2026-04-28T23:41:08Z https://nostr.ae IFIN - The Independent Federated Intelligence Network https://nostr.ae/npub1qm4tytdmranfklywc562p7gprs702mzkc4usqv6t8ja3d340evpslnh363 https://media.infosec.exchange/infosec.exchange/accounts/avatars/115/741/367/687/413/652/original/8fc4c8a9eead7ead.png https://media.infosec.exchange/infosec.exchange/accounts/avatars/115/741/367/687/413/652/original/8fc4c8a9eead7ead.png https://nostr.ae/nevent1qqsf6htk5vz5huys0hytfls6rnyv6tk3ucpdr8ccuuxa3yy9k5nl04szyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx2y9ryf RE: <a href="https://infosec.exchange/@ifin/116605052950779161">https://infosec.exchange/@ifin/116605052950779161</a><br/><br/>Important note. A lot of sources are reporting that the Nx Console extension is the vector by which GitHub was compromised. Although that extension was breached concurrently with the GitHub announcement, GitHub has neither confirmed nor denied this publicly. The connection remains speculation, not fact.<blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/note1xwp27qdxh5gzw8js9yw3ern26kel3hrhvwxxn64339tjmxl54sdquauz0v" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">note1xwp…uz0v</a></span><br/> </div> GitHub's internal repositories have been exfiltrated and offered for sale.<br/><br/><a href="https://discourse.ifin.network/t/github-internal-repositories-compromised-offered-for-sale/484">https://discourse.ifin.network/t/github-internal-repositories-compromised-offered-for-sale/484</a> </blockquote> 2026-05-21T15:04:23Z https://nostr.ae/nevent1qqs0ja7llqdz93yfhdaf9c6gfycs39jlrhd6l544at7pygcdwqjaf0gzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx7s4ud0 In reply to <a href='/nevent1qqsr8q40qxnt6yp8regzj8gu3e4dtvlcm3mk8rrfa2ccj4edn062cxsumda0w'>nevent1q…da0w</a><br/>_________________________<br/><br/>We&#39;ve updated the post with the full list of claimed-compromised repositories. 2026-05-20T13:10:18Z https://nostr.ae/nevent1qqsr8q40qxnt6yp8regzj8gu3e4dtvlcm3mk8rrfa2ccj4edn062cxszyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxhhtpph GitHub&#39;s internal repositories have been exfiltrated and offered for sale.<br/><br/><a href="https://discourse.ifin.network/t/github-internal-repositories-compromised-offered-for-sale/484">https://discourse.ifin.network/t/github-internal-repositories-compromised-offered-for-sale/484</a> 2026-05-20T04:38:26Z https://nostr.ae/nevent1qqs2guna4hslzwuz4ujv5rxxmmt787lr6e8jwqlsswk2hpa8un67j9czyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxdzk5s8 One maintainer&#39;s compromised tokens are responsible for the takeover of 500+ NPM packages, including the AntV family of packages.<br/><br/><a href="https://discourse.ifin.network/t/500-npm-packages-including-antv-compromised-via-single-maintainer/476">https://discourse.ifin.network/t/500-npm-packages-including-antv-compromised-via-single-maintainer/476</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-05-19T06:22:39Z https://nostr.ae/nevent1qqsw0hvn00ty6xmqmge3s604up569f0zc5hmcc32f293hqld9jmlwaszyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx5vawyz In reply to <a href='/nevent1qqs2vssjemtfvpd3r2qqpa2n5a47qfku8u27pxd2kp3lhk6sacelnwgv3u3dg'>nevent1q…u3dg</a><br/>_________________________<br/><br/>Also added to our MISP instance! 2026-05-18T21:59:57Z https://nostr.ae/nevent1qqsxnftw4spgjc26jxjez0vk8795s94v88cmglm29swmmxypet9xxyczyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxjvj7ck Microsoft Power BI is under a DDoS attack claimed by 313 Team, the same group that recently claimed the attack on Ubuntu.<br/><br/>Their booter is still protected by Cloudflare, btw.<br/><br/><a href="https://discourse.ifin.network/t/power-bi-ddosed-claimed-by-313-team/470">https://discourse.ifin.network/t/power-bi-ddosed-claimed-by-313-team/470</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-05-18T17:00:28Z https://nostr.ae/nevent1qqstjw9f0a3w3w9jys9tvdtl9y7yd6sjpz8m27suw58kzfuzjc8sslczyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxneg7vx In reply to <a href='/nevent1qqsr6l73y7fx346mfvvscrfg8ljj5wpyjale5uqa3l5fgfr0shflupcctqt4c'>nevent1q…qt4c</a><br/>_________________________<br/><br/>Two sides of the same mullet.<br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub16kg9lwzqksrhasxqtasrey5dhz7dkyur86xtupw08ayxppqkj47smwafn8" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Cat 🐈🥗 (D.Burch) :paw:⁠:paw:</span> (<span class="italic">npub16kg…afn8</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1eznzdgefq0ece8yljlxtaadscv4skav3ckk38gv3qw04s25mrt2s5fnyq3" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>GAYINT</span> (<span class="italic">npub1ezn…nyq3</span>)</a></span> 2026-05-16T19:41:56Z https://nostr.ae/nevent1qqswut8g8dvuhuqfm7k4amfl4vsjh0ezfcewfnmyscjdej03hx4vhaczyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxnk9ht6 We have a breakdown of the current attack campaign against Cisco SD-WAN devices<br/><br/><a href="https://discourse.ifin.network/t/cve-2026-20182-cisco-catalyst-sd-wan-eitw/457">https://discourse.ifin.network/t/cve-2026-20182-cisco-catalyst-sd-wan-eitw/457</a><br/><br/>#ThreatInte #ThreatIntelligence #IFIN 2026-05-15T18:24:30Z https://nostr.ae/nevent1qqsrxdnv4dmy2yvlfhgw0ph9vugt7tn3n5snw2ehtf3kyamm9m9cyvqzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxuy6vr8 Dear threat research firms,<br/><br/>A modest proposal for your threat intel blog posts:<br/><br/>A *single table* of Indicators of Compromise.<br/><br/>3 columns: Value, Type, Description<br/><br/>The same format. Every time.<br/><br/>Easier for you, easier for your readers, easier for us. <br/><br/>XOXO IFIN 2026-05-15T16:34:51Z https://nostr.ae/nevent1qqsd75lanunep4zm8g28zy6jalg6d54kzy64c6c4kam6kgm9nzmrj8szyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxejhv0f I am sure you&#39;re shocked to hear about another NPM compromise.