For over 20 years, leading companies in Cybersecurity, Healthcare, Finance, New Media and more have come to rely on Loginsoft as a trusted technology partner.
Chantilly, VA USA
Joined June 2018
- Tweets471
- Following64
- Followers228
- Likes3
Disclosures turned into attacks within hours this week, and flaws patched months ago were still being exploited.
๐๐ฒ๐ ๐๐ต๐ฟ๐ฒ๐ฎ๐๐ ๐๐ต๐ถ๐ ๐๐ฒ๐ฒ๐ธ:
๐นCISA added nine vulnerabilities to its KEV catalog, including all four flaws in the Plex2Shell chain, plus Atlassian Data Center, BeyondTrust Remote Support, SiteGuard Server, Siemens Software Center and multiple Fortinet products, some patched as far back as April and August
๐นActive exploitation hit the PHP core flaws four days before disclosure, and the Redis RESTORE flaw was attacked on October 16-17
๐นARMORY CASTLE exploited BeyondTrust Remote Support as a zero-day, deploying the SAWFLY webshell and the BARECLAW SOCKS5 tunneler
๐นPlex2Shell attackers dropped the myawesomeproxy proxyware alongside an XMRig miner
๐นCL-STA-0954 deployed PEERSTITCH, a stealthy memory-resident ARM64 implant on Fortinet firewalls
๐นMultiple ransomware groups exploited the PAN-OS GlobalProtect authentication bypass to break into corporate networks
The lesson: a patch that isnโt applied is an open door. Patch fast, cut exposure, and hunt for compromise.
Get the full breakdown in this weekโs LOVI report: loginsoft.com/reports/weeklyโฆ
#ThreatIntelligence #CyberSecurity #VulnerabilityManagement #ZeroDay #CISAKEV #LOVI #Loginsoft #VulnerabilityIntelligence #Plex #BeyondTrust #Fortinet #PEERSTITCH #PaloAltoNetworks #Ransomware
Zero-days and decade-old flaws hit at the same time this week, and attackers exploited both. CISA added 11 vulnerabilities to its KEV catalog, including zero-days in Palo Alto Networks PAN-OS, Cisco Secure Email Gateway, Microsoft Windows and Ivanti Connect Secure, plus two chained AhsayCBS flaws. Five older flaws also landed in KEV after a joint advisory confirmed exploitation by Chinese government-linked actors, some dating back more than 10 years: Apache Struts, ProFTPD, ISC BIND, ONLYOFFICE and Strapi.
๐๐ฒ๐ ๐๐ต๐ฟ๐ฒ๐ฎ๐๐ ๐๐ต๐ถ๐ ๐๐ฒ๐ฒ๐ธ:
๐นUTA0576 chained three Ivanti zero-days to gain root access without leaving a web shell
๐นAhsayCBS backup servers were hijacked to run a disguised XMRig cryptominer
๐นCL-STA-0954 deployed PEERSTITCH, a stealthy memory-resident FortiGate implant
๐นAttackers exploited the Bricksforge WordPress plugin and redirected EC-CUBE shoppers to phishing pages
The lesson: an unpatched vulnerability doesnโt expire. Patch fast, cut exposure, and hunt for compromise.
Get the full breakdown in this weekโs LOVI report : loginsoft.com/reports/weeklyโฆ
#ThreatIntelligence #CyberSecurity #VulnerabilityManagement #ZeroDay #CISAKEV #LOVI #Loginsoft #VulnerabilityIntelligence #PaloAltoNetworks #ApacheStruts #ONLYOFFICE #EC_CUBE #Cisco #PEERSTITCH #Bricksforge
๐ฌ๐ผ๐๐ฟ ๐ฐ๐ผ๐ป๐๐ฎ๐ถ๐ป๐ฒ๐ฟ ๐ถ๐บ๐ฎ๐ด๐ฒ ๐ฝ๐ฎ๐๐๐ฒ๐ฑ ๐๐ต๐ฒ ๐ฏ๐๐ถ๐น๐ฑ. ๐๐๐ ๐ถ๐ ๐ถ๐ ๐๐ฒ๐ฐ๐๐ฟ๐ฒ ๐ฒ๐ป๐ผ๐๐ด๐ต ๐ณ๐ผ๐ฟ ๐ฝ๐ฟ๐ผ๐ฑ๐๐ฐ๐๐ถ๐ผ๐ป?
