Decipher

Sometimes I post paywalled Post articles. Usually I post marketing ones, free with account creation unless you have one. Sometimes I post free archive versions, which you also can figure out how to find without me.
This week is not the time to shout at me for posting a version that pays reporters.

The Noise in the Silence: Unmasking CISA's Hidden KEV Ransomware Updates In 2025, 59 KEV entries silently flipped to “known ransomware use.” GreyNoise uncovers the hidden flips, why they matter, and a new feed to track them.

Some very interesting data analysis from our friends at @greynoise.io on the silent changes CISA makes to the KEV catalog regarding exploitation by ransomware gangs.
www.greynoise.io/blog/unmaski...

With perfect pitch, Joe Engressia Jr, aka #Joybubbles, discovered that he could whistle specific tones into a phone handset and bend the analog network to his will

(If you’re noticing a similarity between Engressia and the character Whistler in Sneakers, that’s not a coincidence)

Phreaks and Geeks: Joybubbles and the Pre-History of Hacking - Decipher The proto hacker whose innate ability, curiosity, and absolute joy in the act of discovery is conveyed so artfully in the new documentary Joybubbles.

We don't write about movies often but when we do, we write about hacker movies, like JOYBUBBLES from @charmingstranger.com at @sundance.org

decipher.sc/2026/02/02/p...

Google Mandiant: ShinyHunters Attacks Target SaaS Platforms Via SSO, MFA Abuse - Decipher The series of incidents detailed by Mandiant researchers started in early to mid-January, and included a previously disclosed campaign involving Okta customers.

Google Mandiant researchers said the campaign has successfully used voice phishing and credential harvesting sites to pilfer both single sign-on (SSO) credentials and multi-factor authentication (MFA) codes.

decipher.sc/2026/02/02/g...

Ivanti Discloses Exploited Critical EPMM Flaws - Decipher The vulnerabilities (CVE-2026-1281 and CVE-2026-1340) could lead to unauthenticated remote code execution if successfully exploited.

It's not Friday without an actively exploited bug!

decipher.sc/2026/01/30/i...

Fortinet and WinRAR Exploitation, Google's IPIDEA Disruption, and Our Favorite Cybersecurity Creators

🚨 New @deciphersec.bsky.social podcast is up!

🪲 New Fortinet SSO auth bypass exploitation
🪲 Attacks on old WinRAR flaw
🖥️ Google disrupts IPIDEA proxy network

📹 And shoutouts to some fave creators: @ryanaraine.bsky.social @johnhammond.bsky.social @mattjay.com

open.spotify.com/episode/5k9x...

Google Disrupts IPIDEA Residential Proxy Network - Decipher Google researchers observed more than 550 individual threat groups using IPIDEA exit nodes during a one-week period earlier this month.

decipher.sc/2026/01/29/g...

Message from "Signal Support" Dear User, this is Signal Security Support ChatBot. Our system has detected a recent login attempt to your account from an unrecognized device or location. As a security measure, we have blocked this attempt and sent a verification code via SMS to your registered phone number. If this was NOT you: To secure your account and block this unauthorized access, please reply to this message with the verification code you just received. If this WAS you: You can safely ignore this message. The login attempt will be automatically approved shortly. Thank you for helping us keep your account secure.

Signal will never message you like this.

If you get a message like this, SOMEONE IS TRYING TO HACK YOUR SIGNAL.

DO NOT GIVE THEM THAT CODE.

Fortinet Warns of Critical Flaw After FortiCloud SSO Exploitation - Decipher Fortinet is rolling out updates for CVE-2026-24858, with fixes for some versions available as of Tuesday, and others in releases that are upcoming at an unspecified date.

More Fortinet targeting.
decipher.sc/2026/01/28/f...

Cybercrime and APT Groups Exploiting WinRAR Bug - Decipher Exploitation of CVE-2025-8088 in the wild began before disclosure, with attacks confirmed as early as July 18, 2025.

decipher.sc/2026/01/27/c...

Microsoft Releases Emergency Patch for CVE-2026-21509 - Decipher The vulnerability (CVE-2026-21509) requires user interaction for an attack to succeed, with the most likely vector being an attacker sending a malicious Office file to a victim, who then opens it.

decipher.sc/2026/01/26/m...

Wow - Office security feature bypass patched OOB after active exploitation detected. Path now - CVE-2026-21509. At least the Preview Pane isn't an attack vector. msrc.microsoft.com/update-guide...

Fortinet FortiGate Devices Targeted in New Campaign - Decipher This activity shares some similarities with a campaign that researchers at Arctic Wolf identified in December. That campaign started soon after Fortinet disclosed two authentication bypass flaws (CVE-...