<br/><br/>This one was because a maintainer let their email domain expire!<br/><br/><a href="https://discourse.ifin.network/t/node-ipc-npm-packages-infected-with-stealer/454">https://discourse.ifin.network/t/node-ipc-npm-packages-infected-with-stealer/454</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-05-14T22:20:47Z https://nostr.ae/nevent1qqspmjur7e6xyaje96humzzt5gprtxxa9ma0n4txy7fh57w9dv8pqzgzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxe965zj This new Nginx vuln is worth some scrutiny. A heap buffer overflow that can lead to service restart and, on systems with ASLR, code execution. Patches available.<br/><br/><a href="https://discourse.ifin.network/t/cve-2026-42945-heap-buffer-overflow-in-nginx/441">https://discourse.ifin.network/t/cve-2026-42945-heap-buffer-overflow-in-nginx/441</a> 2026-05-13T19:21:30Z https://nostr.ae/nevent1qqsvxvqg7wp8e2aedryky68dx8rls0nnch2lmjhtz68h4rx3xxz9fugzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxmpzqve We are tracking the new Nightmare Eclipse exploits, and we even have some listed IoCs from the code/repo files for you.<br/><br/><a href="https://discourse.ifin.network/t/chaotic-eclipse-nightmare-eclipse-drops-two-windows-0days/437">https://discourse.ifin.network/t/chaotic-eclipse-nightmare-eclipse-drops-two-windows-0days/437</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-05-12T21:59:37Z https://nostr.ae/nevent1qqspulxrdck5rj6m8xjeez90ja4n6n342f3kww9fgnrcakwn3khs8xgzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxq90gcl If you or someone you know has received Instructure #Canvas-themed phishing messages, we want to hear about it! Samples welcome, but also any other circumstances.<br/><br/>Something seems phishy about the claim that no data is out in the open. 2026-05-12T18:34:43Z https://nostr.ae/nevent1qqs990jy8vknt2r2zndn64d952d2wmwfv30eqn35re23ms7r5s9whwgzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxvervq9 Did you know we have a <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1mlypv5xgnd6zxu8ssyzc485ussa5a0mwf3g4t6sz2jtgts2qsuqq6arl2t" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>MISP</span> (<span class="italic">npub1mly…rl2t</span>)</a></span> feed? We do!<br/><br/>Discourse posts with valuable indicators are added to our feed, which is free for all.<br/><br/><a href="https://misp.ifin.network/feed">https://misp.ifin.network/feed</a> (/manifest.json for manual review)<br/><br/>#MISP #ThreatIntel #ThreatIntelligence #IFIN 2026-05-12T18:32:17Z https://nostr.ae/nevent1qqs9ceudfcwjrnhdsjrajyykg2tgmsmyuerhzhezlzslctqtjhk7ceszyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxx9fma4 In reply to <a href='/nevent1qqsranum5an82qz9e74t6a4hcxk62nts4s90g46pzjn527k4ypxc7rqq3au6n'>nevent1q…au6n</a><br/>_________________________<br/><br/>Aaaand now it&#39;s in PyPi 2026-05-12T15:47:22Z https://nostr.ae/nevent1qqsranum5an82qz9e74t6a4hcxk62nts4s90g46pzjn527k4ypxc7rqzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxygazex RE: <a href="https://infosec.exchange/@ifin/116558531955700753">https://infosec.exchange/@ifin/116558531955700753</a><br/><br/>This has evolved to impact 170 packages, including those from Mistral and OpenSearch.<blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/note1w6n44ehck2rdnh5ayedurga94dn9sf0lqazdneg2t038xxkg5mdqzrz3sx" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">note1w6n…z3sx</a></span><br/> </div> TanStack, a popular web UI framework has had its NPM packages compromised by another installment of Mini Shai-Hulud.<br/><br/><a href="https://discourse.ifin.network/t/mini-shai-hulud-strikes-again-tanstack-npm-packages-compromised/428">https://discourse.ifin.network/t/mini-shai-hulud-strikes-again-tanstack-npm-packages-compromised/428</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN </blockquote> 2026-05-12T13:22:50Z https://nostr.ae/nevent1qqs8df66umut9pkem6wjvk7p5wj6kejcyhlsw3xeu599hcnnrty2dkszyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx8f2eql TanStack, a popular web UI framework has had its NPM packages compromised by another installment of Mini Shai-Hulud.<br/><br/><a href="https://discourse.ifin.network/t/mini-shai-hulud-strikes-again-tanstack-npm-packages-compromised/428">https://discourse.ifin.network/t/mini-shai-hulud-strikes-again-tanstack-npm-packages-compromised/428</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-05-11T23:27:32Z https://nostr.ae/nevent1qqsfex33j8uj6g7zw5rummpuc3ntx9yqklkxsa22782sfwjtyzvpvrszyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxtlzl97 In reply to <a href='/nevent1qqspfnrp6u8spj8pcx3tl092lm945s6tta0mqxenxcpaqy6ltpamrrqtk8pzr'>nevent1q…8pzr</a><br/>_________________________<br/><br/>Cloudflare is reporting issues as well, since, uh, all their services get their certs from LetsEncrypt 2026-05-08T20:15:25Z https://nostr.ae/nevent1qqspfnrp6u8spj8pcx3tl092lm945s6tta0mqxenxcpaqy6ltpamrrqzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx9zyx72 BREAKING: LetsEncrypt appears to be stopping certificate issuance due to a &#34;potential incident.&#34;<br/><br/><a href="https://discourse.ifin.network/t/letsencrypt-stopping-issuance/415">https://discourse.ifin.network/t/letsencrypt-stopping-issuance/415</a> 2026-05-08T19:47:21Z https://nostr.ae/nevent1qqsfuepp4t5ep5kuptsfvcz8ctk0umfs0lheyg7qq5tz8lmlm7c4mgczyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx9fl8jn In reply to <a href='/nevent1qqsv3c8ct92l2gzup4s7e3nw8cnrkvcxt6x00cye67fydklktcl260g6g48tj'>nevent1q…48tj</a><br/>_________________________<br/><br/>Fixes for both Debian-derivative and RHEL-like systems listed! 