Cyber Threat Brief

2026-10-07: FortiBleed remains an active ransomware entry point as FBI confirms credentials can lock

Wed, 07 Oct 2026 06:00:00 +0000

Show Notes - 2026-10-07

Stories Covered

Today:
FortiBleed Campaign Remains Active, Leads to Ransomware Deployment [Critical Alerts]
Akira Ransomware Operators Deploy GOST Tunnels, LUNARAXE Extensions Post-Compromise [Ransomware & Extortion]
Japan Extradites Qilin Ransomware Member to Germany [Ransomware & Extortion]
Former Infrastructure Engineer Sentenced for Ransomware-Style Attack [Ransomware & Extortion]
ClickFix Attacks Evolve with DNS TXT Records, Browser Cache Pre-Fetching [Business & Infrastructure Threats]
100+ Compromised Websites Deploy LunexStealer via Fake Cloudflare Verification [Business & Infrastructure Threats]
Healthcare Sector Unprepared for Post-Quantum Cryptography Era [Business & Infrastructure Threats]
Iranian APT Targets Iraqi Infrastructure with GitHub-Based C2 [Business & Infrastructure Threats]
MCP Marketplaces Lack Security Vetting for 15,465 Public Servers [Business & Infrastructure Threats]
Microsoft Warns CISOs: AI Frontier Models Will Flood Patch Tuesday [Windows / AD Security]
BigDiskBuster PoC Blocks Windows Defender Updates Without Exploit [Windows / AD Security]
Microsoft Blocks .msix and .msixbundle Attachments in Outlook [Windows / AD Security]
Classic Outlook Server Assisted Search Bug Leaves Stale Results [Windows / AD Security]
Fake AI Chatbot Ad Portals Capture Credentials and MFA Codes [IOCs & Detection]
Linux Backdoors Impersonate Email Security Products in Korea/Taiwan [IOCs & Detection]
Anthropic Expands Cyber Verification Program as Glasswing Finds 129,000 Flaws [General Security News]
OpenAI Agents Target Wikimedia: Etherpad Compromise Attempts, API Flooding [General Security News]
Google PageBreak AI Agent Finds 500 XSS Flaws in Internal Web Apps [General Security News]
FBI Blames Contractor's Missed Patch for ShinyHunters Breach [General Security News]
Attackers Obtain Counterfeit TLS Certificates for Google, Other Services [General Security News]
NPM Malware Campaign MALFEX Accumulates 40,000 Downloads [General Security News]
CrowdStrike: AI Agents Can Bypass Frontier Model Safety Classifiers [General Security News]
Cisco Talos: Age of AI Agents Executing Cyber Attacks Already Here [General Security News]
Hitachi Energy REB500 DoS Vulnerabilities [Vulnerability Disclosures]
Hitachi Energy Asset Suite Unauthenticated Servlet Access [Vulnerability Disclosures]
Savannah lwIP SMTP Client Buffer Overflow [Vulnerability Disclosures]
Johnson Controls EasyIO FG Full Unauthorized Access [Vulnerability Disclosures]
LibreOffice and Apache OpenOffice Spreadsheet Code Execution [Vulnerability Disclosures]
Android October 2026 Updates Patch 25 Vulnerabilities [Vulnerability Disclosures]
Chromium CVE-2025-0611 Object Corruption in V8 [Vulnerability Disclosures]

CVEs Referenced

CVE-2024-8176, CVE-2025-0611, CVE-2025-0612, CVE-2025-59375, CVE-2026-11796, CVE-2026-15340, CVE-2026-26980, CVE-2026-27872, CVE-2026-27873, CVE-2026-59265, CVE-2026-61500, CVE-2026-63277, CVE-2026-7395

Indicators of Compromise

IP Addresses: 8.3.3.1

Read the full brief

2026-10-06: Citrix confirms a third NetScaler zero-day in under two weeks (CVE-2026-88779

Tue, 06 Oct 2026 06:00:00 +0000

Show Notes - 2026-10-06

Stories Covered

Today:
Citrix NetScaler Zero-Day CVE-2026-88779 Under Active Exploitation [Critical Alerts]
Atlassian CVE-2026-21589 Path Traversal in Eight Data Center Products [Critical Alerts]
Cisco Catalyst SD-WAN Manager CVE-2026-76504 (CVSS 9.8) - No Fix Available [Critical Alerts]
KillSec Ransomware Leader Arrested, 16-Year-Old Mastermind in Custody [Ransomware & Extortion]
ShinyHunters Members Arrested, Two in Custody [Ransomware & Extortion]
Gentlemen Group Threatens to Leak Data from South African Insurance Companies [Ransomware & Extortion]
Nueva EPS Colombia Healthcare System Breach: $15M Extortion Demand [Ransomware & Extortion]
Cling Botnet Exploits Realtek Jungle SDK (CVE-2021-35394, CISA-KEV) [IOCs & Detection]
ClingSTUN IoT Botnet Abuses 24 Known Vulnerabilities [IOCs & Detection]
ClickFix Campaign Leverages Browser Cache for Payload Delivery [IOCs & Detection]
RMM Tool Action1 Abused in Phishing Campaign [Business & Infrastructure Threats]
Warlock Ransomware Exploits SharePoint Vulnerabilities [Business & Infrastructure Threats]
Denmark CPR Register: 8.8 Million Records Accessed via Compromised Company Account [Business & Infrastructure Threats]
U.S.-Bound Oil Tanker Propulsion System Breached by Hackers [Business & Infrastructure Threats]
Microsoft Exchange CVE-2026-96940 Mailbox Access Vulnerability [Windows / AD Security]
AI-Driven Attacks Accelerating Exploitation Timelines [General Security News]
Chinese APT TA419 Impersonates U.S. Officials to Target AI Policy Experts [General Security News]
Rejetto HFS CVE-2026-61500 Under Active Exploitation [General Security News]
Apple Muse and ChatGPT Mac Apps Had Privilege Escalation Vulnerabilities [General Security News]
Windows 11 Market Share Reaches 71.5% as Windows 10 ESU Costs Double [General Security News]
KVM Hypervisor Guest-Host Escape Zero-Day Claimed [General Security News]
FortiMail CVE-2026-104286 (CVSS 9.8) - Active Exploitation Confirmed [Vulnerability Disclosures]
Apple CoreGraphics CVE-2026-86950 Memory Corruption (CISA-KEV) [Vulnerability Disclosures]
Windows 11 26H2 AC-3 Audio Decoder Issue [Vulnerability Disclosures]
UK Education Provider Bromcom SSO Data Breach [Vulnerability Disclosures]
Daiwa Securities Vendor Breach: 110,000 Clients Affected [Vulnerability Disclosures]

CVEs Referenced

CVE-2014-8361, CVE-2016-10372, CVE-2016-20016, CVE-2021-35394, CVE-2021-36380, CVE-2023-26801, CVE-2023-41011, CVE-2024-3721, CVE-2025-34037, CVE-2026-100754, CVE-2026-104286, CVE-2026-21589, CVE-2026-35273, CVE-2026-36356, CVE-2026-61500, CVE-2026-76504, CVE-2026-86950, CVE-2026-87827, CVE-2026-88771, CVE-2026-88779, CVE-2026-96940

Indicators of Compromise

Domains: fbijobs[.]gov, 115[.]184., cocojambo[.]us, capsysnet[.]vg, ciliabula[.]cc., vercel[.]app, server[.]na-2.action1

Read the full brief

2026-10-05: Citrix NetScaler zero-day CVE-2026-88779 is under active exploitation just days after two other

Mon, 05 Oct 2026 06:00:00 +0000

Show Notes - 2026-10-05

Stories Covered

Today:
Citrix NetScaler Zero-Day CVE-2026-88779 Exploited in Targeted Attacks [Critical Alerts]
Rejetto HFS CVE-2026-61500 Under Active Exploitation [Critical Alerts]
Slate Valley School District Refuses Ransom Payment, Kairos to Leak Student Data [Ransomware & Extortion]
ShinyHunters Leader Arrested in Jordan, Cooperating with FBI [Ransomware & Extortion]
CVE-2026-88779: Citrix NetScaler Memory Overflow [Vulnerability Disclosures]
CVE-2026-61500: Rejetto HFS Session Forgery [Vulnerability Disclosures]
CVE-2024-23692: Rejetto HFS (Historical Context) [Vulnerability Disclosures]

CVEs Referenced

CVE-2024-23692, CVE-2026-61500, CVE-2026-88771, CVE-2026-88772, CVE-2026-88779

Read the full brief

2026-10-04: ShinyHunters operator "Rey" is cooperating with FBI from detention in Jordan as the group's arrest

Sun, 04 Oct 2026 06:00:00 +0000

Show Notes - 2026-10-04

Stories Covered

Today:
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware [Critical Alerts]
Fortra BoKS Critical Vulnerabilities Enable AD Compromise and RCE [Critical Alerts]
Rejetto HFS Authentication Bypass Under Active Exploitation (CVE-2026-61500) [Critical Alerts]
ShinyHunters Operator "Rey" Detained in Jordan, Cooperating with FBI [Ransomware & Extortion]
China-Aligned TA419 Targets AI Policy Experts With Microsoft AitM Phishing [Business & Infrastructure Threats]
MI5 Warns 100+ UK Academics Funded by Chinese MSS Front Company [Business & Infrastructure Threats]
Fortra BoKS Privileged Access Manager Vulnerabilities [Vulnerability Disclosures]
Rejetto HFS Authentication Bypass (CVE-2026-61500) [Vulnerability Disclosures]
K7 Security Driver Privilege Escalation (CVE-2025-1055) [Vulnerability Disclosures]
Epic Systems Pauses Development for Six-Week Security Sprint [General Security News]
Italian DPA Fines IQVIA €7 Million for Health Data Processing Violations [General Security News]
GitHub Repositories Expose 543,000+ Valid Credentials [General Security News]
MetaMask Discloses Ongoing Infrastructure Security Incident [General Security News]
OpenAI Faces California DOJ Subpoena Over Cybersecurity Practices [General Security News]
Senate Passes Bipartisan Hospital Cybersecurity Bill [General Security News]
Federal Reserve Employee Mishandled Classified Files Before Retirement [General Security News]

CVEs Referenced

CVE-2025-1055, CVE-2026-12627, CVE-2026-61500, CVE-2026-79898, CVE-2026-79901

Indicators of Compromise

Domains: catbox[.]moe, wasabisys[.]com, 211[.]248, 211[.]249, 211[.]0, fbijobs[.]gov

Read the full brief

2026-10-03: Fortinet warns of active exploitation of a critical FortiMail zero-day allowing unauthenticated

Sat, 03 Oct 2026 06:00:00 +0000

Show Notes - 2026-10-03

Stories Covered

Today:
Fortinet FortiMail Zero-Day Under Active Exploitation (CVE-2026-104286) [Critical Alerts]
CISA Adds Zammad Vulnerabilities to KEV Catalog [Critical Alerts]
Citrix NetScaler Zero-Days Exploited in the Wild [Critical Alerts]
Police Dismantle KillSec Ransomware Group, Arrest Teen Operator [Ransomware & Extortion]
City of Vicksburg, Mississippi Shuts Down After Cyberattack [Ransomware & Extortion]
Ransomware Attack Timeline: The First 24 Hours [Ransomware & Extortion]
Dell Container Storage Modules Hit With Critical 10.0 Vulnerabilities [Business & Infrastructure Threats]
GitLab AI Gateway Critical Flaw Allows Command Execution [Business & Infrastructure Threats]
SWIFT Banking Middleware Vulnerability Enables RCE [Business & Infrastructure Threats]
Microsoft Exchange Server Elevation of Privilege (CVE-2026-96940) [Windows / AD Security]
Antino Backdoor Uses Microsoft 365 for C2 [IOCs & Detection]
Linux Implants Mimic Asian Mail Security Products [IOCs & Detection]
OpenAI AI Agents Breached 100+ Organizations [General Security News]
Iranian State Hacker Extradited to US [General Security News]
macOS Users Targeted by Fake Zoom Installer [General Security News]
Microsoft X Account Hijacked for Crypto Scam [General Security News]
Kiteworks Publishes 100+ Security Advisories [Vulnerability Disclosures]
Apple iCloud Email Spoofing Bugs Patched [Vulnerability Disclosures]
Cloudflare Containers Vulnerability [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-102489, CVE-2026-102490, CVE-2026-104286, CVE-2026-18397, CVE-2026-54472, CVE-2026-61421, CVE-2026-63688, CVE-2026-63692, CVE-2026-67269, CVE-2026-88771, CVE-2026-88772, CVE-2026-90970, CVE-2026-96940

Read the full brief

2026-10-02: Fortinet FortiMail zero-day is under active exploitation with CISA setting an October 4 patch

Fri, 02 Oct 2026 06:00:00 +0000

Show Notes - 2026-10-02

Stories Covered

Today:
Fortinet FortiMail Zero-Day (CVE-2026-104286) [Critical Alerts]
Cisco Catalyst SD-WAN Manager Authentication Bypass (CVE-2026-76504) [Critical Alerts]
Citrix NetScaler Zero-Days (CVE-2026-88771, CVE-2026-88772) [Critical Alerts]
Additional CISA KEV Additions [Critical Alerts]
KillSec Ransomware Takedown [Ransomware & Extortion]
Warlock Ransomware Targets Spanish/Portuguese Critical Infrastructure [Ransomware & Extortion]
McMinnville Records Exposed by RansomHouse [Ransomware & Extortion]
RMM Abuse and Mailbox Manipulation Lead Huntress Tragic Quadrant [Business & Infrastructure Threats]
Zimbra Zero-Day Exploited Before Public Disclosure (CVE-2026-73570) [Business & Infrastructure Threats]
ICS/OT Vulnerabilities [Vulnerability Disclosures]
WordPress Self-Healing Backdoor [Vulnerability Disclosures]
AI Agents Probe Government Sites with SQL Injection [Vulnerability Disclosures]
Microsoft Digital Defense Report: Governments Most Targeted Sector [General Security News]
Met Police Suspends Oxygen Forensics Over Russian Links [General Security News]
Android 17 Locks Accessibility Services Under Advanced Protection [General Security News]
OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI [General Security News]

CVEs Referenced

CVE-2023-46604, CVE-2025-31161, CVE-2026-104286, CVE-2026-32201, CVE-2026-45659, CVE-2026-50522, CVE-2026-55040, CVE-2026-56164, CVE-2026-58644, CVE-2026-73570, CVE-2026-76504, CVE-2026-85102, CVE-2026-88771, CVE-2026-88772, CVE-2026-93616, CVE-2026-93952, CVE-2026-94127

Indicators of Compromise

IP Addresses: 79.141.169.187, 45.129.0.192

Read the full brief

2026-10-01: Cisco warns of active exploitation of a critical SD-WAN Manager zero-day with no workaround

Thu, 01 Oct 2026 06:00:00 +0000

Show Notes - 2026-10-01

Stories Covered

Today:
Cisco Catalyst SD-WAN Manager Authentication Bypass (CVE-2026-76504) [Critical Alerts]
Citrix NetScaler Zero-Days Target Government and Finance (CVE-2026-88771, CVE-2026-88772) [Critical Alerts]
Zimbra Mail Servers Exploited for Web Shell Deployment (CVE-2026-73570) [Critical Alerts]
Bitget Cryptocurrency Exchange Breach Linked to Third-Party Zero-Day [Ransomware & Extortion]
CSuite Phishing Campaign Delivers RATs via Microsoft 365 Session Theft [IOCs & Detection]
Russia's Star Blizzard Adopts RedFlick Malware Delivery [IOCs & Detection]
Attackers Abuse MSP360 RMM in Dual-Tool Phishing Attacks [Business & Infrastructure Threats]
ChatGPT Custom GPTs Weaponized in ClickFix RAT Campaign [Business & Infrastructure Threats]
ScreenConnect Client Abused in Simple Phishing Campaign [Business & Infrastructure Threats]
China-Aligned TA419 Targets US AI Policy Experts [Windows / AD Security]
Apple CoreGraphics PDF Zero-Day PoC Published (CVE-2026-86950) [General Security News]
Google Reports AI Changing Vulnerability Discovery Pace [General Security News]
Google Launches Gemini 4 Argon for Cyber Defenders [General Security News]
Anthropic and OpenAI Face AI Agent Liability Questions [General Security News]
Cloudflare Plans Quantum-Safe TLS Certificates [Vulnerability Disclosures]
AI Coding Agents Exposed 13,000 Internal Images on GitHub [Vulnerability Disclosures]
MetaMask Security Incident Triggers Validator Exit [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-1731, CVE-2026-73570, CVE-2026-76504, CVE-2026-86950, CVE-2026-88771, CVE-2026-88772

Indicators of Compromise

Domains: 85[.]67, 197[.]72, 143[.]20., chatgpt[.]com, thelittlecupandsaucer[.]com

IP Addresses: 26.1.2.1, 20.18.4.1, 20.15.6.1, 20.12.8.2, 20.9.10.1

Read the full brief

2026-09-30: Two Citrix NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5)

Wed, 30 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-30

Stories Covered

Today:
Citrix NetScaler ADC and Gateway Zero-Days (CVE-2026-88771, CVE-2026-88772) [Critical Alerts]
Apple CoreGraphics Zero-Day (CVE-2026-86950) [Critical Alerts]
ATNS Air Traffic Control OT Network (South Africa) [Ransomware & Extortion]
ShinyHunters Arrest and FBI Data Breach [Ransomware & Extortion]
Phishing Delivers MSP360 RMM, Then ScreenConnect [Business & Infrastructure Threats]
ChatGPT Custom GPTs Used for ClickFix [Business & Infrastructure Threats]
Azure DevOps Compromise via Self-Service Password Reset (Storm-3068) [Business & Infrastructure Threats]
Bitget and Belnet Breaches via Zero-Days [Business & Infrastructure Threats]
Star Blizzard RedFlick Technique [Windows / AD Security]
Word 2609 Saves PDFs to the Wrong Location [Windows / AD Security]
French Tax Administration Data Theft [General Security News]
Spectre-v2 BTR Attack [General Security News]
Sanctions Force CA Revocations in Russia and Iran [General Security News]
OpenSSL DTLS Heap Leak (CVE-2026-84782) [Vulnerability Disclosures]
MikroTik RouterOS (CVE-2026-84411) [Vulnerability Disclosures]
VIVOTEK Camera Firmware (CVE-2026-22755) [Vulnerability Disclosures]
Other CISA ICS Advisories [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-100291, CVE-2026-100299, CVE-2026-22755, CVE-2026-84409, CVE-2026-84411, CVE-2026-84782, CVE-2026-86950, CVE-2026-88771, CVE-2026-88772, CVE-2026-91191, CVE-2026-94204, CVE-2026-96274, CVE-2026-96587

Indicators of Compromise

Hashes: 108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc

Read the full brief

2026-09-29: Citrix confirmed two critical NetScaler zero-days actively exploited in the wild

Tue, 29 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-29

Stories Covered

Today:
Citrix NetScaler Zero-Days Exploited in the Wild (CVE-2026-88771, CVE-2026-88772) [Critical Alerts]
Apple CoreGraphics Zero-Day Exploited in Targeted Attacks (CVE-2026-86950) [Critical Alerts]
ShinyHunters Expands Oracle PeopleSoft Campaign with WAF Bypass [Ransomware & Extortion]
Dutch Police Arrest ShinyHunters Member (Second Arrest) [Ransomware & Extortion]
Silent Ransom Group Attacks Hogan Lovells Cadwalader Law Firm Twice [Ransomware & Extortion]
NeedyMantis Post-Compromise Malware Targets Enterprise Networks [Windows / AD Security]
JadePuffer Attacker Conducts Azure Destructive Operations [Windows / AD Security]
ChatGPT Custom GPT Abuse for ClickFix RAT Delivery [IOCs & Detection]
RatHat Android Banking Trojan Uses Gemini for Victim Prioritization [IOCs & Detection]
Carbonato Botnet Deploys Hermes AI Agent via Docker [IOCs & Detection]
TDengine Time-Series Database Zero-Day Denial of Service (CVE-2026-42542) [Business & Infrastructure Threats]
Bitget Cryptocurrency Exchange $388M Theft via Third-Party Security Product Flaw [Business & Infrastructure Threats]
MCP Python SDK Flaw Allows OAuth Credential Theft (CVSS 7.5) [Business & Infrastructure Threats]
OpenAI Shelves GPT-6.1 Astra After Safety Failures [General Security News]
Former U.S. Soldier Sentenced for Hacking and Extortion [General Security News]
New Mexico Jury Finds Facebook Liable for Privacy Deception [General Security News]
Microsoft Chromium CVEs [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-43300, CVE-2025-55177, CVE-2026-35273, CVE-2026-42542, CVE-2026-86950, CVE-2026-88771, CVE-2026-88772, CVE-2026-91728, CVE-2026-91745

Indicators of Compromise

IP Addresses: 3.4.0.0, 3.4.1.5, 3.4.1.6

Read the full brief

2026-09-28: Citrix NetScaler faces active exploitation of two critical zero-days (CVE-2026-88771 and

Mon, 28 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-28

Stories Covered

Today:
Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway (CVE-2026-88771, CVE-2026-88772) [Critical Alerts]
Kiteworks Advanced Forms Zero-Day Prompts Emergency Server Shutdown [Critical Alerts]
OpenAI AI Agents Probed Dozens of US Government and International Sites [General Security News]
Intel Removes Financial Rewards from Bug Bounty Program [General Security News]
Wireshark 4.6.9 Patches 19 Vulnerabilities [Vulnerability Disclosures]
Simba Telco Data Breach Exposes 23,500 Customers [Vulnerability Disclosures]
UK NHS Staff Removed Over Medical Records Data Breach [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-65660, CVE-2026-88771, CVE-2026-88772, CVE-2026-88773

Read the full brief

2026-09-27: Two unpatched Citrix NetScaler RCE zero-days are under active exploitation with no fix available

Sun, 27 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-27

Stories Covered

Today:
Citrix NetScaler ADC/Gateway: Two Unpatched RCE Zero-Days Under Active Exploitation [Critical Alerts]
Oracle PeopleSoft CVE-2026-35273: Mass Exploitation Resumes with WAF Bypass [Critical Alerts]
Microsoft SharePoint CVE-2026-65660: Exploitation Begins Two Days After Technical Disclosure [Critical Alerts]
x47.c Windows Botnet Weaponizes xAI Grok for Persistence and AI API Draining [Ransomware & Extortion]
Lunex Stealer Abuses AMD Driver to Disable Security Tools Before Credential Theft [Ransomware & Extortion]
Healthcare Data Breaches in Poland and U.S. Raise Security Concerns [Business & Infrastructure Threats]
Supabase Customer Databases Exposing Sensitive Data to Public Web [Business & Infrastructure Threats]
Labcorp Settles for $2.3 Million Over Cybersecurity Failings in 2019 AMCA Breach [Business & Infrastructure Threats]
OpenAI Models Accessed U.S. Government Websites in Unintended Ways [Business & Infrastructure Threats]
China and U.S. Agree to Establish AI Safety Channel [General Security News]

CVEs Referenced

CVE-2023-20598, CVE-2026-19490, CVE-2026-35273, CVE-2026-65660

Indicators of Compromise

Domains: 159[.]128.

Read the full brief

2026-09-26: CISA added two actively exploited flaws affecting SharePoint and MikroTik routers to the KEV

Sat, 26 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-26

Stories Covered

Today:
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild [Critical Alerts]
Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the Wild [Critical Alerts]
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft [Ransomware & Extortion]
ShinyHunters Defaced Clop's Leak Site in Grudge Match [Ransomware & Extortion]
Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise [Business & Infrastructure Threats]
Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack [Business & Infrastructure Threats]
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link [Business & Infrastructure Threats]
Storm-3168: Agentic-driven cloud attacks using compromised service principals [Windows / AD Security]
AI Relay Networks Funnel Chinese Traffic to Western Frontier Models [General Security News]
Infostealer Logs Expose Remote Access Keys Across US Water Sector [General Security News]
CLOSEDQUORUM: First Malware to Use Commercial AI APIs for C2 [General Security News]
PamStealer macOS Malware Adds Live C2 Payload Decryption [General Security News]
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware [General Security News]
Microsoft Office CVE-2026-100208 (Outlook RCE) and CVE-2026-100206 (Information Disclosure) [Vulnerability Disclosures]
Chromium Vulnerabilities in Microsoft Edge [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-49113, CVE-2025-68461, CVE-2026-100206, CVE-2026-100208, CVE-2026-35273, CVE-2026-48842, CVE-2026-65660, CVE-2026-67279, CVE-2026-86060, CVE-2026-95274, CVE-2026-95275, CVE-2026-95276, CVE-2026-95277, CVE-2026-95278, CVE-2026-95279, CVE-2026-95280, CVE-2026-95281, CVE-2026-95293, CVE-2026-95303, CVE-2026-95304, CVE-2026-95311, CVE-2026-95316, CVE-2026-95328, CVE-2026-95362, CVE-2026-95366, CVE-2026-95376, CVE-2026-95385

Indicators of Compromise

Domains: wavel[.]app, apple03cloudstore[.]com.

