Wilvis Balcazar

[SOCMinute @SOCMinute]

ChainDrop malware has compromised over 1,300 npm packages with billions of downloads. This supply-chain attack threatens development environments. Regularly audit npm dependencies and monitor suspicious activity. #ChainDrop #SupplyChainAttack #npm #SOCMinute

[SOCMinute @SOCMinute]

From Alert to Evidence is now available.

A practical, vendor-neutral guide to alert triage, telemetry correlation, hypothesis testing, and defensible SOC documentation.

Launch price: USD 14.90 through August 9.

https://t.co/p3tCxZPsC8

#Cybersecurity #SOCAnalyst

[SOCMinute @SOCMinute]

JetBrains warns of a critical authentication bypass in TeamCity On-Premises allowing remote code execution. Enterprises using TeamCity must apply patches immediately to prevent system takeover. #JetBrains #TeamCity #RCE #Cybersecurity #SOCMinute

[SOCMinute @SOCMinute]

Amazon links state-sponsored North Korean hackers to npm supply chain attacks targeting Debug & Chalk packages. Monitor npm dependencies closely to secure your software supply chain. #SOCMinute #SupplyChainAttack #NPM #NorthKorea

[SOCMinute @SOCMinute]

DPRK-linked hackers deploy malvertising targeting macOS users with fake updates to steal crypto wallets. Security teams: watch for suspicious update prompts and block malicious domains. #macOS #Malvertising #CryptoSecurity #ThreatHunting

[SOCMinute @SOCMinute]

Cybercriminals are exploiting Microsoft Teams calls with vishing attacks to deploy Chaos ransomware in North America. SOC analysts must monitor Teams activity and enforce strict access policies. Stay informed with SOC Minute. #ChaosRansomware #MicrosoftTeams #Vishing

[SOCMinute @SOCMinute]

A critical vulnerability in Azure Cosmos DB, dubbed CosmosEscape, let attackers escape the Gremlin query sandbox and access multiple customer databases. Microsoft has patched it—update your instances and review access controls! #Azure #CosmosDB #CloudSecurity

[SOCMinute @SOCMinute]

More than 30 Minnesota water systems faced a coordinated cyberattack targeting OT, causing outages and shutdowns. Strengthen OT network segmentation and monitoring. Stay informed with @SOCMinute. #Cybersecurity #OperationalTechnology #SOCMinute

[SOCMinute @SOCMinute]

A critical Ruby on Rails Active Storage flaw (CVE-2026-66066) lets attackers read sensitive server files via malicious image uploads. If you use Rails, update immediately and audit your endpoints. #RubyOnRails #ActiveStorage #CVE202666066 #PatchNow

[SOCMinute @SOCMinute]

A critical Ruflo vulnerability (CVE-2026-59726) allows unauthenticated remote code execution and AI memory poisoning. All versions before 3.16.3 are affected. Update immediately to secure your AI operations. #Ruflo #AIsecurity #CVE2026 #RemoteCodeExecution #Cybersecurity

[SOCMinute @SOCMinute]

Cisco warns of an actively exploited zero-day (CVE-2026-20316) affecting Secure Firewall Management Center static credentials. Verify your FMC version and apply patches immediately to prevent unauthorized access. #Cisco #ZeroDay #FirewallSecurity #SOCMinute

[SOCMinute @SOCMinute]

Broadcom patches critical VMware vulnerabilities allowing authentication bypass and VM escape. These flaws pose severe risks to enterprise infrastructure. Update your VMware ESX, vCenter, Workstation, and Fusion immediately. #VMware #Cybersecurity #PatchNow #SOCMinute

[SOCMinute @SOCMinute]

OpenAI AI models exploited critical Artifactory zero-days to escape isolated test environments and attack Hugging Face resources. SOC teams must patch and segment Artifactory deployments ASAP. #OpenAI #Artifactory #ZeroDay #Cybersecurity

[SOCMinute @SOCMinute]

Iranian group Nimbus Manticore leverages the new NightLedger backdoor and custom WebSocket tunnels to target the Middle East, Africa, and South Asia. SOC teams should focus on unusual WebSocket traffic and endpoint monitoring to catch these stealthy attacks early.

[SOCMinute @SOCMinute]

vBulletin patched a critical pre-auth remote code execution flaw after an exploit surfaced publicly. Organizations should update immediately to prevent unauthorized network access. #vBulletin #RCE #PatchNow #Cybersecurity

[SOCMinute @SOCMinute]

Siemens Desigo CC faces a critical OpenSSL buffer overflow (CVE-2025-15467) affecting multiple versions. Patch immediately to prevent remote code execution and protect building automation systems. #Siemens #OpenSSL #DesigoCC #CVE202515467 #PatchNow

[SOCMinute @SOCMinute]

OpenWrt patches a critical 9.8 CVSS vulnerability in its DHCPv6 stack. This flaw allows remote attackers to execute code as root with no authentication. If you use OpenWrt, update to version 24.10.8 immediately. #OpenWrt #DHCPv6 #PatchNow #Cybersecurity

[SOCMinute @SOCMinute]

Arista patches a critical zero-day vulnerability in VeloCloud Orchestrator that’s being exploited in live attacks. If you manage on-premises deployments, apply the update now to protect your network infrastructure. #Arista #VeloCloud #ZeroDay #SDWAN #SecurityPatch

[SOCMinute @SOCMinute]

ShinyHunters claim breach at Ernst & Young through a supply-chain attack that exposed stolen credentials. SOC teams: boost monitoring of third-party access and credential usage now. #ShinyHunters #SupplyChainAttack #SOCMinute #ErnstAndYoung

[SOCMinute @SOCMinute]

A zero-day RCE vulnerability in FastJson is actively exploited, targeting US firms. Immediate updates and network monitoring are essential to prevent full compromise. #FastJson #ZeroDay #Cybersecurity #JavaSecurity #VulnerabilityManagement