2026-05-07T22:34:38Z https://nostr.ae/nevent1qqsv3c8ct92l2gzup4s7e3nw8cnrkvcxt6x00cye67fydklktcl260gzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxe7r2wf We&#39;re also tracking the new #CopyFail variants here. DirtyFrag requires the same af_alg module as CopyFail, but another variant does not.<br/><br/><a href="https://discourse.ifin.network/t/new-copyfail-variants/395">https://discourse.ifin.network/t/new-copyfail-variants/395</a> 2026-05-07T21:08:50Z https://nostr.ae/nevent1qqs0sdyljcumemm4z8v95mjj4e05whjvdqr8hve5fch8u7y2fucv6fczyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxfyvng7 RE: <a href="https://infosec.exchange/@wdormann/116533862391306228">https://infosec.exchange/@wdormann/116533862391306228</a><br/><br/>We love direct action you can take to confound the adversary! Disable .URL files (and .js files) today.<br/><br/><a href="https://discourse.ifin.network/t/disable-url-files-before-the-baddies-use-them/393">https://discourse.ifin.network/t/disable-url-files-before-the-baddies-use-them/393</a><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/note1lp3x2ewgexxg26yg7wtgfq6x46da3wdsxk2pgyjvlge3xnvwfy4qnfu5wj" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">note1lp3…u5wj</a></span><br/> </div> Let's talk about Windows .URL (InternetShortcut) files.<br/><br/>Last year there was discussion about a vulnerability in how Windows handles .URL files. Specifically, when a .URL file specifies a WorkingDirectory directive, an otherwise harmless app being launched would load DLLs from the remote (e.g. WebDAV) server specified. You know, being the current working directory of the app being launched and all. This vulnerability was being [exploited in the wild](<a href="https://www.virustotal.com/gui/file/e0a44274d5eb01a0379894bb59b166c1482a23fede1f0ee05e8bf4f7e4e2fcc6">https://www.virustotal.com/gui/file/e0a44274d5eb01a0379894bb59b166c1482a23fede1f0ee05e8bf4f7e4e2fcc6</a> ), and it worked well because it bypassed annoying (to attackers) things like SmartScreen. Sure, it required the victim to click Open on a dialog saying Type: Unknown File Type (😂), but we all know that users are click-happy, so this is fine. Besides, the file clearly has a .pdf extension, so it should be safe (😂).<br/><br/>Microsoft recognized the vulnerability and published an [update in the form of CVE-2025-33053](<a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33053">https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-33053</a> ).<br/><br/>If we were to believe the [Microsoft documentation at the time](<a href="https://web.archive.org/web/20250710095434/https://learn.microsoft.com/en-us/windows/win32/lwef/internet-shortcuts">https://web.archive.org/web/20250710095434/https://learn.microsoft.com/en-us/windows/win32/lwef/internet-shortcuts</a> ), <br/><br/>> When the user clicks the icon, the browser is launched and displays the site associated with the shortcut.<br/><br/>But wait...<br/>How did this .URL file cause a program to be launched? The URL= parameter specifies a website address to be loaded in the browser.<br/><br/>Oh, naive child. Obviously a .URL file can directly point to code on a remote (e.g. WebDAV) server. This technique is also [being exploited ITW as well](<a href="https://www.virustotal.com/gui/file/93a2d60d1ccfe3e009b1a81951653b559e0cae01c2454244a3a0fbd49a5e4539">https://www.virustotal.com/gui/file/93a2d60d1ccfe3e009b1a81951653b559e0cae01c2454244a3a0fbd49a5e4539</a> ).<br/><br/>I reported this to Microsoft, as this has the **EXACT SAME IMPACT** as CVE-2025-33053. So if that's a vulnerability, then this too is a vulnerability, right? <br/><br/>Bless your innocent soul. Per MSRC:<br/><br/>> When the Shell invokes an app from a remote share, it's expected that you will see the legacy Windows Security prompt, not the SmartScreen one. SmartScreen Application Reputation (AppRep) evaluation applies to locally downloaded files that bear an Internet Zone mark of the web. It is not meant to apply to execution of files from Network Shares.<br/><br/>Okie dokie. I'm sure Windows users surely appreciate this. But what about the [incorrect documentation](<a href="https://archive.ph/MgBI8">https://archive.ph/MgBI8</a> )? After my prodding, they [updated the wording](<a href="https://learn.microsoft.com/en-us/windows/win32/lwef/internet-shortcuts">https://learn.microsoft.com/en-us/windows/win32/lwef/internet-shortcuts</a> ):<br/><br/>> When the user clicks the icon, the URL path is opened by the handler application, typically the user's default web browser.<br/><br/>Leaving in the quite misleading first sentence:<br/><br/>> The Internet shortcut object is used to create desktop shortcuts to Internet sites.<br/><br/>(An "Internet site" is a web page, right?)<br/><br/>How can CVE-2025-33053 warrant a CVE, while the behavior I described has the exact same trigger and impact is **not** CVE worthy? That's pretty easy. Microsoft assigns CVEs to **updates**, not **vulnerabilities**. They are the decider as to what is a vulnerability and what is not.<br/><br/>What can we do about it?<br/><br/>At the very least, turn off the Windows feature that hides file extensions, **even if you have the option turned on to see file extensions**. The disdain that Microsoft has for Windows users is tangible here. On what planet would I not want to see the actual extension of a file? Go to HKCU\InternetShortcut and delete the NeverShowExt value. After this, your pwned.pdf file will reveal its true self as being pwned.pdf.url.<br/><br/>More powerful protection would be to block the ability to receive .URL files via email, web browsers, etc. There is no workflow that I can imagine that requires a user to double-click on a .URL file that **came from the internet**.