Border Cyber Group

Pull the Cable? The Unsolved Physics of Network Isolation

Software-defined network isolation is a category error: any control enforced by software on addressable hardware can be defeated by an adversary who owns it. Physical isolation has real limits too — and the industry refuses to discuss either.

10 Jun 2026 ics ot criticalinfrastructure APT stuxnet volt-typhoon ransomware deep-dive

The Exposed Grid: A History of Critical Infrastructure Cyber Attacks

From Stuxnet's centrifuge sabotage to Volt Typhoon's silent pre-positioning inside US power grids — a technical history of critical infrastructure attacks and why 180,000 internet-exposed ICS devices make the ATG advisory a warning, not an anomaly.

10 Jun 2026 APT crimeware dfir ransomware supplychain detection

Border Cyber - Daily Intel Feed

Veeam RCE PoC live; Check Point VPN zero-day tied to Qilin ransomware; LiteLLM command injection chains to unauth RCE — both KEV Jun 8. Linux nf_tables full exploit public. Miasma worm hits 73 Microsoft repos. UNC3753 adds physical intrusion to vishing playbook.

09 Jun 2026 nginx Ghost CMS Ubuntu unattended-upgrades Incident Response Self-Hosting Node.js server administration

When Your Web Server Patches Itself Into a Wall

A routine reboot left two Ghost sites unreachable. The cause: a buggy Ubuntu nginx security patch crashing every worker, compounded by a Node.js version drift breaking Ghost admin. Two hours of diagnosis, two one-line fixes. A cautionary tale about automated updates gone wrong.

09 Jun 2026 vulnerability Vuln APT supply-chain dfir followup detection

BORDER CYBER GROUP — Daily Digest

Check Point VPN bypass (Qilin-linked), Cisco SD-WAN zero-day (no patch), and Netlogon DC RCE dominate today. Miasma worm pivots supply-chain to IDE config files. VerdantBamboo 18-month APT persistence disclosed. Linux nf_tables LPE PoC published. UNC3753 adds physical office intrusion.