🕵️ RESEARCH & DEEP DIVES
AWS publishes incident response guide for CloudTrail investigations – Part 1
AWS has published a guide walking through how to investigate security incidents using AWS CloudTrail logs.- Applies to AWS customers and security teams investigating suspicious activity in their AWS environments
- The guide explains which CloudTrail log fields matter and how to interpret them when investigating incidents
- Part 1 walks through real-world scenarios showing how to analyze CloudTrail events to uncover the full scope of an incident
Coder's registry infrastructure compromised to push malicious modules — BleepingComputer
Large Enterprises Targeted in Fake Merger & Acquisition Scams — Dark Reading
What We Missed: Did ShinyHunters 'Breach' ReliaQuest? — Dark Reading
ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories — The Hacker News
The G7 tells industry to hurry up and prep for post-quantum encryption — CyberScoop
The story behind the intelligence — Cisco Talos
Divide-by-zero in Xpdf 4.06 due to zero-height Type 3 glyphDivide-by-zero in ... — CVE ThreatInt
MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap ... — CVE ThreatInt
stream-json: pick/ignore/filter/replace filters are O(depth2) on nested input... — CVE ThreatInt
Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the av... — CVE ThreatInt
Use of released resource in Mobile in Google Chrome on on Android prior to 15... — CVE ThreatInt
Improper input validation in Transactions Platform in Google Chrome on on iOS... — CVE ThreatInt
Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed... — CVE ThreatInt
Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.79... — CVE ThreatInt
Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.79... — CVE ThreatInt
Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote... — CVE ThreatInt
Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed... — CVE ThreatInt
Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote... — CVE ThreatInt
R2R 3.6.6 SQL Injection via Retrieval Search Filter KeyR2R through 3.6.6 cont... — CVE ThreatInt
itsourcecode Online Medicine Delivery System index.php cross site scriptingA ... — CVE ThreatInt
Medplum - Exposure of OAuth client secret via dynamic registration endpoint i... — CVE ThreatInt
Incident response guide for AWS CloudTrail investigations – Part 2 — AWS Security Blog
Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models — Cloudflare Blog
@ jpsays Any insights on same subnet RDP inbound 3389 to a desktop listening for TermServ would not respond to SYN, and... — @SwiftOnSecurity@infosec.exchange
python-jose HS256 Token Forgery (CVE-2026-85394) — thehackerwire.com (discovered)
GeoNetwork Critical RCE via XSLT Processor Misconfiguration (CVE-2026-58400) — thehackerwire.com (discovered)
Bankrupting the Adversary: Why Cybersecurity is an Economic War — securityboulevard.com (discovered)
Millions of US/Canadian drivers license being sold - Who do we think got breached? Id.me? Verify.me? — r/cybersecurity
Breaking Down Appsec Part 1: Application Context — r/cybersecurity
newbie question here about cyber security and the future — r/cybersecurity
Network pentesters with 2–3 years of experience: What does your day-to-day work actually look like? — r/cybersecurity
📋 ADVISORIES
- 📄 Source for Chrome DevTools use-after-free (CVE-2026-85042) allows sandbox-escape code execution, fixed in 152.0.7977.82 — chromereleases.googleblog.com