<br/><br/>Even more powerful than that would be to disassociate .URL files from opening in Windows (thx <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1yg8lnapwc8yyd0m32jcfdp7k28hwmsvtsqc59rsj6d6d0m3mynqs7tccz0" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Taggart :ifin:</span> (<span class="italic">npub1yg8…ccz0</span>)</a></span> ).<br/><br/>This screen recording is a Windows 11 system that has no internet connectivity. The fact that no warning was displayed that SmartScreen cannot be reached is evidence that SmartScreen is not in play at all. And that dialog...Do you want to open this file?<br/><br/>andType: Unknown File Type<br/><br/><br/>Do you think that users are presented with enough information to make an informed security decision? Of course not. But obviously we all know that we can't rely on users making informed security decisions in general. Don't put users in that position.<br/><video controls width="100%" class="max-h-[90vh] bg-neutral-300 dark:bg-zinc-700"><source src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/533/712/734/034/973/original/7873081a273e8a42.mp4"></video><br/> </blockquote> 2026-05-07T15:38:05Z https://nostr.ae/nevent1qqs2cs0mt5j5rkdds63yemvppf0x3z3pxnvf4llhhh95phw4772hu9szyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxwjqj3s In reply to <a href='/nevent1qqsylulkat6m9xsjhvq3r2ntf7z9qsz8sftwj40udjwjm382gpjdmscckgwmk'>nevent1q…gwmk</a><br/>_________________________<br/><br/>As a chaser, here are two *other* CVEs on Ollama from yesterday.<br/><br/><a href="https://discourse.ifin.network/t/cve-2026-42248-cve-2026-42249-ollama-on-windows-doesnt-verify-updates-writes-anywhere/378">https://discourse.ifin.network/t/cve-2026-42248-cve-2026-42249-ollama-on-windows-doesnt-verify-updates-writes-anywhere/378</a> 2026-05-06T17:44:46Z https://nostr.ae/nevent1qqsylulkat6m9xsjhvq3r2ntf7z9qsz8sftwj40udjwjm382gpjdmsczyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxkrephw Another AI service that&#39;s dangerous when exposed to the internet? Well I never!<br/><br/>Anyway go check for exposed Ollama endpoints.<br/><br/><a href="https://discourse.ifin.network/t/unauthenticated-memory-leak-in-ollama-cve-2026-7482/389">https://discourse.ifin.network/t/unauthenticated-memory-leak-in-ollama-cve-2026-7482/389</a><br/><br/>#CVE #ThreatIntel #ThreatIntelligence #IFIN 2026-05-06T17:35:41Z https://nostr.ae/nevent1qqs8p5gdfpjcz4raczx93f6a9zwcf5lcxlrzjzfvup0wl09zy5yhm2szyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxky9qdz This morning we decided to launch a &#34;Vulnerabilities&#34; category to track vulns without further actionable intelligence besides patching and monitoring. And wouldn&#39;t you know it, a crit on Palo Alto&#39;s User-ID portal showed up to ring it in!<br/><br/><a href="https://discourse.ifin.network/t/cve-2026-0300-9-3-cvss-pan-os-unauthenticated-user-initiated-buffer-overflow-captive-portal/382">https://discourse.ifin.network/t/cve-2026-0300-9-3-cvss-pan-os-unauthenticated-user-initiated-buffer-overflow-captive-portal/382</a><br/><br/>#CVE-2026-0300 #CVE #IFIN 2026-05-06T13:57:47Z https://nostr.ae/nevent1qqsghtcu5j73auap6086r2995f5w5pgjwy5ln6xg7s8qgga9hvcnmygzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx354fks As of 0740 UTC, Ubuntu&#39;s security and archive sites are *finally* behind Cloudflare&#39;s CDN...sorta. So while it&#39;s still ridiculous that Cloudflare is serving both sides, at least Ubuntu&#39;s repos should be more stable.<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/522/736/487/143/212/original/91bd94e9afd5bcf8.png"> <br/> 2026-05-05T15:44:17Z https://nostr.ae/nevent1qqs0kgcz76vcpf7xtep9f6cgrwz893ru5440tl9wzetnyvkkf3wa96qzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxza33vp 313 Team, the Iraqi-aligned group claiming credit for the Ubuntu attack, are now encouraging the use of #CopyFail against Ubuntu targets while servers may not be able to reach updates.<br/><br/><a href="https://discourse.ifin.network/t/ubuntu-services-under-attack/356">https://discourse.ifin.network/t/ubuntu-services-under-attack/356</a> 2026-05-03T05:02:01Z https://nostr.ae/nevent1qqswcn4vdxcg6czwz4fv8kltpm0h4hvnz9ntkhxfjhlnzl475x84ppgzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxyesm6c The worms keep worming, unfortunately. The &#34;Mini Shai-Hulud&#34; attack appears to pivot to #PyPi with a compromise of a #pytorch library:<br/><br/><a href="https://discourse.ifin.network/t/pytorch-lightning-library-hit-by-supply-chain-attack/357">https://discourse.ifin.network/t/pytorch-lightning-library-hit-by-supply-chain-attack/357</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN #Python 2026-04-30T21:22:01Z https://nostr.ae/nevent1qqsycxytxwfx3j3n0pj3ze0vjhsfawzuj3fd94tfe45dpvcf8f3f2tszyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx73ur69 It&#39;s not just you: Ubuntu services are down.<br/><br/><a href="https://discourse.ifin.network/t/ubuntu-services-appear-down/356">https://discourse.ifin.network/t/ubuntu-services-appear-down/356</a> 2026-04-30T20:32:51Z https://nostr.ae/nevent1qqspurernka0mkjtm5lwlv0q33gld942sea09h55xcrck3q28yat45czyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxnaeuqz Since the CopyFail disclosure left some of us feeling a little...unsupported, we&#39;re talking about what we love to see in vulnerability disclosures. Come join the conversation!<br/><br/><a href="https://discourse.ifin.network/t/your-ideal-vuln-disclosure/350">https://discourse.ifin.network/t/your-ideal-vuln-disclosure/350</a> 2026-04-30T17:10:12Z https://nostr.ae/nevent1qqs9xtyxnk8e5weu9hgye0de8mnnx7sxrlws5lmrxj2l3xep3qz6zqqzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxcz4ycf Regarding #CopyFail,<br/><br/>It is worth noting that the exploit can target *any* file and overwrite its contents. That&#39;s not just privilege escalation; that&#39;s the potential for stealthy persistence.