NCU-ISAO (@NcuIsao) header
NCU-ISAO (@NcuIsao) profile picture

NCU-ISAO

@NcuIsao

We help Credit Unions reduce their security and fraud risk through information sharing and collaboration.

 Highlands Ranch, CO
ncuisao.org
Joined January 2018
  • Tweets6.4K
  • Following571
  • Followers312
3.1KMedia
Photo by NCU-ISAO (@NcuIsao)Photo by NCU-ISAO (@NcuIsao)Photo by NCU-ISAO (@NcuIsao)Photo by NCU-ISAO (@NcuIsao)Photo by NCU-ISAO (@NcuIsao)Photo by NCU-ISAO (@NcuIsao)Photo by NCU-ISAO (@NcuIsao)Photo by NCU-ISAO (@NcuIsao)Photo by NCU-ISAO (@NcuIsao)Photo by NCU-ISAO (@NcuIsao)
Chrome extensions with 13.4 million installs caught hijacking searches bleepingcomputer.com/news/se… bleepingcomputer.com/news/se…
Chrome extensions with 13.4 million installs caught hijacking searches

Chrome extensions with 13.4 million installs caught hijacking searches

A massive search-hijacking campaign involving 319 Chrome extensions with a combined 13.4 million reported installations redirected users' searches through tracking servers to generate advertising...

bleepingcomputer.com
22
48
7
163
37,311
🚨 Google patches 52 Chrome security flaws, including 4 CRITICAL bugs. But here's the bigger story: → Claude AI discovered dozens of Chrome vulnerabilities. → Built a working, multi-stage exploit chain. → Escaped Chrome's browser sandbox to execute code. Details: chromereleases.googleblog.co…
Image from The Hacker News (@TheHackersNews)
38
119
23
417
46,522
Hackers now scanning systems for recently-patched Oracle flaw bleepingcomputer.com/news/se… bleepingcomputer.com/news/se…
Hackers now scanning systems for recently-patched Oracle flaw

Hackers now scanning systems for recently-patched Oracle flaw

Attackers have begun probing the Internet for systems unpatched against a recently disclosed critical Oracle E-Business Suite (EBS) vulnerability.

bleepingcomputer.com
6
24
1
97
10,135
🚨 UPDATE: Node2Shell (CVE-2026-111497) has moved from PoC to the wild. Scanning is live and the first exploit attempts are out. The RCE is now confirmed on STOCK x86-64 Node.js, not just arm64. Patch now → 22.23.4 / 24.22.1 / 26.12.1 Read ↓ thehackernews.com/2026/10/re…
Image from The Hacker News (@TheHackersNews)
26
176
17
855
93,867
Update: Microsoft has removed seven certificates associated with the affected eMudhra hierarchies from the Microsoft Edge trust list, following their removal from the Windows trust list. We’ve updated our guidance with additional information on these protections and what customers should consider when managing trust locally. Read the latest in our blog: msft.it/6014aLxJw

Microsoft’s response to compromised eMudhra certificate authority keys

microsoft.com
6
73
278
23,702
CISA has confirmed that hackers are actively exploiting a critical Brotli vulnerability (CVE-2026-111497), also known as Node2Shell, Broccoli2Shell, and HTTP2Shell. bleepingcomputer.com/news/se…
CISA warns of hackers now exploiting critical Node2Shell flaw

CISA warns of hackers now exploiting critical Node2Shell flaw

On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) confirmed that hackers have begun exploiting a critical Brotli vulnerability known as Node2Shell, Broccoli2Shell, and...

bleepingcomputer.com
13
54
5
213
19,460
NCU-ISAO retweeted
CISA Cyber (@CISACyber) profile picture
CISA Cyber
@CISACyberOct 26
We added #PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to our Known Exploited Vulnerabilities Catalog. Visit go.dhs.gov/Z3Q & apply mitigations to protect your org. #Cybersecurity #InfoSec #RCE
Image showing the CISA logo and text: "Known Exploited Vulnerabilities Catalog" with "Updated" labeled prominently. Website: cisa.gov.

ALT Image showing the CISA logo and text: "Known Exploited Vulnerabilities Catalog" with "Updated" labeled prominently. Website: cisa.gov.

17
82
11
211
21,540
NCU-ISAO retweeted
The NCUA (@TheNCUA) profile picture
The NCUA
@TheNCUAOct 27
NCUA released its staff draft budget for 2027–2028 today. The proposed budget is now available on the agency’s website and has been submitted for publication in the Federal Register. Public comments are encouraged. To learn more, please visit: go.ncua.gov/3Wz2Jq5

NCUA Releases 2027–2028 Proposed Budget, Sets November 17 Public Hearing

The National Credit Union Administration (NCUA) released its staff draft budget for 2027–2028 today.

ncua.gov
1
1
439
Microsoft releases Windows OOB updates to distrust eMudhra certificates bleepingcomputer.com/news/mi… bleepingcomputer.com/news/mi…
Microsoft releases Windows OOB updates to distrust eMudhra certificates

Microsoft releases Windows OOB updates to distrust eMudhra certificates

Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic...