Read the full brief

2026-09-25: CISA added two actively exploited vulnerabilities to its KEV catalog with a Friday deadline

Fri, 25 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-25

Stories Covered

Today:
CISA Adds WSO2 and Adobe Commerce Flaws to KEV Catalog (CVE-2026-5430, CVE-2026-71362) [Critical Alerts]
Roundcube Webmail SQL Injection Under Active Exploitation (CVE-2026-48842) [Critical Alerts]
Storm-2570 Affiliate Operates Across Four Ransomware Families Using Consistent Tradecraft [Ransomware & Extortion]
Microsoft September 2026 Security Updates [Windows / AD Security]
Chromium Type Confusion Vulnerability (CVE-2025-2135) [Windows / AD Security]
Threat Actor Compiles Cryptominer Directly on Compromised Endpoint [Business & Infrastructure Threats]
SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted (CVE-2026-28324, CVE-2026-28325, CVE-2026-28326) [Business & Infrastructure Threats]
Salesforce Agentforce Vulnerabilities Enabled Zero-Click Data Exfiltration (SalesBleed) [Business & Infrastructure Threats]
Cloudflare Containers Flaw Allowed Reading Other Customers' Leftover Disk Data [Business & Infrastructure Threats]
ClickFix Campaign Leverages Compromised Ukrainian Websites to Deploy Psychedelic Stealer [General Security News]
Corp MDM Spyware Targets Logistics Sector via Fake Google Play Pages [General Security News]
Placeholder Domain third-party[.]com Weaponized to Serve ClickFix Lures [General Security News]
Botslab G980H Dashcams (14 CVEs) [Vulnerability Disclosures]
Eufy Omni C20 and Omni X10 Pro (3 CVEs) [Vulnerability Disclosures]
OnePlus Unpatched Root Vulnerabilities [Vulnerability Disclosures]

CVEs Referenced

CVE-2024-37383, CVE-2024-7399, CVE-2025-2135, CVE-2025-4632, CVE-2025-49113, CVE-2025-68461, CVE-2026-28324, CVE-2026-28325, CVE-2026-28326, CVE-2026-48842, CVE-2026-5430, CVE-2026-71362, CVE-2026-82566, CVE-2026-84399, CVE-2026-85496, CVE-2026-93289, CVE-2026-93290, CVE-2026-93291

Indicators of Compromise

Domains: fsputnik[.]com, tracker[.]js., uasputnik[.]com, 82[.]242, 82[.]242., logisticstkwcargo[.]com, ceva-app[.]help., 61[.]82, ceva-app[.]help, 61[.]82., third-party[.]com, example[.]com, yoursite[.]com, your-domain[.]com, example[.]org, example[.]net., yourdomain[.]com, your-site[.]com

IP Addresses: 194.87.89.30

Read the full brief

2026-09-24: F5 BIG-IP APM has a critical zero-day under active exploitation with a Friday federal patch deadline

Thu, 24 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-24

Stories Covered

Today:
F5 BIG-IP APM Zero-Day Under Active Exploitation (CVE-2026-94127) [Critical Alerts]
MikroTik RouterOS SSH Chain Exploited Before Patches (CVE-2026-67279, CVE-2026-86060) [Critical Alerts]
WordPress Path Traversal Escalates to Active Compromises (CVE-2026-87902) [Critical Alerts]
Ryuk Operator Sentenced to 24 Months [Ransomware & Extortion]
MacSync Stealer Overhauls Delivery with Binary Droppers [Ransomware & Extortion]
Canva Breached via Vendor's Salesforce Instance [Ransomware & Extortion]
Rogue RMM Abuse: Phishing Leads to Persistent Access [Business & Infrastructure Threats]
TeamFiltration Campaign Compromises Seven M365 Accounts via Default Passwords [Business & Infrastructure Threats]
cPanel Root Exploit via CalDAV/CardDAV Service (CVE-2026-87899) [Business & Infrastructure Threats]
Compromised MemTensor Packages Deliver Credential Stealer [Business & Infrastructure Threats]
Malicious Terraform Providers Deliver Graphalgo Malware via HashiCorp Registry [Business & Infrastructure Threats]
OAuth Token Theft Through Windows Developer Mode (WWAHost.exe) [Windows / AD Security]
Microsoft Outlook RCE (CVE-2026-70125) [Windows / AD Security]
Attackers Poison AI Chatbots in Mass Disinformation Campaign [General Security News]
GitLab Issue Email Addresses Enable Unauthorized Code Commits [General Security News]
AI Models Vote on Malware's Next Move in CLOSEDQUORUM [General Security News]
Linux Kernel Container Escape Unpatched on Ubuntu (CVE-2026-80521) [General Security News]
OpenAI Agent Accessed Non-Public Australian Medicare Portal Files [General Security News]
Adobe Patches 36 Vulnerabilities in Connect, AEM Forms, and Other Products [Vulnerability Disclosures]
Anthropic and OpenAI Release Models with Improved Safety Alignment [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-67279, CVE-2026-68490, CVE-2026-70125, CVE-2026-75682, CVE-2026-75684, CVE-2026-75686, CVE-2026-75689, CVE-2026-75697, CVE-2026-75698, CVE-2026-75745, CVE-2026-80521, CVE-2026-81995, CVE-2026-82000, CVE-2026-86060, CVE-2026-87899, CVE-2026-87900, CVE-2026-87902, CVE-2026-94127

Indicators of Compromise

Domains: skyleen[.]fr., skyleen[.]fr

Read the full brief

2026-09-23: A Microsoft Defender zero-day blocks platform updates by filling disk space

Wed, 23 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-23

Stories Covered

Today:
BigDiskBuster Zero-Day Blocks Microsoft Defender Updates (CVE-2026-45498) [Critical Alerts]
F5 BIG-IP APM Zero-Day Enables Unauthenticated RCE (CVE-2026-94127) [Critical Alerts]
Check Point Management Server Zero-Day Exploited in Targeted Attacks (CVE-2026-93616) [Critical Alerts]
Arista VeloCloud Orchestrator Zero-Day (CVE-2026-93952) [Critical Alerts]
Armenian National Sentenced for RYUK Ransomware Extortion [Ransomware & Extortion]
Scattered Spider Member Pleads Guilty [Ransomware & Extortion]
SharePoint RCE Flaw Misclassified as Spoofing (CVE-2026-65660) [Windows / AD Security]
Microsoft Disrupts EvilTokens Device Code Phishing Platform [Windows / AD Security]
TeamFiltration Campaign Targets Chilean Organizations [Windows / AD Security]
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) [Business & Infrastructure Threats]
Bifrost AI Gateway RCE (CVE-2026-90898) [Business & Infrastructure Threats]
CrowdSec GitHub Breach via TanStack Supply Chain Attack [Business & Infrastructure Threats]
CISA Adds Four KEV Entries (September 22) [Vulnerability Disclosures]
Siemens Industrial Edge Management Authentication Bypass (CVE-2026-18963) [Vulnerability Disclosures]
Multiple Siemens ICS Vulnerabilities [Vulnerability Disclosures]
lwIP TCP/IP Stack Flaws [Vulnerability Disclosures]
Linux Kernel ARM64 KVM Flaw (CVE-2026-89775) [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-18963, CVE-2026-31431, CVE-2026-34223, CVE-2026-45498, CVE-2026-50093, CVE-2026-65660, CVE-2026-67367, CVE-2026-85046, CVE-2026-85102, CVE-2026-85880, CVE-2026-87121, CVE-2026-87491, CVE-2026-89207, CVE-2026-89775, CVE-2026-90898, CVE-2026-91018, CVE-2026-93616, CVE-2026-93952, CVE-2026-94127

Indicators of Compromise

Domains: 149[.]77, 126[.]159., chinadigitaltimes[.]top, americanprgoress[.]top., thecovnresation[.]com, theconversation[.]com

IP Addresses: 5.2.3.16, 6.4.2.8, 0.0.0.0

Read the full brief

2026-09-22: ShinyHunters hijacked Clop's leak site and is threatening to expose ransom payment records from the

Tue, 22 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-22

Stories Covered

Today:
Cisco ISE Authentication Bypass (CVE-2026-76460) [Critical Alerts]
Zyxel GS1900 Series Stack-Based Buffer Overflow (CVE-2026-7273) [Critical Alerts]
Veeam Agent for Windows Local Privilege Escalation (CVE-2026-32996) [Critical Alerts]
Check Point Security Management Critical RCE (CVE-2026-91843) [Critical Alerts]
ShinyHunters Hijacks Clop's Leak Site, Threatens Payment Exposure [Ransomware & Extortion]
INC Ransomware: Dual Ransom Notes and 17-Day Dwell Time [Ransomware & Extortion]
TASK#STOMP PowerShell Backdoor [IOCs & Detection]
SideCopy / ReverseRAT Targeting India [IOCs & Detection]
TerminalFix: PNG Steganography for Payload Delivery [IOCs & Detection]
Fake LastPass Installers Deploy Kernel-Level EDR Killer and Rapuncel Stealer [Business & Infrastructure Threats]
CrowdSec Source Code Stolen via TanStack Supply Chain Attack [Business & Infrastructure Threats]
Contagious Interview (North Korea): 30,000 Devices, $10.71M Stolen [Business & Infrastructure Threats]
CLOSEDQUORUM: First Autonomous AI-Driven C2 Malware [Business & Infrastructure Threats]
Windows Dangling COM Object Privilege Escalation (CVE-2026-66804) [Windows / AD Security]
WordPress Comment2Shell (CVE-2026-93485) [Windows / AD Security]
Meta Muse AI Assistant Zero-Day (macOS) [General Security News]
Plugin4Shell: Zero-Click RCE in AI Coding Agents [General Security News]
Brevo Supply Chain Attack via Compromised Cloudflare API Key [General Security News]
Oracle September 2026 Critical Patch Update [General Security News]
BIND 9 Security Updates (14 vulnerabilities) [Vulnerability Disclosures]
Windows COM Object Privilege Escalation (CVE-2026-66804) [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-61882, CVE-2026-32996, CVE-2026-50343, CVE-2026-66804, CVE-2026-7273, CVE-2026-76460, CVE-2026-76461, CVE-2026-77692, CVE-2026-91843, CVE-2026-93485

Indicators of Compromise

Domains: corecloudfileshare[.]xyz, attachmentsharingdrive[.]xyz, educationportals[.]biz, 157[.]22, docsportal[.]in

Hashes: f5f1eb6d43dd61d5b069c250e5c666384f7417d0c95014773bf9edf8ff13bebe

Read the full brief

2026-09-21: PAYLOAD ransomware weaponizes Active Directory Group Policy to deploy ransom notes domain-wide

Mon, 21 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-21

Stories Covered

Today:
Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO [Critical Alerts]
Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266) [Critical Alerts]
PAYLOAD ransomware via Group Policy [Windows / AD Security]
Jade Sleet Linked to Indian IT Provider Breach With FLATROOF and ROOFDECK Backdoors [Business & Infrastructure Threats]
ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure [Business & Infrastructure Threats]
Google Confirms Gemini AI Breached Three Firms [General Security News]
An undercover Google analyst infiltrated a notorious supply-chain hacking gang [General Security News]
Risky Bulletin: Gemini hacked three companies too [General Security News]
ClickFix expands to macOS with PasteSwitch campaign [General Security News]

CVEs Referenced

CVE-2025-39682, CVE-2025-39964, CVE-2026-53266

Indicators of Compromise

Domains: hashicorp-aws[.]com., hashicorp-aws[.]com

Read the full brief

2026-09-20: ShinyHunters breached Clop's leak site using a Grav CMS exploit

Sun, 20 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-20

Stories Covered

Today:
SolarWinds Access Rights Manager Hard-Coded Key Vulnerability (CVE-2026-28326) [Critical Alerts]
ShinyHunters Breaches Clop Ransomware Gang's Leak Site [Ransomware & Extortion]
Spirals Ransomware Claims Healthcare and Federal ITAD Targets [Ransomware & Extortion]
Researchers Chain Vulnerabilities to Compromise OpenAI Staff Accounts (CVE-2026-32882) [Business & Infrastructure Threats]
National Cancer Centre Email Exposure [Business & Infrastructure Threats]
Google Gemini Autonomously Hacked Three Companies in Security Test [Business & Infrastructure Threats]
SolarWinds Web Help Desk Multiple Vulnerabilities [Vulnerability Disclosures]
SolarWinds Serv-U 16 Vulnerabilities [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-28299, CVE-2026-28302, CVE-2026-28304, CVE-2026-28317, CVE-2026-28321, CVE-2026-28323, CVE-2026-28326, CVE-2026-32882

Read the full brief

2026-09-19: Cisco patched a maximum-severity zero-day in Identity Services Engine under active exploitation

Sat, 19 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-19

Stories Covered

Today:
Cisco ISE Authentication Bypass Zero-Day (CVE-2026-76460) [Critical Alerts]
Three Linux Kernel Flaws Exploited in the Wild [Critical Alerts]
Orkes Conductor Pre-Auth RCE Exploited (CVE-2026-58138) [Critical Alerts]
Ransomware Developer Sentenced to 13 Years in Switzerland [Ransomware & Extortion]
Kansas County Hit by Ransomware [Ransomware & Extortion]
TanStack npm Supply Chain Attack Reached CrowdSec, Mistral, OpenAI [Business & Infrastructure Threats]
Abandoned CDN Domain Re-Registered, Thousands of Sites Still Reference It [Business & Infrastructure Threats]
Foreign Actors Breach Two Colorado Water Utilities [Business & Infrastructure Threats]
North Korea Fake Job Interview Campaign Infected 30,000 Devices [Business & Infrastructure Threats]
Plugin4Shell Affects Four AI Coding Agents [Business & Infrastructure Threats]
Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw [Windows / AD Security]
Windows 11 26H1 Out-of-Band Updates [Windows / AD Security]
MFA Does Not Stop OAuth Consent Abuse [General Security News]
Google Gemini Broke Into Real Company Systems During Security Test [General Security News]
AI Agent Incidents Continue [General Security News]
AWS AgentCore Harness Credential Exposure [General Security News]
Transparent Tribe Deploys Rust Backdoor Using GitHub for C2 [General Security News]
FBI: Government Impersonation Scams Cost $1.6B [General Security News]
Four Linux Kernel Local Privilege Escalation Flaws [Vulnerability Disclosures]
WordPress Click2Shell Flaw [Vulnerability Disclosures]
SAP Critical Vulnerability [Vulnerability Disclosures]
Microsoft Edge CVE-2026-88097 [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-39682, CVE-2025-39964, CVE-2026-20129, CVE-2026-20223, CVE-2026-44756, CVE-2026-45321, CVE-2026-53266, CVE-2026-58138, CVE-2026-62721, CVE-2026-68121, CVE-2026-74469, CVE-2026-76460, CVE-2026-80844, CVE-2026-81000, CVE-2026-85878, CVE-2026-85885, CVE-2026-85889, CVE-2026-85921, CVE-2026-87701, CVE-2026-88097

Read the full brief

2026-09-18: Cisco disclosed a second actively exploited zero-day this week, CVE-2026-76460

Fri, 18 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-18

Stories Covered

Today:
Cisco ISE Authentication Bypass Zero-Day (CVE-2026-76460, CVSS 10.0) [Critical Alerts]
Cisco ISE Additional Critical Flaws (CVE-2026-76423, CVSS 10.0 and 26 more CVEs) [Critical Alerts]
Orkes Conductor RCE Under Active Exploitation (CVE-2026-58138, CVSS 9.8) [Critical Alerts]
AI-Powered Ransomware Operations Maturing [Ransomware & Extortion]
Navigate360 Breach -- 8.3M Anonymous Tips Exposed [Ransomware & Extortion]
Cisco ISE Exploitation Indicators [IOCs & Detection]
HEAVYGRAM Telegram Backdoor (Iran/Handala Hack) [IOCs & Detection]
Brevo Supply Chain Attack -- 100,000+ Websites Compromised [Business & Infrastructure Threats]
Check Point Security Management RCE (CVE-2026-91843, CVSS 9.8) [Business & Infrastructure Threats]
Gyazo Breach -- 23.6M User Records and 490M Image Metadata Records [Business & Infrastructure Threats]
Microsoft Secure Now -- AI-Era Exposure Management [Windows / AD Security]
Microsoft Cloud/Azure CVEs [Windows / AD Security]
Exposed LocalAI Instances Compromised at Scale [General Security News]
Docker Sandboxes VM Escape on macOS (CVE-2026-77179, Critical) [General Security News]
Port of Los Angeles Blocked 120M Attacks in August [General Security News]
BIND 9 -- 14 Security Flaws (ISC) [Vulnerability Disclosures]
Unbound DNS -- Critical DNSSEC Heap Overflow (CVE-2026-81642, CVSS 9.1) [Vulnerability Disclosures]
ICS Advisories -- CISA [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-6625, CVE-2026-0899, CVE-2026-13336, CVE-2026-13337, CVE-2026-13348, CVE-2026-15688, CVE-2026-20176, CVE-2026-20211, CVE-2026-20307, CVE-2026-31431, CVE-2026-55946, CVE-2026-58138, CVE-2026-68791, CVE-2026-69865, CVE-2026-70009, CVE-2026-76163, CVE-2026-76423, CVE-2026-76424, CVE-2026-76460, CVE-2026-76461, CVE-2026-77179, CVE-2026-77692, CVE-2026-81642, CVE-2026-82717, CVE-2026-83946, CVE-2026-86520, CVE-2026-91843

Indicators of Compromise

IP Addresses: 3.2.4.1

Read the full brief

2026-09-17: Cisco ISE has a CVSS 10 authentication bypass zero-day (CVE-2026-76460) under active exploitation

Thu, 17 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-17

Stories Covered

Today:
Cisco ISE Authentication Bypass Zero-Day (CVE-2026-76460) [Critical Alerts]
Google Pixel Modem Zero-Click Privilege Escalation (CVE-2026-58704) [Critical Alerts]
Acronis cPanel Backup Plugin Exploited in the Wild (CVE-2026-87886) [Critical Alerts]
Issabel PBX Framework Hard-Coded JWT Key RCE (CVE-2026-89026) [Critical Alerts]
Ransomware Trends in Japan H1 2026: The Gentlemen, Qilin, and SMB Targeting [Ransomware & Extortion]
Nipigon Hospital Ransomware Attack [Ransomware & Extortion]
AI Coding Assistant Hijacked, Shai-Hulud Worm Spreads Across ~100 Repositories [Business & Infrastructure Threats]
N0va Phishing Kit Targeting US and EU Organizations [Business & Infrastructure Threats]
BragJack: Browser Extensions Hijacking Agentic AI Assistants (CVE-2026-0628, CVE-2026-55945) [Business & Infrastructure Threats]
WordPress The Events Calendar RCE (CVE-2026-78006, CVE-2026-78159) [Business & Infrastructure Threats]
Three Threat Groups Targeting Russian Enterprises via Exchange and Active Directory [Windows / AD Security]
CISA Ends Weekly Vulnerability Bulletin [General Security News]
CISA Publishes Cyber Decoy Guidance [General Security News]
AMOS Stealer Targeting macOS via Fake Toolkit Pages [General Security News]
Scans Targeting Hospitality PBX Applications [General Security News]
Treasury Secretary: No Liability Exemptions for AI Labs [General Security News]
Parallels Desktop Local Root Escalation (CVE-2026-90894) [Vulnerability Disclosures]

CVEs Referenced

CVE-2019-0708, CVE-2020-0688, CVE-2021-26855, CVE-2026-0628, CVE-2026-42897, CVE-2026-55945, CVE-2026-58704, CVE-2026-76460, CVE-2026-78006, CVE-2026-78159, CVE-2026-87886, CVE-2026-89026, CVE-2026-90894

Indicators of Compromise

Domains: getmacouscloud[.]com, ferncore13[.]com.

IP Addresses: 6.17.3.1, 6.17.4.1, 94.102.49.125

Read the full brief

2026-09-16: Cisco discloses a critical zero-day in Secure Email Gateway already exploited in the wild with

Wed, 16 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-16

Stories Covered

Today:
Cisco Secure Email Gateway Zero-Day (CVE-2026-76461) [Critical Alerts]
WSO2 API Manager JWT Bypass Under Active Exploitation (CVE-2026-5430) [Critical Alerts]
Acronis Backup Plugin for cPanel Exploited (CVE-2026-87886) [Critical Alerts]
Thai ISP Compromised via Fortinet Vulnerabilities [Ransomware & Extortion]
NightEagle APT Targets Russian Companies [Ransomware & Extortion]
Healthcare Ransomware Claims [Ransomware & Extortion]
September Patch Tuesday Emergency Fixes [Windows / AD Security]
KREMLIN Banking Malware Indicators [IOCs & Detection]
HEAVYGRAM/CHOSEN BRICK Telegram-Controlled Malware [IOCs & Detection]
BambooToken MQTT-Based Malware [IOCs & Detection]
WooCommerce Wholesale Lead Capture Exploitation (CVE-2026-27540) [Business & Infrastructure Threats]
The Events Calendar Critical RCE Flaws (CVE-2026-78159, CVE-2026-78006) [Business & Infrastructure Threats]
ICS/OT Vulnerabilities [Vulnerability Disclosures]
Apple's Record Patch Release [Vulnerability Disclosures]
NIST/CISA Token Protection Guidance [General Security News]
CDM Program Evolution [General Security News]

CVEs Referenced

CVE-2018-13379, CVE-2020-0688, CVE-2021-22986, CVE-2022-1388, CVE-2022-42475, CVE-2023-27997, CVE-2023-46747, CVE-2024-21762, CVE-2026-27540, CVE-2026-5430, CVE-2026-58113, CVE-2026-73807, CVE-2026-76461, CVE-2026-78006, CVE-2026-78159, CVE-2026-78225, CVE-2026-80465, CVE-2026-81855, CVE-2026-81861, CVE-2026-82567, CVE-2026-87886

Indicators of Compromise

Domains: volmira[.]site, zaviro[.]online., chat5188[.]tk.

