@www.levelblue.com.blogs.spiderlabs-blog@rss-parrot.net
I'm an automated parrot! I relay a website's RSS feed to the Fediverse. Every time a new post appears in the feed, I toot about it. Follow me to get all new posts in your Mastodon timeline! Brought to you by the RSS Parrot.
---
The security community's go-to destination for technical breakdowns of the latest threats, critical vulnerability disclosures and cutting-edge research.
Site URL: www.levelblue.com/blogs/spiderlabs-blog
Feed URL: www.levelblue.com/blogs/spiderlabs-blog/rss.xml
Posts: 13
Followers: 1
Securing the Software Development Lifecycle and Supply Chain in an AI-Forward World
Published: October 22, 2026 14:00
It’s no secret how artificial intelligence (AI)-powered tools and systems, which promise users exponential productivity, growth, and efficiency, have quickly become integral in organizations' processes and workflows. AI — specifically generative AI (GenAI)…
PHP2Shell: Critical RCE Vulnerabilities Affect a Large Majority of Web Servers
Published: October 22, 2026 12:18
On October 21st, two critical memory manipulation vulnerabilities were disclosed in a joint announcement by Wiz Research, Calif, OpenAI, and the PHP team. The two vulnerabilities, combined, are being called PHP2Shell. The vulnerabilities are in PHP Core,…
Inside Wazza: A Newly Observed Device Code Phishing Kit Targeting Microsoft 365 Accounts
Published: October 20, 2026 15:26
LevelBlue SpiderLabs has been tracking multiple waves of Wazza, a newly observed multi-stage phishing kit that deploys device code phishing targeting Microsoft 365 accounts. In addition to recent reporting by The Hacker News, our analysis examines the…
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign
Published: October 7, 2026 15:47
Key Takeaways
Filling the Well: Nightmare-Eclipse's BigDiskBuster and the Defender Update That Never Lands
Published: October 5, 2026 12:57
A new proof of concept called BigDiskBuster, published on GitHub on September 19, 2026, by the actor known as MSNightmare, shows that Defender doesn't need to be disabled to stop receiving updates, it just needs a much simpler dependency: disk space.
TIKTOUK: Tracing a WordPress Credential Collection Toolkit
Published: October 1, 2026 12:41
TIKTOUK brings together WordPress probing, collection of exposed configuration data, recovery of encrypted email credentials, and JavaScript secret scanning. Its two Python components and Go-based Linux crawler turn website responses into structured…
Citrix NetScaler CVE-2026-88771: Observed Exploitation Artifacts and Hunt Indicators
Published: September 30, 2026 20:34
With contributions from James Rodriguez, Gus Staminatos, and Timmy Lister.
Citrix NetScaler Zero-Day Exploited Globally
https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-zero-day-exploited-globally
Published: September 29, 2026 12:29
On Sept 27, Citrix released patches for two critical vulnerabilities being exploited in the wild. Based on current information, we confirm there has been no exposure or impact to LevelBlue or our clients. CISA has already added these vulnerabilities to the…
File Acquisition May Be Recorded as “FileAccessed” in Microsoft 365 (“M365”)
Published: September 24, 2026 12:30
A recent trend has emerged where threat actor groups (e.g., ShinyHunters, PEAR, HELIX, etc.) have been leveraging phishing and vishing techniques to gain access to M365 email accounts. Through identity and token abuse, these actors have then automated…
Enumerating Users and MFA via Microsoft's Password Reset Portal
Published: September 23, 2026 17:13
Microsoft's Self-Service Password Reset (SSPR) portal is a legitimate feature designed to let users recover their accounts without calling the helpdesk. As it turns out, it also tells you quite a lot about the accounts in a tenant — whether they exist,…
One Patch Behind: Nightmare-Eclipse's ShieldCrash and the Defender Bypass That Won't Stay Fixed
Published: September 16, 2026 13:35
In our previous blog, we analyzed four proofs of concept (PoCs) from the leak persona Nightmare-Eclipse that targeted Kaspersky, Avast, NVIDIA, and CrowdStrike, respectively.
Expanding the Attack Surface: Analyzing Nightmare-Eclipse's Latest PoCs
Published: September 9, 2026 12:37
In our previous blog, we explored a series of disclosures from the leak persona Nightmare-Eclipse that focused heavily on Microsoft's ecosystem, including Windows Defender, Cloud Files, and core operating system functionality.
Still Circling: Inside the Operator Behind Blind Eagle's GitHub Loader
Published: August 28, 2026 14:00
This is a collaborative follow-up to our original post, developed jointly with Emmanuel C., an independent security researcher not affiliated with LevelBlue, who contributed additional infrastructure and tooling findings based on an analysis of the same…