we need to get 1k mastodon users to log in

RE: https://infosec.exchange/@BleepingComputer/117121120169040130

Focus on cyber resilience, not AI marketing.

🚨🇿🇼 Hamara allegedly breached, data tied to 11K+ users advertised on a cybercrime forum
⠀
A forum user claims to have breached Hamara, a Zimbabwe-based agriculture and farming platform, after allegedly obtaining exposed credentials and accessing an administrative account that lacked two-factor authentication.
⠀
The listing claims the compromised environment contains:
⠀
• User account data
• Names and usernames
• Email addresses
• Phone numbers
• Account roles and verification status
• Business information
• Business contracts
• Business PDF documents
• Audit logs
• Institution records
• Service data
• Event data
• Marketplace and unit information
• Administrator and manager data
⠀
The account reportedly had access to information associated with more than 11,000 users at the time of the alleged breach. Sample records containing customer names, usernames, emails, phone numbers and account roles were published in the thread.
⠀
The claims and the authenticity, source and scope of the allegedly exposed data have not been independently verified.
⠀
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Après plus de 2 mois du pire des étés pourris, il semble que ce soit vraiment le dernier jour de canicule...!! L'eau revient....

Securo: Self-hosted, privacy-first open-source personal finance manager.

GitHub: https://github.com/securo-finance/securo

A bunch of Andrew Tate fans doing push ups outside of his prison to impress him or something is the most homoerotic shit I’ve ever seen and I spent my 20s frequenting leather bars.

The Palo Alto Networks firewall Master Key is p1a2l3o4a5l6t7o8 and it is well past time you changed it!

If you have never changed it, your LDAP service account password is sitting in your firewall config encrypted with a key the whole internet has known since 2016 [1]. So are your API keys, certificate private keys, RADIUS secrets and IPSec pre-shared keys.

And that config is on someone's laptop. In SharePoint. In a ticket you raised with Palo support three years ago.

Public tools [2] will decrypt anything encrypted with the default key. Any threat actor who gets one of those files gets your LDAP service account and walks straight off the firewall into your AD.

This is not theoretical.

Palo's own Unit 42 [3] documented attackers copying running-config.xml to a web-accessible path and retrieving it after exploiting CVE-2024-3400.

Fortinet has had two mass events on exactly this pattern: the Belsen Group dump of ~15,000 FortiGate configs and VPN credentials in January 2025 [4], and FortiBleed in June 2026, where configs from ~75,000 firewalls were cracked offline into working admin credentials [5].

You have always been able to change the Master Key. In my experience nobody ever does as it hasn't been without risk. If you forget to rotate the key before it expires then you risk bricking your firewall.

In PAN-OS 12.2.2, Palo Alto Networks have finally started forcing the issue. It enforces replacement of the default master key within a grace period of 60 days after which the firewall blocks all commits and HA synchronisation. This is a significant operational change and it is not in the release notes but is buried in the admin guide [6].

Three things to do in the next few weeks:

1. Check your config backups are automated and actually working. You want a known-good backup before you touch the key.

2. Change the Master Key. Do it on your schedule, not on Palo's.

3. Rotate the secrets. Changing the key re-encrypts the secret on the box; every copy already out there is still decryptable with the default key.

For more depth see my research [7] and conference talk [8].

[1] @felix "Attacking Next-Generation Firewalls: Breaking PAN-OS", TROOPERS16 — https://troopers.de/media/filer_public/a5/4d/a54da07e-3780-4f83-b4ac-8c620666a60a/paloalto_troopers.pdf
[2] https://github.com/cybliminal/palo-secret-decryptor
[3] https://unit42.paloaltonetworks.com/cve-2024-3400/
[4] https://censys.com/blog/fortigate-config-leak-impact/
[5] https://www.picussecurity.com/resource/blog/fortibleed-inside-the-campaign-that-cracked-75000-fortinet-firewalls
[6] https://docs.paloaltonetworks.com/ngfw/administration/certificate-management/master-key-encryption/configure-master-key
[7] https://cybliminal.com/pdf/Panning_for_Gold.pdf
[8] https://www.youtube.com/watch?v=2PF4aSY1gVo