← Feed

Posts

• View post

  A SANS Internet Storm Center diary today documents another ClickFix campaign using a fake Cloudflare verification screen on both Windows and macOS. The researcher couldn't obtain the final payload, so it's too early to make claims about the malware. For MSPs, this is still a useful awareness example: legitimate verification shouldn't require users to paste commands into a terminal. https://isc.sans.edu/diary/rss/33466 #CyberSecurity #MSP

• View post

  Discord plans to show some messages from public channels in Discoverable servers on web pages and search results beginning in mid-December. Private servers and DMs aren't included. If you administer a public community, review Server Settings → Web Presence. Members have a Data & Privacy control too. "Public in Discord" may soon also mean "searchable on the web." https://discord.com/blog/making-content-from-discoverable-servers-easier-to-discover #Privacy #IT

• View post

  I feel like @MonaApp could be a bit better optimized for iPhone Duo. Having the post on the right after you click seems redundant. If you don’t click a post, it’s blank.

• View post

  Black Lotus Labs' Silent Train research puts MSP tooling in the spotlight. Volt Typhoon targeted centralized management platforms, including N-able N-central and SD-WAN controllers. One breached console can provide access to many customer systems without noisy lateral movement. For MSPs: restrict admin interfaces, review downstream trust, and retain logs long enough to investigate. #Cybersecurity #MSP https://www.lumen.com/blog/en-us/silent-train-volt-typhoon-operational-framework

• View post

  Cisco confirms exploitation of CVE-2026-76418 in ASA/FTD SSL VPN. An unauthenticated request can reboot vulnerable firewalls when secondary authentication is configured. For admins: check tunnel groups, assess VPN exposure, and install fixed builds. Disabling secondary auth is listed as a mitigation, but it weakens protection. This is an availability risk, not a data breach. https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-tunnel-dos-s6mgkb75

• View post

  Alpine Linux says attackers tried CVE-2026-97229 against its GitLab server. No successful code execution was found, but it couldn't be ruled out; Alpine rebuilt the instance. The operational lesson: its custom image was still vulnerable after a GitLab upgrade because the bundled Ruby lacked the fix. If you run GitLab from source or a custom image, check the Ruby version as well as GitLab's release. https://alpinelinux.org/posts/GitLab-security-incident-CVE-2026-97229.html

• View post

  TianoCore disclosed CVE-2026-97631 (9.5) in EDK II's PXE boot driver. Crafted ICMP errors during network boot may hang affected systems or permit targeted pre-OS code execution. For MSPs/admins: inventory PXE-boot systems, disable network boot where unused, isolate provisioning traffic, and check for vendor firmware updates. Exposure is during PXE boot, not every startup. TianoCore lists no patched release. https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m

• View post

  Cequence says it tracked one scanner cycling through ~32 AI crawler identities while requesting .env files, cloud credentials, and private keys from web servers. The researchers did not report a confirmed breach. For admins: don't treat a bot's User-Agent label as proof of trust. Keep secrets out of web-accessible paths, review logs for sensitive-file probes, and verify automated clients using stronger signals. https://www.cequence.ai/blog/ai-agent-impersonation

• View post

  Cisco Talos' Q3 2026 IR report flags help-desk impersonation and remote-support tool abuse. In one case, a user was tricked into Quick Assist; attackers then used existing RMM software. The exact pretext wasn't confirmed. For MSPs: verify support requests through known channels and alert on unexpected RMM sessions. Ransomware/pre-ransomware appeared in 27% of Talos IR cases, not all incidents worldwide. https://blog.talosintelligence.com/ir-trends-q3-2026/ #Cybersecurity #Infosec #MSP

• View post

  Microsoft says October 2026 Windows updates fix Remote Desktop error 0xC000000D for non-admin users on Windows 11 hosts with Administrator protection enabled. For admins: check the correct update for each Windows 11 version before disabling that protection. The issue primarily affects enterprise-managed RDP hosts using this security feature, not all Remote Desktop connections. https://learn.microsoft.com/windows/release-health/status-windows-11-26H2 #Cybersecurity #Infosec #SysAdmin

• View post

  What keeps me in IT and cybersecurity isn't any particular tool. It's the moment a problem finally makes sense and someone can get back to their day. MSP work shows you how much people depend on technology. I enjoy troubleshooting, but also making systems more reliable so the same issues don't keep coming back. That carries into building apps through RelayByte. I want to make useful things that solve real problems. What got you interested in your work? #Cybersecurity

• View post

  Socket found 319 Chrome extensions with roughly 13.4M reported installs over a decade. They changed default search engines and sent queries through operator-run proxies before Bing or Yahoo. For admins: some requested no special permissions. Check installed extension IDs, search-provider settings, and browser extension policies. Researchers did not confirm phishing or malware redirects. https://www.socket.dev/blog/searchjacked #Cybersecurity #Infosec #MSP #BrowserSecurity

