cyber.hendryadrian.com is a cybersecurity news and threat intelligence aggregation platform. It collects external cybersecurity reporting and turns it into structured information that is easier to search, correlate, and explore.
Hexastrike reconstructs a Qilin intrusion at a German company, detailing S5PIVOT, a Python-based SOCKS5 backconnect proxy, credential-led access, evidence of cloud exfiltration and encryption, and defensive lessons. The total data transferred remains unknown.
CTM360 says it identified 1,000+ incidents in fake gift-card campaigns impersonating major brands. The portals use deceptive verification loops to drive surveys, app installs and paid subscriptions; CTM360 says no rewards were delivered in tested flows.
CIS CTI reports device code phishing activity rising against U.S. SLTTs as PhaaS kits automate OAuth 2.0 account takeovers. It describes token persistence and post-compromise abuse, and advises revoking tokens and removing rogue device registrations.
CVE-2026-19868 can let users with valid alternate-method credentials bypass SAML and enforced MFA on affected SonicOS SSL VPNs. SonicWall investigated a report of potential exploitation; CISA added the flaw to its KEV catalog.
CVE-2026-119977 can leave some WordPress sites exposed while the fix installs, because the updater initially uses old code. Researchers recommend blocking web access to wp-content/upgrade; successful exploitation is not established.
Previdian reported exploitation attempts within nine hours of SSHole’s disclosure and confirmed root access on an Alpine Linux honeypot. The flaw affects specific musl-based OpenSSH configurations; OpenSSH 10.6p2 addresses it.
AWS describes a multi-tenant EKS architecture that uses namespace-scoped mTLS gateways, NetworkPolicies, JWT validation, and managed TURN relay to secure protocols such as ADB and WebRTC, with reported ADB gateway latency below 50 ms.
A guide shows how to export Trellix Helix logs through its search API, prepare JSON events, and troubleshoot authentication, instance, query, and result-limit errors before reviewing the data in LogTotal.
A practical guide to exporting FortiSIEM events through its REST query API, polling for results, extracting raw log messages, and troubleshooting common export problems.
The ITRC’s 2026 report finds unauthorized device access rose to 27.2% of reported identity compromises, while 25.6% of individuals contacting the center faced multiple incidents. Its findings describe patterns in identity misuse, recovery and prevention.
Ping Identity and Deloitte outline six 2026 IAM trends, including AI-agent identity, helpdesk and hiring fraud, decentralized identity, quantum-resistant cryptography and continuous verification, alongside global trust survey findings.
Google Cloud’s H1 2026 Threat Horizons report says identity issues featured in 83% of H2 2025 cloud/SaaS incidents and data was targeted in 73%, while software exploitation overtook weak credentials; it details insider risks, intrusion cases and response guidance.
Brava Security emerged from stealth with a $15 million seed round. The startup says its platform simulates attacker behavior, analyzes security telemetry for gaps, and rewrites SIEM detections.
Microsoft says Storm-3358 used ARTEX in attacks on financial organizations, combining web application exploitation, web shells, compromised credentials and RATs. The report includes detection guidance, hunting queries and IOCs.
Unit 42 describes reported attacks that set European refrigeration units to defrost, affecting supermarkets and medical facilities. It also found over 5,000 internet-exposed devices from manufacturers named in a CERT-FR advisory; exposure does not establish that devices
Crédit Mutuel Arkéa says an attacker reached its network through a service provider’s platform and used the bank’s account for fraudulent transfers. ZachXBT estimated losses at $133 million, but the bank did not confirm that figure.
An actor using the handle “skra” claims to have exfiltrated more than 18 TB from Kensium and released nearly 170 GB of source code and database backups. The breach and data claims are unverified.
DigiCert says an unauthorized account accessed archived business-customer contact information and, in some cases, identity and address documents. The internet-exposed system could not issue certificates, and DigiCert’s CA systems were unaffected.
Eclipse's leak site claims to hold 832 GB of Taiwan Otsuka Pharmaceutical data and shows a publication countdown. The claim, data volume and contents have not been independently verified.
Ransomware group N0n claims it compromised managed IT provider Chibitek and exposed client financial records, network credentials, configuration secrets, and internal documents. The claim is unverified.
Ransomware.live reports that actor N0n listed a Michigan cannabis operator as a victim and claims company data will be published on October 13. The claims are unverified.
A MalwareINFO Pro walkthrough traces an obfuscated JSE and encrypted PowerShell wrapper through recovered source, embedded PE files, and configured endpoint candidates, while distinguishing recovered artifacts from unobserved runtime behavior.
The sponsored article argues that insider-risk detection needs user-specific context, not isolated anomalies, and presents Ent’s endpoint AI as a way to distinguish malicious activity, compromise and mistakes. It describes two anonymized customer investigations.
A guide to exporting Wazuh alerts from manager files or the OpenSearch indexer, filtering records, and accessing full_log data. It explains that exporting all received events requires enabling logall_json in advance.
