Data Core Systems, Romania’s Post

On June 18, CISA added CVE-2026-20253 to its Known Exploited Vulnerabilities catalog — the first Splunk flaw ever to make the list — and gave federal agencies until June 21 to remediate. It is a CVSS 9.8 missing-authentication bug in the Splunk Enterprise PostgreSQL sidecar service: a network-reachable endpoint with no credential check that lets an attacker create or truncate arbitrary files, which public research has chained into pre-authentication remote code execution (Source: The Hacker News, June 2026). Splunk Cloud is not affected, and on-premises deployments are exposed only where the PostgreSQL sidecar is enabled — which it is by default on AWS. The timeline is the part worth sitting with. Splunk shipped patches on June 10. A proof-of-concept landed on June 12. Confirmed exploitation arrived by June 18 — under a week from public code to attacks in the wild (Source: SecurityWeek, June 2026). And the recommendation is to remediate immediately. Things are moving fast in the world of exploits and patches. A few things worth doing now: → Find every Splunk Enterprise instance you run, including the ones a team stood up in a cloud account without telling IT — you cannot patch an asset you cannot see → Confirm the exact version and whether the PostgreSQL sidecar is enabled across the whole fleet, not a sample, so you know precisely what is exposed → Upgrade to 10.0.7, 10.2.4, 10.4.0, or later, or disable the sidecar service as an interim step, then verify the change actually landed on every host → Hunt for prior compromise: unexpected files in Splunk script directories, modified cron entries, and child processes spawned by the Splunk service account 📰 Source: BleepingComputer — "CISA: Splunk Enterprise flaw actively exploited, patch by Sunday" (June 2026); The Hacker News — "Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication" (June 2026); SecurityWeek — "Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure" (June 2026) #Cybersecurity #ExposureManagement #VulnerabilityManagement #CISO #KEV #Tanium

🚨 Critical Splunk Enterprise vulnerability could enable attackers to execute code and compromise environments. Given Splunk’s central role in many SOCs, this isn’t just another patch. It’s a visibility risk. For many organisations, Splunk isn’t just a tool. It’s the source of truth. If that trust is undermined, detection and response are immediately impacted. If your detection platform is compromised, your visibility is too. Prioritise patching, validate log integrity, and don’t assume your monitoring stack is immune to attack. 👉 https://lnkd.in/e8mr5z2P #CyberSecurity #Splunk #SOC #ThreatDetection #Infosec

Patching in 95 minutes is great and all until until it causes a massive production outage. If you've built enough resiliency into your app then it may be less of an issue. Its good to see vulnerabilities that usually go weeks, months, or even years before patching leading to RCE and takeover. #security #patchmanagement #cyber #cybersec #vulnerability #vulnerabilitymanagement #cybersecurity #infosec #informationsecurity

The platform your SOC trusts to spot attacks can be the way in. 🚨 CVE-2026-20253 (CVSS 9.8) is a missing-authentication flaw in Splunk Enterprise's PostgreSQL sidecar service. Any network-reachable attacker can create or truncate files on the host with no login at all — and watchTowr showed that file-write can be chained into pre-authenticated remote code execution. Why this one stings: Splunk is the SIEM many teams rely on to detect attacks. Compromise it, and an attacker can read, tamper with or delete the very security data you'd investigate with, expose stored credentials, and pivot deeper. When the tool you trust to see attacks is the one that's breached, the compromise can stay quiet. This is confirmed, not hypothetical. Patches landed June 10; watchTowr published a working PoC on June 12; Splunk PSIRT confirmed limited in-the-wild exploitation on June 18, and CISA added it to its KEV catalogue — the first Splunk CVE ever on that list — with a June 21 federal deadline that has already passed. Scope it correctly: only Splunk Enterprise 10.2.0–10.2.3 and 10.0.0–10.0.6 are affected. Fixed in 10.4.0, 10.2.4, 10.0.7+. Versions 9.4 and earlier, and Splunk Cloud Platform, are not affected. Some early write-ups overstated the range by merging this with other June Splunk CVEs — use Splunk's SVD-2026-0603 as the source of truth. What to do — treat it as break-glass: ✅ Upgrade to 10.4.0 / 10.2.4 / 10.0.7+ (patching is the only full fix) ✅ Can't patch yet? Temporarily disable the PostgreSQL sidecar (breaks Edge Processor / OpAmp / SPL2) ✅ Get Splunk management & service endpoints off the internet ✅ Hunt for path-traversal (../) in requests, odd PostgreSQL params, and unexpected file writes Full breakdown in the carousel 👇 Run Splunk? Share this with your SOC and platform teams. A question for the SOC leads: if your SIEM itself were the thing under attack, could your team still detect and respond without it? Curious how many have actually rehearsed that. #CyberSecurity #InfoSec #Splunk #SIEM #VulnerabilityManagement #PatchNow #BlueTeam

