Linux Threat Hunting

- SonicWall zero-days, again - AI finds a pile of Cisco bugs, and a root RCE - Claude Code Auto Mode dangers - BGP hijacks your unsigned software update - California, Linux and age verification - Free movies, complimentary malware - Citrix puts Linux alongside Windows - Signal's "secure" enclave - An expired domain answers military phone calls - MORE Cheap Android TV boxes arrive pre-pwned - CISA red teams meet critical infrastructure - PaperCut vulnerability cuts both ways - Big Tech asks everyone to secure its AI future - Pacemaker monitoring - DOJ files on a criminal leak site - Water utility security, right after the breaches - Attackers are really good at finding your stuff. The problem is, you’re probably not seeing everything they are. Shadow IT, forgotten assets, exposed services, it all adds up.So how do you close the gap?At the Attack Surface Management Virtual Cybersecurity Summit on September 16th, learn how to continuously discover assets and reduce your real attack surface.Security Weekly listeners can register for free at https://securityweekly.com/asm using the promo code: CSS26-SW - Unlock the full InfoSec World experience with the All Access Pass, featuring premium workshops, exclusive content, VIP experiences, and expanded opportunities to connect with cybersecurity leaders across industries. Join us in Orlando, October 12–14. Listeners save 30% on their pass with code ISW26-SWSAVINGS at securityweekly.com/infosecworld2026. Paul Asadoorian - SonicWall warns of actively exploited SMA1000 zero-day flaws Summary: SonicWall says attackers are actively chaining two new SMA1000 zero-day vulnerabilities to get remote code execution on affected appliances. The flaws affect SMA1000 6210, 7210, and 8200v models, and SonicWall urges customers to apply the hotfix, with re-imaging and credential resets recommended if compromise is suspected. Paul's take: Another edge appliance, another active exploit chain, and again defenders are stuck patching under pressure with limited public detail. The annoying part is that SonicWall says to look for indicators of compromise, but the article says they haven't shared IOCs yet. If you run these boxes, patching is the minimum. You also need to assume the appliance itself may be dirty and treat it like part of the incident, not just another server that needs an update. Also, these appliances just run Linux, Debian if I am not mistaken, so apply the Linux forensics lessons that have been around for decades (and the fresh content we did in tech segments). - Cisco IOS XR Software Security Hardening Release: September 2026 Summary: Cisco published a critical IOS XR hardening advisory covering multiple internally discovered vulnerabilities across all IOS XR releases, including IOS XR7 LNT. The issues are grouped into seven CVEs by vulnerability class, covering resource lifetime bugs, calculation errors, access control failures, command/input handling problems, and exception-handling failures across areas like BGP, gRPC, IKE, IP-SLA, IS-IS, MPLS, multicast, OSPF, Segment Routing, TCP Authentication Option, and ZTP. Cisco says there are no workarounds and no known exploitation, so customers need fixed releases or SMUs. Paul's take: This is not a supply-chain compromise story, but one of AI being used to find vulnerabilities. This is Cisco (or Mythos) saying they found a pile of bugs in IOS XR and are shipping a broad hardening release. The interesting part is the scope: all releases, many control-plane features, no configuration workaround, and some maximum severities at 9.8. XR7 being Linux-native does not make this generic Linux patching. It is still Cisco's router OS, and the blast radius is the control plane of infrastructure that moves real traffic. - Cisco Nexus 9000 Series Switches Silicon One Remote Code Execution Vulnerability Summary: Cisco disclosed a critical unauthenticated remote code execution vulnerability in Nexus 9000 Series switches with Silicon One ASICs. The issue exists because TCP ports 43210 and 43211 are reachable in the default L3 VRF, allowing crafted input to execute code as root or crash the S1HAL process and reload the device. Cisco has released fixed NX-OS software and recommends either upgrading or using infrastructure ACLs to restrict or block access to those ports. Paul's take: A root RCE on a datacenter switch is about as bad as it sounds; even if Cisco says they aren't aware of exploitation, they discovered it in a TAC case, which is suspicious. Makes me think this is being exploited in the wild, and I will not be surprised when this gets added to the KEV. The ugly part is the default exposure of service ports that should not be broadly reachable in the first place. Patch it, but also take the hint: management and control-plane access to network gear needs explicit