Attackers are finding new entry points… and some are hiding in plain sight. |
From mobile device managers and fintech data stores to AI integrations and edge routers, trust boundaries are getting tested. Even authentication itself isn’t safe.
Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
Ivanti EPMM Vulnerabilities Under Active Attack |
Two critical Ivanti EPMM flaws are under active exploitation, enabling unauthenticated remote code execution on enterprise mobile management servers. Researchers have identified more than 4,400 internet-exposed instances facing automated attacks across multiple regions. |
Because EPMM serves as a centralized control plane, a single compromise can grant broad administrative access across thousands of managed devices.
Immediately patch and verify all EPMM instances, run Ivanti’s detection script to hunt for IOCs, restrict internet exposure behind VPN or IP allowlisting, and rotate credentials if any signs of compromise are found.
|
967K Records Leaked in Figure Breach |
A social engineering attack against fintech lender Figure has resulted in nearly one million customer records being posted online. Analysis of the leak revealed 967,200 records containing emails, names, dates of birth, phone numbers and addresses — creating full identity profiles, not just contact data. Because the data aligns with common financial and telecom identity verification fields, victims face heightened risks of SIM-swapping, account takeover and long-term fraud, as these identifiers cannot simply be reset like passwords.
Immediately review identity verification workflows, reduce reliance on static personal data for authentication and implement phishing-resistant MFA to limit damage from social engineering–driven intrusions. |
MCP Integrations Create Hidden AI Risk |
Enterprise AI assistants are introducing a new risk layer as MCP servers can be exploited for code execution, data exfiltration and stealthy social engineering.
Researchers showed that chaining a malicious local MCP server with a trusted Slack integration enabled zero-click command execution and silent data exfiltration. Supply chain risks increase exposure, as Python components can be pulled at runtime from package repositories, effectively turning MCP servers into machine-in-the-middle infrastructure.
Require formal approval for all MCP servers, sandbox local instances, enforce least-privilege tool permissions, pin package versions, and monitor tool activity in your SIEM to detect anomalous chaining or data exfiltration. |
|
|
How tightly are your AI assistants governed? |
|
|
Yesterday's Pulse Check Results |
How exposed is your dev stack right now? |
|
|
Security Tools You Can Use |
|
|
Texas Sues TP-Link Over Router Security |
Texas has sued TP-Link, alleging it misled consumers about router security and supply chain origins while its devices were used in cyber operations.
According to the complaint, routers labeled “Made in Vietnam” relied on Chinese-sourced components and contained firmware flaws later exploited by state-linked actors to build botnets and run credential-theft campaigns. |
Source: Pete Alexopoulos/Unsplash |
The case is pending a court date at the time of publication.
Patch and replace outdated routers, disable internet-facing admin access, enforce strong credentials and MFA, segment edge devices from critical systems, and continuously monitor for anomalous outbound or command-and-control traffic.
|
better-auth Bug LetsThreat Actors Forge API Keys |
A vulnerability in the better-auth library allows attackers to generate valid API keys for arbitrary users — without logging in.
The flaw allows attackers to supply a userId, bypass session validation and mint API keys for victim accounts, creating exposure for a library downloaded roughly 300,000 times per week on npm. A patch has been released, but keys created during the exposure window may still be active.
Upgrade better-auth, rotate and scope all API keys, monitor for unauthenticated key-creation attempts, and enforce expiration, least privilege and rate limiting on API key endpoints. |
|
|
Secure Your Supply Chain End to End |
From tampered firmware to poisoned open-source packages, a single weak vendor or dependency can quietly introduce systemic risk across your entire environment. |
How to strengthen your hardware and software supply chain: |
-
Maintain full visibility into dependencies by using SBOMs and software composition analysis to track components and detect vulnerable or malicious libraries.
-
Strengthen trust in vendors and updates by conducting thorough third-party risk assessments and enforcing code signing and signature verification for all software and firmware.
-
Protect the hardware and operational layer by enabling secure boot with a hardware root of trust and continuously monitoring third parties for emerging security risks.
|
Supply chain security is foundational to reducing risk, and improving visibility, validating vendor trust and continuously monitoring dependencies helps lower the risk from third-party compromises. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
