Z https://njump.me/nevent1qqst5adqq9xfgae8hlfkjsp9qd65w6qx3g0jqx8u3c69ah35n7w85yqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjaraccn Node and Python were feeling left out, so here&#39;s an RCE that needs attention. The Node issue, referred to as #Node2Shell, appears fairly exploitable. Check your Node versions and update. Check for affected Python packages as well.<br/><br/><a href="https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929">https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929</a><br/><br/>#ThreatIntel 2026-10-23T18:31:51Z https://njump.me/nevent1qqsvetk76zhhs9vwq80vmvcj899pyla4syq8m4s6hs3w07mwy0xmnnczyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj9xyhqp As promised, we&#39;ve updated our #PHP2Shell story with detailed observable indicators. These are based on a broad review of working proofs-of-concept, and should yield high-fidelity hunts and detections. They&#39;ve also been added to our MISP feed.<br/><br/><a href="https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914">https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914</a><br/><br/>#ThreatIntel 2026-10-22T19:53:22Z https://njump.me/nevent1qqsw9cq656wuuvw43qx5aaykwujwvmtv22jccz3u66gm25m2lhqdjxczyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjl6h6gv We will have useful detections for #PHP2Shell in our post and in MISP shortly. We&#39;re doing rigorous validation to make sure we don&#39;t provide nonsense. 2026-10-22T17:24:56Z https://njump.me/nevent1qqsvn39cpxt0p8lgernqzpkmhgnl30cmdzhpfn9ut4nqdwdvjf358wszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjpkrhel After reviewing the &#34;evidence&#34; of exploitation of #PHP2Shell and finding it wanting, we have removed the &#34;EITW&#34; tag from our story.<br/><br/>Our standard for &#34;exploited in the wild&#34; is not sprays against targets. It is direct observables from successful exploitation. That&#39;s a higher bar to clear, but for such a scary vulnerability, hardly impossible. So far however, we have not seen that level of evidence. 2026-10-22T06:02:54Z https://njump.me/nevent1qqspr5krxft9fg8tygcdflsx8hh4suc954ryjr8wgl7fk077xprgehszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjxsxg99 If you run GitLab, you&#39;ve handled some bad vulns recently, so what&#39;s one more? Perfect 10 patched today.<br/><br/><a href="https://ifin.network/t/cve-2026-110264-integer-overflow-in-gitlab-regex-compiler/920">https://ifin.network/t/cve-2026-110264-integer-overflow-in-gitlab-regex-compiler/920</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-10-21T23:35:04Z https://njump.me/nevent1qqsxzgs0u8f4tuk4gxrr4emy73k85fp58y0e7qcc5szy7p94ea8q3hczyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjnfsrxs While you were patching PHP, LiteLLM went and get compromised again.<br/><br/><a href="https://ifin.network/t/litellm-compromised-again-credential-stealer-and-backdoor/919">https://ifin.network/t/litellm-compromised-again-credential-stealer-and-backdoor/919</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-10-21T20:56:46Z https://njump.me/nevent1qqs25gwkk6q23n3es8rs9kms7fdg78chnl9clm4lhjlgpfgwghmdk0czyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj68t2yx <br/><br/>We now have sufficient confirmation to call these exploited in the wild.<br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqyxe3r88hnjte0p66tva3e8kapfp9l6t4z2qx24flkuquea0rf49sd7t0f4" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…t0f4</a></span> </div> The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits.<br/><br/><a href="https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914">https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914</a><br/><br/>#PHP2Shell #ThreatIntelligence #ThreatIntel #IFIN </blockquote> 2026-10-21T17:03:41Z https://njump.me/nevent1qqszrvc3nnmee9uhsad9kwcunmws5sjla9639qr925lmwqwv7h356jczyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj9ugs3u The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits.<br/><br/><a href="https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914">https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914</a><br/><br/>#PHP2Shell #ThreatIntelligence #ThreatIntel #IFIN 2026-10-21T14:11:10Z https://njump.me/nevent1qqsyj7ufrt6taer8srea78fy4y25xudpkw0msxt0a0e8mcrpwgt5p4qzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjqh44tq If you are able to contact folks at local schools, governments, nonprofits, and other services to warn them about the PHP vulnerabilities, please consider doing so. These locations often do not have dedicated security staff and almost certainly have PHP assets exposed.<br/><br/>#ThreatIntelIsMutualAid #TIIMA 2026-10-21T13:05:56Z https://njump.me/nevent1qqstt0k02x8jwrqpj6x435t2l4t6xagrm90w2m89tz7w2d8z5v3zn4qzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjfzhp2a We are aware of the upcoming critical vulnerability disclosures in PHP. Watch this post for updates as they are available.<br/><br/><a href="https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914">https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-10-20T20:34:19Z https://njump.me/nevent1qqsvug5cgvwzt0aml9rmxen7xfnlw732e69sl4x66mnc2l89ghey2hczyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjjfsrjc Eight intermediate certificates used by eMudhra/Emsign have been compromised. These certificates are in multiple trust stores. This will require significant manual action to remediate, including the updates of several packages.<br/><br/><a href="https://ifin.network/t/emudhra-intermediate-certificates-compromised/909">https://ifin.network/t/emudhra-intermediate-certificates-compromised/909</a> <br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-10-20T15:02:32Z https://njump.me/nevent1qqsxs06luus6a3eksjwnk34h3jy022qt33suzm0fnzgzfnq6xl9npzczyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj855k4u Microsoft 365 tenants have been compromised via a stolen ConnectWise Cloud Backup credential. We have the details and investigation steps you need if you use this application in your environment.