cyber.hendryadrian.com is a cybersecurity news and threat intelligence aggregation platform. It collects external cybersecurity reporting and turns it into structured information that is easier to search, correlate, and explore.
Microsoft describes a fake-download campaign that uses trojanized Inno-style installers to silently deploy proxyware, distributed-computing software, and adware-style utilities, and provides investigation and mitigation guidance.
Check Point researchers found that the Haiou Codex jailbreak modifies agent instructions to inject gateway ads into responses. They also observed the bundle in a threat actor’s toolkit, but found no evidence it was designed for cybercrime.
Researchers analyzed a signed fake “Google Workspace” MSIX that uses an .appinstaller file to obtain a server and ID, then runs server-supplied PowerShell via WebView2. The final payload was unavailable; a traffer connection is only a suspected fit.
Node2Shell (CVE-2026-111497) is a critical out-of-bounds write in Brotli decoding that can enable remote code execution. The article reports in-the-wild exploitation and lists fixes for Node.js and Bun.
Barracuda disclosed two flaws that could be chained to bypass authorization and gain root access on affected devices. Exploitation requires access to an affected product’s administrative interface; customers should install the latest firmware and patches.
VulnCheck says attackers exploited unauthenticated Node-RED flaw CVE-2026-58115, using malicious flows to deploy Linux bots and persistent webshells. Siemens patched the flaw in SIMATIC IoT2050 Advanced 4.3.4.1 and later.
A LogTotal review of 11 events examines Brotli decoder crashes and suspicious follow-on processes across Node.js, Python and Windows hosts in a Node2Shell (CVE-2026-111497) sample, with cross-runtime patching and triage guidance.
A controlled emulation of Kimsuky-style activity generated 3,087 Windows audit events on a domain controller. The article checks LogTotal alerts against raw events and outlines detection, containment, credential-reset, and logging steps.
A six-event PHP2Shell sample links PHP memory-exhaustion errors and a worker crash to shell spawning and a reverse shell. The article uses LogTotal to show detection and recommends patching, removing persistence, and hunting PHP logs.
An NCSC assessment outlines three possible AI-cyber threat scenarios through 2028, forecasting increased attacks on the UK and its critical infrastructure while emphasizing that the scenarios are plausible possibilities, not predictions.
A sponsored summary of Gartner's 2026 report says AI agents are reducing routine alert work, shifting SOC roles toward case ownership, SOC engineering and exposure management; it outlines related staffing, training and measurement changes.
CYFIRMA analyzed 42 incidents from Nov. 2025–Oct. 2026; 34 involved supplier pathways. It assesses October’s cluster as an uncoordinated disclosure wave and says AI speeds flaw discovery and puts AI tooling at risk, recommending stronger supplier controls and resilience
CIS announced benchmark updates for Windows, Edge, Docker, Kubernetes, AWS, PostgreSQL and other platforms, alongside new benchmarks and build kits. Changes include revised recommendations, assessment content and support for newer platform versions.
An email sent in mSeven Software’s name urged current and former mSecure customers to change passwords and consider resetting 2FA and removing passkeys after unspecified suspicious activity. The company had not publicly confirmed it by Nov. 3, and exposure remains unpro
Microsoft says Agent 365 provides identity, access controls, discovery, and governance for AI agents. The company describes integrations, planned discovery expansion, and an Action Center for automated governance actions.
Chainstack says an attacker used a third-party component to access development and production systems, including a database with customer information and password hashes. The company detected and cut off access, and advises customers to rotate credentials and API keys.
Binance says a trojanized Homebrew installer and a fake job interview led to engineer endpoint compromise and abuse of internal AI tooling, culminating in unauthorized wallet-signing transactions and a reported $6.43 billion asset theft.
OPSSHIELD says an attacker compromised cPGuard’s update system and sent a malicious script to versions 5.88.12–5.88.19, installing a backdoor and collecting sensitive files. The company estimates 32 files were taken and urges affected servers to update and rotate keys.
Eclipse's leak site claims to hold 832 GB of Taiwan Otsuka Pharmaceutical data and shows a publication countdown. The claim, data volume and contents have not been independently verified.
Ransomware group N0n claims it compromised managed IT provider Chibitek and exposed client financial records, network credentials, configuration secrets, and internal documents. The claim is unverified.
Ransomware.live reports that actor N0n listed a Michigan cannabis operator as a victim and claims company data will be published on October 13. The claims are unverified.
The article argues that complete secure-configuration baselines can reduce attack surface before vulnerabilities are disclosed, citing SMBv1, App Installer and MFA examples while noting that hardening complements—not replaces—patching and other defenses.
A guide to exporting Falcon LogScale events through its query API or search UI, converting NDJSON @rawstring data to raw logs, and troubleshooting permissions, timestamps, aggregation, missing fields and timeouts.
LogTotal masks identifying values in plain-text, CSV and JSON uploads while preserving patterns needed for detection. EVTX files are not sanitized, so users should review data before uploading and follow their organization’s handling rules.
