This week’s Department of Know is hosted by Rich Stroffolino with guests Johna Till Johnson, CEO and Founder, Nemertes (check out the Nemertes substack) and Jason Shockey, CISO, Cenlar FSB. Jason will be speaking at MBA Servicing Solution26 in Texas in late February. Details here.
Missed the live show? Check it out on YouTube
The Department of Know is live every Monday at 4:00 p.m. ET. Join us each week by registering for the open discussion at CISOSeries.com
Critical ‘MongoBleed’ bug under attack
Attackers are actively exploiting a critical MongoDB vulnerability dubbed “MongoBleed” that lets unauthenticated remote attackers leak server memory and steal cleartext credentials, tokens, and sensitive data. Exploitation began around December 29th, just days after proof-of-concept code was published, prompting CISA to confirm in-the-wild attacks. The flaw affects multiple MongoDB versions when zlib compression is enabled, and security vendor Rapid7 warns that organizations need to patch and rotate exposed credentials. MongoDB urges immediate upgrades or disabling zlib compression. (Dark Reading)
The UK hits reset on cybersecurity
The British government presented a new Government Cyber Action Plan to Parliament, which marks a conscious reset in its efforts to protect public services. The announcement admits that its previous approach was flawed and left it unable to meet commitments to security government organizations to known vulnerabilities and methods by 2030. This will see the UK move away from providing non-binding guidance to public sector authorities and instead establish a new Government Cyber Unit to adopt a centralized, mandatory approach. The plan also calls for more coordination on incident response and stronger contractual expectations from strategic suppliers. This comes ahead of a plan to reboot its national cyber strategy, set for release later this year.
No MFA, Know Problems
A threat actor that goes by Zestix or Sentap listed data allegedly stolen from roughly 50 organizations on illicit forums, including the American engineering firm Pickett and Associates, Spain’s Iberia airline, and the Japanese homebuilder Sekisui House. Researchers at Hudson Rock found that this data was stolen using compromised cloud credentials, which was easy because none of the organisations listed had enforced MFA for logins. Zestix isn’t new to this game; they have used infostealers to abscond with passwords and serve as an initial access broker since 2021. Another example of threat actors that don’t break in, they log in.
Ni8mare flaw lets hackers hijack n8n servers
A critical vulnerability called Ni8mare lets unauthenticated attackers hijack locally deployed n8n workflow automation servers, with security researchers at Cyera estimating more than 100,000 instances exposed. It stems from a parser flaw that allows arbitrary file reads and, depending on configuration, access to secrets, authentication bypass, or remote code execution. n8n advises updating to version 1.121.0 and restricting public webhooks, but there’s no full workaround. The flaw was disclosed to n8n in November with a maximum 10.0 severity. (BleepingComputer)
Microsoft to enforce MFA for Microsoft 365 admin center sign-ins
Starting in February, Microsoft will “start enforcing multi-factor authentication for all users accessing the Microsoft 365 admin center. MFA requirements actually started one year ago in February 2025, but as of February 9th of this year, Microsoft will block those without MFA enabled from signing in to the Microsoft 365 administrative portal. This will affect a number of admin center URLs used by IT administrators to manage Microsoft 365 accounts. The specific addresses are listed in the show notes to this episode.
Huge thanks to our sponsor, ThreatLocker
OpenAI prompt injection problems keep festering
We have covered a number of stories about the seemingly permanent problem of prompt injection in recent weeks. Now, security researchers at Radware say “they identified several vulnerabilities in OpenAI’s ChatGPT service that allow the exfiltration of personal information.” These flaws were “identified in a bug report filed on September 26, 2025, were reportedly fixed on December 16, but the problem seems to still exist. The current issue surrounds an indirect prompt injection attack called ShadowLeak that, in short, allows malicious instructions in a Gmail message, for example, to get ChatGPT to transmit a password without any intervention from the agent’s human user. The successor to ShadowLeak, dubbed ZombieAgent has evolved to circumvent the fixes and defenses being put up.
Phaas attackers exploit misconfigured email routing to spoof internal emails
According to a report from Microsoft, “Phishing actors are exploiting complex routing scenarios and misconfigured spoof protections to effectively spoof organizations’ domains and deliver phishing emails that appear, superficially, to have been sent internally.” They are using a wide variety of phishing messages related to phishing-as-a-service (PhaaS) platforms such as Tycoon2FA. “These include messages with lures themed around voicemails, shared documents, communications from human resources (HR) departments, password resets or expirations, and others, leading to credential phishing.” The report suggests “setting strict Domain-based Message Authentication, Reporting, and Conformance (DMARC) deploying reject and SPF hard fail (rather than soft fail) policies and properly configuring any third-party connectors will prevent phishing attacks spoofing organizations’ domains.”