Security news and analysis, without the fear.https://decipher.sc/https://decipher.sc/2026/10/27/hive-nefilim-ransomware-affiliate-sentenced-to-70-months-in-jail/https://decipher.sc/?p=1245A 36-year-old Ukrainian national who acted as a Nefilim and Hive ransomware affiliate and targeted hospitals and government entities has been sentenced to 70 months in prison. Tue, 27 Oct 2026 21:42:00 GMTIntrusionshttps://decipher.sc/2026/10/27/no-major-php2shell-exploits-seen/https://decipher.sc/2026/10/27/no-major-php2shell-exploits-seen/There has been little exploit activity targeting the two critical PHP vulnerabilities disclosed last week.Tue, 27 Oct 2026 20:44:00 GMThttps://decipher.sc/2026/10/20/critical-php-flaws-disclosed-patches-out-now/https://decipher.sc/?p=1224The two flaws are CVE-2026-109618 and CVE-2026-109619 and are said to affect PHP versions 5, 6, 7, and 8.Tue, 20 Oct 2026 19:34:12 GMTVulnerabilitieshttps://decipher.sc/2026/10/18/ongoing-microsoft-365-campaign-abuses-connectwise-app/https://decipher.sc/?p=1220Threat actors have compromised a credential within the vendor’s infrastructure, allowing them to abuse a client assertion that bypasses traditional user authentication.Sun, 18 Oct 2026 15:59:29 GMTIntrusionsMicrosofthttps://decipher.sc/2026/10/15/the-odyssey-and-infosec-how-we-got-from-zeuss-law-to-zero-trust/https://decipher.sc/?p=1214Nolan casts the invention of the Trojan horse as the ultimate violation of “Zeus’s law,” the idea that you should treat any stranger you encounter with kindness and respect, because they could very well be Zeus in disguise.Thu, 15 Oct 2026 12:31:14 GMTMalwarehttps://decipher.sc/2026/10/13/ivanti-patches-connect-secure-zero-day-exploited-in-attacks/https://decipher.sc/?p=1208Ivanti warns of active exploitation of CVE-2026-104935, a high-severity Connect Secure flaw.Tue, 13 Oct 2026 21:52:35 GMTVulnerabilitieshttps://decipher.sc/2026/10/07/healthcare-cybersecurity-has-a-problem-this-bill-wants-to-fix-it/https://decipher.sc/?p=1199Two years after the largest healthcare cybersecurity incident in history, the senate has passed The Health Care Cybersecurity and Resiliency Act of 2025.Thu, 08 Oct 2026 00:26:00 GMTIntrusionshttps://decipher.sc/2026/10/07/patching-faster-has-never-been-the-answer/https://decipher.sc/?p=1194Patching is a necessary evil and doing it manually in any decent sized organization was essentially impossible in the pre-AI times and is now pure folly.Wed, 07 Oct 2026 15:30:03 GMTAIVulnerabilitieshttps://decipher.sc/2026/10/06/fbi-warns-of-fortibleed-attacks-leading-to-lockouts-ransomware/https://decipher.sc/?p=1192FortiBleed attacks are continuing, with the FBI and Secret Service warning of compromised Fortinet firewalls, account lockouts and potential ransomware activity.Tue, 06 Oct 2026 23:27:08 GMTIntrusionshttps://decipher.sc/2026/10/06/ai-may-be-the-future-but-talent-is-what-builds-security/https://decipher.sc/?p=1188While AI is reshaping the threat landscape, the people defending against those threats remain vital.Tue, 06 Oct 2026 15:44:31 GMTAIGovernmenthttps://decipher.sc/2026/10/06/catch-me-if-you-can-is-the-social-engineeers-playbook/https://decipher.sc/?p=1185The reality is that a lot of what hackers actually do is just social engineering in one form or another.Tue, 06 Oct 2026 10:19:02 GMThttps://decipher.sc/2026/10/03/new-citrix-netscaler-issue-emerges/https://decipher.sc/?p=1179The vendor says this is a configuration-dependent issue rather than a failure of the security patches themselves.Sat, 03 Oct 2026 17:29:03 GMTVulnerabilitieshttps://decipher.sc/2026/10/01/cisco-warns-of-critical-exploited-catalyst-sd-wan-manager-flaw/https://decipher.sc/?p=1173Cisco “strongly recommends” customers apply a patch for a critical API authentication bypass that’s being exploited.Thu, 01 Oct 2026 