<br/><br/><a href="https://ifin.network/t/unauthorized-access-in-connectwise-cloud-backup/906">https://ifin.network/t/unauthorized-access-in-connectwise-cloud-backup/906</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-10-17T16:40:38Z https://njump.me/nevent1qqs8w83q7vayyj2ha7hs8e7n40mwr0h27s8ufu4hzdnjymhs7nwn40qzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkja40z3w If your Palo Alto management interface is internet-exposed, you might notice even more traffic on it today. But if that was your security posture, maybe you&#39;re fine with that.<br/><br/>Anyway this is exploited in the wild. Authenticated, so creds required.<br/><br/><a href="https://ifin.network/t/cve-2026-0322-authenticated-rce-in-pan-os/903">https://ifin.network/t/cve-2026-0322-authenticated-rce-in-pan-os/903</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-10-14T20:58:58Z https://njump.me/nevent1qqsqgl8wcvwrkkf8crvh76zl5agm8ct4px7m29qlxt5avjfdcp39t5gzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjzzrtg5 tap tap<br/><br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/117/441/195/119/366/921/original/fce4287d6cf1d0e5.png"> 2026-10-14T20:40:23Z https://njump.me/nevent1qqsxaz2s9wlhrj5rdvzlrc3jxa47w2qyf2kf0d8f2fqcda8h6ntzm0szyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj3zdn9j An Ivanti 0-day auth bypass is being exploited in the wild with significant post-exploitation activity.<br/><br/><a href="https://ifin.network/t/cve-2026-104935-ivanti-connect-secure-auth-bypass-exploited-for-privilege-escalation-code-execution/900">https://ifin.network/t/cve-2026-104935-ivanti-connect-secure-auth-bypass-exploited-for-privilege-escalation-code-execution/900</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-10-13T16:15:54Z https://njump.me/nevent1qqsrymfjt7ctulg0h92uks7wl6pjfh445kzyrrgt4a7lktur48dthdqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjrj7ynk Let&#39;s reset expectations about sharing information. When defensive action is possible, more sharing means more safety for all of us.<br/><br/><a href="https://ifin-intel.org/blog/tlp-clear/">https://ifin-intel.org/blog/tlp-clear/</a> 2026-10-13T15:32:12Z https://njump.me/nevent1qqsz7wq32kkaw0g0sdkgemvgmevf86vwu8qrqkpztkqts3puza55u6qzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjwlndj4 IFIN will be submitting commentary in strong opposition to the obviously dangerous requested TLDs in the latest round of applications to ICANN. Anything that is approved and still dangerous will be added to the IFIN Lists for easy blocking.<br/><br/>We encourage others to submit commentary before November 17.<br/><br/><a href="https://www.icann.org/en/announcements/details/icann-reveals-2026-round-applications-for-new-generic-top-level-domains-07-10-2026-en">https://www.icann.org/en/announcements/details/icann-reveals-2026-round-applications-for-new-generic-top-level-domains-07-10-2026-en</a> 2026-10-10T00:16:58Z https://njump.me/nevent1qqsrsgxw2zkfg2zxj9mwwmz65tq67lpkhyxnd2n3xh828yys8zqrwygzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj4llac5 Once again:<br/><br/>Evidence of exploitation attempts<br/><br/>Is not<br/><br/>Evidence of exploitation<br/><br/>That&#39;s a much higher bar to clear. 2026-10-09T15:10:04Z https://njump.me/nevent1qqsy77tkzyvds2x24mwlm6xma46p8r92w0qwtzlpcwlh0ec384a4skszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjax72kf I&#39;m tired, boss.<br/><br/>A new #Citrix CVE affecting SAML IdP/SP-configured devices is out.<br/><br/><a href="https://ifin.network/t/cve-2026-107406-somehow-another-citrix-netscaler-saml-vulnerability/891">https://ifin.network/t/cve-2026-107406-somehow-another-citrix-netscaler-saml-vulnerability/891</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-10-08T21:09:58Z https://njump.me/nevent1qqsv8z2dapsk4lr2jnmz8x5egusl3svnnfasu00cvzy4exy86ag25wgzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj50j7le The Shai-Hulud style attack on tensorlake has a nasty trick up its sleeve: try to cycle the stolen token, and it&#39;ll blow away your home folder, if you&#39;re not careful.<br/><br/><a href="https://ifin.network/t/tensorlake-supply-chain-attack-comes-with-booby-trap/890">https://ifin.network/t/tensorlake-supply-chain-attack-comes-with-booby-trap/890</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-10-08T16:12:54Z https://njump.me/nevent1qqsgw3ylc4cj5ndefqv7mg3j6e5k8y0dweacy6ml2ezxjz7n3my99jgzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjksxv2d Atlassian has disclosed &#34;arbitrary file access&#34; (cough cough path traversal) in...basically everything. Patches available, but so now is a broad proof-of-concept. Not yet known-exploited, emphasis on &#34;yet.&#34;<br/><br/><a href="https://ifin.network/t/cve-2026-21589-arbitrary-file-access-in-multiple-atlassian-products/885">https://ifin.network/t/cve-2026-21589-arbitrary-file-access-in-multiple-atlassian-products/885</a><br/><br/>#IFIN #ThreatIntel #ThreatIntelligence 2026-10-06T17:26:05Z https://njump.me/nevent1qqsv57sp9uszlzhrr5tnqd8qlqtc8jadk7jfu49udnkqg4nv8lcyqvszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjwtjn6l This is the patch that never ends<br/>It goes on and on my friends<br/>Some people<br/>Started applying it<br/>Not knowing what it was<br/>And they will keep applying it<br/>Forever just because<br/><br/>(CVE-2026-88779 advisory and patch included now)<br/><br/><a href="https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867">https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867</a><br/><br/>#Citrix #Netscaler #ThreatIntel #ThreatIntelligence 2026-10-04T04:37:20Z https://njump.me/nevent1qqs06fvrvdhfpzpcu0remn4tfn4n2027s8z5m9gdzlymxan2ydshteczyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj5ry9dl Sigh<br/><br/>The new reports of further exploitation of Citrix devices and all known observables have been added to our report/MISP feed.