60
60
60
60
60
60
60
60
A stranger has been reading Salesforce and ServiceNow portals worldwide for 17 months
Reco tracks City-Forum, an actor abusing Salesforce and ServiceNow guest-user access from one IP for 17 months to enumerate portal data.
Reco's City-Forum investigation found one IP address, tied to a dormant 2002 domain, anonymously enumerating Salesforce Experience Cloud and ServiceNow portals across telecoms, banks, enterprise software vendors, and public sector since at least March 2025. No vulnerability was exploited and no credentials were used; the actor abused over-permissioned guest users, including a previously undocumented ServiceNow portal search endpoint, with the busiest single target logging over 560,000 events. Audit logs show what was requested but not which records or fields were returned, so defenders must replay anonymous requests to assess exposure.
62
60
60
60
60
60
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
Reco tracks the City Forum campaign: one Contabo VPS has scraped Salesforce and ServiceNow guest portals across finance, telecom and public sector since March 2025.
Reco researchers identified infrastructure at 158.220.87.79, a Contabo VPS using Go's default net/http user agent, that has harvested records from Salesforce Experience Cloud and ServiceNow customer portals across telecom, financial services, enterprise software and public sector targets for over a year. The tool abuses over-privileged persistent guest users, enumerating Salesforce Aura sites (560,000+ events at one target), probing Lightning Web Runtime via the UI-API across API versions v56.0-v66.0, and hitting the poorly documented ServiceNow Service Portal search endpoint. No named victims or actor attribution yet, and activity is ongoing with rising volume. Defenders are advised to hunt the Go-http-client user agent and specific IP in Salesforce Event Monitoring logs and syslog_transaction on ServiceNow, then tighten guest sharing rules and Knowledge Base read criteria.
68
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
153GB of stolen credentials surface after LiteLLM supply chain attack
153GB archive from the LiteLLM supply chain attack exposes secrets from about 2,500 companies, including AWS, Samsung, Cisco and Salesforce.
Hudson Rock obtained and analyzed a 153GB archive stolen in the LiteLLM supply chain attack, containing 433,909 files with secrets attributed to 2,488 corporate domains, including AWS, Samsung, Cisco, Salesforce, NVIDIA, Microsoft and Siemens. TeamPCP compromised Trivy on March 19, 2026, stole LiteLLM's PyPI publishing tokens through the build pipeline, and published malicious LiteLLM versions 1.82.7 and 1.82.8 on March 24. CloudSEK separately estimated close to 2,500 exposed organizations, and Kevin Beaumont confirmed the data is legitimate. Hudson Rock is running a global ethical disclosure effort and urges organizations to rotate secrets before the trove leaks publicly.
90
60
60
60
60
60
Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited
Weekly roundup: Cisco FMC and N-able N-central zero-days exploited in the wild, MikroTik RouterOS hijacks, Microsoft Patch Tuesday ships two exploited zero-days.
State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass in Cisco Secure Firewall Management Center (FMC), alongside CVE-2026-20316. N-able issued an emergency hotfix for CVE-2026-86218, a critical pre-auth RCE in the N-central RMM platform exploited in the wild. CERT Polska disclosed six RouterOS vulnerabilities being chained to hijack internet-exposed MikroTik devices. Microsoft's September 2026 Patch Tuesday shipped a record patch count including two zero-days, while roughly 67,000 Trezor customers faced phishing after a shipping-partner breach and researchers privately disclosed a zero-click WeChat worm to Tencent.
70