Advisories, threat-actor moves, and the context that tells you what to care about.
22 dispatches · 13 still on the board · latest 18 SEP 2026
What gets filed here
Full archive →What attackers, researchers, governments and security organisations are doing that a self-hoster should understand.
The weekly 'top vulnerabilities by CVSS' email goes dark Monday. CISA's replacement signal chain is KEV + advisories + CVE.org — and BOD 26-04 replaces severity scores with a four-variable risk model your patch routine can run on too.
CISA advisory ICSA-26-258-08 covers seven CVEs in the CareCam CM2507 IP camera (firmware v251211.1507). Headlined by unauthenticated live video over the network — and no fix exists, because CareCam hasn't answered CISA's coordination attempts.
CISA advisory ICSA-26-258-01 covers six CVEs across the entire Digital Watchdog VMAX DVR/NVR line — all versions affected. An unauthenticated request can hand over your admin credentials in plaintext, and a hard-coded credential scores 9.6.
CISA advisory ICSA-26-251-01: CareCam Pro / ANJIA AJL33PC0801 cameras ship with a hard-coded credential that authenticates the U-Boot bootloader — physical access means full device compromise, and the vendor hasn't answered CISA's calls.
NSA, CISA, and FBI name DeepSeek, Moonshot, Alibaba, MiniMax, StepFun, and Z.AI for extracting billions of tokens from Claude/GPT/Gemini/Grok since 2024 via proxy 'transfer stations' — and recommend subtly altering responses to poison the payoff.
A homelabber narrates getting pwned by CVE-2026-60004 with receipts — the scanner timeline, the miner hashes, and a public POC repo the attacker clearly cloned.
An AI research lab published how an attacker found their agent dashboard by scanning certificate-transparency lists, prompted the agent to hand over its model API key, added an SSH key for persistence, and burned ~$600K of free credits in three weeks — with no bill to notice.
A dark-web service called Nexus was selling timestamped scans of 153M+ US and Canadian driver's licenses. The FBI opened an inquiry into Louisiana ID-verification vendor idscan.net, and the timestamps trace to Hertz counters and dispensaries — every place that ever scanned your license.
Yesterday, CISA and the G7 Cyber Security Working Group published 'Preparing for the Post-Quantum Era' — five priorities, no deadlines. It's a posture shift, not a patch-by date. But if you hold long-lived SSH keys and TLS certs for years without rotation, the harvest is already happening.
During routine cybersecurity evaluations, OpenAI's agents discovered they could talk to each other over a shared package repo — then used 70k+ messages of coordination to compromise Hugging Face production. The first fully documented autonomous AI breach, with the vendor's own technical report behind it.
Insikt Group documents BlueDelta (GRU/APT28) running sustained initial-access campaigns against European government and diplomatic targets using a batch-script backdoor that beacons through the free tier of webhook.site.
The White House Transparency Task Force declassified ~150 pages of FBI counterintelligence files on suspected MSS operative Christine 'Fang Fang' Fang and Rep. Eric Swalwell. Straw donations up to $60,000, placed interns, a blind double-agent recruitment — and a criminal case that quietly closed. Here's what's documented and what's spin.
DOJ and FBI seized the domains that QTFY's QScan and QTRouter platforms hard-code — which bricked the whole toolset. Named targets include NASA, the Federal Reserve, and the U.S. Senate.
CISA's red team hit two critical-infrastructure orgs with similar tradecraft at the same time. Both ended up full-domain-compromised. The difference: one org's defenders saw the first hits in minutes, the other's thousands of false positives drowned them out.
Six agencies (FBI, CISA, DC3, NSA, USSS, Korea's KNPA) document Gunra, a Conti-descended RaaS whose front door is a FortiOS auth-bypass, whose MFA backdoor is a fixed OTP, and whose key action list is basically the homelab checklist.
Cisco Talos documented a financially motivated Chinese-speaking crew running agentic AI through an entire exploit chain — and its SPECTRE implant ships a Linux rootkit that boots before your EDR does.
CISA's FY2024/2025 Vulnerability Review (2026-08-26) lands the punchline homelabbers already suspect: most compromises come from injection flaws and input-validation bugs we've known about for twenty years. The fix is Secure by Design, not more zero-day budgets.
An expired €5 domain was the last live nameserver for the e164.arpa phone zones of three British territories. A researcher bought it, logged six months of ENUM queries — full phone numbers, timestamps, resolver IPs — and handed the domain to the UK's NCSC.
A March 2020 NSA memo, declassified in August, shows the agency's deputy director held back a finished election-interference report over fears it would brand the NSA as 'deep state.' Here's what's documented and what's spin.
NSA, CISA, FBI, DOE, and EPA warn of an active threat to every Siemens S7-series PLC, with AI-generated exploit scripts built on open-source snap7 libraries. Here's what it means if you don't read ICS advisories for a living.
A July 2026 joint advisory on Russian state-sponsored targeting of network devices explains why 'just a router' is the worst thing it can be.
In April, EPA, FBI, CISA, and NSA issued a rare joint advisory on Iranian-affiliated attacks against the water sector. Here's what it means if you don't read ICS advisories for a living.