Imagine deploying hundreds of microservices across Kubernetes, only to discover hundreds of CVEs across your container images. Many may come from unnecessary packages and dependencies, leaving security teams overwhelmed with alerts and developers waiting to ship.
๐ง๐ต๐ฒ ๐๐ผ๐น๐๐๐ถ๐ผ๐ป ๐ถ๐๐ป'๐ ๐ท๐๐๐ ๐๐ฐ๐ฎ๐ป๐ป๐ถ๐ป๐ด ๐บ๐ผ๐ฟ๐ฒ. ๐๐'๐ ๐ฟ๐ฒ๐ฑ๐๐ฐ๐ถ๐ป๐ด ๐๐ต๐ฒ ๐ฎ๐๐๐ฎ๐ฐ๐ธ ๐๐๐ฟ๐ณ๐ฎ๐ฐ๐ฒ ๐ฎ๐ ๐๐ต๐ฒ ๐๐ผ๐๐ฟ๐ฐ๐ฒ.
Loginsoft's ๐๐ฎ๐ฟ๐ฑ๐ฒ๐ป๐ฒ๐ฑ ๐๐ผ๐ป๐๐ฎ๐ถ๐ป๐ฒ๐ฟ ๐๐บ๐ฎ๐ด๐ฒ๐ service helps organizations strengthen container security through:
๐นMinimal images: Remove unnecessary packages, shells, and utilities.
๐นSecure configurations: Apply non-root execution and restricted permissions.
๐นSBOM + VEX: Improve dependency visibility and understand vulnerability exploitability.
๐นSigned attestations: Verify build provenance and strengthen software supply chain security.
๐นContinuous CVE monitoring: Track emerging vulnerabilities and patches.
๐ง๐ต๐ฒ ๐ถ๐บ๐ฝ๐ฎ๐ฐ๐: Loginsoft's service page cites a typical ๐ฒ๐ฌโ๐ต๐ฌ% ๐ฟ๐ฒ๐ฑ๐๐ฐ๐๐ถ๐ผ๐ป ๐ถ๐ป ๐๐ฉ๐ ๐ฐ๐ผ๐๐ป๐๐, helping reduce vulnerability noise and improve security visibility. Actual results vary by image and workload.
For security and engineering leaders, the goal is simple: ๐ฟ๐ฒ๐ฑ๐๐ฐ๐ฒ ๐๐ป๐ป๐ฒ๐ฐ๐ฒ๐๐๐ฎ๐ฟ๐ ๐ฟ๐ถ๐๐ธ ๐๐ถ๐๐ต๐ผ๐๐ ๐๐น๐ผ๐๐ถ๐ป๐ด ๐ฑ๐ผ๐๐ป ๐ฑ๐ฒ๐น๐ถ๐๐ฒ๐ฟ๐ across AWS, Azure, and GCP.
Explore our service: loginsoft.com/cloud-native-sโฆ
#HardenedContainerImages #ContainerSecurity #CloudNativeSecurity #DevSecOps #Kubernetes #SoftwareSupplyChainSecurity
October opened with a relentless wave of exploitation, as attackers hit helpdesk platforms, email gateways, edge appliances and even office printers. Zero-days, AI-driven intrusions and hours-old disclosures left defenders almost no time to react.
๐๐ฒ๐ ๐ต๐ถ๐ด๐ต๐น๐ถ๐ด๐ต๐๐ ๐ผ๐ณ ๐๐ต๐ฒ ๐๐ฒ๐ฒ๐ธ:
๐นCISA added four flaws to its KEV catalog, including two Zammad zero-days that an autonomous AI agent chained to root in seconds, plus zero-days in Citrix NetScaler and Fortinet FortiMail. Attackers also moved fast on Atlassian Data Center, WordPress plugins, MediaWiki and Sharp printers, often within hours of disclosure.
๐นClingSTUN built a stealthy IoT proxy network that hid inside public STUN traffic
๐นWHIPSHOT and SLAPSHOT surfaced in Citrix NetScaler zero-day attacks
๐นUAC-0277 turned 100+ compromised sites into ClickFix traps delivering LUNEXSTEALER
The gap between disclosure and exploitation keeps shrinking. Patch fast, cut exposure, and hunt for compromise.
