Nostr notes by IFIN - The Independent Federated Intelligence Network

We have finally listed #PHP2Shell as exploited in the wild with ...

2026-10-28T19:29:57Z

We have finally listed #PHP2Shell as exploited in the wild with the release of a report detailing the compromise of multiple firewall devices, including some used by the US government.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#ThreatIntel

Knock Knock Who's there? A trusted client Show me some ID ...

2026-10-27T23:19:58Z

In reply to nevent1q…n99t
_________________________

*Knock Knock*

Who's there?

*A trusted client*

Show me some ID

*Here is the number 4 repeated 20 times*

Welcome back!

Do you use mutual TLS with your network appliances? You might ...

2026-10-27T22:59:34Z

Do you use mutual TLS with your network appliances? You might want to check whether they use a vulnerable version of the GoAhead web server, which has some significant weaknesses in its client certificate verification.

https://ifin.network/t/goahead-tls-vulnerabilities-break-certificate-validation-session-encryption/934

#ThreatIntel #IFIN

Node and Python were feeling left out, so here's an RCE that ...

2026-10-23T18:31:51Z

Node and Python were feeling left out, so here's an RCE that needs attention. The Node issue, referred to as #Node2Shell, appears fairly exploitable. Check your Node versions and update. Check for affected Python packages as well.

https://ifin.network/t/cve-2026-111497-brotli-out-of-bounds-write-impacts-node-python/929

#ThreatIntel

As promised, we've updated our #PHP2Shell story with detailed ...

2026-10-22T19:53:22Z

As promised, we've updated our #PHP2Shell story with detailed observable indicators. These are based on a broad review of working proofs-of-concept, and should yield high-fidelity hunts and detections. They've also been added to our MISP feed.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#ThreatIntel

We will have useful detections for #PHP2Shell in our post and in ...

2026-10-22T17:24:56Z

We will have useful detections for #PHP2Shell in our post and in MISP shortly. We're doing rigorous validation to make sure we don't provide nonsense.

Yes

2026-10-22T15:02:00Z

In reply to nevent1q…3zem
_________________________

Yes

After reviewing the "evidence" of exploitation of ...

2026-10-22T06:02:54Z

After reviewing the "evidence" of exploitation of #PHP2Shell and finding it wanting, we have removed the "EITW" tag from our story.

Our standard for "exploited in the wild" is not sprays against targets. It is direct observables from successful exploitation. That's a higher bar to clear, but for such a scary vulnerability, hardly impossible. So far however, we have not seen that level of evidence.

While you were patching PHP, LiteLLM went and got compromised ...

2026-10-21T20:56:46Z

While you were patching PHP, LiteLLM went and got compromised again.

https://ifin.network/t/litellm-compromised-again-credential-stealer-and-backdoor/919

#ThreatIntel #ThreatIntelligence #IFIN

RE: https://infosec.exchange/@ifin/117479300792253074 We now have ...

2026-10-21T17:03:41Z

RE: https://infosec.exchange/@ifin/117479300792253074

We now have sufficient confirmation to call these exploited in the wild.

quoting
note1nv9…qjpn

The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#PHP2Shell #ThreatIntelligence #ThreatIntel #IFIN

The official advisory and patches have been released. We continue ...

2026-10-21T14:11:10Z

The official advisory and patches have been released. We continue to track emergence of proofs-of-concept and exploits.

https://ifin.network/t/cve-2026-109618-cve-2026-109619-remote-code-execution-in-php/914

#PHP2Shell #ThreatIntelligence #ThreatIntel #IFIN

Big sites are already going dark. A school may be able to knock ...

2026-10-21T13:11:50Z

In reply to nevent1q…q7yf
_________________________

Big sites are already going dark. A school may be able to knock off access to their public sites until patching. Worth a shot!

If you are able to contact folks at local schools, governments, ...

2026-10-21T13:05:56Z

If you are able to contact folks at local schools, governments, nonprofits, and other services to warn them about the PHP vulnerabilities, please consider doing so. These locations often do not have dedicated security staff and almost certainly have PHP assets exposed.

Quick heads up: the forum is going to blip for a minute or two ...

2026-10-21T12:38:58Z

Quick heads up: the forum is going to blip for a minute or two while we increase the RAM because uhhhh we've had a *noticeable increase* in traffic the last two days.

Okay, Edge is updated, and so is Windows curl and PowerShell.

2026-10-20T21:08:59Z

In reply to nevent1q…zwvc
_________________________

Okay, Edge is updated, and so is Windows curl and PowerShell.

We've confirmed (thanks @npub1kws…0n5s!) that Edge remains ...

2026-10-20T17:48:17Z

In reply to nevent1q…zwnx
_________________________

We've confirmed (thanks Buttered Jorts (npub1kws…0n5s)!) that Edge remains unpatched as of this writing.

