Crow's Nest on Black Lantern Security: Crow's Nest

Crow's Nest - 2026-07-29

Wed, 29 Jul 2026 00:00:00 +0000

A roundup of 448 items curated from across the security community.

News

CVE-2026-12118: IBM webMethods Integration Server Vulnerability.

Black Lantern Security discovered and reported this vulnerability in IBM webMethods Integration Server. Full technical writeup with reproduction steps.

LG Bans Residential Proxy Apps from Smart TVs.

Krebs reports LG will suspend smart TV apps that turn televisions into residential proxy nodes. Over 42 percent of webOS store apps were found routing third-party traffic through users’ devices.

Crow's Nest - 2026-07-20

Mon, 20 Jul 2026 00:00:00 +0000

A roundup of 312 items curated from across the security community.

News

EU Exposes FSB Centre 16 as Controller of TURLA Operations by thaddeus e. grugq.

The EU formally attributes TURLA and related cyber operations to the FSB’s 16th Centre, alongside its broadest cyber sanctions package yet targeting Russian-linked actors.

Microsoft July Patch Tuesday: Record 570 Flaws, 3 Zero-Days by BleepingComputer.

The largest Patch Tuesday ever. 570 fixes including 3 zero-days (2 actively exploited) and 141 RCE flaws. Microsoft attributes the surge to AI-assisted vulnerability discovery.

Crow's Nest - 2026-07-13

Mon, 13 Jul 2026 00:00:00 +0000

A roundup of 265 items curated from across the security community.

BBOT 3.0: Rust-Powered Recon with 15x Faster DNS

The biggest BBOT release ever. Core DNS and HTTP engines rewritten from scratch in Rust, delivering 15x faster DNS resolution and FFUF-class directory brute-forcing without leaving the BBOT process. New modules, native SIEM outputs, ASN targeting via the BBOT.IO API Hub, and reworked scoping. Free and open source.

Read more

News

KDDI Breach Exposes Data of 12 Million Japanese Customers by BleepingComputer.

Japanese telecom giant KDDI confirms a data breach affecting 12 million customer records, one of the largest telecommunications breaches in recent years.

Crow's Nest - 2026-07-06

Mon, 06 Jul 2026 00:00:00 +0000

A roundup of 160 items curated from across the security community.

News

FBI PSA: TeamPCP Data Extortion Group Behind Longest Supply-Chain Hack Streak.

FBI releases a PSA on TeamPCP, a data extortion group responsible for the longest running streak of software supply-chain hacks on record, including compromises of Trivy, CheckMarx, LiteLLM, and at least 3,800 GitHub repositories.

Iranian Hacker Arrested for IRGC-Backed University IP Theft Campaign by Kim Zetter.

An Iranian hacker arrested in Montenegro for hacking over 100 US universities on behalf of the IRGC highlights Iran’s shift toward economic espionage and intellectual property theft.

Crow's Nest - 2026-07-02

Thu, 02 Jul 2026 00:00:00 +0000

A roundup of 277 items curated from across the security community.

News

Scattered Spider Hackers Plead Guilty on Day 1 of Trial https://krebsonsecurity.com/2026/06/scattered-spider-hackers-plead-guilty-on-day-1-of-trial/ by Nicolas Krassas.

Multiple Scattered Spider members plead guilty on the first day of their federal trial.

TanStack npm Supply Chain Attack Bypasses SLSA Provenance Verification.

42 TanStack packages published with valid SLSA provenance by stealing OIDC tokens from GitHub Actions runner memory. Provenance verification alone no longer guarantees integrity.

Crow's Nest - 2026-06-22

Mon, 22 Jun 2026 00:00:00 +0000

A roundup of 126 items curated from across the security community.

News

Mastra-AI npm Supply Chain Attack Hits 80+ Packages by Dave Kennedy.

An attacker hijacked npm accounts to inject a phantom dependency into 80+ Mastra-AI packages. The malicious payload arrived via a “dayjs” typosquat that ran a post-install script to download and execute a remote binary.

Operation Endgame Dismantles SocGholish Infrastructure by SwitHak ().

International law enforcement took down 100 servers and domains, remediating nearly 15,000 websites. SocGholish’s “FakeUpdates” web inject framework has been a persistent ransomware delivery vector since 2018.

Crow's Nest - 2026-06-15

Mon, 15 Jun 2026 00:00:00 +0000

A roundup of 292 items curated from across the security community.

News

Microsoft Packages Laced with Credential Stealer for Second Time in Weeks by Nicolas Krassas.

For the second time in weeks, official Microsoft packages were found laced with credential-stealing malware, raising serious questions about supply chain integrity in the Microsoft ecosystem.

