Dennis Fisher

The Joy and Pain of OT Cybersecurity: A Conversation With Lesley Carhart

Lesley Carhart has been cleaning up malware, intrusions, ransomware, and other messes in OT networks for the better part of two decades and recently joined Dennis Fisher on the Decipher podcast to talk about the special challenges OT networks present

Dennis Fisher · 4 min

JUL 15

Bug in Cursor Allows Simple RCE

This exploit occurs entirely in the background, requiring no user approval, dialogue prompts, or interaction.

JUL 8

Researchers Find New GhostApproval Bug in Many AI Coding Assistants

The bug is a modern twist on a Clinton-era piece of known Unix badness: following symbolic links.

Dennis Fisher · 4 min

JUL 7

Chinese APT UAT-7810 Expands Malware Arsenal

The investigation into UAT-7810 shows significant evolution in their toolkit, specifically the development of a successor to their previously documented SHORTLEASH backdoor.

JUL 1

Evil Is as Evil Does: New EvilTokens Affiliate Panel Uncovered

This new ARToken operator panel has a clear lineage going back to the EvilTokens framework, which emerged in early 2026.

JUN 26

New Turla Stockstay Backdoor Emerges

Known historically for its tight ties to Russia’s FSB and its development of the Snake implant, Turla has leveraged STOCKSTAY to target sensitive government and military organizations.

JUN 24

macOS Gaslight Backdoor Weaponizes Prompt Injection Against Security Analysts

Gaslight is a Rust-based backdoor that researchers from SentinelOne have attributed to DPRK-aligned threat actors.

JUN 18

FortiBleed Credential Theft Campaign Marches On

The campaign is not the result of a compromise of Fortinet itself, but rather involves the attackers testing a custom list of known passwords for Fortinet devices.

JUN 17

Mastra AI Hit By npm Compromise

The unknown threat actor gained unauthorized access to legitimate npm accounts, allowing them to inject malicious dependencies into widely used packages.

JUN 9

The Ugly Roots of the Surveillance State

We’ve arrived at a point where billions of us have opted in to types of surveillance that would have caused massive demonstrations just a couple of decades ago.

Dennis Fisher · 1 min

JUN 8

Check Point VPN Flaw Targeted by Ransomware Actors

The vulnerability is a critical one and Check Point Research said that it’s likely that the actor targeting the bug is a financially motivated group.

MAY 28

Vulnerabilities

The Past is Always Present in Vulnerability Disclosure

Microsoft’s reaction to the Nightmare-Eclipse saga is raising memories of the worst days of the disclosure debate.

Dennis Fisher · 4 min

MAY 26

Supply Chain

Coordinated Takedown Cripples Glassworm Malware Network

The disruption, which was a joint effort among CrowdStrike, Google, and the Shadowserver Foundation, targeted Glassworm’s C2 architecture, which was deliberately engineered for extreme resilience.

MAY 20

GitHub Confirms Internal Breach

The company said it is still working through the intrusion but does not believe any customer repositories or data was affected at this point.

MAY 19

Data Shows Thousands of Automatic Tank Gauges Exposed Across the US

As of May 2026, over 6,502 ATG services running on 6,057 unique hosts were found to be reachable on the public internet across more than 65 countries.

MAY 12

Ongoing Supply Chain Attack Expands to PyPi

Researchers have linked the compromise to the “Mini Shai-Hulud” campaign, which has been ongoing for several weeks and is associated with TeamPCP.

MAY 7

Supply Chain

New Dirty Frag Linux Bug Emerges

The vulnerability class is a potent new iteration of kernel bugs that corrupt the page cache of read-only files and is a follow-on to the recently disclosed Copy Fail Linux LPE bug.