Loki Intelligence — Security Briefs · Published
Daily Security Brief: Edge, DevOps, and Healthcare Systems Under Active Pressure
Today’s risk is concentrated around internet-facing management planes, developer infrastructure, and healthcare platforms where compromise can enable ransomware, credential theft, or service disruption. Teams should prioritize verified patching, exposure reduction, credential rotation where compromise is suspected, and monitoring for abnormal admin activity.
Signal 01 · The Hacker News
Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware
Cisco reports that recently patched Secure Firewall Management Center vulnerabilities are being used by multiple threat clusters, including ransomware-linked actors, to steal credentials and support follow-on compromise.
Why it matters: Treat firewall management systems as high-value assets: patch urgently, restrict management access, review privileged accounts, and investigate unusual logins or configuration changes.
Source: The Hacker News
Signal 02 · CISA
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild.
Why it matters: Network teams should inventory MikroTik devices, apply vendor fixes, limit administrative exposure, and monitor routers for unauthorized configuration or persistence.
Source: CISA
Signal 03 · BleepingComputer
GitLab urges users to patch max severity path traversal flaw
GitLab is urging immediate upgrades for a maximum-severity path traversal vulnerability affecting self-managed instances.
Why it matters: Engineering and platform teams should patch GitLab quickly, confirm instance versions, and review access logs for unexpected repository or file access patterns.
Source: BleepingComputer
Signal 04 · BleepingComputer
CISA: WatchGuard RCE flaw now exploited in ransomware attacks
CISA has warned that a critical WatchGuard Firebox vulnerability is now being exploited in ransomware activity.
Why it matters: Organizations using WatchGuard appliances should validate remediation, reduce external management exposure, and check for signs of appliance compromise before assuming patching alone is sufficient.
Source: BleepingComputer
Signal 05 · CISA
Orthanc DICOM Server
CISA issued a medical advisory for Orthanc DICOM Server, warning that an authenticated remote attacker could trigger a memory issue during image processing and crash the service.
Why it matters: Healthcare environments should update affected systems, limit authenticated access, and ensure imaging workflows have resilience plans for service interruption.
Source: CISA
Signal 06 · CISA
NextGen Healthcare Mirth Connect
CISA disclosed vulnerabilities in NextGen Healthcare Mirth Connect that could expose data or cause denial-of-service conditions in affected versions.
Why it matters: Teams running integration engines should patch promptly, review interface exposure, and monitor for unusual data access or disruptions across clinical data flows.
Source: CISA
Signal 07 · The Hacker News
Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors
Researchers report attackers chained JFrog Artifactory flaws to gain administrator control over self-hosted servers and install backdoors.
Why it matters: Artifact repositories are supply-chain choke points; patch, rotate secrets tied to repositories, audit admin changes, and verify build artifacts for unexpected modification.
Source: The Hacker News
Brief sources
Related briefs
- Hardware Hacking for Embedded Security
- How to Evaluate an AI Security Testing Provider
- What Is AI Agent Security Testing?
Relevant Loki services: Orvyn — AI agent security private preview and SKYEN web & API pentesting.