<br/><br/>Our thread now has more technical discussion and also some clever detections.<br/><br/><a href="https://discourse.ifin.network/t/copy-fail-732-bytes-to-root-on-every-major-linux-distributions/342/26">https://discourse.ifin.network/t/copy-fail-732-bytes-to-root-on-every-major-linux-distributions/342/26</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-04-30T15:41:19Z https://nostr.ae/nevent1qqsdy7g9mwwvrgew9aw6wmeh2zhekl89cnfc79hcg3rapwhdkzreqkgzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx4p2ama After careful analysis, we believe the best option for remediation is to turn off the computers and go for a nice walk. Maybe call your mother. 2026-04-29T20:12:57Z https://nostr.ae/nevent1qqs2wedxnl64lwr86hfkj6elw9qhxs2h69n3jdasgyydvnk99ey2uvczyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxj8p8l0 What is going on today??<br/><br/>We&#39;re also tracking #CopyFail.<br/><br/><a href="https://discourse.ifin.network/t/copy-fail-732-bytes-to-root-on-every-major-linux-distributions/342">https://discourse.ifin.network/t/copy-fail-732-bytes-to-root-on-every-major-linux-distributions/342</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-04-29T18:51:59Z https://nostr.ae/nevent1qqsf023er6gfh0266jgwlmxjnk4sse2c3tkcq24x77shxdcffrm0c8qzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx4dp7ss Looks like we have another #supplychain attack underway, this time facing #SAP-related NPM packages.<br/><br/><a href="https://discourse.ifin.network/t/sap-npm-packages-targeted-with-credential-stealing-malware/340">https://discourse.ifin.network/t/sap-npm-packages-targeted-with-credential-stealing-malware/340</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-04-29T16:25:36Z https://nostr.ae/nevent1qqsqcp6qzfej8quklj3fu9p359yayzl0lt7j388zplaftez69ugss7gzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxgmg53p RE: <a href="https://infosec.exchange/@mttaggart/116461922134943653">https://infosec.exchange/@mttaggart/116461922134943653</a><br/><br/>When opportunity (malware) comes a-knocking, you let it in (fire up the sandbox and disassembler).<br/><br/>#malware #ThreatIntel #ThreatIntelligence #IFIN<br/>nostr:note1nq6ga2rz9d8jrkgpzg93n6fdswsjlu840gy69wvldumpmhh6j0ns8dctqd<br/> 2026-04-24T21:59:20Z https://nostr.ae/nevent1qqsy4z44tkuj60g8gvkzpz4hvsw7kudp3z405snwzmpnkvegcpnhdtqzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxs4mx97 In reply to <a href='/nevent1qqszufxzullqueuf88xk94upy8kj33s4cvng95vvnzeun0upuqhw7esa0mwks'>nevent1q…mwks</a><br/>_________________________<br/><br/>Since we were the ones subtooted, it&#39;s worth clarifying: it is *impossible* to get every moderation decision right, and avenues for appeal are absolutely possible. If we make a mistake, we&#39;ll own it. Always.<br/><br/>However, on balance, this signal tends to demonstrate the seriousness with which you approach the issue and our community. If leaning on the side of safety means an occasional false positive, that&#39;s a price worth paying. 2026-04-24T20:54:27Z https://nostr.ae/nevent1qqsxuxdn4rfju3s68g7ds3sj5mlw0ny8hy9e3kav8zlxkzak3rqsdqczyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxp40fkt Tell your friends. Mess around with the single field we ask for during onboarding, and we will toss you. If you don&#39;t take this seriously, we have no reason to expect you to respect our community&#39;s safety.<br/> <img src="https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/461/007/477/566/875/original/76376544204c5095.png"> <br/> 2026-04-24T18:05:47Z https://nostr.ae/nevent1qqsta0g76ngpfpylm62wye9dmsr0r7d87gsfm5h5e6x9asddr7yvmwszyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxgtm75g We&#39;ve been on a tear adding new sources to our RSS aggregator! All the cyber news that&#39;s fit to print, in one place: <a href="https://news.ifin.network">https://news.ifin.network</a> 2026-04-23T17:39:38Z https://nostr.ae/nevent1qqs8alyd8py02wz4n4f57x4dnpvcpakgd34alekck35f765z4rps7tszyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx654m92 Bitwarden&#39;s CLI NPM package was hijacked and used to spread credential stealer malware. This is related to the previous Checkmarx compromise.<br/><br/>We&#39;ll be updating this thread as always with new information. Come join the effort!<br/><br/><a href="https://discourse.ifin.network/t/teampcp-campaign-spreads-to-npm-via-a-hijacked-bitwarden-cli/305">https://discourse.ifin.network/t/teampcp-campaign-spreads-to-npm-via-a-hijacked-bitwarden-cli/305</a> 2026-04-23T15:08:31Z https://nostr.ae/nevent1qqs268jk94eee0gvl3fuf5k47xerjdysqzvnf57yauc2z22g5clc9ngzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx5k6f9v The best time to block api.telegram[.]org was like, I dunno, five years ago? The second best time to do it is now.<br/><br/>Seriously. Cross that one off the easy wins list today.<br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-04-22T15:25:32Z https://nostr.ae/nevent1qqsg35g0vvctltdzpv63jg43nwy2wrkuazadmcyhctz4sjrwd6d4uwczyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxsy4mef RE: <a href="https://infosec.exchange/@ifin/116432853020620365">https://infosec.exchange/@ifin/116432853020620365</a><br/><br/>Thanks to some excellent reporting from Infostealers by Hudson Rock, we know a context[.]ai employee was seeking Roblox cheats when they got hit with LummaStealer, leading to the initial breach which impacted Vercel.