[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"author:marcus-lenngren":3},{"author":4,"posts":27},{"slug":5,"name":6,"job_title":7,"short_bio":8,"photo_url":9,"linkedin_url":10,"same_as":11,"bio_md":12,"location":13,"expertise":14,"credentials":22,"updated_at":26},"marcus-lenngren","Marcus Lenngren","Founder, ThreatNoir","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],"Marcus leads a security engineering team that supports the security operations centre of a global retailer: detection, data ingestion and the automation around it. He reshaped that team into a lean, self-sustaining organisation.\n\n## Earlier roles\n\n- **CTO and CISO, Entraction**: an online gaming company in a heavily regulated market, later acquired by IGT.\n- **CTO, Fenix \u002F Framtidsmedia**\n- **Head of Applications, Network and Data Centre, Schibsted Sverige**\n- **Co-founder, Sportway**: sports coverage with AI-driven cameras.\n\nResponsible for PCI compliance, ISO 27001 (IT-Operations and DevOps), Nevada Gaming Comission, Hearing for DOJ representatives, Upscaling R&D, Transforming business to Cloud from DC\u002FOnPrem (Monolith to MicroServices etc).  And some more.\n\n## Leading teams\n\nHe has led teams of 5 as well as departments of 70 people across IT, R&D and security operations, including nearshore and offshore delivery. He has built organisations up and reshaped them into smaller, self-sufficient ones.\n\n## Hands-on\n\nHe has written software since the mid-1980s, in C, C++, C#, Python and Go, and still writes code for his own projects.\n\n## Why ThreatNoir\n\nHe started ThreatNoir to turn the daily flood of security news into something defenders and boards can act on: which controls matter, what NIS2 and DORA ask for, and what to ask a vendor.","Stockholm, Sweden",[15,16,17,18,19,20,21],"Security operations and detection","NIS2 and DORA","AI security","PCI DSS","Security leadership and governance","Risk management","Choosing security controls and vendors",[23,24,25],"CISSP","CISM","AAISM","2026-10-17T21:18:56.388+00:00",[28,37,46,53,60,67],{"slug":29,"kind":30,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":6,"published_at":35,"reading_minutes":36},"gheist-campaign-abuses-stolen-github-tokens-to-dump-private","rapid-alert","Gheist campaign abuses stolen GitHub tokens to dump private repo and cloud secrets via Actions logs","Since 15 Sep 2026, the Gheist campaign has planted a sync-check workflow in over 13,500 branches using stolen GitHub tokens, printing secrets to Actions logs and pulling them before deleting the run. Public repos are protected by a GitHub hold, but private repos and GitHub Enterprise Server are not.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fgheist-campaign-abuses-stolen-github-tokens-to-dump-private-1032a4f5-cover.png","Gheist rapid alert: Stolen GitHub token, private repo? Every secret in it got printed.","2026-10-27T05:06:27.466+00:00",3,{"slug":38,"kind":39,"title":40,"excerpt":41,"cover_image_url":42,"cover_image_alt":43,"author_name":6,"published_at":44,"reading_minutes":45},"honeypots-see-attacks-first","analysis","Honeypots see attacks before the patch, but how do companies act on it?","Amazon's decoys are probed within 90 seconds of going online. What deception and honeypots do for the security community, and six small steps that let an ordinary team act on early warnings with the people it has.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fblog\u002Fai-1f0002b6-fc7e-49f4-9d6c-fb41c50beb17.png","A decoy server is immediately surrounded by incoming attack probes and attempts on a dark digital background.","2026-10-26T06:27:00+00:00",8,{"slug":47,"kind":30,"title":48,"excerpt":49,"cover_image_url":50,"cover_image_alt":51,"author_name":6,"published_at":52,"reading_minutes":36},"node2shell-node-js-brotli-decoder-rce-cve-2026-111497","Node2Shell: Node.js Brotli decoder RCE (CVE-2026-111497) patched in all supported lines","Node.js fixed an out-of-bounds write in its bundled Brotli decoder on 21 October. Imperva's Node2Shell PoC ran code on an official 24.22.0 build. Upgrade to 22.23.4, 24.22.1 or 26.12.1. There is no workaround in Node.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fnode2shell-node-js-brotli-decoder-rce-cve-2026-111497-e52ba6df-cover.png","Node2Shell rapid alert: Does your service decode Brotli? One crafted stream can run code.","2026-10-23T16:42:51.248+00:00",{"slug":54,"kind":30,"title":55,"excerpt":56,"cover_image_url":57,"cover_image_alt":58,"author_name":6,"published_at":59,"reading_minutes":36},"arista-patches-third-exploited-velocloud-orchestrator-zero","Arista Patches Third Exploited VeloCloud Orchestrator Zero-Day in Four Months (CVE-2026-114625)","CVE-2026-114625 is a critical SQL injection in VeloCloud Orchestrator on-prem, CVSS 9.9, actively exploited. Any authenticated user with the lowest tenant role can become a superuser operator. Patch to 5.2.3.18, 6.1.3.10 or 6.4.2.12 and hunt for abuse now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Farista-patches-third-exploited-velocloud-orchestrator-zero-714429b3-cover.png","VeloCloud VCO rapid alert: Your SD-WAN runs VeloCloud? One low tenant login owns the box.","2026-10-23T15:26:13.908+00:00",{"slug":61,"kind":30,"title":62,"excerpt":63,"cover_image_url":64,"cover_image_alt":65,"author_name":6,"published_at":66,"reading_minutes":36},"php2shell-critical-pre-auth-rce-in-php-core-under-broad","PHP2Shell: Critical Pre-Auth RCE in PHP Core Under Broad Exploitation, Patch Now","Two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), allow unauthenticated remote code execution. Exploitation began four days before the 21 Oct patches. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fphp2shell-critical-pre-auth-rce-in-php-core-under-broad-f10ea3b4-cover.png","PHP2Shell rapid alert: Running PHP on the internet? One crafted request and code runs.","2026-10-23T12:58:01.88+00:00",{"slug":68,"kind":30,"title":69,"excerpt":70,"cover_image_url":71,"cover_image_alt":72,"author_name":6,"published_at":73,"reading_minutes":36},"litellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker","LiteLLM 1.107.0 supply chain attack: poisoned PyPI and Docker images steal cloud and AI credentials","On 21 Oct, LiteLLM 1.107.0 shipped a credential stealer and backdoor through all seven PyPI wheels and Docker images. The packages were live for about three hours and downloaded over 49,000 times. Just starting Python in an affected environment runs the malware. Clean version: 1.106.2.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Flitellm-1-107-0-supply-chain-attack-poisoned-pypi-and-docker-ceecec71-cover.png","LiteLLM 1.107.0 rapid alert: Ran LiteLLM 1.107.0 anywhere? Just starting Python leaked your keys.","2026-10-23T12:58:00.867+00:00"]