All Issues
A weekly briefing on digital forensics news, threat intelligence, historic case studies, and the tools shaping modern investigations. Missed an issue? Read it online or download the PDF below.
Find this useful? Give the project a star on GitHub 👇
Star on GitHubRecent Issues
Blinding the Record: A CVSS 2.7 Zero-Day Whose Only Purpose Was to Erase the Audit Trail, and a Peer-Reviewed Test of an AI Expert System Against Twenty Examiners
- CVE-2026-41709 — CrowdStrike reports the China-nexus actor Warp Panda used a Low-severity VMware ESX logging gap as a zero-day against US organisations including law firms, purely to reduce audit-trail visibility. It grants no access and escalates nothing, which is why it scored 2.7 and why most estates patched it in July without noticing (KEV Oct 28)
- The Magnet AI Research Lab launches with a peer-reviewed Journal of Forensic Sciences study: fourteen video files against twenty trained examiners and an expert system, 91 per cent to 69, and no incorrect classification — the abstention behaviour matters more than the gap, and the vendor-funded design belongs in any citation of it
- CVE-2026-119977 WordPress Core upgrade-window RCE, a TOCTOU race in predictable staging paths exploitable in the seconds a core package is unpacked (KEV Nov 3) & CVE-2026-46300 “Fragnesia”, the Linux kernel escalation chained behind PHP2Shell to root around twenty-five internet-facing Palo Alto firewalls
- Skyw4lker — a device-code phishing kit that steals no password and drops no file, leaving an Entra ID device-code sign-in as the only artefact of a Microsoft 365 account takeover
The Layer Underneath: Pre-Auth RCE in the PHP Runtime as Eight Weak CA Keys Land in Every Trust Store and an AI Agent Runs a Nation-State Intrusion
- PHP2Shell — CVE-2026-109618 and CVE-2026-109619 give unauthenticated RCE across every PHP install serving web requests (CVSS v4 9.2). Embargo broke Oct 20, emergency patches Oct 21, KEV Oct 26. Execution lands as the web worker and drops no file, so request logs are the only record
- Eight eMudhra intermediate CA keys compromised — weak, not stolen, each P-384 value derivable from the public certificate in under a second after a flawed April 2025 key ceremony. Browsers blocked them Oct 17–20; non-browser trust stores in containers, build pipelines and embedded devices remain the gap
- CVE-2026-111497 Brotli out-of-bounds write, Node2Shell widening to HTTP2Shell across Node.js, Bun and Python packages & CVE-2026-110447 Collabora CODE Server command injection in Nextcloud (KEV Oct 23)
- ARTEX — Microsoft ties the ConnectWise supply chain compromise to Storm-0940 driving an agentic AI pentest framework: hundreds of targets, under three hours from first contact to privileged cloud access, and no interactive sign-in to log
The Appliance Is the Crime Scene: Chained Ivanti Zero-Days Leave the Integrity Checker Clean as Europol Maps a Continent's Digital Forensics Gaps
- Volexity details unauthenticated root RCE on Ivanti Connect Secure (CVE-2026-104935 + an unfixed privilege escalation), actor UTA0576 — no web shell, truncated audit logs, an in-memory-only library patch, and an Integrity Checker Tool that reports nothing wrong
- Europol and the European Commission publish Digital Forensics: Gap Analysis (Oct 16) — member states short of resources and skills, capability uneven, commercial tooling expensive and ageing fast; priorities are tool standardisation, cloud/IoT/vehicle forensics, AI within legal limits and training
- CVE-2026-21589 Atlassian Data Center unauthenticated file read across eight products, exploited hours after public PoC (CVSS 9.3, KEV) & CVE-2026-102764 BeyondTrust Remote Support auth bypass exploited since August by a suspected PRC-nexus group
- PEERSTITCH — Unit 42 finds a memory-resident FortiGate implant with no file on disk, no listening port and no callback, living inside miglogd and iked via ptrace
Legacy Exposure, Present-Tense Attacks: Hundreds of French Supermarkets Lose the Cold Chain to Unsupported Fridge Controllers as CISA Flags Five Flaws From 2015 Onward
