Data Core Systems, Romania

Most of our work happens behind a screen. Today, some of it happened behind a wheel. 🥳 A few of our colleagues took a Porsche 718 Cayman onto the circuit at MotorPark Experience. The reward for winning a team-building challenge. Today they finally cashed it in. Helmets on. Tyres warm. Eyes on the next corner. It turns out the track rewards the same instincts we rely on every day, just at 200 kilometers an hour. On a fast lap you cannot react to what is happening now. You have to read what is coming. Brake before you feel you need to. Commit to a corner you cannot fully see yet. Our work runs on the same logic. By the time an alert is loud, you are already late. The job is to see the threat forming and move before it lands. And speed only matters if it is precise. A tenth too late on the brakes and you lose the lap. A tenth too slow on a response and you lose far more. On track and in our #SOC, the margin is measured in seconds. A fast lap is never a solo effort either. Someone runs the briefing. Someone reads your line. Someone is already calling the next corner while you take this one. It looks like one driver. It is a whole team behind every second. That is exactly how we work at #DataCoreSystems. Nobody carries the load alone. We build a lot here. Security our clients count on. Trust they keep coming back for. And, above all, the team that makes both possible. A real thank you to MotorPark Experience for a flawless day, from the first briefing to the final lap. 🤗 #DataCoreSystems #MotorParkExperience #DCS #DCSTeam #Teambuilding #TeamCulture #EmployeeExperience #PeopleFirst #LifeAtDCS #TeamSpirit #WorkHardPlayHard #TrackDay #Porsche #Cayman #Motorsport #FullThrottle #SOC #ThreatDetection #IncidentResponse #InfoSec #CyberDefense #BlueTeam #SecurityOperations

🔴 Critical NGINX Vulnerability Can Crash Workers and Potentially Enable RCE. Fix Available. F5 has released fixes for a critical nginx flaw worth a quick look, especially if nginx sits in front of anything important. It's config-dependent, not universal, and F5 moved fast to ship patches. What's happening: A remote, unauthenticated attacker can trigger a heap buffer overflow in the nginx worker using crafted HTTP requests. At minimum it crashes or restarts the worker (DoS); where ASLR is disabled or bypassable, F5 notes it may allow remote code execution. The flaw only surfaces under a specific config pattern, so many deployments won't be affected at all, worth checking for. Who is affected: Every nginx version from 0.9.6 through 1.31.2. F5's advisory also lists NGINX Ingress Controller, Gateway Fabric, App Protect WAF, and Instance Manager, with fixed builds to follow. CVSS 9.2 (v4), attack complexity rated high. Recommended actions: 💡 Upgrade to nginx 1.30.4 (stable), 1.31.3 (mainline), or NGINX Plus 37.0.3.1. This is the complete fix. 💡 If patching has to wait, F5's interim mitigation is switching affected regex maps to named captures. 💡 Quick config audit: look for a regex-based map whose variable appears alongside a numbered capture from an earlier regex. 💡 Prioritize internet-facing instances and reverse proxies. 💡 Watch F5's advisory for fixed builds across the other affected products. Bottom line: F5 had the fix ready before any exploitation appeared, exactly the right sequence. No confirmed attacks or public exploit yet, but a proof-of-concept is expected down the line, so applying the update now is the easy way to stay ahead. A quick version and config check is time well spent. #NGINXSecurity #CVE202642533 #NGINX #F5 #CyberSecurity #PatchManagement #InfoSec #EnterpriseIT #SYSADMIN #WebServer #VulnerabilityManagement #PatchNow #NetworkSecurity #BufferOverflow #CyberResilience #ITSecurity #SecurityAdvisory #ReverseProxy #ThreatIntelligence #F5Networks