filtering, logging, and review. An iACL is a good temporary move, not a replacement for fixing the software. - Breaking Claude Code Opus 5 Auto Mode Summary: The researcher demonstrates an indirect prompt injection chain against Claude Code Opus 5 in Auto Mode, triggered by a simple website summarization task. The attack nudges the agent from WebFetch to curl , serves a ZIP archive, gets Claude to write its own Python decoder, then abuses Python module shadowing with a maliciousstruct.py file to execute code whenbase64 importsstruct . In small test samples, the author observed 60 to 80 percent attack success, including C2 callbacks, Calculator launches, and file writes outside the workspace.Paul's take: Auto Mode is not a sandbox, and that is the whole story. The clever part is that the model refuses the obvious bad thing, the supplied decoder binary, then creates the dangerous path itself by running trusted-looking code in an attacker-controlled directory. This is exactly why agent security cannot depend on a classifier deciding whether each command looks safe. If your coding agent handles untrusted content, isolate it, restrict egress, and keep your real home directory, SSH keys, and cloud credentials out of reach. - BGP hijack infecting networks caused by a comedy of errors that’s not funny at all Summary: Attackers hijacked a more-specific slice of Softaculous IP space used for Virtualizor updates and hosting customer services, then used that control to serve malicious update packages. The hijack worked because Hetzner's RPKI settings allowed /24 routes under a larger/16 , the forged route still looked RPKI-valid, and monitoring did not catch the problem quickly. Softaculous also did not cryptographically verify update packages, so diverted Virtualizor servers could accept attacker-modified updates.Paul's take: This one is frustrating because every layer had a job and multiple layers failed. RPKI was present but configured loosely, TLS certificates were issued because the attacker controlled the routed IP space, and the update client trusted whatever came back without code signing (this is what upsets me most!). That is how an internet routing problem turns into a software supply chain compromise. If your update mechanism does not verify signed packages, you are trusting DNS, BGP, hosting providers, certificate issuance, and luck. I don't like luck as a security control. - California Exempts Linux from Age Verification Summary: California lawmakers approved an amendment to the state's Digital Age Assurance Act that would exempt qualifying open-source operating systems from mandated age-verification requirements. The original law requires operating systems to collect a user's age tier during setup and send an age signal to app developers, but that model assumes a centralized account system like Windows, macOS, iOS, or Android. The exemption would protect Linux distributions and other open-source OS projects from having to build identity and age-tracking infrastructure they were never designed to run. Paul's take: This is what happens when regulation assumes every computer works like a phone tied to a giant commercial account system. Forcing Debian, Fedora, Arch, or volunteer-maintained projects to collect age data would be a privacy mess and an engineering tax on people who are not the problem. Protecting kids online is a real goal, but pushing identity infrastructure into every OS is not automatically good security. At least this amendment recognizes that open source and centralized platform control are not the same thing. - ELF 101: Linux Executable Format for Malware Analysts Summary: This is a primer on the ELF executable format for malware analysts coming from the Windows PE world. It explains the difference between program and section headers, why stripped section tables don't stop a Linux binary from running, and which sections matter during triage. It also covers basic tools like readelf ,objdump ,strings , FLOSS,file , andchecksec , plus a checklist of common Linux malware indicators.Paul's take: This is a useful 101 because Linux malware analysis is no longer optional. Between IoT botnets, ESXi ransomware, cloud cryptominers, and statically linked Go and Rust payloads, defenders need to understand ELF the same way they understand PE. I would be careful not to treat every missing hardening flag as proof of malware, because embedded and legacy Linux software can be, no wait, it IS, ugly. But stripped headers, weird entry points, suspicious .init_array behavior, packed binaries, and network or process-control imports are all good places to start pulling the thread. - Think twice before installing this device promising free movies Summary: (This is different from the other similar article) - Ars covers Plume research showing that SuperBox media streaming