Palo Alto owners miiiight wanna check today's large list of advisories 👀

We are tracking the new Nightmare Eclipse exploits, and we even have some listed IoCs from the code/repo files for you. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN

Did you know we have a MISP feed? We do! Discourse posts with valuable indicators are added to our feed, which is free for all. misp.ifin.network/feed (`/manifest.json` for manual review) #MISP #ThreatIntel #ThreatIntelligence #IFIN

If you or someone you know has received Instructure #Canvas-themed phishing messages, we want to hear about it! Samples welcome, but also any other circumstances. Something seems phishy about the claim that no data is out in the open.

This has evolved to impact 170 packages, including those from Mistral and OpenSearch.

TanStack, a popular web UI framework has had its NPM packages compromised by another installment of Mini Shai-Hulud. discourse.ifin.netwo... #ThreatIntel #ThreatIntelligence #IFIN

BREAKING: LetsEncrypt appears to be stopping certificate issuance due to a "potential incident."

We're also tracking the new #CopyFail variants here. Fixes for Debian derivatives and RHEL-like systems listed! discourse.ifin.network/t/new-copyfa...

ShinyHunters have used their access to the Instructure Canvas platform to send schools a warning.

We love direct action you can take to confound the adversary! Disable `.URL` files (and `.js` files) today. discourse.ifin.network/t/disable-ur...

This has now moved to threat intel and is actionable with the publication of techniques used by exploiting attackers.

Another AI service that's dangerous when exposed to the internet? Well I never! Anyway go check for exposed Ollama endpoints. discourse.ifin.netwo... #CVE #ThreatIntel #ThreatIntelligence #IFIN

This morning we decided to launch a "Vulnerabilities" category to track vulns without further actionable intelligence besides patching and monitoring. And wouldn't you know it, a crit on Palo Alto's User-ID portal showed up to ring it in! discourse.ifin.netwo... #CVE-2026-0300 #CVE #IFIN

It would appears that the DDoS attack affecting #Ubuntu is finally over, with statements from both Canonical and the claimed attackers. While the attackers threaten Cloudflare next, they continue to use their services to protect their booter service.

As of 0740 UTC, Ubuntu's security and archive sites are *finally* behind Cloudflare's CDN...sorta. So while it's still ridiculous that Cloudflare is serving both sides, at least Ubuntu's repos should be more stable.

Please spread the word and let @cloudflare.social know they're enabling this attack.

Is it May 4th or February 2nd? The Ubuntu DDoS is ongoing, with up-and-down status updates diverging from real, experienced outages. We're far from stable at this point.

313 Team, the Iraqi-aligned group claiming credit for the Ubuntu attack, are now encouraging the use of #CopyFail against Ubuntu targets while servers may not be able to reach updates.

Ubuntu sites appear to be back up...for now. Although updates from official channels have been mostly nonexistent, we've been keeping this page updated with current status.

Thanks to Censys, We have confirmed exploitation leading to ransomware for the #cPanel/WHM auth bypass. discourse.ifin.netwo...#cPanel/WHM#ThreatIntel #ThreatIntelligence #IFIN

Sites now appear to be back up!

We've updated the Ubuntu outage thread to reflect Ubuntu's new status confirming an "attack," and claimed credit from Iraq-aligned hacking group 313 Team.

The worms keep worming, unfortunately. The "Mini Shai-Hulud" attack appears to pivot to #PyPi with a compromise of a #pytorch library: discourse.ifin.netwo...#PyPi#pytorch#ThreatIntel #ThreatIntelligence #IFIN #Python

It's not just you: Ubuntu services are down.

Since the CopyFail disclosure left some of us feeling a little...unsupported, we're talking about what we love to see in vulnerability disclosures. Come join the conversation!

Regarding #CopyFail, It is worth noting that the exploit can target *any* file and overwrite its contents. That's not just privilege escalation; that's the potential for stealthy persistence. Our thread now has more technical discussion and also some clever detections.

After careful analysis, we believe the best option for remediation is to turn off the computers and go for a nice walk. Maybe call your mother.