Accenture confirmed a July 2026 data breach after a malicious actor calling themselves "888" offered 35 gigabytes of internal development data for sale on a cybercrime forum. This is a high-value lesson for engineers, architects, and security teams. What happened: - Actor "888" listed about 35 GB of Accenture’s internal development data on a cybercrime forum. - Accenture confirmed the breach, reported containment and remediation, and stated no client service impact. Why does this matter: - 35 GB of development data can expose design details, infrastructure patterns, build pipelines, and potentially credentials or tokens. That information fuels follow-on attacks. - Development environments and toolchains often touch third-party services and CI/CD systems, increasing supply-chain and propagation risk. - Large consultancies are high-value targets. How they respond sets expectations for security posture and client trust across the industry. Actionable technical lessons: - Apply zero trust to developer tooling: enforce least privilege on repositories and CI/CD systems, require strong multifactor authentication, and use ephemeral credentials where possible. - Enforce secrets hygiene: eliminate hardcoded secrets, add automated secret scanning on pull requests and pipelines, and rotate keys immediately if exposure is suspected. - Keep immutable audit trails: capture secure, tamper-evident logs for repo access, artifact downloads, and pipeline runs to speed investigations. - Minimize sensitive data in dev: use obfuscated or synthetic test data, restrict export capabilities, and limit who can access development snapshots and artifacts. - Prepare rapid containment playbooks: automate credential revocation, provision isolated forensic environments, and maintain pre-approved client communication templates. - Vet third parties: require vendor security SLAs for developer tools and confirm cooperation clauses for incident response. Practical checklist for engineering leaders: (quick wins you can run this week) - Run a full secrets-scan sweep across source repos and CI artifacts. - Verify MFA and SSO enforcement for every developer tool and pipeline. - Rotate long-lived tokens used by build systems and cloud integrations. - Run a tabletop incident response exercise focused on dev-data exfiltration scenarios. - Revisit vendor contracts for clarity on breach notifications and cooperation. Discussion prompt: What are the top two technical controls you would add to this checklist for protecting development data and pipelines? Share them below — practical tips only, please. If you found this useful, please like, comment, and repost to help spread engineering-first security practices across our network. Reposts help teams learn faster and reduce repeat incidents. Accenture Security, Dark Reading, CyberArk 🧠🔐🛠️⚡🔎🤝 #Cybersecurity #IncidentResponse #DevSecOps #ZeroTrust #SupplyChainSecurity #SecureEngineering #InfoSec #Accenture #CyberAwareness

The need for Observability and Security to converge is ever growing, due to the need for runtime context, greater data access(without the duplication) and the ability to utilise this to automate and respond faster. Dynatrace now embeds Kubernetes security findings directly into the Kubernetes app, giving developers and SREs real-time, contextual insight into vulnerabilities, threats, and misconfigurations — without switching tools. #Dynatrace #Security #Runtime #Kubernetes

