Orion84

[Orion84 @Orion84x]

@o_07am Got mine today...not a peasant anymore

[Orion84 @Orion84x]

@elonmusk It's like that all over, some just die in the mines. Others in the fields. Some in the streets.

[Orion84 @Orion84x]

@_alexspring Bro...building an ISP is way more than that.

[Orion84 @Orion84x]

@kurtcaz1 Klink of jy maar n lekker kak tyd het

[Orion84 @Orion84x]

@harisahmad59 @marclou Yeah, I will take it and go on to the next...unless you have a crystal ball...which shows codehype making good revenue...these buyers have way more resources, so for them it could be a 2,3 or 4 year thing..and some of us can't wait so long for moneys

[Orion84 @Orion84x]

I love how grok bots ask the right questions

[Orion84 @Orion84x]

Shodan counts about 9,800 internet-facing PHP servers in South Africa (Afrihost, Xneelo, AWS SA,
Microsoft among them);

Cloudflare's Matthew Prince reported millions of PHP2Shell exploit attempts within hours of disclosure;

AWS MadPot recorded an attempt on 17 October, four days before the embargo lifted;

Wordfence reports no confirmed compromises across 5 million sites it protects

[Orion84 @Orion84x]

Node.js shipped security releases on 21 October 2026 for all three supported lines, fixing ten flaws. The most serious is a buffer overflow in the Brotli decompression code that Node.js bundles, which the project says can lead to remote code execution.

What happened
The bug is tracked as CVE-2026-111497 and rated 9.2 under CVSS 4.0 in the CVE record. It is an out-of-bounds write in the Brotli decoder, triggered by malformed compressed input. The CVE record scopes the flaw to Google Brotli versions 1.0.3 through 1.2.0, fixed in 1.0.10, 1.1.1 and 1.2.1. Node.js copied the upstream patch into its own bundled copy.

Node.js decompresses Brotli whenever an application calls the zlib module directly, or automatically when code calls fetch() on a response that arrives with Brotli compression. An attacker only has to control the compressed data being decoded, for example a request body or a response pulled from another server.

Three further high-severity fixes landed in the same release: CVE-2026-106069 and CVE-2026-105483 both allow a TLS hostname-check bypass by writing an IP address in a non-standard form, and CVE-2026-105482 lets dns.resolve truncate a hostname at an embedded null byte.

Who is affected
Every Node.js installation on the 22.x, 24.x and 26.x lines that handles untrusted or fetched Brotli data is exposed. The fixed builds are below.

Node.js 22.23.4 on the 22.x long-term support line
Node.js 24.22.1 on the 24.x long-term support line
Node.js 26.12.1 on the current line
Node.js 20.x and earlier: end-of-life, no fix will be issued
Software that bundles its own Brotli library, rather than calling Node.js, needs the matching Brotli update to 1.0.10, 1.1.1 or 1.2.1.

What to do now
Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1, and move anything still on 20.x onto a supported line. The advisory offers no workaround inside Node.js for the Brotli flaw.

Inventory every runtime that runs your applications, including container base images and CI build images, not just developer laptops.
Rebuild and redeploy containers on the patched base image rather than patching inside a running container.
If a service cannot be upgraded today, terminate Brotli at a proxy that rejects malformed streams, and stop accepting attacker-supplied compressed bodies where the application does not need them.
Check bundled Brotli versions in other software you ship or host; the same CVE applies to the library itself.
What this means for South African businesses
Most South African SMEs run WordPress and PHP rather than Node.js, so this is not a repeat of the PHP2Shell emergency. The exposure sits in custom web applications, internal dashboards and the tooling that hosts them, which is exactly the code most SMEs never inventory. No exploitation in the wild had been reported as of 22 October, and the public proof-of-concept only reached code execution against a deliberately weakened build. Treat this as a scheduled patch with a tight deadline rather than a fire drill, and confirm who owns each Node.js service before you need to prove it.

Source: The Hacker News and the CVE record for CVE-2026-111497. https://t.co/IRytIbWZzx

[Orion84 @Orion84x]

Node.js just fixed 10 flaws. The worst is CVE-2026-111497, a 9.2 Brotli decoder overflow that can mean RCE wherever your app decompresses untrusted data.
Patch: 22.23.4, 24.22.1, 26.12.1. Node 20 is EOL - no fix coming.
#CyberSecurity #CVE
Link: https://t.co/3vgfe6DnLJ

[Orion84 @Orion84x]

A malware delivery operation is using search-optimised GitHub repositories to impersonate well-known software brands and push a previously undocumented information stealer called Rapuncel. The payload arrives with a Microsoft-signed kernel driver built to switch off the security software meant to catch it.