UPDATE: Fortinet has published some info on these attacks and the new path they're using.

decipher.sc/2026/01/22/f...

Cisco Fixes Unified Communications RCE Flaw Under Attack  - Decipher Threat actors are attempting to exploit the Cisco remote code execution flaw (CVE-2026-20045) in the wild, according to a new security advisory.

The remote code execution flaw (CVE-2026-20045) exists in Cisco’s lineup of products for voice, video, and mobility services for endpoints and applications.

decipher.sc/2026/01/22/c...

Fortinet FortiGate Devices Targeted in New Campaign - Decipher This activity shares some similarities with a campaign that researchers at Arctic Wolf identified in December. That campaign started soon after Fortinet disclosed two authentication bypass flaws (CVE-...

decipher.sc/2026/01/22/f...

High-Risk Authentication Bypass Flaw Found in Telnetd - Decipher The flaw is in the way that the telnetd server handles some specific user-supplied data. An attacker who exploits this vulnerability would be able to bypass the authentication path and gain root privi...

decipher.sc/2026/01/21/h...

This is how you start a security advisory: "If you are tired of modern age vulnerabilities, and remember the good
old times on bugtraq, I hope you will appreciate this one."

www.openwall.com/lists/oss-se...

UK Warns of DoS Attacks by Russian Hacktivist Group NoName057(16)  - Decipher The network was linked to various attacks in 2023 and 2024, including ones against Swedish authorities and bank websites, and a wave of 14 different attacks on more than 250 German companies.

decipher.sc/2026/01/20/u...

🚨 This week's podcast is up now! In this episode we break down:

✅ The RedVDS cybercrime platform takedown by
@security.microsoft.com
✅ New @talosintelligence.com research on UAT-8837 Chinese APT activity
✅ The very cool StackWarp bug by @rayiizzz.bsky.social and team

decipher.sc/podcasts/the...

UAT-8837 targets critical infrastructure sectors in North America Cisco Talos is closely tracking UAT-8837, a threat actor we assess with medium confidence is a China-nexus advanced persistent threat (APT) actor.

A Chinese APT group has focused last year on compromising critical infrastructure across North America.

Cisco has linked multiple intrusions to a group it tracks as UAT-8837.

blog.talosintelligence.com/uat-8837/

Microsoft Disrupts RedVDS Cybercrime Platform - Decipher The takedown marks a significant blow to the cybercrime-as-a-service ecosystem, which fuels large-scale, automated fraud.

“Microsoft tracks the threat actor who develops and operates RedVDS as Storm-2470. We have observed multiple cybercriminal actors, including Storm-0259, Storm-2227, Storm-1575, Storm-1747."
decipher.sc/2026/01/14/m...

‘We Fail a Lot’: How Two Security Pioneers Keep Innovating - Decipher From their roles as the driving forces behind pioneering web appsec firm WhiteHat Security to building out enterprise security programs to breaking large portions of the web, Jeremiah Grossman and Rob...

decipher.sc/2026/01/13/w...

YouTube video by Decipher The Future of Vulnerability Management With Jeremiah Grossman and Robert "RSnake" Hansen

Our latest podcast is out and it's a very fun and insightful conversation with Jeremiah Grossman and Robert Hansen on vulnerability management, building a new platform from scratch at Root Evidence, and very fast cars 🏎️

youtu.be/5eSgyYSEP0s?...

Coming up tomorrow on the podcast: Jeremiah Grossman
and Robert Hansen join @dennisf.bsky.social to talk about Jeremiah's car collection. Oh, and some vulnerability management stuff they're building at Root Evidence. Subscribe here: www.youtube.com/@DecipherSec

Whoa this looks rad. Might be good for one of our hacker movie podcasts!

First podcast of 2026 is up! 🎙️

✅ New Chinese APT UAT-7290 gets busy
✅ Attacks against CVE-2025-55182 React2Shell 📈
✅ News about upcoming podcast guests (spoiler alert!)

decipher.sc/podcasts/a-n...

A New Chinese APT Takes the Stage - Decipher Active since at least 2022, UAT-7290 demonstrates a significant capacity for conducting deep-seated espionage while simultaneously functioning as an initial access group.

decipher.sc/2026/01/08/a...

React2Shell Attacks Continue to Build - Decipher After a peak of more than 430,000 attack sessions in late December, daily volumes targeting React2Shell have stabilized in the 300,000 to 400,000 range.

Research from @greynoise.io shows a sustained attack volume in the 300k-400k per day range against CVE-2025-55182 React2Shell bug.
decipher.sc/2026/01/07/r...

Listen to our buddies. (They actually are our buddies, which is cool, right??)