upsy.si — cybersecurity

YARA-X 1.22.1 Release, (Sat, Oct 31st)

YARA-X 1.22.1 Release, Author: Didier Stevens

Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer

The self-deleting VOLTA infostealer steals credentials, sessions, and cryptocurrency wallets. Then, it uses LLMs to profile victims and rank their most valuable assets.

YARA-X 1.22.0 Release, (Sun, Oct 25th)

YARA-X 1.22.0 Release, Author: Didier Stevens

Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data

American blockchain analysis firm Chainalysis said it was the target of a cybersecurity incident in which an external actor accessed non-sensitive customer data. However, the company noted…

CISA Adds Two Known Exploited Vulnerabilities to Catalog

A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats

Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV)…

Cloudflare Reports 18.2 Million Network-Layer DDoS Attacks in Q3, Up 38%

Friday Squid Blogging: Bigfin Squid Off California Coast

Neat video : The sighting, announced September 2, marks the first time anyone has spotted a live bigfin squid, which belongs to the Magnapinna genus, in the northeastern Pacific Ocean. As…

Bloatware in Aftermarket Auto Parts

This story is interesting: One Civic owner purchased a cheap aftermarket head unit off Amazon, and decided to have Claude work its magic on it, like it would a smart TV. What was reportedly…

PHP had a rough week for security, but the pain isn't over yet

A wave of mass website hacks was largely averted. Here are the main takeaways from the PHP-ocalypse — with bonus video.

Hitachi Energy CoreTec Product

Hitachi Energy TRO600 series products

Siemens Mendix SAML Module

ISC Stormcast For Friday, October 30th, 2026 https://isc.sans.edu/podcastdetail/10158, (Fri, Oct 30th)

ISC Stormcast For Friday, October 30th, 2026 https://isc.sans.edu/podcastdetail/10158, Author: Johannes Ullrich

CISA Adds One Known Exploited Vulnerability to Catalog

Siemens RUGGEDCOM CROSSBOW

Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP

Siemens Industrial Edge Device Kit

Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript Engines

Summary Project Zero compared two automated tools used by Google to find vulnerabilities in Chrome’s JavaScript engine, V8, on a regular basis. Fuzzilli is a generative JavaScript engine…

IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases

Phishing remained the leading initial access technique, while percentage of ransomware and pre-ransomware cases increased. Finance and public administration tied as the top-targeted…

NIK C2: The new AI-enabled command-and-control framework

Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.”

Widespread PHP Flaw May Cause Many Site Outages Today

Expect to see quite a few websites serving "404" or "Page Not Found" errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that…

Feds Suspect Ransom Negotiator Ran ShinyHunters Extortion Site

U.S. federal investigators pursuing the ShinyHunters hacking group that recently stole highly sensitive data from the FBI have identified executives at two different ransomware negotiation…

Microsoft Patches More Than 1,400 Security Flaws

Microsoft today issued updates to fix more than 1,400 security vulnerabilities in its Windows operating systems and other software. Today's epic patch batch dwarfs September's record of…

U.K. Sanctions Cryptomus for RU Money Laundering

The United Kingdom has issued economic sanctions against Cryptomus, a chameleonic cryptocurrency platform that experts say serves as a major conduit for payments related to ransomware…

Deploying a Local Ghidra Server for Your Malware Analysis Lab, (Thu, Oct 29th)

Building your malware analysis lab is a key point before playing with malware. Today, thanks to virtualization, it&#;x26;#;39;s convenient to play with snapshots in your lab. Start a new…

ISC Stormcast For Thursday, October 29th, 2026 https://isc.sans.edu/podcastdetail/10156, (Thu, Oct 29th)

ISC Stormcast For Thursday, October 29th, 2026 https://isc.sans.edu/podcastdetail/10156, Author: Johannes Ullrich

Yet Another ClickFix Campaign, (Wed, Oct 28th)

Yet Another ClickFix Campaign, Author: Brad Duncan

Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN

Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass…

Politicians in U.S. and E.U. Say Targeted Ads Are a Security Risk

Politicians in Europe and the U.S. are speaking out against the use of advertising technology to infect targets with zero-click spyware.

Billions stolen in Binance hack

Billions stolen from Binance in a crypto hack, Last week’s PHP2Shell bugs are being exploited to hack Palo Alto Networks firewalls, The Br [Read More]

Hiding Capabilities in AI Models

Interesting research: “AI Models Can Provably Hide Arbitrary Capabilities” Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability…

ISC Stormcast For Wednesday, October 28th, 2026 https://isc.sans.edu/podcastdetail/10154, (Wed, Oct 28th)

ISC Stormcast For Wednesday, October 28th, 2026 https://isc.sans.edu/podcastdetail/10154, Author: Johannes Ullrich

How Generative AI is Scaling Transnational Repression

Kate Pundyk, Siena Anstis, and Marcus Michaelsen write about the rise of AI-enabled digital transnational repression in their piece for Just Security.