- Attackers drove refrigeration setpoints to 50°C at hundreds of French stores overnight Oct 11–12 — Danfoss AK-SM800/AK-SC355 controllers, most legacy hardware past security support; food discarded, fires, Paris prosecutor and ANSSI investigating
- CISA adds five legacy CVEs to KEV in one Oct 8 batch — ISC BIND and ProFTPD (2015), Apache Struts (2016), ONLYOFFICE (2021), Strapi (2023). An eleven-year-old flaw exploited today is an inventory failure, not a patching failure
- CVE-2026-104286 FortiMail path traversal + NULL byte zero-day, unauthenticated arbitrary file write (CVSS 9.8, KEV) & CVE-2026-89111/89107 SAP Patch Day — CVSS 10.0 Cloud SDK SSRF capturing OAuth2 client credentials
- MATCHBOIL / MATCHWOK — ESET tracks Russia-aligned UAC-0099 shifting from ministries to Ukrainian transport, manufacturing and energy
Previous Issues
Issue 36
October 6, 2026
Remediation That Doesn't Stick: NetScaler Web Shells Outlive the Patch, 543,699 Deleted Credentials Still Authenticate, and a WordPress Backdoor Rebuilds Itself From Any Survivor
Issue 35
September 29, 2026
The Gatekeeper With No Gate: A CVSS 10.0 Cisco ISE Zero-Day Hands Over the Identity Layer as an Attacker Rides a Live AI Coding Session Into 100 Repos
Issue 34
September 22, 2026
Let the AI Decide: Cisco Talos Catches Malware Polling Four LLMs for a Vote as Iran's CHOSEN BRICK Spies on Dissidents via Fake Trusted Contacts
Issue 33
September 15, 2026
26 Seconds to 11 Victims: A Lone Attacker's AI Agent Swarm Hits 395 Orgs as Anthropic Catches Russian Spies Using Claude to Rebuild Malware
Issue 32
September 8, 2026
Ten Hours, No Humans: AI Agents Run an Entire Ransomware Kill Chain as a Magento Zero-Day Turns a Payment Email Into a Rust Backdoor
Issue 31
September 1, 2026
The Network Lies to Its Own Admins: Fire Ant Hides Router Tunnels From Cisco's CLI as a Chained PaperCut Zero-Day Skips the Password
Issue 30
August 25, 2026
Trust Breaks at Build Time: Lazarus Rides a Windows Zero-Day to Plant Troy as a Typosquatted Rust Crate Backdoors 245 Million Downloads
Issue 29
August 18, 2026
When the Plan Meets Reality: Akira's Safe-Mode EDR Trick Breaks Its Own Ransomware as StubMaker Fakes a Clean Build to Hide a RubyGems Infostealer
Issue 28
August 11, 2026
Trust the Reader, Not the Content: CHAINDROP Worms Through npm as Fake API Docs Trick AI Agents Into Paying Attackers
Issue 27
August 4, 2026
Identity Is the Crime Scene: An OpenAI Agent Breaches Hugging Face as DEBULL Rents Out Microsoft's Own Sign-In Flow
Issue 26
July 28, 2026
The Automated Adversary: AI Writes Browser-Native Ransomware as Suspected Chinese Spies Wire Claude Code Into a Live Government Intrusion
Issue 25
July 21, 2026
Poisoned Trust: "FakeGit" Floods GitHub With 7,600 Trojanized Repos as Hackers Breach the DHS Intel-Sharing Network
Issue 24
July 14, 2026
The Keys to the Kingdom: "Djinn Stealer" Hunts Developer & AI-Assistant Credentials as KDDI Spills 12 Million Logins
Issue 23
July 7, 2026
The Machine Pulls the Trigger: The First AI-Run Ransomware Attack & AI-Crafted Malware Aimed at the Grid
Issue 22
June 30, 2026
The Takedown: Operation Endgame Guts the Stealer-Loader Backbone & DOJ Seizes a Crypto-Laundering Hub
Issue 21
June 23, 2026
Blinding the Watchdogs: A RaaS-Built EDR Killer Hits 400+ Tools While macOS Quietly Logs Every Click
Issue 20
June 16, 2026
Built by Machines: 400+ Poisoned Arch Packages, an AI-Assembled Ransomware Toolkit & a PeopleSoft Zero-Day Spree
Issue 19
June 9, 2026
Attackers Hide in Trusted Ground: Steam-Profile C2, an npm Key-Harvesting Worm & a Check Point VPN Zero-Day
Issue 18
June 2, 2026
SonicWall VPNs Breached as Akira Bypasses MFA & Turla Rebuilds Kazuar Into a Stealth P2P Botnet
Issue 17
May 26, 2026
GitHub Breached via Malicious VS Code Extension & Microsoft Dismantles the "Fox Tempest" Malware-Signing Service
Issue 16
May 19, 2026
Grafana's GitHub Token Heist & an 18-Year-Old NGINX Heap Overflow Hits Active Exploitation
Issue 15
May 12, 2026
RansomHouse Breaches Trellix & "Copy Fail" Creates a Forensic Blind Spot on Linux
Issue 14
May 5, 2026
ShinyHunters Hits 275M Canvas Users & cPanel Zero-Day Wipes 40,000 Servers
Issue 13
April 28, 2026
Scattered Spider Guilty Plea & UNC6692 Turns FTK Imager Against Defenders