<br/><br/><a href="https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867">https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867</a><br/><br/>#Citrix #PitScaler #ThreatIntel #ThreatIntelligence #IFIN 2026-10-02T19:42:54Z https://njump.me/nevent1qqsfkzkgg2htqxkrafcrh87sxsufc2662l5mkyl2jwn257v2fwsrj9qzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj4em4al Well would you look at that; it&#39;s Cisco 0-day o&#39;clock again.<br/><br/><a href="https://ifin.network/t/cve-2026-76504-cisco-sd-wan-auth-bypass-actively-exploited/874">https://ifin.network/t/cve-2026-76504-cisco-sd-wan-auth-bypass-actively-exploited/874</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-09-30T18:29:01Z https://njump.me/nevent1qqswg4vd662vzcykmw7hthau7c6u2nucs9cf95ltu3e40kmgugxj09gzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjfjwrjn If you&#39;re involved in vulnerability management/VulnOps, the last several months have been overwhelming. But take heart: there is a path forward, despite the madness surrounding us.<br/><br/><a href="https://ifin-intel.org/blog/vuln-flood/">https://ifin-intel.org/blog/vuln-flood/</a> 2026-09-29T15:32:12Z https://njump.me/nevent1qqsyw2qz8wfeajcyfm9mfxm66s842x8ryrq5u2gx9chcuy8dlq3sj7gzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj2mtgc2 We&#39;ve been continuously updating this post with the latest information—now including details on exploitation of CVE-2026-88772. And all relevant indicators have been added to our MISP feed.<br/><br/><a href="https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867">https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-09-29T15:21:13Z https://njump.me/nevent1qqsd9vjsgecx6gvzq08zk2tf2496mafa75ywekpmnzm09k9yld9qfjgzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjlfxxyq We are tracking the story about undisclosed 0-days in Citrix Netscaler devices. We have confirmation from multiple source now about the veracity of the claims, although few details from Citrix themselves. This is a developing story.<br/><br/><a href="https://ifin.network/t/citrix-advises-shutdown-due-to-new-undisclosed-netscaler-0-days/867">https://ifin.network/t/citrix-advises-shutdown-due-to-new-undisclosed-netscaler-0-days/867</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-09-26T23:40:59Z https://njump.me/nevent1qqspa4x3c836jw9sry7sce5pdql867uquxmezfpk0gcusvrp0l0xmcqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjcderfw The best time to block the finger protocol (port 79/tcp) outbound from your network was like…the second Clinton administration? But now&#39;s a good time too.<br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-09-23T21:42:36Z https://njump.me/nevent1qqsp5dp76665fh0ntcrkxr2tclc3nxxrjmv2zz6lkhzm7rl4kcc73xqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj4t2s97 A format string vulnerability in Shrubbery&#39;s TACACS+ library (and Facebook&#39;s archived fork of it) can lead to secret disclosure, DoS, and potentially remote code execution. No, Cisco gear isn&#39;t affected, but many other devices will be.<br/><br/>As of now, no CVE has been assigned.<br/><br/><a href="https://ifin.network/t/cve-pending-pre-auth-format-string-bug-in-tac-plus-shrubbery-networks/859">https://ifin.network/t/cve-pending-pre-auth-format-string-bug-in-tac-plus-shrubbery-networks/859</a> 2026-09-23T16:03:06Z https://njump.me/nevent1qqs0xqfqyxn8q2455tk0f2wahytevv8e8sgchs9fdz05nrr7mqvls6gzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj7mhmg0 Completing our tour of new known-exploited vulns today, here is Arista&#39;s perfect-10.<br/><br/><a href="https://ifin.network/t/arista-cve-2026-93952-auth-bypass-exploited-in-the-wild/856">https://ifin.network/t/arista-cve-2026-93952-auth-bypass-exploited-in-the-wild/856</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-09-22T22:28:10Z https://njump.me/nevent1qqszku6vlj7vg848mumheqx4am98s5hxaapp2fhhreh54re3rar3rjszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjldd776 When it rains, it pours. F5 BIG-IP APM also has an exploited CVE!<br/><br/><a href="https://ifin.network/t/f5-big-ip-cve-2026-94127-rce-exploited/855">https://ifin.network/t/f5-big-ip-cve-2026-94127-rce-exploited/855</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-09-22T20:51:00Z https://njump.me/nevent1qqs9uc7qlmw80r8lr4hdqyes40a7uy5uvpscpp4lqy5wa5usvh6cegszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjflxny8 Two Check Point critical vulnerabilities are now listed as exploited in the wild.<br/><br/><a href="https://ifin.network/t/cve-2026-85102-and-93616-check-point-security-gateway-rce-path-traversal-exploited/853">https://ifin.network/t/cve-2026-85102-and-93616-check-point-security-gateway-rce-path-traversal-exploited/853</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-09-22T19:56:52Z https://njump.me/nevent1qqsyp09zysecwrcauvjgakrf47xkvk0smrfkw20kg9hukxet5epnspgzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjyk0a22 <br/><br/>We&#39;ve updated this post with more patches from PaperCut and reports from Huntress.<br/><br/>nostr:nevent1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq2kvq5xuq3szqzcny665prgfz384nedx6ts8jl6fldvs6vycfam3qnzh80p 2026-08-28T18:53:15Z https://njump.me/nevent1qqs9yhr33ja2gqed6xx3tz8gc8aufgmm4yu4rshz2d3seq3v586p7mszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj0yucm8 IFIN has an ambitious set of goals for our first year. Learn about the plan and how you can help us succeed.