Eight intermediate certificates used by eMudhra/Emsign have been ...

2026-10-20T15:02:32Z

Eight intermediate certificates used by eMudhra/Emsign have been compromised. These certificates are in multiple trust stores. This will require significant manual action to remediate, including the updates of several packages.

https://ifin.network/t/emudhra-intermediate-certificates-compromised/909

#ThreatIntel #ThreatIntelligence #IFIN

tap tap ...

2026-10-14T20:40:23Z

*tap tap*

Let's reset expectations about sharing information. When ...

2026-10-13T15:32:12Z

Let's reset expectations about sharing information. When defensive action is possible, more sharing means more safety for all of us.

https://ifin-intel.org/blog/tlp-clear/

IFIN will be submitting commentary in strong opposition to the ...

2026-10-10T00:16:58Z

IFIN will be submitting commentary in strong opposition to the obviously dangerous requested TLDs in the latest round of applications to ICANN. Anything that is approved and still dangerous will be added to the IFIN Lists for easy blocking.

We encourage others to submit commentary starting November 17.

https://www.icann.org/en/announcements/details/icann-reveals-2026-round-applications-for-new-generic-top-level-domains-07-10-2026-en

Once again: Evidence of exploitation attempts Is not Evidence ...

2026-10-09T15:10:04Z

Once again:

Evidence of exploitation *attempts*

Is not

Evidence of *exploitation*

That's a much higher bar to clear.

If you are having #Citrix #Netscaler issues after applying all ...

2026-10-03T03:48:03Z

If you are having #Citrix #Netscaler issues after applying all patches and remediations and want to confidentially share intel, let us know: tips@ifin-intel.org

PGP key available at https://ifin-intel.org/contact/

Sigh The new reports of further exploitation of Citrix devices ...

2026-10-02T19:42:54Z

*Sigh*

The new reports of further exploitation of Citrix devices and all known observables have been added to our report/MISP feed.

https://ifin.network/t/multiple-citrix-netscaler-0-days-exploited/867

#Citrix #PitScaler #ThreatIntel #ThreatIntelligence #IFIN

If you're involved in vulnerability management/VulnOps, the ...

2026-09-29T15:32:12Z

If you're involved in vulnerability management/VulnOps, the last several months have been overwhelming. But take heart: there is a path forward, despite the madness surrounding us.

https://ifin-intel.org/blog/vuln-flood/

Based on our data y'all sure do love to link us in Teams ...

2026-09-28T19:02:21Z

Based on our data y'all sure do love to link us in Teams chats.

We're very sorry you have to use Teams.

Based on a community tip (we love those!), we discovered yet ...

2026-09-16T15:49:03Z

Based on a community tip (we love those!), we discovered yet another malware family that's bringing its own Python interpreter—and a few other tricks.

Bring-Your-Own-Python is *so hot right now*

https://ifin.network/t/quickfix-yet-another-bring-your-own-python-payload/841

#ThreatIntel #ThreatIntelligence #IFIN

Our new project: IFIN Lists is a curated set of permanent blocks ...

2026-09-14T15:23:06Z

Our new project: IFIN Lists is a curated set of permanent blocks and perennial hunts that go beyond traditional indicators to include abused "legitimate" services that most organizations should not tolerate.

https://ifin-intel.org/blog/lists/

#ThreatIntel #ThreatIntelligence #TIIMA

Turns out Entra password protection may not be all it's ...

2026-09-08T18:50:05Z

Turns out Entra password protection may not be all it's cracked up to be. A deep dive by one our community members found significant holes.

https://ifin.network/t/entra-password-protection-isnt/816/3

We're thrilled to announce that we'll be at ...

2026-09-01T22:07:08Z

We're thrilled to announce that we'll be at JawnCon (npub1fqu…250v) on October 16th in Philly! Taggart :ifin: (npub1yg8…ccz0) will be presenting "Threat Intel is Mutual Aid: Building a People-First Sharing Network," telling IFIN's story and our work so far.

Also, y'know, swag. Hope to see you there!

PaperCut has released emergency patches for PaperCut NG/MF, with ...

2026-08-27T19:47:12Z

PaperCut has released emergency patches for PaperCut NG/MF, with potential indicators for an active exploitation of a 0-day vulnerability.

https://discourse.ifin.network/t/papercut-emergency-patch/792

#ThreatIntel #ThreatIntelligence #IFIN

PoCs verified, but also details about the exploitation conditions ...

2026-08-26T18:05:07Z

In reply to nevent1q…n355
_________________________

PoCs verified, but also details about the exploitation conditions added. Bottom line: you're probably fine, but check the details.

We have some breaking news. A potential RCE in Apache #Log4J 2 ...

2026-08-26T17:33:01Z

We have some breaking news. A potential RCE in Apache #Log4J 2 (yes, really) appears to have proofs-of-concept. We have the details, the initial bug report, and mitigation recommendations. We are verifying the PoCs currently.

