cyber.hendryadrian.com is a cybersecurity news and threat intelligence aggregation platform. It collects external cybersecurity reporting and turns it into structured information that is easier to search, correlate, and explore.
ESET reports that Turla used its Cereal toolset against government entities in Kazakhstan and Romania in late 2025. The modular malware runs on Exchange servers to collect selected emails and execute commands in memory; its initial access method is unknown.
OpenSourceMalware reports that the sapho11 campaign targeted wallet projects with malicious pull requests, a credential-stealing Rust crate and maintainer phishing. The crate collected secrets during builds; two Zingo Labs pull requests remained open.
Sekoia’s investigation of October and November 2026 attacks on exposed Danfoss refrigeration controllers details disruptive parameter changes and a blocked unauthenticated exploit attempt; use of CVE-2025-41450 remains unconfirmed.
Apple updates fix two iMessage group-chat flaws, a Brotli decoder out-of-bounds write, and Bluetooth/AirPlay issues. CISA added the Brotli flaw to its Known Exploited Vulnerabilities catalog; Apple did not say whether the flaws were exploited.
SAP fixed four CVSS 10.0 flaws in NetWeaver and Web Dispatcher that reportedly require no login or user action. Two could enable remote code execution; others could allow privileged SAML logins or unauthorized SAP Gateway actions.
N-able took hosted N-central offline after researcher Sean Bales disclosed more than 30 alleged zero-days. The company said it had no evidence of exploitation and expected a hotfix around midday November 10.
AWS describes a write-time validation pipeline for Bedrock AgentCore Memory that combines semantic drift, injection patterns, namespace checks, and write-rate signals to allow, quarantine, or deny writes.
A guide to exporting Sekoia.io events through its search API, with steps for paginated retrieval, large exports, permissions and troubleshooting. It also describes reviewing logs in LogTotal.
A guide to exporting Datadog logs for Cloud SIEM investigations using the Logs Search API, cursor-based pagination, or cloud-storage archives, with notes on access, retention, rate limits, and separate security-signal APIs.
Kaspersky's Q3 2026 telemetry report records 311 million web attacks, 81,556 users targeted by ransomware and 217,024 targeted by miners, alongside findings on macOS, IoT and regional threat trends.
Kaspersky's Q3 2026 mobile report recorded 1.66 million attacks blocked and 378,456 malicious Android packages. It highlights banking Trojans, apps that may have used AI for fraud, and iOS spyware using DarkSword.
ReversingLabs found more malicious files referencing LLM APIs, but says those references do not prove model use or autonomous attacks. Its research also examines AI-related malware, PHP2Shell samples and defensive priorities.
Anthropic released Claude Fable 5.2 and Mythos 5.2. Fable 5.2 completed 76.3% of CyScenarioBench challenges, versus 61% for GPT-6 Cyber. Anthropic also updated Claude Security with continuous code scanning and fix tracking.
SAP’s November 2026 updates fix 35 vulnerabilities, including four CVSS 10 flaws in NetWeaver, Gateway and Web Dispatcher that SAP says allow unauthenticated remote attackers to fully compromise systems. Onapsis tracks two as ICM2SHELL and PROXYGATE.
Intezer researchers used AI-assisted workflows to recreate parts of Slack and Finder and build a working Turla replicant. The article also reports threat actors’ use of AI for reverse engineering and discusses risks to software IP and security.
France says the IRGC’s Shahid Kaveh unit carried out an October attack on refrigeration controllers at about 700 retail sites. Attackers allegedly altered defrost settings and disabled safety alerts, causing food losses and fires; a French investigation is underway.
France attributed the Oct. 12 attack on refrigeration systems at about 700 supermarkets to Iran’s Revolutionary Guard. Prosecutors opened an investigation; stores discarded food, and Intermarché reported tens of millions of euros in losses.
Fireworks AI says attackers reached its development machines through a third-party cloud provider incident and accessed customer metadata, billing information, and incomplete model weights and datasets. The company says it detected the activity and took remediation措施.
Eclipse's leak site claims to hold 832 GB of Taiwan Otsuka Pharmaceutical data and shows a publication countdown. The claim, data volume and contents have not been independently verified.
Ransomware group N0n claims it compromised managed IT provider Chibitek and exposed client financial records, network credentials, configuration secrets, and internal documents. The claim is unverified.
Ransomware.live reports that actor N0n listed a Michigan cannabis operator as a victim and claims company data will be published on October 13. The claims are unverified.
Varonis argues that AI agent security needs shared context across models, agents, and environments. Its proposed framework covers AI discovery, prompt and tool governance, intent-based controls, and threat detection and response.
A guide to exporting Carbon Black Cloud process data through the Platform Search API or Data Forwarder, then filtering and reviewing the JSON logs. It covers API setup, retention limits, common errors, and how Carbon Black EDR differs.
Forcepoint’s 2027 Future Insights essay argues that organizations need agentic capital management to assign ownership and accountability to AI agents, track their access, and pair workforce governance with security monitoring.
