cisa-kev - Malwlab

Podcast

Cyber Briefing (2026-08-05): INC Ransomware SonicWall SMA zero-day at scale, Langflow RCE on KEV, cPanel SQL-root escalation

INC Ransomware claims 885 victims on SonicWall SMA 1000 zero-days CVE-2026-15409/15410 with TOTP seed theft. CISA adds Langflow CVE-2026-9198 RCE to KEV. cPanel CVE-2026-58048 (CVSS 9.4) SQL-root escalation.

Podcast

Cyber Briefing Weekly (2026-08-10): INC SonicWall TOTP theft, ChainDrop npm worm, RufRoot AI-agent hijack, NatJack

INC Ransomware hits 900+ victims via SonicWall SMA 1000 zero-days. npm worm ChainDrop poisoned 444+ packages with Ethereum C2 rotation. CVE-2026-59726 leaves Ruflo's MCP bridge unauthed (CVSS 10.0). Plus: TeamCity under BOD in latest KEV batch; NatJack NAT trust exploits.

litellm

The Gateway in the Middle: Why Your AI Proxy Is a Perimeter Device and What a Pre-Auth SQLi Taught Us

An unauthenticated pre-auth SQL injection in the LiteLLM AI gateway, fixed in 1.83.7 and exploited in the wild 36 hours after the global advisory. The AI gateway is the perimeter device of the self-hosted AI stack — here is the triage, the forensics, and the standing posture.

homelab

When Your Self-Hosted App Lands in CISA KEV: The Operator 72-Hour Response Checklist

CISA added four self-hosted apps to KEV in three weeks: Metabase, MLflow, Zimbra, Gitea. The 72-hour operator checklist: exposure check, patch or compensate, compromise check, scoped credential rotation, documentation for the next incident.