Availability, access, and exposure are driving today’s news. |
I’m watching a government DDoS attack, thousands of exposed code repositories, healthcare data theft, and Android malware that’s getting far more capable. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Norway Government Services Hit by DDoS Attack |
I’m tracking the DDoS attack that has disrupted Norway’s shared government digital infrastructure since Monday. It’s been causing intermittent outages and degraded access to public sector services and officials so far are not reporting any indications of data theft. |
My Take: Your resilience testing needs to validate that break glass accounts, downtime procedures, and alternate authentication methods actually work, not just on paper during tabletops. You can test these controls by taking primary identity and communication services offline and verifying that your most important workflows can continue without them. |
Cyberattack Knocks UK Power Generator Offline for Four Days
|
I’m following the reports of a cyberattack that forced a small British power generator offline for a few days in July, with some media reports pointing to a possible Iran-linked threat actor.
U.K. authorities have not confirmed Iranian involvement, and I think it’s a good reminder for all of us not to jump to conclusions given how challenging accurate attribution can be. My Take: This multi-day outage should be a reminder to test your own RTOs and prove you can restore from known good configurations and backups, because tabletops alone won’t tell you how resilient you actually are.
OT environments should restrict remote access, use proper segmentation between ICS and IT networks, and eliminate default credentials. |
28,000 Exposed Git Repos Leak Credentials |
Researchers found 28,000 publicly accessible Git repos and what stands out to me is how much risk can remain buried in repository history.
Hundreds of AWS and other API keys were exposed, with some still active. Removing a secret from current code doesn’t remove it from old commits or deleted branches. My Take: You should treat secret scanning as a pre-commit and CI/CD control, not a cleanup exercise after your credentials reach a repo.
If you find an exposed repository, block public access, scan the full commit history, rotate every exposed credential, and review associated cloud and payment logs for signs of unauthorized activity. |
|
|
|
We’d love your quick input on Qualcomm Snapdragon. This short survey will help us understand awareness and recognition of the brand.
It’s just 4 questions (with 3 optional ones if you have time) and takes 2 minutes or less. [Take the Survey] Thank you for your time and feedback! |
|
|
|
Nutex Health Probes Data Theft After Cyberattack |
I’m following the recent incident at Nutex Health where an unauthorized third party accessed company servers and potentially exfiltrated sensitive data. The company is still working to determine exactly what data was stolen. |
My Take: This is a reminder to maintain visibility into your sensitive data and continuously monitor it. Not related to this incident, but I once found a Windows 95 machine sitting in a random closet during a healthcare audit, and the IT team was just as surprised as me. Review outbound data transfers and access logs for unusual activity, and test your IR plans with actual simulations and not just tabletop exercises. |
ToxicPanda 2.0 Takes Aim at 349 Financial Apps |
ToxicPanda 2.0 is interesting to watch because it supports over a hundred remote commands and has been targeting hundreds of financial Android apps. I think it’s neat how it chains legitimate Android features like Accessibility Services and Wireless Debugging to gain deeper control over a device. My Take: Most organizations allow BYOD, so I suggest treating compromised mobile devices the same as you would an identity compromise and revoke associated sessions, tokens, and passkeys. You should also monitor for unexpected changes to Accessibility, Developer Options, Wireless Debugging, and ADB pairing that could indicate compromise. |
|
|
|
Can You Stop a DDoS Attack? |
Today’s DDoS attacks can generate massive traffic volumes that overwhelm internet-facing services and applications. |
How to strengthen DDoS defense: |
- Identify internet-facing systems, DNS, APIs, and upstream dependencies, then monitor traffic for unusual spikes or patterns.
-
Deploy DDoS protection solutions alongside CDNs, WAFs, rate limiting, traffic filtering, and redundant DNS to absorb attacks and ensure availability.
- Establish failover procedures for critical and third-party services, then test them with DDoS simulations and recovery exercises.
|
Make your DDoS resilience measurable by tracking mitigation time, failover performance, and assess whether critical services remain within defined availability targets during an attack. |
|
|
|
Security Tools You Can Use |
|
|
|
How confident are you in your repository security? |
|
|
|
Yesterday's Pulse Check Results |
Kids’ Privacy Check: Are social platforms doing enough? |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
