Decipher
LightNews LightNews
banner
deciphersec.bsky.social
Decipher
@deciphersec.bsky.social
100 followers 190 following 120 posts
Security without fear since 2018.
https://decipher.sc
https://www.youtube.com/@DecipherSec
https://www.buzzsprout.com/228511/supporters/new
Posts Replies Media Videos
Pinned
deciphersec.bsky.social
Decipher @deciphersec.bsky.social · Dec 16
Yesterday was the 30th anniversary of the release of Michael Mann's HEAT, a hacker movie classic. (Shoutout Kelso.) We did an episode on HEAT last year with the great @meggardiner.bsky.social (co-author of HEAT 2) and our friend @cje.io.

The podcast IS the juice!

youtu.be/b2cfEXeWSn0?...
Deciphering Heat
YouTube video by Decipher
youtu.be
deciphersec.bsky.social
What advantages do defenders have and how can they emply them to stay ahead of adversaries? We chatted with Ryan Dewhurst of @labs.watchtowr.com.web.brid.gy to find out.

youtu.be/5WznmQpJnj4?...
How to Stay Ahead of Attackers With watchTowr's Ryan Dewhurst
YouTube video by Decipher
youtu.be
February 12, 2026 at 2:57 PM
deciphersec.bsky.social
decipher.sc/2026/02/11/m...
Microsoft Fixes Six Exploited Bugs in February Patch Tuesday Updates - Decipher
The exploited vulnerabilities in question exist across various products, from Microsoft Word to Windows Shell.
decipher.sc
February 11, 2026 at 4:20 PM
deciphersec.bsky.social
decipher.sc/2026/02/09/s...
Singapore Says China-Linked Threat Actors Targeted Telecom Sector - Decipher
UNC3886 is a Chinese espionage group known for targeting defense, tech, and telecom organizations across both the U.S. and Asia-Pacific-Japan regions.
decipher.sc
February 9, 2026 at 7:45 PM
deciphersec.bsky.social
Brand new podcast episode is here to brighten up your Monday! We chatted with Ryan Dewhurst of @labs.watchtowr.com.web.brid.gy !

youtu.be/5WznmQpJnj4?...
How to Stay Ahead of Attackers With watchTowr's Ryan Dewhurst
YouTube video by Decipher
youtu.be
February 9, 2026 at 4:28 PM
deciphersec.bsky.social
New @silentpush.bsky.social research on a novel variant of the SystemBC 🤖

decipher.sc/2026/02/04/n...
New SystemBC Botnet Activity Targets Systems Worldwide - Decipher
The SystemBC botnet malware has become a critical component in the modern threat landscape, often preceding a full-scale ransomware deployment.
decipher.sc
February 5, 2026 at 2:31 PM
Reposted by Decipher
joemenn.bsky.social
Sometimes I post paywalled Post articles. Usually I post marketing ones, free with account creation unless you have one. Sometimes I post free archive versions, which you also can figure out how to find without me.
This week is not the time to shout at me for posting a version that pays reporters.
February 3, 2026 at 7:48 PM
deciphersec.bsky.social
Some very interesting data analysis from our friends at @greynoise.io on the silent changes CISA makes to the KEV catalog regarding exploitation by ransomware gangs.
www.greynoise.io/blog/unmaski...
The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates
In 2025, 59 KEV entries silently flipped to “known ransomware use.” GreyNoise uncovers the hidden flips, why they matter, and a new feed to track them.
www.greynoise.io
February 3, 2026 at 4:29 PM
Reposted by Decipher
taonf.bsky.social
With perfect pitch, Joe Engressia Jr, aka #Joybubbles, discovered that he could whistle specific tones into a phone handset and bend the analog network to his will

(If you’re noticing a similarity between Engressia and the character Whistler in Sneakers, that’s not a coincidence)
February 3, 2026 at 12:10 AM
deciphersec.bsky.social
We don't write about movies often but when we do, we write about hacker movies, like JOYBUBBLES from @charmingstranger.com at @sundance.org

decipher.sc/2026/02/02/p...
Phreaks and Geeks: Joybubbles and the Pre-History of Hacking - Decipher
The proto hacker whose innate ability, curiosity, and absolute joy in the act of discovery is conveyed so artfully in the new documentary Joybubbles.
decipher.sc
February 2, 2026 at 8:20 PM
deciphersec.bsky.social
Google Mandiant researchers said the campaign has successfully used voice phishing and credential harvesting sites to pilfer both single sign-on (SSO) credentials and multi-factor authentication (MFA) codes.

decipher.sc/2026/02/02/g...
Google Mandiant: ShinyHunters Attacks Target SaaS Platforms Via SSO, MFA Abuse - Decipher
The series of incidents detailed by Mandiant researchers started in early to mid-January, and included a previously disclosed campaign involving Okta customers.
decipher.sc
February 2, 2026 at 7:10 PM
deciphersec.bsky.social
It's not Friday without an actively exploited bug!

decipher.sc/2026/01/30/i...
Ivanti Discloses Exploited Critical EPMM Flaws - Decipher
The vulnerabilities (CVE-2026-1281 and CVE-2026-1340) could lead to unauthenticated remote code execution if successfully exploited.
decipher.sc
January 30, 2026 at 7:05 PM
Reposted by Decipher
dennisf.bsky.social
🚨 New @deciphersec.bsky.social podcast is up!