• View post

  Ransomnews counted 484,142 publicly listable cloud buckets with ~18B indexed files in October 2026. That's not 484K breaches. Many buckets are public by design, and researchers did not open files to verify contents. For MSPs: audit anonymous access, protect backup/export storage, and check for publicly listed secrets or infrastructure state files. Fix access policies, not just individual files. https://ransomnews.com/cloud-exposure-index-2026/ #Cybersecurity #Infosec #MSP #CloudSecurity

• View post

  RIP to a legend…

• View post

  StylePort is now waiting for the review by Apple! Hopefully we can get this approved soon and on the Mac App Store. Direct download version is available now. https://styleport.app

• View post

  Polymarket paused trading Oct. 29 after a vendor compromise. Hudson Rock found wallet-draining code in a monitoring script. DebugBear told RUM users to remove its embed. For admins: audit third-party JS on authenticated pages, remove unneeded embeds and review CSP/SRI. Initial access and total losses remain unverified. https://www.infostealers.com/article/polymarket-breach-alert-wallet-draining-code-found-in-a-third-party-script/ #Cybersecurity #Infosec #WebSecurity #SupplyChainSecurity

• View post

  Pluto Security found 31 malicious Hugging Face model repos delivering miners and backdoors through trust_remote_code=True. Some payloads scanned clean, and code ran before the model loaded. For admins using local AI/GPU hosts: review custom model Python, pin revisions, isolate workloads and hunt for persistence if a model ran. 32K+ downloads aren't confirmed infections. https://pluto.security/blog/hugging-face-malware-campaign-load-mine/ #Cybersecurity #Infosec #AISecurity #SysAdmin

• View post

  Volexity documented attackers chaining Ivanti Connect Secure auth bypass/RCE (CVE-2026-104935) with privilege escalation (CVE-2026-111357) to gain root. CISA added 104935 to KEV Oct. 13, not 111357. For admins: review Ivanti updates and investigate affected gateways. Patching can't rule out earlier compromise. https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/ #Cybersecurity #Infosec #MSP #VPN

• View post

  GPT-6 Astra and the Supply Chain Attack It Wasn’t Asked to Launch https://securityaffairs.com/199947/ai/gpt-6-astra-and-the-supply-chain-attack-it-wasnt-asked-to-launch.html

• View post

  Office 365 Tenant to Tenant Migration: Steps and Best Practices https://www.cm-alliance.com/cybersecurity-blog/office-365-tenant-to-tenant-migration-steps-and-best-practices

• View post

  A client can have a legitimate complaint and still ask for the wrong fix. Turning off MFA or giving everyone admin access can leave a bigger problem behind. I wrote about where MSPs need to push back, what they owe the client, and when a service needs a firm boundary. https://www.kylereddoch.me/blog/the-customer-isnt-always-right-about-it/ #MSP #ITSupport #Cybersecurity

• View post

  Still not going to be enough… Okta bets on identity to control AI agents, but is identity enough? https://www.csoonline.com/article/4225230/okta-bets-on-identity-to-control-ai-agents-but-is-identity-alone-enough.html

• View post

  Beware these fake websites selling subscriptions to AI assistants https://www.csoonline.com/article/4224923/beware-these-fake-websites-selling-subscriptions-to-ai-assistants-2.html

• View post

  Cisco Warns of Ongoing Exploitation of Critical Email Gateway Zero-Day https://securityaffairs.com/199137/hacking/cisco-warns-of-ongoing-exploitation-of-critical-email-gateway-zero-day.html #cybersecurity

• View post

  Microsoft confirms KB5002914 Excel update breaks copy and paste https://www.bleepingcomputer.com/news/microsoft/microsoft-september-kb5002914-security-update-breaks-excel-copy-and-paste/

• View post

  Hey Indie App Devs, I looking for some input on an app I'm building for iPhone, iPad, and Mac that gives people one place to keep the practical details of how their home works and share that knowledge with someone else. Think about all the things one person in a household tends to know: which air filter to buy, how to restart the internet equipment, where the water shutoff is, which appliance setting actually works, or who to call when something needs attention. Those details can end up sca...

• View post

  Looks like Proton is having a global outage. https://status.proton.me #Proton

• View post

  New by me: CybersecKyle Security How-To Series: Blue Team Fundamentals, Part 3 - Vulnerability Scanning with Real Triage https://www.kylereddoch.me/blog/cyberseckyle-security-how-to-series-blue-team-fundamentals-part-3-vulnerability-scanning-with-real-triage/ #Cybersecurity #InfoSec #VulnerabilityManagement #BlueTeam #CybersecKyleHowTo

• View post

  Vulnerability Summary for the Week of July 27, 2026 | CISA https://www.cisa.gov/news-events/bulletins/sb26-215 #cybersecurity #vulnerability

• View post

  AI Runs the Hack: Chinese Actor Automates Cyberattacks With DeepSeek https://securityaffairs.com/196544/ai/ai-runs-the-hack-chinese-actor-automates-cyberattacks-with-deepseek.html #cybersecurity