https://spidercivi.github.io/HACK-PROJECT/en/Daily Threat Intelligenceenhttps://spidercivi.github.io/HACK-PROJECT/en/a/smartconsole-token-admin-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/smartconsole-token-admin-en.htmlFri, 24 Jul 2026 08:00:00 +0100Check Point has fixed an authentication flaw in SmartConsole, the console that administers its security gateways. CVE-2026-16232 lets an unauthenticated attacker obtain an application login token and use it to log in with full administrative privileges. The vendor confirms it was exploited as a zero-day against a small number of customers; CISA added it to the Known Exploited Vulnerabilities catalogue on 22 July, with a remediation deadline of the 25th. The sore point is where the flaw sits: in the panel that sets the firewall rules.https://spidercivi.github.io/HACK-PROJECT/en/a/adfs-privilege-escalation-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/adfs-privilege-escalation-en.htmlFri, 24 Jul 2026 08:00:00 +0100Microsoft Active Directory Federation Services — the component that provides single sign-on between an organisation and external services — has an insufficient-granularity access-control flaw: CVE-2026-56155. It lets an already-authenticated attacker elevate privileges locally. The NVD score is 7.8, so it is not the "one click and you are in" kind of flaw; but CISA added it to the Known Exploited Vulnerabilities catalogue, and it sits on the server that decides who is who. It is worth explaining why it matters even at 7.8.https://spidercivi.github.io/HACK-PROJECT/en/a/akira-raas-2026-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/akira-raas-2026-en.htmlFri, 24 Jul 2026 08:00:00 +0100Akira is not new: it has operated since March 2023 under the ransomware-as-a-service model and is one of the most prolific groups around. The joint advisory from CISA, the FBI and the Dutch NCSC, updated in November 2025, cites more than 342 organisations hit and roughly 244 million dollars in proceeds. In July 2026 its leak site added new names. The thread that holds the story together is mundane and, for that reason, instructive: Akira almost always enters through poorly protected remote access, not through technical magic.https://spidercivi.github.io/HACK-PROJECT/en/a/ai-act-cybersecurity-alto-rischio-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/ai-act-cybersecurity-alto-rischio-en.htmlFri, 24 Jul 2026 08:00:00 +0100On 2 August 2026 a little-reported piece of the European AI Act kicks in: the obligations for high-risk AI systems listed in Annex III. Among them is Article 15, which places accuracy, robustness and cybersecurity on the same footing. It is not a statement of principle: it requires a high-risk AI system to withstand attempts to alter its use, outputs and performance. An explainer on what the rule actually says, with the dates that matter and without mistaking it for the attack of the day.https://spidercivi.github.io/HACK-PROJECT/en/a/garante-experian-sic-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/garante-experian-sic-en.htmlFri, 24 Jul 2026 08:00:00 +0100On 3 July 2026 Italy's data protection authority, the Garante, ordered Experian Italia S.p.A. to pay 120,000 euros, in a decision touching bedrock principles: lawfulness and transparency, data minimisation, privacy by design. At its centre is a Credit Information System — one of those databases where people's payment history ends up and from which a judgement on their reliability comes out. An explainer on what the decision says and why it concerns anyone who has ever applied for financing.https://spidercivi.github.io/HACK-PROJECT/en/a/password-lunghezza-nist-800-63b-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/password-lunghezza-nist-800-63b-en.htmlFri, 24 Jul 2026 08:00:00 +0100The ninety-day password change, the mandatory special character, the capital letter forced in for its own sake: these are the rules a generation learned to make passwords by. And they are the same ones NIST — the very body that helped spread them — now recommends abandoning. Revision 4 of SP 800-63B flips the perspective: length matters, not artificial complexity. An explainer on what changed and why it is a matter of culture before technology.https://spidercivi.github.io/HACK-PROJECT/en/a/patch-per-rischio-bod-26-04-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/patch-per-rischio-bod-26-04-en.htmlFri, 