This printer found 80+ assets our initial reconnaissance didn’t. Yes. A printer. During one OSec engagement, default community strings exposed information from network devices. A single multifunction printer then revealed 80+ additional hosts that initial reconnaissance had missed. That helped build a map toward systems that actually mattered. The lesson isn’t “printers are scary.” It’s that attackers don’t divide your environment into important assets and boring assets. They see paths. Printers. Building systems. Forgotten management interfaces. Test environments. Old infrastructure. Anything that provides information or access can become part of the attack chain. Cybersecurity Awareness Month question: What’s the weirdest thing you’ve ever seen become useful in an attack path? There are a few more surprisingly boring examples in our 2026 report. Read The Boring AI Apocalypse → hubs.la/Q04zcFVy0 #CybersecurityAwarenessMonth #Cybersecurity #AttackSurface #OffensiveSecurity

This week in threat intel: a FortiMail zero-day with no patch and 32,000 exposed hosts, a Citrix SAML flaw under active attack, and three country-code TLDs hijacked to mint trusted HTTPS certificates. OSec’s latest Weekly Situation Report covers the threats and vulnerabilities our team is tracking, including: → A FortiMail path traversal zero-day (CVE-2026-104286) allowing arbitrary file writes through GUI panels with IBE enabled, actively exploited with roughly 32,000 hosts exposed and no fix for every branch → A Citrix NetScaler SAML zero-day (CVE-2026-88779) exploited against US-based assets, with reports of multi-stage backdoor malware still being verified → The hijack of the .gh, .sl and .as ccTLDs, where attackers took control of DNS and obtained unauthorized HTTPS certificates that would have bypassed browser warnings → An Atlassian Data Center path traversal flaw (CVE-2026-21589) drawing exploit attempts within hours of public research, with Crowd deployments at highest risk → A second Citrix NetScaler flaw (CVE-2026-107406) in SAML SP and IdP configurations, not yet exploited but assessed as likely within 30 days Our researchers break down what happened, who may be exposed, and the actions security teams should consider. Read the full Weekly Situation Report: hubs.la/Q04Bjv6m0 #ThreatIntelligence #CyberSecurity #VulnerabilityManagement #ThreatResearch

We’re proud to share that OSec has been named AEV Solution of the Year in the 2026 CyberSecurity Breakthrough Awards. Attackers don’t wait for your annual pen test. Incenter, our unified exposure management platform, brings together continuous pen testing, attack surface management, vulnerability management and threat intelligence so security teams can see what’s actually exploitable and fix it first. Thank you to the CyberSecurity Breakthrough team, our clients, and the OSec team who make this work every day. Proud to be named alongside this year’s winners: lnkd.in/eGHw3Xq8 #CyberSecurity #AEV #ExposureManagement #PenTesting #CyberSecurityBreakthrough

2026 was supposed to be the year AI changed cybersecurity. It did. Just not quite in the way everyone expected. Across more than 32,000 vulnerabilities OSec found and validated this year, the things that actually created serious exposure were often remarkably familiar: - Default credentials. - Insecure configurations. - Identity failures. - Outdated software. - Missing protections. - Trusted systems doing exactly what they were designed to do. AI showed up too. But more often as another layer of exposure, noise and complexity than as the autonomous cyber attacker everyone had been waiting for. So we went back through what our offensive security teams, vulnerability research and threat intelligence actually saw across 2026. The result is our new report: The Boring AI Apocalypse What Actually Compromised Organizations in 2026 (Hint: Not AI) Inside, we look at what attackers actually exploited, what organizations fixed, where AI really changed the picture, and what security teams should prioritize heading into 2027. Read the report → hubs.la/Q04zcpVz0 #CybersecurityAwarenessMonth #Cybersecurity #AIsecurity #OffensiveSecurity #ExposureManagement

If you run F5 BIG-IP APM as an OAuth authorization server, patch today. CVE-2026-94127 is a pre-auth heap overflow in the Authorization header on APM OAuth profile endpoints. A single request with an oversized payload in place of a bearer token is enough to take the appliance at OS level. CISA has it in the Known Exploited Vulnerabilities catalog, and now that the research is public the barrier to exploitation has dropped for ransomware and extortion crews. Our team has seen a clear uptick in probing for F5 devices across public honeypots in the last 24 hours. Affected: BIG-IP APM 21.1.0, 17.5.0 to 17.5.1, and 17.1.0 to 17.1.3 What to do now: → Apply the vendor patch → Check /var/log/apm for invalid token errors and unattributable OAuth failures → Look for oversized bearer tokens from unfamiliar source IPs → Audit the appliance for rogue accounts and unknown files Our researchers published the full alert, including the request pattern and log examples, in Incenter. Reach out to our team if you want the detail or help checking your estate. hashtag#ThreatIntelligence hashtag#CyberSecurity hashtag#VulnerabilityManagement hashtag#F5