🚨 𝗩𝗲𝗲𝗮𝗺 𝗕𝗮𝗰𝗸𝘂𝗽 𝗙𝗹𝗮𝘄 𝗘𝗻𝗮𝗯𝗹𝗲𝘀 𝗥𝗲𝗺𝗼𝘁𝗲 𝗖𝗼𝗱𝗲 𝗘𝘅𝗲𝗰𝘂𝘁𝗶𝗼𝗻 A newly disclosed vulnerability (CVE-2026-44963) in Veeam Backup & Replication could allow authenticated domain users to execute remote code on backup servers. The flaw is linked to insecure BinaryFormatter deserialization, a long-standing security risk in .NET applications. 🔹 Remote Code Execution (RCE) 🔹 Low-privileged user exploitation 🔹 Backup infrastructure at risk 🔹 Immediate patching recommended Since backup servers are a frequent target for ransomware operators, organizations should prioritize applying security updates and restricting unnecessary access to critical backup systems. ➡️ 𝗥𝗲𝗮𝗱 𝗺𝗼𝗿𝗲 𝗳𝗿𝗼𝗺 𝗼𝘂𝗿 𝗗𝗮𝗶𝗹𝘆 𝗖𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗕𝗹𝗼𝗴: 🔗 https://lnkd.in/gjhi6WVM #CyberSecurity #Veeam #BackupSecurity #RemoteCodeExecution #RCE #Vulnerability #ThreatIntelligence #EnterpriseSecurity #PatchManagement #CyberThreats #InfoSec #SecurityUpdate #SOC #BlueTeam

𝗗𝗮𝘆 𝟮 𝗖𝗹𝗼𝘂𝗱 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗜𝗻𝘁𝗲𝗿𝘃𝗶𝗲𝘄 𝗤𝘂𝗲𝘀𝘁𝗶𝗼𝗻𝘀 𝗣𝗮𝗿𝘁 𝟯 🔒 Final 10 Security questions. Advanced and scenario based. 𝗤𝟮𝟭. What would you do if you discovered an access key was exposed in a GitHub repo? Immediately revoke the key. Rotate all credentials that may have been compromised. Check CloudTrail or Azure Activity Logs for unauthorised actions. Enable secret scanning on the repo to prevent future leaks. 𝗤𝟮𝟮. What is CloudTrail in AWS? Records every API call in your AWS account who did what, when, from where. Store logs in S3. Essential for audit, compliance, and incident investigation. 𝗤𝟮𝟯. What is Azure Activity Log? Records all management operations on Azure resources who created, modified, or deleted what and when. Retained 90 days by default. Export to Log Analytics for longer retention. 𝗤𝟮𝟰. What is the difference between a Security Group and a Firewall? Security Group stateful, instance level, allows or denies traffic to specific resources. Firewall network perimeter level, inspects all traffic. Use both defence in depth. 𝗤𝟮𝟱. How do you enforce least privilege at scale? Use IAM policies with specific resource ARNs not wildcards. Use permission boundaries. Use AWS Organizations SCPs or Azure Policy at account level. Review with IAM Access Analyzer regularly. 𝗤𝟮𝟲. What is a penetration test? Authorised simulated attack on your infrastructure to find vulnerabilities before real attackers do. Run before major releases and after significant architecture changes. 𝗤𝟮𝟳. What is CORS and why is it a security risk? Controls which domains can access your API. Misconfigured CORS with wildcard origins allows any website to make requests on behalf of authenticated users. Always specify exact allowed origins in production. 𝗤𝟮𝟴. What is Workload Identity Federation? Allows external workloads to authenticate to cloud services without storing long-term credentials. Uses OIDC tokens. In SecureOps the pipeline authenticates to Azure without any stored secrets. 𝗤𝟮𝟵. How do you handle secrets in a CI/CD pipeline? Never hardcode secrets in YAML or code. Store in Key Vault or Secrets Manager. Reference at runtime via Managed Identity. Mask secrets in logs. Rotate and automate rotation. 𝗤𝟯𝟬. What is the shared responsibility model? Cloud provider secures the infrastructure. You secure everything on top data, identity, OS, application, network config. Most breaches happen in the customer responsibility layer. 30 Security questions done. Tomorrow Networking. 👇 #CloudEngineer #CloudSecurity #DevSecOps #InterviewPrep #AWS #Azure #LearningInPublic #JobSearch #CareerGrowth

The Asset Identity Crisis: How to Unify Fragmented Security Tools Without a CMDB Nightmare Struggling with mismatched asset identifiers across your security tools? You're not alone. Many organizations face the 'asset identity crisis' where AWS instances, EDR endpoints, and vulnerability scanners report conflicting asset data, creating blind spots in security coverage. This guide reveals a practical, CMDB-free approach to unify fragmented security tools using confidence scoring, field normalization, and open-source solutions. Learn step-by-step merging logic, conflict resolution strategies, and a lightweight implementation plan to achieve a single source of truth for your IT assets without the complexity of a traditional CMDB.