<br/><br/><a href="https://ifin-intel.org/blog/action-plan/">https://ifin-intel.org/blog/action-plan/</a><br/><br/>#IFIN #ThreatIntel #ThreatIntelligence #TIIMA 2026-08-25T15:04:46Z https://njump.me/nevent1qqsqmxtjxhsldjzjd82xat73tmntvgzsvwkzafyn3qgx66lx8w6u9yqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjpfmftj We have the details on the recent MacSync infostealer malware family.<br/><br/><a href="https://discourse.ifin.network/t/macsync-infostealer-infrastructure-and-ttps/781">https://discourse.ifin.network/t/macsync-infostealer-infrastructure-and-ttps/781</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-08-24T20:16:54Z https://njump.me/nevent1qqsgwz7lmcer7lwxttqnd34tde3230clp0hgk3lgfqgmz58gs095nugzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjm2sztj Expel&#39;s recent discovery of SynkLoader combined lots of fun behaviors into a single malware sample. There are a couple strong detection opportunities worth reviewing.<br/><br/><a href="https://discourse.ifin.network/t/synkloader-windows-loader-malware-brings-its-own-python-and-lock-screen/780">https://discourse.ifin.network/t/synkloader-windows-loader-malware-brings-its-own-python-and-lock-screen/780</a><br/><br/>#IFIN #ThreatIntel #ThreatIntelligence 2026-08-24T15:20:41Z https://njump.me/nevent1qqsqnt3kxc6m27zrdu99q6lj73cjmy74pzyxw2kxc8juy6y86z0qa0gzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkja45uas We have a breakdown of recent Citrix vulnerabilities for you. Again. Not a series we wanted to make, but here we are.<br/><br/><a href="https://discourse.ifin.network/t/recent-citrix-netscaler-vulnerability-roundup-2026-08-22/772">https://discourse.ifin.network/t/recent-citrix-netscaler-vulnerability-roundup-2026-08-22/772</a> 2026-08-22T15:15:13Z https://njump.me/nevent1qqsgw5r6m9uhvy90aj64hmkqhr6un8xp3suu72rytxpt3nhx4xlkaeczyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjvj4sll Rust joins the supply chain party with a set of compromised packages and account takeovers/impersonations today.<br/><br/><a href="https://discourse.ifin.network/t/rust-supply-chain-attack-arrayref-internment-and-append-only-vec-poisoned-by-proc-macro2-typosquat/765">https://discourse.ifin.network/t/rust-supply-chain-attack-arrayref-internment-and-append-only-vec-poisoned-by-proc-macro2-typosquat/765</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN #RustLang 2026-08-20T16:36:40Z https://njump.me/nevent1qqsr42wkyzcd5mkdksetpyfeguvup8qlrj4228ww9u8dglycljehg8czyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj0u09nv Iranian-backed &#34;313 Team&#34; (a front for MOIS operations) has claimed credit for both GitHub and Bluesky DDoS attacks yestderday.<br/><br/><a href="https://discourse.ifin.network/t/iranian-backed-313-team-claims-github-bluesky-ddos-attacks/756">https://discourse.ifin.network/t/iranian-backed-313-team-claims-github-bluesky-ddos-attacks/756</a> 2026-08-18T12:08:25Z https://njump.me/nevent1qqsgte28zgd9pzyuyrp3jluq98fds6ysg890jre9sf43lf9ev2ve0gczyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjx9cd5p We have received reports that this VMWare vulnerability is currently exploited in the wild. Our MISP feed has the existing indicators, including the YARA rule for dropped artifacts.<br/><br/><a href="https://discourse.ifin.network/t/cve-2026-59309-critical-auth-bypass-in-broadcom-vmware-vcenter/746">https://discourse.ifin.network/t/cve-2026-59309-critical-auth-bypass-in-broadcom-vmware-vcenter/746</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-08-14T18:04:55Z https://njump.me/nevent1qqs9sef40jdv38y97p0u5mfpth4hrd3mnj6gx9awkuv2g2qded93waszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj27k9yh You mean there&#39;s another serious vulnerability in WordPress core? CVE-2026-64638 chains cross-site scripting to code execution.<br/><br/>If you aren&#39;t already on 7.0.3, please patch ASAP. Also, consider limiting login page access.<br/><br/><a href="https://discourse.ifin.network/t/cve-2026-64638-xss2shell-does-what-it-says-patch-wordpress-now/729">https://discourse.ifin.network/t/cve-2026-64638-xss2shell-does-what-it-says-patch-wordpress-now/729</a><br/><br/>#CVE #IFIN #ThreatIntel #ThreatIntelligence 2026-08-08T13:45:38Z https://njump.me/nevent1qqsfyal26jwpzn5tx0tv6m5kc7eafj50lxu6fae2ge6zfgm6mas9vxszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjsx5xm6 <br/><br/>Get the look:<br/><br/><a href="https://shop.ifin-intel.org">https://shop.ifin-intel.org</a><br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqncn5wzxpejtdkk39tkvy8tq9fzs3sqyul586zx79h79m8zsvu5xsgcakqt" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…akqt</a></span> </div> Coffeeing up and prepping for the day. <br/><br/>If you see me, say hi. <br/><br/>Repping the <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq90jr7ucc9mjy64pesu50lw8hx39wssv9mt40zp6u2t8gd4x9l2lq7uckj7" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq90jr7ucc9mjy64pesu50lw8hx39wssv9mt40zp6u2t8gd4x9l2lq7uckj7</span> (<span class="italic">nprofile…ckj7</span>)</a></span> tee that says “Threat intel is mutual aid” today because<br/><br/>well, because threat intel is mutual aid. We’re an ecosystem of ecosystems, and the more sharing we do at our roots, the more our core and branches thrive.<br/><br/> <img src="https://masto.deoan.org/system/media_attachments/files/117/043/056/216/169/154/original/a9490ab4a8229546.jpeg"> </blockquote> 2026-08-05T13:16:41Z https://njump.me/nevent1qqsq9a5gfvln85xehscyp9lvcydxjte63v8fvznkwfwz7yjv97xmcyqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjrgh6sl Here&#39;s our coverage of the current ongoing keyv/cacheable NPM attack. We&#39;ve included a list of known Ethereum RPC endpoints as indicators, since the malware looks up second stage data from that blockchain. Not sure why nobody else will say so, but these should be considered malicious.