Decryption Digest ®

Daily Central Threat Intelligence. Clear Risk. Clear Action.

[Decryption Digest ® @DecryptionDigst]

70,000+ FortiGate and GlobalProtect credentials sold to Qilin ransomware. CVE-2026-0257 exploited since June 2026.

Patch, rotate all VPN creds, hunt for MeshCentral + Atera.

https://t.co/ds6RqLdPrW

[Decryption Digest ® @DecryptionDigst]

LiteLLM 1.107.0 was backdoored on PyPI for ~2 hrs Oct 21, stealing OpenAI, Anthropic, AWS, Azure credentials at Python startup. Wiz confirmed live abuse 4.5 hrs later. Check: pip show litellm -- if 1.107.0, rotate all AI keys now. Upgrade to v1.107.1.

https://t.co/1WOchGHz8O

[Decryption Digest ® @DecryptionDigst]

CISA/FBI/USSS: SafePay ransomware hit 600+ critical infrastructure orgs since 2024.

Destroys ALL backups before encrypting -- NAS factory reset + shadow copy deletion.

Patch Veeam CVE-2024-40711 (CVSS 9.8) now.

https://t.co/8AEalcjiE5 #SafePay #Ransomware #CISA

[Decryption Digest ® @DecryptionDigst]

BeyondTrust Remote Support CVE-2026-102764 (CVSS 9.3) -- China APT had root access to enterprise appliances for 7 weeks as a zero-day.

CISA deadline: Oct 19, now expired. Self-hosted v24.3.1-26.2.3 needs patch BT26-05-RS.

Sigma rules + remediation: https://t.co/uBF4BCqK04

[Decryption Digest ® @DecryptionDigst]

CVE-2026-96951: Windows Shell strips MotW from crafted archives. SmartScreen skips. CVSS 8.8. Every Windows version exposed. CISA deadline passed.

Patch now: https://t.co/ApDChmUDFb

#CyberSecurity #Windows #ZeroDay #PatchTuesday

[Decryption Digest ® @DecryptionDigst]

173 M365 tenants breached in 2.5 hours after hackers stole ConnectWise Cloud Backup OAuth credential. Zero MFA triggered.

Check Entra logs for App ID 506e08f9. Full detection at https://t.co/8sDyLhKRJi

#cybersecurity #microsoft365

[Decryption Digest ® @DecryptionDigst]

CL-STA-0954 deployed PEERSTITCH on 500+ FortiGate firewalls. Memory-only ARM64 implant. No files. No ports. No outbound traffic.

Hunt: check /proc/miglogd/maps for anonymous 16KB rwxp regions.

Full IOCs + detection:
https://t.co/aRqWYkKRSE

#FortiGate #PEERSTITCH #CyberSecurity

[Decryption Digest ® @DecryptionDigst]

Cisco SEG CVE-2026-76519: root RCE via one crafted email. CVSS 9.8, actively exploited. CISA Oct 17 federal deadline.

Run contentscannerstatus. Patch AsyncOS to 15.5.5-014 or 16.5.0-780.

https://t.co/ZfzhIgbRiP

#CiscoSecurity #CVE

[Decryption Digest ® @DecryptionDigst]

167K GlobalProtect instances exposed. No creds needed.

CVE-2026-0257: Qilin forges PAN-OS VPN sessions. 149 days since patch. Still happening.

Block: 216.245.184.150, 216.245.184.47, 216.245.184.110

https://t.co/4HVglnYA2J

[Decryption Digest ® @DecryptionDigst]

51 AI agents. 61 seconds. 628,000 Ukrainian records stolen.

CyberXero's swarm hit 4,708 WordPress targets and planted 32 web shells in one automated run.

Block 46.21.250.135. Patch WordPress now. Full IOCs: https://t.co/6gqHUc8ZXv

#CyberSecurity #WordPress

[Decryption Digest ® @DecryptionDigst]

AhsayCBS backup consoles are under active attack. CVE-2026-105133+CVE-2026-105134 chain to unauthenticated SYSTEM RCE. 5 orgs breached, no complete patch. Block 185.220.236.49 now.

Details: https://t.co/p3dcg7Ydpt

#ZeroDay #CyberSecurity

[Decryption Digest ® @DecryptionDigst]

FBI seized 7 Flax Typhoon domains. CISA patch deadline is TODAY.

Integrity Tech (Beijing) ran MicroScan (CVE scanner), FishHub (phishing), Raptor Train (200K device botnet).

5 KEV CVEs. Patch now.

https://t.co/PNHdjvLLMS

#FlaxTyphoon #CyberSecurity

[Decryption Digest ® @DecryptionDigst]

2,577 CI/CD secrets stolen. 772 repos. GhostAction is back -- targeting Anthropic and OpenAI API keys. 378 malicious workflows still live.

Audit .github/workflows now.

https://t.co/TBid1mZbqC

#GitHubActions #SupplyChain

[Decryption Digest ® @DecryptionDigst]

40,000+ Atlassian Data Center servers leaking credentials. CVE-2026-21589 (CVSS 9.3): no auth needed, one request reads your DB password. PoC dropped Oct 6, exploitation in 2hrs. Patch now. https://t.co/8Sw0pVpUGo

[Decryption Digest ® @DecryptionDigst]

FBI advisory: 86,644 FortiGate firewalls compromised in 194 countries.

Operators crack SHA-256 admin hashes offline, sell access to Payload/INC/Lynx ransomware. No CVE -- a credential gap.

Full breakdown: https://t.co/AIGdzZNkzM

#Fortinet #CyberSecurity

[Decryption Digest ® @DecryptionDigst]

CVSS 9.8 Cisco SD-WAN Manager auth bypass.

CVE-2026-76504: URI percent-encoding skips j_security_check. Full admin access, no credentials. CISA KEV, deadline passed Oct 3. No workaround.

https://t.co/BZQ2AoI21A

#CiscoSDWAN #CVE202676504 #ZeroDay

[Decryption Digest ® @DecryptionDigst]

Warlock ransomware hit 400+ SharePoint servers this week.

Water utilities, telecom, and governments targeted.

AV killed on 40 hosts in under 2 hours. 33 hosts ransomed via SYSVOL.

Hunt queries + IOCs: https://t.co/u8TNN5wKCM

#Ransomware #SharePoint #CyberSecurity

[Decryption Digest ® @DecryptionDigst]

FortiMail zero-day, CVSS 9.8, no patch. CISA deadline October 4.

CVE-2026-104286: unauthenticated file write on all FortiMail versions.

Disable IBE. Block mgmt interface. Hunt https://t.co/hayTL0zRVr.preload.

https://t.co/p5PVYETfT9

[Decryption Digest ® @DecryptionDigst]

543,699 GitHub credentials confirmed still live right now.

Not estimated -- validated against real APIs on Jul 27-28, 2026.

Median exposure: 784 days. 36.8% leaked AFTER push protection was enabled.

Run TruffleHog --only-verified on your org today.

https://t.co/GHX5OdcOvT

[Decryption Digest ® @DecryptionDigst]

NetScaler backdoor persists after patching. WHIPSHOT webshell hides as CSS on 50,277 appliances. Block 45.141.21.130. Forensic checklist: https://t.co/3HJdq1Sbg1 #CVE202688771 #NetScaler