The putative vulnerability is in a non-standard configuration, so the blast radius is mitigated.

https://discourse.ifin.network/t/log4j2-allowlist-bypass-could-allow-for-rce/788

#ThreatIntel #ThreatIntel #IFIN

Expel's recent discovery of SynkLoader combined lots of fun ...

2026-08-24T15:20:41Z

Expel's recent discovery of SynkLoader combined lots of fun behaviors into a single malware sample. There are a couple strong detection opportunities worth reviewing.

https://discourse.ifin.network/t/synkloader-windows-loader-malware-brings-its-own-python-and-lock-screen/780

#IFIN #ThreatIntel #ThreatIntelligence

Rust joins the supply chain party with a set of compromised ...

2026-08-20T16:36:40Z

Rust joins the supply chain party with a set of compromised packages and account takeovers/impersonations today.

https://discourse.ifin.network/t/rust-supply-chain-attack-arrayref-internment-and-append-only-vec-poisoned-by-proc-macro2-typosquat/765

#ThreatIntel #ThreatIntelligence #IFIN #RustLang

We have received reports that this VMWare vulnerability is ...

2026-08-14T18:04:55Z

We have received reports that this VMWare vulnerability is currently exploited in the wild. Our MISP feed has the existing indicators, including the YARA rule for dropped artifacts.

https://discourse.ifin.network/t/cve-2026-59309-critical-auth-bypass-in-broadcom-vmware-vcenter/746

#ThreatIntel #ThreatIntelligence #IFIN

What's wild about this one is phishing could be a one-click ...

2026-08-08T14:51:41Z

In reply to nevent1q…pjtr
_________________________

What's wild about this one is phishing could be a one-click takeover.

You mean there's another serious vulnerability in WordPress ...

2026-08-08T13:45:38Z

You mean there's another serious vulnerability in WordPress core? CVE-2026-64638 chains cross-site scripting to code execution.

If you aren't already on 7.0.3, please patch ASAP. Also, consider limiting login page access.

https://discourse.ifin.network/t/cve-2026-64638-xss2shell-does-what-it-says-patch-wordpress-now/729

#CVE #IFIN #ThreatIntel #ThreatIntelligence

We're thrilled to announce IFIN has achieved 501(c)(3) ...

2026-08-04T15:10:12Z

We're thrilled to announce IFIN has achieved 501(c)(3) recognition! Now we can get down to business.

https://ifin-intel.org/blog/nonprofit/

#IFIN

RE: https://mastodon.social/@zackwhittaker/117037185272316538 ...

2026-08-04T13:19:32Z

RE: https://mastodon.social/@zackwhittaker/117037185272316538

Folks fighting for ad blockers in your orgs: https://ifin-intel.org/blog/ad-blocker/

quoting
note1e4e…gj8u

By me: A major online ads company that claims to serve 1.5 billion ads a day was hacked and began serving malware designed to steal a person's crypto. This is the latest perfect example why you should use an ad-blocker.

More: https://this.weekinsecurity.com/online-advertising-giant-adform-was-hacked-proving-once-again-why-ad-blockers-are-necessary/

Sign up (or RSS!) for the weekly newsletter: https://this.weekinsecurity.com

This isn't really about GitHub other than hosting the code. ...

2026-08-03T16:11:03Z

In reply to nevent1q…y52a
_________________________

This isn't really about GitHub other than hosting the code. At present, the project runs locally on your compute.

However, it is the height of hubris to release a sandboxing tool after the parade of sandboxing escapes we've seen. And to write it all in...TypeScript, no less.

Sorry to disappoint, but there will be no IFIN Threat Actor ...

2026-07-31T17:52:57Z

Sorry to disappoint, but there will be no IFIN Threat Actor Taxonomy. Here's why:

https://ifin-intel.org/blog/attribution/

The easiest way to stop this attack (and the last one, btw) is to ...

2026-07-30T20:28:49Z

In reply to nevent1q…rssj
_________________________

The easiest way to stop this attack (and the last one, btw) is to deny outbound Tor traffic and block downloads from archive.torproject[.]org in your environment. If the payloads can't do that, they can't continue past the first stage.

Yet another attack against the Arch User Repository is underway. ...

2026-07-30T20:03:45Z

Yet another attack against the Arch User Repository is underway. We are monitoring and analyzing the malware samples.

https://discourse.ifin.network/t/new-aur-attack-prompts-adoption-lock/698

#ThreatIntel #ThreatIntelligence #IFIN

We caught a sample of ACR Stealer and went deep on it. Lots of ...

