Endi mavjud! Telegram Tadqiqoti 2025 — yilning asosiy insaytlari 
SITREP - Independent OSINT Channel
Kanalga Telegram’da o‘tish
AI, technology, mass surveillance, and intelligence — everything you need to know about tomorrow.
Ko'proq ko'rsatish📈 Telegram kanali SITREP - Independent OSINT Channel analitikasi
SITREP - Independent OSINT Channel (@sitreports) Ingliz til segmentidagi kanali faol ishtirokchi. Hozirda hamjamiyat 23 418 obunachidan iborat bo'lib, Texnologiyalar & Aralashmalar toifasida 5 755-o'rinni va AQSH mintaqasida 1 724-o'rinni egallagan.
📊 Auditoriya ko‘rsatkichlari va dinamika
невідомо sanasidan buyon loyiha tez o‘sib, 23 418 obunachiga ega bo‘ldi.
30 Iyun, 2026 dagi oxirgi ma’lumotlarga ko‘ra kanal barqaror faollikka ega. Oxirgi 30 kunda obunachilar soni -50 ga, so‘nggi 24 soatda esa -11 ga o‘zgardi va umumiy qamrov yuqori darajada qolmoqda.
- Tasdiqlash holati: Tasdiqlanmagan
- Jalb etish (ER): Auditoriya o‘rtacha 13.85% darajada jalb etiladi. Nashrdan keyingi dastlabki 24 soatda kontent odatda umumiy obunachilar sonining 2.01% ini tashkil etuvchi reaksiyalarni to‘playdi.
- Post qamrovi: Har bir post o‘rtacha 3 244 marta ko‘riladi; birinchi sutkada odatda 470 ta ko‘rish yig‘iladi.
- Reaksiyalar va o‘zaro ta’sir: Auditoriya faol: har bir postga o‘rtacha 0 ta reaksiya keladi.
- Tematik yo‘nalishlar: Kontent narrative, attack, infrastructure, threat, credential kabi asosiy mavzularga jamlangan.
📝 Tavsif va kontent siyosati
Muallif resursni shaxsiy fikrni ifoda etish maydoni sifatida ta’riflaydi:
“AI, technology, mass surveillance, and intelligence — everything you need to know about tomorrow.”
Yuqori yangilanish chastotasi (oxirgi ma’lumot 01 Iyul, 2026 da olingan) sababli kanal doimo dolzarb va katta qamrovli bo‘lib qoladi. Analitika auditoriya kontent bilan faol hamkorlik qilishini, uni Texnologiyalar & Aralashmalar toifasidagi muhim ta’sir nuqtasiga aylantirishini ko‘rsatadi.
23 418
Obunachilar
-1124 soatlar
-297 kunlar
-5030 kunlar
Ma'lumot yuklanmoqda...
O'xshash kanallar
Taglar buluti
Kirish va chiqish esdaliklari
---
---
---
---
---
---
Obunachilarni jalb qilish
Iyul '26
Iyul '260
0 kanalda
Iyun '26
+154
2 kanalda
Get PRO
May '26
+48
6 kanalda
Get PRO
Aprel '26
+113
14 kanalda
Get PRO
Mart '26
+380
6 kanalda
Get PRO
Fevral '26
+121
1 kanalda
Get PRO
Yanvar '26
+143
1 kanalda
Get PRO
Dekabr '25
+90
4 kanalda
Get PRO
Noyabr '25
+92
1 kanalda
Get PRO
Oktabr '25
+43
2 kanalda
Get PRO
Sentabr '25
+22
1 kanalda
Get PRO
Avgust '25
+14
2 kanalda
Get PRO
Iyul '25
+136
2 kanalda
Get PRO
Iyun '25
+186
5 kanalda
Get PRO
May '25
+28
6 kanalda
Get PRO
Aprel '25
+13
6 kanalda
Get PRO
Mart '25
+13
5 kanalda
Get PRO
Fevral '25
+11
9 kanalda
Get PRO
Yanvar '25
+11
3 kanalda
Get PRO
Dekabr '24
+62
5 kanalda
Get PRO
Noyabr '24
+128
32 kanalda
Get PRO
Oktabr '24
+45
1 kanalda
Get PRO
Sentabr '24
+93
8 kanalda
Get PRO
Avgust '24
+1 524
67 kanalda
Get PRO
Iyul '24
+478
54 kanalda
Get PRO
Iyun '24
+984
76 kanalda
Get PRO
May '24
