Sliver Toolkit Scripts Credential Theft and Persistent Domain Access
A recovered Sliver kit shows how one operator scripted Domain Admin access, disabled defenses, stole credentials, and hid rotating command servers behind Ethereum.
Reader edition
The Feed
Two Windows Zero-Days Give Local Attackers SYSTEM Privileges
The flaws require a local foothold, affect different Windows release families, and leave defenders with fixed-build checks but no CVE-specific compromise indicators.
Coder Registry Hack Sent Credential-Stealing Code to Developers
Attackers made Coder's trusted registry serve malicious Terraform modules. Operators have a 14-hour exposure window, concrete indicators, and urgent credential work.
Cloud Intruders Automate Mass Credential Harvesting in Under Six Hours
Google observed attackers move from cloud compromise to agent-enabled mass credential harvesting in under six hours, shrinking the time defenders have to respond.
JSCeal Replays Browser Sessions to Steal Fresh Google Tokens
Recovered JSCeal code replays stolen cookies and passwords through a headless browser to obtain fresh Google OAuth tokens and exposes concrete Windows hunt artifacts.
Public Telerik Exploit Lets Attackers Run Code on ASP.NET Servers
A public Telerik UI exploit chains two cryptographic oracles to unsafe type loading. Upgrade ASP.NET AJAX to 2026.2.708 and check IIS for post-exploit activity.
N-able Patches N-central Flaw That Lets Attackers Run Code Before Login
Every on-premises build before 2026.3.1.14 needs Hotfix 4. N-able's records conflict on exploitation, so MSPs should patch and review RMM activity.
Compromised npm Code Generator Steals Developer and Cloud Credentials
Ten malicious OpenAPI React Query Codegen releases ran on install and carried credential-stealing code with valid provenance. Teams must scope lockfiles, rebuild hosts and rotate credentials.
Claude Ports WAGO PLC Exploit and Bricks Test Controller
Forescout ported a pre-auth PLC exploit with Claude, then bricked the device during an implant attempt. Restrict FTP and monitor crashes and outbound traffic.
ZBT Router Firmware Gives Remote Attackers Root Access
Two factory firmware implants expose white-label ZBT routers through an open WAN service and an unauthenticated phone-home channel.
LiteLLM Flaw Lets Read-Only Accounts Steal AI Gateway Secrets
Zenity saw file-read probes matching CVE-2026-35029. LiteLLM advises upgrading to 1.83.0 or later; defenders should hunt configuration changes and rotate exposed secrets.
MikroTik Patches RouterOS and Adds Compromise Check
CERT Polska confirms attacks through internet-exposed SSH. Install a fixed build, restrict management access, and investigate the published log and account indicators.
Magento Zero-Day Lets Attackers Backdoor Fully Patched Online Stores
StyleSmuggler turns poisoned Magento logs into server-side code execution, then hides a persistent implant outside the shop's webroot. Adobe has not issued a fix.