What is going on today?? We're also tracking #CopyFail. discourse.ifin.netwo...#CopyFail. #ThreatIntel #ThreatIntelligence #IFIN

We have a CVE and confirmed exploitation for the cPanel vulnerability. CVE-2026-41960. Action is to patch affected versions and review access logs.

Looks like we have another #supplychain attack underway, this time facing #SAP-related NPM packages. discourse.ifin.netwo...#supplychain#SAP-related#ThreatIntel #ThreatIntelligence #IFIN

This is why we're saying we have to look out for each other.

When opportunity (malware) comes a-knocking, you let it in (fire up the sandbox and disassembler). #malware #ThreatIntel #ThreatIntelligence #IFIN

Tell your friends. Mess around with the single field we ask for during onboarding, and we will toss you. If you don't take this seriously, we have no reason to expect you to respect our community's safety.

We've been on a tear adding new sources to our RSS aggregator! All the cyber news that's fit to print, in one place: news.ifin.network

Bitwarden's CLI NPM package was hijacked and used to spread credential stealer malware. This is related to the previous Checkmarx compromise. We'll be updating this thread as always with new information. Come join the effort!

The best time to block api.telegram[.]org was like, I dunno, five years ago? The second best time to do it is now. Seriously. Cross that one off the easy wins list today. #ThreatIntel #ThreatIntelligence #IFIN

Thanks to some excellent reporting from Infostealers by Hudson Rock, we know a context[.]ai employee was seeking Roblox cheats when they got hit with LummaStealer, leading to the initial breach which impacted Vercel. discourse.ifin.network/t/vercel-con...

Today we're talking about another (???) issue in the Cursor AI IDE. Well actually it's two issues, one of which is simple command injection; the other is takeover via Dev tunnels. Don't know what dev tunnels are? Come find out—then block them with extreme prejudice.

Today we're talking about another (???) issue in the Cursor AI IDE. Well actually it's two issues, one of which is simple command injection; the other is takeover via Dev tunnels. Don't know what dev tunnels are? Come find out—then block them with extreme prejudice.

#Vercel update. We now know, thanks to Vercel's CEO, that the compromise came by way of the context[.]ai Office Suite, using OAuth tokens collected from a breach last month. Details here:

We're actively tracking developments here: discourse.ifin.network/t/vercel-con...

#Vercel customers: don't wait. Proactively rotate keys, passwords and environment variables ASAP. vercel.com/kb/bulletin/...

#Vercel customers: don't wait. Proactively rotate keys, passwords and environment variables ASAP. vercel.com/kb/bulletin/...

👀👀👀

We've been tracking #Iran cyber activity since the beginning of March, consolidating high-value intelligence into a single thread. One of the most comprehensive resources on the topic, if we do say so ourselves.

After working on it a bit, we have a fix for a recent #ClickFix attack against #macOS that leverages AppleScript. Here's the writeup, and a link to the forum thread! ifin-intel.org/blog/...#ClickFix#macOS#ThreatIntel ThreatIntelligence #IFIN

After working on it a bit, we have a fix for a recent #ClickFix attack against #macOS that leverages AppleScript. Here's the writeup, and a link to the forum thread! ifin-intel.org/blog/...#ClickFix#macOS#ThreatIntel ThreatIntelligence #IFIN

Following up on an excellent blog post we discovered (linked in thread), we dug a little deeper on a recent #WordPress plugin compromise. We have more IoCs, and evidence of initial access auctions via the blockchain. discourse.ifin.netwo...#WordPress #ThreatIntel #ThreatIntelligence #ThreatHunting #IFIN

Following up on an excellent blog post we discovered (linked in thread), we dug a little deeper on a recent #WordPress plugin compromise. We have more IoCs, and evidence of initial access auctions via the blockchain. discourse.ifin.netwo...#WordPress #ThreatIntel #ThreatIntelligence #ThreatHunting #IFIN

CISA is claiming that #Iran is once again targeting Programmable Logic Controllers (PLCs), similar to efforts in 2024. Has anyone seen recent evidence of this? None was provided from CISA, and we'd love independent confirmation.