The noise is rising, but the real danger is the quiet stuff. |
This week brings a root-level email appliance exploit, a CI/CD shortcut that could poison trusted code, phishing kits built to steal sessions, and hacktivists shifting from disruption to deeper damage. Read past newsletters here. |
|
|
Here’s what you need to know: |
|
|
Cisco Confirms Secure Email RCE Exploited in the Wild |
Cisco says attackers are actively exploiting a critical RCE flaw in its Secure Email appliances for root access. Tracked as CVE-2025-20393 (CVSS 10.0), the vulnerability in Spam Quarantine lets unauthenticated attackers run root commands via crafted HTTP requests. |
Cisco has released a patch for the vulnerability.
Patch Cisco Secure Email appliances immediately, remove Spam Quarantine from the public internet, and forward logs externally to monitor for tunneling and tampering indicators. |
AWS Build Bug Could Let Attackers Poison GitHub Code |
Wiz researchers found CodeBreach, an AWS build automation vulnerability that could have enabled GitHub repo hijacks and malicious code injection into widely used AWS components.
The flaw could let a single pull request trigger privileged CI/CD, turning routine updates — especially in the AWS JavaScript SDK — into a stealth channel for backdoored code. AWS confirmed the issue was tied to project-specific misconfigurations in CodeBuild webhook actor ID filters and said no malicious code was introduced and no customer environments were impacted.
Anchor webhook identity filters with ^ and $, switch CI/CD to short-lived OIDC credentials, block untrusted PR builds from accessing secrets, and test incident response playbooks. |
Go Patches Toolchain Bugs Linked to Code Execution |
Go has released security updates fixing six vulnerabilities across core libraries, plus two toolchain flaws.
Attackers could trigger DoS via malicious ZIPs or oversized form payloads. In some environments, toolchain flaws could also enable code execution during builds and dependency pulls, especially when compiling third-party modules.
Upgrade to Go 1.25.6 or 1.24.12 and leverage DevSecOps to prevent untrusted dependency fetching from leading to code execution. |
|
|
Where is your org on code supply chain security? |
|
|
Yesterday's Pulse Check Results |
Cloud Tenant Armor Check: If one admin endpoint fell, how far could they go? |
|
|
Security Tools You Can Use |
|
|
UK Flags Rising Russian Hacktivist Attacks Beyond DDoS |
UK’s National Cyber Security Centre (NCSC) warns Russian-aligned hacktivists are escalating beyond website disruption to target online services and even operational technology. The NCSC said that even “simple” DDoS attacks can disrupt critical public services and sometimes mask deeper intrusions. |
These are active attacks in the wild.
Pressure-test your DDoS and remote access defenses now — especially helpdesk password reset workflows and privileged account monitoring. |
Flare Warns Phishing Kits Now Steal Sessions at Scale |
Flare researchers report that modern phishing kits run like phishing-as-a-service, built to steal sessions, bypass MFA, and scale account takeovers.
The researchers reviewed 8,627 underground posts and found phishing kits now mimic SaaS, complete with support and dashboards, and increasingly use AiTM/reverse-proxy tactics to steal session tokens — not just passwords.
Prioritize FIDO2/passkeys for high-risk users and tighten conditional access to shorten sessions and block risky logins. |
|
|
New research from PwC shows AI models trained on tokenized patient data delivered nearly twice the data model accuracy compared to models using masked data. More accurate models can lead to better patient outcomes. Learn how.
|
|
|
Defend Against Hacktivist Disruption |
Hacktivist groups have escalated from noisy website defacements into coordinated campaigns that can knock essential services offline and, in some cases, probe for deeper access. Even traditional attacks like DDoS can create real operational impact — and serve as a smokescreen for intrusion attempts and account abuse. |
How to harden your defenses against hacktivist attacks: |
-
Harden availability defenses with a CDN/WAF, upstream DDoS scrubbing, DNS protections, and rate limiting to absorb traffic floods before they reach critical systems.
-
Lock down access paths by enforcing MFA, restricting admin portals behind VPN/jump hosts, and applying strict IP allowlisting for management interfaces.
-
Prepare to contain disruption by monitoring for intrusion attempts during attacks and rehearsing failover plans to keep essential services online.
|
Hacktivist attacks aim to disrupt services and distract defenders, but layered DDoS protection, tight access controls, and rehearsed response plans can keep incidents contained. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