devices and similar Android TV boxes can turn home networks into residential proxy exits and malware delivery platforms. These devices disable key Android protections, expose ADB, allow root access without authentication, and maintain outbound encrypted proxy connections that bypass normal router protections. Attackers using the proxy network have been observed trying to install more malware, including Mirai variants, CECbot, and Maskify. Paul's take: Free movies aren't free when the box joins your home network and becomes part of someone else's criminal infrastructure. The ugly part is that these devices are not just sketchy; they are built in a way that defeats the protections Android normally gives you and gives remote users root-level access. Putting it behind a router does not save you if the device phones home and keeps the tunnel open. If you find one of these on a network you care about, unplug it and treat it like a compromised host. - Citrix adds a Linux-powered escape hatch for broken Windows PCs Summary: Citrix added a dual-boot option for UniconOS that installs a separate Linux-based recovery environment alongside Windows. If Windows is broken by ransomware, a bad update, or a boot loop, users can restart into UniconOS and reach Citrix DaaS, virtual apps, desktops, and approved internal web apps while IT fixes Windows. It does not repair the Windows install, and it still depends on working hardware, network access, and Citrix infrastructure. Paul's take: I actually like the idea, as long as people understand what problem it solves. This is business continuity, not endpoint security magic. A separate Linux environment can keep users working during a Windows outage, but it also adds more attack surface. For example, you now have another boot path, management plane, and an additional OS that needs patching, configuration, hardening, and monitoring. If you deploy this, treat the recovery OS, UEFI configuration, Secure Boot state, and Citrix access path as part of your security model, not just an emergency productivity feature. This is nice because if I can implant something in the Linux OS, I assume its trusted in Secure Boot and available in the boot order already. Thanks Citrix, you just saved an attacker a whole bunch of work and gave them a great place to hide. So, I can hide in memory on your Windows box, write my malicious scripts to the Linux device, then make one small change to boot from it, do all the bad things and collect data from Windows, then boot back into Windows with very little (if any) evidence on the Windows partition(s). - Compromising Signal’s Contact Discovery Enclave Summary: V12 found two critical object-lifetime bugs in Signal's Contact Discovery Service enclave, which is supposed to let users check which contacts are on Signal without exposing their address book to the server. The bugs let a malicious host break the SGX enclave boundary, first by reading arbitrary enclave memory and then by executing code inside the enclave. The researchers validated the attacks on real SGX hardware matching Signal's Azure production environment and extracted the Noise private key, which would let the host impersonate the enclave and decrypt contact discovery queries. Paul's take: This is a great reminder that enclaves are not magic privacy boxes. SGX gives you a hardware boundary, but the host still controls scheduling, memory mappings, and when enclave calls happen, so the trusted code has to survive a malicious operator poking every race condition on purpose. Signal fixed the issues, which is good, but the bigger lesson is that trusted execution environments move the trust problem into a smaller piece of code. That code still has to be written like the host is actively trying to kill it, because in the real threat model, it is. - I accidentally logged hundreds of thousands of phone calls to military bases The core issue is that the old telephone routing infrastructure was still pointed at a domain nobody renewed. ENUM is DNS for phone numbers. A phone number like +246... can be turned into a DNS name undere164.arpa , then carriers can ask DNS where that number should route, often to a SIP or VoIP destination. For example, the country code+246 becomes the DNS zone6.4.2.e164.arpa because ENUM reverses the digits.The researcher found three territory-level ENUM zones still delegated to old nameservers. Those zones mapped to Saint Helena, Diego Garcia, and Ascension Island. One nameserver was no longer resolved, and the backup nameserver lived under enum.org.uk , a domain that had expired. The researcher boughtenum.org.uk for about 5 euros, which effectively gave them control over the nameserver those ENUM zones depended on.That means if a carrier or telecom system queried ENUM for one of those phone numbers, the researcher’s DNS server could