News · BaselineWatch

r/blueteamsec 41 min ago

Silent Train: uncovering Volt Typhoon's operational framework for zero-day exploitation and strategic access

r/blueteamsec · lumen.com

r/blueteamsec 3 h ago

SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage Attacks

r/blueteamsec · hybrid-analysis.blogspot.com

r/blueteamsec 3 h ago

Chained PHP2Shell Exploit Roots 25 Servers

r/blueteamsec · dreamgroup.com

r/blueteamsec 4 h ago

I recreated a Node2Shell (CVE-2026-111497) RCE attack in the form of an interactive exercise

On 21 October 2026, Google released patched versions of its Brotli compression library for CVE-2026-111497, a vulnerability nicknamed Node2Shell. It is an out-of-bounds write in the Brotli decoder (fixed builds 1.0.10, 1.1.1 and 1.2.1), reachable through Content-Encoding: br on both incoming requests and fetched responses. I made an interactive, hands-on lab exercise on this vulnerability. The go…

CVE-2026-111497

r/blueteamsec 4 h ago

68 GB Stolen From a Philippine Government Agency’s Overseas-Employment Databases, Exposed by the Operator’s Own Open Directory

r/blueteamsec · hunt.io

r/blueteamsec 4 h ago

Unveiling Sirius Backdoor: A Multistage Fileless Campaign Disguised as FedEx Invoices

r/blueteamsec · trellix.com

r/blueteamsec 6 h ago

APT Activity Report - Q2 Q3 2026

r/blueteamsec · web-assets.esetstatic.com

r/blueteamsec 8 h ago

Stealing OpenAI Reasoning Traces via Compaction Smuggling

r/blueteamsec · xint.io

r/blueteamsec 8 h ago

Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles

r/blueteamsec · wiz.io

r/blueteamsec 8 h ago

CISA 2030

r/blueteamsec · cisa.gov

r/blueteamsec 8 h ago

Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analytics

r/blueteamsec · sansec.io

r/blueteamsec 10 h ago

IR 8547, Transition to Post-Quantum Cryptography Standards

r/blueteamsec · csrc.nist.gov

r/blueteamsec 11 h ago

NSM hever det nasjonale cyberrisikonivået til HØYT - NSM raises the national cyber risk level to HIGH

r/blueteamsec · nsm.no

r/blueteamsec 11 h ago

The 2025-26 Annual Cyber Threat Report highlights key threats, responses and security advice for Australians.

r/blueteamsec · cyber.gov.au

r/blueteamsec 14 h ago

php2shell in Practice: Exploitable, Conditional, and Hard to Mass-Exploit

r/blueteamsec · praetorian.com

r/blueteamsec 19 h ago

Alleged Israeli spy company heavily targeted Starlink users, sources say

r/blueteamsec · reuters.com

r/blueteamsec 19 h ago

Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million in Losses

r/blueteamsec · justice.gov

r/blueteamsec Tue 27 Oct

Check if your AWS keys were stolen in the LiteLLM attack

Saw this post on how to check if your CloudTrail bucket was compromised in the LiteLLM attack today

r/blueteamsec Tue 27 Oct

Cybercrime ring busted over AI-powered data theft targeting hospitals, businesses

r/blueteamsec · m-en.yna.co.kr

r/blueteamsec Tue 27 Oct

unthemidator: An automated Themida / Code Virtualizer / WinLicense (v3.0-v4) unpacker and dump fixer tool

r/blueteamsec · github.com

r/blueteamsec Tue 27 Oct

Generic.Detection.Yara.PHP2Shell for Velociraptor

r/blueteamsec · docs.velociraptor.app

r/blueteamsec Tue 27 Oct

Kernel eviction notice: What wesp.sys reveals about the Windows Endpoint Security Platform

r/blueteamsec · elastic.co

r/blueteamsec Tue 27 Oct

Continuous security validation turned into a SOC incident

We had a validation run recently that did exactly what it was supposed to do technically and still created a mess operationally. The attack behavior landed, detections fired, SIEM picked everything up. Great. Except the SOC had no idea it was a test, one alert escalated like a real incident, and suddenly people were trying to work out whether we had an actual compromise or somebody had kicked off…

r/blueteamsec Tue 27 Oct

CVE Intel: open-source CVE triage tool.

I posted about this application a few weeks ago and I got really good advice from this reddit cybersecurity community. Thank you! Since then, I have made some progress. Those who don't know CVE Intel is an open-source tool that pulls CVE data from NVD, CISA KEV, EPSS, OSV and public exploit sources into one place. You can use it as a desktop app, CLI, REST API or MCP server. Here's what changed b…

r/blueteamsec Mon 26 Oct

ThreatLens v2.3 is Now Live! Introducing Privacy Controls, IOC Watchlist, and Apache-2.0 License

I’ve been working on the next ThreatLens update before moving on to v3, with a focus on making investigations safer and more useful in day-to-day workflows. ThreatLens brings threat-intelligence lookups for IPs, domains, URLs, file hashes, and CVEs into one CLI workflow. The v2.3 work adds: Privacy modes: Choose standard, passive, approved-provider-only, or local-cache-only investigations. Use --…

r/blueteamsec Mon 26 Oct

PHP2Shell: Critical PHP Vulnerabilities Enable Unauthenticated Remote Code Execution

r/blueteamsec · arcticwolf.com

r/blueteamsec Mon 26 Oct

Social Security truths

r/blueteamsec · x.com

r/blueteamsec Mon 26 Oct

Context Bombs: Making attacking agents pay

r/blueteamsec · agentic.tracebit.com

r/blueteamsec Mon 26 Oct

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 25) - "We are unable to confirm that initial access is associated with the specific PHP2Shell CVEs. We have retracted our previous update from October 23."

r/blueteamsec · unit42.paloaltonetworks.com

CVE-2026-109618, CVE-2026-109619

r/blueteamsec Mon 26 Oct

CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure

r/blueteamsec · cyfirma.com

r/blueteamsec Mon 26 Oct

UAC-0246 Hackers Masquerade as Tax Authorities and Banks to Compromise Devices

r/blueteamsec · cip.gov.ua

r/blueteamsec Mon 26 Oct

ABC wipes staff devices exposed to new, sophisticated cyber attack

r/blueteamsec · abc.net.au

r/blueteamsec Mon 26 Oct

CVE-2026-114625: VeloCloud Orchestrator privilege escalation exploited in the wild. Read-only portal accounts can reach local superuser.

Heads up for anyone running on-prem VeloCloud Orchestrator. CVE-2026-114625 (CVSS 9.9) lets an authenticated user with only Enterprise Read Only portal access escalate to local superuser on the VCO host. Arista reports active exploitation. What’s known so far: → Only on-prem VCO deployments are affected → The attacker needs only the lowest-privilege portal role → Arista observed attack traffic fr…

CVE-2026-114625