+1 380
80 kanalda
Get PRO
Aprel '24
+1 274
64 kanalda
Get PRO
Mart '24
+1 674
74 kanalda
Get PRO
Fevral '24
+1 629
80 kanalda
Get PRO
Yanvar '24
+1 576
67 kanalda
Get PRO
Dekabr '23
+1 932
63 kanalda
Get PRO
Noyabr '23
+1 211
75 kanalda
Get PRO
Oktabr '23
+1 367
60 kanalda
Get PRO
Sentabr '23
+1 173
0 kanalda
Get PRO
Avgust '23
+985
0 kanalda
Get PRO
Iyul '23
+597
0 kanalda
Get PRO
Iyun '23
+1 518
0 kanalda
Get PRO
May '23
+1 048
0 kanalda
Get PRO
Aprel '23
+1 017
0 kanalda
Get PRO
Mart '23
+675
0 kanalda
Get PRO
Fevral '23
+1 080
0 kanalda
Get PRO
Yanvar '23
+2 476
0 kanalda
Get PRO
Dekabr '22
+4 174
0 kanalda
Get PRO
Noyabr '22
+5 621
0 kanalda
| Sana | Obunachilarni jalb qilish | Esdaliklar | Kanallar | |
| 01 Iyul | 0 |
Kanal postlari
🔍 Langflow RCE Used to Drop Monero Miner on Exposed AI App Endpoints
Attackers are exploiting a remote code execution flaw in Langflow to deploy Monero mining payloads on internet-exposed AI application endpoints. The observed activity turns vulnerable servers into cryptomining nodes rather than using them for data theft or persistence-heavy post-exploitation.
The case underscores a familiar pattern in AI tooling: externally reachable management or app interfaces are becoming low-friction targets once RCE is available. Even a miner-only intrusion is operationally relevant, as it confirms unauthorized code execution on exposed infrastructure and highlights weak exposure control around AI stacks.
🛰️ Open sources - closed narratives
@sitreports
| 2 |  🔍 CISA adds critical SimpleHelp auth bypass to KEV
CISA has added CVE-2026-48558 to the Known Exploited Vulnerabilities catalog. The flaw affects SimpleHelp 5.5.15 and earlier plus 6.0 pre-release builds, and allows remote unauthenticated attackers to forge OIDC identity tokens and obtain a fully authenticated technician session. In some setups, MFA can also be bypassed. Federal agencies have until 2 July 2026 to remediate.
The issue is high impact because SimpleHelp is commonly used for remote support and privileged endpoint access. A compromised server can hand an attacker technician-level control across managed systems, enabling remote access, script execution, and wider network compromise.
🛰️ Open sources - closed narratives
@sitreports | 84 |
| 3 |  🔍 Malicious PyPI forks targeted Telegram bot infrastructure
At least eight trojanized Pyrogram forks on PyPI were used from November 2025 to June 2026 to backdoor Telegram bot deployments. The packages added a hidden module that registers covert bot commands, allowing attackers to execute Python code or shell commands, read arbitrary files, dump secrets, and return results via Telegram.
The operation focused specifically on bot accounts, indicating a deliberate push for access to production servers rather than developer endpoints. Shared code, command structure, infrastructure, and Telegram IDs tie the packages to one actor, turning a routine dependency install into direct server-level compromise.
