All Posts

I am writing this blog post using Claude. The irony is not lost on me. It might be the last time. I have been an Anthropic customer since the early days. Claude Max subscriber. $200 a month. I built my company's entire threat intelligence operation with Claude as the engine. Not as a tool — as a partner. I said "ride or die" and I meant it. We co-authored patents together. We built a STIX feed that Microsoft and AT&T pull daily. We indexed a million IOCs. We wrote 1,641 blog

This is your morning sweep. Everything that matters from overnight. IOCs at the bottom. Free STIX feed link at the bottom. If your SIEM pulled our feed last night, some of these were already blocked before you read this sentence. If it didn't — keep reading. CISA Deadline: Today. Right Now. CVE-2026-35616 — Fortinet FortiClient EMS. Pre-authentication API access bypass leading to privilege escalation. CVSS 9.1. CISA added it to the KEV catalog on April 6 and gave federal agen

Langflow is the visual builder for LangChain agents. It's how a lot of teams stand up AI workflows without writing the orchestration code themselves. It's also, as of tonight, sitting on three critical CVEs in two weeks — and CISA is warning about active exploitation on one of them. We have six active exploiter IPs in our index. Two of them are running custom exploits with stage-2 droppers. One is harvesting credentials. The other four are running nuclei against everything th

We built something today that none of the threat intelligence vendors do. Every 6 hours, our platform searches GitHub for newly published CVE exploit code. It pulls the scripts, extracts the attack patterns — target endpoints, injectable headers, SQL injection strings, RCE execution methods, default credentials — classifies each one as a detection PoC or a weaponized tool, and converts the patterns into proper STIX 2.1 indicators that flow directly into your SIEM. From git pu

FortiClient EMS — the server that manages Fortinet's endpoint security agents — has a CVSS 9.8 SQL injection that's being actively exploited in the wild. Unauthenticated. Through the web GUI. Low complexity. Remote code execution. CVE-2026-21643. Active since March 26. Not yet in CISA's KEV catalog. Defused confirmed exploitation on March 30. Fortinet has patches. Most organizations haven't applied them. This is the fifth management interface with a CVSS 9.8+ vulnerability ac

Cisco has been removed from ShinyHunters' dark web leak site. The listing that threatened to dump 3 million Salesforce records, 300 private GitHub repositories, AI product source code, and FBI/IRS/NASA customer data — gone. As of this morning, every other victim is still listed. Cisco is not. In the ransomware world, removal from a leak site means one thing: the victim paid. Cisco has not confirmed payment. They won't. But the $57 billion company that sells firewalls, intrusi

On April 1, we published "One Actor, Three Supply Chains" — documenting how TeamPCP chained Trivy → LiteLLM → Telnyx, each compromise funding the next. We said the chain doesn't stop when the vendor publishes a blog post. It stops when the credentials expire. The credentials haven't expired. Today we learned the chain reaches Cisco. And the European Commission. And potentially the FBI, IRS, and NASA. The Full Chain Aqua Security's Trivy (security scanner) ↓ TeamPCP poisoned 7

Two research teams dropped papers yesterday showing that NVIDIA GPUs are vulnerable to Rowhammer attacks. Not theoretical. Not in a lab. Hundreds to thousands of bit flips on production hardware — RTX 3060, RTX A6000 — giving the attacker full control of the host machine through the GPU's memory. The GPU that trains your AI model. The GPU that renders your cloud workload. The GPU that powers the inference engine your customers depend on. It's an attack surface. It always was.