🔴 Splunk Patches Three Vulnerabilities. One Could Expose Stored Credentials to a Hijacked Session. Fixes Available. A set of three Splunk Enterprise vulnerabilities worth flagging for anyone running the platform. None are confirmed as exploited in the wild, and there's no public proof-of-concept for any of them at this stage, but given where Splunk sits in most security operations, they're worth folding into your review promptly. Why it's on the radar: Splunk is the beating heart of a lot of SOC environments. It holds credentials and indexed log data, which is precisely the kind of material an attacker wants to reach. Vulnerabilities that touch stored secrets, even ones that need specific conditions to trigger, deserve attention rather than a wait-and-see approach. The three findings: 💡 CVE-2026-20296 (High, 8.3): The most significant of the batch. Deployment Server endpoints skip CSRF validation on GET requests, and caller input flows into SPL searches without proper neutralization. An attacker who tricks a user holding the list_deployment_server capability into interacting with a crafted request can run arbitrary SPL as the system user, opening access to stored credentials and indexed data. 💡 CVE-2026-20297 (High, 7.2): A path traversal issue during app installation. A user with the right app-installation capabilities can cause a legitimate install to write files outside the intended directory, into the Splunk home configuration path. 💡 CVE-2026-20298 (Medium, 5.3): A credential hash exposure. A low-privileged user without admin or power roles can retrieve stored credential hashes via a specific REST-based SPL command. Who is affected: Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, and 9.4.13, with one of the flaws also reaching 9.3 versions below 9.3.14. Several Splunk Cloud Platform releases are affected as well. Fixed builds are available across all lines. Recommended actions: 💡 Upgrade Splunk Enterprise to 10.4.1, 10.2.5, 10.0.8, 9.4.13, or 9.3.14 and above. 💡 Splunk Cloud Platform instances are being updated on Splunk's side, so no manual action needed there. 💡 Review who holds the deployment and app-installation capabilities referenced above, and tighten assignments where possible. 💡 Keep an eye on Deployment Server endpoints for unusual search or access activity as general hygiene. All three fixes are available and no active exploitation has been reported. The most serious of the batch needs a social engineering step to work, which raises the bar somewhat, but the sensitivity of what Splunk holds makes applying these updates the sensible move rather than deferring them. A quick version check and upgrade closes the door on all three. #SplunkSecurity #CVE202620296 #Splunk #PatchManagement #ThreatIntelligence #InfoSec #EnterpriseIT #SYSADMIN #VulnerabilityManagement #SOC #SIEMSecurity #CyberResilience #ITSecurity #SecurityAdvisory #CSRF #PrivilegeEscalation #DataProtection #CredentialSecurity

🔴 Microsoft AD FS Zero-Day Actively Exploited Microsoft's July security update cycle includes a fix for an actively exploited elevation of privilege vulnerability in Active Directory Federation Services. Given how central AD FS is to identity infrastructure in enterprise environments, this one deserves immediate attention from security and infrastructure teams alike. What's happening: An authenticated user with minimal privileges can leverage this gap to reach administrator-level access on the affected system. No user interaction is required and the attack complexity is rated low, meaning once an attacker has a foothold, the path upward is straightforward. Microsoft confirmed active exploitation in the wild and assigned a CVSS score of 7.8. Fixes were released as part of the July 14th update cycle, covering a wide range of Windows Server versions from 2012 through 2025. Why AD FS specifically raises the stakes: Servers sit at a particularly sensitive point in enterprise architecture. They process authentication requests, issue security tokens, and act as the bridge between identity services and corporate applications. An attacker who reaches administrator level on an AD FS server can alter configurations, access authentication materials, disable security controls, and use the compromised server as a launchpad for broader network activity. It is not just one server at risk. It is everything that server authenticates. What exploitation looks like in practice: The attacker needs existing authenticated local access to begin. From there, the access control gap allows privilege escalation without any additional complexity. Microsoft has deliberately kept technical exploit details out of public circulation for now, which provides defenders a slightly wider window to patch before more sophisticated campaigns develop around this vulnerability. Recommended actions: 💡 Deploy Microsoft's July cumulative or security-only updates across all AD FS servers immediately, prioritizing those connected to critical identity infrastructure. 💡 Confirm the updated build number post-patching to verify successful installation. 💡 Review local administrator group membership on AD FS servers for any unexpected additions. 💡 Monitor AD FS servers for unusual process executions or unexpected modifications to federation configurations. 💡 Audit privileged login activity and flag any authentication events that fall outside normal patterns. 💡 Reduce unnecessary local privileges across accounts that interact with AD FS infrastructure as an additional containment measure. #MicrosoftSecurity #ADFS #ActiveDirectory #CVE202656155 #CyberSecurity #PatchManagement #IdentitySecurity #ThreatIntelligence #InfoSec #EnterpriseIT #SYSADMIN #WindowsServer #PatchNow #PrivilegeEscalation #ZeroDay #ActiveExploitation #VulnerabilityManagement #PatchTuesday #CyberResilience #ITSecurity