<br/><br/><a href="https://discourse.ifin.network/t/not-so-mini-mini-shai-hulud-attack-hits-400-npm-packages/718">https://discourse.ifin.network/t/not-so-mini-mini-shai-hulud-attack-hits-400-npm-packages/718</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-08-04T18:32:11Z https://njump.me/nevent1qqswenzcu0gaee4lmst8u7h8fpc30fx2g4jq9fgdc7kzdzd5v3rv8ngzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjv5wyza We&#39;re thrilled to announce IFIN has achieved 501(c)(3) recognition! Now we can get down to business. <br/><br/><a href="https://ifin-intel.org/blog/nonprofit/">https://ifin-intel.org/blog/nonprofit/</a><br/><br/>#IFIN 2026-08-04T15:10:12Z https://njump.me/nevent1qqsrw4rgz4r6ny9fxend53yj96l8vmjs0ng6j6alf3yf79cmyee2ruqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjyr3qea <br/><br/>Folks fighting for ad blockers in your orgs: <a href="https://ifin-intel.org/blog/ad-blocker/">https://ifin-intel.org/blog/ad-blocker/</a><br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq5d4x5lcqh5hjmlcg5l29k3sx5sly6kxg5p4alzjj664uxn6t2uxq3fsj5p" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…sj5p</a></span> </div> By me: A major online ads company that claims to serve 1.5 billion ads a day was hacked and began serving malware designed to steal a person's crypto. This is the latest perfect example why you should use an ad-blocker.<br/><br/>More: <a href="https://this.weekinsecurity.com/online-advertising-giant-adform-was-hacked-proving-once-again-why-ad-blockers-are-necessary/">https://this.weekinsecurity.com/online-advertising-giant-adform-was-hacked-proving-once-again-why-ad-blockers-are-necessary/</a><br/><br/>Sign up (or RSS!) for the weekly newsletter: <a href="https://this.weekinsecurity.com">https://this.weekinsecurity.com</a> </blockquote> 2026-08-04T13:19:32Z https://njump.me/nevent1qqsgw7eq3s89dnj6ysvcmjxf442c64lta97ch7736qyy65rxnyepzpgzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkju5pcur Happy Saturday! You might want to check if your Rails app needs a patch against this critical vuln.<br/><br/><a href="https://discourse.ifin.network/t/cve-2026-66066-kindarails2shell-rce-in-rails-via-active-storage/705">https://discourse.ifin.network/t/cve-2026-66066-kindarails2shell-rce-in-rails-via-active-storage/705</a> 2026-08-01T20:10:08Z https://njump.me/nevent1qqst7lm07l7jxzmhl9emm9kaqqv3wswnpszxfqq39v6awpv02khecjszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjpq876z Sorry to disappoint, but there will be no IFIN Threat Actor Taxonomy. Here&#39;s why:<br/><br/><a href="https://ifin-intel.org/blog/attribution/">https://ifin-intel.org/blog/attribution/</a> 2026-07-31T17:52:57Z https://njump.me/nevent1qqsg2429e5an8s4tf5m85rjtzh3dl2xzukvnfwpahggpa3jzmq5mv2czyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj9a54h3 <br/><br/>New packages are still being discovered with malicious payloads. Package adoption remains disabled.<br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqmft9ea58mv8ty5q07mspe8swr0du79w56whq3cda3yvrxqhhv0ssyklvy2" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…lvy2</a></span> </div> Yet another attack against the Arch User Repository is underway. We are monitoring and analyzing the malware samples.<br/><br/><a href="https://discourse.ifin.network/t/new-aur-attack-prompts-adoption-lock/698">https://discourse.ifin.network/t/new-aur-attack-prompts-adoption-lock/698</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN </blockquote> 2026-07-31T12:55:27Z https://njump.me/nevent1qqsd54ju76rakr4j2q8ldcqunc8phk70zh2d8tsgux7cjxpnqtmk8cgzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjj360fw Yet another attack against the Arch User Repository is underway. We are monitoring and analyzing the malware samples.<br/><br/><a href="https://discourse.ifin.network/t/new-aur-attack-prompts-adoption-lock/698">https://discourse.ifin.network/t/new-aur-attack-prompts-adoption-lock/698</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-07-30T20:03:45Z https://njump.me/nevent1qqsgjak2p2h5p7zdsc6dw7qq35jg5n30ze8cjejph64avrsxx4mu8vgzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjzg5a3a We&#39;ve compiled the latest information regarding the Minnesota water systems attacks.<br/><br/><a href="https://discourse.ifin.network/t/minnesota-water-system-suffers-a-breach-due-to-exposed-access-keys/695">https://discourse.ifin.network/t/minnesota-water-system-suffers-a-breach-due-to-exposed-access-keys/695</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-07-30T16:05:14Z https://njump.me/nevent1qqs0nlmfpyuvkv38ssr7wmaasv24jgl5mkf84nuws7z20hm332gd4jqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjwmjkmn We caught a sample of ACR Stealer and went deep on it. Lots of sophistication for &#34;just&#34; an infostealer.<br/><br/><a href="https://discourse.ifin.network/t/acr-stealer-clickfix-etherhiding-and-stego-oh-my/694">https://discourse.ifin.network/t/acr-stealer-clickfix-etherhiding-and-stego-oh-my/694</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-07-29T21:58:35Z https://njump.me/nevent1qqswfrr32dtss7k54lwlkdhvvtuh6dh27zk9zwes5u3z9r8szpnrd0gzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkje3efpe We continue to use our own RSS-Filter project to curate our feed aggregator. We&#39;ve removed &#34;Startups&#34; from the other-wise excellent TechCrunch security news feed to keep the feed relevant and actionable.