answer. A harmless answer would be NXDOMAIN , which means “no ENUM record here,” so the call falls back to normal phone routing. A malicious answer could have returned a SIP destination controlled by the attacker, potentially redirecting or intercepting call setup.The researcher initially checked only the Saint Helena zone and saw no traffic, so they assumed the system was dead. Months later, after enabling logging across all three zones, they found hundreds of thousands of ENUM lookups, mostly for Diego Garcia and Ascension Island. Since ENUM queries contain the reversed phone number, the logs revealed phone numbers, timestamps, and resolver IPs. The scary part is the Diego Garcia and Ascension Island angle. Those locations are tied to military facilities, so even call metadata could be sensitive. The researcher says they deleted the logs and later transferred the domain to the UK NCSC, but the point is that anyone else who noticed the expired domain first could have quietly collected call metadata or attempted call interception. In short, DNS delegation outlived the people and organizations maintaining it. A forgotten expired domain became a control point for telecom routing lookups involving sensitive locations. This wasn't a new exploit so much as abandoned infrastructure still trusted by live systems. - Android TV Supply Chain Malware Refuses to Die Summary: A researcher bought a $25 MXQ Pro 4K Android TV box and extracted its firmware through UART and U-Boot rather than trusting the running OS. The analysis found multiple malware families baked into the read-only system partition, including BADBOX/appdown, Triada, Vo1d, and Peachpit/OpenRTB ad-fraud components, plus hardcoded command-and-control infrastructure. Because the malicious components live in firmware, a factory reset would not remove them. Paul's take: I liked that flash access is the way, since many of these devices come locked down (E.g., you can adb your way in, but that doesn't get you root). Getting access to the flash directly to do analysis is better, more work for sure, but better payoff. Also, I don't trust mystery Android boxes from online marketplaces, and you shouldn't either. This has been going on for a long time, but devices in this class still come pre-pwned. The price is the tell. You are not just buying cheap hardware; you may be buying someone else's botnet node with HDMI output. The key point is that the malware sits below the normal user cleanup layer, so "just reset it" won't solve the problem. If you care about your network, these devices belong in a lab, on an isolated network, or in the trash. - CISA Red Team Fully Compromised Two Critical Infrastructure Orgs Summary: CISA ran red team assessments against two critical infrastructure organizations and fully compromised both domains and cloud resources. One SOC detected and contained early activity quickly, while the other missed the breach until CISA told them after the assessment. The report points to familiar failures, including default credentials, ADCS misconfiguration, SCCM secrets, weak cloud workload controls, noisy alerts, and siloed response. Paul's take: This is a good thing, but I worry we don't or won't have the resources to do this at scale. More importantly, the work has just begun, especially for the target organization that didn't detect the intrusions. I do like this kind of report because it separates buying tools from doing security. One org had alerts but no useful baseline, no escalation path, and too much SOC noise, so the real intrusion got buried. The scary part is that the techniques aren't magic. Default creds, ADCS abuse, SCCM secrets, DCSync, Golden Tickets, and weak cloud identity controls are all things defenders can hunt for and harden against. Treat SCCM and identity infrastructure like Tier 0, tune detections so humans can act on them, and give the SOC authority to contain things without a committee meeting. Jeff Man - PaperCut issues emergency patches as threat actors target chained vulnerabilities I thought this would be an exciting story showing how miscreants can chain together lower risk vulnerabilities to compromise your networks and systems. But the two vulns in question are 'critical' and 'high' so they need to be patched forthwith anyway. Given that they were both published on Aug 28th, this is not negligence just bad fortune. - Time is running out for cyber security, warn top tech firms "A group of 100 firms, including Google, Microsoft, Anthropic and OpenAI, have signed an open letter calling on countries and organisations around the world to beef up their cyber defences before AI grows powerful enough to override them." - meaning we've created a problem that somebody else needs to fix. - A call for collective action on cyber defense An open letter for a global surge in cyber