← Feed

Posts

• View post

  Quick heads up: the forum is going to blip for a minute or two while we increase the RAM because uhhhh we've had a noticeable increase in traffic the last two days.

• View post

  If you are able to contact folks at local schools, governments, nonprofits, and other services to warn them about the PHP vulnerabilities, please consider doing so. These locations often do not have dedicated security staff and almost certainly have PHP assets exposed. #ThreatIntelIsMutualAid #TIIMA

• View post

  The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits. https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914 #PHP2Shell #ThreatIntelligence #ThreatIntel #IFIN

• View post

  While you were patching PHP, LiteLLM went and got compromised again. https://ifin.network/t/litellm-compromised-again-credential-stealer-and-backdoor/919 #ThreatIntel #ThreatIntelligence #IFIN

• View post

  If you run GitLab, you've handled some bad vulns recently, so what's one more? Perfect 10 patched today. https://ifin.network/t/cve-2026-110264-integer-overflow-in-gitlab-regex-compiler/920 #ThreatIntel #ThreatIntelligence #IFIN

• View post

  After reviewing the "evidence" of exploitation of #PHP2Shell and finding it wanting, we have removed the "EITW" tag from our story. Our standard for "exploited in the wild" is not sprays against targets. It is direct observables from successful exploitation. That's a higher bar to clear, but for such a scary vulnerability, hardly impossible. So far however, we have not seen that level of evidence.

• View post

  We will have useful detections for #PHP2Shell in our post and in MISP shortly. We're doing rigorous validation to make sure we don't provide nonsense.

• View post

  As promised, we've updated our #PHP2Shell story with detailed observable indicators. These are based on a broad review of working proofs-of-concept, and should yield high-fidelity hunts and detections. They've also been added to our MISP feed. https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914 #ThreatIntel

• View post

  IFIN will be submitting commentary in strong opposition to the obviously dangerous requested TLDs in the latest round of applications to ICANN. Anything that is approved and still dangerous will be added to the IFIN Lists for easy blocking. We encourage others to submit commentary starting November 17. https://www.icann.org/en/announcements/details/icann-reveals-2026-round-applications-for-new-generic-top-level-domains-07-10-2026-en

• View post

  An Ivanti 0-day auth bypass is being exploited in the wild with significant post-exploitation activity. https://ifin.network/t/cve-2026-104935-ivanti-connect-secure-auth-bypass-exploited-for-privilege-escalation-code-execution/900 #ThreatIntel #ThreatIntelligence #IFIN

• View post

  Let's reset expectations about sharing information. When defensive action is possible, more sharing means more safety for all of us. https://ifin-intel.org/blog/tlp-clear/

• View post

  tap tap

• View post

  If your Palo Alto management interface is internet-exposed, you might notice even more traffic on it today. But if that was your security posture, maybe you're fine with that. Anyway this is exploited in the wild. Authenticated, so creds required. https://ifin.network/t/cve-2026-0322-authenticated-rce-in-pan-os/903 #ThreatIntel #ThreatIntelligence #IFIN

• View post

  Microsoft 365 tenants have been compromised via a stolen ConnectWise Cloud Backup credential. We have the details and investigation steps you need if you use this application in your environment. https://ifin.network/t/unauthorized-access-in-connectwise-cloud-backup/906 #ThreatIntel #ThreatIntelligence #IFIN

• View post

  Based on our data y'all sure do love to link us in Teams chats. We're very sorry you have to use Teams.

• View post

  The best time to block the finger protocol (port 79/tcp) outbound from your network was like…the second Clinton administration? But now's a good time too. #ThreatIntel #ThreatIntelligence #IFIN

• View post

  Two Check Point critical vulnerabilities are now listed as exploited in the wild. https://ifin.network/t/cve-2026-85102-and-93616-check-point-security-gateway-rce-path-traversal-exploited/853 #ThreatIntel #ThreatIntelligence #IFIN

• View post

  Our new project: IFIN Lists is a curated set of permanent blocks and perennial hunts that go beyond traditional indicators to include abused "legitimate" services that most organizations should not tolerate. https://ifin-intel.org/blog/lists/ #ThreatIntel #ThreatIntelligence #TIIMA

• View post

  Ah, I see the fear-mongering around the "open source" (not a thing; they mean open-weights, but actually really they mean "Chinese") models has kicked into high gear. https://www.cybersecuritydive.com/news/openai-hugging-face-hack-ai-models-black-hat/827167/

• View post

  We're thrilled to announce IFIN has achieved 501(c)(3) recognition! Now we can get down to business. https://ifin-intel.org/blog/nonprofit/ #IFIN

• View post

  RE: https://mastodon.social/@zackwhittaker/117037185272316538 Folks fighting for ad blockers in your orgs: https://ifin-intel.org/blog/ad-blocker/

• View post

  The critical SharePoint vulnerability CVE-2026-50522 now appears to be under massive exploitation. We have context and current IOCs in this post. We've also updated the MISP feed with the same. #ThreatIntel #ThreatIntelligence #IFIN https://discourse.ifin.network/t/microsoft-sharepoint-cve-2026-50522/678

• View post

  Fantastic research by our community here on a continuing Lua-based campaign that uses Prometheus obfuscation and our old friend Etherhiding for C2 configuration acquisition. https://discourse.ifin.network/t/luajit-loader-uses-prometheus-obfuscation-and-etherhiding/679 #ThreatIntel #ThreatIntelligence #IFIN

• View post

  Yet another attack against the Arch User Repository is underway. We are monitoring and analyzing the malware samples. https://discourse.ifin.network/t/new-aur-attack-prompts-adoption-lock/698 #ThreatIntel #ThreatIntelligence #IFIN

• View post

  We've compiled the latest information regarding the Minnesota water systems attacks. https://discourse.ifin.network/t/minnesota-water-system-suffers-a-breach-due-to-exposed-access-keys/695 #ThreatIntel #ThreatIntelligence #IFIN

• View post

  We caught a sample of ACR Stealer and went deep on it. Lots of sophistication for "just" an infostealer. https://discourse.ifin.network/t/acr-stealer-clickfix-etherhiding-and-stego-oh-my/694 #ThreatIntel #ThreatIntelligence #IFIN

• View post

  There are security patches available for Discourse so the forum will go down shortly for updates. Be back soon!

• View post

  We continue to use our own RSS-Filter project to curate our feed aggregator. We've removed "Startups" from the other-wise excellent TechCrunch security news feed to keep the feed relevant and actionable. Our Newsfeed: https://news.ifin.network RSS-Filter: https://codeberg.org/ifin/rss-filter

• View post

  Following up on a Fediverse tip, we found a new use for fake software download sites: the referral program hustle. Mirror FOSS, get cash. There are almost certainly more of these out there. https://discourse.ifin.network/t/pdf-arranger-and-terabox-referrals-lamer-than-malware/683 #ThreatIntel #ThreatIntelligence #IFIN

• View post

  With confirmed exploit sources, we've now added this one to our MISP feed. https://discourse.ifin.network/t/microsoft-sharepoint-cve-2026-50522/678/2 #ThreatIntel #ThreatIntelligence #IFIN