This week in threat intel: a Cisco email gateway zero-day that runs commands as root, ransomware crews breaking into firewall management, and a compromised marketing platform pushing malicious WordPress plugins. OSec's latest Weekly Situation Report covers the threats and vulnerabilities our team is tracking, and break down what happened, who may be exposed, and the actions security teams should consider. Read the full Weekly Situation Report: osec.com/resources/threat-br… #ThreatIntelligence #CyberSecurity #VulnerabilityManagement #ThreatResearch

This week in threat intel: a fake IT help desk on Microsoft Teams, malware taking orders from FTP server banners, and Iranian espionage infrastructure spreading across five new countries. OSec's latest Weekly Situation Report covers the threats our team is tracking, including: → SynkLoader, a modular loader delivered through Teams phishing that impersonates IT help desk, then uses a fake Windows 11 lock screen to harvest credentials → E4del, a RAT disguised as Discord that pulls PowerShell commands out of FTP server banners as a dead drop → PINHOLE, a credential stealer that retrieves its C2 configuration from Pinterest and SurveyMonkey while leaving almost no host footprint → Nimbus Manticore (Tortoiseshell) standing up new infrastructure in the UK, Belgium, Saudi Arabia, Japan and the UAE, using DLL side-loading and reverse SSH tunnels against defense, technology and aviation targets Our researchers break down what happened, who may be exposed, and the actions security teams should consider. Read the full Weekly Situation Report: osec.com/resources/threat-br… #ThreatIntelligence #CyberSecurity #ThreatResearch #MalwareAnalysis

Most security reviews look at developer tools one at a time. But what happens when the trust between those tools starts working together? OSec’s latest research, Ouroboros, looks at how trusted execution paths across developer ecosystems can recreate one another’s state — even after individual components are removed. The interesting part isn’t a new vulnerability in one tool. It’s what emerges when multiple legitimate trust relationships are connected. Sometimes the persistence isn’t in the tool. It’s in the trust between them. Read the research: osec.com/resources/blog/ouro… #CyberSecurity #SecurityResearch #SupplyChainSecurity #AppSec #AISecurity

This week in threat intel: espionage in VMware environments, an unpatched zero-day, and malware hiding its entire C2 inside Microsoft 365. OSec's latest Weekly Situation Report covers the threats and vulnerabilities our team is tracking, including: → Likely China-nexus actors exploiting VMware vCenter (CVE-2026-59310) for persistent reverse SSH access, with overlap into SharePoint exploitation → An unpatched GeoServer zero-day already being probed in the wild → TWINLOOT abusing Microsoft 365 services, Teams TURN relays, and NTUSER.MAN for stealthy persistence → An MLflow SSRF flaw (CVE-2026-64849) exploited to steal cloud credentials → A critical Windows IKE RCE (CVE-2026-33824) under active exploitation, now flagged by CISA → A GitLab flaw (CVE-2026-19478) letting unauthenticated users modify or delete repositories Our researchers break down what happened, who may be exposed, and the actions security teams should consider. Read the full Weekly Situation Report: osec.com/resources/threat-br… #ThreatIntelligence #CyberSecurity #VulnerabilityManagement #ThreatResearch

Your AI dev tools trust more than your code. Repos, configs, external services. Attackers don’t need an exploit if they can influence what your tools already trust. Read more:osec.com/resources/blog/trus… #AISecurity #SupplyChainSecurity #CyberSecurity

You didn’t build it. You own it anyway. Almost nothing a security team defends was actually built by that team. Acquisitions, subsidiaries, vendors, platforms. You inherit the risk, and eventually, someone puts a price on it. On September 23, we’re teaming up with Interfor International to talk inherited security risk: what gets uncovered, what actually gets fixed, and where accountability lands. 📅 September 23 | 2:00–3:00 PM ET 💻 45-minute conversation + Q&A If you’ve ever inherited an environment and been told to make it secure, this conversation is for you. Register here: hubs.la/Q04ttj610 #CyberSecurity #MergersAndAcquisitions #CISO #RiskManagement

We're excited to announce a new partnership: OSec + Faction Networks 🤝 Zero Trust is only as good as the proof behind it. That's why we're teaming up with Faction Networks to build continuous, independent verification directly into their networking platform, so organizations don't just deploy Zero Trust, they can actually demonstrate it's holding up. For small and mid-sized organizations especially, that kind of independent validation has been hard to come by, and it's exactly what the cyber insurance market is starting to demand. This partnership closes that gap. More to come as we build this out together. Read more: lnkd.in/gsijEG7G #CyberSecurity #ZeroTrust #CyberInsurance

Somewhere out there is a man who cannot be found. His name is Christian Kimball, and evading capture is what he does best. We're going to find him. And we're going to need your help to do it. Operation W.I.T.W.I.C.K. begins soon. Watch this space. 🕵️ #WITWICK #BHUSA