Read the full breakdown in this week's LOVI report: loginsoft.com/reports/weeklyโฆ
#Cybersecurity #Loginsoft #Vulnerability #Intelligence #LOVI #CISAKEV #Zammad #MediaWiki #WordPress #ClingSTUN #WHIPSHOT #SLAPSHOT #UAC0277 #ClickFix #LUNEXSTEALER
๐ฆ๐ฒ๐ฝ๐๐ฒ๐บ๐ฏ๐ฒ๐ฟ ๐ฎ๐ฌ๐ฎ๐ฒ ๐ฐ๐ผ๐บ๐ฝ๐ฟ๐ฒ๐๐๐ฒ๐ฑ ๐๐ต๐ฒ ๐ฒ๐
๐ฝ๐น๐ผ๐ถ๐๐ฎ๐๐ถ๐ผ๐ป ๐๐ถ๐ป๐ฑ๐ผ๐ ๐ณ๐๐ฟ๐๐ต๐ฒ๐ฟ
๐นCISA's KEV catalog grew by 43 entries, the highest monthly count of 2026. Cisco, Citrix, MikroTik, Microsoft, Google, and JFrog accounted for the bulk of additions, confirming in-the-wild exploitation across perimeter appliances, OS components, browsers, and software supply chain infrastructure.
๐นActive exploitation persisted throughout the month, as threat actors hit perimeter devices, AI platforms, WordPress plugins, and webmail servers through authentication bypass, code injection, and file upload flaws.
๐นRansomware telemetry showed a leaderboard shift. TheGentlemen led ransomware activity with 102 victims, followed by Qilin (74) and KRYBIT (34).
The organizations that came through September safely weren't the ones that patched everything. They were the ones that patched the right things first.
Get the full breakdown in this month's LOVI report: loginsoft.com/reports/monthlโฆ
#Cybersecurity #Loginsoft #Vulnerability #Intelligence #LOVI #September2026 #ActivelyExploited #CISAKEV #Cisco #Citrix #MikroTik #Microsoft #Google #JFrog #Langflow #LiteLLM #Roundcube #WordPress #Ransomware #TheGentlemen #Qilin #KRYBIT #Safepay #IncRansom
The final week of September 2026 left no room for delayed patching. It closed with fresh evidence that both opportunistic exploitation and state-sponsored campaigns continued to accelerate, as critical zero-day vulnerabilities in network perimeter infrastructure drew emergency responses from vendors, national CERTs, and law enforcement.
๐ ๐ณ๐ฒ๐ ๐ต๐ถ๐ด๐ต๐น๐ถ๐ด๐ต๐๐ ๐ณ๐ฟ๐ผ๐บ ๐๐ต๐ฒ ๐๐ฒ๐ฒ๐ธ:
๐นCISA added six vulnerabilities to its KEV catalog, headlined by two Citrix NetScaler zero-days that drew emergency pre-disclosure warnings from the Dutch NCSC-NL, alongside flaws in Microsoft SharePoint, MikroTik RouterOS, Apple CoreGraphics, and WordPress Core
๐นSharePoint exploitation escalated to webshell deployment within hours of technical disclosure, while WordPress Core drew 548,000+ blocked attacks within 24 hours of going public
๐นVolexity identified UTA0565 as the third Chinese APT group to weaponize the same shared Chrome and Windows zero-day chain reported last week, delivering the previously undocumented CLEANGULP backdoor through typosquatted media and NGO websites
The through-line is not just speed but coordination. Vendors, CERTs, and law enforcement moved to pre-notification protocols before patches existed, while state-sponsored actors demonstrated that shared exploit development turns one zero-day chain into three simultaneous campaigns.
Full breakdown in this week's LOVI report:loginsoft.com/reports/weeklyโฆ
#Cybersecurity #Loginsoft #Vulnerability #Intelligence #LOVI #Microsoft #WordPressCore #MikroTikRouter #Apple #UTA0565 #ThreatActor #CitrixNetScaler
๐ฌ๐ผ๐ ๐ฎ๐ฝ๐ฝ๐ฟ๐ผ๐๐ฒ๐ฑ ๐๐ต๐ฒ ๐ ๐๐ฃ ๐๐ผ๐ผ๐น. ๐๐๐ ๐ฐ๐ฎ๐ป ๐๐ผ๐ ๐๐ฟ๐๐๐ ๐ถ๐ ๐๐ผ๐ฑ๐ฎ๐?
As AI agents connect to GitHub, cloud environments, databases, Slack, CI/CD, and other enterprise systems through ๐ ๐ผ๐ฑ๐ฒ๐น ๐๐ผ๐ป๐๐ฒ๐
๐ ๐ฃ๐ฟ๐ผ๐๐ผ๐ฐ๐ผ๐น (๐ ๐๐ฃ), a new supply-chain risk is emerging: ๐ ๐๐ฃ ๐ฅ๐๐ด ๐ฃ๐๐น๐น ๐๐๐๐ฎ๐ฐ๐ธ๐.