2026-07-29T21:58:35Z

We caught a sample of ACR Stealer and went deep on it. Lots of sophistication for "just" an infostealer.

https://discourse.ifin.network/t/acr-stealer-clickfix-etherhiding-and-stego-oh-my/694

#ThreatIntel #ThreatIntelligence #IFIN

Fantastic research by our community here on a continuing ...

2026-07-23T17:30:28Z

Fantastic research by our community here on a continuing Lua-based campaign that uses Prometheus obfuscation and our old friend Etherhiding for C2 configuration acquisition.

https://discourse.ifin.network/t/luajit-loader-uses-prometheus-obfuscation-and-etherhiding/679

#ThreatIntel #ThreatIntelligence #IFIN

Fixed, thanks!

2026-07-15T20:24:51Z

In reply to nevent1q…f4du
_________________________

Fixed, thanks!

Cursor will run anything called git.exe when you open it, but it ...

2026-07-15T20:20:47Z

Cursor will run anything called git.exe when you open it, but it isn't the only one. As a fork of VS Code, Cursor has inherited this behavior from its questionable parentage.

https://discourse.ifin.network/t/remember-that-cursor-git-exe-bug-its-in-vscode-too/665

We regret to inform you that yes, the models continue to produce ...

2026-07-09T21:03:13Z

We regret to inform you that yes, the models continue to produce kernel exploits leading to privilege escalation and container escapes.

This one is part of a two-vuln chain with a public PoC that escapes Firefox and roots the host.

https://discourse.ifin.network/t/cve-2026-43499-ghostlock-yet-another-linux-lpe-container-escape/653

We need to talk about AWS S3 abuse and anti-patterns. Loose ...

2026-07-09T20:05:46Z

We need to talk about AWS S3 abuse and anti-patterns. Loose association between brands and buckets leads to easy prey for spoofers and squatters.

https://ifin-intel.org/blog/s3-anti-pattern/

Soooo Tenda devices have an admin backdoor. Potential ...

2026-07-07T18:30:29Z

Soooo Tenda devices have an admin backdoor. Potential redeployment locations: a wood chipper, the nearest active volcano, or that really annoying neighbor's house.

No patch; have fun!

https://discourse.ifin.network/t/cve-2026-13753-multiple-tenda-routers-have-an-admin-backdoor/646

An IFIN community member caught this #ClickFix campaign, followed ...

2026-07-01T16:14:25Z

An IFIN community member caught this #ClickFix campaign, followed it, reversed the payload, and brought the IOCs. This is the juice right here. A perfect example that #ThreatIntelIsMutualAid

https://discourse.ifin.network/t/compromised-website-hosting-clickfix-payload-leads-to-netsupport-rat-infection/633

#ThreatIntel #ThreatIntelligence #IFIN

Also, y'know, to reduce slop.

2026-06-30T18:51:38Z

In reply to nevent1q…f77x
_________________________

Also, y'know, to reduce slop.

Are we using a Trek title generator for our posts? Yes, yes we ...

2026-06-30T18:50:33Z

In reply to nevent1q…z5cd
_________________________

Are we using a Trek title generator for our posts? Yes, yes we are. We don't want to take credit for someone else's art in previews.

If you're running a SimpleHelp server, it's ...

2026-06-30T18:50:28Z

If you're running a SimpleHelp server, it's patch-o'clock. Also maybe incident-response-o'clock.

(It's always incident-response-o'clock somewhere)

https://discourse.ifin.network/t/stealers-exploit-cve-2026-in-simplehelp-attack/629

#ThreatIntel #ThreatIntelligence #IFIN

We're excited to introduce IFIN's first open source ...

2026-06-24T13:02:54Z

We're excited to introduce IFIN's first open source project! RSS-Filter solves a problem we suspect is common: our RSS feeds were full of noise. Sponcon, unrelated stories, etc. While some services exist to filter feeds by title, we had none that could filter by category or other criteria. RSS-Filter fixes that.

https://codeberg.org/ifin/rss-filter

This tool allows you to configure a set of feed sources and filter rules. It will produce filtered feeds that can be hosted by any web server, or simply consumed as local files.

We're using RSS-Filter today to get sponcon out of BleepingComputer and a few other feeds. We hope you find it useful!

RE: https://infosec.exchange/@ifin/116765684572417559 Courtesy of ...

2026-06-17T19:46:35Z

RE: https://infosec.exchange/@ifin/116765684572417559

Courtesy of GAYINT :yassquatch: (npub1ezn…nyq3), a comprehensive domain list is now available:

https://blog.gayint.org/intel/fortibleed.txt

quoting
note13rr…03ek

Fortinet customers: please take note of this massive breach of SSL VPN credentials. The scale of attacker infrastructure and list of impacted organizations commands attention.

https://discourse.ifin.network/t/fortibleed-tens-of-thousands-of-fortinet-credentials-leaked/597

#ThreatIntel #ThreatIntelligence #IFIN

Fortinet customers: please take note of this massive breach of ...