<br/><br/>Our Newsfeed: <a href="https://news.ifin.network">https://news.ifin.network</a><br/>RSS-Filter: <a href="https://codeberg.org/ifin/rss-filter">https://codeberg.org/ifin/rss-filter</a> 2026-07-27T16:59:51Z https://njump.me/nevent1qqsgj76tl67arrxm7u0xdjelra5hdeurvxmxvtsxf90ph8uqr00vufqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjjv69zd In reply to <a href='/nevent1qqszhvzcjf9jxnnezf5s47z02yt3suehq89csm05efnjhj69ufrenvspz4mhxue69uhhyetvv9ujuerfw36x7tnsw43q3648rk'>nevent1q…48rk</a><br/>_________________________<br/><br/>This is what we&#39;re here for! If you see something suspicious and want someone else to check it out, drop us a tip! We take care of each other by sharing what we see. 2026-07-24T19:18:52Z https://njump.me/nevent1qqszhvzcjf9jxnnezf5s47z02yt3suehq89csm05efnjhj69ufrenvszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjgvv9gn Following up on a Fediverse tip, we found a new use for fake software download sites: the referral program hustle. Mirror FOSS, get cash.<br/><br/>There are almost certainly more of these out there.<br/><br/><a href="https://discourse.ifin.network/t/pdf-arranger-and-terabox-referrals-lamer-than-malware/683">https://discourse.ifin.network/t/pdf-arranger-and-terabox-referrals-lamer-than-malware/683</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-07-24T19:08:37Z https://njump.me/nevent1qqsv35dyampvq0st927jjsvnvwuewgduzp2pquw4euqh94d7jc5hsnqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjqtdpx3 Fantastic research by our community here on a continuing Lua-based campaign that uses Prometheus obfuscation and our old friend Etherhiding for C2 configuration acquisition.<br/><br/><a href="https://discourse.ifin.network/t/luajit-loader-uses-prometheus-obfuscation-and-etherhiding/679">https://discourse.ifin.network/t/luajit-loader-uses-prometheus-obfuscation-and-etherhiding/679</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-07-23T17:30:28Z https://njump.me/nevent1qqsr5rnx2y3j7z9dvp4fevshpk8f3tc66cl4mxvuk79sjwewfvvju9qzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjs826fj The critical SharePoint vulnerability CVE-2026-50522 now appears to be under massive exploitation. We have context and current IOCs in this post. We&#39;ve also updated the MISP feed with the same.<br/><br/>#ThreatIntel #ThreatIntelligence #IFIN<br/><br/><a href="https://discourse.ifin.network/t/microsoft-sharepoint-cve-2026-50522/678">https://discourse.ifin.network/t/microsoft-sharepoint-cve-2026-50522/678</a> 2026-07-23T15:24:49Z https://njump.me/nevent1qqstwu3m95chwz33535229skdft9744hjvpnfczxvjkk9p2ydvnmz0szyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjy9q3g0 With confirmed exploit sources, we&#39;ve now added this one to our MISP feed.<br/><br/><a href="https://discourse.ifin.network/t/microsoft-sharepoint-cve-2026-50522/678/2">https://discourse.ifin.network/t/microsoft-sharepoint-cve-2026-50522/678/2</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-07-22T20:55:12Z https://njump.me/nevent1qqs27up58yt88tqls23tkgwaa3edlr03lfyl4yqtqw8wljz4dc3lqvgzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjzr53el If you pirate games, you should expect malware. That&#39;s a tale as old as 1970-01-01T00:00:00.000Z. But using Etherhiding as the second stage source? Well that&#39;s slightly newer.<br/><br/>In case you couldn&#39;t tell, we&#39;re declaring war on #Etherhiding. More to come.<br/><br/><a href="https://discourse.ifin.network/t/pirated-games-come-with-a-side-of-amatera-stealer/675">https://discourse.ifin.network/t/pirated-games-come-with-a-side-of-amatera-stealer/675</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-07-20T16:16:35Z https://njump.me/nevent1qqsghuues3mvhgzkc0axaf5hr70r2ezrd2qq3alyjes8s9xwxx4939qzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjjulah6 <br/><br/>This has been confirmed exploited in the wild. Updated with IoCS.<br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqj3e0d94079vq92dkd5k5ds8qzwcm45tela4962w66d6dn6dl92dqyqah3u" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…ah3u</a></span> </div> Apparently (?) there's a Pre-Auth RCE (!) in core WordPress (?!), but there are extremely few details as yet.<br/><br/>If it's as gnarly as it sounds, a lot of sites are going to have a very bad time. We'll keep this story updated as details emerge.<br/><br/><a href="https://discourse.ifin.network/t/wp2shell-pre-auth-rce-in-wordpress-no-cve/672">https://discourse.ifin.network/t/wp2shell-pre-auth-rce-in-wordpress-no-cve/672</a> </blockquote> 2026-07-18T15:21:50Z https://njump.me/nevent1qqsfguhkj6hlzkqz4xmx6t2xcrsp8vd669ul76ja98ddxaxeaxlj4xszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkju9h079 Apparently (?) there&#39;s a Pre-Auth RCE (!) in core WordPress (?!), but there are extremely few details as yet.<br/><br/>If it&#39;s as gnarly as it sounds, a lot of sites are going to have a very bad time. We&#39;ll keep this story updated as details emerge.<br/><br/><a href="https://discourse.ifin.network/t/wp2shell-pre-auth-rce-in-wordpress-no-cve/672">https://discourse.ifin.network/t/wp2shell-pre-auth-rce-in-wordpress-no-cve/672</a> 2026-07-18T12:56:31Z https://njump.me/nevent1qqs97w2ek689e2y4q6xrenmde0793xvqyhdvytcr6a2p7vu9f88jq3gzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjmhszg3 Cursor will run anything called git.exe when you open it, but it isn&#39;t the only one. As a fork of VS Code, Cursor has inherited this behavior from its questionable parentage.<br/><br/><a href="https://discourse.ifin.network/t/remember-that-cursor-git-exe-bug-its-in-vscode-too/665">https://discourse.ifin.network/t/remember-that-cursor-git-exe-bug-its-in-vscode-too/665</a> 2026-07-15T20:20:47Z https://njump.me/nevent1qqszv0m207u07g858z9vmw2flsrc2hahg8c02m0l9llcsj6lgnvfekszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjgu6ufk The latest supply chain attack has some novelty, but the techniques should have long been mitigated in your network. IPFS, cryptocurrency, and Nostr have no place in a professional network.