We are pleased to announce that Data Core Systems S.R.L. has officially transitioned to a joint-stock company, now operating as Data Core Systems S.A.🎉 This milestone reflects over a decade of growth, from a cybersecurity integrator founded in Bucharest in 2012 to a company trusted by the top 10 banks in Romania, holding more than 120 relevant technical certifications and partnerships with over 50 technology providers. As part of this transition, the newly established Board of Directors will be comprised of Cristian Manescu as Chairman of the Board, Dragos Diaconu as Vice Chairman of the Board, and Octavian Oancea as Board Member. The new Board composition reflects the governance structure we have been building toward, bringing together the expertise and leadership needed to support our next phase of growth. It positions us to accelerate our ambitions and deliver the most advanced IT and cybersecurity services in Romania. To our clients, partners, and everyone who has been part of this journey - THANK YOU. 🤗 🤝 We look forward to this next chapter.☺️ ____________________________________________________________________ Este un moment care ne bucură și de care suntem mândri: Data Core Systems S.R.L. a devenit oficial societate pe acțiuni și operează de acum sub denumirea Data Core Systems S.A.🎉 Este un pas important, care încununează peste un deceniu de creștere: de la un integrator de soluții de securitate cibernetică fondat la București în 2012, la un partener de încredere pentru primele 10 bănci din România, cu peste 120 de certificări tehnice și parteneriate cu peste 50 de furnizori de tehnologie. Odată cu această tranziție, noul Consiliu de Administrație este format din Cristian Manescu - Președinte, Dragos Diaconu - Vicepreședinte și Octavian Oancea - Membru al Consiliului. Această componență reflectă structura de guvernanță pe care am construit-o pas cu pas și aduce împreună experiența și viziunea de care avem nevoie pentru următoarea etapă. Ne ajută să ne urmărim ambițiile cu și mai multă forță și să oferim cele mai avansate servicii IT și de securitate cibernetică din România. Tuturor clienților, partenerilor și celor care ne-au fost alături pe acest drum - VĂ MULȚUMIM.🤗 🤝 Privim cu entuziasm spre acest nou capitol. ☺️ #DataCoreSystems #DCS #ThirdSeer #Cybersecurity #ITSecurity #CyberSecurity #InfoSec #Romania #Bucharest #JointStock #BoardOfDirectors #StrategicPartnership #ITSolutions #CyberThreats #DigitalTransformation #TechLeadership #Growth #Milestone #CorporateGovernance #Leadership #CompanyNews

🔴 Cisco Unified CM Flaw CVE-2026-20230 Now Actively Exploited Cisco patched this one earlier this month and now active exploitation has been confirmed in the wild. If Unified Communications Manager is part of your environment, this is the right moment to verify that the June 3rd update has been applied. What's happening: A server-side request forgery vulnerability in Cisco Unified CM and Unified CM SME allows an unauthenticated remote attacker to write arbitrary files to the underlying operating system through the WebDialer component. From there, the path to root-level access is well documented. Cisco moved proactively to address the issue and released fixes ahead of any known exploitation at the time. The current attack activity appears reconnaissance-focused rather than immediately destructive. Observed attempts are originating from a single IP address and seem designed to identify vulnerable devices by dropping a test file rather than deploying anything malicious. That said, now that a full technical write-up and proof-of-concept are publicly available, the window before more aggressive activity follows tends to be short. Why the current activity still matters: Reconnaissance is typically the first step before a more targeted campaign. Knowing which devices are vulnerable is valuable information for a threat actor planning a follow-up operation. Getting the patch in place now removes your environment from that picture entirely. Recommended actions: 💡 Verify that the June 3rd Cisco security update has been applied across all Unified CM and Unified CM SME instances. 💡 Check for the presence of unexpected files in the /tmp directory, particularly anything referencing CVE-2026-20230. 💡 Review WebDialer access logs for unusual HTTP requests involving file:// URI patterns. 💡 Restrict external access to Unified CM interfaces where not operationally required. 💡 Keep an eye on Cisco's PSIRT advisory page for any further updates as the situation develops. Bottom line: Cisco had the fix ready before exploitation began, which is exactly the right sequence. The patch is available, the exploitation path is now fully public, and the current activity is a clear signal that more attention is coming to this vulnerability. Applying the update now is the straightforward way to stay ahead of it. #CiscoSecurity #UnifiedCommunications #CVE202620230 #CyberSecurity #PatchManagement #ThreatIntelligence #InfoSec #EnterpriseIT #SYSADMIN #NetworkSecurity #VulnerabilityManagement #PatchNow #CUCM #CyberResilience #Cisco #SecurityAdvisory #ActiveExploitation #ITSecurity #SSRF #IncidentResponse