A tool can be legitimate when approved, then change its behavior later, while the AI agent continues to trust it.
๐ง๐ต๐ถ๐ ๐ฐ๐ฎ๐ป ๐น๐ฒ๐ฎ๐ฑ ๐๐ผ:
๐นData exfiltration
๐นCredential exposure
๐นUnauthorized actions
๐นWorkflow manipulation
For CIOs, CISOs, and security leaders, the question is no longer just:
โ๐๐ถ๐ฑ ๐๐ฒ ๐ฎ๐ฝ๐ฝ๐ฟ๐ผ๐๐ฒ ๐๐ต๐ถ๐ ๐๐ผ๐ผ๐น?โ
โ๐๐ ๐๐ต๐ฒ ๐๐ผ๐ผ๐น ๐๐ฒ ๐๐๐ฒ ๐๐ผ๐ฑ๐ฎ๐ ๐๐๐ถ๐น๐น ๐๐ต๐ฒ ๐๐ผ๐ผ๐น ๐๐ฒ ๐ฎ๐ฝ๐ฝ๐ฟ๐ผ๐๐ฒ๐ฑ?โ
Organizations should consider provenance and integrity verification, version controls, continuous change detection, least-privilege access, runtime monitoring, and re-approval workflows.
๐๐ ๐๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ ๐ถ๐๐ป'๐ ๐ผ๐ป๐น๐ ๐ฎ๐ฏ๐ผ๐๐ ๐๐ฒ๐ฐ๐๐ฟ๐ถ๐ป๐ด ๐๐ต๐ฒ ๐บ๐ผ๐ฑ๐ฒ๐น. ๐๐โ๐ ๐ฎ๐ฏ๐ผ๐๐ ๐ฐ๐ผ๐ป๐๐ถ๐ป๐๐ผ๐๐๐น๐ ๐๐ฒ๐ฟ๐ถ๐ณ๐๐ถ๐ป๐ด ๐ฒ๐๐ฒ๐ฟ๐๐๐ต๐ถ๐ป๐ด ๐๐ต๐ฒ ๐บ๐ผ๐ฑ๐ฒ๐น ๐๐ฟ๐๐๐๐.
Read the full analysis: loginsoft.com/post/mcp-rug-pโฆ
#AISecurity #MCP #AgenticAI #AIAgents #Cybersecurity #CISO #CIO #CTO #AISupplyChain #SupplyChainSecurity #LLMSecurity #AIThreats #EnterpriseSecurity #CyberRisk
๐๐ฌ๐๐๐ฅ๐ฆ๐๐๐จ๐ฅ๐๐ง๐ฌ ๐๐ซ๐๐๐๐๐๐ก๐๐ ๐๐ก ๐๐๐ง๐๐ข๐ก
Weโre proud to celebrate ๐ฅ๐ฎ๐ต๐๐น from ๐๐ผ๐ด๐ถ๐ป๐๐ผ๐ณ๐ for completing all 5 challenges at the ๐๐ ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ ๐ฉ๐ถ๐น๐น๐ฎ๐ด๐ฒ and winning ๐ข๐ฝ๐ฒ๐ฟ๐ฎ๐๐ถ๐ผ๐ป ๐๐ฒ๐ฎ๐ฑ๐ฏ๐ผ๐น๐ at ๐ ๐ถ๐ฐ๐ฟ๐ผ๐๐ผ๐ณ๐ ๐๐น๐๐ฒ๐๐ฎ๐ ๐๐๐ถ๐ฎ ๐ฎ๐ฌ๐ฎ๐ฒ.
A major highlight of the event was ๐ข๐ฝ๐ฒ๐ฟ๐ฎ๐๐ถ๐ผ๐ป ๐๐ฒ๐ฎ๐ฑ๐ฏ๐ผ๐น๐, an AI security challenge focused on attacking and securing AI models. Rahul achieved ๐๐ถ๐ฟ๐๐ ๐๐น๐ผ๐ผ๐ฑ ๐ฉธ, successfully completed the challenge, and was recognized as a winner, receiving the trophy.
This remarkable accomplishment reflects Rahulโs technical expertise, problem-solving mindset, and passion for advancing cybersecurity and AI security.
Congratulations, Rahul!
