cyber.hendryadrian.com is a cybersecurity news and threat intelligence aggregation platform. It collects external cybersecurity reporting and turns it into structured information that is easier to search, correlate, and explore.
Morphisec analyzed an order-themed email campaign that uses obfuscated JScript to drop LuaJIT and a Lua loader, execute XLoader in memory, then transfer it into an x86 process via shared-section mapping and thread-context redirection.
Analysis finds a signed 62 MB Windows utility hiding a 9.7 KB loader that retrieves GodRAT over raw TCP and injects it into cmd.exe. The certificate also signed a separate Golden Gh0st loader, but attribution remains undetermined.
Technical analysis traces a signed, three-stage IEProc chain to Golden Gh0st RAT, linking it to APT-Q-27 through a reused plugin and C2 key. The backdoor contacted app[.]probref[.]com, but received no commands in testing.
CVE-2026-112816 lets an attacker with API network access and a trusted client's public certificate impersonate that client in LXD or MicroCloud. Canonical released fixes; no public exploitation is known.
CISA added two Ivanti Connect Secure flaws to its KEV catalog after active exploitation. Volexity reported a three-flaw chain enabling unauthenticated root-level code execution; Ivanti says fixes are available.
A proof-of-concept targets CVE-2026-58882, a zero-click Android WAP Push flaw that can crash cellular services or trigger reboot loops. Google reportedly patched Android 14–17 in October; Android 12–13 remain vulnerable.
The article outlines an Observe, Prove, Act, and Confirm workflow for validating security changes before enforcement, coordinating approvals, and verifying results. It reports remediation outcomes from the analyzed environments.
A practical guide to exporting Elasticsearch logs with Python, ES|QL, or Kibana Discover, including API-key permissions, format and row limits, and preparing log records for investigation in LogTotal.
The article compares algorithmic, single-LLM, and multi-agent approaches to generating filters for false-positive security alerts. It reports that a single-LLM approach reduced false positives by 99% and improved analyst efficiency.
Cloudflare reported 18.2 million network-layer DDoS attacks in Q3 2026, up from 13.2 million in Q2. Short-burst attacks surged 208%, while attacks exceeding 1 Tbps fell 69%.
Wiz’s survey of 100 senior IT and security decision-makers found widespread AI deployment but limited inventory and governance: 55% use agentic systems, while only 17% have a comprehensive AI asset inventory. The report recommends stronger visibility and controls.
A researcher reported finding 26,000 unique, valid credentials in 7.25 million public Gitee repositories, validating candidates against provider endpoints. About half dated to commits pushed in 2025; affected providers were notified.
AWS says a 2026 exercise switched off the European Sovereign Cloud’s links to its global network and local operational-data system. Traffic rerouted over the public internet while workloads and customer access continued without reported service impact.
The agency says maintenance and checks initiated after a cyberattack on information systems may affect some services. It warns benefit recipients that staff will not request confidential information by phone or message.
This roundup covers new cybersecurity and privacy developments, including Norway’s HIGH national cyber risk level and recommended controls, NIST’s post-quantum migration deadlines, breach-risk guidance, AI-agent safeguards and data-protection policy changes.
Oberspreewald-Lausitz confirmed an IT security incident and shut down its systems as a precaution, leaving email and most services unavailable. A cyberattack has not been officially confirmed; the investigation is ongoing.
Matten municipality says a March 14–15, 2026 cyberattack encrypted some municipal data, which was fully restored. Its analysis found no data theft or publication; operations continued and critical systems were reportedly unaffected.
Foster City says ransomware was discovered on its network, prompting service suspensions and most computer systems to be taken offline. The city says 911 and emergency response remain operational, and public information may have been accessed.
Eclipse's leak site claims to hold 832 GB of Taiwan Otsuka Pharmaceutical data and shows a publication countdown. The claim, data volume and contents have not been independently verified.
Ransomware group N0n claims it compromised managed IT provider Chibitek and exposed client financial records, network credentials, configuration secrets, and internal documents. The claim is unverified.
Ransomware.live reports that actor N0n listed a Michigan cannabis operator as a victim and claims company data will be published on October 13. The claims are unverified.
A new onedump.py option outputs embedded files from multiple OneNote files as JSON. Piping the output to myjson-filter.py writes the files to disk using each file's SHA-256 hash as its name.
This sponsored guide offers practical advice for learning bug bounty skills: practise in authorized labs, verify findings with evidence, use AI for hints, and write reproducible reports. It also discusses changing submission quality at curl and Google programs.
Passkeys reduce phishing and reusable-credential risks, but organizations still need to secure identity enrollment and recovery and monitor for device, session, and account risks after authentication.
