The Digital Warfare Podcast

Digital Warfare
  • 0.0 (0)
  • Technology

The Digital Warfare Podcast dives into the untold stories of digital defense. Join the anonymous hacker and his clients for raw, revealing conversations on the front lines of cybersecurity.

  1. 1d ago

    EP. 147: CVE-2026-64849 Turns MLflow Into a Cloud Credential Theft Path

    SummaryCVE-2026-64849 is a critical unauthenticated SSRF vulnerability in MLflow’s webhook delivery functionality. A remote attacker can bypass URL validation using HTTP redirects or DNS rebinding, causing the MLflow server to access internal services or cloud metadata endpoints and return the response content. The flaw carries a CVSS score of 9.3. The vulnerability affects MLflow releases before 3.15.0. The corrected implementation validates the actual connection peer, including redirect destinations, closing the path to internal and metadata services. Organizations should patch immediately, inventory exposed MLflow systems, review webhook activity and outbound connections, and rotate cloud credentials where exploitation is suspected. Key Takeaways• CVE-2026-64849 is a critical MLflow SSRF vulnerability rated CVSS 9.3 • The attack requires no authentication or user interaction on vulnerable default deployments • HTTP redirects can bypass the original destination validation • Attackers may read responses from cloud metadata services and internal-only systems • Cloud IAM credentials exposed through metadata services may expand the compromise beyond MLflow • All MLflow deployments before 3.15.0 should be upgraded • Exposed systems require investigation, credential review, IAM auditing, and network-access validation KeywordsMLflow, CVE-2026-64849, MLflow vulnerability, SSRF, server-side request forgery, cloud credential theft, IAM credentials, cloud metadata, MLOps security, AI infrastructure security, webhook security, internal network access, CVSS 9.3, cloud security, vulnerability management, incident response, Digital Warfare Podcast, cybersecurity, threat intelligence

  2. 3d ago

    EP. 146: How a Private APN Became a Backdoor Into a Polish Power Plant

    SummaryA destructive cyberattack against a Polish combined heat and power facility demonstrated a previously undocumented attack path through a private cellular APN. The attackers first compromised infrastructure at a separate wind farm, accessed a cellular router, tunneled into the private APN, discovered a WAGO PLC at the CHP plant, and used that controller as a gateway into the plant’s OT network. After roughly a week of reconnaissance, the attackers manipulated Siemens PLCs, shutting down a steam turbine and process-water treatment system. Operators restored operations before customers lost heat or electricity. Attackers also altered industrial network devices and deliberately damaged equipment and logs to obstruct investigation and recovery. The incident demonstrates why private APNs must not automatically be treated as trusted networks. Industrial operators should apply segmentation, client isolation, strict allowlisting, credential hygiene, centralized logging, and continuous monitoring to any network providing connectivity into OT environments. Key Takeaways• Attackers moved from a compromised wind-farm network into a separate energy facility through a private APN • Investigators believe this is the first publicly documented real-world cyberattack using a private APN as an OT lateral-movement path • A Teltonika cellular router was used to establish an SSH tunnel into the private APN • A WAGO PFC200 controller using default administrator credentials became the next pivot into the CHP plant’s OT network • Attackers manipulated Siemens PLCs and shut down a steam turbine and water-treatment process • Industrial networking equipment was deliberately reconfigured and damaged to slow recovery and destroy evidence • Private APNs should be treated as untrusted networks and protected through segmentation, client isolation, allowlisting, monitoring, and strong credential controls Keywordsprivate APN attack, Polish energy cyberattack, operational technology security, OT security, ICS attack, SCADA security, WAGO PFC200, Siemens PLC, FortiGate, Teltonika RUTX50, SSH tunneling, lateral movement, industrial sabotage, private cellular network, critical infrastructure, network segmentation, default credentials, energy sector cybersecurity, Digital Warfare Podcast, threat intelligence

  3. 6d ago

    EP. 146: CRPx0 Is Rewriting the Ransomware Business Model

    SummaryCRPx0 has emerged as a rapidly expanding ransomware operation, increasing from fewer than 10 claimed victims in June to 46 claimed victims in July 2026. Across the wider ransomware ecosystem, 873 claimed victims were recorded during July, reportedly the third-highest monthly level over the previous 12 months. These figures are based on ransomware claims and should not be interpreted as independently confirmed breaches. Technical research shows that CRPx0's capabilities extend beyond encryption. Its multi-stage architecture can target Windows and macOS, maintain C2 communications, steal cryptocurrency through clipboard manipulation, search for wallet recovery phrases, exfiltrate valuable files, and ultimately perform double-extortion ransomware attacks. Its emerging white-label model is particularly important because it could make attribution based on ransomware branding less reliable. Defenders should therefore prioritize behavioral detection over identifying individual ransomware families. Key Takeaways• CRPx0 reportedly increased from fewer than 10 claimed victims in June to 46 in July. • The wider ransomware ecosystem recorded 873 claimed victims in July, although leak-site claims should not automatically be treated as verified breaches. • CRPx0 uses a multi-stage architecture capable of targeting Windows and macOS systems. • Its capabilities include cryptocurrency clipboard hijacking, recovery-phrase harvesting, data exfiltration, command and control, persistence, and ransomware deployment. • CRPx0 combines multiple monetization mechanisms rather than relying exclusively on file encryption. • Its reported white-label RaaS approach could make individual incidents appear unrelated even when they share underlying criminal infrastructure. • Security teams should hunt attacker behaviors rather than relying primarily on ransomware family names. KeywordsCRPx0, CRPx0 ransomware, ransomware, ransomware-as-a-service, RaaS, white-label ransomware, double extortion, cryptocurrency theft, clipboard hijacking, seed phrase theft, Python malware, data exfiltration, cross-platform malware, Windows malware, macOS malware, ransomware affiliates, threat intelligence, incident response, Digital Warfare Podcast, cybersecurity