2026-06-17T13:29:10Z

Fortinet customers: please take note of this massive breach of SSL VPN credentials. The scale of attacker infrastructure and list of impacted organizations commands attention.

https://discourse.ifin.network/t/fortibleed-tens-of-thousands-of-fortinet-credentials-leaked/597

#ThreatIntel #ThreatIntelligence #IFIN

RE: https://infosec.exchange/@ifin/116735279416101129 This attack ...

2026-06-12T13:04:39Z

RE: https://infosec.exchange/@ifin/116735279416101129

This attack is ongoing, with the attackers shifting from npm to bun for malware installation. If you see information we're missing, please consider contributing!

quoting
note12w4…m9ah

400+ Arch User Repository packages have been compromised in a massive, sophisticated supply chain attack, including a rootkit installation.

https://discourse.ifin.network/t/400-aur-packages-compromised-with-infostealer-and-rootkit/577

#ThreatIntel #ThreatIntelligence #IFIN

400+ Arch User Repository packages have been compromised in a ...

2026-06-12T04:36:44Z

400+ Arch User Repository packages have been compromised in a massive, sophisticated supply chain attack, including a rootkit installation.

https://discourse.ifin.network/t/400-aur-packages-compromised-with-infostealer-and-rootkit/577

#ThreatIntel #ThreatIntelligence #IFIN

Even if Chrome is nerfing old ones, ad blockers still matter. Get ...

2026-06-11T17:15:52Z

Even if Chrome is nerfing old ones, ad blockers still matter. Get them on your users' systems for one of the most impactful one-move security wins available.

https://ifin-intel.org/blog/ad-blocker/

Do you like T-shirts? How about coffee mugs? You can support ...

2026-06-08T19:41:08Z

Do you like T-shirts? How about coffee mugs?

You can support IFIN's mission and also get some cool merch! All proceeds go directly to operational costs and building our capacity to produce and share free cyber threat intelligence resources.

(stickers coming soon)

https://shop.ifin-intel.org

A developing story: Microsoft is disabling repos related to Azure ...

2026-06-05T22:16:38Z

A developing story: Microsoft is disabling repos related to Azure Functions, Durable Task, and more in what appears to be another supply chain compromise.

https://discourse.ifin.network/t/microsoft-disabling-repos-related-to-azure-functions-durable-task/549

#ThreatIntel #ThreatIntelligence #IFIN

RE: https://infosec.exchange/@cR0w/116692776221622923 Hell yeah ...

2026-06-05T00:52:27Z

RE: https://infosec.exchange/@cR0w/116692776221622923

Hell yeah

quoting
note1le8…4h0s

Reminder: Security companies exist to protect the wealthy. Community protects community.

Patches are available for Nginx and Apache against the latest ...

2026-06-03T20:36:56Z

Patches are available for Nginx and Apache against the latest HTTP/2 DoS. Other servers, who knows??

https://discourse.ifin.network/t/cve-2026-49975-http-2-bomb-remote-dos-against-most-major-web-servers/536

We would be remiss in our duty indeed if we did not shout out our ...

2026-06-01T19:49:13Z

We would be remiss in our duty indeed if we did not shout out our colleagues and friends at GAYINT :yassquatch: (npub1ezn…nyq3). IFIN itself is made of LGBTQIA+ community members and allies, and we wish everyone a Happy Pride.

Celebrate by adding the GAYINT feeds to your block lists.

https://gayint.org/blocklists

IPs and domains are just the beginning of the IoC journey. ...

2026-05-27T23:11:05Z

IPs and domains are just the beginning of the IoC journey. Effective defense requires the distillation of atomic indicators to something more generally applicable. IFIN Staff Member Mike B walks us through the distillation process.

https://ifin-intel.org/blog/ioc-distillation/

#ThreatIntel #ThreatIntelligence #IFIN

Got Nessus? Got Crowdstrike? You might also have a huge pile of ...

2026-05-26T14:53:31Z

Got Nessus? Got Crowdstrike? You might also have a huge pile of false positives this morning, as Nessus attempted to run a PoC of the "MiniPlasma" exploit proactively, triggering CrowdStrike alerts.

https://discourse.ifin.network/t/crowdstrike-s1-triggering-1000s-of-high-severity-alerts-on-tenable-2026-05-25/500

Add Laravel to the list of large projects whose GitHub repos have ...

2026-05-23T06:02:10Z

Add Laravel to the list of large projects whose GitHub repos have been compromised.

https://discourse.ifin.network/t/laravel-packages-compromised-in-yet-another-github-attack/497

#ThreatIntel #ThreatIntelligence #IFIN

We regret to inform you that yet another GitHub attack is ...