IP Addresses: 92.241.13.213, 31.59.129.150, 92.241.13.140, 23.137.105.214, 23.180.120.140, 104.194.9.138, 187.75.114.36, 114.10.43.203, 37.114.144.209, 2.0.3.1, 6.17.3.1, 6.17.4.1

Read the full brief

2026-09-15: Cisco Secure Email Gateway zero-day actively exploited for root command execution

Tue, 15 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-15

Stories Covered

Today:
Cisco Secure Email Gateway SQL Injection (CVE-2026-76461) [Critical Alerts]
GitLab Path Traversal (CVE-2026-85706) [Critical Alerts]
Chrome-Windows Zero-Day Chain (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) [Critical Alerts]
Microsoft September Patch Tuesday Zero-Days (CVE-2026-85880, CVE-2026-81963) [Critical Alerts]
Cisco Secure Firewall Management Center Exploited by Russia and Cybercriminals [Business & Infrastructure Threats]
MikroTik RouterOS Chain Enables Passwordless SSH and Admin Escalation [Business & Infrastructure Threats]
Large-Scale Fortinet VPN Credential Attacks [Business & Infrastructure Threats]
WordPress Automated Plugin Reviews Block Backdoored Release [Business & Infrastructure Threats]
Microsoft Edge Chromium Updates [Windows / AD Security]
Windows Secure Kernel Mode Double Free (CVE-2026-85921) [Windows / AD Security]
Silent Ransom Group Attacks Greenberg Traurig Law Firm [Ransomware & Extortion]
Monroe School District (Wisconsin) Disrupted by Possible Cyber Incident [Ransomware & Extortion]
Anthropic Claude Models Hacked Real Internet Due to Configuration Failures [General Security News]
Check Point Reveals PuzzleMask Plain-Prose Jailbreak Technique [General Security News]
DOJ Targets $245M COVID Loan Fraud in Operation No Doze [General Security News]
Data Breaches [General Security News]

CVEs Referenced

CVE-2026-20079, CVE-2026-20316, CVE-2026-67276, CVE-2026-72898, CVE-2026-76461, CVE-2026-81963, CVE-2026-85046, CVE-2026-85706, CVE-2026-85880, CVE-2026-85921, CVE-2026-86060, CVE-2026-87454, CVE-2026-87491, CVE-2026-87527, CVE-2026-87528, CVE-2026-87632

Read the full brief

2026-09-14: ConnectWise ScreenConnect faces active worm-like exploitation with CISA adding CVE-2026-84869 to

Mon, 14 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-14

Stories Covered

Today:
ConnectWise ScreenConnect Vulnerability Exploited in Worm-Like Attacks (CVE-2026-84869) [Critical Alerts]
Three JFrog Artifactory Flaws Exploited for Backdoor Deployment [Business & Infrastructure Threats]
Passkey-Themed Social Engineering Leads to Microsoft Cloud Account Compromise [Business & Infrastructure Threats]
Malicious Twitch Browser Extension Leaks OAuth Tokens from 31,000 Users [Business & Infrastructure Threats]
Telus Warns Customers of Account Breaches [Business & Infrastructure Threats]
AT&T Store Worker Sentenced for SIM-Swap Side Hustle [General Security News]
Anthropic CEO Calls for AI Industry Slowdown [General Security News]
Delaware Updates Privacy and Data-Breach Laws [Vulnerability Disclosures]
HHS Releases Updated Security Risk Assessment Tool [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-42016, CVE-2026-42018, CVE-2026-82329, CVE-2026-84869

Read the full brief

2026-09-13: CISA added five actively exploited flaws to the KEV catalog with patch deadlines through September

Sun, 13 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-13

Stories Covered

Today:
CISA Adds Five Actively Exploited Vulnerabilities to KEV Catalog [Critical Alerts]
BlueMoon Exploit Kit Chains Chrome and Windows Zero-Days (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) [Critical Alerts]
Google Content Removal System Leaked Sex Crime Victim Identities Globally [General Security News]
New York DFS Issues Cybersecurity Risk Assessment Guidance [General Security News]
CVE-2026-42016 [Vulnerability Disclosures]
CVE-2026-42018 [Vulnerability Disclosures]
CVE-2026-82329 [Vulnerability Disclosures]
CVE-2026-84869 [Vulnerability Disclosures]
CVE-2026-67277 [Vulnerability Disclosures]
CVE-2026-86060 [Vulnerability Disclosures]
CVE-2026-85046 [Vulnerability Disclosures]
CVE-2026-87491 [Vulnerability Disclosures]
CVE-2026-85880 [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-42016, CVE-2026-42018, CVE-2026-67277, CVE-2026-82329, CVE-2026-84869, CVE-2026-85046, CVE-2026-85880, CVE-2026-86060, CVE-2026-87491

Read the full brief

2026-09-12: Check Point patches four critical VPN flaws including two on CISA's KEV list

Sat, 12 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-12

Stories Covered

Today:
GitLab CVSS 10 Path Traversal Under Active Exploitation (CVE-2026-85706) [Critical Alerts]
Chrome V8 Zero-Day Exploited in the Wild (CVE-2026-87491) [Critical Alerts]
Check Point VPN Critical Flaws Include Two CISA KEV Entries (CVE-2026-16232, CVE-2026-50751, CVE-2026-85102, CVE-2026-85103) [Critical Alerts]
Ukrainian Conti Developer Sentenced to 4 Years [Ransomware & Extortion]
AI-Powered PaperCut Attack Shows Attacker Speed Gains [IOCs & Detection]
OpenAI Agent Swarm Compromised RubyGems Infrastructure [IOCs & Detection]
LLM Access Harvesting Operation Uses Autonomous Agent [IOCs & Detection]
Endpoint Hardening Gaps Enable Common Intrusions [Business & Infrastructure Threats]
CISA Calls for Transparent Breach Communications [Business & Infrastructure Threats]
GitLab Multiple Flaws [Vulnerability Disclosures]
Microsoft Edge and Chromium Updates [Vulnerability Disclosures]
JFrog Artifactory Under Active Exploitation [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-16232, CVE-2026-19478, CVE-2026-42016, CVE-2026-42018, CVE-2026-50751, CVE-2026-76018, CVE-2026-76019, CVE-2026-76022, CVE-2026-76023, CVE-2026-77490, CVE-2026-84330, CVE-2026-84333, CVE-2026-84869, CVE-2026-85043, CVE-2026-85045, CVE-2026-85052, CVE-2026-85053, CVE-2026-85102, CVE-2026-85103, CVE-2026-85706, CVE-2026-87491, CVE-2026-87719

Read the full brief

2026-09-11: Cisco firewalls are under attack by state-sponsored groups and Qilin ransomware

Fri, 11 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-11

Stories Covered

Today:
Cisco FMC Exploited by State-Sponsored Groups and Qilin Ransomware (CVE-2026-20316, CVE-2026-20079) [Critical Alerts]
PaperCut Attacker Uses AI Agents to Compromise 440+ Instances (CVE-2026-81578, CVE-2026-82078) [Critical Alerts]
Check Point VPN Flaws Enable Unauthenticated RCE (CVE-2026-85102, CVE-2026-85103) [Critical Alerts]
CISA Adds Four Exploited Vulnerabilities to KEV Catalog [Critical Alerts]
Fortinet Flaw Exploited to Deploy PivotC2 RAT (CVE-2025-25249) [Ransomware & Extortion]
Conti Ransomware Developer Sentenced to 4 Years [Ransomware & Extortion]
Voice Callers Exploit BYOD to Reach Microsoft 365 Corporate Data [Business & Infrastructure Threats]
AI-Themed Phishing Campaigns Target ChatGPT, Copilot, DeepSeek, Claude Users [Business & Infrastructure Threats]
Microsoft Promotes AI Invoice Fraud Campaign Using Generative AI [Business & Infrastructure Threats]
JFrog Artifactory Flaws Chained for Admin Takeover (CVE-2026-42018, CVE-2026-42016) [Business & Infrastructure Threats]
ShieldCrash Bypasses Microsoft Defender Patches (CVE-2026-69414) [Windows / AD Security]
ShinyHunters Breach McKesson Medical Supplier, Expose 6.4M Records [General Security News]
China-Linked UNC3569 Exploited Sogou Input Method for GRAYRABBIT Backdoor (CVE-2021-38003) [General Security News]
Trezor and BitBox Targeted in Newsletter Phishing Campaign [General Security News]
Citrix NetScaler Authentication Bypass (CVE-2026-19490) [Vulnerability Disclosures]
AVEVA Pipeline Integrity Monitor ICS Vulnerabilities [Vulnerability Disclosures]
NextGen Healthcare Mirth Connect Medical Device Flaws [Vulnerability Disclosures]
Orthanc DICOM Server Heap Overflow (CVE-2026-87020) [Vulnerability Disclosures]
Google Play Early Access Abused for Deceptive Apps [Vulnerability Disclosures]
Android Banking Malware Gigabud Uses Work Profiles to Hide (Indonesia) [Vulnerability Disclosures]

CVEs Referenced

CVE-2021-38003, CVE-2025-25249, CVE-2026-19490, CVE-2026-20079, CVE-2026-20316, CVE-2026-42016, CVE-2026-42018, CVE-2026-67277, CVE-2026-69414, CVE-2026-78224, CVE-2026-81578, CVE-2026-81821, CVE-2026-81822, CVE-2026-81823, CVE-2026-81824, CVE-2026-82078, CVE-2026-82329, CVE-2026-82578, CVE-2026-82583, CVE-2026-85102, CVE-2026-85103, CVE-2026-86060, CVE-2026-87020

Indicators of Compromise

IP Addresses: 45.142.193.132

Read the full brief

2026-09-10: Multiple Chinese espionage groups are rapidly exploiting a Chrome/Windows zero-day chain

Thu, 10 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-10

Stories Covered

Today:
BlueMoon Exploit Chain: Chrome and Windows Zero-Days Under Active Exploitation (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) [Critical Alerts]
Cisco Secure Firewall Management Center Under Active Attack (CVE-2026-20079, CVE-2026-20316) [Critical Alerts]
CISA KEV Additions: Four Vulnerabilities with Tight Deadlines [Critical Alerts]
Fortinet Flaw Exploited to Deploy PivotC2 RAT (CVE-2025-25249) [Ransomware & Extortion]
Qilin Ransomware Affiliate Exploited Cisco FMC (UAT-11988) [Ransomware & Extortion]
Microsoft Defender Zero-Day: ShieldCrash Bypasses September Patches (CVE-2026-69414) [Windows / AD Security]
Passkey-Themed Social Engineering Leads to Cloud Identity Compromise [Windows / AD Security]
Infostealer Logs Expose Replayable AI API Keys and Session Tokens [Business & Infrastructure Threats]
LiteLLM Gateways Exposed with Default Admin Key "sk-1234" (CVE-2026-59821) [Business & Infrastructure Threats]
Workflow Identity Hijacking: AI Attack Bypasses Authorization in Enterprise Pipelines [Business & Infrastructure Threats]
ICS Patch Tuesday: Schneider Electric, Siemens Fix Critical Flaws [Vulnerability Disclosures]
Chipmaker Patch Tuesday: Nvidia, AMD, Arm [Vulnerability Disclosures]
DeepSeek Harness Sandbox Escape (CVE-2026-82533) [Vulnerability Disclosures]
Alby Hub Bitcoin Wallet Flaw (v1.7.0 - v1.18.5) [Vulnerability Disclosures]
US Disrupts Xinbi Guarantee Scam Marketplace, Freezes $52.8M Crypto [General Security News]
US Agencies Accuse Chinese AI Firms of Industrial-Scale Model Distillation [General Security News]
Anthropic Discloses Fourth AI Hacking Incident [General Security News]
EU Cyber Resilience Act Reporting Requirements Begin September 11 [General Security News]

CVEs Referenced

CVE-2025-25249, CVE-2026-19490, CVE-2026-20079, CVE-2026-20316, CVE-2026-31431, CVE-2026-3869, CVE-2026-43603, CVE-2026-50656, CVE-2026-59821, CVE-2026-69414, CVE-2026-82533, CVE-2026-85046, CVE-2026-85880, CVE-2026-87491

Indicators of Compromise

IP Addresses: 127.0.0.1

Read the full brief

2026-09-09: Microsoft breaks records with 974 vulnerabilities including two actively exploited zero-days

Wed, 09 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-09

Stories Covered

Today:
Microsoft Patches Two Actively Exploited Zero-Days Among Record 974 CVEs [Critical Alerts]
Chrome 153 Patches Seventh Zero-Day of 2026 [Critical Alerts]
N-able N-central Pre-Auth RCE Actively Exploited [Critical Alerts]
Adobe Commerce Zero-Day StyleSmuggler Exploited Since September 4 [Critical Alerts]
SAP Patches CVSS 10.0 Kernel Flaw OVERPASS [Business & Infrastructure Threats]
20 Wormable CVEs Create Network Contagion Risk [Business & Infrastructure Threats]
FreeIPA Critical Flaw Chain Enables Admin Credential Creation [Business & Infrastructure Threats]
Multi-Hop Google Redirect Phishing Campaign [Business & Infrastructure Threats]
Microsoft Office Preview Pane Attack Surface [Windows / AD Security]
Windows Hyper-V Guest-to-Host Escape Flaws [Windows / AD Security]
Active Directory Rights Management Service (AD RMS) Research [Windows / AD Security]
Microsoft Defender ShieldBreak Patch Bypass (ShieldCrash) [General Security News]
Microsoft September 2026: 974 CVEs [Vulnerability Disclosures]
Adobe September 2026: 170+ CVEs [Vulnerability Disclosures]

CVEs Referenced

CVE-2020-1350, CVE-2026-11645, CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-44756, CVE-2026-48273, CVE-2026-5281, CVE-2026-55007, CVE-2026-58240, CVE-2026-69380, CVE-2026-69414, CVE-2026-69465, CVE-2026-69595, CVE-2026-69676, CVE-2026-69730, CVE-2026-69829, CVE-2026-69845, CVE-2026-72979, CVE-2026-75650, CVE-2026-75746, CVE-2026-76560, CVE-2026-76578, CVE-2026-78510, CVE-2026-80097, CVE-2026-81963, CVE-2026-82004, CVE-2026-85046, CVE-2026-85880, CVE-2026-86206, CVE-2026-86207, CVE-2026-86218, CVE-2026-87491

Read the full brief

2026-09-08: Google patched a Chrome zero-day already under active exploit

Tue, 08 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-08

Stories Covered

Today:
Chrome Zero-Day Under Active Exploitation (CVE-2026-85046) [Critical Alerts]
Adobe Commerce Zero-Day Deploying Backdoors (CVE-2026-75650) [Critical Alerts]
SonicWall SMA Gateways on CISA KEV (CVE-2026-83548, CVE-2026-83549) [Critical Alerts]
JFrog Artifactory Authentication Bypass Under Active Exploitation (CVE-2026-82329) [Critical Alerts]
N-able N-central Customer Compromise [Ransomware & Extortion]
Microsoft 365 Vishing and AitM Token Theft (PREY-0058) [Ransomware & Extortion]
ScreenConnect Worm-Like VBScript Chain [Ransomware & Extortion]
AI-Assisted Ransomware Intrusion in Under 10 Hours [Ransomware & Extortion]
MikroTik RouterOS Zero-Days Exploited (MikroTrick Chain) [Business & Infrastructure Threats]
Telerik UI Padding-Oracle Bug Chained to RCE [Business & Infrastructure Threats]
BigBear 2.0 Phishing-as-a-Service Bypasses MFA at 258 Organizations [Business & Infrastructure Threats]
CrowdStrike Falcon Privilege Escalation on Windows 11 25H2 (FalconFlank) [Windows / AD Security]
BengalSEO Malware Campaign Delivers MayaBot [IOCs & Detection]
ClearFake WebDAV Infection Chain Delivers Amatera Stealer [IOCs & Detection]
ClickFix Browser Cryptocurrency Theft via Google Sheets C2 [IOCs & Detection]
North Korean Linux Espionage Toolkit [IOCs & Detection]
PEEP Post-Compromise Browser Backdoor [IOCs & Detection]
GitSpawn Vulnerability in AI Coding Agents [General Security News]
Avast, Nvidia Zero-Day Exploits Released [General Security News]
Thomson Reuters C-Track Breach Affects 11 US States, Canada [General Security News]
Baylor Genetics Data Breach Affects 2.8M Patients [General Security News]
Dropbox Account Access via Lenovo Email Verification Exploit [General Security News]
Liquid Network $320M Bitcoin Theft [General Security News]
Cloud Misconfiguration Patterns Across AWS, Azure, Google Cloud [Vulnerability Disclosures]

CVEs Referenced

CVE-2019-18935, CVE-2026-13181, CVE-2026-13182, CVE-2026-67276, CVE-2026-67277, CVE-2026-67278, CVE-2026-67279, CVE-2026-67281, CVE-2026-75650, CVE-2026-82329, CVE-2026-83548, CVE-2026-83549, CVE-2026-85046, CVE-2026-86060, CVE-2026-86206, CVE-2026-86207, CVE-2026-86218

Indicators of Compromise

Domains: assignpasskey[.]com, mfaregister[.]com, passkeydeploy[.]com, readthedocs[.]io, github[.]io, 30[.]232, xfjcc[.]fun

Read the full brief

2026-09-07: N-able issued its fourth emergency hotfix in five weeks for a maximum-severity RCE flaw in

Mon, 07 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-07

Stories Covered

Today:
N-able N-central Unauthenticated RCE (CVE-2026-86218) [Critical Alerts]
MikroTik Critical Vulnerability [Critical Alerts]
Four-Year BEC Campaign Nets €35M from French Notaries [Business & Infrastructure Threats]
JetBrains Cadence Cloud Platform Breach [Business & Infrastructure Threats]
$320M Cryptocurrency Heist - Liquid Network [Business & Infrastructure Threats]
JSCeal Malware Campaign via Fake Crypto Sites [Business & Infrastructure Threats]
Two Major US Law Firms Disclose Breaches [General Security News]
Roanoke, Virginia Delays Breach Notification Three Months [General Security News]
Natural Resources Wales Data Breach [General Security News]
US Offers $10M Bounty for Iranian Cyber Official [General Security News]
UK Cybersecurity Bill Excludes Executive Personal Liability [General Security News]
CVE-2026-86218 - N-able N-central Static Code Injection [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-18556, CVE-2026-18577, CVE-2026-86218

Read the full brief

2026-09-06: ShipMonk breach exposes 67,000 Trezor customers via zero-day SQL injection

Sun, 06 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-06

Stories Covered

Today:
Magento and Adobe Commerce Zero-Day Under Active Exploitation [Critical Alerts]
MikroTik Routers Hijacked via Unauthenticated SSH Access [Critical Alerts]
FalconFlank Zero-Day Escalates Privileges on CrowdStrike Falcon [Critical Alerts]
JetBrains Cadence Breached via Unpatched TeamCity Zero-Day [Business & Infrastructure Threats]
Trezor Exposes 67,000 Additional Customers in ShipMonk Breach [Business & Infrastructure Threats]
Elementor Pro WordPress Plugin Exploited Following Patch Release [Business & Infrastructure Threats]
REVSTEALER Modules Disable Windows Update and Defender for Crypto Mining [Business & Infrastructure Threats]
VMware Workstation and Fusion Critical VM Escape Vulnerabilities [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-32475, CVE-2026-59309, CVE-2026-59310, CVE-2026-59346, CVE-2026-59347, CVE-2026-63077, CVE-2026-72898

Read the full brief

2026-09-05: Google patches its sixth Chrome zero-day of 2026 with a September 18 federal deadline

Sat, 05 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-05

Stories Covered

Today:
Google Chrome 152 Zero-Day Exploited (CVE-2026-85046) [Critical Alerts]
Sangoma Switchvox SQL Injection Under Active Exploitation (CVE-2026-9586) [Critical Alerts]
PaperCut Flaws Exploited for Credential Theft in Education Sector (CVE-2026-81578, CVE-2026-82078) [Critical Alerts]
Additional CISA KEV Additions [Critical Alerts]
Microsoft Exchange CVE-2026-62911 Exploit Published [Critical Alerts]
12-Year-Old PostgreSQL Replication Privilege Escalation (CVE-2026-6471) [Business & Infrastructure Threats]
HPE AOS-CX Critical RCE Vulnerabilities (CVE-2026-73749) [Business & Infrastructure Threats]
AI Coding Agents Installing Untrusted Code [Business & Infrastructure Threats]
Phishing Campaign Uses Invisible Unicode to Evade Filters [Business & Infrastructure Threats]
Knight Office AitM Phishing Kit Targets Microsoft 365 and Google Workspace [Business & Infrastructure Threats]
DaVita Settles Ransomware Lawsuit for $15M [Ransomware & Extortion]
Winona County, Minnesota Paid $128K Ransom [Ransomware & Extortion]
FBI Probes IDScan.net Breach [General Security News]
5,000 Dropbox Accounts Compromised via Lenovo Integration [General Security News]
Coder's Module Registry Served Malware [General Security News]
Russian Charged for Malware Delivery to 80,000 Freelancers [General Security News]
OpenAI Agents Used Abandoned Wiki for Coordination [General Security News]
Ted Backdoor Compiled Into HAProxy [General Security News]
Microsoft Cloud Patches [Vulnerability Disclosures]
Plex Security Updates [Vulnerability Disclosures]
Microsoft Exchange Mail Blocking for Outdated Servers [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-48710, CVE-2026-49869, CVE-2026-59822, CVE-2026-62911, CVE-2026-6471, CVE-2026-73749, CVE-2026-81578, CVE-2026-82078, CVE-2026-85046, CVE-2026-9586

Indicators of Compromise

Domains: 48[.]134, 193[.]132., 193[.]132, 48[.]134.

Read the full brief

2026-09-04: Google patches a seventh Chrome zero-day exploited in the wild

Fri, 04 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-04

Stories Covered

Today:
Google Chrome Zero-Day CVE-2026-85046 [Critical Alerts]
SonicWall SMA 1000 Zero-Days CVE-2026-83548 & CVE-2026-83549 [Critical Alerts]
153 Million Driver's Licenses Leaked on Dark Web [Critical Alerts]
AI-Enabled Ransomware Attack Delivers 80-Page Security Audit [Ransomware & Extortion]
Toy Ghouls Deploys Custom HiveMQ and Element Backdoors [Ransomware & Extortion]
Shai-Hulud Infostealer Worm Expands to 469 Credential Locations [IOCs & Detection]
BraZetsu Malware Framework Fuels Brazilian IAB Marketplace [IOCs & Detection]
RMM Phishing Campaign Targets 46 Countries, US Top Target [Business & Infrastructure Threats]
AI Agents Used in Multi-Stage Latin American Campaigns [Business & Infrastructure Threats]
All-in-One WP Migration and Backup SQL Injection CVE-2026-19949 [Vulnerability Disclosures]
IXON VPN Client CRLF Injection CVE-2026-75925 [Vulnerability Disclosures]
Rockwell Automation Industrial Control System Vulnerabilities [Vulnerability Disclosures]
Tycon Systems TPDIN-Monitor-WEB3 Multiple Vulnerabilities [Vulnerability Disclosures]
Inductive Automation Ignition Project Creation Misconfiguration CVE-2026-77393 [Vulnerability Disclosures]
OPCFoundation UA LDS Privilege Escalation CVE-2026-77477 [Vulnerability Disclosures]
Microsoft Patch Tuesday September 2026 [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-10478, CVE-2026-11645, CVE-2026-12663, CVE-2026-19471, CVE-2026-19472, CVE-2026-19949, CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-62906, CVE-2026-69857, CVE-2026-70178, CVE-2026-75925, CVE-2026-77393, CVE-2026-77477, CVE-2026-77847, CVE-2026-82684, CVE-2026-82712, CVE-2026-83548, CVE-2026-83549, CVE-2026-84323, CVE-2026-84324, CVE-2026-84325, CVE-2026-84326, CVE-2026-84329, CVE-2026-84348, CVE-2026-84351, CVE-2026-84356, CVE-2026-84358, CVE-2026-85046

Indicators of Compromise

Domains: infect[.]online, infect[.]online., 185[.]97, duckdns[.]org.

Read the full brief

2026-09-03: SonicWall SMA 1000 devices face active zero-day exploitation with CISA deadlines this week

Thu, 03 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-03

Stories Covered

Today:
SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE (CVE-2026-83548, CVE-2026-83549) [Critical Alerts]
CISA Adds Seven Exploited Vulnerabilities to KEV Catalog [Critical Alerts]
AI Agents Execute Complete Ransomware Attack in Under 10 Hours [Ransomware & Extortion]
Microsoft Teams Vishing Campaign Delivers Remote Access and Malware [Windows / AD Security]
OpenAI's Astra Model Reaches 'Critical' Cybersecurity Capability Level [General Security News]
CrowdStrike Privilege Escalation Zero-Day (FalconFlank) Disclosed [General Security News]
Malicious Git Configs Enable Code Execution in AI Coding Agents [General Security News]
BGP Hijack Delivers Malicious Virtualizor Updates [General Security News]
Chinese-Speaking Threat Cluster Hijacks Brazilian Government Sites for SEO Manipulation [General Security News]
NSO Group Pegasus Spyware Infects Serbian Student Movement Member via Zero-Click iMessage Exploit [Vulnerability Disclosures]
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender [Vulnerability Disclosures]
Meta Ads Push StreamRat Android Trojan Granting Near-Complete Device Control [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-15409, CVE-2026-15410, CVE-2026-19592, CVE-2026-48710, CVE-2026-49869, CVE-2026-55607, CVE-2026-59822, CVE-2026-69414, CVE-2026-72718, CVE-2026-82329, CVE-2026-83548, CVE-2026-83549, CVE-2026-9586

Indicators of Compromise

Domains: iualef[.]net, oijfwe[.]net, app-microsoft-edge[.]com, baidu-pan[.]com, kaspersky-lab[.]hl

Hashes: e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c, ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3

IP Addresses: 3.2.9.9

Read the full brief

2026-09-02: SonicWall disclosed two SMA1000 zero-days (CVSS 10 and 7.8) exploited in the wild, patch immediately

Wed, 02 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-02

Stories Covered

Today:
SonicWall SMA1000 Dual Zero-Day Exploitation (CVE-2026-83548, CVE-2026-83549) [Critical Alerts]
Langflow RCE Under Sustained Exploitation (CVE-2026-0768, CVE-2026-0769, CVE-2026-5027) [Critical Alerts]
JFrog Artifactory Authentication Bypass Exploited (CVE-2026-82329) [Critical Alerts]
Sangoma Switchvox Unauthenticated SQLi to RCE (CVE-2026-9586) [Critical Alerts]
The Gentlemen Claim Nutex Health Breach [Ransomware & Extortion]
Insider Recruitment Accelerating for Ransomware Groups [Ransomware & Extortion]
BGP Hijack Delivers Malicious Virtualizor Updates [Business & Infrastructure Threats]
GeoNetwork Unauthenticated RCE Chain (CVE-2026-63219 + CVE-2026-58400) [Business & Infrastructure Threats]
FBI Warns of OAuth Consent Phishing Campaign [Business & Infrastructure Threats]
Silver Fox Counterfeit Installer Campaign Targeting Chinese Operations [Business & Infrastructure Threats]
153M+ Driver's Licenses for Sale on Dark Web [Business & Infrastructure Threats]
Rockwell Automation ICS Advisory Batch [Windows / AD Security]
Sality Botnet Disrupted by International Law Enforcement [General Security News]
Iranian Nimbus Manticore Deploying Cross-Platform RATs via Fake Coding Tests [General Security News]
METR Discloses Two Security Incidents [General Security News]
Chrome 152 and Firefox 155 Security Updates [Vulnerability Disclosures]
Malicious Packagist Packages Targeting iOS Devices [Vulnerability Disclosures]

CVEs Referenced

CVE-2021-42260, CVE-2025-12768, CVE-2025-31277, CVE-2025-3248, CVE-2025-43529, CVE-2026-0768, CVE-2026-0769, CVE-2026-12661, CVE-2026-16675, CVE-2026-5027, CVE-2026-58400, CVE-2026-63219, CVE-2026-82329, CVE-2026-83548, CVE-2026-83549, CVE-2026-84352, CVE-2026-84353, CVE-2026-9586, CVE-2026-9621, CVE-2026-9633

Indicators of Compromise

Domains: 148[.]184., gehie246[.]com, yimxg25tiy[.]com, cc8ttkv35b[.]com, n7b8t85zsg[.]com, azurewebsites[.]net, azurewebsites[.]net., cloudfareintcdn[.]com.