24 Jul 2026 08:00:00 +0100In June 2026 CISA issued directive BOD 26-04, changing how US federal agencies decide what to fix first. The rule is no longer "update everything, fast", but "update first what is genuinely risky", by four criteria. It binds US agencies, not Italian companies; but the method is replicable anywhere the patch queue is longer than the time available — that is, almost everywhere. An explainer on how it works and what can be taken from it.https://spidercivi.github.io/HACK-PROJECT/en/a/langflow-validate-rce-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/langflow-validate-rce-en.htmlWed, 22 Jul 2026 08:00:00 +0100Langflow is a visual tool for building flows and agents on top of language models. The function meant to «validate» user-supplied code, validate_code(), instead passes it to exec() with no sandbox: CVE-2026-0770 lets an unauthenticated attacker run arbitrary commands on the server. CVSS 9.8. Added to the CISA KEV catalog on 21 July 2026, with public proof-of-concept code already available. Patch now and keep instances off the public internet.https://spidercivi.github.io/HACK-PROJECT/en/a/wordpress-wp2shell-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/wordpress-wp2shell-en.htmlWed, 22 Jul 2026 08:00:00 +0100WordPress runs a huge share of the public web. Two flaws in its core — a SQL injection in WP_Query (CVE-2026-60137) and a REST API batch-route confusion (CVE-2026-63030) — chained into an exploit dubbed "WP2Shell" let an unauthenticated attacker run code remotely on a default install. Disclosed on 17 July, exploited within days, added to the CISA KEV catalog on 21 July. WordPress shipped patches and force-pushed them via auto-update.https://spidercivi.github.io/HACK-PROJECT/en/a/qilin-danone-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/qilin-danone-en.htmlWed, 22 Jul 2026 08:00:00 +0100The Qilin ransomware group listed Danone on its leak site, claiming it stole roughly 221 GB of data and publishing more than 90,000 files. The claim, dated 17 July 2026, is not currently confirmed by the company: as always with leak sites, the assertion should be treated as a claim until verified. The case is still a chance to look at Qilin's double-extortion model — one of 2026's most active groups — with what the sources actually say and the uncertainties in plain view.https://spidercivi.github.io/HACK-PROJECT/en/a/deepfake-voce-truffe-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/deepfake-voce-truffe-en.htmlWed, 22 Jul 2026 08:00:00 +0100Social engineering remains the most-used way in, and AI has made it cheaper and more convincing: voice cloning can mimic an executive's voice from a few seconds of audio, and generated phishing text lacks the errors that once gave it away. ENISA places phishing and social engineering at the top of the threats. An explainer on what really changes, and why the defense is cultural and procedural before it is technical.https://spidercivi.github.io/HACK-PROJECT/en/a/dora-resilienza-operativa-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/dora-resilienza-operativa-en.htmlWed, 22 Jul 2026 08:00:00 +0100Not an attack, but the resilience framework the European financial sector must hold up under when incidents hit. Regulation (EU) 2022/2554 — DORA, the Digital Operational Resilience Act — has been fully applicable since 17 January 2025. It harmonizes ICT risk management for banks, insurers, crypto-asset providers and many others, mandates incident reporting, resilience testing and third-party risk management — and, through oversight of critical providers, reaches those who serve finance too.https://spidercivi.github.io/HACK-PROJECT/en/a/garante-windtre-sanzione-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/garante-windtre-sanzione-en.htmlWed, 22 Jul 2026 08:00:00 +0100Italy's data protection authority (the Garante) fined Wind Tre €1,715,600 for serious shortcomings in system security. According to the authority, two unauthorized accesses led to the exfiltration of personal data of over 365,000 customers; for 41,359 of them, payment-method data was also touched. The interesting part: the way in was not an exploit but an attacker posing as technical support who talked staff at two retail stores into granting access.https://spidercivi.github.io/HACK-PROJECT/en/a/mfa-resistente-phishing-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/mfa-resistente-phishing-en.htmlWed, 