cyber.hendryadrian.com is a cybersecurity news and threat intelligence aggregation platform. It collects external cybersecurity reporting and turns it into structured information that is easier to search, correlate, and explore.
Sekoia details a watering-hole campaign assessed with moderate-to-high confidence as APT29, using compromised sites and Plerdy to deliver patched iOS and Android exploits that stole cookies, Wi-Fi passwords and device data.
NetSPI demonstrates how attackers with compromised user or service-principal access can use Microsoft Graph Rich Notifications to exfiltrate Outlook snippets and Teams messages, and describes monitoring via the added GraphNotificationsActivityLogs table.
Researchers mapped a signed CookUp installer that installs a harmless recipe app but can use three gates and a server-issued token to fetch and run a DLL in memory. The server refused observed sessions, leaving the final payload unknown.
Binarly says Zyxel GS1900 Patch 2 remains vulnerable to a network-reachable, unauthenticated command-execution flaw (CVE-2026-107441); Patch 3 fixes it. GreyNoise reported data collection from 996 switches, but their firmware status is unknown.
CISA added Apple flaw CVE-2024-27834 to its KEV catalog after active-exploitation reports. Sekoia linked the activity with moderate-to-high confidence to APT29 and described malware delivery through several website and supply-chain pathways.
SonicWall says it will not patch two vulnerabilities affecting end-of-life GMS 9.5.2 and earlier, and urges users to upgrade to NSM. Separately, CVE-2026-102255 is under active exploitation.
A practical guide to exporting ArcSight events through Logger searches, CEF forwarding to a syslog collector, or the REST API. Original event text is available only if SmartConnectors preserve raw events.
Qualys describes CAR scripts that upgrade PHP on Windows and macOS to the latest release in the installed minor series, with verification and rollback on Windows, Homebrew handling on macOS, and agent-based or authenticated scanner-based deployment.
The article outlines six defensive practices and a staged checklist to limit the reach of compromised credentials, vendors, software packages, services, and developer machines through 2026.
A month-long review of AI-agent use at one software company found widespread non-engineer use, many tool calls without human approval, gaps in agent logs versus kernel telemetry, and extensive use of third-party MCP servers.
An evaluation of 624 indicators found reputation services often missed software supply chain threats: 62.2% had no VirusTotal detections at ingestion, and 71.3% remained undetected months later.
An NCSC assessment outlines three possible AI-cyber threat scenarios through 2028, forecasting increased attacks on the UK and its critical infrastructure while emphasizing that the scenarios are plausible possibilities, not predictions.
OpenAI says its AI pipeline reproduced 1,724 Linux vulnerabilities and generated 948 local privilege-escalation exploits in 30 hours, at a cost of $1.21 million. The company says automated patching must keep pace with AI-assisted discovery.
mSeven Software says it investigated suspicious activity involving mSecure and advises users to protect stored information, but has not said what happened or whether customer data was accessed. Malwarebytes recommends precautionary credential changes.
Check Point Research says Haiou modifies OpenAI Codex configuration to inject persistent ads for an LLM gateway. The bundle uses prompt-injection techniques and is also included in the Codex-X configuration tool.
An actor using the handle “koii” claims to offer a SENA-associated database containing 20,564,434 records with identity, contact, academic, and employment data. The dataset and sale claims remain unverified.
OpsShield says attackers used compromised credentials to distribute malicious cPGuard updates. The company estimates 2,950 servers ran them and about 7,900 client account records were copied; it has released cleanup updates and rotated credentials.
Binance says attackers compromised three engineers’ computers in a months-long campaign, then abused its wallet signing service to steal $6.34 billion. The FBI blamed TraderTraitor; North Korea denied it. Binance says $2.85 billion was frozen or intercepted.
Eclipse's leak site claims to hold 832 GB of Taiwan Otsuka Pharmaceutical data and shows a publication countdown. The claim, data volume and contents have not been independently verified.
Ransomware group N0n claims it compromised managed IT provider Chibitek and exposed client financial records, network credentials, configuration secrets, and internal documents. The claim is unverified.
Ransomware.live reports that actor N0n listed a Michigan cannabis operator as a victim and claims company data will be published on October 13. The claims are unverified.
Malwarebytes found a fake $750 Apple Cash offer that uses timers and a supposed device check to funnel users to app promotions. The page provides no reward; users may share personal data or spend money in games.
Arctic Wolf’s review of NCSC findings says UK cyber resilience lags behind threats: 88% of large-organisation incidents involved four familiar routes. It recommends stronger asset, identity, patching and response practices as AI accelerates attacks.
A guide to exporting Exabeam events through its Search API or UI, converting JSON results to JSONL, and reviewing them in LogTotal. It covers API-key permissions, regional hosts, filters, and common errors.