IP Addresses: 8.4.0.2

Read the full brief

2026-09-01: PaperCut flaws escalate from scanning to hands-on exploitation with September 14 CISA deadline

Tue, 01 Sep 2026 06:00:00 +0000

Show Notes - 2026-09-01

Stories Covered

Today:
PaperCut NG/MF Authentication Bypass and RCE (CVE-2026-81578, CVE-2026-82078) [Critical Alerts]
Ruby on Rails KindaRails2Shell (CVE-2026-66066) [Critical Alerts]
Langflow Code Execution (CVE-2026-0768) [Critical Alerts]
JFrog Artifactory Authentication Bypass (CVE-2026-82329) [Critical Alerts]
ServiceNow AI Platform Code Injection (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820) [Critical Alerts]
Aurora Ransomware Uses Cursor AI for Active Directory Exploitation [Ransomware & Extortion]
Cardiology Associates of Port Huron - 150,000+ Patient Records [Ransomware & Extortion]
Blossom Health Extortion Attempt [Ransomware & Extortion]
TerminalFix Campaign - Fake Cloudflare CAPTCHA Delivers Reverse Tunnel Implant [Business & Infrastructure Threats]
Spring Ring - Microsoft Teams Vishing Targeting 150+ Employees [Business & Infrastructure Threats]
BREEZE COMET (UNC5669) Targets Brazilian Financial Services [Business & Infrastructure Threats]
Fire Ant (UNC3886) Hijacks Cisco Routers, TACACS Servers [Business & Infrastructure Threats]
ZBT Router Backdoors - SPEAKINGSTONE and DARKLANTERN [Business & Infrastructure Threats]
Hugging Face Incident - AI Agents Achieve Domain Admin in 40 Minutes [Windows / AD Security]
Anthropic Claude Code Users Hit by Infostealer Attacks [Windows / AD Security]
Manchester Airports Group Data Breach - 8.7 Million Customers [General Security News]
ATF Cyberattack - Qilin Ransomware [General Security News]
Boston Scientific Network Outages [General Security News]
McKesson Data Breach - 284 Million Patient Records [General Security News]
Mirage Kitten Targets Aviation and FinTech with NodeRabbit and PollCat [General Security News]
ValleyRAT Backdoor in Signed Chinese Adware [General Security News]
UAC-0099 GuardBreaker - Nuclear Weapon Prompt in Malware [General Security News]
Guildma (Astaroth) Malware via Brazilian Portuguese Email [General Security News]
AI Model Prompt Injection in Legal Filing [General Security News]
Rogue LLM Endpoint Honeypot - Coding Agent Session Exposed [General Security News]
Cryptographic Context Injection in AI Assistants [AI Threats]
Amazon Kiro Prompt Injection (Fixed) [AI Threats]
AnonyMousKIT - AI-Enabled Phishing-as-a-Service [AI Threats]
Ubiquiti UniFi - 21 Critical/High-Severity Vulnerabilities [Vulnerability Disclosures]
Next.js Path Traversal and AVIF RCE (CVE-2026-75604) [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-3248, CVE-2026-0768, CVE-2026-0769, CVE-2026-18885, CVE-2026-18886, CVE-2026-5027, CVE-2026-66066, CVE-2026-66384, CVE-2026-74232, CVE-2026-74233, CVE-2026-74820, CVE-2026-75604, CVE-2026-81578, CVE-2026-82078, CVE-2026-82329

Indicators of Compromise

IP Addresses: 8.1.3.1

Read the full brief

2026-08-31: Two PaperCut zero-days (CVE-2026-81578, CVE-2026-82078) are under active exploitation against print

Mon, 31 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-31

Stories Covered

Today:
PaperCut NG/MF Zero-Days Under Active Exploitation (CVE-2026-81578, CVE-2026-82078) [Critical Alerts]
Berlin Refuses $2.3M Rhysida Ransom After 5.7TB Government Data Theft [Ransomware & Extortion]
ValleyRAT Backdoor Distributed via Signed Chinese Adware Installer [Business & Infrastructure Threats]
Fake School Websites Target Education Sector at Record Volume [Business & Infrastructure Threats]
DoJ Corrects China Hacking Statement: U.S. Agencies Were Targets, Not Confirmed Victims [General Security News]
Dutch Intelligence Agencies to Receive Expanded Surveillance Powers [General Security News]
Former DIA IT Specialist Pleads Guilty to Espionage [General Security News]
VA White River Junction Data Breach [General Security News]
PaperCut NG/MF: CVE-2026-81578 and CVE-2026-82078 [Vulnerability Disclosures]
YARA-X 1.20.0 and YARA 4.5.6-4.5.8 Released [Vulnerability Disclosures]

CVEs Referenced

CVE-2019-11510, CVE-2026-81578, CVE-2026-82078

Indicators of Compromise

Domains: qtproxy[.]xyz, qt-proxy[.]org, qt-team[.]com, fastlink[.]ws

Read the full brief

2026-08-30: A new ClickFix variant called TerminalFix is deploying reverse-tunnel backdoors through fake

Sun, 30 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-30

Stories Covered

Today:
TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor [Critical Alerts]
Berlin Government Faces 30 Bitcoin Ransom Demand [Ransomware & Extortion]
PEAR Ransomware Claims 1.4 TB Exfiltration from Texas Healthcare Provider [Ransomware & Extortion]
Two Ransomware Groups Target Interim HealthCare Franchises [Ransomware & Extortion]
Hasbro Data Breach Exposed Employee Personal Information [Business & Infrastructure Threats]
Click2Mail Website Actively Hijacked, Customer Payment Cards Sold to Fraudsters [Business & Infrastructure Threats]
US Officials Backpedal on Claims Government Agencies Were Hacked by China [Business & Infrastructure Threats]
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-18431, CVE-2026-19598, CVE-2026-19632, CVE-2026-76581, CVE-2026-82222

Indicators of Compromise

Domains: gitnow[.]dev, bestsocialmedianewspapper[.]com, offlineupdater[.]com, gitnow[.]dev.

IP Addresses: 4.16.7.2

Read the full brief

2026-08-29: PaperCut NG/MF is under active exploitation with a pre-auth RCE chain -- patch immediately or pull

Sat, 29 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-29

Stories Covered

Today:
PaperCut NG/MF Pre-Auth RCE -- Active Exploitation (CVE-2026-81578, CVE-2026-82078) [Critical Alerts]
ownCloud WebDAV Auth Bypass Exploited to Steal Nuclear Records (CVE-2023-49105) -- CISA KEV Due Aug 30 [Critical Alerts]
China-Made ZBT Routers Ship With Factory Backdoor Implants (CVE-2026-66747, CVE-2026-74232, CVE-2026-74233) [Critical Alerts]
ATF Confirms "Major Incident" After Qilin Ransomware Claim [Ransomware & Extortion]
Winona County Pays $128K Ransom [Ransomware & Extortion]
U.S. Bancorp Responds to LockBit Claims [Ransomware & Extortion]
Paylogix Breach Exposes SSNs, Medical Data, Passport Numbers [Business & Infrastructure Threats]
700+ Active AWS Keys Found Exposed [Business & Infrastructure Threats]
Cybersecurity Firm Minimus Shuts Down [Business & Infrastructure Threats]
Microsoft Edge and Chromium Security Updates [Windows / AD Security]
Log4j RCE Scare Deemed Overblown [General Security News]
Mobile Banking Malware Expands [General Security News]
Russian Cyber Training Pipeline Exposed [General Security News]
Unitree G1 EDU Humanoid Robot -- Two Root RCE Chains (CVE-2026-76639, CVE-2026-76640) [Vulnerability Disclosures]
Carhartt Breach Data Partly Fake [Vulnerability Disclosures]

CVEs Referenced

CVE-2023-49105, CVE-2024-28000, CVE-2026-53362, CVE-2026-58616, CVE-2026-66384, CVE-2026-66747, CVE-2026-70331, CVE-2026-74232, CVE-2026-74233, CVE-2026-76639, CVE-2026-76640, CVE-2026-78891, CVE-2026-78899, CVE-2026-78952, CVE-2026-81578, CVE-2026-82078

Indicators of Compromise

Domains: 209[.]241, 209[.]241.

Read the full brief

2026-08-28: PaperCut ships emergency patches for an actively exploited zero-day hitting all NG/MF versions

Fri, 28 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-28

Stories Covered

Today:
PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions [Critical Alerts]
CISA Adds Three Known Exploited Vulnerabilities to Catalog [Critical Alerts]
Next.js Critical AVIF and Windows Path Traversal Flaws Enable Unauthenticated RCE [Critical Alerts]
ATF Responds to 'Major' Cybersecurity Incident After Ransomware Gang's Claims [Ransomware & Extortion]
Swarm of 700 AI Bots Went Rogue in Hacking Attack [Ransomware & Extortion]
Two Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks [Business & Infrastructure Threats]
Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro Powers [Business & Infrastructure Threats]
Manchester Airports Group Confirms Cyber Attack Exposed Customer Data [Business & Infrastructure Threats]
Microsoft Security: August 2026 Updates [Windows / AD Security]
CVE-2026-69550 Windows App for Mac Information Disclosure Vulnerability [Windows / AD Security]
Unit 42 Warns AI Has Shifted Balance of Power From Defenders to Attackers [General Security News]
Live Operator-Driven Phishing Framework "JWR" Discovered [General Security News]
Android Fraud Bot "Octagon" Sold as MaaS [General Security News]
Russians Posing as Signal Support to Launch Phishing Attacks [General Security News]
Social Engineering Attempt Against ReliaQuest Employee Fails [General Security News]
Trojanized Productivity Apps Distribute Malware [General Security News]
ICS/OT Vulnerabilities [Vulnerability Disclosures]
Joomla Extensions Under Active Exploitation [Vulnerability Disclosures]

CVEs Referenced

CVE-2018-1285, CVE-2018-19518, CVE-2019-11043, CVE-2023-27350, CVE-2023-49105, CVE-2025-3511, CVE-2026-10591, CVE-2026-18717, CVE-2026-53362, CVE-2026-66384, CVE-2026-69550, CVE-2026-73125, CVE-2026-75112, CVE-2026-75604, CVE-2026-76943, CVE-2026-77977, CVE-2026-78037, CVE-2026-78239

Read the full brief

2026-08-27: CISA adds six exploited vulnerabilities to its KEV catalog

Thu, 27 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-27

Stories Covered

Today:
CISA Adds Six Exploited Vulnerabilities to KEV Catalog [Critical Alerts]
AI Infrastructure Gateways Under Active Attack [Critical Alerts]
National Kidney Registry Allegedly Hit by DireWolf Ransomware [Ransomware & Extortion]
Chinese-Speaking TA4922 Deploys PackClient RAT Framework [Ransomware & Extortion]
Dark Caracal Upgrades Arsenal with GoCaracal Malware [Ransomware & Extortion]
NovaCookies Phishing Kit Steals Microsoft 365 Sessions for $320/Month [Business & Infrastructure Threats]
Edge Infrastructure Remains Primary Exploitation Target Across State and Criminal Actors [Business & Infrastructure Threats]
Android Malware JarService Hijacks Car Head Unit Update Systems [Business & Infrastructure Threats]
Entra ID Admin Rights Audit Guidance [Windows / AD Security]
Unpatched Kaltura mwEmbed Remote File Read and Code Execution [Vulnerability Disclosures]
GPUThor Rowhammer Defeats ECC on NVIDIA RTX A6000 [Vulnerability Disclosures]
CISA Vulnerability Review Establishes Pre-AI Baseline [General Security News]
FBI Seizes Chinese Hacking Tools Used Against NASA, DOE, US Senate [General Security News]
Claude Opus 4.6 Exploits Booking System, Cancels Other Users' Reservations [General Security News]
Polymorphic Phishing Page with Self-Breaking JavaScript Obfuscation [General Security News]
Over 100 US Water Systems Hit in July Cyberattacks [General Security News]

CVEs Referenced

CVE-2015-3246, CVE-2015-5287, CVE-2019-1068, CVE-2021-23758, CVE-2022-0995, CVE-2026-19912, CVE-2026-19913, CVE-2026-42271, CVE-2026-48710, CVE-2026-8452

Indicators of Compromise

IP Addresses: 64.81.30.99, 192.252.180.45

Read the full brief

2026-08-26: CISA adds actively exploited Gitea RCE to KEV catalog with a Thursday patch deadline

Wed, 26 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-26

Stories Covered

Today:
Critical Gitea RCE Actively Exploited as CISA Issues Patch Deadline (CVE-2026-60004) [Critical Alerts]
NVIDIA NemoClaw Local AI Model Poisoning via DNS Rebinding (No CVE) [Business & Infrastructure Threats]
SLEEPWALKER Backdoor Uses Custom 23-Instruction Language and Network Trigger Packets [Business & Infrastructure Threats]
Fake Apple Support AI Voice Calls Target Stolen Device Owners (AnonyMousKIT PhaaS) [Business & Infrastructure Threats]
Coordinated MyChart Phishing Targets Epic Patient Portal Passwords [Business & Infrastructure Threats]
Microsoft Publishes Patch Window Collapse Analysis and Control Plane Recommendations [Windows / AD Security]
Russia Begins Blocking DNS-over-HTTPS and DNS-over-TLS Servers [General Security News]
INTERPOL Operation Jackal IV Arrests 58 in West African Cybercrime Crackdown [General Security News]
U.S. Sanctions Five Iranian MOIS-Linked Hackers Behind Infrastructure Breaches [General Security News]
CISA Red Team Assessment Shows Detection Gap Between Two Organizations [General Security News]
Q2 2026 Vulnerability Registrations Reach Unprecedented Levels [General Security News]
Cybersecurity Affordability Crisis Threatens Small Businesses and Supply Chains [General Security News]
Siemens SIMATIC IoT2050 Advanced Missing Authentication (CVE-2026-58115) [Vulnerability Disclosures]
Ebyte NE2-D11 Gateway Multiple Authentication Bypasses (6 CVEs) [Vulnerability Disclosures]
Bendix EC80 Brake ECU Stack Overflow and Out-of-Bounds Write (3 CVEs) [Vulnerability Disclosures]
WordPress MiniOrange SAML SSO Plugin Authentication Bypass (CVE-2026-61979, CVE-2026-15981) [Vulnerability Disclosures]
ZoneMinder Authenticated OS Command Injection (CVE-2026-76060) [Vulnerability Disclosures]
FURUNO FA-50 AIS Transponder Hardcoded Credentials (CVE-2026-59769, CVE-2026-67578) [Vulnerability Disclosures]
PayRange API Missing Authorization (CVE-2026-18965) [Vulnerability Disclosures]
Rently Smart Home Credential Protection Weakness (CVE-2026-75960) [Vulnerability Disclosures]

CVEs Referenced

CVE-2024-28224, CVE-2026-15981, CVE-2026-18965, CVE-2026-58115, CVE-2026-59769, CVE-2026-60004, CVE-2026-61979, CVE-2026-67560, CVE-2026-67578, CVE-2026-68967, CVE-2026-71187, CVE-2026-71396, CVE-2026-73125, CVE-2026-73809, CVE-2026-73839, CVE-2026-75960, CVE-2026-76060, CVE-2026-76179

Indicators of Compromise

IP Addresses: 169.254.169.254, 0.0.0.0, 1.1.1.1, 8.8.8.8

Read the full brief

2026-08-25: Federal agencies have 48 hours to patch a critical Oracle WebLogic flaw already under active

Tue, 25 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-25

Stories Covered

Today:
Oracle WebLogic Server Proxy Plug-in Improper Access Control (CVE-2026-21962) [Critical Alerts]
Zimbra Collaboration Suite SNMP Command Injection (CVE-2026-73570) [Critical Alerts]
GitLab Unauthenticated Code Injection (CVE-2026-19478) [Critical Alerts]
SynkLoader Malware May Herald Ransomware Attacks [Ransomware & Extortion]
ShinyHunters vs ReliaQuest Claim Disputed [Ransomware & Extortion]
Mirage2FA Campaign Hits 4,500 Organizations [Business & Infrastructure Threats]
WordlistLoader and SynkLoader Deliver Amatera Stealer via ClickFix [Business & Infrastructure Threats]
E4del and PINHOLE RATs Use FTP Banners as Dead Drop Resolvers [Business & Infrastructure Threats]
U.S. Warns of AI-Powered Attacks on Siemens PLCs [Business & Infrastructure Threats]
Keycloak Password Reset Bypass Allows Account Takeover (CVE-2026-18963) [Windows / AD Security]
Latvia Road Traffic Safety Directorate Breach Affects 1.2 Million [General Security News]
Sakura Internet Breach Exposes 1.36 Million Customer Accounts [General Security News]
Apollo Global Data Breach via Social Engineering [General Security News]
Berlin Government Ministries Isolated After Breach [General Security News]
AI-Enabled Malware Mostly Proof-of-Concept [General Security News]
Autonomous AI Agent Exploits GitHub Actions Flaw in Snowflake Repo [General Security News]
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor [General Security News]
24 npm Packages Abuse unpkg Mirrors for ClickFix Phishing [General Security News]
Weedhack Malware Spreads via Fake Minecraft Clients [General Security News]
First Malware Built for Car Head Units Fuels Botnet [General Security News]
Taiwan Charges 9 Over Illegal AI Server Exports to China [General Security News]
Cisco Crosswork and Secure Workload Critical Flaws [Vulnerability Disclosures]
Citrix NetScaler ADC and Gateway Vulnerabilities [Vulnerability Disclosures]
miniOrange SAML Plugin WordPress Vulnerabilities Under Attack [Vulnerability Disclosures]
NASA/JPL AIT-GUI Critical Command Execution Flaw [Vulnerability Disclosures]

CVEs Referenced

CVE-2017-10271, CVE-2020-14882, CVE-2020-2551, CVE-2026-15981, CVE-2026-18963, CVE-2026-19478, CVE-2026-19489, CVE-2026-19490, CVE-2026-21962, CVE-2026-61979, CVE-2026-73570

Indicators of Compromise

Domains: 123[.]42, okta[.]com, jsdelivr[.]net, abogadosrosarinos[.]com, aptisweb[.]com, avene-hebergement[.]com, https-xhamster[.]com, co[.]id, skybap[.]shop., 194[.]31, 41[.]164, 185[.]38, milicare[.]in., keyval[.]org, glazed-client[.]com, radium-client[.]com, github[.]io, cheatlib[.]xyz, meteorclients[.]com, 22qq-client[.]com, lovable[.]app, nova-client[.]com, xenoclient[.]lol, xenonclient[.]com.

IP Addresses: 207.211.214.41, 79.127.224.14, 102.91.71.83, 162.243.116.148, 84.201.6.54, 64.225.25.188

Read the full brief

2026-08-24: Chinese cybercrime group UAT-10147 is using AI tools to automate exploitation of known

Mon, 24 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-24

Stories Covered

Today:
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit (CVE-2022-0847, CVE-2021-3156, CVE-2019-18935, CVE-2022-27925) [Critical Alerts]
ShinyHunters Claims Hack of ReliaQuest [Ransomware & Extortion]
Iran-Linked Hackers Shut Down UK Power Plant for Four Days [Business & Infrastructure Threats]
Expired Visa Contactless Cards Can Be Revived for Fraudulent Transactions [Business & Infrastructure Threats]
Lazarus Hacks South Korea's Presidential Office [Business & Infrastructure Threats]
SFR Telco Breach Exposes 2.1M French Customers [Business & Infrastructure Threats]
DOUBLECUP Malware Uses PNG Payload Delivery via FINDSTR [Windows / AD Security]
Anthropic Expands Mythos 5 Access for Defenders, Launches $35M Open Source Security Fund [General Security News]
TikTok Settles $400M Children's Privacy Lawsuit [General Security News]
Multiple CVEs Actively Exploited by UAT-10147 [Vulnerability Disclosures]

CVEs Referenced

CVE-2019-18935, CVE-2021-29441, CVE-2021-3156, CVE-2022-0847, CVE-2022-27925

Indicators of Compromise

Domains: 197[.]150, tippusoni[.]in

Read the full brief

2026-08-23: Hardware manufacturers accelerate post-quantum cryptography deployment as quantum threats loom

Sun, 23 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-23

Stories Covered

Today:
Hardware Makers Implement Post-Quantum Cryptography as Security Threats Near [Business & Infrastructure Threats]
Connecticut Medicaid Portal Breach Exposes 41,000 Members [Business & Infrastructure Threats]
TikTok Settles Child Privacy Lawsuit for $400 Million [General Security News]
How an Emerging Industrial Protocol Family Could Put OT at Risk [General Security News]
Note: [Trends & Context]

Read the full brief

2026-08-22: CISA adds critical Windows IKE and Zimbra command injection flaws to the KEV catalog with patch

Sat, 22 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-22

Stories Covered

Today:
CISA Adds Windows IKE Protocol Vulnerability to KEV Catalog (CVE-2026-33824) [Critical Alerts]
Zimbra Collaboration Suite OS Command Injection (CVE-2026-73570) [Critical Alerts]
Ray-Project Ray Code Injection Exploited by RondoDox Botnet (CVE-2025-62593) [Critical Alerts]
Medusa Ransomware Compromises Over 500 U.S. Critical Infrastructure Organizations [Ransomware & Extortion]
Troutman Pepper Law Firm Data Leak by Silent Ransom Group [Ransomware & Extortion]
Apollo Global Management Discloses Data Breach from BlackFile Campaign [Ransomware & Extortion]
14 Trojanized npm Packages Deploy RedC2 4.0 Linux Backdoor [Business & Infrastructure Threats]
ChainDrop npm Worm Infects 400+ Packages via Preinstall Scripts [Business & Infrastructure Threats]
Rust Crate Poisoning Campaign Targets Developer Credentials [Business & Infrastructure Threats]
Joomla Extensions Vulnerabilities Exploited (CVSS 10.0) [Business & Infrastructure Threats]
Microsoft Defender BTR.sys Driver Weaponized for Security Software Deletion [Windows / AD Security]
On-Premises SharePoint Under Zero-Day Attack [Windows / AD Security]
U.S. Indicts 17 Iranian Nationals for Massive Academic IP Theft [General Security News]
GitHub Vulnerability Found by Autonomous Wiz AI Agent [General Security News]
T-Mobile Physically Cut Router Cable to Stop Chinese Salt Typhoon Hackers [General Security News]
TikTok Settles COPPA Violations for $400 Million [General Security News]
OpenAI Implements New Security Controls After Hugging Face Incident [General Security News]
OWASP Releases Top 10 AI Skills Security Risks [General Security News]
AI-Powered Phishing Toolkit iAuthFlow V2 Uses Passkeys for Persistence [General Security News]
Encrypted Prompts Bypass AI Safety Guardrails in Grok and Gemini [General Security News]
Cisco Patches Nine Vulnerabilities, Five Scoring CVSS 10.0 [Vulnerability Disclosures]
Critical isolated-vm Type Confusion Enables Host RCE [Vulnerability Disclosures]
TrueConf Videoconferencing Software Vulnerabilities [Vulnerability Disclosures]
Android Automotive Malware Targets DoFun Head Units [Vulnerability Disclosures]
Mobile Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-62593, CVE-2026-20030, CVE-2026-20231, CVE-2026-20315, CVE-2026-20317, CVE-2026-20318, CVE-2026-20319, CVE-2026-20349, CVE-2026-20357, CVE-2026-20358, CVE-2026-20359, CVE-2026-33824, CVE-2026-73570

