Security Tips

Most detection writing describes a control and stops there. The interesting part is never the control — it is what the other side does about it, and how fast. We got four days of that this week against a single operator, on our own free-tier registration form, and every observation below is our telemetry rather than somebody else's report. The setup On August 15 an audit found that 26 of the 103 API keys we had ever issued — 25% of every registration in our history — belonged

Four weeks ago a RubyGem called Dendreo shipped a malicious version from a maintainer account that had been quiet since October 2020. We wrote about it, because the dormancy was not incidental to the attack — it was the attack. Seven years of accumulated trust, spent all at once. We also ran our own package-reputation scanner against it that morning and published what it said, which was allow. On August 15, sixteen more malicious gems arrived. This time nobody borrowed any tr

At one minute past midnight our exploit harvester fired an alert. A second independent public proof-of-concept had appeared for CVE-2026-20079, a vulnerability in Cisco Secure Firewall Management Center. We already had the first one, harvested ten days earlier. What made the second interesting was not the exploit. It was what happened when we checked whether CISA had catalogued the vulnerability. It had not. It still has not. Three vulnerabilities, one product, one very odd p

If you use Claude Code, Cursor, Copilot, Cline or Windsurf, there is a file in your repository that your AI agent reads before it does anything else. It is called CLAUDE.md, or .cursorrules, or copilot-instructions.md. It is the standing brief. Every session, every invocation, the model reads it and takes it as direction. It is also, in most repositories, a file nobody reviews carefully. It is prose, not code. It does not run. It has no tests. When it shows up in a pull reque

On 16 August 2026, Hudson Rock's InfoStealers reported that an actor calling themselves TheHatman is selling internal employee directories said to be pulled from enterprise Azure and Entra portals using compromised credentials. The list of named organisations is not small: McDonald's at roughly 1.7 million records, TCS at 800,000, Vodafone at 425,000, HCL Technologies, InterContinental Hotels, Kyndryl, Gap, Hexaware, Wyndham. Around 3.6 million records in total, if the seller

In March 1975, a year before the Ramones put out a record, five guys from the Bronx and Queens released an album called Go Girl Crazy! The first track was called "The Next Big Thing," and it opened with a boast — the singer explaining, at length, that he was about to be enormous. He was not. The Dictators never got big. The record sold badly. Epic dropped them. They were also, by fairly broad agreement now, one of the first punk bands in the world. Half of what CBGB became in

Stanley Kubrick released Dr. Strangelove or: How I Learned to Stop Worrying and Love the Bomb in 1964. It is a film about an automated retaliation system, a communications gate that fails at the worst possible moment, a room full of confident men reading a board that is already wrong, and a conspiracy theory built entirely out of correlation. We spent this week measuring our own automated blocking system. Every single one of those turned out to be a documented failure mode we

We run a threat intelligence platform, and we defend it with something that costs us almost nothing: a small script running on Cloudflare's edge, fed by a list of addresses our own feed rates as high confidence. No appliance. No agent. No console. No analyst watching a screen. We call it the edge shield, and the honest question we had never properly answered was whether it actually works, or whether it is security theatre that happens to be cheap. So we measured it. This is w

[CVE-2026-58231](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-58231) is a 10.0. Not a 9.8 — the actual ceiling. SAP patched it in Commerce Cloud on patch day. Defused researchers saw the first exploitation attempts hit their honeypots three days later. And as of writing there is no public proof-of-concept. That last fact is the interesting one, and it is what this post is about. The flaw It is in the Commerce Cloud Data Hub Adapter, affecting COM_CLOUD ve

Six organisations disclosed breaches this week and not one of them was breached. Their suppliers were. Listed separately they read as an unlucky week. Put the dates and the mechanisms side by side and two things fall out: the same crew is behind at least two of them, and one of the entry points is a vulnerability we wrote about on Tuesday — exploited five days before CISA got around to cataloguing it. The week Trezor — 13,689 customers exposed. Not through Trezor. Through Shi

