Mandiant (part of Google Cloud)

LLMJacking needs to be on your radar. 📡

Threat actors have used leaked IAM and GitHub keys to enable cloud LLM services, route stolen quotas to underground “LLM Mixers,” and rack up $100K/day bills.

Defend using our playbook 👇

Sharpen your threat hunting skills! 🔎

Join us Nov. 17–18 (EMEA hours) for our virtual Threat Hunting with Google workshop. Hunt simulated threats, explore key MITRE ATT&CK techniques, and learn from frontline experts.

goo.gle/4ezaClu

Friday focus: CTI. 🧑‍💻

Explore Mandiant Academy courses on OSINT, network enrichment, & attribution.

Swipe for the details and find links in the thread below. 👇

🚨 Two critical PHP core vulnerabilities (CVSS 9.2) expose web apps to RCE and memory disclosure across PHP 5.4–8.5.11. Use our guide to patch and hunt for compromise.

@googlecloud advisory: goo.gle/4idT13I
@wiz_io research: goo.gle/4BiQgGX

🚨 Suspected PRC-nexus actor ARMORY CASTLE is exploiting a BeyondTrust zero-day (CVE-2026-102764) to gain root persistence, dump vault secrets, and wipe logs.

📋 Full analysis & IOCs: goo.gle/4dKpqxv