<br/><br/><a href="https://discourse.ifin.network/t/vercel-confirms-breach-as-hackers-claim-to-be-selling-stolen-data/293/7">https://discourse.ifin.network/t/vercel-confirms-breach-as-hackers-claim-to-be-selling-stolen-data/293/7</a><blockquote class="border-l-05rem border-l-strongpink border-solid"><div class="-ml-4 bg-gradient-to-r from-gray-100 dark:from-zinc-800 to-transparent mr-0 mt-0 mb-4 pl-4 pr-2 py-2">quoting <br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Article"><a itemprop="url" href="/note1v6vqu2qzyk9zulzpplvgr655ffwndc84m5jdl50lwsl7h06aaagsq6k8zn" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1">note1v6v…k8zn</a></span><br/> </div> We're actively tracking developments here: <a href="https://discourse.ifin.network/t/vercel-confirms-breach-as-hackers-claim-to-be-selling-stolen-data/293">https://discourse.ifin.network/t/vercel-confirms-breach-as-hackers-claim-to-be-selling-stolen-data/293</a> </blockquote> 2026-04-21T16:58:33Z https://nostr.ae/nevent1qqs20yy24stuc3txtpk02kpyhrs4dsyhsd774rfy5qk5vc98jpzphrgzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxdan4xs In reply to <a href='/nevent1qqs83cug2qrrgxe95nyfkg292p3pyxhd93st6rfcq7c07qmjmws87zq8gzvsy'>nevent1q…zvsy</a><br/>_________________________<br/><br/>What a hassle! We&#39;ll look into it. Apologies for the inconvenience!<br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1kp7e9nzstq7up4rfch5j4nxa0mqxqy4gsqme6p7y847nmq2h0ygqrgrszc" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Fritz Adalis</span> (<span class="italic">npub1kp7…rszc</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1v9rfxr538ppy58765llpk88spjrdmph4lalf7lu574fqwdwpxzjqr9d02r" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Rob Carlson</span> (<span class="italic">npub1v9r…d02r</span>)</a></span> 2026-04-21T14:27:01Z https://nostr.ae/nevent1qqsretz8seg7cz7sp053j4k4ym5jmfv5h0ktv083c0pwnmee9sg823qzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxmu3eav Today we&#39;re talking about another (???) issue in the Cursor AI IDE. Well actually it&#39;s two issues, one of which is simple command injection; the other is takeover via Dev tunnels. Don&#39;t know what dev tunnels are? Come find out—then block them with extreme prejudice.<br/><br/><a href="https://discourse.ifin.network/t/cursors-remote-tunnel-capability-is-vulnerable-to-malicious-prompt-injection/295">https://discourse.ifin.network/t/cursors-remote-tunnel-capability-is-vulnerable-to-malicious-prompt-injection/295</a><br/><br/>#IFIN #ThreatIntel #ThreatIntelligence 2026-04-20T19:08:26Z https://nostr.ae/nevent1qqst4plsdlm75vzws8wrw8df54lex9uwm4vrdphrfam7msq833qwvxszyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx929qj8 #Vercel update. We now know, thanks to Vercel&#39;s CEO, that the compromise came by way of the context[.]ai Office Suite, using OAuth tokens collected from a breach last month. Details here:<br/><br/><a href="https://discourse.ifin.network/t/vercel-confirms-breach-as-hackers-claim-to-be-selling-stolen-data/293/6">https://discourse.ifin.network/t/vercel-confirms-breach-as-hackers-claim-to-be-selling-stolen-data/293/6</a> 2026-04-20T12:16:39Z https://nostr.ae/nevent1qqsxdxqw9qpztz3w03qslkypa22y5hfkur6a6fxl68lhg0lthaw775gzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxu2w8tf In reply to <a href='/nevent1qqs0m9sk5ljaq3uffprrqhrwur5rq2qkyf2qvp9m79uduv3s3dyrgugmg2v3j'>nevent1q…2v3j</a><br/>_________________________<br/><br/>We&#39;re actively tracking developments here: <a href="https://discourse.ifin.network/t/vercel-confirms-breach-as-hackers-claim-to-be-selling-stolen-data/293">https://discourse.ifin.network/t/vercel-confirms-breach-as-hackers-claim-to-be-selling-stolen-data/293</a> 2026-04-19T18:45:44Z https://nostr.ae/nevent1qqs0m9sk5ljaq3uffprrqhrwur5rq2qkyf2qvp9m79uduv3s3dyrgugzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxkgzf6y #Vercel customers: don&#39;t wait. Proactively rotate keys, passwords and environment variables ASAP.<br/><br/><a href="https://vercel.com/kb/bulletin/vercel-april-2026-security-incident">https://vercel.com/kb/bulletin/vercel-april-2026-security-incident</a> 2026-04-19T17:46:34Z https://nostr.ae/nevent1qqszyvvgrkeyhsrtvgq7wk3xsmy5zxn2gnlvamsy6c953ugqx7r2cfqzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx0j28xk In reply to <a href='/nevent1qqs0935rj6s4esx4tmxsqdsvmqeqt9q2t78mr6heu09gjh7c6wje3ecd6q7p7'>nevent1q…q7p7</a><br/>_________________________<br/><br/>Thanks so much for including us!<br/><span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1ljmfkwmllavdpnf5tgmrfay6mj4t78c0xryugfw4qka0c4exas0q2pw8tm" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>jonny (good kind)</span> (<span class="italic">npub1ljm…w8tm</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1n7zz894h5ugju2uzuvtsladk0lq3tznlrjd52nljvf45smprjghqcwjm2n" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Lenny Zeltser</span> (<span class="italic">npub1n7z…jm2n</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1ur9qljq4fg3ahdy4rxal8n37xuscn2958g69kkp3ngfu23g23xass8v3q2" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Fractal Kitty</span> (<span class="italic">npub1ur9…v3q2</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub18ak6r2run0k5vadryvdp5nuzscqkummqp3z5m3dzz24zfepnudwsf3untn" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>ploum</span> (<span class="italic">npub18ak…untn</span>)</a></span> [@otterlove](<a href="https://mastodon.art/@otterlove">https://mastodon.art/@otterlove</a> ) <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1388cy7ljtym4jag6l7d9c2tczk64y7c4qhxzy2g87wfy830760xqlusxrr" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Max Leibman</span> (<span class="italic">npub1388…sxrr</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1jjwz42h80fn278xjas9y2k9eeysjqyyh0w4r2kagqw6wf6wt748sex2z5l" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Hyde 