#Loginsoft #Cybersecurity #AISecurity #BlueHatAsia2026 #OperationDeadbolt #SecurityResearch
This week, attackers probed the seams of enterprise infrastructure and found plenty to work with, turning freshly disclosed flaws in kernels, VPN gateways, and web platforms into active campaigns before many teams could react.
๐ ๐ณ๐ฒ๐ ๐ต๐ถ๐ด๐ต๐น๐ถ๐ด๐ต๐๐ ๐ณ๐ฟ๐ผ๐บ ๐๐ต๐ฒ ๐๐ฒ๐ฒ๐ธ:
๐นCISA added eight vulnerabilities to its KEV catalog, including three Linux kernel flaws, two Check Point product flaws, and one each in F5 BIG-IP APM, Arista VeloCloud Orchestrator, and Zyxel GS1900 switches
๐นActive exploitation surfaced across Roundcube Webmail, WordPress Core, and the Orkes Conductor workflow platform, with some flaws weaponized within hours of public disclosure
๐นVolexity uncovered a third Chinese APT, UTA0565, chaining the same Chrome and Windows zero-days as UTA0560 and JungleBamboo, this time through typosquatted fake websites to deploy the previously undocumented CLEANGULP backdoor
The through-line is speed. The gap between disclosure and exploitation keeps shrinking, and shared exploit kits are letting separate actors strike the same surfaces in parallel.
Full breakdown in this week's report: loginsoft.com/reports/weeklyโฆ
#Cybersecurity #ThreatIntelligence #Loginsoft #Vulnerability #LOVI #CISAKEV #WordPress #CheckPoint #Zyxel #F5 #ZeroDay #CLEANGULP #UTA0565
๐ณ๐ฌ% ๐ผ๐ณ ๐๐น๐ผ๐๐ฑ ๐๐ฟ๐ฒ๐ฎ๐ฐ๐ต๐ฒ๐ ๐ฆ๐๐ฎ๐ฟ๐ ๐ช๐ถ๐๐ต ๐ฎ ๐ ๐ถ๐๐ฐ๐ผ๐ป๐ณ๐ถ๐ด๐๐ฟ๐ฎ๐๐ถ๐ผ๐ป
Cloud security isnโt just a patching problem anymore.
Misconfigured IAM, exposed storage, overly permissive access, and insecure cloud controls can create an attack path long before a CVE becomes the issue.
Thatโs why ๐ฐ๐น๐ผ๐๐ฑ ๐๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ ๐ถ๐ ๐ฎ๐ป ๐ฒ๐ป๐ด๐ถ๐ป๐ฒ๐ฒ๐ฟ๐ถ๐ป๐ด ๐ฝ๐ฟ๐ผ๐ฏ๐น๐ฒ๐บ.
Security teams need to continuously:
๐นIdentify misconfigurations
๐นPrioritize the risks that matter
๐นStrengthen cloud posture
๐นAutomate security controls
๐นValidate that fixes actually work
The shift is simple:
๐๐ผ๐ปโ๐ ๐ท๐๐๐ ๐ฝ๐ฎ๐๐ฐ๐ต ๐๐๐น๐ป๐ฒ๐ฟ๐ฎ๐ฏ๐ถ๐น๐ถ๐๐ถ๐ฒ๐. ๐๐ป๐ด๐ถ๐ป๐ฒ๐ฒ๐ฟ ๐ฎ ๐๐ฒ๐ฐ๐๐ฟ๐ฒ ๐ฐ๐น๐ผ๐๐ฑ ๐ฒ๐ป๐๐ถ๐ฟ๐ผ๐ป๐บ๐ฒ๐ป๐.
Explore Loginsoftโs ๐๐น๐ผ๐๐ฑ ๐๐ป๐ณ๐ฟ๐ฎ๐๐๐ฟ๐๐ฐ๐๐๐ฟ๐ฒ ๐ฆ๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ ๐๐ฒ๐ฟ๐๐ถ๐ฐ๐ฒ๐: loginsoft.com/cloud-infrastrโฆ
#CloudSecurity #CloudMisconfiguration #CSPM #CloudBreach #CloudPosture #Cybersecurity #CloudInfrastructure
This week the threat landscape delivered zero-days under active attack, chained exploits, and relentless pressure on enterprise infrastructure simultaneously.
