Security Validation

We noticed that the GCP Cloud NGFW Enterprise endpoints issue impersonation certificates without AKID extension. This violates https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.1While Cloud NGFW is claimed to be powered by Palo Alto networks (https://www.paloaltonetworks.com/blog/2024/04/google-cloud-ngfw-enterprise/), we see the Palo Alto Firewall exhibit the RFC compliant behaviour. What does this break?Python 3.13, https://docs.python.org/3/library/ssl.html#ssl.create_default_context. Although we can work around this problem by disabling strict checks, it would be prudent for GCP to address this gap on priority in the interest of a long term solution. Steps to reproduce:Python 3.13.15 (main, Aug 6 2026, 11:06:22) [GCC 13.3.0] on linuxType "help", "copyright", "credits" or "license" for more information.>>> import ssl>>> import socket>>> hostname = "api.github.com">>> port = 44>>> port = 443>>> context = ssl.create_defau

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.7.0 of the MSV platform.EnhancementsAdded the option to set a default landing page (such as the Topology Map) upon sign in, improving load times for users who prefer to bypass the initial Simulations page. For Windows 10/11, added support for TPM 2.0 on Protected Theater.  Added the ability to hide unselectable actors from the user interface, streamlining the actor selection process when running actions. Improved system memory efficiency and performance when downloading or exporting large datasets—including attachments, assessments, Bulk Job results, and suspect events. Enhanced the scaling and responsiveness of the Jobs interface through optimizations, including batched loading and database aggregation for event lists.Bug fixesThis release includes a number of bug fixes and stability improvements. Key fixes are categorized as follows:Actor and integration stabilityFixed an intermittent issue where Actors w

We're building a production certificate automation tool using Google Trust Services' production ACME API (dv.acme-v02.api.pki.goog).We've observed that when we place a new order and fetch the raw authorization object, the "expires" field is consistently exactly 8 days after the order's creation timestamp — reproduced across 2 different domains and 2 different ACME accounts.Within this 8-day window, a new order for the same domain/account automatically reuses the existing authorization as "valid" — no DNS-01 challenge needed. After 8 days, a new order requires a fresh DNS-01 challenge.GTS's CP/CPS (Section 4.2.1) states validation data may be reused for up to 200 days — but we observe a hard boundary at 8 days.Questions:1. Is this 8-day authorization validity an intentional, fixed, documented policy, separate from the 200-day CP/CPS ceiling?2. Is this duration stable, or could it change without notice?3. Does this differ for wildcard domain authorizations?A clear, authoritative answer w

I'm trying to verify the OAuth consent screen (branding) for my app and it keeps failing on the same two issues, even though my home page appears to meet the requirements.App details:- App name (consent screen): Perfect Lien Law- Home page: https://perfectlien.com- The app requests the Google Calendar sensitive scope (calendar deadline sync)- Authorized domain ownership is verified in Google Search Console under the same accountThe two errors branding verification returns:1. "Your home page does not explain the purpose of your app."2. "The app name 'Perfect Lien Law' configured for your OAuth consent screen does not match the app name on your home page."Why I believe the home page already meets both requirements:- The site was originally a client-side React app (empty #root in the HTML), so I added server-rendered content. The raw HTML of https://perfectlien.com now contains a <title>Perfect Lien Law...</title>, a <meta name="description"> describing the app, and an &

Getting error while publishing Terraform Kubernetes App. on GCP marketplace.{ "taskReports": [ { "taskType": "EXECUTE_TERRAFORM_PLAN", "taskExecutionStatus": "ISSUES_FOUND", "digest": "Failed to execute terraform plan for some versions.", "errorMessage": "Error validating Terraform zip: Marketplace UI deployments must declare a variable 'goog_cm_deployment_name'. This variable specifies the name of the deployment, and should be used to avoid resource name collisions across deployments\n" } ]}Possible solutions I have tried:I have changed variable.tf file to include variable:variable "goog_cm_deployment_name" { description = "Name of the Google Cloud Marketplace deployment. Auto-populated by the Marketplace UI." type = string}Added below in metadata.yaml file:interfaces: variables: # ---- GCP / cluster --------------------------------------------------- - name: goog_cm_deployment_name description: The name of the deployment.

I'm currently testing an application hosted on Google Cloud, and I'm running into a security validation issue that I can't explain. The OAuth consent screen has been configured, the authorized redirect URIs are correct, and all required scopes have been reviewed. However, every time I attempt the validation process, it reports a generic security validation failure without identifying which specific requirement is not being met.I have already verified that the domain ownership is confirmed through Search Console, HTTPS is properly configured with a valid SSL certificate, and the privacy policy and terms pages are publicly accessible. I've also tested the application using different Google accounts and browsers, cleared caches, and even recreated the OAuth credentials, but the validation result remains the same.Has anyone experienced a similar issue where the security validation fails even though the project appears to meet all documented requirements? I'm mainly looking for guidance on