📷 🖋 :debian:</span> (<span class="italic">npub1jjw…2z5l</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1xhjvfwgv2nqnespjrvxh5ky9jzvxappwpm4kxdcjl90l559gexds98hq9k" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Naty</span> (<span class="italic">npub1xhj…hq9k</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1yg8lnapwc8yyd0m32jcfdp7k28hwmsvtsqc59rsj6d6d0m3mynqs7tccz0" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Taggart :ifin:</span> (<span class="italic">npub1yg8…ccz0</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1c993q8n9ke28hqf9x7u0clqedrd8rpq7n9lueuw9d3nfnrcjyfpsczljas" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>readbeanicecream</span> (<span class="italic">npub1c99…ljas</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1x7454l785ug9mhfg0dh2aq9xj9equmrgyhj05lchj4vn5k5z97asvnruph" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Joel :casio: :blobcatderpy:</span> (<span class="italic">npub1x74…ruph</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1j33kuu9hrg2ukwtnnpyy4hgs70hhlvl5pf3vgv9l68y8spe8cdxqsj55x2" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Taran Rampersad</span> (<span class="italic">npub1j33…55x2</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1wp7duwkkw0r7q45f6yfdr3kn63chtm4dfy76yjetx4nhmqantekspr7eym" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Red 🟥</span> (<span class="italic">npub1wp7…7eym</span>)</a></span> [@_elena](<a href="https://mastodon.social/@_elena">https://mastodon.social/@_elena</a> ) <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1c2u267rt55rdn6h3myzw0c3fs0ake3ez8g54675as3h20eqam8sscdzg55" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Space Hobo</span> (<span class="italic">npub1c2u…zg55</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1l2k3sf7vk3kpy0s4ggvaf8dq8079lduf4q38thxz8chmgdwyee0qp46m2l" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Connected Places</span> (<span class="italic">npub1l2k…6m2l</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1dhl6470pzgczhuy6yxgpf595l998vppl0jje2swukmwyk7qny6dq0qud8y" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>gloriouscow</span> (<span class="italic">npub1dhl…ud8y</span>)</a></span> <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1090hjdt6ra9glpm5chzx8vahs5rerzejcy0ektcwyr32078ar8yqe9cff7" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>Nicolas Gouny</span> (<span class="italic">npub1090…cff7</span>)</a></span> 2026-04-18T11:47:39Z https://nostr.ae/nevent1qqsf9s7vd8shhqn7na8haq72y7z7p0f3zxh3ghnukwd0tw2x7lrvlkqzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx90hexw In reply to <a href='/nevent1qqstgmpj4eyaxz0fkfj29f044gr82se5jnc7cfedz6mnsqzdaqwdlrcapnca2'>nevent1q…nca2</a><br/>_________________________<br/><br/>Proud of you bb 2026-04-18T00:26:55Z https://nostr.ae/nevent1qqs202evwjy0yvve4gtcyswwjzc4xe4wxet99wzy0fhh0qt8ysvh82gzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxhdjknv After working on it a bit, we have a fix for a recent #ClickFix attack against #macOS that leverages AppleScript. Here&#39;s the writeup, and a link to the forum thread!<br/><br/><a href="https://ifin-intel.org/blog/applescript/">https://ifin-intel.org/blog/applescript/</a><br/><br/>#ThreatIntel #ThreatIntelligence #IFIN 2026-04-16T01:05:08Z https://nostr.ae/nevent1qqs05993cqs8w0a5wlh7c6wsdh6f0utqhrrw3ey5cqr7ew22tu6h2lszyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxltr7wg Well well well, would you look at that<br/><br/><a href="https://discourse.ifin.network/t/activitypub-test/271/1">https://discourse.ifin.network/t/activitypub-test/271/1</a> 2026-04-15T04:33:44Z https://nostr.ae/nevent1qqsgf0kw4nfeef8m4qmr7upcx0vg3d0ygqchtgrxvdkav8wzdxp7xngzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx78tsue Following up on an excellent blog post we discovered (linked in thread), we dug a little deeper on a recent #WordPress plugin compromise. We have more IoCs for you, and what we believe to be a use of the blockchain for an initial access auction for the plugin install base.<br/><br/><a href="https://discourse.ifin.network/t/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/265/8">https://discourse.ifin.network/t/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/265/8</a><br/><br/>#ThreatIntel #ThreatIntelligence #ThreatHunting #IFIN 2026-04-14T17:13:23Z https://nostr.ae/nevent1qqsy4d8y32pvkjk44ml7zznmtcwrynu75vtsz40a4a745cd7davzn3qzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxmgft33 CISA is claiming that #Iran is once again targeting Programmable Logic Controllers (PLCs), similar to efforts in 2024. Has anyone seen recent evidence of this? None was provided from CISA, and we&#39;d love independent confirmation. 2026-04-13T19:21:03Z https://nostr.ae/nevent1qqsfea9ngul78fm4q3egkytjr4y6zh0w99ulhnghfkgumxkff3leraczyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxp4tfnd We ask for preferred pronouns when you register. We do this so everyone can address you how you wish. But it&#39;s also a signal of how you&#39;ll treat others. <br/><br/>We just rejected a forum account application because of joke pronouns. That is such a low barrier and if you don&#39;t take it seriously, we have no confidence you&#39;ll treat our community members with respect. 2026-04-11T14:56:14Z https://nostr.ae/nevent1qqs9up6fy54y7d0x4fpyz4u0fpd6r57ns7j23gv69jet8tk7t62tkyqzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxev4tge RE: <a href="https://infosec.exchange/@cR0w/116052391841771930">https://infosec.exchange/@cR0w/116052391841771930</a><br/><br/>Come gather round. We&#39;ll tell stories together for free.