Security news and analysis, without the fear.https://decipher.sc/https://decipher.sc/2026/10/20/critical-php-flaws-disclosed-patches-out-now/https://decipher.sc/2026/10/20/critical-php-flaws-disclosed-patches-out-now/The two flaws are CVE-2026-109618 and CVE-2026-109619 and are said to affect PHP versions 5, 6, 7, and 8.Tue, 20 Oct 2026 19:34:12 GMTVulnerabilitieshttps://decipher.sc/videos/when-hackers-meet-policymakers-beau-woods/https://decipher.sc/videos/when-hackers-meet-policymakers-beau-woods/Cybersecurity policy can stall when technical experts and lawmakers speak different languages. Beau Woods, CEO and founder of Stratigos Security, joins Lindsey O’Donnell-Welch to explain how Hackers on the Hill brings cybersecurity researchers and policymakers together to build understanding and move ideas forward.Tue, 20 Oct 2026 11:37:15 GMTGovernmenthttps://decipher.sc/2026/10/18/ongoing-microsoft-365-campaign-abuses-connectwise-app/https://decipher.sc/2026/10/18/ongoing-microsoft-365-campaign-abuses-connectwise-app/Threat actors have compromised a credential within the vendor’s infrastructure, allowing them to abuse a client assertion that bypasses traditional user authentication.Sun, 18 Oct 2026 15:59:29 GMTIntrusionsMicrosofthttps://decipher.sc/2026/10/15/the-odyssey-and-infosec-how-we-got-from-zeuss-law-to-zero-trust/https://decipher.sc/2026/10/15/the-odyssey-and-infosec-how-we-got-from-zeuss-law-to-zero-trust/Nolan casts the invention of the Trojan horse as the ultimate violation of “Zeus’s law,” the idea that you should treat any stranger you encounter with kindness and respect, because they could very well be Zeus in disguise.Thu, 15 Oct 2026 12:31:14 GMTMalwarehttps://decipher.sc/2026/10/13/ivanti-patches-connect-secure-zero-day-exploited-in-attacks/https://decipher.sc/2026/10/13/ivanti-patches-connect-secure-zero-day-exploited-in-attacks/Ivanti warns of active exploitation of CVE-2026-104935, a high-severity Connect Secure flaw.Tue, 13 Oct 2026 21:52:35 GMTVulnerabilitieshttps://decipher.sc/videos/the-clickfix-epidemic-and-ai-enabled-attacks-john-hammond/https://decipher.sc/videos/the-clickfix-epidemic-and-ai-enabled-attacks-john-hammond/John Hammond of Huntress joins Dennis Fisher to dive into the ClickFix attack episdemic, how these attacks work, what the payloads are, and what individuals and organizations can do to protect themselves against them.Tue, 13 Oct 2026 17:47:29 GMTMalwarehttps://decipher.sc/2026/10/07/healthcare-cybersecurity-has-a-problem-this-bill-wants-to-fix-it/https://decipher.sc/2026/10/07/healthcare-cybersecurity-has-a-problem-this-bill-wants-to-fix-it/Two years after the largest healthcare cybersecurity incident in history, the senate has passed The Health Care Cybersecurity and Resiliency Act of 2025.Thu, 08 Oct 2026 00:26:00 GMTIntrusionshttps://decipher.sc/2026/10/07/patching-faster-has-never-been-the-answer/https://decipher.sc/2026/10/07/patching-faster-has-never-been-the-answer/Patching is a necessary evil and doing it manually in any decent sized organization was essentially impossible in the pre-AI times and is now pure folly.Wed, 07 Oct 2026 15:30:03 GMTAIVulnerabilitieshttps://decipher.sc/2026/10/06/fbi-warns-of-fortibleed-attacks-leading-to-lockouts-ransomware/https://decipher.sc/2026/10/06/fbi-warns-of-fortibleed-attacks-leading-to-lockouts-ransomware/FortiBleed attacks are continuing, with the FBI and Secret Service warning of compromised Fortinet firewalls, account lockouts and potential ransomware activity.Tue, 06 Oct 2026 23:27:08 GMTIntrusionshttps://decipher.sc/2026/10/06/ai-may-be-the-future-but-talent-is-what-builds-security/https://decipher.sc/2026/10/06/ai-may-be-the-future-but-talent-is-what-builds-security/While AI is reshaping the threat landscape, the people defending against those threats remain vital.Tue, 06 Oct 2026 15:44:31 GMTAIGovernmenthttps://decipher.sc/2026/10/06/catch-me-if-you-can-is-the-social-engineeers-playbook/https://decipher.sc/2026/10/06/catch-me-if-you-can-is-the-social-engineeers-playbook/The reality is that a lot of what hackers actually do is just