🪲 New Fortinet SSO auth bypass exploitation
🪲 Attacks on old WinRAR flaw
🖥️ Google disrupts IPIDEA proxy network

📹 And shoutouts to some fave creators: @ryanaraine.bsky.social @johnhammond.bsky.social @mattjay.com

open.spotify.com/episode/5k9x...
Fortinet and WinRAR Exploitation, Google's IPIDEA Disruption, and Our Favorite Cybersecurity Creators
open.spotify.com
January 30, 2026 at 3:52 PM
deciphersec.bsky.social
decipher.sc/2026/01/29/g...
Google Disrupts IPIDEA Residential Proxy Network - Decipher
Google researchers observed more than 550 individual threat groups using IPIDEA exit nodes during a one-week period earlier this month.
decipher.sc
January 29, 2026 at 4:08 PM
Reposted by Decipher
lookitup.baby
Signal will never message you like this.

If you get a message like this, SOMEONE IS TRYING TO HACK YOUR SIGNAL.

DO NOT GIVE THEM THAT CODE.
Message from "Signal Support" Dear User, this is Signal Security Support ChatBot. Our system has detected a recent login attempt to your account from an unrecognized device or location. As a security measure, we have blocked this attempt and sent a verification code via SMS to your registered phone number. If this was NOT you: To secure your account and block this unauthorized access, please reply to this message with the verification code you just received. If this WAS you: You can safely ignore this message. The login attempt will be automatically approved shortly. Thank you for helping us keep your account secure.
January 26, 2026 at 2:16 AM
deciphersec.bsky.social
More Fortinet targeting.
decipher.sc/2026/01/28/f...
Fortinet Warns of Critical Flaw After FortiCloud SSO Exploitation - Decipher
Fortinet is rolling out updates for CVE-2026-24858, with fixes for some versions available as of Tuesday, and others in releases that are upcoming at an unspecified date.
decipher.sc
January 28, 2026 at 8:27 PM
deciphersec.bsky.social
decipher.sc/2026/01/27/c...
Cybercrime and APT Groups Exploiting WinRAR Bug - Decipher
Exploitation of CVE-2025-8088 in the wild began before disclosure, with attacks confirmed as early as July 18, 2025.
decipher.sc
January 27, 2026 at 5:06 PM
deciphersec.bsky.social
decipher.sc/2026/01/26/m...
Microsoft Releases Emergency Patch for CVE-2026-21509 - Decipher
The vulnerability (CVE-2026-21509) requires user interaction for an attack to succeed, with the most likely vector being an attacker sending a malicious Office file to a victim, who then opens it.
decipher.sc
January 27, 2026 at 2:43 PM
Reposted by Decipher
dustinchilds.bsky.social
Wow - Office security feature bypass patched OOB after active exploitation detected. Path now - CVE-2026-21509. At least the Preview Pane isn't an attack vector. msrc.microsoft.com/update-guide...
Security Update Guide - Microsoft Security Response Center
msrc.microsoft.com
January 26, 2026 at 5:40 PM
deciphersec.bsky.social
UPDATE: Fortinet has published some info on these attacks and the new path they're using.

decipher.sc/2026/01/22/f...
Fortinet FortiGate Devices Targeted in New Campaign - Decipher
This activity shares some similarities with a campaign that researchers at Arctic Wolf identified in December. That campaign started soon after Fortinet disclosed two authentication bypass flaws (CVE-...
decipher.sc
January 22, 2026 at 9:12 PM
deciphersec.bsky.social
The remote code execution flaw (CVE-2026-20045) exists in Cisco’s lineup of products for voice, video, and mobility services for endpoints and applications.

decipher.sc/2026/01/22/c...
Cisco Fixes Unified Communications RCE Flaw Under Attack  - Decipher
Threat actors are attempting to exploit the Cisco remote code execution flaw (CVE-2026-20045) in the wild, according to a new security advisory.
decipher.sc
January 22, 2026 at 4:51 PM
deciphersec.bsky.social
decipher.sc/2026/01/22/f...
Fortinet FortiGate Devices Targeted in New Campaign - Decipher
This activity shares some similarities with a campaign that researchers at Arctic Wolf identified in December. That campaign started soon after Fortinet disclosed two authentication bypass flaws (CVE-...
decipher.sc
January 22, 2026 at 3:36 PM
deciphersec.bsky.social
decipher.sc/2026/01/21/h...
High-Risk Authentication Bypass Flaw Found in Telnetd - Decipher
The flaw is in the way that the telnetd server handles some specific user-supplied data. An attacker who exploits this vulnerability would be able to bypass the authentication path and gain root privi...
decipher.sc
January 21, 2026 at 8:30 PM
deciphersec.bsky.social
This is how you start a security advisory: "If you are tired of modern age vulnerabilities, and remember the good
old times on bugtraq, I hope you will appreciate this one."

www.openwall.com/lists/oss-se...
oss-security - GNU InetUtils Security Advisory: remote authentication by-pass in telnetd
www.openwall.com
January 21, 2026 at 3:21 PM
deciphersec.bsky.social
decipher.sc/2026/01/20/u...
UK Warns of DoS Attacks by Russian Hacktivist Group NoName057(16)  - Decipher
The network was linked to various attacks in 2023 and 2024, including ones against Swedish authorities and bank websites, and a wave of 14 different attacks on more than 250 German companies.
decipher.sc
January 20, 2026 at 3:37 PM
deciphersec.bsky.social
🚨 This week's podcast is up now! In this episode we break down:

✅ The RedVDS cybercrime platform takedown by
@security.microsoft.com
✅ New @talosintelligence.com research on UAT-8837 Chinese APT activity
✅ The very cool StackWarp bug by @rayiizzz.bsky.social and team

decipher.sc/podcasts/the...
The RedVDS Takedown, Yet Another Chinese APT Emerges, and the StackWarp AMD Bug
This week, we talk about how Microsoft disrupted a long-running, large-scale cybercrime-as-a-service platform called RedVDS that has been active since 2019 and was used in high-volume phishing and BEC...
decipher.sc
January 16, 2026 at 6:24 PM