SecPod (@SecPod) | teapawt

Tweets
All Posts
Sort by
Most recent Popular
Tweets & Replies
Reposts
Media
Search

Pinned Tweet

SecPod@SecPodAug 4

Songs from the SOC: #7 AI Anxiety: The Remediation Rush AI is getting really good at finding security weaknesses. The problem? Attackers can use those capabilities too. Finding vulnerabilities is becoming easier. Reducing risk before they can be exploited is the real challenge. While patches are being built and roadmaps are being planned, the clock is still ticking. A lighthearted reminder that while finding weaknesses gets easier, Prevention remains the foundation of security. #CyberSecurity #AI #CloudSecurity #VulnerabilityManagement #Infosec #PreventionFirst #SecPod #mythos #gpt

1

62

SecPod@SecPodOct 28

Tailscale SSH flaws can turn one authorized foothold into root-level access on reachable servers. The issues affect privileged socket forwarding and can enable lateral movement beyond the intended user permissions. Read more: secpod.com/learn/security-re… #CyberSecurity #Tailscale

Tailscale SSH Tailworm Findings: Root via Socket Forwarding

Tailscale SSH Tailworm Findings: Root via Socket Forwarding

Tailworm details Tailscale SSH Unix-socket forwarding and TOCTOU issues that can escalate approved sessions. Vendor status, impact, and interim mitigations.

21

SecPod@SecPodOct 28

AI-assisted ransomware is now being used in real intrusions. The Phantom Framework, linked to INC and The Gentlemen, supports exploitation, credential theft, lateral movement, data theft, and ransomware deployment. Read more: secpod.com/learn/security-re… #Ransomware #AI

Phantom Framework Enables AI-Assisted Ransomware Attacks

Phantom Framework Enables AI-Assisted Ransomware Attacks

Explore how the Phantom Framework enables AI-assisted cyber intrusions and ransomware operations across enterprise networks.

33

SecPod@SecPodOct 13

CVE-2026-97229 is a CVSS 10.0 GitLab flaw that can allow unauthenticated remote code execution through crafted CI/CD regex input. Self-managed GitLab users should upgrade to 19.2.8, 19.3.5, or 19.4.2. secpod.com/learn/security-re… #GitLab #CyberSecurity #RCE

GitLab CVE-2026-97229: Critical RCE Vulnerability

GitLab CVE-2026-97229: Critical RCE Vulnerability

GitLab CVE-2026-97229 is a critical CVSS 10.0 integer overflow flaw in the CI/CD Regex Compiler that could enable remote code execution.

1

86

SecPod@SecPodOct 13

Critical Bricksforge flaw exposes WordPress sites to remote code execution. Attackers could exploit vulnerable sites to run code and take control of affected systems. Update Bricksforge now: secpod.com/learn/security-re… #WordPress #CyberSecurity

Bricksforge WordPress Vulnerability Enables Remote Code Execution

Bricksforge WordPress Vulnerability Enables Remote Code Execution

A critical Bricksforge vulnerability, CVE-2026-85097, allows unauthenticated attackers to upload malicious files.

1

29

SecPod@SecPodOct 13

CyberXero is linked to the theft of 628,000 Ukrainian records, using AI-assisted tooling to support initial access operations. Read the full analysis: secpod.com/learn/security-re… #CyberSecurity #ThreatIntel

CyberXero: AI-Augmented IAB Stole 628,000 Ukrainian Records

CyberXero: AI-Augmented IAB Stole 628,000 Ukrainian Records

CyberXero pairs Claude Code agents, PentAGI, and Cobalt Strike in dual campaigns against WordPress and Ukrainian critical infrastructure. IOCs and defenses.

30

SecPod@SecPodOct 9

CVE-2026-21589 is a critical unauthenticated file access flaw affecting multiple Atlassian Data Center products. Attackers can access specific files when the exact path is known. Patch affected instances now: secpod.com/learn/security-re… #Atlassian #CyberSecurity #CVE

CVE-2026-21589: Critical Atlassian File Access Flaw

CVE-2026-21589: Critical Atlassian File Access Flaw

CVE-2026-21589: critical unauthenticated file access in Atlassian Data Center products. Fixed versions and temporary mitigations available.

74

SecPod@SecPodOct 9

CVE-2026-88779 is being exploited in targeted attacks against Citrix NetScaler ADC and Gateway. The SAML-related flaw can trigger denial of service on exposed deployments. Upgrade to a fixed build: secpod.com/learn/security-re… #Citrix #NetScaler #CyberSecurity

CVE-2026-88779: Citrix NetScaler SAML DoS Flaw Actively Exploited

CVE-2026-88779: Citrix NetScaler SAML DoS Flaw Actively Exploited

CVE-2026-88779: NetScaler ADC/Gateway memory overflow DoS on SAML SP/IdP. Targeted attacks observed; in CISA KEV. Fixed builds and patch guidance.

1

157

SecPod@SecPodOct 9

CVE-2026-102255 is a CVSS 10.0 pre-auth SSRF flaw in SonicWall SMA 1000. Unauthenticated attackers could reach internal functionality and perform unauthorized operations. Apply the fixed platform hotfix now: secpod.com/learn/security-re… #SonicWall #CyberSecurity #CVE

CVE-2026-102255: Critical SonicWall SMA 1000 Pre-Auth SSRF

CVE-2026-102255: Critical SonicWall SMA 1000 Pre-Auth SSRF

CVE-2026-102255 is a critical pre-auth SSRF in SonicWall SMA 1000 Work Place. Unauthenticated attackers can reach internal functions. Fixed hotfixes available.