bleepingcomputer.com
5
40
150
16,954
‼️WARNING - Hundreds of millions of devices run GoAhead's embedded web server. Now, 3 TLS vulnerabilities have been disclosed that can allow revoked client certificates to authenticate or expose encrypted sessions to decryption. Affected builds use specific OpenSSL, LibreSSL, or Mbed TLS configurations. Read more: thehackernews.com/2026/10/go…
Image from The Hacker News (@TheHackersNews)
14
34
2
187
37,938
🚨 CISA adds two PHP2Shell bugs to its KEV catalog after confirming active exploitation. CVE-2026-109618 and CVE-2026-109619 enable unauthenticated remote code execution on affected PHP deployments. Read ↓ thehackernews.com/2026/10/ci…
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

CISA adds two exploited PHP2Shell flaws to its KEV catalog after honeypot tests confirm remote code execution on a single-worker mod_php setup.

thehackernews.com
26
62
4
232
42,754
AI coding agents hijacked using AGENTS.md file in Downloads folder bleepingcomputer.com/news/se… bleepingcomputer.com/news/se…
AI coding agents hijacked using AGENTS.md file in Downloads folder

AI coding agents hijacked using AGENTS.md file in Downloads folder

Researchers found a malicious AGENTS markdown instruction file in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package.

bleepingcomputer.com
58
21
25
96
17,425
🚨 UPDATE: The Brotli flaw (CVE-2026-111497) goes beyond Node.js and web traffic. • .NET: patched by Microsoft • FFmpeg: hit via a crafted JPEG XL image • ClickHouse: one request crashes it, fix not yet released • Apache Arrow: no fix yet Details ↓ thehackernews.com/2026/10/br…
Image from The Hacker News (@TheHackersNews)
Image from The Hacker News (@TheHackersNews)
35
183
25
863
88,546
‼️ BREAKING ‼️ PHP warns of another UNPATCHED REC vulnerability just 2 days after releasing emergency patches for critical PHP2Shell flaws. New "CVE-2026-115560" affects only unusual session configurations. PHP has issued urgent mitigation guidance. Full details → thehackernews.com/2026/10/ur…
Image from The Hacker News (@TheHackersNews)
225
2,232
791
7,309
1,473,265
PHP ships emergency patches for critical PHP2Shell flaws bleepingcomputer.com/news/se… bleepingcomputer.com/news/se…
PHP ships emergency patches for critical PHP2Shell flaws

PHP ships emergency patches for critical PHP2Shell flaws

The PHP security team released emergency security patches for two critical remote code execution (RCE) vulnerabilities (CVE-2026-109618 and CVE-2026-109619) tracked collectively as PHP2Shell.

bleepingcomputer.com
12
62
2
139
12,715
‼️ URGENT ‼️ Two CRITICAL, unpatched PHP flaws (CVSS 9.2 each) have triggered an emergency warning after alleged exploit details surfaced online. Researchers report potential RCE. CVE-2026-109618 and CVE-2026-109619. Fixes scheduled for October 21, 14:00 UTC. Details - thehackernews.com/2026/10/ph…
Image from The Hacker News (@TheHackersNews)
29
193
28
766
98,298
NCU-ISAO retweeted
The NCUA (@TheNCUA) profile picture
The NCUA
@TheNCUAOct 20
Today NCUA announced its thirteenth round of proposed rule changes for the Deregulation Project. To learn more, please visit: go.ncua.gov/4yUBWCR
NCUA Announces Thirteenth Round of Deregulation Proposals

NCUA Announces Thirteenth Round of Deregulation Proposals

The National Credit Union Administration today announced the thirteenth round of proposed regulatory changes associated with NCUA’s Deregulation Project.

ncua.gov
1
4
7
535
F5 releases out-of-band patches for critical NGINX vulnerabilities bleepingcomputer.com/news/se… bleepingcomputer.com/news/se…
F5 releases out-of-band patches for critical NGINX vulnerabilities

F5 releases out-of-band patches for critical NGINX vulnerabilities

F5 has released out-of-band security patches to address multiple NGINX web server flaws, including three critical-severity vulnerabilities that can let attackers execute code on vulnerable systems.

bleepingcomputer.com
4
44
1
119
19,675
‼️ BREAKING: Go has issued an URGENT security update blocking 8 certificate authority keys over undisclosed security concerns. It will reject certificate chains using these keys, potentially breaking connections for rebuilt applications. The filter cannot be disabled. Here's what we know: thehackernews.com/2026/10/go…
Image from The Hacker News (@TheHackersNews)
27
109
28
463
188,299
🚨 Palo Alto Networks patches actively exploited PAN-OS RCE flaw (CVE-2026-0322). Authenticated attackers with network access to the management interface can run code as root. Palo Alto reports "very limited" exploitation. CISA added it to KEV. Read - thehackernews.com/2026/10/pa…
Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation

Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation

Palo Alto Networks patched an exploited PAN-OS flaw that lets authenticated attackers with management interface access execute code as root.

thehackernews.com
15
31
106
20,840
Load more