Ray M., MSc, CFE @ItsRayHere

Beware there’s a fake KQ website under the name KQAirways.com that’s a pretty passable clone of the @KQSupport website. Double check any links purporting to share offers especially on social media advertising

Meet @ItsRayHere . Every cyber incident leaves a trail but only those who know what to look for can uncover the full story. At AfricaHackon Summit 2026, Ray Musumba will lead a masterclass on digital forensics, sharing how investigators uncover hidden evidence, interpret digital artefacts, and piece together what really happened after a cyber incident. Whether you're an aspiring cybersecurity professional, a SOC analyst, an incident responder, or simply curious about digital investigations, this session will equip you with practical insights you can apply in the real world. If you're ready to think beyond the obvious and see digital evidence through the eyes of a forensic investigator, you won't want to miss this session. Comment or DM us "SUMMIT" to receive the Summit programme, ticket information and registration link. #AfricaHackon #CyberSecurity #DigitalForensics #IncidentResponse #AfricaHackonSummit

The biggest cybersecurity threat isn't always the one you detect, it's the one you never see coming. Many organizations don't lack data. They lack the visibility, monitoring, and security processes needed to identify threats before they become costly incidents. Without the right systems in place, attacks can go unnoticed for weeks or even months giving attackers time to move through networks, access sensitive information, and disrupt operations. Cybersecurity today is about more than responding to incidents. It's about building the people, processes, and technologies that help you detect, respond to, and recover from threats effectively. At AfricaHackon Summit 2026, industry experts will share practical strategies for strengthening cyber resilience and staying ahead of an ever-evolving threat landscape. Comment or DM us "HACK" to receive the Summit programme and registration details. #AfricaHackon #CyberSecurity #CyberResilience #RiskManagement #AfricaHackonSummit

You're the person everyone calls when something breaks. You troubleshoot. You reset accounts. You configure devices. You keep the business running. Now you're ready for the next step. Cybersecurity isn't a completely new career, it's a natural progression for professionals who already understand how technology works and want to build deeper, more specialized skills. At AfricaHackon Academy, you'll learn alongside other IT support professionals, guided by industry mentors and backed by a community that continues to share opportunities, knowledge, and support long after the programme ends. Because the best career moves don't happen alone. Comment "ITPRO" or send us a DM, and we'll send you the Academy brochure, curriculum, and payment options

Interested in offensive security and real-world cyber operations? Meet Gichuki Jonia John, who will lead a practical Computer Network Exploitation (CNE) masterclass inside a fully emulated cyber range, demonstrating how intelligence-driven cyber operations are planned and executed. Calling all IT professionals with a passion for Red Teaming, cyber operations, and practical cybersecurity, this session is designed for you. Comment or DM us "SUMMIT" to receive the full Summit programme and registration details.

65 days to go. You don't need another article telling you cybersecurity is growing. You need a place to meet the people who made the transition, ask questions, and understand what the journey actually looks like. AfricaHackon Summit 2026 is where career changers meet practitioners, mentors, and employers who can help make the next step clearer. Comment "SWITCH" or send us a DM to receive the Summit details

Come through and hear from industry professionals. I’ll be leading the discussion when it comes to digital forensics.

AfricaHackOn @AfricaHackon

4 weeks ago

The cybersecurity industry is growing, but opportunities rarely find people who stay on the sidelines. Whether you're a •⁠ ⁠Student •⁠ ⁠⁠Career switcher •⁠ ⁠⁠IT professional •⁠ ⁠⁠Business owner •⁠ ⁠⁠Curious about cybersecurity There is a place for

keyboard_arrow_left Previous keyboard_arrow_right Next

0 15 22 1K 3

Dennis Itumbi, Head of Presidential Special Projects in Kenya's State House, shared a photo on X claiming to show world leaders at the 2026 G7 Summit. It contains at least four verifiable red flags. A fact-check🧵

-Dennis Itumbi, CBS @OleItumbi

a month ago

G 7. President @WilliamsRuto

keyboard_arrow_left Previous keyboard_arrow_right Next

270 124 834 336K 30

‼️🚨 BREAKING: 320,000 Fortinet firewall devices have been targeted in a campaign that has been dubbed 'FortiBleed'. Attackers were able to confirm 75,000 working credentials against the admin and SSL VPN interfaces. The victims include really big names like Samsung, Oracle, Spotify, Sony, and more. The data was first surfaced by researcher Volodymyr "Bob" Diachenko and analyzed by Hudson Rock and SOCRadar. The operation runs as a self-feeding loop. Attackers scan the internet for exposed Fortinet devices, then test each one against a curated list of passwords leaked from earlier Fortinet breaches and infostealer logs. Every successful login gets recorded into a verified database. They then turn each compromised box into a listening post, sniffing the traffic passing through the firewall to harvest fresh credentials, which go straight back into the scanner. The scale is large. The group ran an estimated 1.16 billion credential attempts against more than 320,000 FortiGate targets, plus 2.1 billion brute-force tries against 160,000 MSSQL servers. In the deeper intrusions they intercept SSL VPN authentication hashes, crack them on a dedicated 45-GPU cluster, and move into internal Active Directory. Diachenko confirmed full network compromises in Japan, Taiwan, Vietnam, Iraq, and Turkey, including a Turkish NATO defense contractor that had classified defense documents stolen. If you run Fortinet, act now: rotate every VPN and admin credential, enforce MFA on all external gateways, restrict management access to approved sources, segment internal networks, and audit gateway logs for unusual logins. Hudson Rock has a free domain lookup at hudsonrock.com/fortinet. Data surfaced via the Hunt Intelligence, Inc. feed.

keyboard_arrow_left Previous keyboard_arrow_right Next

@designsentry @AikidoSecurity What are you saying? 😂

⚠️ New "IronWorm" supply-chain attack: 30+ npm packages from @ asteroiddao shipped a malicious Rust binary firing on preinstall. It sweeps 86 env vars + 20 credential files (AWS, GCP, Vault, npm, plus AI keys like Anthropic & OpenAI), hits Exodus wallets, hides behind an eBPF rootkit, and beacons over Tor. Self-propagates via npm Trusted Publishing OIDC, with backdated commits faked as claude/dependabot/renovate.

