Skip to content
Braincap
← All articles

Blog

Infrastructure & network

Illustration: the PEERSTITCH malware hidden in the memory of the legitimate FortiOS logging and VPN daemons, with no files on disk, no open ports and no connections of its own, with the logs switched off by the attacker

PEERSTITCH: how an attack hides inside a FortiOS firewall

PEERSTITCH leaves no file on disk, opens no ports and makes no connections. It injects itself into legitimate FortiOS daemons, including the logging one, and talks through their traffic. What happened, why a CVSS of 5.4 does not mean low risk, and what it means for anyone with edge devices on their network.

Read the article
Illustration: the correct order of work for a critical bulletin, inventory, compromise check, then patch, with the warning that patching first destroys the evidence

NetScaler (CTX697096): if you patch first, you may never know you were compromised

Citrix published CTX697096, a critical vulnerability already exploited, with no workaround and no published indicators of compromise. The correct order is not ”patch”, but inventory, then a compromise check, then patch. How the Braincap team works with clients running NetScaler ADC and Gateway, what it looks for on the appliances, and what it finds almost every time.

Read the article
Illustration: a commercial product built on top of an open-source core, with the CRA security responsibility moved onto the company that ships it, not the open-source project

Cyber Resilience Act: "it is open source" does not exempt you if you build commercially on WordPress, PrestaShop or Magento

The CRA distinction is not open source or not, but commercial activity or not. If you sell plugins and themes or build sites and shops commercially for EU clients, the CRA can make you the manufacturer of what you ship. The most exposed case: those who modify the core. When you become a manufacturer, what is required and why Romania is exposed.

Read the article
Illustration: the Cyber Resilience Act timeline, with the reporting obligation in force on 11 September 2026 and the main obligations on 11 December 2027

The Cyber Resilience Act: security becomes mandatory for digital products in the EU, and it has already started

The Cyber Resilience Act (Regulation (EU) 2024/2847) makes security mandatory by design for any product with digital elements placed on the EU market. It is not just for big tech: it catches you if you sell connected software or hardware. The first obligation, reporting, has applied since 11 September 2026; the bulk arrives on 11 December 2027. What it requires, who it catches and what to do now.

Read the article
Illustration: the CVE-2026-87902 timeline, from the WordPress 7.1.2 patch to the first probes under five hours later and to mass exploitation the next day

WordPress: critical core RCE exploited within hours of the patch (CVE-2026-87902)

CVE-2026-87902, an unauthenticated path traversal in WordPress core (CVSS 9.2), leads to local PHP file inclusion and, on common setups like the official PHP Docker image or default cPanel, to code execution. Exploited at scale within hours of the patch and already on CISA KEV. What it is, who is exposed and what to do now: 7.1.2 plus two stopgaps.

Read the article
Illustration: a payload with a space between the angle bracket and the tag name passes the first WordPress filter as harmless, but the second filter parses it as a valid tag, leading to XSS and code execution

XSS2Shell: an XSS on the WordPress login screen reaches code execution on the server

CVE-2026-64638, "XSS2Shell", is a WordPress core vulnerability that turns an unauthenticated XSS on the login screen into PHP code execution on the server. The root cause is a disagreement between two sanitization filters. What it is, why it is serious (core, pre-auth, around 43% of the web) and what to do: update to 7.0.3 and escape correctly at output.

Read the article
Illustration: a Windows named pipe between a SYSTEM client and an attacker-controlled server that reaches a SYSTEM token through impersonation

Named pipes: the Windows attack surface you build yourself

Named pipes are a normal Windows IPC mechanism and a two-sided attack surface: vulnerabilities you build yourself (pipe squatting, confused deputy) and a classic privilege-escalation primitive to SYSTEM (named pipe impersonation), plus stealth C2 over pipes. How it works and how to defend, at the code and detection level.