social engineering in one form or another.Tue, 06 Oct 2026 10:19:02 GMThttps://decipher.sc/2026/10/03/new-citrix-netscaler-issue-emerges/https://decipher.sc/2026/10/03/new-citrix-netscaler-issue-emerges/The vendor says this is a configuration-dependent issue rather than a failure of the security patches themselves.Sat, 03 Oct 2026 17:29:03 GMTVulnerabilitieshttps://decipher.sc/videos/edge-devices-under-attack-a-threatcon-preview-and-communication-breakdowns/https://decipher.sc/videos/edge-devices-under-attack-a-threatcon-preview-and-communication-breakdowns/Today we have for you a buffet of zero days being exploited in edge security products, including Citrix and Fortinet, then we discuss the importance of communications from vendors when bad things happen, and finally we preview VulnCheck’s THREATCON1, which takes place next week.Fri, 02 Oct 2026 17:42:41 GMTVulnerabilitieshttps://decipher.sc/2026/10/01/cisco-warns-of-critical-exploited-catalyst-sd-wan-manager-flaw/https://decipher.sc/2026/10/01/cisco-warns-of-critical-exploited-catalyst-sd-wan-manager-flaw/Cisco “strongly recommends” customers apply a patch for a critical API authentication bypass that’s being exploited.Thu, 01 Oct 2026 13:13:44 GMTVulnerabilitieshttps://decipher.sc/2026/09/29/inside-the-citrix-netscaler-zero-day-saga/https://decipher.sc/2026/09/29/inside-the-citrix-netscaler-zero-day-saga/This case is yet another reminder just how important vendor communication is in such incidents and how much uncertainty can hamper security.Tue, 29 Sep 2026 14:55:40 GMTMalwareVulnerabilitieshttps://decipher.sc/videos/the-malware-that-asks-ai-what-to-do-next-ryan-fetterman/https://decipher.sc/videos/the-malware-that-asks-ai-what-to-do-next-ryan-fetterman/Ryan Fetterman from Cisco Talos sits down with Decipher’s Lindsey O’Donnell-Welch to talk about ClosedQuorum, the first reported malware binary with an autonomous command-and-control. They talk about the wide range of ways threat actors are using AI, and useful detection strategies for AI-assisted attacks.Tue, 29 Sep 2026 13:47:44 GMTAIhttps://decipher.sc/2026/09/27/researchers-warn-of-citrix-netscaler-exploitation/https://decipher.sc/2026/09/27/researchers-warn-of-citrix-netscaler-exploitation/On Saturday, researchers from watchTowr Labs said they had credible information that attackers were exploiting an unknown RCE vulnerability in Citrix NetScaler boxes.Sun, 27 Sep 2026 14:05:55 GMTVulnerabilitieshttps://decipher.sc/videos/fbi-hack-fallout-eviltokens-takedown-and-the-f5-zero-day/https://decipher.sc/videos/fbi-hack-fallout-eviltokens-takedown-and-the-f5-zero-day/This week we dig into the ShinyHunters hack of the FBI and what it means not just for the FBI personnel but for the attackers, then we discuss the disruption of the EvilTokens phishing operation by Microsoft, and finally we talk about the F5 BIG-IP zero day and some odds and ends from LabsCon. Note:…Sat, 26 Sep 2026 13:43:08 GMTAIhttps://decipher.sc/2026/09/24/f5-cve-2026-94127-taregted-in-active-attacks/https://decipher.sc/2026/09/24/f5-cve-2026-94127-taregted-in-active-attacks/This vulnerability allows for unauthenticated remote code execution and shows how a missing bounds check—a classic programming error.Thu, 24 Sep 2026 19:02:56 GMTVulnerabilitieshttps://decipher.sc/2026/09/22/researchers-find-windows-malware-sample-with-autonomous-c2-functionality/https://decipher.sc/2026/09/22/researchers-find-windows-malware-sample-with-autonomous-c2-functionality/Cisco Talos researchers identified ClosedQuorum, a Windows implant that uses multiple LLMs to autonomously select attack actions. The catch: there’s no confirmation that it’s actually been deployed in the wild.Tue, 22 Sep 2026 23:26:19 GMTAIMalwarehttps://decipher.sc/videos/assessing-ai-model-security-from-the-outside-in-matt-fredrikson/https://decipher.sc/videos/assessing-ai-model-security-from-the-outside-in-matt-fredrikson/The security and reliability of the code in AI models is a huge question mark, because the models are black boxes that aren’t accessible to outsiders. Matt Fredrikson, professor at Carnegie