Category: SANS Internet Storm Center, InfoCON: green

TeamPCP Supply Chain Campaign: Update 008 – 26-Day Pause Ends with Three Concurrent Compromises (Checkmarx KICS, Bitwarden CLI Cascade, xinference PyPI), CanisterSprawl npm Worm Identified, and Tier 1 Coverage Returns, (Mon, Apr 27th)

This update succeeds TeamPCP Supply Chain Campaign Update 007, published April 8, 2026, which left the campaign in credential-monetization mode following the Cisco source code theft via Trivy-linked credentials, Google GTIG's formal designation of the operators as UNC6780 (with their credential…

Read more →

Apple Patches Exploited Notification Flaw, (Thu, Apr 23rd)

Apple yesterday released iOS/iPadOS 26.4.2 and iOS/iPadOS 18.7.8. This update fixes a single Notification Services vulnerability, CVE-2026-28950: This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Apple Patches Exploited Notification Flaw, (Thu, Apr…

Read more →

A .WAV With A Payload, (Tue, Apr 21st)

There have been reports of threat actors using a .wav file as a vector for malware. This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: A .WAV With A Payload, (Tue, Apr 21st)

Read more →

Handling the CVE Flood With EPSS, (Mon, Apr 20th)

Every morning, security people around the world face the same ritual: opening their vulnerability feed to find a lot of new CVE entries that appeared overnight. Over the past decade, this flood has become a defining challenge of modern defensive…

Read more →

Scanning for AI Models, (Tue, Apr 14th)

Starting March 10, 2026, my DShield sensor started getting probe for various AI models such as claude, openclaw, huggingface, etc. Reviewing the data already reported by other DShield sensors to ISC, the DShield database shows reporting of these probes started…

Read more →

Microsoft Patch Tuesday April 2026., (Tue, Apr 14th)

This month's Microsoft Patch Tuesday looks like a record one, but let's look at it a bit closer to understand what is happening This article has been indexed from SANS Internet Storm Center, InfoCON: green Read the original article: Microsoft…

Read more →

Scans for EncystPHP Webshell, (Mon, Apr 13th)

Last week, I wrote about attackers scanning for various webshells, hoping to find some that do not require authentication or others that use well-known credentials. But some attackers are paying attention and are deploying webshells with more difficult-to-guess credentials. Today,…

Read more →