Evidence-led cyber security writing for beginners, IT admins, SOC analysts, and security leaders. Every claim cited to a primary source.https://cyberneticsintern.com/enhttps://cyberneticsintern.com/blog/bambootoken-mqtt-broker-c2/https://cyberneticsintern.com/blog/bambootoken-mqtt-broker-c2/BambooToken runs command and control over MQTT. The host connects to a broker, the operator connects to the same broker, and the two never meet.Thu, 17 Sep 2026 00:00:00 GMTTHREAT-INTELtechnical-analysishttps://cyberneticsintern.com/blog/rubygems-publish-first-verify-later/https://cyberneticsintern.com/blog/rubygems-publish-first-verify-later/RubyGems gave out publish-capable keys before confirming the email, and a CDN handed one user's key to another. Who did it turned out not to matter.Sun, 13 Sep 2026 09:00:00 GMTSUPPLY-CHAINincident-breakdownhttps://cyberneticsintern.com/blog/cwe-288-alternate-path-cisco-citrix-kev/https://cyberneticsintern.com/blog/cwe-288-alternate-path-cisco-citrix-kev/CISA listed exploited CWE-288 authentication bypasses in Cisco Secure FMC and Citrix NetScaler on the same day. Neither vendor offers a workaround.Thu, 10 Sep 2026 09:00:00 GMTVULNdefensive-guidehttps://cyberneticsintern.com/blog/stylesmuggler-magento-cve-2026-75650/https://cyberneticsintern.com/blog/stylesmuggler-magento-cve-2026-75650/Adobe shipped an out-of-band hotfix for a CVSS 10.0 Magento zero-day after three days of exploitation. The implant beacons out shaped like NTP.Tue, 08 Sep 2026 02:00:00 GMTINCIDENTthreat-briefhttps://cyberneticsintern.com/blog/idscan-nexus-driver-licence-leak/https://cyberneticsintern.com/blog/idscan-nexus-driver-licence-leak/A dark web service listed 153 million US and Canadian licence scans, including the infrared and ultraviolet captures used to prove they are genuine.Sun, 06 Sep 2026 15:00:00 GMTIDENTITYincident-breakdownhttps://cyberneticsintern.com/blog/litellm-mcp-auth-bypass-cve-2026-59822/https://cyberneticsintern.com/blog/litellm-mcp-auth-bypass-cve-2026-59822/LiteLLM turned a failed key check into an empty identity, and that identity could reach MCP tools. CISA added CVE-2026-59822 to KEV on September 2, 2026.Sat, 05 Sep 2026 08:00:00 GMTAI-SECnews-explainerhttps://cyberneticsintern.com/blog/papercut-ng-mf-zero-day-cve-2026-81578/https://cyberneticsintern.com/blog/papercut-ng-mf-zero-day-cve-2026-81578/PaperCut NG and MF are under active exploitation. Two flaws chain into pre-auth code execution, and the one scored lower is the one that mattered.Wed, 02 Sep 2026 18:30:00 GMTINCIDENTtechnical-analysishttps://cyberneticsintern.com/blog/device-code-flow-phishing-entra-conditional-access/https://cyberneticsintern.com/blog/device-code-flow-phishing-entra-conditional-access/Security defaults block device code flow in new Entra tenants. The Conditional Access upgrade path does not include it, so older tenants stay open.Mon, 31 Aug 2026 09:00:00 GMTIDENTITYdefensive-guidehttps://cyberneticsintern.com/blog/kev-august-26-two-deadlines-privilege-escalation/https://cyberneticsintern.com/blog/kev-august-26-two-deadlines-privilege-escalation/CISA added six CVEs to KEV on August 26. Four trace to a published Talos report and got 14 days. Two appear in no research at all, and got three.Sat, 29 Aug 2026 13:35:00 GMTVULNnews-explainerhttps://cyberneticsintern.com/blog/tale-of-two-socs-red-team-detection/https://cyberneticsintern.com/blog/tale-of-two-socs-red-team-detection/CISA red-teamed two organisations at once with the same tradecraft. One never noticed. The other isolated three hosts in minutes off a medium alert.Fri, 28 Aug 2026 19:15:00 GMTDETECTpostmortemhttps://cyberneticsintern.com/blog/detection-programme-audit-five-checks/https://cyberneticsintern.com/blog/detection-programme-audit-five-checks/Five checks that tell you whether your detections work, each producing evidence rather than a coverage number. No vendor needed, and none takes a quarter.Fri, 28 Aug 2026 09:00:00 GMTDETECTdefensive-guidehttps://cyberneticsintern.com/blog/oracle-proxy-plugin-cve-2026-21962-kev/https://cyberneticsintern.com/blog/oracle-proxy-plugin-cve-2026-21962-kev/CISA added a CVSS 10.0 Oracle proxy flaw to KEV seven months after disclosure. The public exploitation evidence is thinner than the coverage suggests.Mon, 24 Aug 2026 22:30:00 GMTVULNnews-explainerhttps://cyberneticsintern.com/blog/ai-generated-exploit-scripts-siemens-s7/https://cyberneticsintern.com/blog/ai-generated-exploit-scripts-siemens-s7/Five US agencies say threat actors use AI to write exploit scripts for Siemens S7 PLCs. The advisory reports preparation, not compromise.Sun, 23 Aug 2026 16:00:00 