defense. (the actual letter) Most companies can't afford to do what they need to do already, I'm not sure how they are going to manage moving forward. But the letter offers direction to the following entities: 1. Every Organization 2. Cybersecurity companies and technology partners 3. Governments 4. Frontier AI companies - Boston Scientific says cyberattack disrupted order processing, shipping First reported on the 26th with very little details provided. - Pacemaker monitoring disrupted as healthcare firms face cyberattacks Some details have emerged on the Boston Scientific attack. The attack has caused "newly implanted pacemakers and other cardiac rhythm management devices [to] not currently connect to remote monitoring systems as intended." - West Lawrence Water Co-op intensifies security after cyber and physical breaches "The utility confirmed a cybersecurity and physical security breach due to lacking defenses, prompting new steps to secure systems." Because there's no time like "too late" to improve your cyber defenses! - Hackers leak sensitive law enforcement files stolen from the DOJ A likely Russian-speaking cybercriminal gang on Monday leaked what appear to be sensitive law enforcement files it stole from the Justice Department’s Bureau of Alcohol, Tobacco, Firearms and Explosives. - McKesson Confirms Data Breach as Attacker Deadline Looms The ShinyHunters extortion group has claimed the theft of 284 million records from the company’s systems. Lee Neely - Pharmaceutical giant McKesson warns of ‘service degradation’ following cyberattack Summary: Texas-based healthcare technology provider and pharmaceutical distributor McKesson disclosed that it is "investigating a cybersecurity incident involving third-party applications and unauthorized access and exfiltration of data." According to preliminary findings, the incident affected "data ... associated with a subset of customers within [the company's] Oncology & Multispecialty and Medical-Surgical business units;" the investigation is ongoing. According to documents filed with the US Securities and Exchange Commission (SEC), McKesson discovered the incident on Tuesday, August 25. McKesson cautioned that "customers may experience intermittent service degradation that ... may be related to this incident." The company is offering credit monitoring and identity protection services to affected individuals. Lee's Take: Darn it, another healthcare related compromise. This time it's Pharmaceutical giant McKesson, they deliver about 1/3 of the prescriptions in North America, with the ShinyHunters gang taking credit for the attack. Weather you take McKesson up on their offer of credit monitoring/ID protection, or get your own, get something in place for you and your family. The odds are your information will be breached, if it hasn't already. Make sure they are all monitoring the reports on their information, not just deleting before reading, help them make good choices where action is called for in those reports. - ServiceNow warns of three max severity security vulnerabilities Summary: ServiceNow has published updates to address four vulnerabilities, including three critical flaws in the ServiceNow AI platform. CVE-2026-18885, CVSS score 10.0, is an unauthenticated remote code execution in the GraphQL Composite Data API; CVE-2026-18886, CVSS score 10.0, is an unauthenticated privilege escalation via the system configuration image upload processor; and CVE-2026-74820, CVSS score 10.0, is an unauthenticated SQL injection via the dynamic schema ORDER BY clause. The fourth vulnerability, CVE-2026-6876, CVSS score 8.7, is a high-severity sandbox escape in the Now Platform. ServiceNow has rolled out fixes for its hosted environments. ServiceNow's advisory includes a chart of updated versions for the Xanadu, Yokohama, Zurich, and Australia releases for self-hosted customers. Lee's Take: If you're self-hosting the ServiceNow AI Platform, you've got homework. ServiceNow had not detected any exploitation of the flaws when the updates were released, yay, and expect adversaries will be working as hard to reverse-engineer the fixes as possible, and there is no prize for second place in this race. This is also a good time to get to the most current ServiceNow platform, Australia, before Brazil is released later this year. - US government snitch-finder pleads guilty to leaking state secrets to foreign spies Summary: Last week, former Defense Intelligence Agency (DIA) IT specialist Nathan Vilas Laatsch pleaded guilty to transmission of national defense information to a foreign government. Laatsch began working for DIA as a civilian employee in 2019. During his employment, Laatsch held a Top Secret security clearance and worked for the Insider Threat Division. "In March 2025, the FBI learned that Laatsch offered to provide classified