On August 12, 2026, at 10:46 UTC, a researcher going by @q1uf3ng posted a GeoServer zero-day to X. Within hours, exploitation attempts were being observed in the wild. The flaw carries a CVSS of 9.8. It has no CVE number. It has a GitHub advisory identifier — GHSA-mqjf-5f49-2fjh — and that is the whole of its official naming. We run a standing beat on exactly this tier, so here is the honest read on what it is, what the timeline tells you, and why the missing identifier matte

We now publish a MISP feed. Point a MISP instance at https://analytics.dugganusa.com/api/v1/stix-feed/misp/ — Sync Actions, Feeds, Add, format "MISP Feed" — with an API key. It is live as of today, and free. The more useful half of this post is what went wrong building it, because the first working version was quietly doing something we spend a lot of words telling other people not to do. Why MISP, and how we found out We ship STIX 2.1, TAXII 2.1, CSV blocklists and native OP

FortiGuard Labs published on a previously undocumented Linux botnet family called Evooo1Bot, active since July 2026. It is Mirai-derived, which is unremarkable, and it has a SOCKS relay module, which is the part that matters. We have been tracking the residential-proxy supply chain for five months. This is the fourth acquisition layer, and putting the four side by side says more than any one of them does. The four layers, with dates Layer one — device SDKs. March 12, the FBI

On August 4, researchers identified a Shai-Hulud variant — ChainDrop — that had trojanized 444 npm packages across multiple publishers, collectively pulling roughly two billion downloads a month. By 13:20 UTC that day, 2,212 malicious versions had been catalogued. The interesting parts are not the size. They are the four places this campaign refuses to behave the way defences expect. It came in through the front door, signed The attackers compromised the GitHub account of the

SecurityWeek published a piece on August 14 titled "Trivy, Not LiteLLM Behind the 2,500 Org Compromise." The correction it carries is that TeamPCP never targeted LiteLLM directly — LiteLLM was compromised because its CI pipeline automatically installed the poisoned Trivy version. We published that chain on April 1, 2026, in a post called "One Actor, Three Supply Chains: How TeamPCP Chained Trivy, LiteLLM, and Telnyx Into a Single Kill Chain." This post is both halves of that:

On August 12, 2026, the President signed a National Security Presidential Memorandum authorising vetted private companies to conduct offensive cyber operations against foreign criminal organisations. It is the first formal US program of its kind. We have been circling this exact question since December 2025, from the other direction, and we want to lay out the argument we already made before the policy existed — because it turns out to have been a question about consent all a

The interesting number in this campaign is not 9.8. It is five days, and then forty-eight hours. The bug [CVE-2026-59310](https://analytics.dugganusa.com/api/v1/dredd/kev-gap?cve=CVE-2026-59310) is a directory traversal in the VMware vCenter Syslog server that lets an unauthenticated attacker with network access execute arbitrary code. CVSS 9.8. Broadcom disclosed it on July 29, 2026. Note where it lives. Not in the vSphere Client, not in an authentication path — in the syslo

Huntress documented an Akira intrusion in which the affiliate did something Akira had not been seen doing before, executed it successfully, and then watched their own ransomware fail to run. It is an instructive failure, and the lesson is not the one the failure suggests. What happened The intrusion began around August 4, 2026 with a credential spray against a SonicWall SSL VPN. Ordinary front door, ordinary technique, and the same class of entry point we have written about b

This is a follow-through post. We wrote LegacyHive twice while it had no CVE and no patch, and the story just closed. Here is the whole arc with dates, because the arc is the point. The timeline July 14, 2026. Microsoft ships its largest Patch Tuesday ever — 570 fixes, two already exploited in the wild. July 15, hours later. A researcher who goes by Nightmare Eclipse (also Chaotic Eclipse, known around Redmond as a serial tormentor) publishes a working proof-of-concept for a

The Israeli firm Dream published research on an operation that used open-source AI agent frameworks to attack Taiwanese government systems. It is being reported, near-universally, as AI agents hacking a nuclear agency. That is true and it is doing an enormous amount of work. Our first reaction here was the same as everyone else's, so this post starts by correcting it, and then gets to the part that is genuinely worse than the headline. No reactor was touched The victim is Tai