DarkInvader

31/08/2026

Most third party breaches reach you through a customer, a journalist or a leak site. Not the supplier.

That single fact changes how you should plan. If your process assumes a formal notification arrives first, your first few hours get spent chasing confirmation instead of containing exposure.

Two things worth building now:

Early warning signals. Watch for odd authentication patterns from supplier IP ranges, sessions that stay open long after a contractor's engagement ended, DNS changes you did not request, and your brand or domain appearing in ransomware leak site postings. These usually show up before anyone tells you anything.

A 72-hour runbook that does not depend on the supplier. Under UK rules the clock starts on your side of the contract, regardless of whose infrastructure failed. That means you need to know, in advance, what data each supplier holds, who owns the decision to notify, and how you evidence what you did.

And then the contract fixes, because the same gap tends to repeat with the next vendor.

How quickly could you list every supplier holding your personal data right now, without asking anyone?

Read the full blog: www.darkinvader.io/blog/third-party-breach-response-guide

Third party breach hitting your data? Get the early warning signals, a 72-hour UK response runbook and the contract fixes that stop a repeat.

28/08/2026

A NetScaler authentication bypass is not exploited yet. That sentence has a very short shelf life.

CVE-2026-19490 carries a CVSS v4.0 score of 9.3. An unauthenticated attacker can bypass login checks on NetScaler ADC and Gateway appliances configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server.

One detail matters: on newer builds a SAML action must be configured for the flaw to apply. On older builds, a Gateway or AAA configuration alone is enough.

Fixed versions are 14.1-73.32 and 13.1-63.21 and later. Rapid7 had seen no exploitation as of 19 August but is urging emergency patching, because Citrix edge appliances are weaponised faster than almost anything else on the internet.

This is the week to find every NetScaler you expose and confirm the build. Not the week after.

Read full blog here:

CVE-2026-19490 is a critical authentication bypass vulnerability in NetScaler ADC and Gateway. It refers to an authentication flaw that could potentially become a major security threat if not addressed promptly.

27/08/2026

Your CMDB is not the list an attacker works from.

Passive reconnaissance against a domain builds a very different picture. DNS records get walked. Certificate transparency logs get read, and every subdomain someone spun up for a two-week campaign in 2022 is sitting there in plain text. IP ranges that announce your name get checked. Corporate email domains turn up in stealer logs, which tells an attacker not just that an asset exists but that credentials for it may already be circulating.

The footprint that comes back almost never matches the internal asset register. That gap is not an admin problem, it is the starting point for most incidents we see.

The useful shift is to stop asking what we own and start asking what announces our name from outside. Those two answers should match. They rarely do.

When you last compared your external footprint to your asset inventory, how big was the gap, and what surprised you most?

Read the full blog: www.darkinvader.io/blog/shadow-it-risks

Shadow IT risks explained from the attacker's view: 7 exposures, how each one is discovered from outside, and what to fix first. See how to find yours.

25/08/2026

Two days. That is how long it took attackers to start hitting GitLab CVE-2026-19478 after the patch dropped.

The flaw is a code injection bug in GitLab CE and EE, rated CVSS 9.4. Under certain conditions an unauthenticated attacker can modify or delete public projects and user data through a single GraphQL directive. No credentials, no user interaction.

GitLab pushed an out-of-band release on 17 August. watchTowr reproduced the issue within minutes of reading the advisory and saw exploitation attempts against its honeypot network by 19 August.

GitLab and Dedicated are already fixed. If you run self-managed GitLab, you need 18.11.11, 19.0.8, 19.1.6 or 19.2.4. If you cannot patch today, restrict unauthenticated access to /api/graphql.

The harder question is whether you know every self-hosted GitLab your organisation exposes to the internet. Most teams do not.

Read full blog here: www.darkinvader.io/blog/gitlab-cve-2026-19478-graphql-code-injection-exploited

24/08/2026

Framework's customers never had a relationship with Metabase. Their data went anyway.

CVE-2026-72898 scored a perfect CVSS 10.0. Unauthenticated SQL injection through the /api/session/reset_password endpoint, which sits open by design for password recovery. The result is administrator access, and from there the stored credentials for every connected database.

Metabase confirmed active exploitation on 6 August. Versions 0.58 and above are affected.

Then the downstream picture: Framework disclosed customer names, addresses and login IPs accessed. n8n disclosed 136 records taken, five with bcrypt-hashed passwords. Tally and Kilo Code were also named.

This is fourth-party exposure. A BI platform is, by design, the one system holding credentials to everything else, and most inventories classify it as an internal reporting tool.

Wiz found roughly 13 percent of cloud environments run self-hosted Metabase, about a quarter of those internet accessible. Vendor questionnaires ask what controls a supplier has. They do not ask what that supplier exposes.

Read full blog here:

Explore the anatomy of a fourth-party data breach, examining the risks associated with Metabase, Framework, and n8n and how to mitigate them.

21/08/2026

No CVE. No malware. No exploit. A turbine serving 50,000 people still stopped.