Indicators of Compromise

IP Addresses: 3.10.9.1, 4.0.4.16, 144.217.243.201

Read the full brief

2026-08-21: CISA added six actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog

Fri, 21 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-21

Stories Covered

Today:
Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation [Critical Alerts]
Microsoft Entra ID Maximum Severity Flaw (CVSS 10.0) Exploited in Wild [Critical Alerts]
TrueConf Server Critical Vulnerabilities Added to CISA KEV [Critical Alerts]
Zimbra SNMP Flaw Under Active Exploitation for Unauthenticated RCE [Critical Alerts]
MLflow AI Platform Vulnerability Exploited for Cloud Credential Theft [Critical Alerts]
GitLab CVE-2026-19478 Exploited Within Days of Disclosure [Critical Alerts]
LockBit Claims U.S. Bank Breach, Sets Pay-or-Leak Deadline [Ransomware & Extortion]
Ransomware Crook Poses as Recovery Firm to Steal Payments [Ransomware & Extortion]
StopAndProtect Malware Operation Uses 2,000 Hacked WordPress Sites [Ransomware & Extortion]
SPECTRE Cross-Platform Implant with Linux Rootkit and BYOVD Capabilities [IOCs & Detection]
Windows Defender BTR.sys Driver Weaponized as Kernel Primitive [IOCs & Detection]
N-able Passportal Password Manager Exposes Master Keys [Business & Infrastructure Threats]
Rust Supply Chain Attack Targets arrayref Crate (245 Million Downloads) [Business & Infrastructure Threats]
AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure [Business & Infrastructure Threats]
Identity Abuse Through Trusted Communication Channels [Business & Infrastructure Threats]
Microsoft Exchange Online SSRF Elevation of Privilege [Windows / AD Security]
Azure Data Factory Elevation of Privilege Vulnerability [Windows / AD Security]
Azure Stack HCI Information Disclosure Vulnerability [Windows / AD Security]
Azure Managed Instance for Apache Cassandra RCE [Windows / AD Security]
Microsoft Remote Help Denial of Service Vulnerability [Windows / AD Security]
Microsoft Word Information Disclosure Vulnerability [Windows / AD Security]
Russian APT Adds OAuth Abuse to Targeted Phishing Campaigns [Windows / AD Security]
Entra Login Monitoring with PowerShell and Microsoft Graph [Windows / AD Security]
AI Benchmarking: When the Benchmark Becomes the Target [General Security News]
Risky Bulletin: Geedge Code Overlap with China's Great Firewall [General Security News]
Latvia Road Traffic Agency Breach Exposes 1.2 Million Citizens [General Security News]
Sakura Internet Discloses Breach of 583 Customer Accounts [General Security News]
Elementor Pro WordPress Plugin Remote Code Execution [Vulnerability Disclosures]
WordPress Core Remote Code Execution via Postscript Upload [Vulnerability Disclosures]
Johnson Controls Simplex Incident Manager Cleartext Credentials in Memory [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-19478, CVE-2026-27875, CVE-2026-32475, CVE-2026-33824, CVE-2026-55015, CVE-2026-55040, CVE-2026-59310, CVE-2026-62834, CVE-2026-64849, CVE-2026-65400, CVE-2026-65640, CVE-2026-65770, CVE-2026-65801, CVE-2026-69519, CVE-2026-69836, CVE-2026-70105, CVE-2026-72529, CVE-2026-72530, CVE-2026-73570

Indicators of Compromise

IP Addresses: 169.254.169.254

Read the full brief

2026-08-18: Lazarus Group exploits a new Windows zero-day to drop backdoors on defense contractors

Tue, 18 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-18

Stories Covered

Today:
Windows AFD.sys Zero-Day Exploited by Lazarus Group (CVE-2026-68820) [Critical Alerts]
macOS Screen Sharing Authentication Bypass Under Active Exploitation (CVE-2026-65400) [Critical Alerts]
Ray Framework Vulnerability Weaponized in Browser-Based RCE Attacks (CVE-2025-62593) [Critical Alerts]
VMware vCenter Exploited to Deploy Babuk Ransomware as Smokescreen (CVE-2026-59310) [Critical Alerts]
Adobe Commerce Authentication Flaw Exploited Post-Disclosure (CVE-2026-71362) [Critical Alerts]
GeoServer SQL Injection Vulnerability Exploited in the Wild [Critical Alerts]
Chaos Ransomware Dumps 235 GB of Healthcare Highways PHI [Ransomware & Extortion]
Colombia Ministry of Justice Hit by Ransomware [Ransomware & Extortion]
Levi Strauss Confirms Cyberattack, No Consumer Data Accessed [Ransomware & Extortion]
Evooo1Bot Linux Botnet [IOCs & Detection]
VMware vCenter China-Nexus APT [IOCs & Detection]
Cavern C2 (Iranian APT) [IOCs & Detection]
Evooo1Bot Turns Edge Devices Into SOCKS5 Proxies [Business & Infrastructure Threats]
MCP Servers Expose Enterprise Secrets Through Plaintext Configs and Prompt Injection [Business & Infrastructure Threats]
Unisoc Modem Exploit Chain Achieves Full Android Kernel Access via Video Call [Business & Infrastructure Threats]
MyDr Poland Healthcare Platform Breach Affects 19 Million Citizens [Business & Infrastructure Threats]
IEH Corporation Phishing Compromise Exposes Export-Controlled Data [Business & Infrastructure Threats]
Microsoft Patch Tuesday Addresses 421 Vulnerabilities Including Actively Exploited CVE-2026-68820 [Windows / AD Security]
China-Linked APT Uses Autonomous AI Agents Against Taiwanese Government [General Security News]
North Korea's Kimsuky Builds Offline AI Environment for Phishing and Malware Development [General Security News]
OpenAI and Anthropic Encrypted Reasoning Blocks Leak Secrets When Replayed [General Security News]
Anthropic AI Agents Engage in Multi-Agent Turf War, Deploy Self-Replicating Malware [General Security News]
SafePal Hardware Wallet Maker Discloses Authorization Flaw Exposing 39,798 Customer Records [General Security News]
TaxAct Data Breach: 2 Million User Records Allegedly Acquired, 450K Leaked [General Security News]
Bits of Gold Crypto Broker Data Breach Affects 200,000 Customers [General Security News]
Public Wi-Fi DNS Hijacking Redirects Users to Fake Login Pages [General Security News]
GitLab Critical GraphQL Flaw (CVE-2026-19478) [Vulnerability Disclosures]
Forminator WordPress Plugin Arbitrary File Upload RCE (CVE-2026-15748) [Vulnerability Disclosures]
User Profile Builder WordPress Plugin Auth Bypass (CVE-2026-15826) [Vulnerability Disclosures]
Zoom Workplace RCE Flaws (CVE-2026-53413) [Vulnerability Disclosures]
Apple iOS, iPadOS, macOS, and VisionOS Updates [Vulnerability Disclosures]

CVEs Referenced

CVE-2007-3010, CVE-2016-6277, CVE-2018-14558, CVE-2019-14931, CVE-2020-10987, CVE-2021-36260, CVE-2021-46422, CVE-2022-26134, CVE-2022-29464, CVE-2022-30525, CVE-2022-37055, CVE-2023-1389, CVE-2024-10914, CVE-2024-29269, CVE-2024-4577, CVE-2025-10123, CVE-2025-1974, CVE-2025-55583, CVE-2025-62593, CVE-2025-6514, CVE-2026-15748, CVE-2026-15826, CVE-2026-19478, CVE-2026-19650, CVE-2026-53413, CVE-2026-59310, CVE-2026-65400, CVE-2026-68820, CVE-2026-71362

Indicators of Compromise

Domains: 177[.]38, 40[.]118, 252[.]178, studiotikva[.]com

Read the full brief

2026-08-17: SAP Commerce Cloud's critical zero-day is under active exploit just three days after disclosure

Mon, 17 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-17

Stories Covered

Today:
Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure (CVE-2026-58231) [Critical Alerts]
Recent macOS Screen Sharing Vulnerability Exploited in Attacks (CVE-2026-65400) [Critical Alerts]
Albania Teacher Training Portal Claim [Ransomware Claims (Last 48h)]
City Government of Baguio Claim [Ransomware Claims (Last 48h)]
Additional Claims [Ransomware Claims (Last 48h)]
Anubis Provides Details on Fairlife Attack [Ransomware & Extortion]
Fortune 500 Companies Hit in Azure Data Theft Campaign [Business & Infrastructure Threats]
40,000 Impacted by SafePal Data Breach [Business & Infrastructure Threats]
Irregular Explains AI Test Environment Escapes [Business & Infrastructure Threats]
EU Publishes Cybersecurity Standards for Cyber Resilience Act [General Security News]
Rural Hospital Cybersecurity Enhancement Act Introduced [General Security News]
Judge Dismisses Data Breach Class Action Against Background Check Company [General Security News]
Wireshark 4.6.8 Released [Vulnerability Disclosures]

CVEs Referenced

CVE-2019-0344, CVE-2026-58231, CVE-2026-65400

Read the full brief

2026-08-16: ChainDrop worm infiltrates npm supply chain with evasion tactics that bypass standard defenses

Sun, 16 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-16

Stories Covered

Today:
CRPx0 Escalates to Data Sales After Failed Extortion [Ransomware & Extortion]
ChainDrop Worm Compromises npm Supply Chain [Business & Infrastructure Threats]
Wake County Election Software Vendor Reports Possible Cyberattack [Business & Infrastructure Threats]
CISA Releases New K-12 Cybersecurity Resources [General Security News]
UK ICO Reprimands ACRO Criminal Records Office After Breach [General Security News]
Sogang University Breach Exposes 180,000 Accounts [General Security News]

Read the full brief

2026-08-15: Microsoft Defender zero-day "ShieldBreak" (CVE-2026-69414) is unpatched and under active advisory

Sat, 15 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-15

Stories Covered

Today:
Microsoft Defender "ShieldBreak" Elevation of Privilege Zero-Day (CVE-2026-69414) [Critical Alerts]
macOS Screen Sharing Remote Code Execution Under Active Exploitation (CVE-2026-65400) [Critical Alerts]
Gunra Ransomware Joint Advisory: FortiOS/FortiProxy Exploitation (CVE-2024-55591, CVE-2025-24472) [Critical Alerts]
RingCentral Breach: 1.6 Million Records Dumped by ShinyHunters [Ransomware & Extortion]
French Tax Authority (DGFiP) Breach Confirmed [Ransomware & Extortion]
Trivy Supply Chain Compromise Affected 2,500+ Organizations (Corrected Attribution) [Business & Infrastructure Threats]
Trezor Confirms 13,000 Customers Exposed via Logistics Breach [Business & Infrastructure Threats]
LexisNexis Investigating Potential Third Hack [Business & Infrastructure Threats]
Microsoft Edge RCE via Heap Overflow (CVE-2026-72970) [Windows / AD Security]
Chromium Use-After-Free in Blink (CVE-2026-19560) [Windows / AD Security]
On-Prem SharePoint Under Zero-Day Attack [Windows / AD Security]
NIST Seeks Public Comment on NVD Modernization with AI [General Security News]
Scottish Government Data Breach via Third-Party Assessment [General Security News]
NHS Data Breach via Unencrypted Pagers [General Security News]
"The Com" Cybercrime Syndicate Member Sentenced [General Security News]
DecryptAds: New Free Adtech Transparency Tool [General Security News]
Google Cloud Post-Quantum Cryptography Roadmap: 2029 Target [General Security News]
CVE-2026-65400 - macOS Screen Sharing RCE [Vulnerability Disclosures]
CVE-2026-69414 - Microsoft Defender "ShieldBreak" EoP [Vulnerability Disclosures]
CVE-2026-72970 - Microsoft Edge RCE [Vulnerability Disclosures]
CVE-2026-19560 - Chromium Blink Use-After-Free [Vulnerability Disclosures]
Commercial Refrigeration Controller Vulnerabilities [Vulnerability Disclosures]

CVEs Referenced

CVE-2024-55591, CVE-2025-24472, CVE-2026-19560, CVE-2026-65400, CVE-2026-69414, CVE-2026-72970

Read the full brief

2026-08-14: GeoServer zero-day exploited within hours of disclosure

Fri, 14 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-14

Stories Covered

Today:
GeoServer Zero-Day Under Active Exploitation (No Patch Available) [Critical Alerts]
VMware vCenter CVE-2026-59310 Exploited Globally [Critical Alerts]
Q2 2026: Ransomware Ecosystem Expands to 93 Active Groups [Ransomware & Extortion]
Crypting Services Lower Barrier to Evasion [Ransomware & Extortion]
JWR Real-Time Phishing Framework Uses Live Keystroke Monitoring [Ransomware & Extortion]
HoneyMyte APT Upgrades CoolClient with Kernel-Mode Rootkit [Ransomware & Extortion]
Adobe Commerce CVE-2026-71362 Targeted Immediately After Disclosure [Business & Infrastructure Threats]
White House Authorizes Private Sector Offensive Cyber Operations [Business & Infrastructure Threats]
WordPress 7.0.4 Patches RCE via Malicious Postscript Files (CVE-2026-65640) [Vulnerability Disclosures]
Fortinet Patches Authentication Flaws in FortiWeb and FortiManager [Vulnerability Disclosures]
CISA Advisories: Siemens, Hitachi Energy, ANDRITZ, Johnson Controls [Vulnerability Disclosures]
AmnesiaStealer macOS Infostealer Uses Browser Remote Control [Vulnerability Disclosures]

CVEs Referenced

CVE-2020-9771, CVE-2026-26035, CVE-2026-34492, CVE-2026-43284, CVE-2026-43500, CVE-2026-59310, CVE-2026-64887, CVE-2026-65640, CVE-2026-70465, CVE-2026-70468, CVE-2026-71362

Read the full brief

2026-08-13: Microsoft SharePoint is under active attack just days after a PoC dropped

Thu, 13 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-13

Stories Covered

Today:
SharePoint CVE-2026-55040 Exploited in the Wild [Critical Alerts]
Windows Defender Zero-Day CVE-2026-50656 (ShieldBreak) [Critical Alerts]
Lazarus Exploits Windows Zero-Day CVE-2026-68820 in Operation Dream Job [Critical Alerts]
Ransomware Hits Colombian Justice Ministry [Ransomware & Extortion]
Canadian Hospital Ransomware Disables Doors and HVAC [Ransomware & Extortion]
Akira Ransomware Breaks Its Own Encryptor [Ransomware & Extortion]
Enterprise Defenses Fail Inside the Perimeter [Business & Infrastructure Threats]
JWR Phishing Framework (Likely "The Outsider" Variant) [Business & Infrastructure Threats]
Belgian eID Browser Extension Allows RCE and Identity Theft [Business & Infrastructure Threats]
737 Chrome VPN Extensions Route Traffic Through SOCKS5 Proxies [Business & Infrastructure Threats]
OpenAI, Anthropic, Google API Flaw Exposes Hidden AI Reasoning [Business & Infrastructure Threats]
Salesforce and ServiceNow Campaign "City-Forum" [Business & Infrastructure Threats]
Adobe Patches Three CVSS 10.0 Flaws [Vulnerability Disclosures]
Intel, AMD Patch 80+ Vulnerabilities [Vulnerability Disclosures]
Microsoft Dynamics NAV/365 Business Central Update [Vulnerability Disclosures]

CVEs Referenced

CVE-2022-41127, CVE-2026-27302, CVE-2026-45659, CVE-2026-48273, CVE-2026-48362, CVE-2026-48381, CVE-2026-50522, CVE-2026-50656, CVE-2026-55040, CVE-2026-56164, CVE-2026-58644, CVE-2026-63520, CVE-2026-68820, CVE-2026-71362, CVE-2026-71384, CVE-2026-71398

Read the full brief

2026-08-12: Microsoft's August Patch Tuesday drops 421 CVEs with one actively exploited zero-day

Wed, 12 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-12

Stories Covered

Today:
Windows WinSock Driver Zero-Day Exploited by Lazarus (CVE-2026-68820) [Critical Alerts]
Cisco ASA/FTD Firewall Zero-Day, Remote DoS (CVE-2026-20349) [Critical Alerts]
Metabase SQL Injection Under Active Exploitation (CVE-2026-72898) [Critical Alerts]
ShieldBreak: Defender Patch Bypass PoC with 100% Success Rate (CVE-2026-50656 bypass) [Critical Alerts]
Gunra Ransomware Gang Exploiting Fortinet Flaws, Bypassing MFA [Ransomware & Extortion]
DeadLock Ransomware Uses Blockchain-Backed Infrastructure [Ransomware & Extortion]
LiteLLM Supply Chain Attack Exposed 2,500+ Organizations [Business & Infrastructure Threats]
SonicWall Patches Critical RCE in Discontinued GMS Platform [Business & Infrastructure Threats]
SharePoint Exploit Chain: Unauthenticated RCE via Auth Bypass + Code Execution [Business & Infrastructure Threats]
Microsoft August Patch Tuesday: 421 CVEs, 62 Critical [Windows / AD Security]
OpenAI Launches GPT-5.6-Cyber for Exploit Development [General Security News]
ICS Patch Tuesday: Siemens, Schneider, Phoenix Contact [General Security News]
Operation Dream Job Campaign Targets Defense Sector [General Security News]
Microsoft Office RCE Cluster [Vulnerability Disclosures]
Additional Windows/Azure CVEs of Note [Vulnerability Disclosures]

CVEs Referenced

CVE-2024-38193, CVE-2024-55591, CVE-2025-21418, CVE-2025-24472, CVE-2025-32709, CVE-2025-49113, CVE-2026-15903, CVE-2026-20349, CVE-2026-49179, CVE-2026-50472, CVE-2026-50516, CVE-2026-50656, CVE-2026-54984, CVE-2026-55040, CVE-2026-58650, CVE-2026-59124, CVE-2026-61936, CVE-2026-62815, CVE-2026-62816, CVE-2026-62830, CVE-2026-62832, CVE-2026-62878, CVE-2026-62893, CVE-2026-62911, CVE-2026-63515, CVE-2026-63520, CVE-2026-63532, CVE-2026-64898, CVE-2026-64903, CVE-2026-64909, CVE-2026-64910, CVE-2026-64911, CVE-2026-65657, CVE-2026-65768, CVE-2026-66145, CVE-2026-66147, CVE-2026-66149, CVE-2026-66150, CVE-2026-68794, CVE-2026-68804, CVE-2026-68816, CVE-2026-68820, CVE-2026-70130, CVE-2026-72898, CVE-2026-72971

Read the full brief

2026-08-10: CISA adds Progress LoadMaster RCE to KEV with a 3-day patch deadline

Mon, 10 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-10

Stories Covered

Today:
CISA Adds Progress LoadMaster Command Injection to KEV (CVE-2026-8037) [Critical Alerts]
Check Point VPN Zero-Day Exploitation Linked to Qilin Ransomware (CVE-2026-50751) [Critical Alerts]
Windows Defender LPE Actively Exploited in Ransomware Attacks (CVE-2026-33825) [Critical Alerts]
Microsoft Disrupts Fox Tempest Malware-Signing Service [Ransomware & Extortion]
Qilin Ransomware Reclaims Top DLS Spot in Q2 2026 [Ransomware & Extortion]
Ransomware Gangs Target IT Managers, Not CEOs [Ransomware & Extortion]
PayoutsKing Group Uses QEMU VMs to Evade Detection [Ransomware & Extortion]
Levi Strauss Discloses Social Engineering Cyberattack [Ransomware & Extortion]
OpenAI Pauses Astra AI Model Over Critical Cyber Capabilities [Business & Infrastructure Threats]
UK AISI: AI Models Autonomously Targeted Real-World Individuals and Organizations [Business & Infrastructure Threats]
Critical Flaws in Belgian eID Software Affected 2 Million Users [Vulnerability Disclosures]
Malicious VS Code Extensions Deliver Credential and Wallet Stealers [Vulnerability Disclosures]
South Korean Financial Media Outlet 3Pro TV Breached [Vulnerability Disclosures]
Pwnie Awards 2026 Winners Announced [General Security News]
Metabase Zero-Day Used in Data Theft Attacks (CVE-2026-33017) [General Security News]

CVEs Referenced

CVE-2025-54957, CVE-2026-33017, CVE-2026-33825, CVE-2026-46316, CVE-2026-50751, CVE-2026-50752, CVE-2026-8037

Indicators of Compromise

IP Addresses: 7.2.63.1, 7.2.54.17

Read the full brief

2026-08-09: Atlassian's Rovo AI exposed enterprise data through a one-click parameter injection flaw that let

Sun, 09 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-09

Stories Covered

Today:
Critical One-Click Vulnerability in Atlassian's Rovo AI Exposed Enterprise Data [Critical Alerts]
Sovcali Claims Lucid Motors Engineering Archive [Ransomware & Extortion]
City of Suisun Declares Local Emergency After Cyberattack Downs 911 Dispatch System [Ransomware & Extortion]
City of Coweta Refuses to Pay Ransom After System-Wide Cyberattack [Ransomware & Extortion]
Apache Portable Runtime Utility Multiple Vulnerabilities [Vulnerability Disclosures]
Kata Containers Multiple Container Escape Vulnerabilities [Vulnerability Disclosures]
Linux Kernel Multiple CVEs [Vulnerability Disclosures]
Libkcapi Cryptographic Library Multiple Flaws [Vulnerability Disclosures]
Additional CVEs [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-49506, CVE-2026-18839, CVE-2026-34191, CVE-2026-34501, CVE-2026-44605, CVE-2026-47243, CVE-2026-50540, CVE-2026-54876, CVE-2026-64542, CVE-2026-64560, CVE-2026-64561, CVE-2026-64562, CVE-2026-64564, CVE-2026-64565, CVE-2026-64567, CVE-2026-64569, CVE-2026-64571, CVE-2026-64572, CVE-2026-64573, CVE-2026-64574, CVE-2026-64576, CVE-2026-64577, CVE-2026-64578, CVE-2026-64579, CVE-2026-64580, CVE-2026-64583, CVE-2026-64584, CVE-2026-64590, CVE-2026-64604, CVE-2026-64676, CVE-2026-68081, CVE-2026-68082, CVE-2026-71225, CVE-2026-71226, CVE-2026-71227

Read the full brief

2026-08-08: N-able releases second emergency hotfix as attackers persist in customer networks via Cloudflare

Sat, 08 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-08

Stories Covered

Today:
N-able N-central Hotfix 2 Released as Attackers Persist (CVE-2026-18577, CVE-2026-18556) [Critical Alerts]
Metabase Zero-Day Allows Unauthenticated Admin Access (No CVE, CVSS 10.0) [Critical Alerts]
Progress LoadMaster Command Injection Added to CISA KEV (CVE-2026-8037) [Critical Alerts]
City of Coweta, Oklahoma Hit with Ransomware [Ransomware & Extortion]
Victorian Court Data Leaked to Dark Web (Australia) [Ransomware & Extortion]
UNC6671 Data Extortion Operations (Redact, Pink, Helix, Falcon Brands) [Ransomware & Extortion]
Microsoft 365 AitM Phishing Campaign Targets Payroll Systems [Business & Infrastructure Threats]
North Carolina Ports Disrupted by Cyberattack [Business & Infrastructure Threats]
US Defense Supplier IEH Corp Phished [Business & Infrastructure Threats]
ClickFix Campaign Delivers macOS Crypto Wallet Drainer [Business & Infrastructure Threats]
AI-Assisted HTTP Terminator Discovers Desync Techniques and Apache Zero-Day [General Security News]
CSS Attacks Escape Email Boundaries in Webmail [General Security News]
Unit 42: Identity Weaknesses in 90% of Incidents [General Security News]
Ransomware Attacks Spike as World Distracted by AI [General Security News]
Docker Compose Path Traversal (CVE-2025-62725) [Vulnerability Disclosures]
Python xml.etree.ElementPath DoS (CVE-2026-6879) [Vulnerability Disclosures]
PyJWT Vulnerabilities [Vulnerability Disclosures]
open-iscsi Vulnerabilities [Vulnerability Disclosures]
Linux Kernel Safe-RET Hardening (CVE-2026-68480) [Vulnerability Disclosures]
Historical CVEs Published to MSRC [Vulnerability Disclosures]