Mellon University and founder of Gray Swan AI, joins Dennis to talk about the challenge of assessing these models and how a community of…Tue, 22 Sep 2026 14:53:39 GMTAIhttps://decipher.sc/2026/09/21/fake-lastpass-authenticator-pages-deliver-rapuncel-infostealer/https://decipher.sc/2026/09/21/fake-lastpass-authenticator-pages-deliver-rapuncel-infostealer/Attackers impersonated LastPass Authenticator on fake GitHub pages to deliver the Rapuncel infostealer in a campaign involving 40 fake brands.Tue, 22 Sep 2026 00:57:38 GMTMalwarehttps://decipher.sc/2026/09/21/we-have-enough-ai-realism-in-a-time-of-relentless-hype/https://decipher.sc/2026/09/21/we-have-enough-ai-realism-in-a-time-of-relentless-hype/Let’s ask a simple question that seems to be getting lost in all of the credulous fervor around AI: How’s this working out for everyone?Mon, 21 Sep 2026 15:48:03 GMTAIhttps://decipher.sc/videos/the-real-story-on-ai-security-live-from-labscon/https://decipher.sc/videos/the-real-story-on-ai-security-live-from-labscon/Dennis joins from the last LabsCon conference, which featured amazing keynotes from Prof. James Mickens on AI reality and myths, Katie Moussouris on why humans are more vital than ever in security, and Dino Dai Zovi on using hardware to break attack chains,Mon, 21 Sep 2026 13:05:59 GMTAIhttps://decipher.sc/2026/09/17/new-sparrowocky-backdoor-targets-latin-america/https://decipher.sc/2026/09/17/new-sparrowocky-backdoor-targets-latin-america/Active since at least August 2025, the malware represents a functional pivot from the threat actor’s existing SparrowDoor backdoor.Thu, 17 Sep 2026 10:00:00 GMTGeneralhttps://decipher.sc/2026/09/16/us-uk-agencies-detail-iranian-malware-campaign-targeting-dissidents/https://decipher.sc/2026/09/16/us-uk-agencies-detail-iranian-malware-campaign-targeting-dissidents/A new joint advisory from multiple law enforcement agencies this week warned of an Iranian cyber campaign targeting dissidents and journalists in the U.S., UK, and elsewhere.Thu, 17 Sep 2026 00:37:50 GMTGovernmentLaw Enforcementhttps://decipher.sc/videos/the-vulnpocalypse-myth-jeremiah-grossman/https://decipher.sc/videos/the-vulnpocalypse-myth-jeremiah-grossman/We’ve heard all of the hysteria around the Vulnpocalypse caused by AI-assisted bug hunting and the shrinking time to exploit window. Now Jeremiah Grossman dispels those myths and shows exactly what the data reveals about how many bugs are actually exploited and how long it takes for attackers to target them.Wed, 16 Sep 2026 16:43:07 GMTAIVulnerabilitieshttps://decipher.sc/2026/09/14/here-come-the-ai-generated-bec-scams/https://decipher.sc/2026/09/14/here-come-the-ai-generated-bec-scams/Messages delivered through legitimate third-party email infrastructure had C-suite sender display names, custom signatures, and direct approval notes.Mon, 14 Sep 2026 13:12:44 GMTAIMicrosofthttps://decipher.sc/videos/securing-communications-in-an-ai-assisted-world-christine-gadsby/https://decipher.sc/videos/securing-communications-in-an-ai-assisted-world-christine-gadsby/Christine Gadsby of BlackBerry, a longtime security executive, joins Dennis to talk about her extensive experience in cybersecurity, the evolution of security practices, the challenges of securing mobile communications, and the impact of AI on the security industry.Wed, 09 Sep 2026 00:11:26 GMTAIhttps://decipher.sc/2026/09/08/russian-national-extradited-to-us-to-face-bank-account-takeover-charges/https://decipher.sc/2026/09/08/russian-national-extradited-to-us-to-face-bank-account-takeover-charges/A Russian web developer allegedly behind a massive bank account takeover scheme was extradited to the U.S.Wed, 09 Sep 2026 00:09:48 GMTLaw Enforcementhttps://decipher.sc/2026/09/06/microtik-routers-under-attack-in-new-campaign/https://decipher.sc/2026/09/06/microtik-routers-under-attack-in-new-campaign/Labeled “MikroTrick” by researchers at CERT Polska who discovered and disclosed six vulnerabilities in the software,  the campaign targets devices with SSH services reachable from the public internetSun, 06 Sep 2026 20:37:40 