๐ ๐ณ๐ฒ๐ ๐ต๐ถ๐ด๐ต๐น๐ถ๐ด๐ต๐๐ ๐ณ๐ฟ๐ผ๐บ ๐๐ต๐ฒ ๐๐ฒ๐ฒ๐ธ:
๐นCISA added 10 vulnerabilities to its KEV catalog, including dual flaws in MikroTik RouterOS and JFrog Artifactory exploited in coordinated campaigns
๐นActive exploitation confirmed across WSO2 API Manager, The Events Calendar WordPress plugin, and Issabel Framework within 24-hour windows
๐นNation-state and hacktivist clusters converged on identical vulnerability surfaces through shared exploit infrastructure, transforming individual flaws into synchronized multi-vector attacks
๐นNightEagle and Hacking Cat targeted Russian enterprises with GhostContainer backdoors and polymorphic Monkey Ransomware variants
๐นUTA0560 and JungleBamboo synchronized Chrome V8 exploitation chains targeting international NGOs with credential-stealing extensions
๐นRed Heron rapidly weaponized Gitea vulnerabilities across seven countries, while Mirai_ptea and Mirai_aurora infiltrated legacy IoT infrastructure establishing encrypted botnet networks
Full breakdown in this week's LOVI intelligence report: loginsoft.com/reports/weeklyโฆ
#Cybersecurity #Loginsoft #Vulnerability #Intelligence #LOVI #WSO2 #WordPress #Issabel #MikroTik #JFrog #AISecurity #ZeroDayExploits #ThreatIntelligence
70% of cloud breaches start with a misconfiguration.
Not a CVE. Not a zero-day. A misconfiguration.
In cloud, configuration is code. And configuration drift is your attack surface.
๐น Over permissioned IAM roles sitting idle
๐น Storage buckets exposed to public read
๐น Security groups with 0.0.0.0/0 left open
๐น CloudTrail logging disabled in production
CSPM tools surface these. The real fix is treating cloud posture as a control engineering discipline: drift detection in CI/CD, misconfiguration as code debt.
At Loginsoft, we help teams build proactive cloud posture programs so misconfigurations never reach production.
Is your cloud security strategy still reactive? Drop a comment below.
#CloudSecurity #CSPM #CloudMisconfiguration #CloudPosture #CyberSecurity #DevSecOps
When your firewall becomes the front door and your browser becomes the attack surface, it's not a slow week in cybersecurity. This one wasn't.
๐ ๐ณ๐ฒ๐ ๐ต๐ถ๐ด๐ต๐น๐ถ๐ด๐ต๐๐ ๐ณ๐ฟ๐ผ๐บ ๐๐ต๐ฒ ๐๐ฒ๐ฒ๐ธ:
๐นNine actively exploited vulnerabilities hit the CISA KEV catalog, spanning Microsoft, Google, Cisco, Fortinet, Citrix, N-Able, and Adobe, with four confirmed as zero-days
๐นFour state-aligned espionage clusters adopted the same exploit kit, BlueMoon, within days of each other, weaponizing Chrome patch-gap zero-days before stable fixes reached users
๐นPivotC2, an AI-assisted RAT built exclusively for FortiGate appliances, turned compromised firewalls into autonomous credential-harvesting machines, with 178 infections confirmed out of 30,000+ targeted
๐นThree separate threat clusters converged on Cisco FMC vulnerabilities, deploying Cyclops Blink malware and Qilin ransomware through the same attack surface
๐นMikroTik routers fell to "MikroTrick," a chained SSH exploit discovered by Poland's CERT with the help of GPT-5.5-cyber and GPT-5.6-sol
๐นAI fingerprints showed up in both offensive tooling and defensive research, the line between who uses AI and how is getting thinner every week
Full breakdown in this week's LOVI report: loginsoft.com/reports/weeklyโฆ
#Cybersecurity #Loginsoft #LOVI #Vulnerabilty #Intelligence #Microsoft #GoogleChrome #CISAKEV #MikroTrick #Fortinet #Cisco #Citrix
Your AI model passed the benchmark.
๐๐๐ ๐ฐ๐ฎ๐ป ๐๐ผ๐ ๐๐ฟ๐๐๐ ๐ถ๐ ๐ถ๐ป ๐ฝ๐ฟ๐ผ๐ฑ๐๐ฐ๐๐ถ๐ผ๐ป?
AI can still hallucinate, fail on edge cases, generate false positives, or behave unpredictably under adversarial inputs.
Thatโs why ๐๐ ๐ ๐ผ๐ฑ๐ฒ๐น ๐ฉ๐ฎ๐น๐ถ๐ฑ๐ฎ๐๐ถ๐ผ๐ป matters.