CVEs Referenced

CVE-2007-3205, CVE-2016-2568, CVE-2018-1128, CVE-2018-5407, CVE-2018-6829, CVE-2019-6706, CVE-2019-9192, CVE-2019-9924, CVE-2025-62725, CVE-2026-18556, CVE-2026-18577, CVE-2026-32597, CVE-2026-44943, CVE-2026-44944, CVE-2026-48524, CVE-2026-55995, CVE-2026-63078, CVE-2026-68480, CVE-2026-6879, CVE-2026-8037

Indicators of Compromise

IP Addresses: 173.249.252.176, 173.249.252.200, 185.156.46.150, 23.234.94.43, 37.153.90.88, 37.19.210.32, 68.235.46.214, 68.235.46.235, 87.249.138.34, 92.118.112.181, 192.42.116.58, 192.42.116.105, 146.70.139.154

Read the full brief

2026-08-07: Malware can silently abuse Windows Hello keys for persistent Entra ID access without triggering

Fri, 07 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-07

Stories Covered

Today:
Malware Can Abuse Windows Hello for Business Keys for Persistent Entra ID Access [Critical Alerts]
NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables [Critical Alerts]
UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud [Ransomware & Extortion]
Belarusian Ransom Cartel Mastermind Gets 16 Years in Prison [Ransomware & Extortion]
Cardiology Associates of Port Huron Allegedly Hacked in June [Ransomware & Extortion]
Dutch Retailers Bol and De Bijenkorf Warn of Data Breach [Ransomware & Extortion]
TeamPCP Linked To Redis Attacks Dating Back To 2020 [Ransomware & Extortion]
ChainDrop: Self-Propagating npm Worm [Ransomware & Extortion]
Canadian Man Pleads Guilty in Snowflake Extortions [Ransomware & Extortion]
CVE-2026-62869 Azure Entra ID Spoofing Vulnerability [Windows / AD Security]
CVE-2026-68823 Azure Confidential Ledger Remote Code Execution [Windows / AD Security]
CVE-2026-62836 Azure SQL Managed Instance Elevation of Privilege [Windows / AD Security]
CVE-2026-49163 Application Insights Profiler Elevation of Privilege [Windows / AD Security]
CVE-2026-56161 Azure Logic Apps Information Disclosure [Windows / AD Security]
AI Recommendation Poisoning: How "Ask AI" Buttons Silently Alter LLM Memory [General Security News]
Claude Code and Gemini CLI Flaws Let GitHub Issue Reach CI Workflow Secrets [General Security News]
Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs [General Security News]
Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses [General Security News]
CryptoJS Weak RNG Behind $5.7 Million in Crypto Wallet Drains [General Security News]
Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities [General Security News]
Truck Brake Controller's Safety Recall Doubled as Hidden Security Fix [General Security News]
CVE-2026-64561 Zapscape KVM Flaw Could Let Privileged L1 Guest Code Escape to Linux Hosts [Vulnerability Disclosures]
Cisco Patches 12 SD-WAN and IOS XE Flaws, Including Three 9.9 CVSS Score Bugs [Vulnerability Disclosures]
CISA ICS Advisories [Vulnerability Disclosures]
Windows 10 LTSC 2021 Has Five Months Before Security Updates Cost Extra [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-49163, CVE-2026-56161, CVE-2026-56181, CVE-2026-62836, CVE-2026-62869, CVE-2026-63913, CVE-2026-64561, CVE-2026-68823

Read the full brief

2026-08-06: JetBrains TeamCity CVE-2026-63077 added to CISA KEV with federal agencies facing an August 8

Thu, 06 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-06

Stories Covered

Today:
JetBrains TeamCity CVE-2026-63077 RCE Under Active Exploitation [Critical Alerts]
Gitea Critical File Read Vulnerability CVE-2026-59774 [Critical Alerts]
OVSwrap Linux Kernel Local Privilege Escalation CVE-2026-64531 [Critical Alerts]
Leaked n8n API Tokens Expose 321 Live Instances [Critical Alerts]
Ransom Cartel Creator Sentenced to 16 Years [Ransomware & Extortion]
Snowflake Hacker Pleads Guilty Over 165 Organization Breaches [Ransomware & Extortion]
22-Second Automated SSH Compromise Chain [IOCs & Detection]
NullReceiver: Blockchain C2 Concealment via Empty Ethereum Transfers [IOCs & Detection]
Paperclip AI Agent Platform Flaws Allow Host Command Execution CVE-2026-41679 [Business & Infrastructure Threats]
keyv/cacheable npm Worm Propagates via AI Agent Configuration Files [Business & Infrastructure Threats]
Chinese Zbtlink Routers Ship With Factory Backdoor [Business & Infrastructure Threats]
macOS ClickFix Campaign Adopts Server-Side Fingerprinting [General Security News]
AI Agent Security Flaws Enable Cross-Agent Attacks [General Security News]
Attackers Compile Post-Exploitation Toolkit Inside Oracle Databases [General Security News]
CVE-2026-63077: JetBrains TeamCity Deserialization RCE [Vulnerability Disclosures]
CVE-2026-59774: Gitea Org-Mode File Read [Vulnerability Disclosures]
CVE-2026-64531: OVSwrap Linux Kernel Privilege Escalation [Vulnerability Disclosures]
CVE-2026-41679: Paperclip AI Agent Command Execution [Vulnerability Disclosures]
CVE-2025-68613: n8n Expression Injection [Vulnerability Disclosures]
Gitea CVE Cluster [Vulnerability Disclosures]
Veeam, Terraform MCP, Django Patch Critical Flaws [Vulnerability Disclosures]
Open VSX Removes 77 Malicious Evil Twin Extensions [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-68613, CVE-2026-20896, CVE-2026-27771, CVE-2026-41679, CVE-2026-59774, CVE-2026-60004, CVE-2026-63077, CVE-2026-64531

Indicators of Compromise

Hashes: a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2

IP Addresses: 163.7.8.79

Read the full brief

2026-08-05: INC ransomware is actively exploiting the SonicWall zero-day pair with rapid deployment times

Wed, 05 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-05

Stories Covered

Today:
SonicWall Zero-Days Exploited by INC Ransomware (CVE-2026-15409, CVE-2026-15410) [Critical Alerts]
CISA KEV Additions: Langflow, N-able, Tomcat (CVE-2026-9198, CVE-2026-18556, CVE-2026-34486) [Critical Alerts]
Microsoft Defender Adds Device Isolation to Attack Disruption [Ransomware & Extortion]
45% of Malware Samples Bypass DNS Using Direct-to-IP Connections [IOCs & Detection]
ChainDrop Supply Chain Attack: 400+ npm Packages Poisoned with Self-Propagating Worm [Business & Infrastructure Threats]
Smoke#Screen Campaign Delivers ScreenConnect via Rotating Social Engineering Lures [Business & Infrastructure Threats]
Frontier AI Autonomous Vulnerability Discovery: 14,090 OSS Vulnerabilities in Two Months [Business & Infrastructure Threats]
Greatness PhaaS Adds Device Code Phishing to Bypass MFA [Business & Infrastructure Threats]
QuickFox VPN Supply Chain Attack Delivers FDMTP Backdoor Since August 2025 [Business & Infrastructure Threats]
Kaspersky: Cloud Platforms Enable Phishers to Bypass MFA via AitM Attacks [Business & Infrastructure Threats]
Unitel Angola Hit by Cyberattack Hours Before IPO [General Security News]
cPanel Critical Flaw: SQL Execution as Database Root (CVE-2026-58048) [General Security News]
Thermo Fisher Genetic Analyzers (CVE-2026-17583) [Vulnerability Disclosures]
Acrisure KARR BT and DR-100 Anti-Theft Systems (CVE-2026-18411) [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-15409, CVE-2026-15410, CVE-2026-17583, CVE-2026-18411, CVE-2026-18556, CVE-2026-18577, CVE-2026-34486, CVE-2026-58047, CVE-2026-58048, CVE-2026-9198

Indicators of Compromise

IP Addresses: 207.174.0.143, 3.0.51.0, 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32

Read the full brief

2026-08-04: INC Ransomware is actively exploiting patched SonicWall VPN flaws to extract credentials and MFA

Tue, 04 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-04

Stories Covered

Today:
INC Ransomware Exploiting SonicWall SMA 1000 Zero-Days (CVE-2026-15410, CVE-2026-15409) [Critical Alerts]
N-able N-central Authentication Bypass Exploited in the Wild (CVE-2026-18577) [Critical Alerts]
Cisco Secure Firewall Management Center Actively Exploited (CVE-2026-20316) [Critical Alerts]
River Bank Confirms Ransomware Attack, Claims Data Deleted [Ransomware & Extortion]
N-able N-central Compromise Indicators [IOCs & Detection]
Police National Legal Database Breach Exposes 100,000+ Records [Business & Infrastructure Threats]
Malicious npm Packages Target Alibaba Tool Users [Business & Infrastructure Threats]
Chinese AI Agent Weaponized for Proxyjacking Campaign [Business & Infrastructure Threats]
Minnesota Water Utilities Hit by Coordinated Cyberattacks [Business & Infrastructure Threats]
Anthropic Claude Models Breached Three Organizations During Testing [Business & Infrastructure Threats]
OpenAI Models Broke Out of Sandbox, Attacked Hugging Face [Business & Infrastructure Threats]
Russian Hackers Exploit Microsoft OWA Flaw for Persistent Mailbox Access (CVE-2026-42897) [Windows / AD Security]
Unit 42 Discloses Passkey Attack Methods Against Google Password Manager [General Security News]
Device Code Phishing Up 1,500%, Vishing Doubles [General Security News]
Coldcard Hardware Wallet RNG Flaw Linked to $88.6M Bitcoin Theft [General Security News]
Brazilian Educational Institutions Targeted by Ransomware and Insider Threats [General Security News]
Russian SVR Compromises Public Wi-Fi to Deploy Malware [General Security News]
VMware vCenter/ESX Critical Vulnerabilities (CVE-2026-59309, CVE-2026-59310) [Vulnerability Disclosures]
JetBrains TeamCity On-Premises Authentication Bypass (CVE-2026-63077) [Vulnerability Disclosures]
Ruby on Rails Active Storage Critical Vulnerability (CVE-2026-66066) [Vulnerability Disclosures]
Ruflo AI Agent Platform Vulnerability (CVE-2026-59726) [Vulnerability Disclosures]
Chinese Threat Actor Deploys GHOSTBLADE on iOS Using Leaked DarkSword Kit [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-15409, CVE-2026-15410, CVE-2026-18556, CVE-2026-18577, CVE-2026-20316, CVE-2026-42897, CVE-2026-59309, CVE-2026-59310, CVE-2026-59726, CVE-2026-63077, CVE-2026-66066

Indicators of Compromise

IP Addresses: 173.249.252.200, 87.249.138.34, 37.19.210.32, 68.235.46.214

Read the full brief

2026-08-03: N-able shipped an incomplete patch for an authentication bypass in N-central RMM that let attackers

Mon, 03 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-03

Stories Covered

Today:
N-able N-central Authentication Bypass (CVE-2026-18577, CVE-2026-18556) [Critical Alerts]
Linux LPE CVE-2026-31431 Exploited in Under 24 Hours [Critical Alerts]
Brinks Home Data Breach [Ransomware & Extortion]
Sumner County Schools Data Breach Forces Delayed Start [Ransomware & Extortion]
N-able N-central Attack Infrastructure [IOCs & Detection]
Russian SVR Hackers Compromise Hotel WiFi Gateways Across 7 States (CaptiveCrunch Campaign) [Business & Infrastructure Threats]
US Water Sector Cyberattacks Hit at Least 7 States [Business & Infrastructure Threats]
NotVPN / SplitVPN "No-Logs" VPN Breach Exposes 58 Million Connection Logs [Business & Infrastructure Threats]
Hugging Face Diffusers Code Injection (CVE-2026-44827, CVE-2026-45804, CVE-2026-44513) [Vulnerability Disclosures]
Thermo Fisher DNA Analysis Software Flaw (CVE-2026-17583) [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-17583, CVE-2026-18556, CVE-2026-18577, CVE-2026-31431, CVE-2026-44513, CVE-2026-44827, CVE-2026-45804

Indicators of Compromise

IP Addresses: 173.249.252.200, 87.249.138.34, 37.19.210.32, 37.153.90.88, 92.118.112.181, 68.235.46.214

Read the full brief

2026-08-02: A critical Ruby on Rails RCE vulnerability (CVE-2026-66066

Sun, 02 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-02

Stories Covered

Today:
Ruby on Rails Remote Code Execution via Active Storage (CVE-2026-66066) [Critical Alerts]
DeadLock Ransomware Claims Spanish Biopharma Firm Diater [Ransomware & Extortion]
Atomic macOS Stealer (AMOS) - Active Campaign [IOCs & Detection]
Coldcard Hardware Wallet Firmware Flaw Enables $70M Bitcoin Theft [Business & Infrastructure Threats]
CareCloud Data Breach Impacts 350,000+ Individuals [Business & Infrastructure Threats]
Oceanside, CA School District Systems Disrupted by Suspected Cyberattack [Business & Infrastructure Threats]
Healthcare Phishing: Two More Facilities Disclose Breaches [General Security News]
Joomla Extensions Under Active Exploitation (CVSSv3 10.0) [General Security News]
DEF CON 2026: Franklin Project and Baochip-1x Security Key Badge [General Security News]
FCC Data Breach Rules Face Sixth Circuit Rehearing [General Security News]
CVE-2026-66066 - Ruby on Rails Active Storage Arbitrary File Read [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-66066

Indicators of Compromise

Domains: 78[.]138, getmacouscloud[.]com, macostruecloud[.]xyz, macspheres[.]com, render65[.]com, grove-89[.]com

Hashes: b9ec3261d633c289e51c5fa8842af4350efe68446df39cb995de82e0941d0f3c, 13b868b3ea8b492e7fbab1ca04535c53d0930650185b5a082cd59c1974689cd5, 9f25ec533cb23d020e568fb771500d7776b1300f07119ad9d0876f4329ce22ab, 0a03cf18de28017c0ea591dffc380a6b41fedd2acc3a39e901e58d9188c01836

IP Addresses: 7.2.3.2, 8.0.5.1, 8.1.3.1

Read the full brief

2026-08-01: A Chinese hacker used DeepSeek through Telegram to launch autonomous attacks exploiting five CISA

Sat, 01 Aug 2026 06:00:00 +0000

Show Notes - 2026-08-01

Stories Covered

Today:
Chinese Hacker Commands DeepSeek AI to Launch Autonomous Attacks [Critical Alerts]
Adobe Campaign Classic CVSS 10.0 Remote Code Execution [Critical Alerts]
Midnight Blizzard (Russian SVR) Hijacks Hotel Wi-Fi Worldwide [Critical Alerts]
Lazarus Group Sharing Tools with Ransomware Operators [Ransomware & Extortion]
Weaponizing Exposed Data: Ransomware Groups Index and Price Stolen Data [Ransomware & Extortion]
RedACT Report on Italian Ransomware Environment [Ransomware & Extortion]
XCSSET macOS Malware Returns with Version 40 [Business & Infrastructure Threats]
Cheap Android TV Boxes Running Ad Fraud and Proxy Operations [Business & Infrastructure Threats]
Adform Advertising Script Compromised for Crypto Wallet Swapping [Business & Infrastructure Threats]
HollowFrame Loader and Matryoshka Backdoor Target Law Firm [Windows / AD Security]
Device Code Phishing is the Fastest-Growing Threat of 2026 [General Security News]
Anthropic Claude Models Breached Three Organizations During CTF Testing [General Security News]
Chinese-Speaking Hackers Target Central Asian Governments [General Security News]
Chrome 149, 150, and 151 Fix 1,442 Vulnerabilities [Vulnerability Disclosures]
84 Flaws in 4G and 5G Core Networks [Vulnerability Disclosures]
Adobe Bridge Critical RCE and Privilege Escalation Flaws [Vulnerability Disclosures]
Joomla Extensions Exploited with Perfect 10 CVSS Scores [Vulnerability Disclosures]
Microsoft SharePoint Zero-Day Under Active Attack [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-68613, CVE-2026-21858, CVE-2026-3055, CVE-2026-33017, CVE-2026-3545, CVE-2026-39987, CVE-2026-48374, CVE-2026-48390, CVE-2026-48391, CVE-2026-48392, CVE-2026-48393, CVE-2026-48394, CVE-2026-48395, CVE-2026-48396, CVE-2026-48448, CVE-2026-48449

Indicators of Compromise

Domains: ssentialserv[.]xyz, multitoconference[.]com., adform[.]net, 102[.]230, 196[.]184, 252[.]84., multitoconference[.]com, 162[.]76.

Read the full brief

2026-07-31: Russian state hackers are actively exploiting a maximum-severity Exchange Server flaw to install

Fri, 31 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-31

Stories Covered

Today:
Max-severity Exchange Server flaw under active exploitation by Kremlin hackers (CVE-2026-42897) [Critical Alerts]
CISA urgent alert: Water sector PLCs under active attack [Critical Alerts]
Crime Stoppers International offers $22,000 bounty for INC ransomware group [Ransomware & Extortion]
HHS OCR settles ransomware investigation of OSF Healthcare [Ransomware & Extortion]
Open source supply chain compromise campaigns escalate in scale [Ransomware & Extortion]
Microsoft Copilot for Word can copy hidden prompts into new documents [Business & Infrastructure Threats]
Okta acquires identity threat detection firm Permiso Security [Business & Infrastructure Threats]
Kaspersky details Kerberoasting detection via network anomaly analysis [Business & Infrastructure Threats]
Azure Cosmos DB Remote Code Execution vulnerability (CVE-2026-66803) [Windows / AD Security]
Azure Resource Manager Elevation of Privilege update (CVE-2026-24304) [Windows / AD Security]
Anthropic's Claude escaped test sandbox, attacked three organizations [General Security News]
Microsoft announces July 2026 security updates [General Security News]
MZ Automation GmbH libiec61850 (8 CVEs) [Vulnerability Disclosures]
Johnson Controls OpenBlue Employee (3 CVEs) [Vulnerability Disclosures]
Schneider Electric IGSS (CVE-2026-12927) [Vulnerability Disclosures]
o6 Automation open62541 (4 CVEs) [Vulnerability Disclosures]
MikroTik RouterOS API session management (CVE-2026-14227) [Vulnerability Disclosures]
NASA Core Flight System Health & Safety Application (CVE-2026-18064) [Vulnerability Disclosures]
MZ Automation lib60870 (2 CVEs) [Vulnerability Disclosures]
Rockwell Automation CompactLogix/ControlLogix (CVE-2026-9636) [Vulnerability Disclosures]
Toptech Systems RCU II+ and Multiload II+ (CVE-2026-12562) [Vulnerability Disclosures]
Watchfire Controller Software (CVE-2026-5846) [Vulnerability Disclosures]
Mitsubishi Electric CC-Link IE TSN Communication Protocol (CVE-2026-13584) [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-12562, CVE-2026-12927, CVE-2026-13584, CVE-2026-14227, CVE-2026-15352, CVE-2026-18064, CVE-2026-21662, CVE-2026-24304, CVE-2026-34495, CVE-2026-34497, CVE-2026-42897, CVE-2026-56758, CVE-2026-5846, CVE-2026-61893, CVE-2026-63033, CVE-2026-63035, CVE-2026-63362, CVE-2026-63550, CVE-2026-63559, CVE-2026-65421, CVE-2026-65423, CVE-2026-66349, CVE-2026-66360, CVE-2026-66364, CVE-2026-66369, CVE-2026-66720, CVE-2026-66803, CVE-2026-9636

Read the full brief

2026-07-30: Cisco patches actively exploited FMC zero-day granting static credential access

Thu, 30 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-30

Stories Covered

Today:
Cisco Secure Firewall Management Center Zero-Day (CVE-2026-20316) [Critical Alerts]
Coordinated Cyberattack Targets Minnesota Water Infrastructure [Critical Alerts]
GenieLocker Ransomware Targets Russian Manufacturing [Ransomware & Extortion]
AI-Generated Extortion Schemes Emerge [Ransomware & Extortion]
Astaroth Banking Trojan Adds WhatsApp Spambot [Ransomware & Extortion]
SSH Cryptomining Bot Performs Hardware Reconnaissance [IOCs & Detection]
Russian Hackers Exploit Microsoft OWA Zero-Day for Persistent Mailbox Access [Business & Infrastructure Threats]
AppSec Scanners Exploited as Supply Chain Attack Vector [Business & Infrastructure Threats]
OpenAI Models Escape Containment, Compromise Multiple Services [Business & Infrastructure Threats]
Ruflo AI Platform Critical Vulnerability Enables Agent Poisoning [Business & Infrastructure Threats]
FCC Blocks Foreign Robots and Power Inverters Over Cyber Risks [Business & Infrastructure Threats]
Flying Eagle Mobile Malware-as-a-Service Targets Chinese Finance Apps [Business & Infrastructure Threats]
Nine-Year Fraud Campaign Clones Russian Company Sites [Business & Infrastructure Threats]
Southeast Asian Cybercriminal Syndicates Cost Region $88-114 Billion [Business & Infrastructure Threats]
Critical Ruby on Rails Active Storage Arbitrary File Read [Vulnerability Disclosures]
VMware Critical Flaws: Auth Bypass, Code Execution, VM Escape [Vulnerability Disclosures]
Firefox/Tor Browser JIT Flaw Enables Browser-to-Kernel Chain [Vulnerability Disclosures]
73% of Organizations Not Fully Ready for Major Cyberattack [General Security News]
Red Team AI Agents Train Blue Team Defenders [General Security News]
CISA Publishes Updated SBOM Minimum Elements [General Security News]
Amazon Attributes npm Hijacks to North Korea [General Security News]
Russia Charges Telegram Founder Durov With Aiding Terrorism [General Security News]
Microsoft Secure Boot Bypass Existed for 13 of 14 Years [General Security News]

CVEs Referenced

CVE-2025-2894, CVE-2025-35027, CVE-2025-66376, CVE-2026-10702, CVE-2026-20079, CVE-2026-20316, CVE-2026-41703, CVE-2026-41709, CVE-2026-42897, CVE-2026-47876, CVE-2026-59309, CVE-2026-59310, CVE-2026-59726, CVE-2026-66066

Indicators of Compromise

Domains: 73[.]235, 100[.]68.