22 Jul 2026 08:00:00 +0100Multi-factor authentication is the most-cited defense against credential theft, but "MFA" is not a uniform category. SMS and push notifications remain vulnerable to phishing and MFA fatigue; only two implementations are considered phishing-resistant by official sources: FIDO2/WebAuthn (passkeys included) and smart-card-based PKI. An explainer on what NIST SP 800-63B and CISA guidance say, and how to adopt it.https://spidercivi.github.io/HACK-PROJECT/en/a/joomla-upload-rce-wave-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/joomla-upload-rce-wave-en.htmlMon, 20 Jul 2026 08:00:00 +0100In a few weeks four widely installed Joomla extensions — SP Page Builder, iCagenda, PageBuilder CK and Balbooa Forms — landed in CISA's catalog of exploited vulnerabilities, all with the same flaw: an endpoint reachable with no login that accepts a file upload without checking its type. The result is a PHP web shell executed on the server. In at least one case the observed payload plants a hidden Super Administrator with an @secure.local email and scatters "PHP File manager" backdoors across several folders. No named actor: what stands out is the same mistake repeated in different products.https://spidercivi.github.io/HACK-PROJECT/en/a/oracle-ebs-payments-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/oracle-ebs-payments-en.htmlMon, 20 Jul 2026 08:00:00 +0100Oracle Payments is the payment engine inside Oracle E-Business Suite: the point where the company's finance applications talk to banks and card networks. CVE-2026-46817 (CVSS 9.8) lets an unauthenticated attacker with only HTTP access compromise and take over the module. The exploit hits the ibytransmit endpoint of the File Transmission component, which invokes an internal Java function directly: patched in late May, the flaw was exploited in the wild from 27 June — before any public PoC — and added to the CISA KEV catalog on 15 July.https://spidercivi.github.io/HACK-PROJECT/en/a/simplehelp-oidc-bypass-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/simplehelp-oidc-bypass-en.htmlMon, 20 Jul 2026 08:00:00 +0100SimpleHelp is remote-support software: whoever controls it controls the computers it manages. CVE-2026-48558 (CVSS 10.0) is an authentication bypass in the OIDC flow: when single sign-on is configured, identity tokens were accepted without verifying their cryptographic signature. A remote, unauthenticated attacker could therefore submit a forged token with arbitrary claims and obtain a full technician session — in some configurations bypassing MFA too. The flaw was exploited in the wild to deliver the TaskWeaver loader and the Djinn stealer, and was added to the CISA KEV catalog on 29 June.https://spidercivi.github.io/HACK-PROJECT/en/a/ransomware-raas-difesa-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/ransomware-raas-difesa-en.htmlMon, 20 Jul 2026 08:00:00 +0100Ransomware today is a service industry, not a lone wolf: operators who rent the malware, affiliates who strike, brokers who sell the initial access. This explainer is not the attack of the day: it lines up what official sources say — CISA with #StopRansomware, Europol with the No More Ransom project, ENISA with its Threat Landscape — on how that chain breaks. The takeaway is less spectacular than a ransom and more useful: you hit the model's economics, not the single group.https://spidercivi.github.io/HACK-PROJECT/en/a/cra-prodotti-digitali-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/cra-prodotti-digitali-en.htmlMon, 20 Jul 2026 08:00:00 +0100Not an attack, but a deadline drawing closer. The Cyber Resilience Act — Regulation (EU) 2024/2847 — has been in force since 10 December 2024, but its obligations arrive in stages. The first concrete block lands on 11 September 2026: from that day, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents, with an early warning within 24 hours and a notification within 72. The bulk of the obligations — essential security requirements, conformity assessment, CE marking — applies instead from 11 December 2027. Anyone who makes or sells software and hardware in the EU has a window that is closing.https://spidercivi.github.io/HACK-PROJECT/en/a/data-breach-72-ore-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/data-breach-72-ore-en.htmlMon, 20 Jul 2026 