Read the article
Illustration: the Microsoft Defender shield used as an escalation step from an ordinary user to SYSTEM, conditional on a local foothold already obtained

Microsoft Defender bypassed again (ShieldBreak): PoC grants SYSTEM, but it needs local access first

ShieldBreak is a PoC that bypasses Microsoft's patch for RoguePlanet (CVE-2026-50656) and escalates to SYSTEM on Windows 10/11 and Server 2025 with Defender enabled. It is not a remote attack: the attacker already has a local foothold and only climbs to SYSTEM. No patch yet, no confirmed exploitation. What it means for a managed fleet and what to do until the fix lands.

Read the article
Illustration of two institutions hit by a cyberattack — one that reassures, one that discloses — with the citizen in between

Two breaches, two ways of treating people

Same summer, two cyberattacks in Romania: one at the national land registry, one at a bank. We are not comparing severity — we are comparing the reflex, to disclose or to reassure. And why, in the end, cyber hygiene is a form of care for the citizen, especially the elderly, who cannot simply "reset" their property records.

Read the article
Illustration of a VMware ESXi hypervisor encrypted by ransomware — a single padlock locking all the virtual machines above it

VMware ESXi ransomware: how one strike encrypts all your virtual machines

When ransomware reaches the VMware ESXi hypervisor, it does not encrypt one server — it encrypts them all at once, because every virtual machine lives on it. It is the most feared scenario in virtualized infrastructure, and the financial sector is a prime target. How attackers reach ESXi (CVE-2024-37085, CVE-2021-21974), why EDR does not see you there, and what actually saves you.

Read the article
Illustration of a ransomware attack on a bank, with a DNSC-style response — encrypted systems and an ongoing investigation

Ransomware attack at Techventures Bank (former Banca Feroviară): what is confirmed and what is not

Romania's DNSC was notified on 2 August 2026 of a ransomware attack at Techventures Bank S.A. (the former Banca Comercială Feroviară) and is supporting mitigation and investigation. Everything else — systems affected, data exfiltration, customer impact, the group behind it — remains officially unknown. What we know for certain, what we do not, and why it matters for any DORA/NIS2-regulated entity.

Read the article
Illustration of three products — Langflow, N-central and Apache Tomcat — flagged as actively exploited in CISA's KEV catalog

CISA: three actively exploited flaws in Langflow, N-central and Apache Tomcat

CISA added three actively exploited vulnerabilities to its KEV catalog: CVE-2026-9198 in IBM Langflow (unauthenticated RCE, CVSS 9.8), CVE-2026-18576 in N-able N-central (authentication bypass, admin account takeover) and CVE-2026-34486 in Apache Tomcat (incomplete fix, CVSS 7.5). Public PoC for Langflow, an emergency hotfix for N-central. What they are, who is affected, and what to do now.

Read the article
Illustration of a community software package taken over by an attacker injecting malicious code into the build file

Arch Linux disabled AUR package adoption to stop a malware flood

Attackers took over 200+ packages in the Arch User Repository (AUR) by adopting orphaned packages and injecting malicious code into build files — an anti-analysis loader plus a Rust infostealer delivered over Tor that steals SSH keys, cloud secrets and API keys. Arch temporarily disabled adoption. How it worked, and the supply-chain lesson.

Read the article
Illustration of a hypervisor with stacked virtual machines, one escaping its isolation, and a bypassed authentication lock

VMware fixes three critical flaws: vCenter auth bypass and VM escape

Broadcom has shipped patches for three critical VMware flaws: a vCenter authentication bypass (CVE-2026-59309) and code execution (CVE-2026-59310), both CVSS 9.8 and unauthenticated, plus a virtual-machine escape (CVE-2026-47876, CVSS 9.3). Not yet exploited — but there is no workaround. What to update, and in what order.

Read the article
Illustration of an information system taken down by a cyberattack

ANCPI cyberattack (2026): timeline and confirmed facts

ANCPI cyberattack, July 2026: the timeline of the cadastre and land-registry outage (e-Terra) and the facts confirmed by ANCPI and DNSC. What is confirmed, what is not, and what the attacker claimed.

Read the article