Wolfcore Blog Posts

GitHub Account Hijack: Revoke Access Before You Rotate

A GitHub account hijack used stolen tokens on 4,837 accounts to push a secret stealer into repositories. Revoke access first, then rotate secrets …

Apache HTTP/2 Vulnerability CVE-2026-119618: Check Your Server

Apache HTTP/2 vulnerability CVE-2026-119618 may allow remote code execution. Check if your server is affected, and what to do this week to stay safe …

N-able N-central Zero-Days: 3 Questions for Your IT Provider

A remote management tool used by IT providers had 33 exploits published. N-able has a fix. Here is what that tool can do and what to ask your provider …

Barracuda Email Security Gateway Exploited: Patch, Then Test (Wolfcore)

Barracuda Email Gateway Exploited: Patch, Then Pen Test It

Barracuda says attackers are exploiting its Email Security Gateway flaws. Patching is step one. Here is what a penetration test finds that patching misses …

Supplier Data Breach: What Who Gives A Crap Teaches SMEs

A marketing tool held Who Gives A Crap customer data and was breached. What UK businesses should ask suppliers, and when the ICO must hear about it …

Claude Code Secrets Leak: Check Your Repos and Rotate Keys

Apiiro found 1,122 public Claude Code settings files holding secrets. Here is how a “don’t ask again” click saves a password, and what to rotate first …

Device Code Phishing: Fake AI Event Invites Beat Your MFA

Device code phishing uses fake OpenAI and SpaceX event pages to get staff to approve attacker sign-ins on a real Microsoft page. What to block this week …

Zyxel GS1900 Patch Failed: Check Your Office Switches Now

Zyxel GS1900 patch did not block the exploit, researchers say. See what UK small businesses should check on their switches this week, in plain English …