🔴 Critical Splunk Enterprise Flaw Under Active Attack Active exploitation has been confirmed and the clock is ticking. If Splunk Enterprise is part of your environment, this one moves to the front of the queue. The fix is already available and the case for deploying it promptly has never been clearer. What's happening: A pre-authentication vulnerability in Splunk Enterprise exposes a PostgreSQL sidecar service endpoint that lacks access controls on specific file operations. A network-reachable attacker can invoke these operations without any credentials, creating a reliable path toward remote code execution. Splunk identified the issue, shipped fixes, and updated its advisory promptly once limited exploitation activity was detected. The response has been transparent and methodical throughout. The urgency now sits entirely on the deployment side. How the timeline unfolded: The patch came first. An external research team published a technical write-up and proof-of-concept several days later, compressing the window between public knowledge and active exploitation to just a matter of days. By mid-week, in-the-wild attacks were confirmed, turning what was already an important update into a time-sensitive one. Who is affected: Splunk Enterprise versions 10.2.0 through 10.2.3 and 10.0.0 through 10.0.6. Internet scanning data shows over 1,400 publicly reachable Splunk instances globally, with notable concentration across North America and Europe. Can't patch immediately? There's a stopgap: Splunk has provided an interim mitigation. Disabling the PostgreSQL sidecar service removes the attack surface entirely. One caveat worth planning around: doing so will impact Edge Processor, OpAmp, and SPL2 data pipeline functionality, so weigh the operational consequences before going that route. Recommended actions: 💡 Patch to a fixed release as the primary action. Clean, complete, no operational side effects. 💡 If patching must wait, disable the PostgreSQL sidecar service and document the pipeline impact. 💡 Audit any internet-facing Splunk instances. Exposure to untrusted networks puts these at highest risk. 💡 Review Splunk logs for unusual file operation activity in the period leading up to remediation. 💡 Stay close to Splunk's official advisory page. They've been proactive and communicative throughout this disclosure. #SplunkSecurity #CVE202620253 #Splunk #CyberSecurity #PatchManagement #ThreatIntelligence #InfoSec #EnterpriseIT #SYSADMIN #ActiveExploitation #PatchNow #NetworkSecurity #VulnerabilityManagement #SOC #SIEMSecurity #CyberResilience #ITSecurity #SecurityAdvisory #DataPipeline #IncidentResponse

🔴 Cisco Catalyst SD-WAN Manager Zero-Day Patched - Here's What to Do Next Cisco has moved quickly to address a zero-day vulnerability in Catalyst SD-WAN Manager, with fixes now available across all affected release lines. If SD-WAN Manager is part of your infrastructure, here's what you need to know. What happened: The vulnerability sits in how the platform handles file uploads through its web UI. An authenticated user with limited privileges could exploit this to write files onto the underlying system, a path that could eventually lead to elevated access. Cisco's security team identified active exploitation and responded promptly with a patch, while also providing indicators of compromise to help customers assess their exposure. That level of transparency is exactly what you want to see from a vendor. Every deployment type is covered by the fix, on-premises, Cloud-Pro, Cisco-managed cloud, and the #FedRAMP government edition. Already patched? Still worth a quick check: Cisco went the extra mile by sharing specific log sources to review for any suspicious file upload activity prior to patching: 💡 vmanage-server logs 💡 vmanage-appserver logs 💡 serviceproxy-access logs Keep an eye out for any attempts to upload index.jsp or .war files, these are the indicators tied to the observed activity. Recommended actions: 💡 Apply the relevant fixed release at the earliest opportunity, Cisco has strongly encouraged prompt action 💡 Run through the #IOC checklist on your SD-WAN logs as a precautionary step 💡 Do a quick file system audit on affected instances for any unexpected .jsp or .war files 💡 Review authenticated user activity in the period before patching 💡 Stay close to Cisco's #PSIRT page, they've been proactive with communications across this product line recently Bottom line: #Cisco identified the issue, delivered the fix, and equipped customers with the tools to check their own exposure. The patch is ready and applying it promptly is the straightforward next step. #CiscoSecurity #SDWan #CatalystSDWAN #CVE202620262 #ZeroDay #CyberSecurity #PatchManagement #NetworkSecurity #ThreatIntelligence #InfoSec #EnterpriseIT #SYSADMIN #PatchNow #VulnerabilityManagement #Cisco #CyberResilience #SecurityAdvisory #ITSecurity #ActiveExploitation #PSIRT