91

SecPod@SecPodOct 8

Warlock ransomware is still exploiting year-old SharePoint flaws to hit critical infrastructure. Attackers are using unpatched servers for initial access, persistence, lateral movement, and ransomware deployment. Patch and investigate exposed SharePoint servers now.

2

1

66

SecPod@SecPodOct 8

secpod.com/learn/security-re…

Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure

Warlock Ransomware Still Exploits Year-Old SharePoint Flaws to Hit Critical Infrastructure

19

SecPod@SecPodSep 22

Red Heron is exploiting CVE-2026-60004 in Gitea to move from RCE to credential theft, persistence, lateral movement, and root access. The campaign also deploys JITTERLY and the SIXZUT rootkit. Upgrade Gitea to 1.27.1 or later and investigate exposed instances. #Gitea #CVE

1

77

SecPod@SecPodSep 22

read more here: secpod.com/learn/security-re…

From Gitea Exploitation to Root Access: Uncovering Red Heron’s Global

From Gitea Exploitation to Root Access: Uncovering Red Heron’s Global

From Gitea Exploitation to Root Access: Uncovering Red Heron’s Global Attack Campaign

16

SecPod@SecPodSep 15

Two critical Check Point flaws, CVE-2026-85102 and CVE-2026-85103, can allow unauthenticated remote code execution on VPN-enabled gateways and management appliances. Apply LivePatch Take 24 or the relevant hotfix immediately. secpod.com/learn/security-re…

Active Exploitation Imminent: Two Critical Check Point Flaws

Active Exploitation Imminent: Two Critical Check Point Flaws

CVE-2026-85102 and CVE-2026-85103 are critical vulnerabilities in Check Point VPN products that can allow unauthenticated remote code execution. The first flaw involves improper validation of...

68

SecPod@SecPodSep 11

Microsoft’s September Patch Tuesday fixes 973 vulnerabilities, including 113 Critical flaws and 2 zero-days already exploited in the wild. Prioritize the exploited zero-days and network-facing RCE flaws. Read more: secpod.com/learn/security-re… #CyberSecurity #Microsoft #ZeroDay

30

SecPod@SecPodSep 4

🚨 CVE-2026-20212 puts Cisco Nexus 9000 switches at risk of root-level RCE. Unauthenticated attackers may execute code as root or crash affected switches. Patch affected systems or restrict access to vulnerable ports. secpod.com/learn/security-re… #CyberSecurity #Cisco #RCE

1

95

SecPod@SecPodSep 4

SonicWall SMA 1000 appliances are under active attack. CVE-2026-83548 and CVE-2026-83549 can be chained from unauthenticated SSRF to remote code execution. SonicWall has confirmed exploitation in the wild. Patch affected SMA 1000 systems immediately. secpod.com/learn/security-re…

76

SecPod@SecPodSep 1

🚨 PaperCut zero-day alert: an authentication bypass can be chained into remote code execution, putting exposed servers at serious risk. Read more: secpod.com/learn/security-re… #CyberSecurity #ZeroDay #PaperCut #RCE

Inside the PaperCut Zero-Day Attack Chain: Auth Bypass to Code

Inside the PaperCut Zero-Day Attack Chain: Auth Bypass to Code

Inside the PaperCut Zero-Day Attack Chain: Auth Bypass to Code Execution

58

SecPod@SecPodAug 25

🚨 Cl0p is exploiting CVE-2026-12569 in PTC Windchill and FlexPLM, targeting 40+ organizations. The flaw can enable unauthenticated RCE and data theft. Patch affected systems now. secpod.com/learn/security-re… #CyberSecurity #Cl0p #CVE

Cl0p Exploits Critical PTC Windchill Flaw to Target 40+ Organizations

Cl0p Exploits Critical PTC Windchill Flaw to Target 40+ Organizations

Cl0p Exploits Critical PTC Windchill Flaw to Target 40+ Organizations

113

SecPod@SecPodAug 17

🚨 GeoServer zero-day alert: a flaw in jsonArrayContains could open the door to remote code execution. Security teams should identify exposed GeoServer instances, assess risk, and apply available mitigations or fixes immediately. Read the analysis: secpod.com/learn/security-re…

Inside the GeoServer Zero-Day: From jsonArrayContains to Potential RCE

Inside the GeoServer Zero-Day: From jsonArrayContains to Potential RCE

Inside the GeoServer Zero-Day: From jsonArrayContains to Potential RCE

40

SecPod@SecPodAug 17

🚨 Gunra ransomware is exploiting Fortinet auth bypass flaws to breach networks, steal data, and deploy ransomware. (secpod.com) Patch exposed FortiOS and FortiProxy devices now. Read more: secpod.com/learn/security-re…

Saner Platform | Cyberattack Prevention | Exposure Management

Saner Platform | Cyberattack Prevention | Exposure Management

SecPod's cyberattack prevention platform simplifies attack surface management by continuously identifying and remediating vulnerabilities across endpoints, cloud, and networks.

27