  4. Aug 13

    EP. 145: VMware vCenter Under Attack: CVE-2026-59310 Enables Persistent Access

    SummaryCVE-2026-59310 is a critical directory traversal vulnerability in VMware vCenter Server’s Syslog component that can allow a remote attacker with network access to execute arbitrary code. Broadcom rates the flaw CVSS 9.8 and provides no workaround, making patching the required remediation. Active exploitation began shortly after the July 29 disclosure. More than 360 compromised IP addresses were subsequently observed across 47 countries, with attackers deploying the open-source reverse_ssh framework to establish persistent outbound command-and-control access. Organizations should patch immediately and investigate exposed vCenter systems for suspicious binaries, outbound SSH connections, unauthorized administrative activity, and evidence that attackers accessed ESXi hosts, virtual machines, credentials, or other connected infrastructure. Key Takeaways• CVE-2026-59310 affects VMware vCenter Server’s Syslog component. • Broadcom assigns the vulnerability a CVSS score of 9.8. • Attackers with network access to vCenter can exploit the flaw to execute arbitrary code without authentication. • Active exploitation began within days of the vulnerability’s public disclosure. • More than 360 compromised IP addresses across 47 countries have been observed, although IP counts do not equal confirmed victim organizations. • Attackers are deploying reverse_ssh to create persistent outbound remote-access channels. • Broadcom provides no workaround, so affected organizations must patch and investigate for compromise. KeywordsVMware vCenter, CVE-2026-59310, vCenter vulnerability, VMware RCE, directory traversal, reverse SSH, reverse_ssh, CVSS 9.8, active exploitation, virtualization security, ESXi security, management plane compromise, remote code execution, persistence, incident response, vulnerability management, Digital Warfare Podcast, cybersecurity, threat intelligence

  5. Aug 11

    EP. 144: The Metabase Zero-Day That Turns Analytics Into a Database Attack Path

    SummaryAn actively exploited Metabase vulnerability tracked as GHSA-vwf4-m7j8-wcjf allows unauthenticated remote attackers to inject arbitrary SQL into the platform’s application database. The issue carries a CVSS 10.0 rating and currently has no assigned CVE identifier. Successful exploitation can provide administrator access, allow configuration changes, expose credentials for connected databases, and enable attackers to read or export data reachable through those connections. The vendor has confirmed active exploitation. Organizations should upgrade to the fixed release for their branch immediately. Systems with the vulnerable endpoint exposed publicly should also undergo session revocation, API-key review, administrator auditing, database credential rotation, and investigation of query and warehouse logs. Key Takeaways• GHSA-vwf4-m7j8-wcjf is a critical unauthenticated SQL injection vulnerability affecting Metabase • The vulnerability carries the maximum CVSS score of 10.0 • No CVE identifier has been assigned at the time of this briefing • Active exploitation has been confirmed by the vendor • Successful exploitation can lead to Metabase administrator access • Attackers may obtain stored credentials for connected databases and access data beyond the Metabase platform itself • Fixed releases are x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, and x.63.5 KeywordsMetabase, GHSA-vwf4-m7j8-wcjf, Metabase zero-day, SQL injection, unauthenticated SQL injection, CVSS 10.0, active exploitation, business intelligence security, database credential theft, administrator access, data exfiltration, database security, application security, vulnerability management, incident response, Digital Warfare Podcast, cybersecurity, threat intelligence

