The Backdoor Wants the File You Just Saved
A Windows backdoor that waits for your next save should worry you more than the ransomware slide. Audit your cybersecurity hunts.
September 2026
Can Your Firewall Follow a Polygon C2?
ChainScript's Polygon C2 and ClickFix lures make perimeter cybersecurity look current while the callback moves. See what to hunt this week.
Private GitHub Is a Loud Command Channel
Private GitHub is live C2, and the AI-escape story is cover. See what this week's cybersecurity failures mean for your repos.
The Agent Already Took the Data
Spain filed an agentic data theft. Your cybersecurity stack still starts too late. Check the login trail.
Hijacked Session Spread Worms to 100 Repos
A hijacked AI coding session spread Shai-Hulud through 100 repos. See what cybersecurity teams should lock down before the next suggestion.
MQTT Keepalives Hid Three Years of Access
BambooToken used MQTT keepalives as C2 for years. See how to treat brokers as command servers and cut dwell. Check your allows.
Your Confidential VM Believed the Old Write
DDRop starves DRAM writes and fools TDX and SEV. Your cybersecurity isolation pitch just met a circuit. Check the real threat model.
Five Centers. You Still Own Every Outage.
NSA's five mission centers will not shorten your outage. See what the cybersecurity reorg actually changes for intel, detection, and IR. Read the checklist.
One Kit Now Chains Chrome and Windows for Multiple Spies
BlueMoon now chains Chrome and Windows zero-days for multiple spies. See how cybersecurity teams hunt the shared kit. Check your detections.
Twenty Agencies Faced a Model Operator
Russia-linked spies used Claude against 20+ agencies. See what model-paced ops mean for your cybersecurity program, then close the gaps.