Decryption Digest ®

Daily Central Threat Intelligence. Clear Risk. Clear Action.

[Decryption Digest ® @DecryptionDigst]

80 AI-built modules bypass Sophos, CrowdStrike & Defender in a live ransomware campaign. Sophos CTU: confirmed victims on leak sites. Enable behavioral EDR. Block Telegram API from endpoints. https://t.co/hi6Gy04edk #cybersecurity #ransomware #EDR #infosec

[Decryption Digest ® @DecryptionDigst]

CVE-2026-41089: CVSS 9.8 Windows Netlogon RCE now exploited in wild. Zero auth needed. Patch every domain controller now with KB5058411/KB5058385. Full breakdown: https://t.co/hi6Gy04edk #CyberSecurity #CVE202641089 #WindowsServer #ActiveDirectory #PatchNow #CISA #InfoSec

[Decryption Digest ® @DecryptionDigst]

4 CISA patch deadlines expire June 1-4. PAN-OS GlobalProtect deadline is TODAY. Attackers inside networks since May 17. Defender zero-days June 3. MuddyWater Langflow CVSS 9.4 June 4. Full IOC guide at https://t.co/hi6Gy04edk #CISA #PatchNow #CyberSecurity #InfoSec #ZeroDay

[Decryption Digest ® @DecryptionDigst]

56% of SaaS incidents come from misconfigs, not exploits.

Grip vs Adaptive Shield vs AppOmni vs Obsidian: 2026 SSPM comparison covering shadow SaaS discovery, OAuth governance, and threat detection.

https://t.co/rk6boBZ7CX

#SSPM #SaaSSecurity

[Decryption Digest ® @DecryptionDigst]

80%+ of enterprise breaches involve identity attacks. 24-day average dwell time before detection.

Microsoft Defender for Identity vs CrowdStrike vs SentinelOne vs Semperis: independent 2026 ITDR comparison.

https://t.co/s92AjY0wyQ

#ITDR #ActiveDirectory #IdentitySecurity

[Decryption Digest ® @DecryptionDigst]

74% of enterprise breaches involve privileged credentials.

CyberArk, BeyondTrust, Delinea, or Saviynt? Independent 2026 comparison: vault security, JIT provisioning, cloud PAM, and real TCO.

https://t.co/mIW3USzz7V

#PAM #IdentitySecurity

[Decryption Digest ® @DecryptionDigst]

AI agent drained a full DB in 113 sec via marimo CVE-2026-39987. No human operator. RCE → AWS creds → SSH bastion → PostgreSQL dump, all in 68 min. CISA KEV. Update to 0.23.0 now. https://t.co/hi6Gy04edk #CyberSecurity #LLMAgent #OffensiveAI #CISAKEV #ThreatIntel

[Decryption Digest ® @DecryptionDigst]

CVSS 10.0: any cPanel tenant becomes root via CVE-2026-48172. CISA deadline is today. LiteSpeed WHM Plugin v5.3.1.0 closes the gap. Scan logs for cpanel_jsonapi_func=redisAble now. Full IOCs at https://t.co/hi6Gy04edk #CVE202648172 #cPanel #LiteSpeed #CISA #PatchNow #WebSecurity

[Decryption Digest ® @DecryptionDigst]

JINX-0164 steals 51 crypto wallet extensions via fake LinkedIn recruiter lures on macOS. @velora-dex/sdk npm v4.9.1 was trojanized April 7. Full IOCs: https://t.co/hi6Gy04edk #JINX0164 #CryptoCurrency #NorthKorea #CyberSecurity #AUDIOFIX

[Decryption Digest ® @DecryptionDigst]

40M Charter records stolen in one phone call.

ShinyHunters vishing hit 400+ orgs in 2026: telecom, education, healthcare. Every breach started with an employee who picked up.

Full breakdown: https://t.co/hi6Gy04edk

#ShinyHunters #vishing #cybersecurity #databreach #FIDO2

[Decryption Digest ® @DecryptionDigst]

SonicWall Gen6 SSL-VPN: firmware patch alone does not fix CVE-2024-12802 (CVSS 9.1). Akira operators reach file servers in 30 min. 6 LDAP steps required.

https://t.co/hi6Gy04edk

#SonicWall #CVE202412802 #Akira #MFABypass #PatchNow #CyberSecurity #InfoSec

[Decryption Digest ® @DecryptionDigst]

5,561 GitHub repos poisoned in 6 hours. Megalodon: stolen dev passwords gave TeamPCP access to 5,561 CI/CD pipelines, no GitHub exploit needed. Plus: MiniPlasma zero-day PoC and Defender CISA June 3 deadline. https://t.co/hi6Gy04edk #CyberSecurity #GitHub #SupplyChain

[Decryption Digest ® @DecryptionDigst]

Silver Fox sent 1,600+ AI-crafted tax authority emails across 6 countries. ABCDoor backdoor deployed. Grammar filters caught none of it.

https://t.co/hi6Gy04edk

#AIPhishing #CyberSecurity #SilverFox #ABCDoor #InfoSec #ThreatIntel

[Decryption Digest ® @DecryptionDigst]

2 Defender zero-days chained in live attacks: CVE-2026-45498 kills AV, CVE-2026-41091 escalates to SYSTEM. CISA KEV added May 20. Patch Engine to 1.1.26040.8 now.

https://t.co/hi6Gy04edk #CyberSecurity #ZeroDay #Windows #CISA #PatchNow

[Decryption Digest ® @DecryptionDigst]

160 npm packages. Developer credentials on the dark web. Rotate AWS + GitHub tokens NOW if you used @tanstack on May 11 (19:20-19:42 UTC). https://t.co/hi6Gy04edk #CyberSecurity #npm #SupplyChain #DarkWeb #DevSec #GitHub

[Decryption Digest ® @DecryptionDigst]

332 victims in 5 months. The Gentlemen = #2 ransomware globally.

They walk in through your FortiGate. Disable your EDR. Encrypt everything.

Patch CVE-2024-55591 now. https://t.co/hi6Gy04edk

#ransomware #cybersecurity #FortiGate #infosec #RaaS

[Decryption Digest ® @DecryptionDigst]

CVSS 10.0 Cisco SD-WAN auth bypass CVE-2026-20182: nation-state actor UAT-8616 exploits it now. No creds needed. No workaround. CISA KEV listed. Patch your branch today. https://t.co/hi6Gy04edk #CiscoSDWAN #CVE202620182 #CISAKEV #PatchNow #InfoSec

[Decryption Digest ® @DecryptionDigst]

5,800 Palo Alto firewalls under active root RCE attack. CISA added Exchange CVE-2026-42897 to KEV. 275M Canvas records breached. 5 critical patches before EOD. https://t.co/hi6Gy04edk #CyberSecurity #PaloAlto #CISAKEV #InfoSec #PatchNow

[Decryption Digest ® @DecryptionDigst]

5,219 US PLCs exposed to Iranian state hackers. CyberAv3ngers (IRGC-CEC) inside US water & energy infrastructure since March 2026, modifying control logic undetected. CISA AA26-097A. https://t.co/hi6Gy04edk #ICS #OTSecurity #CriticalInfrastructure #CISA #IRGC

[Decryption Digest ® @DecryptionDigst]

AI built the first zero-day exploit targeting 2FA. Google GTIG intercepted it before mass deployment. APT45, UNC2814, Russia-nexus: all confirmed using AI for exploit dev in 2026.

https://t.co/hi6Gy04edk #ZeroDay #OffensiveAI #CyberSecurity #GoogleGTIG #APT45