🛰️ Open sources - closed narratives
@sitreports | 116 |
| 4 |  🔍 BioShocking exposes a control gap in AI browsers
LayerX says its BioShocking prompt-injection PoC manipulated six agentic browser products into treating unsafe actions as part of a fictional game scenario, culminating in copying and sharing sensitive data from a GitHub repository. OpenAI reportedly fixed the issue in ChatGPT Atlas; other tested products remained vulnerable or unresponsive.
The reported failure is not simple prompt abuse but context collapse: agents did not separate game logic from real-world data handling. That makes guardrails brittle when browser agents are granted live access to repositories, credentials, or web sessions.
🛰️ Open sources - closed narratives
@sitreports | 158 |
| 5 | 📡 XSS.is takedown hit a ransomware supply hub, not the market
French and Ukrainian police arrested the alleged admin of XSS.is in Kyiv and seized the forum plus its Jabber infrastructure. Europol said the Russian-language forum had 50,000+ members and generated over EUR 7 million through escrow services. Research from the leaked database shows a marketplace centered on exploits, malware, crypting, stolen access, shells, databases, and RDP footholds.
The key loss is trust, not capability. XSS functioned as the brokerage layer connecting sellers and buyers across the intrusion chain, especially initial access. With forum data, private messages, IPs, emails, hashes, and Jabber logs exposed, the takedown degrades anonymity and escrow confidence, while access-broker activity is already shifting elsewhere.
🛰️ Open sources - closed narratives
@sitreports | 192 |
| 6 |  🤖 RustDuck Rebuilds for Cross-Platform DDoS Operations
The RustDuck botnet has been rebuilt in Rust and is targeting routers and servers for DDoS activity. The rewrite indicates an updated malware codebase aimed at compromising internet-facing infrastructure rather than endpoint-heavy environments.
A Rust implementation improves portability and can streamline deployment across mixed Linux-based targets common in network appliances and hosted systems. That shifts the threat from simple botnet persistence to scalable abuse of exposed infrastructure with direct impact on service availability.
🛰️ Open sources - closed narratives
@sitreports | 198 |
| 7 |  📡 Citrix ships fixes for six NetScaler flaws
Citrix has patched six vulnerabilities in NetScaler ADC and NetScaler Gateway, including issues that can enable unintended file read access and denial-of-service conditions. The affected products sit at the network edge for many enterprises, making the NetScaler flaws relevant for internet-facing infrastructure and remote access environments.
For defenders, this is a perimeter hardening event rather than a routine maintenance update. Appliances handling application delivery and gateway functions can expose high-value paths into enterprise networks, so patch velocity and validation on externally exposed instances are the key operational variables.
🛰️ Open sources - closed narratives
@sitreports | 245 |
| 8 |  🤖 US set to remove export controls on Anthropic’s Fable AI model
The U.S. is expected to lift export restrictions on Anthropic’s Fable AI model on Tuesday. The move would reverse a recent control measure imposed on one of the company’s advanced systems.
This signals a fast policy adjustment in how Washington handles high-end AI exports. For OSINT tracking, the key indicator is not just the reversal itself, but how quickly U.S. authorities recalibrate access controls around frontier models with security implications.
🛰️ Open sources - closed narratives
@sitreports | 285 |
| 9 |  📡 III MEF fields MRIC in Guam during Valiant Shield
III Marine Expeditionary Force used the Medium-Range Intercept Capability during simulation drills at Guam’s Mason range in Valiant Shield 26, marking the first confirmed appearance of the system in the exercise. The mobile air-defense platform gives the Marine Corps an organic 4–70 km layer against cruise missiles and drones; recent interceptor deliveries and FY2027 funding plans indicate the program is moving beyond trials into force integration. MRIC is based on the Iron Dome concept and uses SkyHunter interceptors.
Operationally, this adds a mobile medium-range shield to forward Marine units in the Pacific, reducing dependence on other services for local air defense. Its integration in Guam aligns with a wider shift toward sustaining forces inside contested engagement zones.
