| DATE |
|
NAME |
INFO |
CATEGORIE |
WEB |
|
30.9.26 |
 |
No MDM for Linux? A 68-line Elastic workflow keeps every
endpoint's config current |
Elastic InfoSec runs Linux endpoint management through Elastic Defend with a
scheduled workflow that gets Cursor and Codex config onto new laptops without
piling up duplicate actions on offline hosts, and it works for other config too.
Our mobile device management (MDM) covers macOS and Windows but
not Linux.
|
OS |
ELASTIC |
|
17.9.26 |
 |
MacOS 27 - First Boot |
I have not done this type of diary in a
while: What traffic will you see from a system on boot, before a user
logs in? I just took a quick look at macOS 27 "Golden Gate" to see what
traffic you should expect. Here are some of the highlights.. |
OS |
SANS |
|
15.9.26 |
|
Apple Updates Everything |
Today, Apple released its annual update
across all its operating systems. With that, Apple not only released new
features but also patched 261 different vulnerabilities. This is the
most vulnerabilities Apple has ever patched, but the increase is not as
significant as other vendors' "post-AI" patch releases. |
OS |
SANS |
|
15.9.26 |
|
Analysis of a Low-Detection Linux Implant with Hands-On
Intrusion Capabilities |
UPDATE: After reviewing related
infra found by
@500mk500 and a related sample by
@malwrhunterteam, I found quite a few similarities with the Adaptix Agent
using the adaptix_gopher protocol. In early July 2026,
MalwareHunterTeam shared an interesting ELF named
gregbfdah.png with minimal detection in VirusTotal. The ELF was uploaded
to VirusTotal on 2026-06-16 and it still has very low detection.
|
OS |
DMDUMP |
|
14.9.26 |
|
Linux Detection Engineering - Local Privilege Escalation |
Seven of the thirteen Linux privilege escalation CVEs we tracked
in 2026 turned out to be the same copy-on-write bug pointed at different kernel
interfaces. We ran the public proof-of-concept for eleven exploits and two
misconfigurations, and noted which rules fired.Local privilege escalation (LPE)
is the step that turns a foothold into full control of a host. An attacker who
lands as an unprivileged user rarely stops there. They want root, and Linux
keeps offering new ways to get it. |
OS |
ELASTIC |
|
10.9.26 |
|
Redtail Payload Analysis |
Following a RedTail Linux Payload
from DShield to Dynamic Analysis
During monitoring of my DShield honeypot, I observed an attacker
uploading a collection of Linux executables targeting several processor
architectures. The files included ARM, ARM64, i686, RISC-V and x86-64 variants
named as part of a RedTail deployment package.
|
OS |
SANS |
|
9.9.26 |
 |
September 2026
Microsoft Patch Tuesday |
This month, Microsoft
released patches for a record-breaking 973 vulnerabilities, including
113 rated critical. It is by far the largest Patch Tuesday to date, well
ahead of the previous high of 664 set in July 2026. Two vulnerabilities
are listed as exploited in the wild, while none were publicly disclosed
before Patch Tuesday. Notable fixes include Windows privilege escalation
and critical RCEs in Skype for Business, MSMQ and RRAS. |
OS |
SANS |
|
20.8.26 |
|
Using Microsoft Graph and Powershell - Risk Detection Commands |
Building on the last diary on Using MS Graph and Powershell,
let's look at "Risky" logins. |
OS |
SANS |
|
20.8.26 |
|
Using Microsoft Graph and Powershell to Mine for Information - Stale Accounts
and Licenses |
Microsoft Graph is a newer API that is meant to replace several others. OK, it's
at version 2.3.9, so it's not all that new, but it's new enough that lots of
folks (and commercial tools) aren't using it yet. It allows you to Get and Set
info from/to M365, Entra Users and Entra managed machines for starters. Let's
dig in! |
OS |
SANS |
|
18.8.26 |
|
Apple Patches iOS and macOS |
Apple today released updates for
iOS/iPadOS (26 and 18) and macOS 26. This update fixes 108 vulnerabilities and
comes about two weeks after the much smaller macOS update that addressed the
single screen-sharing vulnerability. This vulnerability did not affect iOS/iPadOS.
|
OS |
SANS |
|
18.8.26 |
|
Apple Screen Sharing Security |
About 20 years ago, with macOS 10.5 (Leopard), Apple introduced
screen sharing. Apple did not invent a new protocol for screen sharing. Instead,
it used the established VNC protocol. VNC is a pretty simple, unencrypted protocol
using TCP port 5900. Historically, the protocol used a simple global password
for authentication. Apple adapted the protocol for its own use, but overall,
left the VNC protocol itself alone. |
OS |
SANS |
|
13.8.26 |
|
Linux Kernel Process Accounting |
A
couple of days ago, Xavier posted about Atuin to gain more insight into the
command history. Atuin does a great job of better organizing what is usually
handled by "bash_history" and collecting meaningful additional data. Our reader
David commented that this can also be done quite well with Linux's kernel
process accounting feature, and I think he is very right. I really like Linux
process accounting for a number of reasons, so here is a quick introduction.
|
OS |
SANS |
|
12.8.26 |
|
Microsoft Patch Tuesday August 2026 |
This month we got patches for 418 vulnerabilities. Of these, 62
are critical, 1 is being exploited in the wild, and 2 were publicly disclosed as
zero-days. Notable fixes include Windows privilege escalation, container
tampering, and critical QUIC and DNS Server remote code execution bugs.
|
OS |
SANS |
|
8.8.26 |
|
Linux Shell Forensic: Let?s Dive Into Atuin! |
UNIX systems (including Linux) are well-known to record a lot of activities in
many different locations. But there is one domain where they definitely lack of
"modern" logging: shells. Most shells provide an historization of the typed
commands through a flat file in the $HOME directory (ex: $HOME/.bash_history).
They suffer of multiple problems: |
OS |
SANS |
|
31.7.2026 |
|
Apple Patches Everything (July 2026) |
I
am a bit late with this summary, but this week Apple released updates to all its
operating systems and Safari. The Safari update, as usual, targets macOS prior
to macOS 26. macOS updates covered the two older versions (14 and 15), while
other operating system patches only covered the current 26 versions. |
OS |
SANS |
|
|
|
|
|
|