08:00:00 +0100"You have 72 hours to notify" is the line everyone repeats and few explain. This explainer lines up what the GDPR actually says: when the clock starts, the difference between notifying the supervisory authority (Art. 33) and informing data subjects (Art. 34), why not every breach is notifiable, and the duty that applies regardless — documentation. Not the attack of the day, but the legal frame every personal-data incident eventually meets.https://spidercivi.github.io/HACK-PROJECT/en/a/fattore-umano-social-engineering-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/fattore-umano-social-engineering-en.htmlMon, 20 Jul 2026 08:00:00 +0100Social engineering is among the prime threats in the Union according to ENISA, yet the most common reaction stays the worst: blame whoever clicked. This explainer explains why the "human factor" is not a weak link to scold but a system to design — with verifiable procedures, blame-free reporting and tools that make the deception ineffective. Not the attack of the day, but the culture that decides whether the technical defenses hold.https://spidercivi.github.io/HACK-PROJECT/en/a/nis2-italia-recepimento-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/nis2-italia-recepimento-en.htmlMon, 20 Jul 2026 08:00:00 +0100Not an attack, but the perimeter within which attacks are managed. The NIS2 directive was transposed in Italy by Legislative Decree 138/2024, in force since 16 October 2024. It defines who the "essential" and "important" entities are, what they must do on risk management and incident notification, and how accountability rises to top management. The less obvious point is the cascade onto the supply chain: many companies not directly regulated find the obligations on them because they supply an entity that is.https://spidercivi.github.io/HACK-PROJECT/en/a/fortisandbox-oscmd-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/fortisandbox-oscmd-en.htmlSun, 19 Jul 2026 08:00:00 +0100FortiSandbox is the box where suspicious files are detonated safely. Two unauthenticated OS command injection flaws — one in the WEB UI, one in an API endpoint — let anyone execute commands on the appliance itself. Patched quietly in April and June under a "Known Exploited: No" label, both were added to the CISA KEV catalog on 16 July: a sign someone had started using them, with the patch already months old.https://spidercivi.github.io/HACK-PROJECT/en/a/sonicwall-sma1000-mfa-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/sonicwall-sma1000-mfa-en.htmlSat, 18 Jul 2026 08:00:00 +0100Two zero-days in SonicWall SMA1000 remote-access appliances, chained and exploited before disclosure. The first is an unauthenticated SSRF with a maximum score; the second reaches root. But the detail that matters is what they took: not just passwords, the TOTP MFA seeds and the active session databases — the one thing a reset does not rotate.https://spidercivi.github.io/HACK-PROJECT/en/a/knxlock-bcu-key-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/knxlock-bcu-key-en.htmlFri, 17 Jul 2026 08:00:00 +0100On 15 July 2026 CISA added to the KEV catalog a 2023 CVE describing a 2021 attack. There is no malicious code: the attackers purge a building's KNX devices, then set the BCU key — the password the protocol provides as a protective feature. Vendors replied that no reset exists. No ransom ever arrived.https://spidercivi.github.io/HACK-PROJECT/en/a/fortibleed-inc-lynx-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/fortibleed-inc-lynx-en.htmlThu, 16 Jul 2026 08:00:00 +0100Roughly half of all internet-facing Fortinet firewalls have their admin credentials in the hands of an access broker. There is no CVE to patch: there are exported config files, SHA-256 hashes cracked offline, and perfectly legitimate logins. In July, SOCRadar tied the operation to the INC and Lynx ransomware brands.https://spidercivi.github.io/HACK-PROJECT/en/a/apt28-router-dns-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/apt28-router-dns-en.htmlWed, 15 Jul 2026 08:00:00 +0100APT28 turned thousands of home routers into a wiretapping network aimed at foreign ministries and law enforcement, hijacking DNS to steal already-authenticated OAuth tokens. No exotic malware — just the least-defended infrastructure on earth, and a US court order letting the FBI reach into five thousand privately owned devices to clean them