🛰️ Open sources - closed narratives
@sitreports | 531 |
| 10 |  🤖 Overland AI gets $20M Pentagon deal for Marine Corps autonomous resupply vehicles
Overland AI has secured a $20 million production contract to deliver more than a dozen autonomous ground vehicles for Marine Air Defense Integrated System resupply. The APFIT-backed award also covers the company’s OverWatch and OverDrive software, spares, and services, with initial deliveries expected about nine months after award.
The contract marks a shift from prototyping to production for autonomous ground systems in Marine service. The vehicles are being added as a support layer inside MADIS rather than replacing JLTV-based sensor and weapons platforms, indicating a near-term focus on logistics endurance and operator scaling under degraded communications.
🛰️ Open sources - closed narratives
@sitreports | 465 |
| 11 |  🤖 DIA accelerates data-centric AI modernization
The Defense Intelligence Agency says it is restructuring its enterprise around policy-controlled data access, zero-trust enforcement, and a Modular Component Platform to speed AI adoption across intelligence workflows. DIA CIO E.P. Mathew also said the agency is building semantic AI functions such as knowledge graphs and entity resolution, while using a six-month Training with Industry program to rebuild technical expertise after a 22% loss in specialized network and software engineering staff.
The core issue is tempo. DIA is trying to compress acquisition, integration, and workforce adaptation cycles that no longer match commercial software and chip development. The stated model prioritizes modularity, tighter data governance, and internal operator competence over vendor lock-in and slow support chains.
🛰️ Open sources - closed narratives
@sitreports | 423 |
| 12 | 🔍 Critical Hoppscotch flaw exposes self-hosted instances before setup completion
Hoppscotch disclosed CVE-2026-50160, a CVSS 10.0 mass-assignment issue affecting self-hosted backend deployments through version 2026.4.1. If onboarding is still incomplete, an unauthenticated attacker can send a single POST to overwrite JWT and session secrets, then forge tokens and take over the server. Fixed in 2026.5.0.
The exposure is limited to the first-boot onboarding window, but that is also when fresh internet-facing deployments are most vulnerable. Impact extends beyond admin access: persistent control of signing secrets enables continued token forgery, access to workspaces and stored API keys, and invalidation of active user sessions.
🛰️ Open sources - closed narratives
@sitreports | 383 |
| 13 |  🔍 Splunk Secure Gateway RCE Exposes Low-Privilege Path to Host Command Execution
CVE-2026-20251 affects Splunk Secure Gateway and lets an authenticated low-privileged user execute arbitrary OS commands on the underlying host. The flaw sits in Splunk Secure Gateway alert processing, where KV Store data from the mobile_alerts collection can bypass validation and reach jsonpickle deserialization. Fixed versions include 3.8.67, 3.9.20, 3.10.6, and patched Splunk Enterprise branches.
Operationally, this turns routine app-level access into code execution as the Splunk service account, without admin privileges. The issue also highlights a recurring failure pattern: unsafe deserialization combined with validators that stop at the first trusted key instead of fully traversing nested data.
🛰️ Open sources - closed narratives
@sitreports | 376 |
| 14 | 🔫 Anonymous researcher publishes multi-vendor 0-day repo
An anonymous researcher using the handle bikini reportedly released a now-removed GitHub repository, exploitarium, containing claimed working exploits and write-ups for zero-days affecting 15 products, including libssh2, Gitea, OpenVPN, VLC and Splunk. Two flaws are already assessed as actively exploited: CVE-2026-55200 in libssh2 and CVE-2026-20896 affecting self-hosted Gitea Docker deployments.
The immediate significance is reduced attacker lead time. For libssh2, a fix is merged but not yet released; for Gitea, patched versions are available. Even with the original repo removed, public exploit release shifts exposure from theoretical to operational, especially where defenders have not yet patched or deployed detections.
🛰️ Open sources - closed narratives
@sitreports | 391 |
| 15 |  🔍 Oracle E-Business flaw moves from patch cycle to active exploitation
Attackers are actively exploiting CVE-2026-46817, a critical Oracle E-Business Suite vulnerability in the Oracle Payments File Transmission component. The flaw allows unauthenticated takeover over HTTP with low attack complexity. Oracle patched it in May 2026, while Defused says exploitation attempts were observed over the weekend on Oracle E-Business honeypots.
