GitHub disabled two compromised actions-cool Actions in May but never cleaned their release tags. When the repos came back on 16 September, every workflow still pinned to a mutable tag resumed stealing CI secrets on its own. Here is how to hunt the reopen window in KQL, Falcon CQL, Splunk and Kibana.

WSO2 fixed CVE-2026-5430 in May. In September, honeypots started catching forged admin JWTs. What the flaw allows, why patching does not end the question, and how to hunt the gap in KQL, Falcon CQL, Splunk and Kibana.

A pre-authentication stack overflow in Check Point's login path gives an unauthenticated attacker root on Security Management Server, Multi-Domain, and Log Server. What it means for policy and log trust, how to patch, and hunt queries you can run today.

Shimcache, Amcache, Prefetch, BAM and SRUM all get called evidence of execution. Only some earn the name. What each artifact proves, what it does not, and the four ways analysts reach the wrong conclusion.

Cisco ISE CVE-2026-76460 is on CISA KEV with a 19 September deadline, and the API it abuses never asked for an admin session. Patch the branch, then hunt the access logs for what arrived before you did: unauthenticated API calls, root, and credentials that moved.

ACTION BRIEF • WINDOWS ENDPOINTS If your organization uses Sogou Input Method for Windows, verify its version and investigate suspicious activity from before it was patched. A malicious link can exploit a vulnerable installation to deliver GRAYRABBIT, a backdoor that gives an attacker access in the signed-in user’s context. Your first three actions: identify affected devices, update the software, and check whether attackers used it before the update. Patching closes the repor

A software repository sits between the people who build software and the systems that run it. When that repository is compromised, the investigation needs to answer more than whether someone accessed a server. It needs to establish whether the company can still trust the identities, credentials, and artifacts passing through it. Recent Artifactory exploitation illustrates why. Two vulnerabilities allow an attacker to obtain a token and escalate its authority. A separate vulne

Hunt GitLab CVE-2026-85706: unauth commits API path traversal. POST /repository/commits with file.path. watchTowr ITW Sep 11. CISA KEV due Sep 14.

The process tree still sitting on the box is not a closed Chrome patch ticket. It is chrome.exe (or msedge.exe / brave.exe) spawning cmd.exe, which spawns curl.exe, which writes %TEMP%\msgbox.exe or %TEMP%\ChromeUpdate.exe and runs it. Proofpoint tracks that default BlueMoon breakout, and the follow-on loaders are what operators actually keep. A hot stable build does not rewrite a curl stub that already ran from the broker. This hunt shop is not a second CVSS recap, and it is

The traces still on the management plane are not a closed patch ticket. They are a Tomcat JSP named home.jsp that Base64-decodes F6C1F0E7, a package_info.pl line that runs /var/tmp/license.tmp --lsm as root, and a Python socks5.py reverse-SSH tunnel that forwards LDAP, Kerberos, SMB, and WinRM out of Secure Firewall Management Center into Active Directory. Cisco Secure Firewall Management Center centrally manages your Secure Firewall estate. CVE-2026-20079 is a critical authe

The leftover is not a failed checkout ticket. It is a process that looks like time sync, a cron line that restarts twice an hour, and a Payment Transaction Failed Reminder that already ran PHP while Magento rendered it. Nobody needed to open the message. Delivery can fail, and the planted code still executes. That is StyleSmuggler after the styles poison, not another Magento zero-day recap. Here is the plain version before the product jargon. An unauthenticated attacker poiso

The alert is wscript.exe, four short script names, and a Run key that looks like a Windows service helper. ScreenConnect is already on the box. Someone says helpdesk has a session. There is no ransomware family on the page, and the brand name on the client is the same one your techs use every day. That is when this chain wants you to call it a rogue RMM install and move on. Here is the plain version before the product jargon. A modified ScreenConnect client on one host watche

You know the ticket. Someone downloaded a video. The ticket says media. The player refuses to open it. Antivirus already shrugged and called it an MP4. There is no ransomware family name on the alert, and the user swears they never watched anything. That unfair case is when this chain wants you to close it and move on. Here is the plain version before the box jargon. The file is a fake video shell. It is stuffed with a script. It is not a clip you failed to open. It is a carr

Unit 42 published Spring Ring today, 31 August 2026. The activity in the report is from January through April. This is leftover tradecraft, not a weekend outbreak. If you are hunting it because the write-up is new, you are hunting a gap that has been sitting in Teams since winter. The gap is Chat with anyone plus a voice call that never hits the mail gateway. They are not phish-mailing IT. A throwaway .onmicrosoft.com tenant named like a helpdesk opens a Teams chat. Then a 10

You have seen this ticket. Print is still working. Someone applied the first emergency PaperCut patch when it dropped, the queue came back, and they closed it. The Application Server web UI is still on the internet because print admins do not like taking that box down twice in one week. That is the hunt. Not the CVE number. The hunt is the emergency patch that did not stay a patch. CISA put CVE-2026-81578 and CVE-2026-82078 on KEV on 31 August 2026. If you only ran Patch 1, y

Citrix NetScaler Gateway after a quiet nsppe crash. Hunt PHP under /var/vpn/theme. You have seen this ticket. VPN died, VPN came back, someone closed it as a blip. Citrix sold CVE-2026-8452 as a crash. CISA put it on KEV Monday. The federal clock is Saturday, 29 August. Builds with a fix: 13.1-63.21 or later, 14.1-73.32 or later. 12.1 and 13.0 have no fix. Patch is not the hunt. A patched box that already had a quiet respawn still needs the directory check. The hunt is not th

PhishLocker is a fake Windows lock screen. The password plus the tunnel is the prize. On 18 August, Expel caught SynkLoader off a scheduled-task EDR hit that started in Microsoft Teams and ended in a fake lock screen. The EDR alert was the first clean look at a loader nobody had published yet. File times and compile stamps ran back to about 28 July. They named it SynkLoader. No crew name came with it. How SynkLoader arrives in Microsoft Teams The user had already been talked

In the world of cloud security, things move fast. Sometimes, cracks in big systems like Microsoft's Entra ID show up in ways that make you double-check your own setup. Security researcher Dirkjan van der Bijl recently revealed a vulnerability that allows attackers to snag Global Admin rights in nearly any Entra ID tenant. This issue is tied to undocumented "Actor tokens" and a sloppy validation problem in the old Azure AD Graph API. If you're a security pro working with Micro

In the ever-evolving world of cybersecurity, new vulnerabilities can turn a seemingly secure setup into a hacker's playground. Just last month, on August 6, 2025, Microsoft documented CVE-2025-53786, an elevation of privilege (EoP) vulnerability affecting hybrid Microsoft Exchange Server deployments. This flaw allows attackers with administrative access on on-premises Exchange servers to escalate privileges and potentially compromise your entire Microsoft 365 (M365) Exchange

Identity and access management is no longer just an enterprise challenge. With hybrid work, cloud adoption, and the rise of generative AI, small and mid-sized businesses (SMBs) are facing the same risks — often with fewer resources. Microsoft’s Secure Employee Access Report 2025 highlights the problem: “58% of security leaders expect the number of identities in their organization to grow in the next year.” “61% reported an increase in identity- and network-related incidents d