Read Time: 8 minutes

Brought to you by:

Howdy friends!

An odd week for me. Definitely feeling that Spring burnout. Feels like a lot of people around me also, what is in the air?

I’m gearing up for some speaking gigs I’ve got this summer and really excited about some of the talks I’ve got cooking.

ICYMI

🖊️ Something I wrote: zero days are not invisibility cloaks.

🎧️ Something I heard: This breakdown of Anthropic and SpaceX stuff is the best I’ve seen

🎤 Something I said: GitHub is not ok

🔖 Something I read: Finding Zero-Days with Any Model (best blog I’ve read in a long time)

Vulnerable News

Canvas hacked by ShinyHunters

Vulnerability fixes without an owner are just a suggestion*

Most vulnerability tickets die in the backlog. Sometimes the fix is hard. More likely, nobody knows who owns it, or the ticket didn't help the person fix it, just a request to patch a vague vulnerability.

And when you do find the owner, the tags are stale, the original engineer moved on, and the new owner doesn't know what they inherited.

Maze's AI agents show you the fix your developers will actually implement, not just the textbook fix. Then they cross-reference your repo history, CODEOWNERS, CMDB, and other signals to find who's fixed this before, so the fix lands with the right person every time.

Vulns get closed. Period. (read more)

*Sponsored

Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution

Because apparently it’s consumer edge device vulnerability day ending in Y, we’ve got another PAN-OS bug getting actively exploited. This one is a buffer overflow in the User-ID authentication portal that lets an unauthenticated attacker execute arbitrary code as root. That’s about as bad as it gets.

What stands out to me is this was already being exploited before the advisory dropped. So this was a zero day. And honestly, the part I keep coming back to with a lot of these edge-device bugs is that the vendor guidance usually says the same thing every time: don’t expose these management and auth portals directly to the internet. Because these vulnerabilities happen constantly.

That’s the frustrating part. I don’t even beat vendors up too hard over some of this anymore because everybody ships vulnerable code eventually. The real issue is how often these things are internet-facing in the first place. The numbers on this one aren’t staggering, but some new evidence is pointed towards state actors out of China and hyper targeted so they don’t need numbers. (read more here, here, and here)

Coinbase Cuts Headcount By 14%, Citing AI Acceleration

Coinbase laid off about 14% of the workforce, roughly 700 people.

They are blaming AI, which at this point shows up in every layoff. “AI is changing how we work,” engineers shipping faster, non-technical teams shipping production code, workflows getting automated. I don’t even disagree with a lot of that. But I think AI is lowercase in reality and uppercase in the press release. This is cost cutting first, AI second. If you can reduce headcount and keep revenue the same, why wouldn’t you do that? That’s the magic corporate Ozempic everyone wants.

The thing a bunch of people, myself included, found concerning here. We have a financial institution saying managers will be pushed to 15+ direct reports and be asked to be individual contributors too. No pure play managers. Player coaches. etc. etc. We’ll see how far this one goes, but non-tech teams pushing code to prod sounds sexy for startups, sounds concerning for finance.

Zooming out, this isn’t just Coinbase. It’s happening everywhere. Companies trim the fat, point to AI, and say they’re more efficient. One possible outcome here is we end up with fewer massive companies and a lot more smaller ones, because it’s easier to build now. Code isn’t a moat like it used to be. But the other path is a lot uglier: widespread layoffs, less spending, everything slows down. I’m hoping we land closer to the first one. (read more)

MuddyWater Uses Microsoft Teams to Steal Credentials in False Flag Ransomware Attack

MuddyWater's getting creative with their false flag game. The Iranian state group just pulled off a ransomware attack that wasn't really about ransomware at all - they used the Chaos RaaS brand as cover while conducting what was actually a targeted espionage operation. The attack kicked off with some social engineering via Microsoft Teams, where they posed as IT support and got victims to screen-share their way into giving up credentials and bypassing MFA. Once inside, they skipped the whole file encryption thing and went straight for data exfiltration and persistence tools like DWAgent.

(Do I need to keep saying it? Help desk social engineering should be top of your list)

This fits a bigger pattern we're seeing where state actors are borrowing from the cybercrime playbook to muddy attribution waters. (get it?) It's getting harder to tell who's who when Iranian operators are using the same tools and tactics as profit-driven ransomware crews. This comes alongside other Iranian cyber escalations, including attacks on Omani government systems and that Port of Fujairah hit where stolen infrastructure data was allegedly used for missile targeting. We're watching the line between cyber and kinetic operations blur in real time.(I made a whole video about that) (read more)

Romance Scammers Turn Sweet Talk Into £102M Payday

The UK just reported more than £102 million lost to romance scams in 2025, and honestly, I think the real number is way higher due to many being unreported. These scams are working. I personally know people whose parents lost tens of thousands of dollars. One was out 30 grand, another 60 grand, and in both cases the victims still fully believed they were in real relationships. Their families become “the bad guys” for trying to stop the bleeding. Both didn’t report due to being so convinced by the scam.

That’s the part people don’t understand about these things. Once someone is emotionally locked in, logic stops mattering. One of the victims I know had their kids cutting off access to accounts and credit cards, and they still found ways to send money; gift cards, whatever they could. And the people who do realize what happened are often too embarrassed to report it, which means the stats we’re seeing are almost definitely underreported.