  6. Aug 10

    EP. 143: CVE-2026-8037 Turns LoadMaster Into a Pre-Authentication Attack Path

    SummaryCVE-2026-8037 is a critical command injection vulnerability affecting Progress Kemp LoadMaster and related ADC products. It allows an unauthenticated attacker to execute arbitrary operating-system commands through unsanitized input sent to vulnerable command endpoints. Progress rates the flaw CVSS 9.6, while NIST assigns a 9.8 score. CISA has now classified the vulnerability as actively exploited. Progress fixed the issue in LoadMaster 7.2.63.2 GA and 7.2.54.18 LTSF, both released June 4, 2026. Organizations should patch immediately, restrict administrative access, investigate exposed appliances for evidence of compromise, and review downstream applications and credentials if vulnerable systems were reachable from untrusted networks. Key Takeaways• CVE-2026-8037 is a critical operating-system command injection vulnerability affecting Progress Kemp LoadMaster • The flaw can be exploited without authentication or user interaction • Progress rates the vulnerability CVSS 9.6, while NIST rates it 9.8 • CISA has confirmed active exploitation by adding the vulnerability to its Known Exploited Vulnerabilities catalog • Fixed LoadMaster releases include 7.2.63.2 GA and 7.2.54.18 LTSF • LoadMaster appliances are particularly valuable targets because they often sit directly in front of critical enterprise applications • Internet-facing vulnerable appliances should be treated as potential incident-response cases, not simply patch-management tasks KeywordsCVE-2026-8037, Progress Kemp LoadMaster, LoadMaster vulnerability, command injection, remote code execution, unauthenticated RCE, CISA KEV, active exploitation, application delivery controller, ADC security, load balancer security, edge infrastructure, perimeter security, vulnerability management, incident response, enterprise cybersecurity, threat intelligence, Digital Warfare Podcast

  7. Aug 6

    EP. 142: How CVE-2026-12569 Turned Windchill Into a Ransomware Gateway

    SummaryCVE-2026-12569 is a critical unauthenticated remote code execution vulnerability affecting PTC Windchill PDMLink and FlexPLM. The flaw involves deserialization of untrusted data and carries a CVSS 4.0 score of 9.3 and a CVSS 3.1 score of 9.8. The vulnerability has been exploited to deploy persistent JSP web shells, and recent reporting associates some activity with a Cl0p ransomware affiliate. PTC has released patches, indicators of compromise, detection guidance, and repeated urgent remediation notices. Organizations should patch immediately, reduce internet exposure, inspect login directories and HTTP logs, investigate known indicators, and treat identified web shells or suspicious requests as evidence of potential compromise rather than a routine vulnerability-management event. Key Takeaways• CVE-2026-12569 enables unauthenticated remote code execution in PTC Windchill and FlexPLM. • The vulnerability involves unsafe deserialization of attacker-controlled data. • Exploitation has been confirmed, with recent activity associated with ransomware operations. • Attackers have deployed persistent JSP web shells inside Windchill login directories. • Key indicators include hexadecimal JSP filenames, the X-windchill-req header, and the flst.txt file. • Windchill compromise may expose engineering designs, product records, supplier information, and intellectual property. • Organizations must combine immediate patching with threat hunting, evidence preservation, credential rotation, and incident response. KeywordsPTC Windchill, FlexPLM, CVE-2026-12569, unsafe deserialization, remote code execution, ransomware, Cl0p, JSP web shell, product lifecycle management, PLM security, intellectual property theft, manufacturing security, supply-chain risk, incident response, vulnerability management, Digital Warfare Podcast, cybersecurity, threat intelligence

  8. Aug 4

    Digital Warfare Podcast Daily Brief #141 August 04, 2026

    SummaryResearchers disclosed three attack techniques collectively known as Pass-ta-key, targeting Google Password Manager’s synced passkeys in Chrome on Windows systems with TPM support. The techniques require malware to already be running on the endpoint and do not break passkey cryptography. Instead, they exploit device-trust, onboarding, recovery, and validation weaknesses. The attacks may allow malware to request valid passkey assertions, register attacker-controlled user-verification keys, or extract the master secret used to decrypt synchronized passkeys. The most serious scenario could expose existing and future passkeys associated with the account. The research represents a controlled demonstration, not confirmed active exploitation. Organizations should continue adopting passkeys while strengthening endpoint controls, monitoring device enrollment and recovery activity, and ensuring services strictly validate user-verification signals during authentication. Key Takeaways• Pass-ta-key consists of three newly demonstrated attacks against Google-synced passkeys on Chrome for Windows. • Every technique requires malware to be present on the victim’s endpoint first. • The basic attack can generate a valid authentication assertion without administrator privileges, device unlock, biometrics, or user interaction. • Silver Pass-ta-key can register an attacker-controlled verification key and support authentication from a separate system. • Golden Pass-ta-key may expose the master secret used to decrypt existing and future synchronized passkeys. • The attacks exploit implementation and trust-flow weaknesses rather than breaking passkey cryptography. • Organizations should strengthen endpoint detection, monitor passkey recovery activity, and require strict user-verification validation. KeywordsPass-ta-key, Silver Pass-ta-key, Golden Pass-ta-key, Google Password Manager, Google Chrome, passkey security, passwordless authentication, WebAuthn, FIDO2, Trusted Platform Module, TPM security, synced passkeys, account takeover, user verification bypass, security domain secret, credential theft, endpoint malware, identity security, Digital Warfare Podcast, cybersecurity, threat intelligence

See All (148)

About

The Digital Warfare Podcast dives into the untold stories of digital defense. Join the anonymous hacker and his clients for raw, revealing conversations on the front lines of cybersecurity.

Information