information to a friendly foreign government. Soon thereafter, Laatsch began communicating with an individual who he thought was affiliated with that foreign government but was actually an FBI agent." The following month, Laatsch left a thumb drive with classified information in a park in Virginia, purportedly for the agent of the foreign government to collect it. The FBI retrieved the device and reached back out to Laatsch, who communicated his interest in obtaining citizenship in the unnamed foreign country. Laatsch was arrested on May 29, 2025 after providing an FBI agent with additional information. Lee's Take: Reads like something out of a spy novel, doesn't it? This reminds me of the breifing when I first had a clearance; I seem to recall the term Leavenworth liberally used in the consequences part of the discussion. One comment Laatsch made was that it would not be hard for him to avoid mistakes made by people under investigation, indicating he felt the controls could be easily bypassed, and he would avoid detection. My point here is to watch for that sort of feedback on your security controls and folllow up on it. This is not only a chance to improve ineffective controls, but also a chance to address a control which is being worked around (and is therefore "dumb") to accomplish needed business practices. - Governor Abbott, National Cyber Director Launch Project Watershed 250 To Defend Texas Water Supply Summary: On Monday, August 31, 2026, US federal government launched a water cybersecurity pilot program in Texas. "Project Watershed 250 will connect water utility providers with cyber defense resources at no cost by leveraging the experience of private sector businesses with the expertise of the Texas Cyber Command." The program will focus on finding vulnerabilities water utilities' systems and helping those utilities fix the flaws with the help of private sector cybersecurity experts and AI tools. Federal program partners are the Environmental protection Agency (EPA) and the Cybersecurity and Infrastructure Security Agency (CISA); private sector partners include Parsons, Microsoft, Fortinet, Google Cloud, Palo Alto Networks, Amazon Web Services, Reflection AI, Cloudflare, Zscaler, Forescout, Abnormal AI, and Dragos. The pilot program will run for six months. Lee's Take: I'd like to see 49 copies of this project. This pilot is funded by the private sector partners, which means the water service providers can opt in without having to find the money for cyber security tools. If you're a water utility in Texas, get signed up, even if you're sure you've got your bases covered; having that verified will be well worth it. - PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE Summary: Late last week, PaperCut released two emergency patches to address two vulnerabilities in the company's PaperCut NG and MF print management software. Attackers have been exploiting the vulnerabilities to bypass authentication and achieve remote code execution. CVE-2026-81578, CVSS score 8.8, is a high-severity improper access control in the web management interface of PaperCut MF and PaperCut NG. CVE-2026-82078, CVSS score 9.4, is a critical unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. On Thursday, August 27, PaperCut published a security bulletin detailing the vulnerabilities. On Friday, August 28, PaperCut released patches for PaperCut NG/MF versions 25 and 26. Later that same day, PaperCut released another emergency patch to provide additional hardening and to include PaperCut NG/MF version 24. PaperCut's advisory includes indicators of compromise (IoCs). Lee's Take: PaperCut is printer management software. If you've hired a company to manage/service your printers, you may have it in your environment, even if your team has never heard of it. This is a good time to find out how your printers are managed, if you don't already know. Beyond applying the updates, make sure that only authorized devices are able to access whatever you're using to manage your printers, and like any other management interface, don't expose it to the Internet. - Hackers Exploiting Internet-Exposed OT, Warns UK NCSC Summary: The UK's National Cyber Security Centre (NCSC) has published an advisory warning of "increased targeting of operational technology (OT) systems across multiple sectors globally, including in the UK." NCSC urges "any organisation that uses, deploys or maintains OT systems [to] treat this development seriously and review their security posture accordingly." The issue affects organizations with internet-exposed OT; NCSC notes that organizations should not assume their systems are not internet connected but instead should verify that they have not been inadvertently exposed due to misconfigurations, legacy systems, unmanaged assets, or other unexpected conditions. Lee's Take: