cyber.hendryadrian.com is a cybersecurity news and threat intelligence aggregation platform. It collects external cybersecurity reporting and turns it into structured information that is easier to search, correlate, and explore.
ESET says the Russia-aligned Gorbag group targeted Ukrainian organizations with phishing and malicious RAR archives exploiting CVE-2025-8088, stealing browser credentials, VPN configurations and files with its BeautyStealer infostealer.
Analysis traces a signed funding-form decoy through DLL side-loading to an unattributed plugin-based RAT. Sandbox traffic showed an operator viewing the screen and browsing files; the article also details persistence and defensive hunting advice.
FortiGuard Labs attributes a South Asia-focused campaign to suspected BITTER with high confidence. Three Windows infection chains use LNK, URL and VHDX lures to deploy PapRAT; a Rust variant adds commands and HTTPS C2.
VulnCheck says attackers exploited unauthenticated Node-RED flaw CVE-2026-58115, using malicious flows to deploy Linux bots and persistent webshells. Siemens patched the flaw in SIMATIC IoT2050 Advanced 4.3.4.1 and later.
CVE-2026-98432 is a Linux IPv4 TCP use-after-free rated 9.8; it may allow unauthenticated remote code execution. RHEL fixes are available, while Ubuntu updates remain in opt-in testing. No in-the-wild attacks have been reported.
BTCPay Server says Bitcoin and Litecoin theft reports involve instances running 2.4.1 or earlier and a vulnerability patched in 2.4.2. It urges affected users to move to a fresh server and wallet; a link to an earlier flaw remains unclear.
A practical guide to identifying DKIM replay attacks, distinguishing them from relays and spoofing, and responding with DMARC enforcement, message-level evidence, old-key removal, and Amazon SES monitoring.
A SOC Prime guide gives API and CLI export routes for major SIEMs, recommends narrow time windows and raw events, and explains permission, time-zone and retention limits. It also promotes LogTotal for file-based analysis.
A practical guide to granting read and export access to Windows event logs without local admin rights, checking channel permissions, enabling remote access, and troubleshooting common access and forwarding issues.
CYFIRMA analyzed 42 incidents from Nov. 2025–Oct. 2026; 34 involved supplier pathways. It assesses October’s cluster as an uncoordinated disclosure wave and says AI speeds flaw discovery and puts AI tooling at risk, recommending stronger supplier controls and resilience
Microsoft analyzes 2,056 CVEs exploited in the wild through September 2026, finding exploitation concentrated in takeover vulnerabilities and outpacing patching. It recommends prioritizing high-impact flaws on exposed, critical assets.
A Broadcom-commissioned Q3 2026 Forrester Consulting survey of 253 cybersecurity decision-makers found midmarket teams face resource constraints and tool sprawl; 64% had implemented XDR, and most adopters reported or anticipated faster response and better root-cause فهم
Google’s November 2026 Android updates fix more than 200 vulnerabilities, including critical flaws. The most severe, CVE-2026-58868, could enable remote code execution without user interaction.
ESET reports Russia-aligned Gorbag has targeted Ukrainian organizations since at least February 2025 using infostealers and reverse shells. Trend Micro linked the actor to attacks exploiting patched WinRAR vulnerability CVE-2025-8088.
Kaspersky’s MLEP in KICS for Networks 5.0 uses recurring network behavior to refine OT device categories and alert on anomalies. Its aggregated events cannot reconstruct packet order or command contents, and results depend on traffic visibility.
More than 100 European stores reported refrigeration disruptions resembling attacks in France earlier in October. Retailers blamed a cyberattack, but investigators have not linked the waves; internet-exposed controllers and food losses were reported.
Attackers remotely altered supermarket refrigeration controls in Belgium, Sweden, Estonia and elsewhere, causing some food losses. Outdated software and insecure connections were cited; no actor or link to the earlier French attacks was confirmed.
Have I Been Pwned analyzed data from Harvard’s breach and found information linked to 850,500 accounts. ShinyHunters claimed responsibility and said it stole records; Harvard said the affected systems did not store Social Security numbers, passwords, or payment card or.
Eclipse's leak site claims to hold 832 GB of Taiwan Otsuka Pharmaceutical data and shows a publication countdown. The claim, data volume and contents have not been independently verified.
Ransomware group N0n claims it compromised managed IT provider Chibitek and exposed client financial records, network credentials, configuration secrets, and internal documents. The claim is unverified.
Ransomware.live reports that actor N0n listed a Michigan cannabis operator as a victim and claims company data will be published on October 13. The claims are unverified.
The article explains a four-part approach to exposure prioritization—threat intelligence, asset context, exploitability modeling and security control validation—and describes how Picus says its platform combines them.
The article argues that CISA’s 2030 goals require operators to reassess trust in OT devices, software, identities, and AI agents, enforce access limits, and test whether access can be revoked without interrupting essential services.
Gen Threat Labs describes “BillBait,” misleading mobile subscriptions that use SMS-code autofill to make recurring-payment authorization resemble routine phone verification, and recommends reading the full SMS before submitting a code.