What happened
LastPass and Delphos Labs documented the campaign after finding a fake GitHub organisation posing as LastPass Authenticator and ranking near the top of search results for download queries. The same kit was serving impersonation pages for at least 40 brands. From the fake repository, a download button leads through hidden GitHub Pages redirectors to an attacker server, which returns a ZIP archive padded to 127.9 MB or 148 MB so that scanners with file-size limits skip it.

Inside the archive, the supposed installer is a renamed copy of Microsoft's own Visual Studio debugger, vsdbg.exe, which loads an attacker-supplied vsdbg.dll from the same folder. That loader installs Rapuncel plus a kernel driver disguised as an NVIDIA component, nvfsflt64.sys. The driver carries a hardcoded list of 145 antivirus and endpoint detection products and terminates them from kernel mode, which defeats the Protected Process Light protection many of them rely on. It is signed through Microsoft's Windows Hardware Compatibility Publisher chain and was not on Microsoft's blocked-driver list.

Rapuncel then pulls saved passwords from more than 25 browsers, wallet files from around 30 cryptocurrency applications, Discord, Steam and Telegram session data, and the Windows Credential Manager. For Chrome and Edge it injects code into the browser process to defeat app-bound encryption. It also collects screenshots and any document named with words like password, seed, wallet or recovery, then uploads the archive to an attacker server and persists as a Windows service. LastPass states that no LastPass system or customer vault was involved; the brand was borrowed, and GitHub is not a distribution channel for the product.

Who is affected
Any Windows workstation where a user downloaded software from a search result and ran the installer. The design defeats the controls small organisations rely on most.

Users who search for an installer and click a GitHub link instead of going to the vendor site
Machines protected only by antivirus or an EDR agent that trusts Microsoft-signed drivers
Environments where users hold local administrator rights and can approve the installer's elevation prompt
What to do now
Assume any machine that ran one of these installers is fully compromised, including saved browser passwords and cached Microsoft 365 sessions. Removing the stealer is not enough on its own.

Pull the affected machine off the network, remove the driver in safe mode or rebuild it, then rotate every credential that was stored on it.
Revoke active sessions and refresh tokens for Microsoft 365 and any other single sign-on account used from that machine, and reset passwords from a clean device.
Block the campaign's payload and redirect domains at the proxy and DNS layer, and alert users that GitHub results are not a vendor download channel.
Check the driver blocklist on endpoints and remove local administrator rights from standard users.
What this means for South African businesses
The practical danger for a South African SME is not the stealer itself but the signature: a Microsoft-attested driver tells Windows, and most endpoint tools, that the file is legitimate, so nothing alerts until credentials are already gone. Because the same kit impersonates 40 brands, this is not a LastPass problem and blocking one repository achieves nothing. If your users routinely download software from search results and hold local admin rights, treat this as a present risk rather than a theoretical one.

Source: https://t.co/2j9XaULUh1, reporting research published by LastPass and Delphos Labs.

[Orion84 @Orion84x]

A Microsoft-signed kernel driver is now the attack. Fake GitHub repos posing as 40 software brands install Rapuncel, which kills 145 AV/EDR tools from kernel mode, then steals browser passwords and
M365 sessions.
If a user ran that installer, rotate everything.
#CyberSecurity #InfoSec
Link: https://t.co/fSE49CUdMU

[Orion84 @Orion84x]

@thecurioustales Should've replied with '402 Paymemt required'

[Orion84 @Orion84x]

@bot Please dont make grok bot too fat...i like my bot on the skinnier side....for agility reasons..or you are just trying to make the bots burn more tokens. Stop it

[Orion84 @Orion84x]

@CRy3no @PlayStation Sounds like there's more to this story

[Orion84 @Orion84x]

70,000 firewall credentials in one dataset.
Group-IB: k0t exploits FortiWeb CVE-2025-64446, brute forces FortiGate, then decrypts configs with Fortinet's default AES key.
Close admin access. Enable private-data-encryption.
#CyberSecurity #Fortinet

[Orion84 @Orion84x]

@harleyfoote_ Let's hope....my portfolio still in red

[Orion84 @Orion84x]

GitLab just patched a CVSS 10.0 unauthenticated RCE that hits every self-managed release back to 7.0 (2014).
No login needed. Code execution on the server, and your CI secrets sit right behind it.
Fixed in 19.5.1 and backports. Patch today.
#CyberSecurity #CVE
Link: https://t.co/xtwoQNyyMh

[Orion84 @Orion84x]

Your staff can pass MFA and still hand over Microsoft 365.
The Wazza kit shows a real Microsoft device code, the user types it in, and the attacker walks away with OAuth tokens, no password taken.
Turn off device code flow in Entra.
#Microsoft365 #InfoSec
Link: https://t.co/e3gipKuglb

[Orion84 @Orion84x]

@bijanbowen Gay version?

[Orion84 @Orion84x]

@peer_rich The dependance on on it is becoming a risk though