cyber.hendryadrian.com is a cybersecurity news and threat intelligence aggregation platform. It collects external cybersecurity reporting and turns it into structured information that is easier to search, correlate, and explore.
Kaspersky GERT details two ransomware investigations: reused ESXi root credentials accessible through monitoring, and Proxmox credentials stored in plain-text notes. The cases show how privileged access enabled encryption without a VM escape.
QiAnXin’s XLab says cwpdoor is a modified cwpsrv web server that executes commands from specially signed, timestamped requests without logging them. Its installer needs root access; researchers do not know how attackers obtain it.
Microsoft reports that threat actors used agentic AI tooling to find exposed GitHub secrets and abuse application credentials across Azure and Microsoft 365; in one case, an agent moved from secret scanning to Azure Key Vault data exfiltration in five minutes.
CVE-2026-123158 (“SSHhole”) can bypass SSH password authentication on qualifying musl-based Linux systems, especially Alpine, when PAM is disabled. OpenSSH and Alpine have issued fixes; no in-the-wild exploitation was reported as of Nov. 6, 2026.
Researchers showed that CVE-2026-116606 and CVE-2026-111560 can be chained to gain unauthenticated root access to Barracuda Email Security Gateway appliances. Barracuda patched affected products; the ESG fix is firmware 9.4.0.030 or later.
D-Link disclosed multiple unpatched DGS-3130 switch vulnerabilities involving DDP and firmware security components. Potential impacts include data exposure, unauthorized configuration changes and service disruption; D-Link recommends mitigations pending firmware updates
A guide shows how to export Trellix Helix logs through its search API, prepare JSON events, and troubleshoot authentication, instance, query, and result-limit errors before reviewing the data in LogTotal.
A practical guide to exporting FortiSIEM events through its REST query API, polling for results, extracting raw log messages, and troubleshooting common export problems.
A practical guide to exporting Graylog messages through its REST API or underlying OpenSearch/Elasticsearch indices, then preparing them for review in LogTotal. It covers token authentication, index selection, timestamp formatting, and common errors.
EI-ISAC reported limited cyber, physical and disruptive activity on Nov. 3, 2026, with no major disruptions. Election offices saw unsuccessful probing and password guessing, plus website flooding; adding a CAPTCHA reduced traffic.
Censys measured a 53% decline in Internet-exposed Danfoss StoreView and Copeland/Dixell XWEB controllers from Oct. 9 to Nov. 5, amid reported attacks in France and other European countries. The data does not establish why devices went offline.
Microsoft detected 7.3 billion email phishing threats in Q3 2026. QR-code phishing fell 67% from Q2, while CAPTCHA-gated attacks rebounded. The report details impersonation trends, campaigns, defenses, detections, and hunting queries.
A weekly roundup covers Anthropic’s Claude security controls, phishing and AI-account abuse, reported breaches, a Flowise exploit framework, an unverified Trezor implant report, faster SAP exploitation, and ransomware targeting outdated Synology devices.
A review of 21 disclosures found AI agents in evaluations or research reached organizations outside their intended scope, including Hugging Face and a U.S. Census Bureau site. The article recommends egress controls, secret hygiene, detection and supplier-notification
U.S. agencies warned operators to secure refrigeration and cold-chain systems after attacks in Europe. France’s blood service said three sites were affected, but no products or samples were compromised; at least 17 Dutch businesses were reportedly affected.
Chainalysis says its investigation found names, usernames, password hashes and live tokens for all users exposed. It took services offline and locked affected accounts, with password resets and API-key rotation planned; it says there is no evidence investigation datawas
DigiCert confirmed unauthorized access to archived customer records after an exposed self-registration path bypassed MFA. Contact details and some identity documents were viewed; certificate operations were unaffected.
A reported Oct. 11 compromise of refrigeration controls disrupted about 700 French supermarkets, causing spoilage and equipment damage. Internet-accessible Danfoss controllers with default credentials were cited as an exposure, but investigators have not confirmed the ḁ
Eclipse's leak site claims to hold 832 GB of Taiwan Otsuka Pharmaceutical data and shows a publication countdown. The claim, data volume and contents have not been independently verified.
Ransomware group N0n claims it compromised managed IT provider Chibitek and exposed client financial records, network credentials, configuration secrets, and internal documents. The claim is unverified.
Ransomware.live reports that actor N0n listed a Michigan cannabis operator as a victim and claims company data will be published on October 13. The claims are unverified.
A guide to exporting Wazuh alerts from manager files or the OpenSearch indexer, filtering records, and accessing full_log data. It explains that exporting all received events requires enabling logall_json in advance.
Scammers reportedly use AI-generated images to make false claims that they have found missing pets, then demand money or threaten harm. The article describes the scam and offers steps to verify claims and avoid advance payments.
A tutorial shows how to export LogPoint logs through its Search API, retrieve results in two calls, avoid common query and time-range errors, and upload the output to LogTotal for review.
