35
30
35
30
35
35
35
30
35
35
35
35
30
30
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Logging Denial of Service Vulnerability
Cisco patched an ASA/FTD rate-limiting flaw where TCP SYN floods trigger excessive syslog 419002 messages, causing high CPU and degraded performance.
A vulnerability in the system rate-limiting process for syslog message 419002 in Cisco Secure Firewall ASA and FTD Software allows an unauthenticated, remote attacker to cause high CPU utilization. The flaw results from improper rate limiting; an attacker can exploit it by sending a flood of TCP SYN packets, degrading device performance. Cisco has released software updates.
28
30
35
45
35
30
45
30
30
30
30
35
30
45
30
45
30
30
35
30
30
30
Angry Birds: Toy Ghouls’ new toys
Kaspersky tracks ransomware group Toy Ghouls deploying new custom backdoors, mqtt-bird-agent and matrix-bird-agent, using HiveMQ MQTT and Element as C2 channels.
Kaspersky reports that Toy Ghouls (also known as Bearlyfy, Laboo.boo and Feral Wolf), a financially motivated group targeting Russian organizations since 2025, shifted from leaked Babuk and LockBit builders and public GitHub tools to its custom GenieLocker ransomware. In early July 2026 the group deployed two custom backdoors: mqtt-bird-agent 0.1.0 using the public HiveMQ MQTT broker as C2, and matrix-bird-agent 0.1.0 using the Element messenger. The backdoors are delivered via WinRM using Evil-WinRM and WinRM-fs, persist as Windows services, and encrypt their configuration with ChaCha20-Poly1305 keyed to the machine's MachineGuid registry value.
45
45
30
30