up.https://spidercivi.github.io/HACK-PROJECT/en/a/axios-npm-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/axios-npm-en.htmlWed, 15 Jul 2026 08:00:00 +0100On 31 March 2026 two malicious axios releases added a booby-trapped dependency without touching a single line of source code. npm had rolled out OIDC Trusted Publishing to stop exactly this. The actor walked around it with an old classic token.https://spidercivi.github.io/HACK-PROJECT/en/a/medusa-ummc-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/medusa-ummc-en.htmlWed, 15 Jul 2026 08:00:00 +0100On 19 February 2026 Mississippi's largest health system went dark: 35 clinical sites shut, the state's only Level I trauma center paralysed. But the instructive story isn't how they got in — nobody has made that public — it's how the oncology unit rebuilt a working clinic with no IT at all.https://spidercivi.github.io/HACK-PROJECT/en/a/qilin-checkpoint-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/qilin-checkpoint-en.htmlWed, 15 Jul 2026 08:00:00 +0100A logic flaw in certificate validation during the IKEv1 key exchange let attackers open an authenticated Check Point VPN session without knowing any password. Qilin had been using it for a month before the vendor noticed. But the bug isn't the story — the story is that it only bites organisations that never switched off a dead protocol.https://spidercivi.github.io/HACK-PROJECT/en/a/splunk-cve-2026-20253-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/splunk-cve-2026-20253-en.htmlWed, 15 Jul 2026 08:00:00 +0100CVSS 9.8, pre-auth, RCE. The flaw isn't in Splunk proper but in an internal PostgreSQL component that accepts whatever credential you hand it. A pre-auth hole in the tool companies buy to notice intrusions.https://spidercivi.github.io/HACK-PROJECT/en/a/storm2603-warlock-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/storm2603-warlock-en.htmlWed, 15 Jul 2026 08:00:00 +0100Storm-2603 abuses an authentication bypass in SmarterMail to install Velociraptor as a C2 and stage Warlock ransomware. But the detail that matters surfaced later: inside one compromised network Microsoft found two unrelated crews working in parallel, each unknowingly covering the other's tracks.https://spidercivi.github.io/HACK-PROJECT/en/a/volt-typhoon-ot-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/volt-typhoon-ot-en.htmlWed, 15 Jul 2026 08:00:00 +0100For five years Volt Typhoon hid inside US critical infrastructure and touched nothing. In 2026 Dragos catches it manipulating engineering workstations to learn which conditions halt an industrial process. And it no longer sources its own access — a broker inside its own apparatus hands it over.https://spidercivi.github.io/HACK-PROJECT/en/a/interlock-clickfix-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/interlock-clickfix-en.htmlWed, 15 Jul 2026 08:00:00 +0100Interlock flipped the ransomware script: no phishing, no breached VPN. The victim visits a legitimate compromised site, sees a fake CAPTCHA, and pastes the command that infects them. Anatomy of an attack chain in which the user is the exploit.https://spidercivi.github.io/HACK-PROJECT/en/a/kimsuky-quishing-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/kimsuky-quishing-en.htmlWed, 15 Jul 2026 08:00:00 +0100Kimsuky stopped fighting corporate email filters. It simply changed channel: a QR code forces the victim onto a personal phone, outside the IT perimeter. And it steals the session token rather than the password — so MFA falls without raising a single alert.https://spidercivi.github.io/HACK-PROJECT/en/a/miasma-redhat-npm-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/miasma-redhat-npm-en.htmlWed, 15 Jul 2026 08:00:00 +0100Thirty-two Red Hat npm packages were published with malicious payloads — carrying valid SLSA provenance attestations. The technology built to guarantee build integrity certified the malware, because SLSA attests where a package was built, not whether the build's input was legitimate.https://spidercivi.github.io/HACK-PROJECT/en/a/sharepoint-cve-2026-45659-en.htmlhttps://spidercivi.github.io/HACK-PROJECT/en/a/sharepoint-cve-2026-45659-en.htmlWed, 15 Jul 2026 08:00:00 +0100Microsoft rated it "Exploitation Less Likely". Five weeks later CISA put it in the KEV catalog with a three-day remediation window. A lesson in what vendor exploitability predictions are actually worth.