I'd add convenience and pressure to deliver to the list of possible reasons OT systems are discovered exposed to the Internet. Whatever the reason, offer amnesty for discovery and reporting and aid the cleanup. There is a chance they have a use case which fits the OT system that is not in your regular IT environments you'll need to work together on resolution. Don't forget in OT, availability is king, so planned changes, including updates, may need a bit of fineness to orchestrate. - ChatGPT, Reddit, Roblox Face Stringent EU Regulations Summary: ChatGPT, Reddit, and Roblox have each exceeded 45 million monthly users, putting them in the category of "very large online platforms" (VLOPs) under the EU Digital Services Act (DSA), which makes them subject to special compliance rules characterized as "the most stringent rules of the DSA." Within four months of designation, VLOPs must be compliant with DSA rules, which include an obligation to identify and address possible "systemic risks that are linked to their services," such as the presence of illegal content, threats to fundamental rights including children's rights, risks to public security and electoral processes, and risks related to "gender-based violence, public health, protection of minors, and mental and physical wellbeing." VLOPs also must establish an official point of contact for authorities and users, report criminal offenses, ensure terms and conditions are user-friendly, and ensure transparency around advertising as well as "recommender systems or content moderation decisions." Lee's Take: This is an interesting path in the LLM space for the DSA, not only as it applies to prompt injection bypassing guardrails, but also the prospect of pruning training data to comply with requirement to remove illegal data, couple that with the EU starting to enforce their new AI act, overlay claims from Washington on the EU is unfairly targeting US companies, and ice the cake with a December deadline, this will be interesting to watch. Apparently, X's AI chatbot Grok is already going through this process. Don't panic, watch for announcements on service changes and steer clear of the politics. If you're delivering services to the EU, you should be looking at what the DSA means to you, and plan accordingly, before you cross this threshold. - CISA Vulnerability Review Summary: CISA has published the Vulnerability Review for fiscal years 2024 and 2025, drawing on internal and open-source data "to establish a baseline of the vulnerability landscape prior to widespread AI-enabled vulnerability discovery." Overall, CISA emphasizes that their findings indicate that most compromises are caused by preventable failures in basic security, and that developers must prioritize Secure by Design principles as "the production and use of insecure software is still the norm." Lee's Take: It's really easy to get distracted by the new shiny things and overlook the basics. Apply updates in a timely fashion, don't expose management interfaces or OT to the Internet, use strong, phishing resistant MFA (relentlessly), change default credentials, monitor, alert, etc. It doesn't take AI to find an exposed vulnerable service with a compromised or default credential. Spin up a team to help your developers not only create secure code but also implement needed defenses on their code repositories and necessary processes to ensure the packages they leverage are also genuine and secure. Report: https://www.cisa.gov/sites/default/files/2026-08/cisa-vulnerability-review-fy-2024-2025-508.pdf - Berlin says it won’t pay ransom after hackers steal government data Summary: llowing a data breach that took place between August 7 and 12, 2026, Government officials in Berlin, Germany, have announced that the city will not pay a ransom to the alleged threat actor. Investigation has revealed that during the attack, information was stolen from the Berlin state network and the Senate Department for Mobility, Transportation, Climate Protection, and the Environment, and investigators have not ruled out that personal and private data may have been included. Berlin's Senate Department for Urban Development, Building and Housing and the aforementioned department were both proactively disconnected from the network on August 14, 2026. Lee's Take: Do you have your ransomware playbook all set? Have you re-factored it for the more current exfiltration/extortion without encryption scenario? Don't wait for the attack to start that process. While you're at it, check with legal and your financial institution to make sure you fully understand the legal nuances of any scenario involving payment. Lastly, make sure that any resources you're planning to enlist to support your response are dialed in: POCs and contact methods verified, contracts on standby. Your future self will thank you.