13:13:44 GMTVulnerabilitieshttps://decipher.sc/2026/09/29/inside-the-citrix-netscaler-zero-day-saga/https://decipher.sc/?p=1170This case is yet another reminder just how important vendor communication is in such incidents and how much uncertainty can hamper security.Tue, 29 Sep 2026 14:55:40 GMTMalwareVulnerabilitieshttps://decipher.sc/2026/09/27/researchers-warn-of-citrix-netscaler-exploitation/https://decipher.sc/?p=1152On Saturday, researchers from watchTowr Labs said they had credible information that attackers were exploiting an unknown RCE vulnerability in Citrix NetScaler boxes.Sun, 27 Sep 2026 14:05:55 GMTVulnerabilitieshttps://decipher.sc/2026/09/24/f5-cve-2026-94127-taregted-in-active-attacks/https://decipher.sc/?p=1148This vulnerability allows for unauthenticated remote code execution and shows how a missing bounds check—a classic programming error.Thu, 24 Sep 2026 19:02:56 GMTVulnerabilitieshttps://decipher.sc/2026/09/22/researchers-find-windows-malware-sample-with-autonomous-c2-functionality/https://decipher.sc/?p=1140Cisco Talos researchers identified ClosedQuorum, a Windows implant that uses multiple LLMs to autonomously select attack actions. The catch: there’s no confirmation that it’s actually been deployed in the wild.Tue, 22 Sep 2026 23:26:19 GMTAIMalwarehttps://decipher.sc/2026/09/21/fake-lastpass-authenticator-pages-deliver-rapuncel-infostealer/https://decipher.sc/?p=1134Attackers impersonated LastPass Authenticator on fake GitHub pages to deliver the Rapuncel infostealer in a campaign involving 40 fake brands.Tue, 22 Sep 2026 00:57:38 GMTMalwarehttps://decipher.sc/2026/09/21/we-have-enough-ai-realism-in-a-time-of-relentless-hype/https://decipher.sc/?p=1131Let’s ask a simple question that seems to be getting lost in all of the credulous fervor around AI: How’s this working out for everyone?Mon, 21 Sep 2026 15:48:03 GMTAIhttps://decipher.sc/2026/09/17/new-sparrowocky-backdoor-targets-latin-america/https://decipher.sc/?p=1123Active since at least August 2025, the malware represents a functional pivot from the threat actor’s existing SparrowDoor backdoor.Thu, 17 Sep 2026 10:00:00 GMTGeneralhttps://decipher.sc/2026/09/16/us-uk-agencies-detail-iranian-malware-campaign-targeting-dissidents/https://decipher.sc/?p=1126A new joint advisory from multiple law enforcement agencies this week warned of an Iranian cyber campaign targeting dissidents and journalists in the U.S., UK, and elsewhere.Thu, 17 Sep 2026 00:37:50 GMTGovernmentLaw Enforcementhttps://decipher.sc/2026/09/14/here-come-the-ai-generated-bec-scams/https://decipher.sc/?p=1117Messages delivered through legitimate third-party email infrastructure had C-suite sender display names, custom signatures, and direct approval notes.Mon, 14 Sep 2026 13:12:44 GMTAIMicrosofthttps://decipher.sc/2026/09/08/russian-national-extradited-to-us-to-face-bank-account-takeover-charges/https://decipher.sc/?p=1108A Russian web developer allegedly behind a massive bank account takeover scheme was extradited to the U.S.Wed, 09 Sep 2026 00:09:48 GMTLaw Enforcementhttps://decipher.sc/2026/09/06/microtik-routers-under-attack-in-new-campaign/https://decipher.sc/?p=1102Labeled “MikroTrick” by researchers at CERT Polska who discovered and disclosed six vulnerabilities in the software,  the campaign targets devices with SSH services reachable from the public internetSun, 06 Sep 2026 20:37:40 GMTVulnerabilitieshttps://decipher.sc/2026/09/03/new-campaign-weaponizes-microsoft-teams-for-remote-access/https://decipher.sc/?p=1096Unlike standard commodity malware that aims for quick credential theft, this campaign features a manual, hands-on-keyboard scheme designed to escalate rapidly from a single compromised workstation to broad, network-wide access.Thu, 03 Sep 2026 15:46:43 