What Cyber-Threat.net is for
What Cyber-Threat.net is for, how we source and correct our work, what Hunt Lab offers, and what The Long Watch newsletter will be.
Post-quantum TLS: the deadlines are real now
US agencies owed OMB and the National Cyber Director a post-quantum migration plan on 22 October, and the NCSC has named the TLS key exchanges to use. The hard part is the inventory, not the maths.
SafePay: joint advisory on a ransomware crew with 600-plus victims
FBI, CISA, NCA and German police detail SafePay: old edge-device CVEs, legitimate tools, NAS backups reset to factory settings and phone calls to victims.
Plex2Shell is being exploited: patch Plex, then assume compromise
A four-bug Plex Media Server chain is planting miners. The fix shipped in August; exposed servers older than 1.43.3.10861 should be treated as compromised.
ConnectWise Cloud Backup: Storm-0940 and an AI-paced supply-chain attack
Microsoft links the ConnectWise Cloud Backup compromise to Storm-0940 and the ARTEX framework. Export your Entra logs before retention eats the evidence.
PHP2Shell: patch PHP now, then go hunting
Two critical PHP flaws allow unauthenticated RCE, and attackers were probing before the fix. Upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then hunt.