<br/>nostr:note17teqm8m359cjtwf6qcafdl02c44l94j5k02ypkylgjsf9savh4gq2e9am9<br/> 2026-04-10T21:04:23Z https://nostr.ae/nevent1qqs0mqnt2mgwakvfmkxwzykm80ztzv9sv65uxnkumy74x97p30e9jrszyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxumxh3p CPUID downloads were temporarily compromised earlier today. We have a thread compiling analysis and IoCs for you to investigate:<br/><br/><a href="https://discourse.ifin.network/t/hwmonitor-download-compromised/249">https://discourse.ifin.network/t/hwmonitor-download-compromised/249</a><br/><br/>#ThreatIntel #IFIN #ThreatIntelligence 2026-04-10T13:49:31Z https://nostr.ae/nevent1qqsgm50nrjsdqe0xpnuqvlrpdh84dqa2sjflv56gwna3hrkrr869j5qzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx9zx406 In reply to <a href='/nevent1qqsd53zp9ll6t79jt9kvtzh2s7m93n0nvz7jfaqlrwgmxnk639dn67cmjqp6w'>nevent1q…qp6w</a><br/>_________________________<br/><br/>:ablobcatpopcorn: 2026-04-09T16:20:46Z https://nostr.ae/nevent1qqs28djadv4t94j5xx0cqjgjfzd5gyuxeft83rhae9m0la2hh2v6uwczyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx4dhl7m This right here?<br/><br/>This is a huge part of why we exist. It&#39;s time to trust in each other for our mutual protection, because nobody is coming to save us.<br/><br/><a href="https://www.securityweek.com/white-house-seeks-to-slash-cisa-funding-by-707-million/">https://www.securityweek.com/white-house-seeks-to-slash-cisa-funding-by-707-million/</a> 2026-04-09T13:09:12Z https://nostr.ae/nevent1qqswuh0ptwsx204n8eawkdfwvgg5xvx023v9cves7evmecg7lznfeaqzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx7d2uz3 In reply to <a href='/nevent1qqsyg7kg6vf33vhsxd9trkvajpuas9h8nt975c4nr9ldg5chv6messg42ch6q'>nevent1q…ch6q</a><br/>_________________________<br/><br/>So, how this works is:&lt;li&gt;Our community finds something interesting&lt;/li&gt;&lt;li&gt;We make a thread&lt;/li&gt;&lt;li&gt;We investigate together&lt;/li&gt;&lt;li&gt;The data &lt;u&gt;remains searchable&lt;/u&gt; for future reference&lt;/li&gt;&lt;li&gt;We all win&lt;/li&gt;<br/><br/>Come join us! 2026-04-08T19:09:36Z https://nostr.ae/nevent1qqsyg7kg6vf33vhsxd9trkvajpuas9h8nt975c4nr9ldg5chv6messgzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxm3hqhh Looks like we have a live one here. Weird Rust maintainer phishing campaign using crates[.]ws:<br/><br/><a href="https://discourse.ifin.network/t/bizarre-crates-io-phishing-campaign/232">https://discourse.ifin.network/t/bizarre-crates-io-phishing-campaign/232</a> 2026-04-08T18:53:37Z https://nostr.ae/nevent1qqs0xnwhq8ssngmnf7zhelwhqw8cajwkswyy53d82tpmhv0jzu2386szyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx92eyrn In reply to <a href='/nevent1qqsdxljntqphljuvek4fc5skvw9ul0raw0vzqpuatcdjlpsvu9xqt5qgeg55t'>nevent1q…g55t</a><br/>_________________________<br/><br/>I&#39;ve been trying to think of a way to describe our relationship and this is pretty much flawless.<br/><br/>IFIN :rainbow_heart: <span itemprop="mentions" itemscope itemtype="https://schema.org/Person"><a itemprop="url" href="/npub1eznzdgefq0ece8yljlxtaadscv4skav3ckk38gv3qw04s25mrt2s5fnyq3" class="bg-lavender dark:prose:text-neutral-50 dark:text-neutral-50 dark:bg-garnet px-1"><span>GAYINT</span> (<span class="italic">npub1ezn…nyq3</span>)</a></span> 2026-04-07T19:05:27Z https://nostr.ae/nevent1qqs8ssjyn4reyat7z74knxdzqf3xwsdk4f5770jyg8tr3ajpzmsqtdgzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxr3m0ex CISA just published an advisory about IRGC activity against Rockwell/Allen-Bradley PLCs. This is a return to form for IRGC, following patterns observed in 2023.<br/><br/><a href="https://discourse.ifin.network/t/iran-conflict-cyber-threat-activity/145/25">https://discourse.ifin.network/t/iran-conflict-cyber-threat-activity/145/25</a> 2026-04-07T18:35:33Z https://nostr.ae/nevent1qqsq72ym46tmg4vzss5q8vak5c0ul67zek60znzpur0c9egr8dfvengzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxcmyd83 Folks here will probably be interested in our AI policy:<br/><br/>&gt; With so many downside risks, and with such dubious benefit to usage, the choice for IFIN is clear: we choose not to participate in the toxic cult of generative AI. Our published material and code are not produced with these models.<br/><br/><a href="https://ifin-intel.org/policies/ai/">https://ifin-intel.org/policies/ai/</a> 2026-04-07T17:30:23Z https://nostr.ae/nevent1qqs95vg92ky74cjgwz8wjgz6jy206m6uwzf57wj7tzw4gnx0y42chpgzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx69p5d2 In reply to <a href='/nevent1qqs0ptdhcaems3u90aytzrkme5hgxuuyddthhn6n649luyd6uz9jexsfpxwed'>nevent1q…xwed</a><br/>_________________________<br/><br/>Haha insta-hugged. Standby! 2026-04-07T15:48:30Z https://nostr.ae/nevent1qqs0ptdhcaems3u90aytzrkme5hgxuuyddthhn6n649luyd6uz9jexszyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sxcmp2zt And our first contribution: here is our thread on currently tracked #Iran-based cyber threat activity, including motivations and targeting information.<br/><br/><a href="https://discourse.ifin.network/t/iran-conflict-cyber-threat-activity/145/23">https://discourse.ifin.network/t/iran-conflict-cyber-threat-activity/145/23</a> 2026-04-07T15:45:24Z https://nostr.ae/nevent1qqst0xvxd0v04mqdkxwg2s4zhss93dz9d28dt9735d45nrc7vwkk4vgzyqrw4v3dhv0kdxmu3mznfg8eqywreatv2mzhjqpnfv7tk9kx4l9sx7y288w Hello, world!<br/><br/>We are IFIN, the Independent Federated Intelligence Network, and we want to change how threat intelligence is done.<br/><br/>We believe we&#39;re all safer when we share what we know. Come learn more and join us!<br/><br/><a href="https://ifin-intel.org/blog/hello/">https://ifin-intel.org/blog/hello/</a><br/><br/>#ThreatIntel #ThreatIntelligence #Cybersecurity #Infosec 2026-04-07T15:31:14Z