This is a story of network segmentation and the impact that seemingly trivial misconfigurations can have for your organization. This is one of those occasions.
This particular pen test asked for goals-based assessment focusing on post-compromise activities — an attempt by the client to discover how vulnerable internal systems were to lateral movement by an attacker who had compromised the domain. Among the goals was a request to attempt to compromise the client’s Amazon Web Services (AWS) infrastructure and a secondary request to access and exploit any systems discovered to contain sensitive or critical operational data .
Read more…
Source: Rapid7
Related:
- UK and Germany launch joint-partnership to counter sabotage and cyber attacks
October 8, 2026
Prime Minister Andy Burnham will travel to Berlin today for talks with Chancellor Friedrich Merz, as the UK and Germany work together on technologies and industries that will drive growth in every UK postcode, and build resilience against shared threats. The UK and Germany are Europe’s two largest economies and biggest investors in defence and today ...
- Update Chrome and ChromeOS to fix critical security issues
October 7, 2026
Google has released updates for the Chrome browser and the ChromeOS operating system. On October 6, Google released a Stable Channel Update for Desktop. This is the most important one for desktop users. It brings Chrome to version 155.0.8059.39 for Linux and versions 154.0.8037.39/.40 for Windows and Mac. The update includes 247 security fixes including four rated Critical. On the same ...
- Medical records giant Epic pauses product development to fix security bugs that risk patients’ data
October 2, 2026
Epic, the software technology giant that makes the widely used MyChart software for accessing patients’ medical data, has paused most of its product development as the company works to protect its software and systems from cyberattacks. Judy Faulkner, the founder and chief executive of Epic, told Modern Healthcare last month that the pause would likely last ...
- Apple says it’s tightening macOS ‘Full Disk Access’ controls due to new risks from AI agents
October 2, 2026
Days after a journalist claimed that Meta’s Muse app on Mac read their private messages — a claim that Meta disputed — Apple announced that it’s introducing additional controls around a setting called “Full Disk Access” on macOS. The feature was designed to allow backups to function properly, but AI agents have now increased “the ...
- Update your iPhone, iPad, or Mac: Flaw could run attackers’ code
September 29, 2026
Apple has released updates for iPhones, iPads, and Macs to fix a flaw that could let an attacker run code when a device processes a malicious file. Apple says it may have been used in highly targeted attacks against iPhone users running versions of iOS before iOS 27. The fix is in iOS and iPadOS 26.7.1, ...
- Bill Gates says unchecked AI could ‘cause a billion deaths’ in call for regulation
September 27, 2026
Bill Gates has called on the US’s federal legislators and law enforcers to regulate the development of artificial intelligence (AI), saying in an interview airing on Sunday that the technology left unchecked could cause “a billion deaths” and “no one thinks self-regulation is enough”. “You need law enforcement and the politicians to get into the discussion ...