Edition 22
Chainalysis: every user's tokens, please reset
Plus unauthenticated RCEs in Apache OFBiz, an APT package-swap bug, and DreamHost's two-month breach.
It’s Probably
Nothing.
An automated experimental daily cybersecurity briefing from Sierra Echo Charlie.
Latest edition
Chainalysis: every user's tokens, please reset
Today's a credentials-and-supply-chain sort of day. Chainalysis has quietly upgraded its October incident from "no evidence credentials were accessed" to "hashes and live tokens for everyone", Apache OFBiz dropped a batch of pre-auth RCEs, and there's a genuinely nasty bug in APT's download retry path. Also: the mode ChatGPT sells as its anti-exfiltration control had a popup-shaped hole in it.
Get it daily.
Read it. Listen to it. Have it delivered.
All editions
The archive.
Edition 21
Your WordPress site is most hackable while updating it
Plus: cPGuard's own update channel shipped a backdoor, and APT29's mobile watering holes get an autopsy.
Edition 20
The fridge hackers went on a European tour
Supermarket freezers hit in four more countries, the FBI names North Korea for Binance, and malware that talks back to AI.
Edition 19
Fake nuclear alerts, on both sides of the war
Emergency apps hijacked in Ukraine and Russia, Amadeus notifies airlines, and BITTER’s PapRAT goes LOLBin.
Edition 18
Six billion out the door at Binance
A record crypto heist, plus confirmed exploitation of GitLab's regex RCE and the full Ivanti chain.
Edition 17
Cisco’s VPN flaw can restart the firewall
Plus PHP2Shell’s kernel-level follow-up and two distinct Juniper compromise paths.
Edition 16
Brotli joins the known-exploited list
Adobe’s upload flaw has a crucial caveat; NT Health pauses its observer programme.
Edition 15
Real booking details make a better payment scam
Plus PHP2Shell’s KEV escalation, a Consul namespace bypass and casino crypto flows.
Edition 14
A compaction detour around OpenAI’s safeguards
Xint’s safeguard bypass, Anthropic’s proposed IPO, and Australian breach numbers worth reading carefully.
Edition 13
LiteLLM could run without being imported
Brotli's wider reach, VeloCloud triage and new research into AI containment failures.
Edition 12
Special edition: CVE-2926-109618 (Update #5)
Exploit claims widen; NetScaler fixes are pending and a compromise account needs qualification
Edition 11
Special edition: CVE-2926-109618 (Update #4)
Sophos retracts its compromise report; PHP adds separate, narrowly scoped guidance
Edition 10
Special edition: CVE-2926-109618 (Update #3)
A reported compromise and a pre-disclosure attempt broaden the investigation window
Edition 09
eMudhra plans its TLS exit. One private key was 4.
GitLab and Node.js fixes, ConnectWise attribution, and a New Zealand breach disclosure.
Edition 08
Special edition: CVE-2926-109618 (Update #2)
PHP fixes are out; exploitation attempts are reported, and FPM isn't exempt
Edition 07
Special edition: Leaked PHP RCE bugs bring fixes forward to 03:00 NZDT Thursday
Two embargoed PHP flaws leaked early; patches due 14:00 UTC Wednesday, details still under wraps
Edition 06
Leaked CA keys, a hijacked backup tool and open AI panels
Go wants a rebuild, AOMEI hasn't told anyone, and AI-agent crims forgot to lock the door.
Edition 05
Ransom negotiators, NetScaler keys and a DeepSeek ban
Who's really across the table, why patching NetScaler isn't eviction, and a hypervisor-level heist.
Edition 04
One vendor credential, hundreds of M365 tenants
Plus an espionage zero-day in BeyondTrust, root-by-email on Cisco gateways, and a poisoned WordPress plugin.
Edition 03
Record Patch Tuesday, a phishing takedown, and laptop farms
An exploited Mark-of-the-Web bypass, 1bn+ scam messages' worth of domains seized, and Texas raids.
Edition 02
Ivanti chain gets root on patched VPNs; fridge alert grows
CERT-FR adds Copeland and Dixell kit, Ledger explains its LTE implant, and LiteLLM gets a fix.
Edition 01
Hacked supermarket fridges hit 50°C in France
Plus Ahold Delhaize pulls systems offline, and Albert Heijn's app and deliveries go dark