2026-05-21T20:36:35Z

We regret to inform you that yet *another* GitHub attack is underway—this time compromising GitHub Actions with infostealer scripts.

https://discourse.ifin.network/t/5600-github-accounts-compromised-in-megalodon-attack/490

#ThreatIntel #ThreatIntelligence #IFIN

Thanks. Gonna delete this then.

2026-05-21T15:10:36Z

In reply to nevent1q…f3ua
_________________________

Thanks. Gonna delete this then.

RE: https://infosec.exchange/@ifin/116605052950779161 Important ...

2026-05-21T15:04:23Z

RE: https://infosec.exchange/@ifin/116605052950779161

Important note. A lot of sources are reporting that the Nx Console extension is the vector by which GitHub was compromised. Although that extension was breached concurrently with the GitHub announcement, GitHub has neither confirmed nor denied this publicly. The connection remains speculation, not fact.

quoting
note1xwp…uz0v

GitHub's internal repositories have been exfiltrated and offered for sale.

https://discourse.ifin.network/t/github-internal-repositories-compromised-offered-for-sale/484

We've updated the post with the full list of ...

2026-05-20T13:10:18Z

In reply to nevent1q…da0w
_________________________

We've updated the post with the full list of claimed-compromised repositories.

GitHub's internal repositories have been exfiltrated and ...

2026-05-20T04:38:26Z

GitHub's internal repositories have been exfiltrated and offered for sale.

https://discourse.ifin.network/t/github-internal-repositories-compromised-offered-for-sale/484

One maintainer's compromised tokens are responsible for the ...

2026-05-19T06:22:39Z

One maintainer's compromised tokens are responsible for the takeover of 500+ NPM packages, including the AntV family of packages.

https://discourse.ifin.network/t/500-npm-packages-including-antv-compromised-via-single-maintainer/476

#ThreatIntel #ThreatIntelligence #IFIN

Also added to our MISP instance!

2026-05-18T21:59:57Z

In reply to nevent1q…u3dg
_________________________

Also added to our MISP instance!

Microsoft Power BI is under a DDoS attack claimed by 313 Team, ...

2026-05-18T17:00:28Z

Microsoft Power BI is under a DDoS attack claimed by 313 Team, the same group that recently claimed the attack on Ubuntu.

Their booter is still protected by Cloudflare, btw.

https://discourse.ifin.network/t/power-bi-ddosed-claimed-by-313-team/470

#ThreatIntel #ThreatIntelligence #IFIN

Two sides of the same mullet. @npub16kg…afn8 @npub1ezn…nyq3

2026-05-16T19:41:56Z

In reply to nevent1q…qt4c
_________________________

Two sides of the same mullet.
Cat 🐈🥗 (D.Burch) (npub16kg…afn8) GAYINT :yassquatch: (npub1ezn…nyq3)

We have a breakdown of the current attack campaign against Cisco ...

2026-05-15T18:24:30Z

We have a breakdown of the current attack campaign against Cisco SD-WAN devices

https://discourse.ifin.network/t/cve-2026-20182-cisco-catalyst-sd-wan-eitw/457

#ThreatInte #ThreatIntelligence #IFIN

Dear threat research firms, A modest proposal for your threat ...

2026-05-15T16:34:51Z

Dear threat research firms,

A modest proposal for your threat intel blog posts:

A *single table* of Indicators of Compromise.

3 columns: Value, Type, Description

The same format. Every time.

Easier for you, easier for your readers, easier for us.

XOXO IFIN

I am sure you're shocked to hear about another NPM ...

2026-05-14T22:20:47Z

I am sure you're shocked to hear about another NPM compromise.

This one was because a maintainer let their email domain expire!

https://discourse.ifin.network/t/node-ipc-npm-packages-infected-with-stealer/454

#ThreatIntel #ThreatIntelligence #IFIN

This new Nginx vuln is worth some scrutiny. A heap buffer ...

2026-05-13T19:21:30Z

This new Nginx vuln is worth some scrutiny. A heap buffer overflow that can lead to service restart and, on systems with ASLR, code execution. Patches available.

https://discourse.ifin.network/t/cve-2026-42945-heap-buffer-overflow-in-nginx/441

We are tracking the new Nightmare Eclipse exploits, and we even ...

2026-05-12T21:59:37Z

We are tracking the new Nightmare Eclipse exploits, and we even have some listed IoCs from the code/repo files for you.

https://discourse.ifin.network/t/chaotic-eclipse-nightmare-eclipse-drops-two-windows-0days/437

#ThreatIntel #ThreatIntelligence #IFIN

If you or someone you know has received Instructure ...

2026-05-12T18:34:43Z

If you or someone you know has received Instructure #Canvas-themed phishing messages, we want to hear about it! Samples welcome, but also any other circumstances.

Something seems phishy about the claim that no data is out in the open.

Did you know we have a @npub1mly…rl2t feed? We do! Discourse ...

2026-05-12T18:32:17Z

Did you know we have a MISP (npub1mly…rl2t) feed? We do!