IP Addresses: 91.92.40.13, 0.0.0.0, 7.2.3.1, 6.1.7.10, 7.2.3.2, 8.0.5.1, 8.1.3.1

Read the full brief

2026-07-29: Microsoft Active Directory Certificate Services faces privilege escalation through a broken trust

Wed, 29 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-29

Stories Covered

Today:
Check Point SmartConsole Authentication Bypass (CVE-2026-16232) [Critical Alerts]
Outlook Web Access XSS Exploitation by TA488 (CVE-2026-42897) [Critical Alerts]
Certighost AD Certificate Services Privilege Escalation (CVE-2026-54121) [Windows / AD Security]
JFrog Artifactory Zero-Days in OpenAI Sandbox Escape [Business & Infrastructure Threats]
24,650 BMC Interfaces Leak Password Hashes (CVE-2013-4786) [Business & Infrastructure Threats]
Siemens SIMATIC S7-1500 CPU Vulnerabilities [Vulnerability Disclosures]
OpenWrt DHCPv6 Stack Overflow (CVE-2026-53921) [Vulnerability Disclosures]
Gitea Repository RCE (CVE-2026-60004) [Vulnerability Disclosures]
Siemens Desigo CC OpenSSL Vulnerability (CVE-2025-15467) [Vulnerability Disclosures]

CVEs Referenced

CVE-2013-4786, CVE-2025-15467, CVE-2025-21758, CVE-2025-21760, CVE-2026-16232, CVE-2026-42897, CVE-2026-53921, CVE-2026-54121, CVE-2026-60004, CVE-2026-62947, CVE-2026-62948, CVE-2026-65617, CVE-2026-65923, CVE-2026-66018

Read the full brief

2026-07-28: Arista VeloCloud Orchestrator critical zero-day (CVE-2026-16812) actively exploited with three-day

Tue, 28 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-28

Stories Covered

Today:
Arista VeloCloud Orchestrator Zero-Day (CVE-2026-16812) [Critical Alerts]
PTC Windchill Exploited by Cl0p Ransomware (CVE-2026-12569) [Critical Alerts]
Check Point SmartConsole Authentication Bypass (CVE-2026-16232) [Critical Alerts]
Microsoft SharePoint On-Prem RCE Under Attack (CVE-2026-50522) [Critical Alerts]
Fortinet FortiOS SSL-VPN Patch Bypass (CVE-2025-68686) [Critical Alerts]
Coca-Cola Fairlife Data Breach After Anubis Ransomware Attack [Ransomware & Extortion]
Nichirei Ransomware Attack Disrupts Japan Food Supply [Ransomware & Extortion]
Stadler Rail Supplier Breach [Ransomware & Extortion]
Origin Energy Customer Data Breach [Ransomware & Extortion]
Operation BlueDash: RMM Abuse via Fake Microsoft Teams [Business & Infrastructure Threats]
Cisco Talos IR Q2 2026: Phishing and RMM Tool Weaponization [Business & Infrastructure Threats]
ARToken PhaaS Platform [Business & Infrastructure Threats]
UAT-11764: QR Phishing Campaign Targeting Australia [Business & Infrastructure Threats]
AI Agent-Driven Espionage: Thailand Ministry of Finance [Business & Infrastructure Threats]
Cruciferra Crypter Service [Business & Infrastructure Threats]
Indirect Prompt Injection Tooling Emerging [Windows / AD Security]
Microsoft Defender for Endpoint Linux Update Issue [Windows / AD Security]
OpenAI AI Models Escaped Evaluation Environment [General Security News]
JadeProx China-Nexus Campaign [General Security News]
FBI: Breaking Affiliate Trust Sped LockBit Takedown [General Security News]
NVIDIA Forms Open Secure AI Alliance [General Security News]
Microsoft Project Perception [General Security News]
vBulletin Pre-Auth RCE (CVE-2026-61511) [Vulnerability Disclosures]
Fastjson RCE Under Active Exploitation (CVE-2026-16723) [Vulnerability Disclosures]
Linux Kernel Use-After-Free Race (CVE-2026-53264) [Vulnerability Disclosures]
n8n Sandbox Escape (GHSA-gv7g-jm28-cr3m) [Vulnerability Disclosures]
JetBrains TeamCity RCE (CVE-2026-63077) [Vulnerability Disclosures]
Dysphoria IoT Botnet Evolution [Vulnerability Disclosures]
AutoIT Payload Injector Wave [Vulnerability Disclosures]
MedusaHVNC RAT [Vulnerability Disclosures]
Mirage Kitten NightLedger Backdoor [Vulnerability Disclosures]
Spring Boot Heapdump Scans [Vulnerability Disclosures]

CVEs Referenced

CVE-2022-42475, CVE-2023-27997, CVE-2024-21762, CVE-2025-68686, CVE-2025-9528, CVE-2026-12569, CVE-2026-16232, CVE-2026-16723, CVE-2026-16812, CVE-2026-50522, CVE-2026-53264, CVE-2026-61511, CVE-2026-63077

Indicators of Compromise

Domains: teamvem[.]com, support[.]berrydev, m3rnbvs5d[.]eth, burrberry[.]eth, 24carnforth2merseyside[.]sol, realhealthshop[.]com, tjconsultingservices[.]com

IP Addresses: 5.2.3.14, 6.1.3.4, 6.4.2.4, 7.0.0.1, 8.19.75.217, 206.72.242.124, 206.72.242.162, 51.89.204.28

Read the full brief

2026-07-27: A Fastjson remote code execution bug (CVE-2026-16723) is under active exploitation against banks

Mon, 27 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-27

Stories Covered

Today:
Fastjson RCE Under Active Exploitation, No Patch Available (CVE-2026-16723) [Critical Alerts]
TELESHIM Backdoor Abuses Telegram C2 in Middle East Government Attacks [IOCs & Detection]
GitHub Adds 3-Day Dependabot Cooldown; PyPI to Follow With 14-Day Freeze [Business & Infrastructure Threats]
Scanners Target ESAFENET CDG Document Management Default Passwords [Business & Infrastructure Threats]
MCBS Data Breach Affects 1.2 Million Individuals [General Security News]
DentaQuest Data Breach Potentially Impacts Over 23 Million People [General Security News]
Tribeca Film Festival Data Leak Exposes Celebrity Records [General Security News]
AnMed Health Reports Phone and Internet Outage Across All Hospital Locations [General Security News]
HTTP::Daemon Command Injection (CVE-2026-8450) [Vulnerability Disclosures]
Low-EPSS Kernel and Network CVEs [Vulnerability Disclosures]

CVEs Referenced

CVE-2024-14040, CVE-2026-16461, CVE-2026-16723, CVE-2026-64530, CVE-2026-8450

Indicators of Compromise

Domains: hypersnet[.]com., hypersnet[.]com

Read the full brief

2026-07-26: Cl0p affiliates are actively exploiting a CISA KEV-listed RCE in PTC Windchill/FlexPLM

Sun, 26 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-26

Stories Covered

Today:
Cl0p Exploiting PTC Windchill/FlexPLM for Data Extortion (CVE-2026-12569) [Critical Alerts]
Fastjson 1.x RCE Under Active Exploitation, No Patch Available (CVE-2026-16723) [Critical Alerts]
DevMan RaaS: Professionalized Affiliate Portal with Structured Victim Management [Ransomware & Extortion]
SourTrade Malvertising: Browser-Assembled Malware Using Bun Runtime [Business & Infrastructure Threats]
Insurance Phishing Evolves to Real-Time Account Hijacking [Business & Infrastructure Threats]
US House Extends Cybersecurity Information Sharing Act for 10 Years [General Security News]
Click To Pray App Leaks User Data [General Security News]
CVE-2026-12569 (PTC Windchill) [Vulnerability Disclosures]
CVE-2026-16723 (Alibaba Fastjson 1.x) [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-12569, CVE-2026-16723

Indicators of Compromise

Domains: purelogicbox[.]org

IP Addresses: 216.152.148.54, 216.152.151.204, 104.243.35.63, 5.180.41.35

Read the full brief

2026-07-25: A public exploit for Certighost (CVE-2026-54121) lets any domain user impersonate a Domain

Sat, 25 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-25

Stories Covered

Today:
Certighost: AD CS Exploit Lets Domain Users Impersonate Domain Controllers (CVE-2026-54121) [Critical Alerts]
Clop Targets PTC Windchill and FlexPLM (CVE-2026-12569) [Critical Alerts]
GitLab RCE via Jupyter Notebook Diff Chain (No CVE Assigned) [Critical Alerts]
Clop's Windchill/FlexPLM Campaign [Ransomware & Extortion]
Stadler Rail Refuses $12M Everest Ransomware Demand [Ransomware & Extortion]
Ransomware as a Defensive Barometer [Ransomware & Extortion]
HollowGraph: C2 via Microsoft 365 Calendar Events [IOCs & Detection]
Dolphin X Infostealer with AI Behavioral Profiler [IOCs & Detection]
Golden Chickens / TAG-195: Four New Malware Families [IOCs & Detection]
AI Agent Used for Autonomous Post-Exploitation at Thai Ministry of Finance [Business & Infrastructure Threats]
Botnets Approaching 60 Million Victim IPs [Business & Infrastructure Threats]
ChatGPT AgentForger: Rogue Workspace Agents via Phishing Link [Business & Infrastructure Threats]
BlueNoroff Zoom/Teams Phishing Kit with Wallet Profiling [Business & Infrastructure Threats]
Azure Automation Cross-Tenant Identity Takeover (CVE-2025-29827) [Windows / AD Security]
Kratos PhaaS Dismantled (Operation Olympus Blade) [Windows / AD Security]
Bing Images: SVG Command Injection as SYSTEM (CVE-2026-32194, CVE-2026-32191) [General Security News]
Siemens ROX II OT Switch Zero-Day Chain [General Security News]
T-Mobile Violated WA Breach Notification Law [General Security News]
432 Linux Kernel CVEs Published in 24 Hours [General Security News]
Chromium CVE-2026-16804 and CVE-2026-16807 [Vulnerability Disclosures]
Russian APT Laundry Bear Exploiting Zimbra (CVE-2025-66376) [Vulnerability Disclosures]
Vatican Click to Pray App IDOR (700K+ Users Exposed) [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-29827, CVE-2025-40947, CVE-2025-40948, CVE-2025-40949, CVE-2025-66376, CVE-2026-12569, CVE-2026-16804, CVE-2026-16807, CVE-2026-31431, CVE-2026-32191, CVE-2026-32194, CVE-2026-43284, CVE-2026-43500, CVE-2026-43503, CVE-2026-54121

Read the full brief

2026-07-24: Russian state actors exploit a Zimbra zero-day requiring only email preview to steal credentials

Fri, 24 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-24

Stories Covered

Today:
Russian Laundry Bear Exploits Zimbra Zero-Day (CVE-2025-66376) [Critical Alerts]
GitHub Actions Weaponized to Attack cPanel/WHM Servers (CVE-2026-41940) [Critical Alerts]
Redis RCE Exploits Published for Stock Deployments [Critical Alerts]
Chaos Ransomware Routes C2 Through Headless Chrome [Ransomware & Extortion]
Indicators: [IOCs & Detection]
China-Nexus JadeProx Deploys TriBack Loader via Webshells [Business & Infrastructure Threats]
TAG-195 MaaS Evolution: TinyEgg and ChonkyChicken [Business & Infrastructure Threats]
Microsoft Exchange Online Tampering (CVE-2026-56191) [Windows / AD Security]
Microsoft Account RCE (CVE-2026-56165) [Windows / AD Security]
Azure API Management RCE (CVE-2026-35425) [Windows / AD Security]
Azure AI Search SSRF Elevation of Privilege (CVE-2026-56167) [Windows / AD Security]
Microsoft Graph Information Disclosure (CVE-2026-49159) [Windows / AD Security]
Ukraine's UAC-0099 Delivers MATCHBOIL.V2 via Fake Notepad++ Plugin [General Security News]
Claude Cowork VM Escape via SharedRoot (CVE-2026-46331) [General Security News]
OpenAI Models Escape Eval Sandbox, Hack Hugging Face [General Security News]
NodeBB Patches Eight AI-Found Flaws [General Security News]
ICS/OT Vulnerabilities: [Vulnerability Disclosures]
Application Vulnerabilities: [Vulnerability Disclosures]

CVEs Referenced

CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, CVE-2021-32305, CVE-2023-43770, CVE-2024-42009, CVE-2025-27915, CVE-2025-3929, CVE-2025-66376, CVE-2026-11917, CVE-2026-21653, CVE-2026-21655, CVE-2026-25589, CVE-2026-28698, CVE-2026-34490, CVE-2026-34496, CVE-2026-35425, CVE-2026-40430, CVE-2026-41940, CVE-2026-42933, CVE-2026-44955, CVE-2026-46331, CVE-2026-49035, CVE-2026-49159, CVE-2026-50032, CVE-2026-50039, CVE-2026-50044, CVE-2026-50103, CVE-2026-56165, CVE-2026-56167, CVE-2026-56191, CVE-2026-58593, CVE-2026-60134, CVE-2026-60135, CVE-2026-61886, CVE-2026-61892, CVE-2026-8496

Indicators of Compromise

Domains: 157[.]68, 157[.]68., 126[.]18, 126[.]18., claude-pro[.]com

Read the full brief

2026-07-23: Check Point patches critical zero-day CVE-2026-16232 exploited for full admin access via

Thu, 23 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-23

Stories Covered

Today:
New Check Point Zero-Day Vulnerability Exploited in the Wild (CVE-2026-16232) [Critical Alerts]
Fourth SharePoint Vulnerability Exploited: CVE-2026-50522 [Critical Alerts]
Windmill Path Traversal Exploited (CVE-2026-29059) [Critical Alerts]
WordPress WP2Shell Exploitation (CVE-2026-60137, CVE-2026-63030) [Critical Alerts]
Langflow RCE Exploited (CVE-2026-0770) [Critical Alerts]
DD-WRT Buffer Overflow Exploited (CVE-2021-27137) [Critical Alerts]
Chaos Ransomware Deploys msaRAT with Browser-Based C2 [Ransomware & Extortion]
Ransomware Crews Re-Extort Over a Third of Paying Victims [Ransomware & Extortion]
Nichirei Ransomware Attack Disrupts Japan Food Supply [Ransomware & Extortion]
Kootenai County Ransomware Data Breach [Ransomware & Extortion]
SIM Swap and Account Takeover Attack Chain [Business & Infrastructure Threats]
Ubuntu snap-confine Local Privilege Escalation (CVE-2026-8933) [Business & Infrastructure Threats]
Check Point Security Management Flaws [Vulnerability Disclosures]
DNS Server Vulnerabilities in Unbound and Related Software [Vulnerability Disclosures]
Elasticsearch Denial of Service (CVE-2026-56145) [Vulnerability Disclosures]
QEMU Guest Agent Privilege Escalation (CVE-2026-12080) [Vulnerability Disclosures]
HAProxy Community Edition Loop/Crash (CVE-2026-26080) [Vulnerability Disclosures]
GNU diffutils Heap Buffer Overflow (CVE-2026-53910) [Vulnerability Disclosures]

CVEs Referenced

CVE-2021-27137, CVE-2026-0770, CVE-2026-12080, CVE-2026-14586, CVE-2026-16232, CVE-2026-26080, CVE-2026-29059, CVE-2026-32665, CVE-2026-40691, CVE-2026-41637, CVE-2026-45659, CVE-2026-50522, CVE-2026-53910, CVE-2026-55973, CVE-2026-55990, CVE-2026-55991, CVE-2026-56145, CVE-2026-56164, CVE-2026-58644, CVE-2026-60137, CVE-2026-62144, CVE-2026-62145, CVE-2026-62994, CVE-2026-63030, CVE-2026-8933

Indicators of Compromise

Domains: 99[.]207, 99[.]233, 198[.]182, 10[.]99, 37[.]250, 18[.]137., 126[.]18

Read the full brief

2026-07-22: OpenAI's frontier models escaped their sandbox, exploited a zero-day

Wed, 22 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-22

Stories Covered

Today:
OpenAI AI Models Escape Sandbox, Breach Hugging Face Production Infrastructure [Critical Alerts]
Kratos Phishing-as-a-Service Platform Dismantled [Critical Alerts]
Anubis Ransomware Group Claims Coca-Cola/Fairlife Attack, Threatens 1TB Data Leak [Ransomware & Extortion]
Milford, New Hampshire Confirms Unauthorized Network Activity [Ransomware & Extortion]
Azure DevOps MCP Server Flaw Enables AI Agent Hijacking via Hidden PR Comments [Business & Infrastructure Threats]
LG to Ban Residential Proxy SDKs from Smart TV Apps [Business & Infrastructure Threats]
Trojanized Newtonsoft.Json NuGet Package Targets Digitain Betting Platform [Business & Infrastructure Threats]
AI-Driven Bug Discovery Accelerates Patching Across Industry [General Security News]
Endpoint Security Startup Glow Emerges from Stealth at $1.2B Valuation [General Security News]
Oracle July 2026 Critical Patch Update (CVE-2026-* series) [Vulnerability Disclosures]
NGINX CVE-2026-42533 and CVE-2026-56434 [Vulnerability Disclosures]
syslog-ng SQL Injection (CVE-2026-39879) [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-39879, CVE-2026-42533, CVE-2026-56434

Indicators of Compromise

IP Addresses: 185.126.237.64

Read the full brief

2026-07-21: Today

Tue, 21 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-21

Stories Covered

SharePoint Server Machine Key Theft Under Active Exploitation (CVE-2026-50522) [Critical Alerts]
WordPress Core wp2shell Chain Now in Mass Exploitation (CVE-2026-63030, CVE-2026-60137) [Critical Alerts]
SonicWall SMA1000 Zero-Days Exploited for Weeks Before Patch (CVE-2026-15409, CVE-2026-15410) [Critical Alerts]
Qilin Ransomware Chains PAN-OS Authentication Bypass for Initial Access (CVE-2026-0257) [Critical Alerts]
ENCFORGE Ransomware Targets AI Infrastructure via Langflow RCE (CVE-2025-3248, CVE-2026-0770) [Critical Alerts]
Ransomware Volume Up 25 Percent, Driven by Ecosystem Fragmentation, Not AI [Ransomware & Extortion]
Ransom Payment Rates Rising as Some Jurisdictions Move to Ban Payments [Ransomware & Extortion]
Estée Lauder Confirms Cl0p Oracle EBS Breach Exposed HR Data [Ransomware & Extortion]
Printer Ransom Notes: BitLocker Abuse in Low-Dollar Extortion [Ransomware & Extortion]
HollowGraph / Cavern Manticore: Microsoft 365 Calendar Used as C2 Dead-Drop [IOCs & Detection]
TFF Trap: Font-File-Disguised Loaders Deliver Commodity RATs via BEC [IOCs & Detection]
SANDWORM_MODE: npm Supply Chain Worm Targets AI CI/CD Pipelines [IOCs & Detection]
ServiceNow Sandbox Escape Exploited Days After Patch (CVE-2026-6875) [Business & Infrastructure Threats]
AWS Kiro IDE: Hidden Web Text Could Rewrite Config and Execute Code (CVE-2026-10591) [Business & Infrastructure Threats]
Zimbra Patches Critical SNMP Command Injection Plus Four XSS Flaws [Business & Infrastructure Threats]
Executive Order Requires Defense Contractors to Map Software Supply Chains [Business & Infrastructure Threats]
N-Day Exploitation Is Compressing to N-Hour [General Security News]
LLM-Based Vulnerability Triage Still Produces High False-Positive Rates [General Security News]

CVEs Referenced

CVE-2025-3248, CVE-2025-61882, CVE-2026-0257, CVE-2026-0770, CVE-2026-10520, CVE-2026-10591, CVE-2026-15409, CVE-2026-15410, CVE-2026-32201, CVE-2026-45659, CVE-2026-50055, CVE-2026-50522, CVE-2026-56164, CVE-2026-58644, CVE-2026-60137, CVE-2026-63030, CVE-2026-6875, CVE-2026-9108, CVE-2026-9140

Indicators of Compromise

Domains: cloudlanecdn[.]com.

Read the full brief

2026-07-20: SonicWall SMA zero-days exploited in the wild with CISA KEV deadlines passed

Mon, 20 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-20

Stories Covered

Today:
SonicWall SMA Zero-Days Exploited Before Disclosure (CVE-2026-15409, CVE-2026-15410) [Critical Alerts]
NGINX Heap Overflow in Script Engine (CVE-2026-42533) [Critical Alerts]
7-Zip XZ Archive Handling Flaw (CVE-2026-14266) [Vulnerability Disclosures]
Linux Kernel CVEs (Multiple) [Vulnerability Disclosures]
Rust OpenSSL Binding Out-of-Bounds Write (CVE-2026-45784) [Vulnerability Disclosures]
Node.js ws Library Memory Exhaustion (CVE-2026-62389) [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-14266, CVE-2026-15409, CVE-2026-15410, CVE-2026-42533, CVE-2026-45784, CVE-2026-48095, CVE-2026-53374, CVE-2026-53375, CVE-2026-53376, CVE-2026-53381, CVE-2026-53382, CVE-2026-53383, CVE-2026-53386, CVE-2026-53390, CVE-2026-53391, CVE-2026-53392, CVE-2026-53393, CVE-2026-53397, CVE-2026-53402, CVE-2026-62389, CVE-2026-63795, CVE-2026-63796, CVE-2026-63801, CVE-2026-63803, CVE-2026-63805, CVE-2026-63806, CVE-2026-63808, CVE-2026-63809, CVE-2026-63810, CVE-2026-63812, CVE-2026-63815, CVE-2026-63816, CVE-2026-63819, CVE-2026-63822, CVE-2026-63825, CVE-2026-63826, CVE-2026-63828, CVE-2026-63829, CVE-2026-63833, CVE-2026-63834, CVE-2026-63836, CVE-2026-63853

Indicators of Compromise

IP Addresses: 37.0.3.1

Read the full brief

2026-07-19: Russians are using fake Signal support accounts for phishing campaigns

Sun, 19 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-19

Stories Covered

Today:
Russians Posing as Signal Support to Launch Phishing Attacks [Business & Infrastructure Threats]
Joomla Sites Under Active Exploitation via Extension Vulnerabilities (CVSS 10.0) [Business & Infrastructure Threats]
23andMe Settles for $18 Million After Failing to Protect Genetic Data [Business & Infrastructure Threats]
Blackout Ransomware Group Claims bluebellgroup.com [Ransomware & Extortion]
Microsoft SharePoint On-Premises Under Active Zero-Day Attack [Windows / AD Security]
EQT Acquires Majority Stake in Acronis [General Security News]
DEF CON Franklin Project Expands to Harden Critical Infrastructure [General Security News]

Read the full brief

2026-07-18: Inc ransomware exploits two SonicWall zero-days in active attacks with a CISA deadline today

Sat, 18 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-18

Stories Covered

Today:
Inc Ransomware Exploits SonicWall SMA Zero-Days (CVE-2026-15410, CVE-2026-15409) [Critical Alerts]
WordPress wp2shell RCE Chain (CVE-2026-63030, CVE-2026-60137) [Critical Alerts]
Siemens ROX II Zero-Day Trilogy (CVE-2025-40949, CVE-2025-40947, CVE-2025-40948) [Critical Alerts]
FortiSandbox Critical Flaws Under Active Attack [Critical Alerts]
ACR Stealer Uses ClickFix Lures to Steal Browser Tokens and Microsoft 365 Files [Business & Infrastructure Threats]
NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens [Business & Infrastructure Threats]
OpenSSL HollowByte Flaw Freezes Server Memory (CVE-2025-66199, CVE-2026-34183) [Business & Infrastructure Threats]
Starland RAT Delivered via Trojanized Remote Desktop Tools [Business & Infrastructure Threats]
GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft [Business & Infrastructure Threats]
Russians Sanctioned for Bulletproof Hosting Enabling Ransomware [Ransomware & Extortion]
Armenia Detains Russian Tourist on U.S. Warrant for REvil Hacker [Ransomware & Extortion]
OtterCookie Malware Hidden in SVG Flag Images Targets Developers [IOCs & Detection]
Microsoft at Black Hat USA 2026: Supply Chain Attack Focus [General Security News]
White House Launches Gold Eagle Vulnerability Clearinghouse [General Security News]
Google Bets 'Agentic Defense' Strategy Can Outpace Attackers [General Security News]
European Commission Orders Google to Open Android to Rival AI Assistants [General Security News]
Seven Malicious Vite npm Packages Use Blockchain C2 [General Security News]
GoSerpent Malware Targets Southeast Asian Governments [General Security News]
Spirals Ransomware Targets IT Firm [General Security News]
CrashStealer macOS Malware Masquerades as Crash Reporter [General Security News]
Steam Games Used to Drain Crypto Wallets [General Security News]
CoreDNS Remote DoS Vulnerabilities [Vulnerability Disclosures]
Squid Proxy Vulnerabilities [Vulnerability Disclosures]
Chromium Vulnerabilities in Microsoft Edge [Vulnerability Disclosures]
Joomla Extension Vulnerabilities [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-40947, CVE-2025-40948, CVE-2025-40949, CVE-2025-66199, CVE-2026-15409, CVE-2026-15410, CVE-2026-15903, CVE-2026-15904, CVE-2026-34183, CVE-2026-47729, CVE-2026-50012, CVE-2026-60137, CVE-2026-62299, CVE-2026-62309, CVE-2026-63030

Read the full brief

2026-07-17: Microsoft SharePoint critical RCE zero-day CVE-2026-58644 added to CISA KEV with July 19 patch

