Say it loud, say it proud, say it on your laptop lid. TIIMA. And a lil IFIN logo as a bonus!

The flood of new CVEs can make it hard to know what matters. But there are tools to help find our way.

The flood of new CVEs can make it hard to know what matters. But there are tools to help find our way.

Last Updated: 2026-09-29T14:53:55Z (UTC) What’s Happening Citrix has disclosed 8 critical CVEs. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 There’s also an associated blog post. Affected Versions Citrix NetScaler ADC and Citrix NetScaler Gateway 14.1 BEFORE 14.1-73.37 Citrix NetScaler ADC and Citrix NetScaler Gateway 13.1 BEFORE 13.1-64.23 Citrix NetScaler ADC FIPS BEFORE 14.1-73.37 FIPS Citrix NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.279 Indicato...

Last Updated: 2026-09-27T15:49:52Z (UTC) What’s Happening Citrix has disclosed 8 critical CVEs. https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX697096 Vulnerability Severity (CVSS 4) Preconditions CVE-2026-88771 9.5 None CVE-2026-88772 9.5 DTLS config enabled (enabled by default on VPN) CVE-2026-88773 9.3 HTTP Configuration enabled CVE-2026-88774 7.0 Any policy with HTTP URL-based expression CVE-2026-88775 8.8 ADC or Gateway configured as Gateway/A...

Last Updated: 2026-09-26T23:22:28Z (UTC) What’s Happening On 2026-09-26T07:00:00Z (UTC), a Reddit posts in the Citrix community indicated that the presence of two 0-day vulnerabilities in Citrix Netscaler devices. The poster was apparently advised to shut down external devices. Research firm WatchTowr corroborated the report, as did researcher Kevin Beaumont. Both Beaumont and WatchTowr doubled down on the claim later in the day. WatchTowr, while unable to confirm sourcing, stated t...

Last Updated: 2026-09-26T23:22:28Z (UTC) What’s Happening On 2026-09-26T07:00:00Z (UTC), a Reddit posts in the Citrix community indicated that the presence of two 0-day vulnerabilities in Citrix Netscaler devices. The poster was apparently advised to shut down external devices. Research firm WatchTowr corroborated the report, as did researcher Kevin Beaumont. Both Beaumont and WatchTowr doubled down on the claim later in the day. WatchTowr, while unable to confirm sourcing, stated t...

A not-for-profit organization dedicated to the teaching of best practices in cyber threat intelligence, and the mutual sharing of timely, actionable, and relevant intelligence among the community.

Last Updated: 2026-09-23T15:47:14Z (UTC) CVE: TBA CVSSv3: tentative 9.8 (per vuln publisher, not ratified) What’s Happening Research firm elttam has disclosed a vulnerability in the Shrubbery fork of the tac_plus TACACS+ authentication library used in multiple networking devices. The vulnerability, if fully exploited, can lead to remote code execution on target devices. Crashing systems is also a possibility. Secret disclosure is a natural result of this vulnerability. The post is long,...

Last Updated: 2026-09-22T22:18:11Z (UTC) Arista published a security advisory today regarding its VeloCloud Orchestrator. The perfect-10 CVSS vulnerability: …may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Yes, it “may” indeed. It’s now confirmed exploited and on CISA’s KEVs as of today. Ther...

Last Updated: 2026-09-22T20:36:25Z (UTC) What’s Happening A F5 advisory published 2026-09-22 details CVE-2026-94127 (CVSSv3 9.8). When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). It is unknown how common this configuration is as of this writing. Affected Products/Versions The affected product is BIG-IP APM (Access Policy Manager), versions: 21.1.0, patched in Hotfix-BIGIP-21.1.0...

Last updated: 2026-09-22T19:41:29Z (UTC) CVSSv3: 9.8 What’s Happening In what’s-old-is-new-again news, two CVEs were released today for Checkpoint Security Gateway management toolsets, including a pre-auth remote code execution and a path traversal in the management web service. Here are Check Points internal support center details: Since I started writing this Check Point posted notification of exploitation on their blog. Actions Check the advisories above for affected versions and o...

The Independent Federated Intelligence Network

Last Updated: 2026-09-18T12:35:00Z (UTC) What’s Happening According to the Rust language security response working group, maintainers of rust-lang (the repo comprising the Rust language itself) and popular packages (crates) are being targeted by social engineering attacks intended to compromise the repository. Per the post: A video call is set up for something positive — maybe for a job, maybe for a project, maybe for a contract opportunity — and then that’s used as a vector to either g...

The Independent Federated Intelligence Network

Last Updated: 2026-09-16T14:53:57Z (UTC) What’s Happening TL;DR: `fileupdates.blob.core.windows[.]net is hosting “QuickFix,”, a new-ish installer file with PowerShell that installs its own Python interpreter, then activates a light C2 beacon for Python commands send via JSON. The detection opportunity is Python executing outside of expected directories. This was a tip from Fedi and turned into a really fun investigation. The tipper was surprised that Microsoft even allowed that blob storage...

Last Updated: 2026-09-16T14:53:57Z (UTC) What’s Happening TL;DR: `fileupdates.blob.core.windows[.]net is hosting “QuickFix,”, a new-ish installer file with PowerShell that installs its own Python interpreter, then activates a light C2 beacon for Python commands send via JSON. The detection opportunity is Python executing outside of expected directories. This was a tip from Fedi and turned into a really fun investigation. The tipper was surprised that Microsoft even allowed that blob storage...