GMTIntrusionsMicrosofthttps://decipher.sc/2026/09/02/one-year-of-decipher-relaunched/https://decipher.sc/?p=1085It’s been one year since we relaunched Decipher in September 2025. Here are the videos, podcasts, and articles that best reflect our mission statement: Security without fear.Wed, 02 Sep 2026 13:25:26 GMTAIGeneralGovernmenthttps://decipher.sc/2026/09/01/critical-artifactory-bug-under-attack/https://decipher.sc/?p=1081CVE-2026-82329 is a simple authentication bypass that can allow an attacker to get admin privileges quite easilyTue, 01 Sep 2026 13:39:21 GMTVulnerabilitieshttps://decipher.sc/2026/08/25/linux-foundation-backs-new-trace-ai-security-standard/https://decipher.sc/?p=1071TRACE aims to help prove that sensitive data in organizations is being handled “according to policy” by AI agents and open weight models.Wed, 26 Aug 2026 01:17:39 GMTAIGovernmentOpen Source Software Securityhttps://decipher.sc/2026/08/25/unauthenticated-rce-chain-found-for-microsoft-sharepoint-cve-2026-55040-and-cve-2026-63520/https://decipher.sc/?p=1068The chain leverages two distinct vulnerabilities—an authentication bypass and an unsafe .NET type instantiation flaw—to provide full server control without valid credentials.Tue, 25 Aug 2026 15:49:58 GMTMicrosofthttps://decipher.sc/2026/08/20/inside-exploitgym-how-researchers-are-measuring-ai-agent-exploitation-capabilities/https://decipher.sc/?p=1051A research collaboration, directed by UC Berkeley, led to the development of ExploitGym, a large-scale benchmark for measuring AI agents’ abilities to develop exploits. Here’s the story of how ExploitGym came to be.Thu, 20 Aug 2026 23:35:28 GMTAIhttps://decipher.sc/2026/08/18/mlflow-bug-actively-exploited-to-steal-credentials/https://decipher.sc/?p=1046This flaw allows remote, unauthenticated attackers to read sensitive data from internal network services or cloud metadata endpoints.Tue, 18 Aug 2026 13:58:31 GMTAIVulnerabilitieshttps://decipher.sc/2026/08/15/researchers-find-persistent-backdoor-in-zbtlink-routers/https://decipher.sc/?p=1036The vulnerability, named EndlessDoors, affects more than 20 specific models of networking hardware sold globally under both the Zbtlink and Wiflyer brand names.Sat, 15 Aug 2026 20:04:22 GMThttps://decipher.sc/2026/08/05/openai-anthropic-ai-agents-performed-unsanctioned-actions-during-cyber-tests/https://decipher.sc/?p=1042OpenAI and Anthropic models made “unsanctioned” actions during tests by the AI Security Institute. Here’s what we know.Wed, 05 Aug 2026 13:42:15 GMTAIIntrusionshttps://decipher.sc/2026/08/03/exploits-target-n-able-cve-2026-18577-flaw/https://decipher.sc/?p=1034The vulnerability, which effectively provides unauthenticated administrative access to the RMM console, stems from two related security issuesMon, 03 Aug 2026 19:56:05 GMTVulnerabilitieshttps://decipher.sc/2026/07/29/openai-hugging-face-breach-five-new-things-we-learned/https://decipher.sc/?p=1029New details emerged this week about an intrusion by OpenAI models on Hugging Face’s infrastructure.Wed, 29 Jul 2026 11:16:05 GMTAIIntrusionshttps://decipher.sc/2026/07/23/your-llm-is-showing-new-data-finds-sharp-rise-in-exposed-ai-tools/https://decipher.sc/?p=1023Exposures of AI/LLM tools has risen by more than 60 percent over the last nine months.Thu, 23 Jul 2026 12:06:50 GMTAIVulnerabilitieshttps://decipher.sc/2026/07/21/critical-sharepoint-bug-under-attack/https://decipher.sc/?p=1021The flaw (CVE-2026-50522) affects SharePoint Enterprise Server 2016 and 2019 as well as SharePoint Subscription service. Microsoft released the fix for this vulnerability on July 14.Tue, 21 Jul 2026 14:43:50 GMTMicrosoftVulnerabilitieshttps://decipher.sc/2026/07/17/the-joy-and-pain-of-ot-cybersecurity-a-conversation-with-lesley-carhart/https://decipher.sc/?p=1012Lesley Carhart has been cleaning up malware, intrusions, ransomware, and