Author
Abdulaziz Alzamil
Founder & CEO, Fyntralink
Abdulaziz Alzamil is the founder and CEO of Fyntralink and writes the Fyntralink blog: analysis of vulnerabilities and cyber threats and what they mean for Saudi organisations, readings of regulatory frameworks such as the NCA Essential Cybersecurity Controls and the Personal Data Protection Law, and pieces on AI and software engineering.
400 articles
GopherWhisper APT: Slack & Microsoft 365 C2 Risk to SAMA Banks
ESET unveils GopherWhisper — a China-aligned APT using Discord, Slack and Microsoft 365 Outlook as covert C2. SAMA-regulated banks face the same legitimate-service abuse risk and must rethink detection.
Cloud & IdentityPCPJack Cloud Worm: Credential Theft Threat to SAMA Banks
SentinelLabs has uncovered PCPJack, a self-propagating cloud worm that hijacks TeamPCP infrastructure and steals credentials at scale. Saudi financial institutions running cloud workloads face urgent SAMA CSCC exposure.
VulnerabilitiesCitrixBleed 3 (CVE-2026-3055): Critical Risk for SAMA Banks
A critical Citrix NetScaler memory overread (CVE-2026-3055) is being actively exploited against SAML-enabled appliances. Saudi banks must patch and rotate session tokens before attackers harvest more.
Vulnerabilitiesvm2 Sandbox Escape (CVE-2026-24118): RCE Risk for SAMA Banks
Twelve critical vm2 Node.js sandbox escape vulnerabilities, including CVE-2026-24118 (CVSS 9.8), let attackers execute arbitrary code on host servers. Saudi banks and fintechs running Node.js platforms face urgent SAMA CSCC remediation pressure.
Phishing & FraudVENOMOUS#HELPER RMM Phishing Campaign: Risk to SAMA Banks
A new initial-access campaign is hijacking legitimate RMM tools — SimpleHelp and ScreenConnect — to slip past EDR and establish dual-channel persistence. Here is why CISOs at SAMA-regulated banks must act this week.
VulnerabilitiescPanel CVE-2026-41940: Vendor Risk for SAMA-Regulated Banks
A pre-auth cPanel bypass (CVE-2026-41940) exposes 1.5M internet-facing servers — including those running Saudi bank marketing sites and vendor portals. Here is what SAMA-regulated CISOs must act on now.
Cloud & IdentityTeamPCP Cloud Compromise: CI/CD Threat for SAMA Banks
TeamPCP weaponized open-source security tools (Trivy, LiteLLM, KICS) to harvest CI/CD secrets and pivot into AWS, Azure and SaaS environments. SAMA-regulated banks must reassess third-party and pipeline trust now.
Supply Chain & Third PartyTrellix Source Code Breach: Supply Chain Threat to SAMA Banks
Trellix confirmed unauthorized access to its source code repository in May 2026. For SAMA-regulated banks relying on Trellix XDR and EDR, this incident raises urgent supply chain and third-party risk questions under SAMA CSCC.
Malware & Threat ActorsDAEMON Tools Supply Chain Backdoor: SAMA Bank Endpoint Risk
Kaspersky uncovered a trojanized DAEMON Tools installer distributing a Chinese-linked backdoor through the vendor's official domain since April 8, 2026 — a direct test of SAMA CSCC software supply chain controls.
VulnerabilitiesCVE-2026-0300: PAN-OS Captive Portal RCE Threat to SAMA Banks
A critical PAN-OS Captive Portal buffer overflow lets unauthenticated attackers gain root on Palo Alto firewalls. SAMA-regulated banks must patch and isolate User-ID portals immediately.
Network & InfrastructureIran's PLC Campaign: OT/IT Convergence Risks for SAMA Banks
CISA's April 2026 advisory reveals an Iranian APT campaign abusing internet-exposed Rockwell PLCs. SAMA-regulated banks run similar OT systems in data centers and branches—here's how to defend them.
VulnerabilitiesMOVEit CVE-2026-4670: Critical Auth Bypass Threatens SAMA Banks
A CVSS 9.8 authentication bypass flaw in MOVEit Automation (CVE-2026-4670) lets unauthenticated attackers seize full administrative control of file transfer servers. Saudi financial institutions must act now.