GMTAI-SECthreat-briefhttps://cyberneticsintern.com/blog/ransom-busters-fake-recovery-service/https://cyberneticsintern.com/blog/ransom-busters-fake-recovery-service/A firm called Ransom Busters offers to delete stolen data for $20,000 to $60,000. GuidePoint assesses it is the affiliate that took the data in the first place.Sat, 22 Aug 2026 16:30:00 GMTRANSOMWAREthreat-briefhttps://cyberneticsintern.com/blog/entra-id-cve-2026-69836-cloud-kev/https://cyberneticsintern.com/blog/entra-id-cve-2026-69836-cloud-kev/Microsoft fixed a CVSS 10.0 Entra ID flaw before disclosing it and says no customer action is needed. CISA added it to KEV anyway. Both are right.Fri, 21 Aug 2026 18:30:00 GMTCLOUDnews-explainerhttps://cyberneticsintern.com/blog/autonomous-ai-campaign-cve-2026-33824/https://cyberneticsintern.com/blog/autonomous-ai-campaign-cve-2026-33824/Unit 42 documented an AI agent attacking unattended. The autonomous runs failed, the manual ones worked, and seven of eight target CVEs were already in KEV.Thu, 20 Aug 2026 21:26:00 GMTTHREAT-INTELthreat-briefhttps://cyberneticsintern.com/blog/ray-cve-2025-62593-browser-guard/https://cyberneticsintern.com/blog/ray-cve-2025-62593-browser-guard/CISA set an August 20, 2026 deadline for a Ray flaw whose fix shipped 271 days earlier. The guard it bypassed was a check on one header string.Wed, 19 Aug 2026 08:00:00 GMTAI-SECtechnical-analysishttps://cyberneticsintern.com/blog/vcenter-cve-2026-59310-mass-exploitation/https://cyberneticsintern.com/blog/vcenter-cve-2026-59310-mass-exploitation/A directory traversal in the vCenter syslog server gave attackers root without authentication. QUIRSO tracked 361 victim IPs in 47 countries inside three days.Tue, 18 Aug 2026 07:30:00 GMTINCIDENTincident-breakdownhttps://cyberneticsintern.com/blog/macos-screen-sharing-cve-2026-65400/https://cyberneticsintern.com/blog/macos-screen-sharing-cve-2026-65400/CVE-2026-65400 lets an attacker authenticate to macOS Screen Sharing with no credentials. Exposed Macs are being rooted and turned into Monero miners.Sun, 16 Aug 2026 20:45:00 GMTVULNnews-explainerhttps://cyberneticsintern.com/blog/lazarus-afd-zero-day-dream-job/https://cyberneticsintern.com/blog/lazarus-afd-zero-day-dream-job/Lazarus used a Windows kernel zero-day, CVE-2026-68820, to blind endpoint security after luring defence engineers with fake job offers.Sat, 15 Aug 2026 01:40:00 GMTTHREAT-INTELthreat-briefhttps://cyberneticsintern.com/blog/water-utility-plc-internet-exposure/https://cyberneticsintern.com/blog/water-utility-plc-internet-exposure/The FBI and CISA report attackers changing IP addresses and passwords on exposed water sector PLCs, causing pressure loss, flooding and manual operations.Sat, 15 Aug 2026 01:30:00 GMTINCIDENTdefensive-guidehttps://cyberneticsintern.com/blog/metabase-sql-injection-cve-2026-72898/https://cyberneticsintern.com/blog/metabase-sql-injection-cve-2026-72898/CVE-2026-72898 lets an unauthenticated attacker reach admin on Metabase and read every connected database credential. Metabase confirms active exploitation.Fri, 14 Aug 2026 18:20:00 GMTVULNnews-explainerhttps://cyberneticsintern.com/blog/gunra-ransomware-advisory/https://cyberneticsintern.com/blog/gunra-ransomware-advisory/A six-agency advisory details Gunra ransomware: Conti-derived, RaaS, double extortion. Its way in is vulnerabilities that have been on the KEV list since 2025.Fri, 14 Aug 2026 17:40:00 GMTRANSOMWAREthreat-briefhttps://cyberneticsintern.com/blog/shai-hulud-npm-worm-keyv/https://cyberneticsintern.com/blog/shai-hulud-npm-worm-keyv/On August 4, 2026 a self-replicating worm hijacked the keyv npm package family, stealing developer credentials and using them to infect hundreds more packages.Fri, 14 Aug 2026 17:10:00 GMTSUPPLY-CHAINincident-breakdownhttps://cyberneticsintern.com/blog/langflow-rce-ai-tooling-kev/https://cyberneticsintern.com/blog/langflow-rce-ai-tooling-kev/CVE-2026-9198 lets an unauthenticated attacker run code on default IBM Langflow deployments. CISA added it to the exploited list on August 4, 2026.Fri, 14 Aug 2026 16:30:00 GMTAI-SECnews-explainerhttps://cyberneticsintern.com/blog/cisco-asa-ftd-vpn-dos-kev/https://cyberneticsintern.com/blog/cisco-asa-ftd-vpn-dos-kev/CVE-2026-20349 lets an unauthenticated attacker reboot Cisco ASA and FTD firewalls via the VPN service. Cisco confirms exploitation and offers no workaround.Fri, 14 Aug 2026 10:00:00 GMTVULNnews-explainerhttps://cyberneticsintern.com/blog/payroll-pirate-storm-2755/https://cyberneticsintern.com/blog/payroll-pirate-storm-2755/Storm-2755 is redirecting Canadian salaries by hijacking Microsoft 365 sessions and editing Workday. The FBI described this same playbook back in 2018.Fri, 14 Aug 2026 09:00:00 GMTIDENTITYthreat-brief