The IT Guy Who Became the Threat

When Ezekiel Dean Potter left his job as a senior IT support specialist at the Saydel Community School District in Iowa in April 2023, the district should have cut off his access. They didn't. According to BleepingComputer, Potter used his retained credentials to attack the district repeatedly over the next 21 months.

He deleted the school's Facebook page. He stripped staff of access to the educational platforms they needed to teach. He reset usernames and passwords across multiple systems, locking people out of their own accounts mid-school-year. The damage ran to tens of thousands of dollars — not counting the classroom disruption and administrative chaos.

Potter, now 34, was sentenced to 21 months in federal prison. The U.S. government's sentencing memorandum described him as "a plague" on the district throughout that period.

This is not a sophisticated nation-state attack. There was no zero-day, no malware, no elaborate intrusion. Just a set of credentials that were never revoked, handed to someone who had good reason to use them.

What to do: If you manage any organisation — school, small business, charity, anything — offboarding a staff member means immediately revoking every account, credential, and platform access they held. Not tomorrow. Not at the end of the week. The day they leave.

No major updates today.

What Splunk Enterprise is: Splunk is a platform used by IT and security teams to collect, search, and analyse machine-generated data — logs, alerts, and system events — across an organisation's infrastructure.

What it is: A critical flaw in Splunk Enterprise allows anyone who can reach the system over a network to create or overwrite files — and then escalate that access to run arbitrary code — without ever logging in. The vulnerable entry point is an internal PostgreSQL sidecar service (a background database process) that was left completely open, with no authentication (a login or credential check) required to use it.

Who's at risk: Any organisation running Splunk Enterprise versions 10.0.0–10.0.6 or 10.2.0–10.2.3. Splunk Cloud is not affected. Splunk Enterprise 10.4 is also not affected.

CVSS: 9.8 — Critical. Patch today. Stop reading, go patch.

Root cause: The PostgreSQL sidecar service exposes backup and restore endpoints that were never protected with authentication controls. Any network-reachable user can call these endpoints directly. The developer failed to restrict access to what are effectively administrative database functions — functions capable of reading, writing, and executing content on the underlying file system.

Attack vector: An attacker connects their own controlled database to Splunk's exposed backup endpoint and dumps its contents onto the Splunk file system. They then use the restore endpoint to load that dump into Splunk's local PostgreSQL instance, triggering execution of SQL (database query language) commands they wrote themselves. From there, they overwrite a Python script that Splunk runs regularly — injecting whatever code they want the server to execute. No login required at any point in this chain.

Detection strategies:

1. Look for unexpected connections to Splunk's internal PostgreSQL ports from external or unusual IP addresses.
2. Monitor for new or modified Python scripts under /opt/splunk/etc/apps/ — changes outside of normal update windows are a red flag.
3. Check backup and restore endpoint logs for calls that did not originate from your own admin team.

Recommended actions:

1. Upgrade to Splunk Enterprise 10.0.7 or 10.2.4 immediately.
2. If patching is not immediately possible, restrict network access to the PostgreSQL sidecar service ports at the firewall level.
3. Audit recent file changes on your Splunk host for any signs of unauthorised writes.

GitHub is shipping a meaningful supply chain defence into NPM (Node Package Manager — the tool developers use to install software packages for JavaScript projects) with version 12, due in July.

Currently, packages can run code automatically the moment a developer installs them — before anyone has reviewed what that code does. Attackers have been exploiting this behaviour for months, including through a self-replicating worm called Shai-Hulud that spread malware across thousands of developer environments. A supply chain attack (targeting the tools developers use rather than end users directly) is particularly damaging because it poisons software at the point of creation.

From NPM 12 onwards, those install scripts will be blocked by default unless explicitly allowed. If your team builds with JavaScript, brief them before July and audit which packages currently rely on automatic scripts.

No major compliance updates today.