CERT Polska disclosed this on 8 August. The incident happened in December 2025 and was originally logged as a contractor error during maintenance. It almost disappeared.

The path: an internet-exposed FortiGate at a wind farm allowing accounts without MFA, then a Teltonika cellular router whose SSH service tunnelled into a private APN run by the distribution system operator. That APN had no client isolation, so the attacker scanned it and found a WAGO PFC200 at a different facility with default admin credentials.

A week of reconnaissance later they set the plant's Siemens PLCs to STOP and password-protected them. Steam turbine and water treatment down. Customers never lost heat.

CERT Polska calls it the first known lateral movement into OT through a private cellular APN, and says the permissive configuration is common well beyond Poland.

Every component worked exactly as configured.

Read full blog here:

In the interconnected world of industrial operations, cyber threats can emerge unexpectedly. This post explores how a forgotten VPN at a wind farm compromised Siemens PLCs at a heat plant and the importance of robust cybersecurity strategies.

20/08/2026

An AI agent found a live unauthenticated RCE chain in SharePoint. The entry lost at Pwn2Own anyway.

Rapid7 Labs ran two sprints against the codebase. January produced nothing. March produced CVE-2026-55040, a JWT validation bypass at CVSS 9.1, and CVE-2026-63520, unsafe .NET type instantiation in Business Connectivity Services at CVSS 8.1. Neither reaches unauthenticated RCE alone. Chained, they do.

The second sprint took 120 hours of agent runtime, 96 sessions, roughly 80,000 tool calls and 256 human prompts across 24 days.

Rapid7 published the PoC for the first flaw on 11 August. Defused reported honeypot exploitation on 12 August.

The operational catch is split remediation. July only leaves the RCE half. August only leaves the bypass. Both patches are required to break the chain, and Shadowserver still counts over 8,500 SharePoint servers reachable from the open internet.

Full technical details for CVE-2026-63520 land around 10 September.

Read full blog here:

In cybersecurity, anticipating future trends means understanding current discoveries. The agent-discovered SharePoint vulnerability chain illuminates how exploitation could evolve and how organisations can prepare.

18/08/2026

Broadcom patched it on 29 July. Attackers were inside by 3 August.

CVE-2026-59310 is a directory traversal flaw in the vCenter Syslog server, CVSS 9.8, exploitable by an unauthenticated attacker with network access.

Broadcom confirmed there are no workarounds.

QUIRSO published findings on 10 August after an IR engagement: 361 unique victim IPs across 47 countries, with persistence established via a malicious cron job deploying reverse_ssh.

Babuk-derived ransomware has been deployed in connection with the campaign.

Two things worth sitting with. The same advisory carried a second CVSS 9.8 flaw, CVE-2026-59309, an authentication bypass in vmdir. Teams that triaged the headline CVE may

still be carrying the other half.

And a cron job survives the patch. If the appliance was reachable before 3 August, patching closes the door but does not evict anyone already through it.

Read full blog here:

A comprehensive analysis of the vCenter Syslog Flaw, its potential impacts, and mitigation strategies.

17/08/2026

Your MFA is on. Their phishing kit doesn't care.

An active campaign tracked as Payroll Pirates is hijacking Microsoft 365 accounts using adversary-in-the-middle proxies that relay the real Microsoft login in real time. Victims complete MFA on what looks like a legitimate page, and the attackers walk away with the session.

From there it gets methodical: sign-ins hidden behind rotating residential proxies, sessions refreshed automatically every eight hours, and Microsoft Graph queries to pinpoint exactly who handles payroll, invoices and banking. Hundreds of organisations were targeted in July alone across the US, Canada and Europe.

The end goal is simple: reroute salaries to attacker controlled accounts.

We walk through the full playbook, the detection signals to hunt for, and how to get ahead of the impersonation domains before the lure ever lands.

Read full blog here:

An exploration of the "Payroll Pirates" AitM phishing campaign, highlighting its techniques and providing guidance for detection and defense.

14/08/2026

The water utility attackers didn't exploit a single vulnerability. They didn't need to.

Forescout's latest scan found 4,407 Rockwell PLCs exposed directly to the internet, including 22 in cities hit by the recent attacks on US water systems. The attackers simply changed IP addresses and set passwords on controllers that were already publicly reachable, locking operators out of their own equipment.

The FBI and EPA have confirmed attacks across at least 12 states. Half the exposed devices are MicroLogix 1400s, and the MicroLogix 1100 has been end of life since 2022, meaning no patches will ever come.

The uncomfortable truth: this exposure was discoverable by anyone scanning. The attackers found it first.

If you don't know what your organisation has facing the internet, that's exactly the problem we help solve. Book a demo and we'll show you what's visible from the outside.

Read full blog here:

Forescout's Vedere Labs identified 4,407 internet-exposed Rockwell Automation/Allen-Bradley PLCs in an August 2026 scan, including 22 in cities affected by coordinated attacks on US water utilities. Attackers achieved disruption without exploiting any vulnerability: they changed IP addresses and set...