<br/><br/><a href="https://discourse.ifin.network/t/latest-miasma-attack-uses-blockchain-garbage-you-should-have-already-blocked/663">https://discourse.ifin.network/t/latest-miasma-attack-uses-blockchain-garbage-you-should-have-already-blocked/663</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-07-14T22:34:28Z https://njump.me/nevent1qqsz8v3j6nfm4e5jwddhh6ev9kmtw9ntk9yueusxqcmmc276c5lks9czyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj9rv96q Are you using jscrambler to obfuscate your JS code?<br/><br/>Forget scrambling—depending on version, you might be cooked a different way.<br/><br/><a href="https://discourse.ifin.network/t/popular-js-obfuscator-jscrambler-compromised/657">https://discourse.ifin.network/t/popular-js-obfuscator-jscrambler-compromised/657</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-07-12T13:07:29Z https://njump.me/nevent1qqsyudk36tew6pwvawylcjuf0pqvxvvf4th9amn2pvqgtqjfsa9wz0qzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjdqwa6z We need to talk about AWS S3 abuse and anti-patterns. Loose association between brands and buckets leads to easy prey for spoofers and squatters.<br/><br/><a href="https://ifin-intel.org/blog/s3-anti-pattern/">https://ifin-intel.org/blog/s3-anti-pattern/</a> 2026-07-09T20:05:46Z https://njump.me/nevent1qqs2k0e2cxjzya5meamawn8nq05zn9qxvunkndu8vqlesc2qnjcncqgzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjn2c4zy Terry Pratchett said: &#34;If you show a clown a ladder and bucket of water, he only knows one way to act.&#34;<br/><br/>The same applies to LLMs and secrets in CI/CD pipelines.<br/><br/><a href="https://discourse.ifin.network/t/gitlost-prompt-injection-in-github-agentic-workflows/647">https://discourse.ifin.network/t/gitlost-prompt-injection-in-github-agentic-workflows/647</a> 2026-07-08T15:43:42Z https://njump.me/nevent1qqs0lq2kva6kqew70cl9ydcf88yd64xns7zrcs56naxdf2xnpr0e60czyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjhhz06d Soooo Tenda devices have an admin backdoor. Potential redeployment locations: a wood chipper, the nearest active volcano, or that really annoying neighbor&#39;s house.<br/><br/>No patch; have fun!<br/><br/><a href="https://discourse.ifin.network/t/cve-2026-13753-multiple-tenda-routers-have-an-admin-backdoor/646">https://discourse.ifin.network/t/cve-2026-13753-multiple-tenda-routers-have-an-admin-backdoor/646</a> 2026-07-07T18:30:29Z https://njump.me/nevent1qqsqjmj4q547zrtx3gzj0mc4ufenghymzsu68fnd2qaed6sqdfaav7qzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjgv780u Device Code authorization in OAuth 2.0 was intended for input-constrained devices like Smart TVs. It probably shouldn&#39;t be used for anything else, especially since attackers are using it effectively for phishing.<br/><br/><a href="https://discourse.ifin.network/t/the-dangers-of-device-code-flow/642">https://discourse.ifin.network/t/the-dangers-of-device-code-flow/642</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-07-06T16:14:45Z https://njump.me/nevent1qqst294thtkwlvarrsfzna5rjvfjjl0vq69mf0hqy3cfzp8hk9xpx3qzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjzfl2hh We&#39;re shocked, shocked I say that Claude Cowork is vulnerable to DLL sideloading.<br/><br/>Well, not that shocked.<br/><br/><a href="https://discourse.ifin.network/t/claude-cowork-for-windows-vulnerable-to-dll-sideloading-closed-as-wont-fix/640">https://discourse.ifin.network/t/claude-cowork-for-windows-vulnerable-to-dll-sideloading-closed-as-wont-fix/640</a> 2026-07-02T19:24:44Z https://njump.me/nevent1qqswy8ustaxqhaumlq85cpfwzt4aq6tqj0se2yt298v6yjumye4lhxqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjf84wrf An IFIN community member caught this #ClickFix campaign, followed it, reversed the payload, and brought the IOCs. This is the juice right here. A perfect example that #ThreatIntelIsMutualAid<br/><br/><a href="https://discourse.ifin.network/t/compromised-website-hosting-clickfix-payload-leads-to-netsupport-rat-infection/633">https://discourse.ifin.network/t/compromised-website-hosting-clickfix-payload-leads-to-netsupport-rat-infection/633</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-07-01T16:14:25Z https://njump.me/nevent1qqsvxefhrjh4n2m55s0jgtmy0apd5gdwt74yyg2amcqmshn2tegnwgqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjvzt4yn If you&#39;re running a SimpleHelp server, it&#39;s patch-o&#39;clock. Also maybe incident-response-o&#39;clock. <br/><br/>(It&#39;s always incident-response-o&#39;clock somewhere)<br/><br/><a href="https://discourse.ifin.network/t/stealers-exploit-cve-2026-in-simplehelp-attack/629">https://discourse.ifin.network/t/stealers-exploit-cve-2026-in-simplehelp-attack/629</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-06-30T18:50:28Z https://njump.me/nevent1qqsyd0jdtnxh5yt3e9lzl05mzg4c8m5kezctp4wl8062tenc527q66czyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj8tswsk Maaaaybe just block the whole dot garden top-level domain. <br/><br/><a href="https://discourse.ifin.network/t/garden-tlds-change-to-a-bad-neighborhood/627">https://discourse.ifin.network/t/garden-tlds-change-to-a-bad-neighborhood/627</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-06-29T17:15:11Z https://njump.me/nevent1qqs0h860k6xufqud6k53lqncchvjldc8df2y8tl3use09n9w57u2fmczyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjrjps9y If you&#39;re running Lantronix gear on the internet, you might want to check your logs for suspicious logins and command execution.<br/><br/><a href="https://discourse.ifin.network/t/lantronix-openwrt-luci-attacks/625">https://discourse.ifin.network/t/lantronix-openwrt-luci-attacks/625</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-06-26T19:16:40Z https://njump.me/nevent1qqspjr2nfyswc5mgs5ylpftqgcd4tx3ktgzwch6cewspx9lz0gupenszyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjmfxzeq Another Mini Shai-Hulud-like attack. Again using Bun, but this one also installs persistence to AI coding assistant configs. <br/><br/>If you&#39;re not a JS dev shop, maybe block Bun? The attackers will move on, but for now it&#39;s a favorite.