other messes in OT networks for the better part of two decades and recently joined Dennis Fisher on the Decipher podcast to talk about the special challenges OT networks presentFri, 17 Jul 2026 12:33:27 GMTIntrusionshttps://decipher.sc/2026/07/15/bug-in-cursor-allows-simple-rce/https://decipher.sc/?p=1008This exploit occurs entirely in the background, requiring no user approval, dialogue prompts, or interaction.Wed, 15 Jul 2026 19:26:24 GMTAIVulnerabilitieshttps://decipher.sc/2026/07/14/unsealed-doj-indictment-targets-bulletproof-hosting-services/https://decipher.sc/?p=1001Media Land and ML.Cloud offer bulletproof hosting services that help keep threat actors and their infrastructure hidden from law enforcement.Wed, 15 Jul 2026 01:35:08 GMTGovernmentLaw Enforcementhttps://decipher.sc/2026/07/13/us-sanctions-first-vpn-cybercriminal-service/https://decipher.sc/?p=999First VPN has been active for more than a decade and is specifically designed for ransomware operators, fraud groups, and other cybercriminals trying to hide malicious activity from law enforcement.Tue, 14 Jul 2026 01:02:28 GMTGovernmentLaw Enforcementhttps://decipher.sc/2026/07/09/new-forg365-phaas-kit-emerges/https://decipher.sc/?p=992Like EvilTokens and Kali365, Forg365 is distributed through Telegram and offered as a commoditized service for attackers who want to target Microsoft 365 environments.Fri, 10 Jul 2026 01:29:39 GMTAIMicrosofthttps://decipher.sc/2026/07/08/researchers-find-new-ghostapproval-bug-in-many-ai-coding-assistants/https://decipher.sc/?p=988The bug is a modern twist on a Clinton-era piece of known Unix badness: following symbolic links.Wed, 08 Jul 2026 14:08:07 GMTAIVulnerabilitieshttps://decipher.sc/2026/07/07/chinese-apt-uat-7810-expands-malware-arsenal/https://decipher.sc/?p=979The investigation into UAT-7810 shows significant evolution in their toolkit, specifically the development of a successor to their previously documented SHORTLEASH backdoor.Tue, 07 Jul 2026 14:27:50 GMTIntrusionshttps://decipher.sc/2026/07/01/doj-alleged-scattered-spider-member-extradited-to-us/https://decipher.sc/?p=97319-year-old Peter Stokes is one of several to be arrested for their alleged participation in Scattered Spider.Thu, 02 Jul 2026 01:31:29 GMTLaw Enforcementhttps://decipher.sc/2026/07/01/evils-is-as-evil-does-new-eviltokens-affiliate-panel-uncovered/https://decipher.sc/?p=968This new ARToken operator panel has a clear lineage going back to the EvilTokens framework, which emerged in early 2026.Wed, 01 Jul 2026 14:13:10 GMTIntrusionsMicrosofthttps://decipher.sc/2026/06/26/new-turla-stockstay-backdoor-emerges/https://decipher.sc/?p=962Known historically for its tight ties to Russia’s FSB and its development of the Snake implant, Turla has leveraged STOCKSTAY to target sensitive government and military organizations.Fri, 26 Jun 2026 14:43:32 GMTIntrusionshttps://decipher.sc/2026/06/25/targeting-cybercrime-assembly-lines-europol-announces-malware-crackdown/https://decipher.sc/?p=955As part of the takedown, SocGholish infrastructure tied to fake browser-update scams was heavily impacted, including remediation of nearly 15,000 compromised WordPress sites.Thu, 25 Jun 2026 12:37:15 GMTLaw Enforcementhttps://decipher.sc/2026/06/24/macos-gaslight-backdoor-weaponizes-prompt-injection-against-security-analysts/https://decipher.sc/?p=950Gaslight is a Rust-based backdoor that researchers from SentinelOne have attributed to DPRK-aligned threat actors.Wed, 24 Jun 2026 12:57:45 GMTAIApplehttps://decipher.sc/2026/06/18/fortibleed-credential-theft-campaign-marches-on/https://decipher.sc/?p=947The campaign is not the result of a compromise of Fortinet itself, but rather involves the attackers testing a custom list of known passwords for Fortinet devices.Thu, 18 Jun 2026 14:54:38 GMTIntrusions