GMTVulnerabilitieshttps://decipher.sc/videos/microsoft-teams-phishing-a-botnet-takedown-23-years-in-the-making-and-the-cuckoos-eggs-lessons/https://decipher.sc/videos/microsoft-teams-phishing-a-botnet-takedown-23-years-in-the-making-and-the-cuckoos-eggs-lessons/It’s our one year anniversary! This week we talk about the highlights of the last year, a new high-level phishing campaign that uses Microsoft Teams as an initial access vector, and the takedown of the ancient Sality P2P botnet. Then we offer some book and TV recommendations for the long weekend. Links One year of…Fri, 04 Sep 2026 10:34:18 GMTMicrosofthttps://decipher.sc/2026/09/03/new-campaign-weaponizes-microsoft-teams-for-remote-access/https://decipher.sc/2026/09/03/new-campaign-weaponizes-microsoft-teams-for-remote-access/Unlike standard commodity malware that aims for quick credential theft, this campaign features a manual, hands-on-keyboard scheme designed to escalate rapidly from a single compromised workstation to broad, network-wide access.Thu, 03 Sep 2026 15:46:43 GMTIntrusionsMicrosofthttps://decipher.sc/2026/09/02/one-year-of-decipher-relaunched/https://decipher.sc/2026/09/02/one-year-of-decipher-relaunched/It’s been one year since we relaunched Decipher in September 2025. Here are the videos, podcasts, and articles that best reflect our mission statement: Security without fear.Wed, 02 Sep 2026 13:25:26 GMTAIGeneralGovernmenthttps://decipher.sc/videos/cybercrime-disruption-making-a-real-impact-ken-bagnall/https://decipher.sc/videos/cybercrime-disruption-making-a-real-impact-ken-bagnall/Ken Bagnall, founder and CEO of Silent Push, talks about the August National Security Presidential Memorandum (NSPM) on transnational cyber-enabled crime, how organizations can make “real impact” with cybercriminal disruption, and the challenges of measuring success in disrupting the cybercriminal ecosystem.Tue, 01 Sep 2026 15:12:50 GMTAIGovernmentLaw Enforcementhttps://decipher.sc/2026/09/01/critical-artifactory-bug-under-attack/https://decipher.sc/2026/09/01/critical-artifactory-bug-under-attack/CVE-2026-82329 is a simple authentication bypass that can allow an attacker to get admin privileges quite easilyTue, 01 Sep 2026 13:39:21 GMTVulnerabilitieshttps://decipher.sc/videos/teampcp-arrests-the-qtfy-attacks-and-the-openai-post-mortem/https://decipher.sc/videos/teampcp-arrests-the-qtfy-attacks-and-the-openai-post-mortem/This week we discuss the two arrests in Australia of alleged members of the TeamPCP cybercrime group that has targeted the open source ecosystem, the US government’s disclosure of intrusion activity by the Chinese QTFY threat actor, and finally the long report from OpenAI on the Hugging Face incident.Fri, 28 Aug 2026 14:26:05 GMTAIGovernmentLaw Enforcementhttps://decipher.sc/videos/the-future-of-surveillance-and-privacy-in-the-age-of-ai-nicole-ozer/https://decipher.sc/videos/the-future-of-surveillance-and-privacy-in-the-age-of-ai-nicole-ozer/Nicole Ozer, new executive director at the EFF, talks about AI and surveillance concerns.Wed, 26 Aug 2026 01:21:32 GMTAIhttps://decipher.sc/2026/08/25/linux-foundation-backs-new-trace-ai-security-standard/https://decipher.sc/2026/08/25/linux-foundation-backs-new-trace-ai-security-standard/TRACE aims to help prove that sensitive data in organizations is being handled “according to policy” by AI agents and open weight models.Wed, 26 Aug 2026 01:17:39 GMTAIGovernmentOpen Source Software Securityhttps://decipher.sc/2026/08/25/unauthenticated-rce-chain-found-for-microsoft-sharepoint-cve-2026-55040-and-cve-2026-63520/https://decipher.sc/2026/08/25/unauthenticated-rce-chain-found-for-microsoft-sharepoint-cve-2026-55040-and-cve-2026-63520/The chain leverages two distinct vulnerabilities—an authentication bypass and an unsafe .NET type instantiation flaw—to provide full server control without valid credentials.Tue, 25 Aug 2026 15:49:58 GMTMicrosofthttps://decipher.sc/videos/the-challenge-of-hacking-back-the-origins-of-exploitgym-and-water-plant-attacks/https://decipher.sc/videos/the-challenge-of-hacking-back-the-origins-of-exploitgym-and-water-plant-attacks/This