I am getting below error while validating my terraform kubernetes app. Can any on ehelm what is the issue?{  "taskReports": [    {      "taskType": "EXECUTE_TERRAFORM_PLAN",      "taskExecutionStatus": "ISSUES_FOUND",      "digest": "Unable to start verification.",      "errorMessage": "Failed to process container images from schema file: Unexpected response.\nHeaders:\nHTTP/1.1 400 Bad Request\r\nContent-Type: application/json; charset=utf-8\r\ndocker-distribution-api-version: registry/2.0\r\nServer: Docker Registry\r\nVary: Accept-Encoding\r\nX-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nx-gcr-using-artifact-registry: true\r\nx-google-artifactregistry-docker-imageref: us-docker.pkg.dev/cloud-launcher-images-prd/gcr.io/crestdata-public/test-app/test-app:1.0\r\nx-google-gfe-cloud-project-number: 720804119614\r\nX-Google-GFE-Backend-Request-Cost: 48.89476869076971\r\nX-Google-Security-Signals: FRAMEWORK=GOA\r\nX-Google-Security-Signals: ACTION=GOA_ACTION,ENV=borg,ENV

VHR20260722 - July 22, 2026The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260722 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes109 Actions added 88 Files addedRelease HighlightsA new Action covering Campaign 26-069, an initial access campaign by actor UNC6910 leveraging social engineering lures and delivering CURLYGATE, CURLYFENCE, and NEONSLIDE malware. A new Action covering Campaign 26-014, involving North Korea-nexus threat actor UNC5342 deploying Python backdoors such as JADESNOW and INVISIBLEFERRET.JAVASCRIPT to target GitHub repositories for unauthorized code modification. New Actions demonstrating Campaign 26-068, a campaign by UNC6468 using recipe-themed executables to deliver PINESAP 

VHR20260624 - June 24, 2026The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260624 - Content Expansion. This content pack requires Director version 4.14.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes370 Actions added 329 Files added 14 Actions updated 6 Files updatedRelease HighlightsNew Actions demonstrating Campaign 25-002, where UNC5487 conducts a social engineering campaign to deliver REMCOS and SHADOWLADDER. New Actions demonstrating Campaign 25-082, a suspected Iranian espionage threat actor UNC1549 campaign leveraging TWOSTROKE malware against Azerbaijan and Turkish-based organizations. A new Action covering FLUXWEAVE leveraged in Campaign 25-076 by UNC6527 to deliver a downloader. New Actions demonstrating Campaign 25-039, a distribution cluster UNC1543 ca

This release note outlines the latest updates, enhancements, and bug fixes for the Mandiant SecOps Integrations (MSI) service.EnhancementsTrend Micro Vision One v1: Exposed the Alert Field Mapping configuration in the web interface, allowing users to customize which fields are used for alert data. Default mappings are still provided. Enabled support for SSL certificate authentication for the following integrations: Exabeam Cloud v1 Splunk v1 Splunk v2 Added titles to the default queries for the following integrations: Google BigQuery v1 Logzilla v1 Microsoft Defender ATP v1 Security Onion v1 Trellix Enterprise Security Manager v2 Trellix Enterprise Security Manager v1 Trellix Helix v1 Bug fixesCybereason v1: Fixed an issue where Default Malware Queries were not displaying, which prevented the integration from being saved. This was due to incorrect model typing for the malware queries field. Google Cloud Logging v1: Fixed an AttributeError that occurred during health checks whe

VHR20260603 - June 3, 2026The Mandiant Intelligence Validation Research Team (VRT) has published VHR20260603 - Content Expansion. This content pack requires Director version 4.14.1.0-0 or higher.If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal.Summary of Changes83 Actions added 61 Files added 7 Actions updated 1 Files updatedRelease HighlightsNew Actions covering Campaign 26-053, a campaign targeting healthcare and education with obfuscated PowerShell, registry modifications, and discovery via tools such as NLTEST. New Actions covering Campaign 26-054, a China-nexus threat actor UNC6863 campaign deploying SLICKDEMON and BADFALL (QUIC RAT) via software supply chain compromise of DAEMON Tools. A new Action demonstrating Campaign 26-052, a financially motivated actor UNC6780 campaign poisoning software supply chains to compromise

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.6.1 of the MSV platform.Bug fixesThis hotfix release addresses the following critical issues:Resolved an issue where repeated checks on Protected Theater VNC status could overload the system, potentially leading to unresponsiveness. Fixed issues related to Google Authenticator two-factor authentication (2FA) after upgrading to 4.14.6.0, ensuring that 2FA configurations are correctly retained and preventing users from being incorrectly redirected to User Preferences with a false warning to re-enable Google Authenticator upon sign in.Known issuesLocal Event Filtering works as expected but is limited to Match Action, Match Integration, and Match Events (when the latter involves Raw Events). If a rule has a Match Event condition for any field other than Raw Event, the rule does not apply to Local Events. It only applies to events from standard local integrations in MSV. Network configuration may reset unexpecte

MSV 4.14.6.0 Product Release - May 13, 2026The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.6.0 of the MSV platform.EnhancementsUpdates to Director and content to support MITRE ATT&CK v18. Added support for Remote Integrations on installable Actors. MSI version downgrades are prevented on Director upgrades. For external database scenarios, upgraded the database encryption to support scram-sha-256 password hashing. Improved memory performance for the /analyze/pivot_data route. To enhance privacy, Azure Client Secrets used for Cloud Validation Modules (CVM) have more redactions. Added a setting to allow administrators to disable the requirement for a local user account when using Google or SAML authentication. That way, all users can use the selected authentication type without needing a local fallback. Updated API calls for the CrowdStrike Intel Threat Intelligence Platform integration to align with the latest CrowdStrike API endpoints. Improved Job Re