The case highlights a narrow but high-impact enterprise exposure set: Shadowserver tracks more than 450 Oracle EBS instances online. The immediate significance is not novelty, but patch latency on internet-facing financial application infrastructure.
🛰️ Open sources - closed narratives
@sitreports | 402 |
| 16 | 🔍 SimpleHelp auth bypass used to push new cross-platform stealer
Attackers are actively exploiting CVE-2026-48558 in SimpleHelp to create privileged technician access on internet-facing servers using OIDC, then deploy TaskWeaver and the previously undocumented Djinn Stealer. Blackpoint observed the chain in the wild; Djinn targets Windows, macOS, and Linux and harvests cloud, Git, SSH, package registry, browser, wallet, and AI tooling credentials.
The significance is the access path: a compromised RMM instance becomes a trusted admin channel for file transfer and command execution across managed endpoints. Djinn’s collection of local MCP configs and AI assistant tokens extends the impact beyond user creds into downstream access to repos, cloud resources, databases, and internal APIs.
🛰️ Open sources - closed narratives
@sitreports | 385 |
| 17 | 🔍 U.S. posts $10M bounty on Russian-linked groups targeting Signal and WhatsApp
The U.S. Department of State is offering up to $10 million under the Rewards for Justice program for information on UNC5792 and UNC4221, two groups tied to Russian security and military services. U.S. officials say the actors ran phishing campaigns against Signal and WhatsApp users, including government and military personnel, and used fake support messages to steal Signal backup recovery keys.
The case highlights a persistent access model built on social engineering rather than breaking platform encryption. The stated target set spans U.S. and NATO officials, journalists, NGOs, and researchers, indicating a broad intelligence collection effort focused on private communications.
🛰️ Open sources - closed narratives
@sitreports | 455 |
| 18 |  🔍 Mustang Panda shifts C2 to Zoho WorkDrive in India-targeted campaign
Researchers tracking Mustang Panda say the group used Zoho WorkDrive as a command channel in attacks targeting Indian government entities. The activity ties a known China-linked intrusion set to malware delivery and control infrastructure embedded in a legitimate cloud collaboration service.
Using a trusted SaaS platform for C2 complicates detection, blends malicious traffic into normal enterprise workflows, and raises response costs for defended government networks. The tradecraft underscores continued reliance on living-off-trusted-services rather than bespoke infrastructure.
🛰️ Open sources - closed narratives
@sitreports | 530 |
| 19 | 🔍 DirtyClone opens another Linux kernel root path
DirtyClone (CVE-2026-43503) is a newly disclosed local privilege escalation flaw in the Linux kernel that lets an unprivileged user gain root by corrupting file-backed page-cache memory through cloned network packets. The issue stems from dropped skb safety metadata in __pskb_copy_fclone(), affecting a separate path in the DirtyFrag bug family and leaving no kernel logs or audit traces.
Operationally, the flaw keeps partially patched systems exposed even after earlier DirtyFrag fixes. Debian, Ubuntu, and Fedora are named among affected distributions, with elevated risk in multi-tenant servers, Kubernetes nodes, and containerized environments where unprivileged user namespaces remain enabled.
🛰️ Open sources - closed narratives
@sitreports | 902 |
| 20 | 📡 Ukraine reports credential-theft campaign using fake support texts
Ukrainian authorities say Russian intelligence used social-engineering messages posing as technical support to steal credentials for messaging accounts. The operation relied on fraudulent prompts designed to capture login data and access user communications via messaging credentials rather than malware-heavy intrusion.
The case underlines a low-cost access method with high intelligence value: compromise the account, bypass endpoint defenses, and exploit trusted channels already used for coordination. For defenders, the main signal is impersonated support contact targeting authentication workflows, not just suspicious files or links.
🛰️ Open sources - closed narratives
@sitreports | 969 |