week we discuss the new White House memo on using private sector operators in offensive cyber operations, Lindsey’s deep dive into the origins of the ExploitGym AI benchmark, and the rash of attacks on water utilities in the U.S. Links Inside ExploitGym: https://decipher.sc/2026/08/20/inside… White House memo: https://www.whitehouse.gov/presidenti… OpenAI post: https://openai.com/index/the-defender…Fri, 21 Aug 2026 17:20:08 GMTAIGovernmenthttps://decipher.sc/2026/08/20/inside-exploitgym-how-researchers-are-measuring-ai-agent-exploitation-capabilities/https://decipher.sc/2026/08/20/inside-exploitgym-how-researchers-are-measuring-ai-agent-exploitation-capabilities/A research collaboration, directed by UC Berkeley, led to the development of ExploitGym, a large-scale benchmark for measuring AI agents’ abilities to develop exploits. Here’s the story of how ExploitGym came to be.Thu, 20 Aug 2026 23:35:28 GMTAIhttps://decipher.sc/2026/08/18/mlflow-bug-actively-exploited-to-steal-credentials/https://decipher.sc/2026/08/18/mlflow-bug-actively-exploited-to-steal-credentials/This flaw allows remote, unauthenticated attackers to read sensitive data from internal network services or cloud metadata endpoints.Tue, 18 Aug 2026 13:58:31 GMTAIVulnerabilitieshttps://decipher.sc/videos/the-truth-about-ai-model-security-and-whats-coming-next-gary-mcgraw/https://decipher.sc/videos/the-truth-about-ai-model-security-and-whats-coming-next-gary-mcgraw/AI security pioneer and machine learning expert Gary McGraw helps Dennis separate the facts from fiction about the recent OpenAI, Meta, and Anthropic model escapes, what the real risks to enterprises are from agentic AI, and what he sees as the true threats on the horizon.Sat, 15 Aug 2026 20:09:36 GMTAIhttps://decipher.sc/2026/08/15/researchers-find-persistent-backdoor-in-zbtlink-routers/https://decipher.sc/2026/08/15/researchers-find-persistent-backdoor-in-zbtlink-routers/The vulnerability, named EndlessDoors, affects more than 20 specific models of networking hardware sold globally under both the Zbtlink and Wiflyer brand names.Sat, 15 Aug 2026 20:04:22 GMThttps://decipher.sc/2026/08/05/openai-anthropic-ai-agents-performed-unsanctioned-actions-during-cyber-tests/https://decipher.sc/2026/08/05/openai-anthropic-ai-agents-performed-unsanctioned-actions-during-cyber-tests/OpenAI and Anthropic models made “unsanctioned” actions during tests by the AI Security Institute. Here’s what we know.Wed, 05 Aug 2026 13:42:15 GMTAIIntrusionshttps://decipher.sc/2026/08/03/exploits-target-n-able-cve-2026-18577-flaw/https://decipher.sc/2026/08/03/exploits-target-n-able-cve-2026-18577-flaw/The vulnerability, which effectively provides unauthenticated administrative access to the RMM console, stems from two related security issuesMon, 03 Aug 2026 19:56:05 GMTVulnerabilitieshttps://decipher.sc/videos/the-openai-and-hugging-face-intrusion-wasnt-enough-so-now-anthropic-wants-in/https://decipher.sc/videos/the-openai-and-hugging-face-intrusion-wasnt-enough-so-now-anthropic-wants-in/This week we talk about the OpenAI-Hugging Face incident and what it means for those companies and the way that AI models are tested, and then we discuss Anthropic’s entry into the race with its own admission that some of its models escaped the playground and attacked outside organizations. Links OpenAI-Hugging Face intrusion: https://decipher.sc/2026/07/29/openai… Anthropic…Fri, 31 Jul 2026 19:13:45 GMTAIhttps://decipher.sc/2026/07/29/openai-hugging-face-breach-five-new-things-we-learned/https://decipher.sc/2026/07/29/openai-hugging-face-breach-five-new-things-we-learned/New details emerged this week about an intrusion by OpenAI models on Hugging Face’s infrastructure.Wed, 29 Jul 2026 11:16:05 GMTAIIntrusionshttps://decipher.sc/2026/07/23/your-llm-is-showing-new-data-finds-sharp-rise-in-exposed-ai-tools/https://decipher.sc/2026/07/23/your-llm-is-showing-new-data-finds-sharp-rise-in-exposed-ai-tools/Exposures of AI/LLM tools has risen by more than 60 percent over the last nine months.Thu, 23 Jul 2026 12:06:50 GMTAIVulnerabilities