Discourse posts with valuable indicators are added to our feed, which is free for all.

https://misp.ifin.network/feed (/manifest.json for manual review)

#MISP #ThreatIntel #ThreatIntelligence #IFIN

Aaaand now it's in PyPi

2026-05-12T15:47:22Z

In reply to nevent1q…au6n
_________________________

Aaaand now it's in PyPi

RE: https://infosec.exchange/@ifin/116558531955700753 This has ...

2026-05-12T13:22:50Z

RE: https://infosec.exchange/@ifin/116558531955700753

This has evolved to impact 170 packages, including those from Mistral and OpenSearch.

quoting
note1w6n…z3sx

TanStack, a popular web UI framework has had its NPM packages compromised by another installment of Mini Shai-Hulud.

https://discourse.ifin.network/t/mini-shai-hulud-strikes-again-tanstack-npm-packages-compromised/428

#ThreatIntel #ThreatIntelligence #IFIN

TanStack, a popular web UI framework has had its NPM packages ...

2026-05-11T23:27:32Z

TanStack, a popular web UI framework has had its NPM packages compromised by another installment of Mini Shai-Hulud.

https://discourse.ifin.network/t/mini-shai-hulud-strikes-again-tanstack-npm-packages-compromised/428

#ThreatIntel #ThreatIntelligence #IFIN

Cloudflare is reporting issues as well, since, uh, all their ...

2026-05-08T20:15:25Z

In reply to nevent1q…8pzr
_________________________

Cloudflare is reporting issues as well, since, uh, all their services get their certs from LetsEncrypt

BREAKING: LetsEncrypt appears to be stopping certificate issuance ...

2026-05-08T19:47:21Z

BREAKING: LetsEncrypt appears to be stopping certificate issuance due to a "potential incident."

https://discourse.ifin.network/t/letsencrypt-stopping-issuance/415

Fixes for both Debian-derivative and RHEL-like systems listed!

2026-05-07T22:34:38Z

In reply to nevent1q…48tj
_________________________

Fixes for both Debian-derivative and RHEL-like systems listed!

We're also tracking the new #CopyFail variants here. ...

2026-05-07T21:08:50Z

We're also tracking the new #CopyFail variants here. DirtyFrag requires the same af_alg module as CopyFail, but another variant does not.

https://discourse.ifin.network/t/new-copyfail-variants/395

RE: https://infosec.exchange/@wdormann/116533862391306228 We love ...

2026-05-07T15:38:05Z

RE: https://infosec.exchange/@wdormann/116533862391306228

We love direct action you can take to confound the adversary! Disable .URL files (and .js files) today.

https://discourse.ifin.network/t/disable-url-files-before-the-baddies-use-them/393

quoting
note1lp3…u5wj

Let's talk about Windows .URL (InternetShortcut) files.

Last year there was discussion about a vulnerability in how Windows handles .URL files. Specifically, when a .URL file specifies a WorkingDirectory directive, an otherwise harmless app being launched would load DLLs from the remote (e.g. WebDAV) server specified. You know, being the current working directory of the app being launched and all. This vulnerability was being [exploited in the wild](https://www.virustotal.com/gui/file/e0a44274d5eb01a0379894bb59b166c1482a23fede1f0ee05e8bf4f7e4e2fcc6 ), and it worked well because it bypassed annoying (to attackers) things like SmartScreen. Sure, it required the victim to click Open on a dialog saying Type: Unknown File Type (😂), but we all know that users are click-happy, so this is fine. Besides, the file clearly has a .pdf extension, so it should be safe (😂).

Microsoft recognized the vulnerability and published an [update in the form of CVE-2025-33053](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33053 ).

If we were to believe the [Microsoft documentation at the time](https://web.archive.org/web/20250710095434/https://learn.microsoft.com/en-us/windows/win32/lwef/internet-shortcuts ),

> When the user clicks the icon, the browser is launched and displays the site associated with the shortcut.

But wait...
How did this .URL file cause a program to be launched? The URL= parameter specifies a website address to be loaded in the browser.

Oh, naive child. Obviously a .URL file can directly point to code on a remote (e.g. WebDAV) server. This technique is also [being exploited ITW as well](https://www.virustotal.com/gui/file/93a2d60d1ccfe3e009b1a81951653b559e0cae01c2454244a3a0fbd49a5e4539 ).

I reported this to Microsoft, as this has the **EXACT SAME IMPACT** as CVE-2025-33053. So if that's a vulnerability, then this too is a vulnerability, right?

Bless your innocent soul. Per MSRC:

> When the Shell invokes an app from a remote share, it's expected that you will see the legacy Windows Security prompt, not the SmartScreen one. SmartScreen Application Reputation (AppRep) evaluation applies to locally downloaded files that bear an Internet Zone mark of the web. It is not meant to apply to execution of files from Network Shares.