At Loginsoft, we test AI models against real-world scenarios using:
๐นDomain-specific test cases
๐นHuman expert validation
๐นAdversarial testing
๐นFailure & hallucination analysis
๐นContinuous validation
๐จ๐ฝ ๐๐ผ ๐ต๐ด% ๐ฎ๐ฐ๐ฐ๐๐ฟ๐ฎ๐ฐ๐.
๐จ๐ฝ ๐๐ผ ๐ณ๐ฌ% ๐ต๐ฎ๐น๐น๐๐ฐ๐ถ๐ป๐ฎ๐๐ถ๐ผ๐ป ๐ฟ๐ฒ๐ฑ๐๐ฐ๐๐ถ๐ผ๐ป.
๐ฏร ๐ณ๐ฎ๐๐๐ฒ๐ฟ ๐ถ๐บ๐ฝ๐ฟ๐ผ๐๐ฒ๐บ๐ฒ๐ป๐ ๐ฐ๐๐ฐ๐น๐ฒ๐.
Donโt just deploy AI.
๐ฉ๐ฎ๐น๐ถ๐ฑ๐ฎ๐๐ฒ ๐ถ๐. ๐ง๐ฟ๐๐๐ ๐ถ๐. ๐ง๐ต๐ฒ๐ป ๐๐ฐ๐ฎ๐น๐ฒ ๐ถ๐.
Learn more: loginsoft.com/artificial-intโฆ
#AI #ArtificialIntelligence #AIModelValidation #LLM #GenerativeAI #AIGovernance #AISecurity #ResponsibleAI #Cybersecurity #EnterpriseAI
As August rolled into September, the threat landscape offered no quiet handover: the new month opened with zero-days under active attack, chained exploits, and a fresh wave of pressure on both enterprise and AI infrastructure.
๐ ๐ณ๐ฒ๐ ๐ต๐ถ๐ด๐ต๐น๐ถ๐ด๐ต๐๐ ๐ณ๐ฟ๐ผ๐บ ๐๐ต๐ฒ ๐๐ฒ๐ฒ๐ธ:
๐นCISA added 12 vulnerabilities to its KEV catalog, including two SonicWall SMA1000 flaws and two PaperCut NG/MF flaws exploited as chained zero-days
๐นActive exploitation beyond KEV struck Langflow, the Elementor Pro WordPress plugin, and Ruby on Rails Active Storage, some within days of going public
๐นThe AI stack took direct hits, with LiteLLM, Langflow, and Kestra targeted for the API keys, model access, and cloud credentials they quietly hold
๐นToxNetV2 surfaced as an AI-assisted Linux botnet that plugged a language model into its controller, spreading through neglected IoT and networking gear while still leaning on a human to approve its moves
Full breakdown in this week's LOVI report: loginsoft.com/reports/weeklyโฆ
#Cybersecurity #Loginsoft #Vulnerability #Intelligence #LOVI #SonicWall #PaperCut #JFrog #LiteLLM #Langflow #RubyonRails #ToxNetV2 #AISecurity #ZeroDay
๐๐๐ด๐๐๐ ๐ฎ๐ฌ๐ฎ๐ฒ ๐ฑ๐ถ๐ฑ๐ป'๐ ๐ฒ๐ฎ๐๐ฒ ๐๐ฝ ๐ณ๐ผ๐ฟ ๐ฎ ๐๐ถ๐ป๐ด๐น๐ฒ ๐ฑ๐ฎ๐.
By the time the month closed, CISA had added 32 vulnerabilities to its KEV catalog, one of the heaviest runs of the year, and every entry told the same story: attackers were already inside real systems before most defenders knew there was an unpatched vulnerability.
Meanwhile, the human threat sharpened. The China-linked QTFY group breached US critical infrastructure. The Chinese-speaking UAT-10147 crew folded AI directly into its attacks and deployed a cross-platform backdoor. And the Mirai-bred Evooo1Bot botnet quietly turned everyday routers and cameras into weapons.
Then came the extortion. Qilin dominated the month with 162 organizations hit, followed by TheGentlemen at 111 and Cl0p at 85, a relentless pace that showed just how industrialized ransomware had become.
The takeaway was hard to miss: the gap between disclosure and exploitation had all but disappeared. In August, speed wasn't an advantage. It was survival.