@ODPC_KE You say registration is a statutory obligation but the registration flow presents an optional path for businesses with turnover < KES 5m and that don’t process data in sensitive categories predetermined by ODPC. So is it actually mandatory? Messaging is unclear.

@ODPC_KE You say registration is mandatory but the registration flow presents an optional path for businesses with turnover < KES 5m and that don’t process data in sensitive categories predetermined by ODPC. So is it actually mandatory? Messaging is unclear.

Let me just laugh. 😂

GitHub @github

2 months ago

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely

2K 5K 25K 13.9M 6K

Ikeja Electric was hacked through a profile photo upload form. The threat actor exploited an Unrestricted File Upload vulnerability on their Smart Warehousing Inventory Management System, uploaded a webshell, and had remote access within minutes. From there, he moved through their network, finding passwords stored in plain text, using them to access internal systems, and eventually cracking the domain admin password. Gaining full control in four days.​​​​​​​​​​​​​​​​ He then exploited an unpatched VMware vCenter server—software from 2018, never updated—and according to him, deployed ransomware across 50+ hosts, taking down metering software across their systems. I’ve published a full analysis of what I’m now calling cyber-terrorism against Nigerian critical infrastructure, along with a practical advisory for affected individuals, organisations, and regulators. securityintelligence.substack.com/p/a-security-a…

🚨 UPDATE on the cPanel/WHM authentication bypass (CVE-2026-41940): Shadowserver now reports at least 44,000 unique IPs compromised and actively scanning their honeypot network on April 30, 2026. What this means in practice. Within roughly 24 hours of public disclosure, attackers have already taken over enough vulnerable cPanel/WHM servers to use them as a global scanning swarm, hunting for the next batch of victims. Each of those 44,000 IPs is itself a compromised host, mostly shared-hosting servers running customer websites, email, and databases. Shadowserver also reports approximately 650,000 cPanel/WHM instances exposed to the internet in total. Anything not patched today is sitting in the targeting pool.

International Cyber Digest @IntCyberDigest

3 months ago

🚨 BREAKING: cPanel and WHM, the control panels behind an estimated 70+ million websites, have a critical security flaw that lets anyone become root admin without a password. CVE-2026-41940 affects every supported version. It’s already being exploited in the wild. watchTowr Labs

keyboard_arrow_left Previous keyboard_arrow_right Next

103 771 4K 561K 2K

🚨 BREAKING: cPanel and WHM, the control panels behind an estimated 70+ million websites, have a critical security flaw that lets anyone become root admin without a password. CVE-2026-41940 affects every supported version. It’s already being exploited in the wild. watchTowr Labs published the full attack today, after the hosting company KnownHost confirmed the bug was already being used to break into a significant chunk of the internet. If you've never heard of cPanel: it's the dashboard that hosting providers and millions of website owners use to manage their servers, domains, email accounts, databases, and SSL certificates. WHM is the admin version that controls the entire server. If someone gets root access to WHM, they get the keys to the kingdom and to every apartment inside it. How the attack works, in plain English: 🔴 Step 1: The attacker sends a deliberately wrong login. cPanel still creates a temporary "you tried to log in" record on disk and gives the attacker a cookie tied to it. 🔴 Step 2: The attacker tweaks the cookie to disable cPanel's password encryption. Normally cPanel encrypts the password field on disk. With one small change to the cookie, cPanel just stores it as plain text instead. 🔴 Step 3: The attacker sends a fake login attempt where the password field secretly contains hidden line breaks. cPanel does not strip these line breaks out, so they get written straight to the session file. Each line break creates a brand new fake record. The attacker uses this to inject lines that say "this user is root" and "this user already authenticated successfully." 🔴 Step 4: The attacker visits one more random page on the site to nudge cPanel into re-reading the file. cPanel then promotes the injected fake lines into its main session memory. 🔴 Step 5: On the next request, cPanel sees a flag that says "this user already passed the password check." cPanel trusts that flag, skips checking the actual password, and lets the attacker in as root. From start to finish, the attack takes a handful of HTTP requests. If you run cPanel or WHM, the patched versions are: 🔴 cPanel/WHM 110.0.x → 11.110.0.97 🔴 cPanel/WHM 118.0.x → 11.118.0.63 🔴 cPanel/WHM 126.0.x → 11.126.0.54 🔴 cPanel/WHM 132.0.x → 11.132.0.29 🔴 cPanel/WHM 134.0.x → 11.134.0.20 🔴 cPanel/WHM 136.0.x → 11.136.0.5 If your version is older than these, assume someone has already broken in and act accordingly. Patch right now, then rotate every password and key the server touched: root passwords, API tokens, SSL private keys, SSH keys, mail passwords, and database passwords.

keyboard_arrow_left Previous keyboard_arrow_right Next

x.com/i/article/2048…

We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems, impacting a limited subset of customers. Please see our security bulletin: vercel.com/kb/bulletin/ve…

@kcsfa Good idea, though I foresee adoption challenges. For instance, how does this work where publishers use pseudonyms and other anonymization techniques for legitimate reasons?