Okie dokie. I'm sure Windows users surely appreciate this. But what about the [incorrect documentation](https://archive.ph/MgBI8 )? After my prodding, they [updated the wording](https://learn.microsoft.com/en-us/windows/win32/lwef/internet-shortcuts ):

> When the user clicks the icon, the URL path is opened by the handler application, typically the user's default web browser.

Leaving in the quite misleading first sentence:

> The Internet shortcut object is used to create desktop shortcuts to Internet sites.

(An "Internet site" is a web page, right?)

How can CVE-2025-33053 warrant a CVE, while the behavior I described has the exact same trigger and impact is **not** CVE worthy? That's pretty easy. Microsoft assigns CVEs to **updates**, not **vulnerabilities**. They are the decider as to what is a vulnerability and what is not.

What can we do about it?

At the very least, turn off the Windows feature that hides file extensions, **even if you have the option turned on to see file extensions**. The disdain that Microsoft has for Windows users is tangible here. On what planet would I not want to see the actual extension of a file? Go to HKCU\InternetShortcut and delete the NeverShowExt value. After this, your pwned.pdf file will reveal its true self as being pwned.pdf.url.

More powerful protection would be to block the ability to receive .URL files via email, web browsers, etc. There is no workflow that I can imagine that requires a user to double-click on a .URL file that **came from the internet**.

Even more powerful than that would be to disassociate .URL files from opening in Windows (thx Taggart :ifin: (npub1yg8…ccz0) ).

This screen recording is a Windows 11 system that has no internet connectivity. The fact that no warning was displayed that SmartScreen cannot be reached is evidence that SmartScreen is not in play at all. And that dialog...Do you want to open this file?

andType: Unknown File Type

Do you think that users are presented with enough information to make an informed security decision? Of course not. But obviously we all know that we can't rely on users making informed security decisions in general. Don't put users in that position.

As a chaser, here are two other CVEs on Ollama from yesterday. ...

2026-05-06T17:44:46Z

In reply to nevent1q…gwmk
_________________________

As a chaser, here are two *other* CVEs on Ollama from yesterday.

https://discourse.ifin.network/t/cve-2026-42248-cve-2026-42249-ollama-on-windows-doesnt-verify-updates-writes-anywhere/378

Another AI service that's dangerous when exposed to the ...

2026-05-06T17:35:41Z

Another AI service that's dangerous when exposed to the internet? Well I never!

Anyway go check for exposed Ollama endpoints.

https://discourse.ifin.network/t/unauthenticated-memory-leak-in-ollama-cve-2026-7482/389

#CVE #ThreatIntel #ThreatIntelligence #IFIN

This morning we decided to launch a "Vulnerabilities" ...

2026-05-06T13:57:47Z

This morning we decided to launch a "Vulnerabilities" category to track vulns without further actionable intelligence besides patching and monitoring. And wouldn't you know it, a crit on Palo Alto's User-ID portal showed up to ring it in!

https://discourse.ifin.network/t/cve-2026-0300-9-3-cvss-pan-os-unauthenticated-user-initiated-buffer-overflow-captive-portal/382

#CVE-2026-0300 #CVE #IFIN

As of 0740 UTC, Ubuntu's security and archive sites are ...

2026-05-05T15:44:17Z

As of 0740 UTC, Ubuntu's security and archive sites are *finally* behind Cloudflare's CDN...sorta. So while it's still ridiculous that Cloudflare is serving both sides, at least Ubuntu's repos should be more stable.

313 Team, the Iraqi-aligned group claiming credit for the Ubuntu ...

2026-05-03T05:02:01Z

313 Team, the Iraqi-aligned group claiming credit for the Ubuntu attack, are now encouraging the use of #CopyFail against Ubuntu targets while servers may not be able to reach updates.

https://discourse.ifin.network/t/ubuntu-services-under-attack/356

The worms keep worming, unfortunately. The "Mini ...

2026-04-30T21:22:01Z

The worms keep worming, unfortunately. The "Mini Shai-Hulud" attack appears to pivot to #PyPi with a compromise of a #pytorch library:

https://discourse.ifin.network/t/pytorch-lightning-library-hit-by-supply-chain-attack/357

#ThreatIntel #ThreatIntelligence #IFIN #Python

It's not just you: Ubuntu services are down. ...

2026-04-30T20:32:51Z

It's not just you: Ubuntu services are down.

https://discourse.ifin.network/t/ubuntu-services-appear-down/356

Since the CopyFail disclosure left some of us feeling a ...

2026-04-30T17:10:12Z

Since the CopyFail disclosure left some of us feeling a little...unsupported, we're talking about what we love to see in vulnerability disclosures. Come join the conversation!

https://discourse.ifin.network/t/your-ideal-vuln-disclosure/350