🕵️ RESEARCH & DEEP DIVES
CVE-2026-78425: SAML Audience Confusion in NeuVector Allows Cross-SP Authentication
NeuVector fails to validate SAML assertion audiences, letting users of other apps behind the same IdP authenticate into it.- Affects NeuVector SAML SSO deployments using a corporate identity provider (CVE-2026-78425, CWE-287, CVSS 7.6 HIGH).
- Assertions issued for other apps (wiki, ticketing, expenses tool) are accepted because the Audience element mismatch is ignored.
- The NotInAudience warning is never read, so any authorised user of a sibling application can log into NeuVector.
- Status: Reserved 2026-08-24, published 2026-09-17; assigner SUSE, no affected version ranges listed.
Talos: Japan ransomware incidents up 4.7% in H1 2026; The Gentlemen tops list, Qilin seen using AI
Cisco Talos reports ransomware incidents in Japan rose 4.7% in the first half of 2026, led by The Gentlemen and with Qilin showing evidence of AI use.- Affects Japanese organizations, especially SMEs: firms capitalized under JPY 1 billion accounted for 78% of victims, up ~13% from 2025
- 90 organizations hit January–July 2026 (86 in the same period last year); manufacturing was the most affected sector at 34% of incidents
- The Gentlemen was the most active group with 14 incidents; its global leak-site listings grew from 48 in January to 105 in July (~2.2x); Qilin and SafePay had seven incidents each
- The Gentlemen operates a RaaS model with double extortion, active since around July 2025; possible involvement of Russian-speaking individuals
- Qilin, the second-most-active group in Japan, is leveraging AI to improve the efficiency of its operations
Unit42: Compromised Kubernetes Node Lets Root Attacker Steal Co-Located Workload Identities via SPIRE
Unit42 researchers showed a root-level attacker on a Kubernetes node can manipulate Linux cgroup data to make the local SPIRE agent issue other workloads' identities to a hostile process.- Affects Kubernetes deployments using SPIFFE/SPIRE for short-lived workload identities (SVIDs) used in mutual TLS and token-based access.
- A root-level attacker can create or manipulate a cgroup path resembling a target workload's, tricking the SPIRE agent's selector checks into issuing the target's credential.
- Technique is post-exploitation, requiring prior root control of the node; every workload identity on the node should be considered exposed.
- Unit42 built Spooffe, a tool that scans a node, recreates cgroup paths for running workloads, and requests their identities to measure exposure.
- Researchers said the technique has not been observed in the wild; valid workload identities could enable authentication to internal services and lateral movement as a legitimate service.
Security Boulevard profiles San Diego CISOs in a city that retains its security leaders
Security Boulevard has published a profile roundup of San Diego's CISOs and the local security community that keeps them.- Covers chief information security officers working in the San Diego area and their career trajectories in the region.
- Highlights regional security organizations including the San Diego CISO Roundtable, Cyber Center of Excellence, SIM San Diego, and the local InfraGard chapter.
- Describes San Diego's security community as unusually well organized for a city its size, with the city notable for retaining its security leaders.
Philadelphia's CISOs to Watch: Securing Health Systems and Heavy Industry
A new feature profiles the CISOs securing the Philadelphia region's health systems and heavy industry.- The story spotlights security leaders in the Delaware Valley, spanning health systems, insurers, pharmaceutical companies, and heavy industry.
- The healthcare-side organizations are governed under HIPAA and HITRUST regulatory frameworks.
- The two industries are described as opposites in culture but nearly identical in regulatory weight.
📋 ADVISORIES
- 📄 Source for Cisco Warns of Critical ISE 0-Day (CVE-2026-76460) Actively Exploited in Attacks — sec.cloudapps.cisco.com
🕵️ RESEARCH & DEEP DIVES
US takes down NightmareStresser DDoS-for-hire platform — BleepingComputer
How Candidates Could Use AI for Good — Schneier on Security
America’s cyber strategy overlooks the infrastructure that actually keeps the military moving — CyberScoop
Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Co... — CVE ThreatInt
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Us... — CVE ThreatInt
In Eclipse Ankaios versions 0.6.0 to before 1.0.4,
LogRule::matchesin the ... — CVE ThreatIntRubygem-foreman_ansible: ansible inventory api ignores view_hosts permission ... — CVE ThreatInt
Rubygem-foreman_ansible: unscoped lookupvalue deletion allows cross-model ove... — CVE ThreatInt
Admission Control Bypass via Hardcoded Sidecar Image ExemptionThe NeuVector a... — CVE ThreatInt
Logout bypass via alternate JWT spellingThe NeuVector JWT verifier accepts no... — CVE ThreatInt
Flaw in Nuevector can result in one user receiving another user's authenticat... — CVE ThreatInt
FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor — Cyber Security News
AWS Says Some Cloud Data Cannot Be Recovered After Data Centers Suffer War Damage — Cyber Security News
APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networks — Cyber Security News
BlackHatSect0r Uses DeepSeek-Powered AI Agent to Automate Attacks and Harvest 16,834 Credentials — Cyber Security News
Hackers Allegedly Selling Fortinet FortiGate 1-Day Vulnerability on Underground Forums — Cyber Security News
This is a really nice obit for Cat Frazier, who changed the internet for the better, not least for creating this... — @zackwhittaker@mastodon.social
Roblox Games, Piracy Platforms Fertile Ground for Terrorist Grooming — securityboulevard.com (discovered)
Detection engineering fundamentals for SOC teams — securityboulevard.com (discovered)
CISOs to Watch in the Twin Cities: From State Government to the Supply Chain — securityboulevard.com (discovered)
CISOs to Watch in Charlotte: From Theme Parks to Financial Services — securityboulevard.com (discovered)
CISOs to Watch in LA: From Movie Studios to Storage Units — securityboulevard.com (discovered)
The fact that AI safety testing doesn't bring in cyber pros was the subject of several conversations I had at the... — @metacurity@infosec.exchange
How are regulated organizations securely using non Co-Pilot LLMS? — r/cybersecurity
Which NIS2 country specific requirements concern you most? — r/cybersecurity
Pen Test Partners (PTP) UK, any insights? — r/cybersecurity
Preparing CompTIA Security+ the right way — <https://www.reddit.com/r