September 2026 – Page 15

Windows Recall: The Privacy Debate Before Launch

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:AI & Agent Security Identity & Phishing Security

Announced May 20, 2024 as a Copilot+ flagship, Windows Recall promised searchable memory of everything on screen — and researchers found the archive in a plaintext SQLite database any user-context malware could read, with a runtime API to match. This account covers Kevin Beaumont’s teardown, the TotalRecall extraction tool, the threat-model fallacies in each Microsoft defense, the June climb-down to opt-in plus Windows Hello and encryption, and the rare process win of an architecture changed before deployment.

CrushFTP VFS Sandbox Escape: Zero-Trust Patch Confusion in File Transfer

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Cloud & Infrastructure Security Supply Chain Security

On April 19-20, 2024, CrushFTP shipped emergency fixes for CVE-2024-4040 — an unauthenticated escape from the virtual file system sandbox that exposed arbitrary host files, including the credential-stuffed configuration that anchors enterprise partner integrations. Exploitation followed within days, CISA listed it April 30, and a chaotic trail of interim builds left customers arguing about version numbers mid-fire. This account covers the traversal-to-escape chain, the mainserv credential hunt, and the hard lessons of small-vendor emergency patching.

PuTTY ECDSA Nonce Bias: How 71 Signatures Exposed Your SSH Key

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Cryptography & PKI Security

PuTTY’s April 2024 advisory for CVE-2024-31497 read like a physics problem: the terminal’s ECDSA implementation biased nonces on NIST P-521, so roughly 71 captured SSH signatures suffice for a lattice attack that recovers the private key. This piece explains the Hidden Number Problem math, why archived PCAP and DLP session capture retroactively weaponized years of traffic, the 0.81 deterministic-nonce fix, and the brutal rotation drill that made every P-521 key used through Pageant presumptively burned.

PAN-OS GlobalProtect Zero-Day: CVE-2024-3400 Explained

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Cloud & Infrastructure Security Web & API Security

On April 12, 2024, WatchTowr disclosed CVE-2024-3400 — a CVSS 10.0 pre-auth command injection in PAN-OS GlobalProtect that state-sponsored actors had exploited since late March by chaining a cookie-controlled file write into Tcl execution as root. This account walks the two-flaw exploit chain, the scramble after the 10.2.9-h1 hotfix, CISA’s KEV clock, config-hidden persistence that survived reboots, the mitigation-versus-remediation confusion, and why 2024 made appliances patch with server-grade urgency.

AT&T 73M Leak: The 2019 Dataset That Resurfaced Free

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Identity & Phishing Security

March 2024’s 73-million-record AT&T leak was an old wound reopened: a 2019-era vendor-workspace dataset, shopped unsuccessfully in 2021, finally dumped free on a hacking forum with SSNs and account details intact. This account disentangles it from the concurrent Snowflake campaign, explains why free publication maximizes criminal utility, maps the 7.6 million passcode resets, and follows the extortion thread that later surfaced in DOJ filings.

The XZ Utils Backdoor: Inside the Almost-Catastrophe

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Security Supply Chain Security

The most patient supply-chain attack ever caught — a two-year maintainer infiltration that planted an SSH backdoor into xz-utils release tarballs, discovered in March 2024 only because one engineer noticed 500 milliseconds of latency. This account traces the Jia Tan persona from helpful contributor to release engineer, the test-file obfuscation and build-stage injection, the systemd/sshd target chain, the near-miss that kept stable distros clean, and the trust-model reforms that rippled through open source.

JetBrains TeamCity Auth Bypass: Build Servers as Front Door

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Security Supply Chain Security Web & API Security

March 2024’s CVE-2024-27198 let unauthenticated attackers mint admin accounts on self-hosted TeamCity CI servers, converting every connected build agent into attacker-controlled execution holding source, secrets and signing keys. This piece covers the alternate-path authentication bypass, the companion path traversal, the ransomware crews that queued within days, and the year’s hard-learned rule that build infrastructure deserves domain-controller-grade security.

LockBit Takedown: Operation Cronos and Its Awkward Aftermath

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Emerging Tech & Architecture Ransomware & Malware Security

February 2024’s Operation Cronos seized LockBit’s infrastructure across a dozen countries — and then the leaks showed how long the FBI had been inside. This account covers the covert access, the sting timing driven by UK hospital targeting, the servers and affiliate accounts taken down, the hurried rebrand to LockBit 4.1, the affiliate diaspora to RansomHub and Akira, and the awkward questions the takedown’s trolling raised about reading crime statistics.

ConnectWise ScreenConnect Auth Bypass: An Instant RCE Wave

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Cloud & Infrastructure Security Web & API Security

February 2024’s CVE-2024-1709 let anyone add administrative accounts to self-hosted ScreenConnect servers — a setup-wizard path traversal that converted remote-support consoles into ransomware deployment platforms within 72 hours of disclosure. This account covers the twinned vulnerabilities, why MSP-hosted instances multiplied the blast radius across client fleets, the observed ransomware sequences, and the hard questions RMM vendors faced about unauthenticated wizard endpoints.

Wyze Camera Flaw: 13,000 Strangers Through One Caching Hole

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Cloud & Infrastructure Identity & Phishing Security

Two February 2024 vulnerabilities let Wyze app users briefly see thumbnails and live feeds of strangers’ cameras — a cache-key failure amplified by a three-year-old flaw resurfacing in redesigned hardware. This account covers the date-based cache-key bug, the 13,000 affected users, the nine-hour fleet update, and the uncomfortable questions about budget-camera security engineering when the same vendor has now repeated the vulnerability class.

AnyDesk Breach: Production Compromise and a Certificate Sprint

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Identity & Phishing Security Supply Chain Security

Remote-access maker AnyDesk confirmed in February 2024 that attackers had compromised production systems using valid credentials traced to infostealer logs — forcing a certificate rotation, password resets, and a rushed 8.1.1 release whose code-signing was intact but whose credibility needed rebuilding. This piece covers the infostealer-to-supply-chain escalation path that rewired vendor-risk thinking, and why remote-admin tooling became a tier-one identity perimeter.

MOAB: The 26 Billion-Record Compilation That Wasn’t a Breach

Post author:Prabhu Kalyan Samal
Post published: September 3, 2026
Post category:Identity & Phishing Security

The January 2024 ‘Mother of All Breaches’ headline turned out to be a compilation of thousands of prior incidents re-hosted in a misconfigured bucket — 26 billion rows of recycled credentials stacked into a credential-stuffing goldmine. This piece explains why aggregations are not new breaches but still multiply risk, how the 12-terabyte trove mapped to old LinkedIn, Adobe and MyFitnessPal leaks, and why password reuse makes every old breach a live 2024 attack.