Blackfile-suspected list (attached) up to 59. Medium-high confidence. Also attached CSV of 134 domains connected or adjacent to Blackfile/ShinyHunters from Sept 11-14, all worth blocking preemptively...

IFIN Lists is a project to build a well curated, community driven set of permanent block lists for all to use.

A curated collection of long-term block lists and hunting targets for all organizations, along with documentation and explanations.

IFIN Lists is a project to build a well curated, community driven set of permanent block lists for all to use.

Last Updated: 2026-09-12T15:06:12Z (UTC) What’s Happening While reviewing some recent ClickFix/Etherhiding domains on ThreatFox, I noticed a bizarre sample with weirdo strings in it. Turns out it was part of the Lorem Ipsum malware family, which uses nonsense strings as a sort of encoding mechanism for its C2 commands. This is a known technique. Also known is the use of letsdiskuss[.]com, an Indian social media site, to host C2 data. For example, this user profile. The malware’s ...

Hey folks, Been tracking the Blackfile passkey/mfa campaign for weeks or months now. Saw a recent listing from Unit42 that was missing a few domains I have, and had a few domains I missed. blackfile...

Thank you The vast majority of the research is from Microsoft’s own documentation: On-Prem Entra Password Protection for AD DS Eliminate bad passwords using Entra Password Protection It should be noted that at the very bottom of the second article, MS outlines this exact scenario: Let’s look a slightly different example to show how more complexity in a password can build the required number of points to be accepted. In the following example scenario, a user changes their password to “Conto...

The Independent Federated Intelligence Network

Ouch. Last Updated: 2026-08-27T19:46:03Z (UTC) What’s Happening PaperCut has released an urgent security advisory for PaperCut NG and PaperCut MF Security Advisory Actions Immediately disconnect PaperCut NG and PaperCut MF services that are accessible from the internet, ensuring they can only be accessed by trusted IP addresses even if no suspicious activity has been observed. Apply the emergency patch that has been released for customers are unable to take other mitigating actions. URGE...

Last Updated: 2026-08-26T17:05:28Z (UTC) What’s Happening A currently unconfirmed vulnerability in Apache Log4j could allow remote code execution (RCE) by bypassing the allowlist enforced by FilteredObjectInputStream (FOIS) during Java deserialization. Exploitation requires an uncommon configuration in which an application or logging service accepts serialized Log4j LogEvent objects through an FOIS-based receiver, as well as a suitable deserialization gadget on the target classpath. Unlik...

As we begin this journey, we have a clear plan to achieve our goals. They all need support from people like you.

Last Updated: 2026-08-24T19:42:12Z (UTC) What’s Happening Microsoft expands on reporting by RST Cloud on macOS infostealer infrastructure and TTPs, in which they connected over 30 additional domains to the activity. Rather than hunting on the large amount of quickly rotating domains used, Microsoft relates repeated execution patterns including request paths, headers, curl arguments, and upload parameters, tracking the malware’s entire attack chain. https://www.microsoft.com/en-us/securit...

Last Updated: 2026-08-24T14:49:19Z (UTC) What’s Happening The latest research from Marcus Hutchins (malwaretech) at Expel is a humdinger of a read, with some really creative behaviors. First, we have Teams phishing as a delivery mechanism. I don’t know how many folks have reviewed their external access Teams policies, but the more you can lock them down, the better. Then you have obfuscated PowerShell (a classic), that creates Script Blocks via [System.Management.Automation.ScriptBlock]:...

This is starting to become a series. I was about to write up something about a specific recent Netscaler vulnerability, but as I was gathering information, I realized that there’s just been a deluge of exploited and not-yet-exploited critical vulnerabilities in Citrix Netscalers. Let’s get into it. CVE-2026-8452 CVSSv3: 9.8 Exploited: Unconfirmed, but probably soon This is a memory corruption bug in the ADC and Gateway SAML handler. Now this advisory is from June, but has seen recent re...

Last Updated: 2026-08-20T16:23:19Z (UTC) What’s Happening This morning (01:55:34 UTC, 2026-08-20), an attacker impersonating (dtolney) the developer account (dtolnay) for proc-macro2 published a typosquat package named proc-macro1. This malicious package was a clone of the original with a malicious build script later added. Simultaneously, the attacker published an update to arrayref with the compromised author account (droundy), referencing the typosquat proc-macro1package. When building,...

Putting this here in Cyber News because there is nothing actionable. It’s just interesting. Yesterday, both Github and Bluesky experienced several hours of outage yesterday. Both were due to sustained DDoS attacks. Iranian-backed “313 Team,” aka the “Islamic Cyber Resistance in Iraq” claimed both attacks on their Telegram channel. Worth noting that in the past, 313 used Beamed, Cloudflare-protected booter for their operations. Since June, they have pivoted to using booters protecte...

Last Updated: Friday, August 14, 2026 5:45 PM (UTC) CVSSv3: 9.8 What’s Happening There is a critical Auth Bypass vulnerability in Broadcom’s VMware vCenter, CVE-2026-59309. Published in Broadcom’s July 29th, 2026 security advisory, the security researchers who discovered the vulnerability published a walkthrough for it on the same day. There is a patch available for the vulnerability. There is no other workaround. It has been reported as EITW by independant sources. The vulnerability bypas...

IFIN has achieved 501(c)(3) status. What this means for us, and for you.