AI Misidentification Leads to Wrongful Arrest, Months in Prison by Kim Zetter.

AI facial recognition identified Jalil Richardson with only 85% accuracy. Police never checked his alibi. He spent months in prison and lost his job, home, and child custody before police admitted the AI was wrong.

Crow's Nest - 2026-06-08

Mon, 08 Jun 2026 00:00:00 +0000

A roundup of 44 items curated from across the security community.

News

UN food agency breach exposes 600,000 Gaza households by Nicolas Krassas.

The UN World Food Programme discloses a data breach affecting 600,000 households in Gaza.

UNC3753 targets US law firms with vishing and physical intrusion by scriptjunkie (Matt).

Mandiant details UNC3753 using vishing and RMM tools for data extortion against US law firms, with some operators attempting in-person theft.

CISA: SolarWinds Serv-U flaw now actively exploited by BleepingComputer.

CISA adds an actively exploited SolarWinds Serv-U vulnerability to the KEV catalog.

Crow's Nest - 2026-06-04

Thu, 04 Jun 2026 00:00:00 +0000

A roundup of 89 items curated from across the security community.

News

Hackers Used Meta’s AI Support Bot to Seize Instagram Accounts by BrianKrebs.

Pro-Iran hackers hijacked high-profile Instagram accounts, including the Obama White House, by tricking Meta’s AI support bot into resetting passwords with a spoofed hometown IP.

Dutch police dismantle a 17-million-device botnet.

Dutch police and the NCSC dismantled a 17-million-device botnet operating on 200 servers seized from a local hosting provider.

Crow's Nest - 2026-05-28

Thu, 28 May 2026 00:00:00 +0000

A roundup of 82 items curated from across the security community.

News

Active exploitation of a Cisco Catalyst SD-WAN auth bypass (CVE-2026-20182) by Cisco Talos.

Talos is tracking in-the-wild exploitation of CVE-2026-20182, an authentication bypass in Cisco Catalyst SD-WAN Manager and Controller.

Pwn2Own Berlin 2026: DEVCORE takes Master of Pwn by Dustin Childs.

DEVCORE took Master of Pwn at Pwn2Own Berlin 2026, capping an event that paid $1,298,250 for 47 zero-days. Orange Tsai chained three bugs to RCE as SYSTEM on Exchange for $200,000.

Crow's Nest - 2026-05-18

Mon, 18 May 2026 00:00:00 +0000

A roundup of 44 items curated from across the security community.

News

Bleeding Llama: unauthenticated memory leak in Ollama (CVE-2026-7482).

Cyera Research uncovers a critical pre-auth memory disclosure in Ollama. Self-hosted LLM gateways leak adjacent buffer contents to anyone who can hit the API.

More this week (2)

Crow's Nest - 2026-05-11

Mon, 11 May 2026 00:00:00 +0000

A roundup of 54 items curated from across the security community.

News

Apache ActiveMQ CVE-2026-40466 exploited in the wild by kmkz.

VulnCheck sees CVE-2026-40466 burning in active campaigns: authenticated RCE in ActiveMQ via the vm:// protocol, a bypass of the original CVE-2026-34197 fix. 2,700+ exposed instances on Shodan.

Mythos: a long-form look at the stakes, impact, and PR by Kuba Gretzky.

Ivan Kwiatkowski’s deep-dive cuts through weeks of hot takes about Anthropic’s Mythos: what the actual capability claims are, what they mean for the bug-finding economy, and what the rollout did to industry trust.

Crow's Nest - 2026-05-08

Fri, 08 May 2026 00:00:00 +0000

A roundup of 189 items curated from across the security community.

News

Claude Mythos Has Found 271 Zero-Days in Firefox by Bruce Schneier.

271 Firefox bugs found by Claude Mythos in collaboration with Mozilla. Schneier breaks down the disclosure and what it means for browser security at scale.

Defender for Endpoint: restrict response actions on high-value assets by Sean Metcalf.

Defender for Endpoint adds a public preview to restrict live response actions on high-value assets. The control SOC analysts running scripts as SYSTEM on tier 0 boxes have been asking for.

Welcome to the Crow's Nest

Wed, 06 May 2026 00:00:00 +0000

Welcome aboard. Crow’s Nest is a curated roundup of security news, techniques, tools, and exploits, published by Black Lantern Security.

What You Can Expect

Each edition will cover:

News: meaningful security news from across the community.
Techniques and Write-ups: interesting research, blog posts, and analyses.
Tools and Exploits: new offensive and defensive tooling, PoCs, and exploits.

An editor reads and selects every item that lands here. Automation handles the heavy lifting of scraping feeds and keeping tabs on the community, but every post is curated by hand. New editions land when there is enough worth covering, not on a fixed schedule.