The scary part is these scammers are still basically playing on easy mode. They’re not even really using the scary AI stuff yet: deepfakes, voice cloning, all of that. If they’re already this successful with basic manipulation and fake personas, it’s only going to get worse once those tools become standard. (read more)

That AI Extension Helping You Write Emails? It’s Reading Them First

Unit 42 dropped a report on high-risk gen AI browser extensions, and this is one of those “you should probably read this” things. They’re seeing this stuff in the wild. Extensions that look like AI tools, or maybe actually are AI tools, but they’re also doing some sketchy stuff on the side. Data exfiltration, adware, hidden iframes, prompt hijacking, redirecting searches, all the usual nonsense, just wrapped in AI branding.

What stands out to me isn’t even that any one of these is massive. Some of them barely have users. A couple thousand here, one had like two users. That’s not the point. The point is the behavior. This stuff is getting into the Chrome Web Store, and it’s doing exactly what we’ve been talking about. Either it’s malicious from the start, or it does what it says it does for a while and then turns malicious later. (read more)

Stop deepfakes and social engineering across the employee life cycle*

Social engineering, deepfakes, and impersonation are the new security threats. Persona's Workforce IDV solution verifies real-world identity, not just credentials, with liveness detection, government ID checks, and passive signals.

From onboarding and device enrollment to MFA resets and privileged actions, identity stays secure. (read more)

Grok Tricked Into Sending Money By Prompt Injection

All right, this is super funny: someone prompt injected Grok and got it to transfer real crypto by tweeting Morse code saying “withdraw all, whatever the heck this coin is, and send it to this wallet.” Grok, being the super helpful AI that it is, decoded the Morse code and there was a special account tagged in this that actually listened to the command. It being the super helpful bot that it is said, “you got it,” and went ahead and withdrew the coin and sent it to that wallet.

Turns out the Bankr thing allocates wallets to any account that interacts with it. Even though nobody managing the Grok account had any idea, it had been accruing some coins with real monetary value. Just an objectively hilarious prompt injection. (read more)

Critical, High-Severity Vulnerabilities Patched in Apache MINA, HTTP Server

Apache shipped httpd 2.4.67 on Sunday to patch CVE-2026-23918, a double-free in mod_http2 hitting every 2.4.66 and earlier deployment running HTTP/2. Send a HEADERS frame followed by RST_STREAM with a non-zero error code on the same stream, and two nghttp2 callbacks free the same h2_stream pointer twice. The DoS path is one TCP connection, two frames, no auth, worker dies on contact.

Researchers also built a working RCE PoC using mmap reuse and Apache's scoreboard memory as a stable target, though it needs APR with the mmap allocator (default on Debian) and an info leak. No confirmed exploitation yet, but the DoS is a weekend project for anyone with nghttp2. Patch to 2.4.67 - kill HTTP/2 as a stopgap if you can't. (read more here, here and here)

Critrical cPanel Flaw Mass-Exploited In "Sorry" Ransomware Attacks

cPanel is getting mass-exploited right now, and honestly … of course it is. This thing has been around forever, like mid-90s forever, and it’s still sitting all over the internet. CVE-2026-41940 is getting hammered by ransomware crews. The "Sorry" gang is having a field day with this one, with Shadowserver reporting at least 44,000 compromised IP addresses since Thursday. The attackers are dropping a Go-based Linux encryptor that slaps a ".sorry" extension on files and uses ChaCha20 encryption with RSA-2048 key protection.

This isn't some small-scale operation either - hundreds of compromised sites are already showing up in Google searches. Emergency patches dropped this week, so if you haven't updated your WHM/cPanel installations yet, now would be a really good time. The exploitation started back in February as a zero-day, so this crew has had plenty of time cause damage. (read more)

Microsoft Defender Wrongly Flags DigiCert Certs As Trojan:Win32/Cerdigent.A!dha

This DigiCert situation was kind of wild because it was two problems stacked on top of each other. First headline everyone saw: Microsoft Defender started flagging legit DigiCert root certs as malware, even removing them from systems in some cases. Massive false positives. That alone is chaos.

But underneath that, there was a real incident. DigiCert had a breach where attackers got access through - are you ready? You’re not going to believe it… - a customer support employee. Same playbook again. Not some AI super hacker. Just calling support, pretending to be someone they’re not, and getting access. From there, they were able to generate initialization codes for a small number of code signing certs, some of which were then used to sign malware.

So now you’ve got this weird chain reaction. Real breach leads to real abuse of certificates, which leads Microsoft to start flagging things aggressively, and now you’ve got legit certs getting nuked. Some people in my live stream chat got their days ruined for this one. Rough! (read more)

PCPJack | Cloud Worm Evicts TeamPCP and Steals Credentials at Scale

There's some drama brewing in the malware scene. A new framework called PCPJack is stealing creds from exposed Docker, Kubernetes, and MongoDB instances, but also actively kicking out TeamPCP infections from the same systems. SentinelLabs thinks this might be the work of a former TeamPCP member who went rogue and decided to start their own operation. "Fine, I'll start my own criminal enterprise!"

PCPJack is pretty complex for malware beef. It's exploiting fresh CVEs like the React2Shell flaw and some WordPress vulnerabilities, then exfiltrating stolen creds to Telegram channels using proper encryption. The lateral movement game is strong too - it harvests SSH keys, enumerates Kubernetes clusters, and spreads through internal networks. What's wild is how methodically it scrubs TeamPCP artifacts - processes, services, containers, etc. It's like watching one hacker crew actively evicting another from compromised systems. Professional courtesy is clearly dead. (read more)

Miscellaneous mattjay

Parting Thoughts:

Community was foundational in launching and propelling my career. Community is the only reason I can stand being in Texas during the summer months. Community is the point. Today, I invite you to embrace discomfort on the road to a more vulnerable you.

Stay safe, Matt Johansen
@mattjay