Full breakdown in this month's LOVI report: loginsoft.com/reports/monthlโฆ
#Cybersecurity #Loginsoft #Vulnerability #Intelligence #LOVI #August2026 #ActivelyExploited #CISAKEV #Microsoft #TrueConf #PaperCut #Apple #Oracle #RedHat #Citrix #UAT10147 #QTFYgroup #Ransomware #Qilin #TheGentlemen #Cl0p
๐ณ๐ฌ% ๐ผ๐ณ ๐ฐ๐น๐ผ๐๐ฑ ๐ฏ๐ฟ๐ฒ๐ฎ๐ฐ๐ต๐ฒ๐ ๐๐๐ฎ๐ฟ๐ ๐๐ถ๐๐ต ๐ฎ ๐บ๐ถ๐๐ฐ๐ผ๐ป๐ณ๐ถ๐ด๐๐ฟ๐ฎ๐๐ถ๐ผ๐ป.
Not a CVE. Not a zero-day. A misconfiguration.
In cloud, configuration is code. And configuration drift is your attack surface.
๐น Over permissioned IAM roles sitting idle
๐น Storage buckets exposed to public read
๐น Security groups with 0.0.0.0/0 left open
๐น CloudTrail logging disabled in production
CSPM tools surface these. The real fix is treating cloud posture as a control engineering discipline: drift detection in CI/CD, misconfiguration as code debt.
At Loginsoft, we help teams build proactive cloud posture programs so misconfigurations never reach production.
Is your cloud security strategy still reactive? Drop a comment below.
#CloudSecurity #CSPM #CloudMisconfiguration #CloudPosture #CyberSecurity #DevSecOps
This week the pattern was pressure from both ends: a heavy run of catalog additions met a wave of same-week exploitation, while two China-linked campaigns showed how state-aligned operators and AI-assisted tooling keep bending toward internet-facing infrastructure.
๐ ๐ณ๐ฒ๐ ๐ต๐ถ๐ด๐ต๐น๐ถ๐ด๐ต๐๐ ๐ณ๐ฟ๐ผ๐บ ๐๐ต๐ฒ ๐๐ฒ๐ฒ๐ธ:
๐นCISA added 11 vulnerabilities to its KEV catalog
๐นActive exploitation beyond KEV across GitLab, the Pods and TranslatePress WordPress plugins, miniOrange SAML SSO, TYPO3, and SPIP
๐นQTFY, a China-linked group tied to a Nanjing front company, breaching US critical infrastructure with its QScan, QTRouter, and QTBotnet platforms
๐นUAT-10147, a Chinese-speaking group, deploying the cross-platform SPECTRE implant with a Linux rootkit and AI-assisted development
Full breakdown in this week's LOVI report: loginsoft.com/reports/weeklyโฆ
#Cybersecurity #Loginsoft #Vulnerability #Intelligence #LOVI #Microsoft #RedHat #TrueConf #Linux #UAT10147 #QTFY #Gitea #GitLab
This week the pattern was speed: disclosure and exploitation collapsed into the same window, and attackers outpaced patch cycles across enterprise, open-source, and AI infrastructure alike, from federal catalog additions to a Mirai-bred botnet and an AI-orchestrated intrusion campaign.
๐ ๐ณ๐ฒ๐ ๐ต๐ถ๐ด๐ต๐น๐ถ๐ด๐ต๐๐ ๐ณ๐ฟ๐ผ๐บ ๐๐ต๐ฒ ๐๐ฒ๐ฒ๐ธ:
๐น6 new CISA KEV entries: MLflow, Apple macOS, two from Microsoft, Broadcom VMware, and Ray Project spanning AI tooling, operating systems, virtualization, and distributed compute
๐นActive exploitation beyond KEV across Citrix NetScaler, the User Profile Builder WordPress plugin, SAP Commerce Cloud, New API, and Zimbra, several within days, some within hours, of disclosure
๐นEvooo1Bot, a Mirai-derived Linux botnet, turning internet-facing edge devices into stealthy proxy relays and DDoS nodes
๐นknaithe (KnYuan), a Chinese-speaking actor, pairing autonomous AI-driven attacks with hands-on manual exploitation
The disclosure-to-exploitation window has effectively closed.
Full breakdown in this week's LOVI report:loginsoft.com/reports/weeklyโฆ
#Cybersecurity #LOVI #ZeroDay #CISAKEV #Ransomware #MLflow #Apple #Microsoft #VMware #Citrix #SAP #Zimbra #Mirai #AIsecurity #ThreatIntel