<br/><br/><a href="https://discourse.ifin.network/t/mini-shai-hulud-hits-codfish-semantic-release/620">https://discourse.ifin.network/t/mini-shai-hulud-hits-codfish-semantic-release/620</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-06-24T18:55:16Z https://njump.me/nevent1qqsyay5vpq828ps206k9xz5kqfn3mdwmna7cenyhhmz2sdtmcvrgx2czyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjrctymu We&#39;re excited to introduce IFIN&#39;s first open source project! RSS-Filter solves a problem we suspect is common: our RSS feeds were full of noise. Sponcon, unrelated stories, etc. While some services exist to filter feeds by title, we had none that could filter by category or other criteria. RSS-Filter fixes that.<br/><br/><a href="https://codeberg.org/ifin/rss-filter">https://codeberg.org/ifin/rss-filter</a><br/><br/>This tool allows you to configure a set of feed sources and filter rules. It will produce filtered feeds that can be hosted by any web server, or simply consumed as local files.<br/><br/>We&#39;re using RSS-Filter today to get sponcon out of BleepingComputer and a few other feeds. We hope you find it useful! 2026-06-24T13:02:54Z https://njump.me/nevent1qqszzfan2purr4alul3nku2crnpcqs344mcg0g84a0tw2wsyxp3tdfczyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjj8dtfl A thousand blessings upon Dirk-Jan and Fabian for this post about CAP bypasses in Entra, and the EntraScopes lookup tool.<br/><br/><a href="https://discourse.ifin.network/t/entra-patched-cap-bypasses-but-you-might-have-to-opt-in/612">https://discourse.ifin.network/t/entra-patched-cap-bypasses-but-you-might-have-to-opt-in/612</a> 2026-06-22T19:02:16Z https://njump.me/nevent1qqsp9jhllznm4td2yq7mnfe07lxgk9s7wrqs309j5vhl29sscjrh0vqzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjpha9gd Let&#39;s talk about ClickFix.<br/><br/><a href="https://discourse.ifin.network/t/lets-talk-about-clickfix/603/1">https://discourse.ifin.network/t/lets-talk-about-clickfix/603/1</a> 2026-06-20T13:22:51Z https://njump.me/nevent1qqsxl83x4eqv67xnfq5jvts5t2ndwrnju9lpykqkyrlm8ts7352tewgzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjr6z860 <br/><br/>We&#39;ve updated our post with the latest information from CloudSek and, of course, <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq7lgy0rj5a2nwpnyc4hup6ufpfz7wz6dzcgd3crm6fm2yd34dcz0q4lg4vn" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq7lgy0rj5a2nwpnyc4hup6ufpfz7wz6dzcgd3crm6fm2yd34dcz0q4lg4vn</span> (<span class="italic">nprofile…g4vn</span>)</a></span>.<br/><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/nevent1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqzgxpkfmzw7hvynq675rgkp6fwp7rluzvpmd9xl2jgw0h5rhfrngsqpevy9" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">nevent1q…evy9</a></span> </div> Fortinet customers: please take note of this massive breach of SSL VPN credentials. The scale of attacker infrastructure and list of impacted organizations commands attention.<br/><br/><a href="https://discourse.ifin.network/t/fortibleed-tens-of-thousands-of-fortinet-credentials-leaked/597">https://discourse.ifin.network/t/fortibleed-tens-of-thousands-of-fortinet-credentials-leaked/597</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN </blockquote> 2026-06-19T22:10:13Z https://njump.me/nevent1qqs8h5lrdx5mw2uj62hxa6a2hsxlaxtmcfzv3ss5gc82zn7y9nd95lgzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj3y3hsn Trusted sites are favorites for the baddies as command-and-control and exfiltration destinations, because they think you can&#39;t block them or observe them. That&#39;s exactly what this attack expects.<br/><br/>But not all &#34;trusted&#34; sites should be, and there are ways to monitor traffic to confound the adversary.<br/><br/><a href="https://discourse.ifin.network/t/ai-lures-in-malvertising-utilizing-lots-and-share-urls-to-deliver-clickfix-attacks/600">https://discourse.ifin.network/t/ai-lures-in-malvertising-utilizing-lots-and-share-urls-to-deliver-clickfix-attacks/600</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-06-18T16:54:53Z https://njump.me/nevent1qqsfkwdkn9gp7fdp4sh92t325xejl37c0ug73wett9mmavs7x26hpeczyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkj4g3khg Etherhiding is so hot right now. When your malware sample contains blockchain artifacts, learn how to pivot on them and get all the indicators from the campaign.<br/><br/><a href="https://ifin-intel.org/blog/etherhiding/">https://ifin-intel.org/blog/etherhiding/</a> 2026-06-17T21:26:55Z https://njump.me/nevent1qqspyrqmya380tkzfsd02p5tqayhqlpl7pxqakjn04fy88m6pm53e5gzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjy9f837 Fortinet customers: please take note of this massive breach of SSL VPN credentials. The scale of attacker infrastructure and list of impacted organizations commands attention.<br/><br/><a href="https://discourse.ifin.network/t/fortibleed-tens-of-thousands-of-fortinet-credentials-leaked/597">https://discourse.ifin.network/t/fortibleed-tens-of-thousands-of-fortinet-credentials-leaked/597</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-06-17T13:29:10Z https://njump.me/nevent1qqsz90dd600dxznldvu6q6lscnrauucvgd3rwraeuahzxgfsx5cl6vgzyrg0yegpf2mvu2uyrs573nk6nk7qfdz7gah87rwphn2r49ykj0rkjwrhyel This report from GTIG is worth a moment&#39;s consideration. Research institutions with public-facing assets should take this opportunity to harden their external posture.<br/><br/><a href="https://discourse.ifin.network/t/google-china-based-espionage-targeting-redcap-servers/595">https://discourse.ifin.network/t/google-china-based-espionage-targeting-redcap-servers/595</a><br/><br/>#ThreatInte #ThreatIntelligence #IFIN 2026-06-16T20:22:27Z