Serbian Prosecutor Who Investigated Belgrade Trump Tower Project ‘Targeted with Spyware’

New findings by the Citizen Lab and SHARE Foundation show that a prominent supporter of Serbia's student movement was targeted with spyware.

From federal SOCs to Talos: Ryan Fetterman on practical security research

What does it mean to be "blue collar" for the blue team? Ryan Fetterman discusses the realities of detection engineering, and shares his philosophy on building a career in security without…

Weekly Update 527: Cybergeddon News v. Reality

As the news from last week has settled down, it would seem this headline was pretty spot on. The foretold apocalypse didn't eventuate, and there were no internet-destroying outages. In…

Studying Fraudulent North Korean IT Workers

Researchers set up a fake start-up company to study fraudulent North Korean IT workers.

Built-In Weakness: Lawful Access and Encryption in the Age of AI-Powered Cyber Threats

Senior research associate Kate Robertson spoke about the legal concerns that Canada’s proposed Lawful Access Act poses with the Canadian Internet Society.

I had plans for that second

The Earth is speeding up, the leap second is being abolished, oh, and there's critical vulnerabilities in PHP.

Citizen Lab Director Slams Trump Administration, ‘Techno-Fascist’ Executives

Director Ron Deibert spoke to a crowd at SecTor 2026, warning that threats that the Citizen Lab investigates are being “super-charged” thanks to AI.

Compromised eMudhra intermediate certificates

Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra.

Two critical RCEs in PHP core

Two critical remote code execution vulnerabilities in PHP core could have implications across its wider ecosystem. Talos has published a blog to explain what we know so far, and details the…

It sure looks like the Trump administration is weaponizing sanctions to silence its critics

Freezing the assets of international war crimes investigators and forcing the shut down of overseas internet providers to own the libs.

Weekly Update 526: Building HIBP AI/SI First

I have this sense that we've passed the point where "vibe coding" is a derogatory term. I have no empirical evidence for this; it's more a feeling that those weaponising the term have now…

PSA: How to check if that Amazon call, email, or text message is a scam

The message verification feature lets you check if outreach is real — or a scam.

Weekly Update 525: AI Data Breach Hyperbole

I remember the name of that AI doco now - The AI Doc: Or How I Became an Apocaloptimist . I was watching it on the long-haul flight home the other day, and what I found particularly…

MapQuest now lets you locate nearby surveillance cameras, like Flock

The decades-old online map app is watching the watchers.

The Lawful Access Act’s threats to Canada’s national security

Kate Robertson warns that Bill C-22 poses risks to Canada's national security in this piece for The Globe and Mail.

Between Two Nerds: Why frontier lab security will always suck

In this edition of Between Two Nerds Tom Uren and The Grugq talk about security culture. The PHP foundation seems to have had a change of heart about security, but what are the chances that…

Srsly Risky Biz: Chinese AI can learn to love the West

Tom Uren and Amberleigh Jack talk about new research that shows that Chinese open-weight AI models can be reeducated to remove pro-CCP bias. Good news for American businesses that want…

Bias in Qwen3-Coder Model

Interesting research : TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes…

Friday Squid Blogging: Increasing Squid Populations

This article in Nature argues that it’s due to an overfishing of predators and warming sea temperatures. As usual, you can also use this squid post to talk about the security stories in the…

Compromised TLS Certificates

The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys: The compromised eMudhra keys were defective at a level that’s challenging the imagination of many…

New Serious PHP Vulnerabilities Released and Patched

PHP maintainers have released fixes for two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code…

Risky Bulletin: Moldovan public services crippled by cyberattack

Moldova takes down more than 80 public services after a cyberattack, the White House launches a new cybersecurity pilot program, South Korea arrests an AI-assisted cybercrime ring, and the…

Srsly Risky Biz: OpenAI's Kazoo-Grade Spying Incident

Tom Uren and Amberleigh Jack talk about the weird bugging incident at OpenAI. It doesn’t look at all like it was normal state-backed espionage, but there are still good reasons the frontier…

Risky Bulletin: Linux patches PwnEscape KVM vulnerability

A serious vulnerability lets attackers escape Kernel-based virtual machines, OpenCode users become collateral damage in a distillation attack, supply chain incidents hit AOMEI and…

Risky Bulletin: DataSuckers suspects arrested in Russia

Three DataSuckers hacking group suspects arrested in Russia, Al Jazeera employees targeted with Candiru spyware, the US disrupts 40 North Korean laptop farms, and an OpenAI employee was…

Risky Bulletin: Brotli RCE is wrecking what's left of the internet

While everyone was distracted by PHP, another RCE has been wrecking the internet, Australia