SURIQCybersecurity news, analyzed for practitioners.
New vulnerabilities, actively exploited flaws, and attack campaigns, explained for the people who run the affected servers: who is exposed, how bad it is, and what to do today.
This backdoor is named after your VMware and EDR tools. Your allowlist trusts it.
A Chinese APT called CL-STA-1062 ships its TinyRCT backdoor disguised as VMware and EDR agents. Why filename allowlists miss it, and what to hunt instead.
SUSE Linux trusted software repositories enough to let one overwrite your system files
SUSE and openSUSE patched seven flaws in their package manager. CVE-2026-25707 lets a malicious repository overwrite system files as root.
libssh2 flaw: a malicious SSH server can hijack the client connecting to it
libssh2's CVE-2026-55200 lets a malicious SSH server run code on the client that connects to it. No login, a public PoC is out, and there is no tagged fix yet.
Hotels are running malware on a legitimate Node.js runtime, and that beats allowlisting
TonRAT runs on a genuine Node.js runtime on hotel front-desk machines, hides its C2 on the TON blockchain, and slips past allowlists. Here is what to hunt.
A seized iPhone gave up everything. The MacBook beside it gave up nothing.
Cellebrite's UFED tool fully read a locked iPhone in Russian custody but failed on the encrypted MacBook seized beside it.
Linux's newest root exploits rewrite /bin/su in memory and leave the file clean
DirtyClone and pedit COW are the latest in a family of Linux kernel root bugs that rewrite binaries in memory, invisible to file-integrity monitoring.
A rigged 7-Zip archive can erase the Windows warning on downloaded files, and there is no fix yet
A crafted RAR5 archive lets 7-Zip 26.02 strip the Mark-of-the-Web, defeating Windows SmartScreen warnings. No patch exists yet.
Signal's recovery key never expires, and Russian intelligence is now phishing for it
Russian intelligence is phishing Signal users for the Backup Recovery Key, a secret that decrypts a whole message history and that no reset or new account can
Polymarket's servers were never hacked. A poisoned vendor script still stole $3 million from users.
A compromised third-party vendor injected malicious code into Polymarket's site and stole nearly $3 million from users. The backend was never breached.
What is MITRE ATT&CK? Tactics, techniques, and how defenders actually use it
A plain-English guide to MITRE ATT&CK: what it is, how its tactics and techniques are organized, a real intrusion mapped step by step, and how defenders use it.
What is a SIEM, in plain terms (and how it differs from a SOC and EDR)
What a SIEM is, what it actually does, and how it differs from a SOC, an EDR, and plain log management - explained by a team that runs one.
Open the wrong repo and Amazon Q ran its config file as you, AWS keys included
Amazon Q Developer ran a repo's MCP config file as you, with AWS keys attached. CVE-2026-12957 is patched in 1.69.0. What to verify and hunt for now.
The dangerous vulnerabilities this week were already old.
The vulnerability classes that actually shipped this week are the same five from 2010, even in new AI tooling. The pattern, and what to do.
A widely used PHP tool for making PDFs can hand attackers your internal files and cloud keys
php-weasyprint's attachment option fetched attacker-controlled URLs server-side, reaching internal services, cloud metadata, and local files.
Russia's Turla built a new backdoor for one reason: deleting one tool will not evict them
Google tied Russia's Turla to STOCKSTAY, a new .NET backdoor built as four swappable parts. Why deleting one piece does not evict the group, and what to hunt.
Windchill holds your product blueprints. A web shell on its login page hands them over.
CISA added PTC Windchill RCE CVE-2026-12569 to its KEV catalog after web shells hit exposed PLM servers. Patch to 11.0 M030 before the June 28 deadline.
Mistic backdoor writes nothing to disk and quietly sells your network to ransomware crews
Mistic is an in-memory backdoor that access broker KongTuke uses to hold footholds and sell them to Qilin and other ransomware crews. Here is where to catch it.
One setting in Red Hat OpenShift Virtualization can expose your VMs to any pod on the cluster
CVE-2026-13325: enabling disableTLS for faster live migration in Red Hat OpenShift Virtualization drops authentication, letting any pod reach another tenant’s
GitLab patched a no-login flaw that can hijack a user's session. Self-hosted servers are the exposed ones.
GitLab's June 24 release fixes 14 flaws, including an unauthenticated cross-site scripting bug.
A free GitHub account can push code as a trusted maintainer. Upgrading actions/checkout won't fix it.
Cordyceps lets anyone with a free GitHub account run code as a maintainer on 300+ repos. Why upgrading actions/checkout closes one door, not the others.
Two flaws in Unraid's control panel let a logged-in user seize the whole server
Two command injection flaws in Unraid's web panel, CVE-2026-9772 and CVE-2026-9773, let any logged-in user run code as www-data.
A rigged container image can seize root on the host running Docker's AI agent tools
CVE-2026-55887 lets a malicious container image escape Docker's MCP Gateway and run code as root on the host. Rated 8.7.
A new flaw lets attackers take over Quest NetVault backup servers, login or not
CVE-2026-7570 is a SQL-injection-to-remote-code-execution flaw in Quest NetVault Backup, rated 8.8. The login can be bypassed. Quest fixed it in 14.0.2.
Police seized the malware that stole 27 million passwords. The passwords still work.
Operation Endgame seized the servers behind the Amadey and StealC malware, but the 27 million credentials they already stole stay valid until you rotate them.
See what Suriq finds on your own servers.
Suriq watches the machines you run, ranks what it finds into incidents, and explains each one in plain English, with fixes proposed for your team to approve.