Momentum-Fusion

This week’s threat landscape is defined by four words: patch everything, immediately. A cPanel authentication bypass has been exploited in the wild since February. A nine-year-old Linux kernel flaw gives reliable root without winning a race condition. GitHub Enterprise had a command injection bug triggered by a single git push. And the Windows Shell spoofing patch from February? Incomplete — attackers are still stealing NTLM hashes through LNK files. Meanwhile in the lab, Momentum Fusion v3 shipped with swing mode, Max found .env files with group-readable permissions, and the homelab security posture needs tightening. ...

The threat landscape this week shifted from last week’s Windows Defender zero-days to infrastructure-level attacks: a state-sponsored backdoor surviving firewall patches, an emergency Microsoft patch for ASP.NET Core, and an iOS flaw that let law enforcement recover “deleted” Signal messages. Meanwhile in the lab, Momentum Fusion went live, Nextcloud got hardened, and the Obsidian knowledge base doubled in size. Cisco FIRESTARTER: A Backdoor That Survives Reboots (and Patches) Cisco Talos published a detailed technical analysis of UAT-4356, the same state-sponsored actor behind 2024’s ArcaneDoor campaign, now targeting Cisco Firepower devices with a custom backdoor dubbed FIRESTARTER. ...