 🔴#Ivanti Sentry Vulnerability Addressed - Why This One Shouldn't Wait for Next Week If Ivanti Sentry is part of your environment, this one needs immediate attention. A critical vulnerability has been addressed by Ivanti with fixes already available, but exploitation attempts began shortly after technical details became public, making the patching timeline particularly tight. What's happening: A maximum severity OS command injection flaw in Ivanti Sentry, the gateway appliance managing secure traffic between corporate systems and remote mobile devices, has been patched by Ivanti. Shortly after the fix was released, a public proof-of-concept emerged and #exploitation attempts followed rapidly. Ivanti moved quickly to address the issue, and the fixes are ready to deploy. The core message here is straightforward: the patch exists, it works, and applying it is the single most effective action you can take right now. Who is affected: Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1. Any internet-facing instance that hasn't yet received the update should be prioritized immediately. Why speed matters here: The gap between patch availability and active exploitation attempts was remarkably short, a reminder that in today's threat landscape, maintenance window schedules sometimes need to flex when the risk profile demands it. Ivanti has been transparent about the issue and delivered fixes promptly, which is exactly the right response from a vendor. Recommended actions: 💡 Update to R10.5.2, R10.6.2, or R10.7.1 immediately - fixes are available and ready to deploy 💡 Restrict admin portal access to trusted IP ranges as a compensating control during the update process 💡 Review Sentry appliance logs for any unusual activity in the period before patching 💡 Verify outbound traffic patterns from Sentry devices as a precautionary step post-update 💡 Follow Ivanti's official advisory page for any further technical guidance as it becomes available Bottom line: Ivanti identified the issue, developed a fix, and made it available promptly. The responsibility now sits with security teams to deploy it without delay. In a threat environment where public exploits appear within hours of disclosure, fast patch #deployment is the most reliable defense available. #IvantiSecurity #IvantiSentry #CVE202610520 #CyberSecurity #PatchManagement #VulnerabilityManagement #ThreatIntelligence #InfoSec #EnterpriseIT #SYSADMIN #NetworkSecurity #MobileGateway #PatchNow #CyberResilience #Ivanti #ITSecurity #SecurityAdvisory #ActiveDirectory #CyberThreat #IncidentResponse

We just came off the stage at Fortinet Security Day 2026, and the day is still in full swing. 🎉 Data Core Systems presented as a Gold Partner, and we didn't bring a product pitch. We brought a field story. Age of Automation & How SASE Shapes the Modern Cyber-Zeitgeist Speaker: Andrei Nitu-Ecxarcu 👇 Here's what we shared: It began with an incident few teams are ever ready for. Two separate threat actors, encrypting different systems at the same time, across an estate of 30+ sites. One hub held every database. There was no disaster recovery. And this is the reality now. In Romania, ransomware hasn't just grown over the past year. It has professionalized, scaling faster than most defenses can adapt. So we rebuilt the network from the ground up. A complete Fortinet fabric, with more than 25 #FortiGate sites staged in a single day. Plug the cable, the tunnel comes up, done. The real story, though, is how we did it: automation first. With #Ansible and #FortiManager, built on idempotency and desired-state configuration, you define the secure state once and the systems enforce it continuously, across every site, with no configuration drift to chase later. Inside that rebuild sat a genuine milestone: Romania's first #FortiSASE deployment. Security delivered from an always-on FortiGate in the cloud, protecting a workforce that no longer has a perimeter to defend, fully independent of the production network. The lesson is simple. The battlefield is digital. Automation is the enabler. #SASE is the architecture. The perimeter is gone, and that reshapes everything about how we protect a business. What comes next is FortiSASE Sovereign, already in development. Because in a world without edges, the question that really matters is where your data, your traffic, and your logs actually live. A huge congratulations to Andrei Nitu-Ecxarcu for a sharp, honest, and genuinely valuable session, and to Serban Slavila for his invaluable expertise in deploying the aforementioned setup. This is what real expertise sounds like when it steps on stage. And a shout-out to the rest of the team representing #DataCoreSystems at the event today: Catalin Matei, Cosmin Moldoveanu, Sergiu Banyai, Andrei Nitu-Ecxarcu, Denisa Dragolici, Gabriela JEREBIE, Serban Slavila, and Iorgulescu George Gabriel. 👏 Still at the event? Come find us at our stand. We'd love to continue the conversation in person. Thank you to the Fortinet team for another excellent edition and for a partnership we're proud to keep building on. 🤝 #FortinetSecurityDay #Fortinet #FortiSASE #SASE #ZeroTrust #Cybersecurity #NetworkSecurity #SecurityAutomation #IncidentResponse #DataCoreSystems #CyberResilience #CyberSecurityRomania #SecurityAutomation #InfrastructureAsCode #Ansible #DevSecOps #IdempotentInfrastructure #Ransomware #IncidentResponse #ThreatIntelligence #CyberResilience #DisasterRecovery #BusinessContinuity #CyberDefense #DataProtection