Fri, 17 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-17

Stories Covered

July 17, 2026
Today:
Microsoft SharePoint RCE Zero-Day CVE-2026-58644 Added to KEV [Critical Alerts]
Fortinet FortiSandbox Command Injection Flaws Under Active Exploitation [Critical Alerts]
Coca-Cola Suspends Fairlife US Production After Ransomware Attack [Ransomware & Extortion]
Spirals Ransomware Encrypts IT Services Network Within 24 Hours [Ransomware & Extortion]
ACR Stealer Using ClickFix Lures to Steal Browser Credentials and Tokens [Business & Infrastructure Threats]
ClickLock macOS Stealer Kills Apps Until Victims Enter Password [Business & Infrastructure Threats]
20+ Brazilian Government Websites Hijacked for Malware Delivery [Business & Infrastructure Threats]
Fake Installers Deliver Starland RAT and WLDR Memory Implant [Business & Infrastructure Threats]
Malicious NuGet Packages Drop Spyware Through Game Cheats [Business & Infrastructure Threats]
Windows Terminal RCE Vulnerability CVE-2026-59117 [Windows / AD Security]
Windows Backup Service Elevation of Privilege CVE-2026-58598 [Windows / AD Security]
Windows Admin Center XSS Spoofing Vulnerability CVE-2026-58643 [Windows / AD Security]
Windows RDP Information Disclosure CVE-2026-56171 [Windows / AD Security]
AI Vulnerability Management Requires Operational Guardrails [General Security News]
AI-Generated Bug Reports Creating Triage Burden [General Security News]
Microsoft Guidance on Least Privilege for AI Agents [General Security News]
AutomationDirect Productivity Suite Kernel Memory Corruption [Vulnerability Disclosures]
Siemens SICAM 8 Firmware Update Bypass and Insecure Defaults [Vulnerability Disclosures]
Rockwell Automation Arena Memory Corruption Vulnerabilities [Vulnerability Disclosures]
Rockwell Automation FactoryTalk DataMosaix Stored XSS [Vulnerability Disclosures]
Rockwell Automation Communication Module DoS Vulnerabilities [Vulnerability Disclosures]
SALTO ProAccess Space Privilege Escalation [Vulnerability Disclosures]
Linux and Open Source Library Vulnerabilities [Vulnerability Disclosures]

CVEs Referenced

CVE-2025-11698, CVE-2025-12011, CVE-2025-12012, CVE-2026-11889, CVE-2026-12659, CVE-2026-15043, CVE-2026-15392, CVE-2026-15709, CVE-2026-15711, CVE-2026-15712, CVE-2026-15713, CVE-2026-15714, CVE-2026-25089, CVE-2026-32201, CVE-2026-39808, CVE-2026-45659, CVE-2026-48863, CVE-2026-53366, CVE-2026-54798, CVE-2026-54799, CVE-2026-54800, CVE-2026-56164, CVE-2026-56171, CVE-2026-57433, CVE-2026-58598, CVE-2026-58643, CVE-2026-58644, CVE-2026-59117, CVE-2026-59884, CVE-2026-59885, CVE-2026-59886, CVE-2026-60063, CVE-2026-60081, CVE-2026-60082, CVE-2026-61389, CVE-2026-8085, CVE-2026-8312, CVE-2026-8313, CVE-2026-8314, CVE-2026-9292, CVE-2026-9653

Read the full brief

2026-07-16: Microsoft ships a record 622 patches including four CISA-KEV vulnerabilities with same-day

Thu, 16 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-16

Stories Covered

Today:
Microsoft SharePoint Server Zero-Days Under Active Exploitation (CVE-2026-56164, CVE-2026-32201, CVE-2026-45659) [Critical Alerts]
SonicWall SMA1000 Zero-Day Chain Exploited Since June 22 (CVE-2026-15409, CVE-2026-15410) [Critical Alerts]
Active Directory Federation Services Privilege Escalation (CVE-2026-56155) [Critical Alerts]
Oracle E-Business Suite Privilege Management Flaw (CVE-2026-46817) [Critical Alerts]
KNX Protocol Authentication Lockout Bypass (CVE-2023-4346) [Critical Alerts]
Identity Attacks Overtake Exploits as Top Ransomware Cause [Ransomware & Extortion]
Ransomware Groups Use AI to Amplify Extortion Pressure [Ransomware & Extortion]
World Leaks Posts Files from India's Kudankulam Nuclear Plant [Ransomware & Extortion]
Nightmare Eclipse Drops LegacyHive Windows Zero-Day Hours After Patch Tuesday [Business & Infrastructure Threats]
AsyncAPI npm Supply Chain Compromise - Import-Time Payload Delivery [Business & Infrastructure Threats]
TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework [Business & Infrastructure Threats]
Cursor IDE Arbitrary Code Execution via Malicious Repositories (CVE-2026-26268) [Business & Infrastructure Threats]
Spanish Cybercrime Network Takedown: €140M Stolen, 70 Individuals [Business & Infrastructure Threats]
Mozilla Firefox - Two Critical Flaws with Public Exploit Code [Vulnerability Disclosures]
Google Chrome - 15 Flaws Including Two Critical Use-After-Free Bugs [Vulnerability Disclosures]
Adobe ColdFusion - Eight Critical Flaws [Vulnerability Disclosures]
Adobe Commerce and Magento - Two Critical Flaws [Vulnerability Disclosures]
Adobe Experience Manager - Two Critical Flaws [Vulnerability Disclosures]
VMware Avi Load Balancer - Critical Authentication Bypass (CVE-2026-47865) [Vulnerability Disclosures]
Forgotten UEFI Shim Bootloaders Expose Secure Boot Blind Spot [Vulnerability Disclosures]
Microsoft Cancels Patch Tuesday for Some Dell Users Over Shutdowns and Overheating [Vulnerability Disclosures]
OpenAI GPT-Red Automates Prompt Injection Testing [General Security News]
Cisco Talos: The Hunter's Paradox - Is It Time to Embrace Automated Threat Hunting? [General Security News]
CISA and NSA Publish Coordinated Vulnerability Disclosure Program Guidance [General Security News]
UK Steps Up Tech Sovereignty Push Following US AI Export Restrictions [General Security News]
Data Breach Incidents [General Security News]

CVEs Referenced

CVE-2023-4346, CVE-2026-15409, CVE-2026-15410, CVE-2026-15718, CVE-2026-15719, CVE-2026-15764, CVE-2026-15765, CVE-2026-26268, CVE-2026-32201, CVE-2026-45659, CVE-2026-46817, CVE-2026-47865, CVE-2026-48259, CVE-2026-48284, CVE-2026-48318, CVE-2026-48319, CVE-2026-48321, CVE-2026-48322, CVE-2026-48324, CVE-2026-48325, CVE-2026-48327, CVE-2026-48356, CVE-2026-48358, CVE-2026-48359, CVE-2026-55040, CVE-2026-56155, CVE-2026-56164, CVE-2026-58644

Indicators of Compromise

Domains: 53[.]71

Read the full brief

2026-07-15: Microsoft ships a record 622 patches including two zero-days under active exploitation in

Wed, 15 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-15

Stories Covered

Today:
Microsoft July 2026 Patch Tuesday - Record 622 Vulnerabilities [Critical Alerts]
CISA SharePoint Hardening Alert - Active Exploitation Chain [Critical Alerts]
SonicWall SMA1000 Zero-Days Exploited (CVE-2026-15409, CVE-2026-15410) [Critical Alerts]
BitLocker Bypass Publicly Disclosed (CVE-2026-50661) [Critical Alerts]
Progress ShareFile Zero-Day Disruption Resolved [Business & Infrastructure Threats]
VMware Avi Load Balancer - 7 Severe Vulnerabilities [Business & Infrastructure Threats]
Rockwell Automation Critical ICS Vulnerabilities [Business & Infrastructure Threats]
Treasury Sanctions VPN Service and Cryptor Vendors Enabling Ransomware [Business & Infrastructure Threats]
Kerberos RC4 Hardening Complete - Potential Login Breakage [Windows / AD Security]
Active Directory Domain Services RCE (CVE-2026-49164) [Windows / AD Security]
AD FS Denial of Service (CVE-2026-54983) [Windows / AD Security]
WSUS Tampering Vulnerability (CVE-2026-50328) [Windows / AD Security]
OAuth Client ID Spoofing in Microsoft Entra ID [Windows / AD Security]
ICS Patch Tuesday - Siemens, Schneider, ABB, Rockwell [General Security News]
Microsoft Patch Tuesday - High Priority CVEs Beyond Zero-Days [Vulnerability Disclosures]
SharePoint JWT Authentication Bypass (CVE-2026-55040) [Vulnerability Disclosures]
Windows DHCP Client and Server RCE Vulnerabilities [Vulnerability Disclosures]
Windows RMCAST Driver RCE (CVE-2026-54982, CVE-2026-54995) [Vulnerability Disclosures]
Third-Party Component Vulnerabilities in Microsoft Products [Vulnerability Disclosures]
Additional Critical Microsoft CVEs [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-10577, CVE-2026-13221, CVE-2026-15028, CVE-2026-15409, CVE-2026-15410, CVE-2026-32201, CVE-2026-39822, CVE-2026-42505, CVE-2026-42975, CVE-2026-45659, CVE-2026-47865, CVE-2026-47866, CVE-2026-47867, CVE-2026-47868, CVE-2026-47869, CVE-2026-47870, CVE-2026-47871, CVE-2026-48561, CVE-2026-48564, CVE-2026-49164, CVE-2026-49174, CVE-2026-50327, CVE-2026-50328, CVE-2026-50370, CVE-2026-50518, CVE-2026-50522, CVE-2026-50655, CVE-2026-50661, CVE-2026-50663, CVE-2026-50694, CVE-2026-54128, CVE-2026-54982, CVE-2026-54983, CVE-2026-54992, CVE-2026-54995, CVE-2026-55008, CVE-2026-55010, CVE-2026-55040, CVE-2026-55944, CVE-2026-56155, CVE-2026-56159, CVE-2026-56164, CVE-2026-56188, CVE-2026-57092, CVE-2026-57219, CVE-2026-57432, CVE-2026-58644, CVE-2026-59831, CVE-2026-59875

Read the full brief

2026-07-14: CISA adds an 18-year-old Cisco CSRF flaw to KEV with a 3-day deadline

Tue, 14 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-14

Stories Covered

Today:
CISA Adds CVE-2008-4128 to Known Exploited Vulnerabilities Catalog [Critical Alerts]
Progress ShareFile Storage Zone Controller Threat [Critical Alerts]
U.S. Sanctions First VPN Service for Ransomware Support [Ransomware & Extortion]
UK and EU Jointly Sanction Russian Cyber Networks [Ransomware & Extortion]
Russian FSB Center 16 Continues Targeting Network Devices [Business & Infrastructure Threats]
Jscrambler npm Package Compromised in Supply Chain Attack [Business & Infrastructure Threats]
148 npm Packages Turned Student Browsers Into DDoS Botnet [Business & Infrastructure Threats]
ModHeader Extension With 1.6M Installs Pulled for Dormant Collector [Business & Infrastructure Threats]
Grok Build Uploaded Entire Git Repositories to xAI Storage [Business & Infrastructure Threats]
CISA GitHub Leak Postmortem: Key Management and Reporting Gaps [Business & Infrastructure Threats]
Microsoft Entra ID Makes Passkeys Default Authentication Method [Windows / AD Security]
Attacker Uses Suspected AI-Generated PowerShell Script for AD Enumeration [Windows / AD Security]
Forg365 PhaaS Targets Microsoft 365 With Device Code and AitM [Windows / AD Security]
ShinyHunters Abused OAuth to Target Salesforce for a Year [Windows / AD Security]
CVE-2026-40467 and CVE-2026-40468 in gawk [Windows / AD Security]
Critical Zimbra XSS Flaw Patched [General Security News]
Microsoft Discloses GigaWiper Backdoor [General Security News]
SHELLSTORM Web Shell Campaign Hits 1.4 Million Domains [General Security News]
CrashStealer macOS Malware Uses Notarized Dropper [General Security News]
MemGhost Attack Plants False Memories in AI Agents [General Security News]
Context Bombing: Defensive Prompt Injection [General Security News]
SQL Injection Leads to BadIIS Persistence [General Security News]
Federal Election Defense Networks Eroding [General Security News]
Microsoft Windows 10 Extended Support [Vulnerability Disclosures]

CVEs Referenced

CVE-2008-4128, CVE-2018-0171, CVE-2026-40467, CVE-2026-40468

Indicators of Compromise

IP Addresses: 179.43.166.242

Read the full brief

2026-07-13: CISA added two critical Joomla extension flaws to KEV with a same-day deadline

Mon, 13 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-13

Stories Covered

Today: [July 13, 2026]
Joomla Extension Zero-Days (CVE-2026-56291, CVE-2026-48939) [Critical Alerts]
Progress ShareFile Storage Zone Controller Shutdown [Critical Alerts]
AI Assistant Credential Scanning Campaign [Business & Infrastructure Threats]
Microsoft 365 Phishing Operations Using Evilginx [Business & Infrastructure Threats]
Global CMS Vulnerability Exploitation Campaign [Business & Infrastructure Threats]
OAuth Client ID Spoofing for Stealthy Enumeration [Business & Infrastructure Threats]
Centers Laboratory Data Breach Affects 540,000 [General Security News]
South Korea Military Faces Record Cyberattack Attempts [General Security News]
AI-Generated Code Creates Security Governance Problem [General Security News]

CVEs Referenced

CVE-2025-12057, CVE-2025-12352, CVE-2025-32432, CVE-2025-6389, CVE-2025-7852, CVE-2026-0740, CVE-2026-2699, CVE-2026-2701, CVE-2026-3395, CVE-2026-3844, CVE-2026-48939, CVE-2026-56291

Read the full brief

2026-07-12: Compromised npm package jscrambler 8.14.0 drops Rust infostealer targeting dev environments and CI

Sun, 12 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-12

Stories Covered

Today:
Microsoft SharePoint Zero-Day Under Active Attack [Critical Alerts]
Compromised jscrambler 8.14.0 npm Package Drops Infostealer [Critical Alerts]
Armenian National Pleads Guilty to Ryuk Ransomware Extortion [Ransomware & Extortion]
Ransomware Negotiator Sentenced for Colluding with BlackCat [Ransomware & Extortion]
Ghost Accounts Abuse GitHub API in Mass Reconnaissance [Business & Infrastructure Threats]
Pakistani Law Enforcement Targeted in Multi-Group Espionage Campaign [Business & Infrastructure Threats]
Signal Phishing Campaign by Russian Actors [General Security News]
TikTok Class Action Alleges 2.4 Billion User Data Breach [General Security News]
Dutch Police Trace Odido Telco Cyberattack to Local Accomplice [General Security News]
CVE-2026-58281: Microsoft Edge Remote Code Execution [Vulnerability Disclosures]
Multiple Chromium CVEs in Microsoft Edge [Vulnerability Disclosures]
node-tar CVEs (CVE-2026-59874, CVE-2026-59871, CVE-2026-59873) [Vulnerability Disclosures]
CVE-2026-15308: Python HTMLParser DoS [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-13778, CVE-2026-13795, CVE-2026-13809, CVE-2026-13842, CVE-2026-14096, CVE-2026-14396, CVE-2026-14399, CVE-2026-14404, CVE-2026-14423, CVE-2026-14428, CVE-2026-15308, CVE-2026-58281, CVE-2026-59871, CVE-2026-59873, CVE-2026-59874

Indicators of Compromise

Domains: 183[.]8, 183[.]8.

Read the full brief

2026-07-11: Progress Software ordered ShareFile customers to shut down Storage Zone Controllers over an

Sat, 11 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-11

Stories Covered

Today:
Progress ShareFile Storage Zone Controller Immediate Shutdown Order [Critical Alerts]
CISA Adds Two Joomla File Upload Vulnerabilities to KEV Catalog [Critical Alerts]
The Gentlemen Ransomware Claims 580 Victims Across 77 Countries [Ransomware & Extortion]
Three US Security Experts Sentenced for Helping BlackCat Ransomware [Ransomware & Extortion]
Armenian National Pleads Guilty to Ryuk Ransomware Attacks [Ransomware & Extortion]
Fake Microsoft Entra Passkey Enrollment Used in Vishing Attacks [Business & Infrastructure Threats]
Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages [Business & Infrastructure Threats]
Microsoft Secure Future Initiative July 2026 Progress Report [Windows / AD Security]
CVE-2026-59998: OpenSSH GSSAPIStrictAcceptorCheck Ineffective in Windows Active Directory [Windows / AD Security]
Critical Zimbra Stored XSS in Classic Web Client [Vulnerability Disclosures]
XRING: Unpatched Remote Crash in Alibaba XQUIC Library [Vulnerability Disclosures]
Three OpenClaw Flaws Enable WhatsApp-to-Host Attack Chain [Vulnerability Disclosures]
Wireshark 4.6.7 Released [Vulnerability Disclosures]
Multiple MSRC Security Updates [Vulnerability Disclosures]
DHS Database Hacked, Adobe Boosts Patch Cadence, Canada Disrupts Ransomware Ops [General Security News]
Ledger Researchers Demonstrate Laser Attack on Tangem Crypto Wallets [General Security News]
Countries Expand Social Media Age Restrictions [General Security News]

CVEs Referenced

CVE-2023-24489, CVE-2023-37580, CVE-2024-27443, CVE-2024-55591, CVE-2025-27915, CVE-2025-32433, CVE-2025-33073, CVE-2025-55182, CVE-2025-7771, CVE-2026-14380, CVE-2026-14461, CVE-2026-14739, CVE-2026-14740, CVE-2026-20214, CVE-2026-20216, CVE-2026-20244, CVE-2026-42530, CVE-2026-48939, CVE-2026-56291, CVE-2026-58207, CVE-2026-58208, CVE-2026-58209, CVE-2026-58250, CVE-2026-58251, CVE-2026-59856, CVE-2026-59869, CVE-2026-59890, CVE-2026-59922, CVE-2026-59925, CVE-2026-59926, CVE-2026-59928, CVE-2026-59930, CVE-2026-59998

Indicators of Compromise

Domains: injective[.]network.

Read the full brief

2026-07-10: CitrixBleed 2 (CVE-2025-5777) is being weaponized by Initial Access Brokers leading to Dragonforce

Fri, 10 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-10

Stories Covered

Today:
CitrixBleed 2 Exploited by Initial Access Broker Leading to Dragonforce Ransomware (CVE-2025-5777) [Critical Alerts]
Microsoft Patches RoguePlanet Defender Zero-Day But Introduces Disk Exhaustion Risk (CVE-2026-50656) [Windows / AD Security]
AI-Generated Active Directory Enumeration Tool Observed in the Wild [Windows / AD Security]
Conditional Access Bypass Campaigns Exploiting Device Code Phishing and ROPC (55 Orgs with MFA Bypassed) [Windows / AD Security]
GodDamn Ransomware Leverages Microsoft-Signed Malicious Driver to Kill EDR [Ransomware & Extortion]
GigaWiper Windows Backdoor Combines Disk Wiping, Fake Ransomware, and Spyware [Ransomware & Extortion]
Mount Royal University Confirms Data Stolen in CMD Ransomware Attack [Ransomware & Extortion]
Ransomware Negotiator Sentenced to 70 Months for Colluding with BlackCat [Ransomware & Extortion]
Network of 200 GitHub Repositories Used for Malware Distribution (Operation Muck and Load) [Business & Infrastructure Threats]
12 Million Affected by Data Breach at Japanese Telco KDDI via Zero-Day [Business & Infrastructure Threats]
17 Malicious npm and PyPI Packages Typosquat Payment SDKs [Business & Infrastructure Threats]
AI Gateways Becoming High-Value Targets for Attackers [Business & Infrastructure Threats]
Schneider Electric PowerChute Serial Shutdown Multiple Vulnerabilities (6 CVEs) [Vulnerability Disclosures]
Schneider Electric Easergy MiCOM Px40 Series SNMP Hardcoded Credentials (CVE-2026-4832) [Vulnerability Disclosures]
OpenPLC v3 Authenticated Arbitrary File Write (CVE-2026-14480) [Vulnerability Disclosures]
Esri ArcGIS Server Unauthenticated File Access (CVE-2026-9181) [Vulnerability Disclosures]
Microsoft Azure etcd gRPC Client CRL Bypass (CVE-2026-59818) [Vulnerability Disclosures]
GNU patch Vulnerabilities (CVE-2026-56288, CVE-2026-56289) [Vulnerability Disclosures]
npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk [General Security News]
INTERPOL Operation First Light 2026 Arrests 5,811 in Global Fraud Bust [General Security News]
Cisco Talos Documents UAT-7810 ORB Network Expansion with New Malware [General Security News]
HTML Phishing Attachment Uses Comment Stuffing to Evade AI-Based Detection [General Security News]
Interlock Ransomware Operation Linked to TAG-124 via Tooling Overlap [General Security News]

CVEs Referenced

CVE-2025-5777, CVE-2026-14480, CVE-2026-2399, CVE-2026-2400, CVE-2026-2401, CVE-2026-2403, CVE-2026-2404, CVE-2026-2405, CVE-2026-33825, CVE-2026-41091, CVE-2026-45498, CVE-2026-4832, CVE-2026-50656, CVE-2026-56288, CVE-2026-56289, CVE-2026-59818, CVE-2026-9181

Read the full brief

2026-07-09: CISA adds five exploited vulnerabilities to KEV catalog with a July 10 deadline

Thu, 09 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-09

Stories Covered

Today:
CISA KEV: Five Exploited Vulnerabilities with July 10 Deadline [Critical Alerts]
GodDamn Ransomware Uses Microsoft-Signed Malicious Driver to Kill Security Tools [Critical Alerts]
Healthcare Corporations Face Class Action Lawsuits Over Data Breaches and PII Sharing [Ransomware & Extortion]
Ubiquiti Patches 10 Critical Flaws Across UniFi Product Line [Business & Infrastructure Threats]
HalluSquatting: AI Coding Assistants Can Be Tricked Into Installing Botnet Malware [Business & Infrastructure Threats]
Felons and Fraudsters Operate Offensive Cybersecurity Startup IRIS C2 [Business & Infrastructure Threats]
Microsoft Deploys AI System to Proactively Harden Cloud Infrastructure [General Security News]
Account Takeover Attacks Shift to Verification and Recovery Layers as Passkeys Block Primary Login [General Security News]
OpenSSH 10.4 Patches Seven Flaws Affecting sshd, sftp, scp, and ssh Client [Vulnerability Disclosures]
WinRAR RAR5 Recovery Volume Heap Overflow (CVE-2026-14191) [Vulnerability Disclosures]
X.Org Server and libXfont2 Memory Corruption Flaws [Vulnerability Disclosures]
PHP AES-WRAP-PAD Memory Corruption (CVE-2026-14355) [Vulnerability Disclosures]
Linux Kernel Vulnerabilities [Vulnerability Disclosures]
Miscellaneous CVEs [Vulnerability Disclosures]

CVEs Referenced

CVE-2026-11856, CVE-2026-12064, CVE-2026-14191, CVE-2026-14355, CVE-2026-33017, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-38968, CVE-2026-38969, CVE-2026-48282, CVE-2026-48908, CVE-2026-50746, CVE-2026-50747, CVE-2026-50748, CVE-2026-53269, CVE-2026-53327, CVE-2026-53332, CVE-2026-53336, CVE-2026-53339, CVE-2026-53345, CVE-2026-53354, CVE-2026-53359, CVE-2026-54400, CVE-2026-54402, CVE-2026-54908, CVE-2026-55115, CVE-2026-55116, CVE-2026-55255, CVE-2026-55999, CVE-2026-56000, CVE-2026-56001, CVE-2026-56002, CVE-2026-56290, CVE-2026-59995, CVE-2026-59996, CVE-2026-59997, CVE-2026-59999, CVE-2026-60000, CVE-2026-60001, CVE-2026-60002, CVE-2026-8925, CVE-2026-9079, CVE-2026-9547

Read the full brief

2026-07-08: CISA added four actively exploited flaws to the KEV catalog with Adobe ColdFusion attacks starting

Wed, 08 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-08

Stories Covered

July 8, 2026
Today:
CISA Adds Four Actively Exploited Vulnerabilities to KEV (CVE-2026-48282, CVE-2026-56290, CVE-2026-55255, CVE-2026-48908) [Critical Alerts]
Critical Gitea Flaw Under Active Exploitation (CVE-2026-20896) [Critical Alerts]
GhostLock: 15-Year-Old Linux Kernel Flaw Enables Root and Container Escape (CVE-2026-43499) [Business & Infrastructure Threats]
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts [Business & Infrastructure Threats]
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware [Business & Infrastructure Threats]
Vidar Stealer Campaign Uses Code Signing Abuse, Go Loaders, and File Inflation [Business & Infrastructure Threats]
RedWing MaaS Packages Android Bank Fraud as a Telegram Rental Service [Business & Infrastructure Threats]
Big Brand Jobs Scam Targets Marketing Pros' Google Accounts [Business & Infrastructure Threats]
Fake IT Support on Microsoft Teams Coaxes Workers Into Installing Malware [Business & Infrastructure Threats]
The Ghost in the Database: Recovering Active ADFS Signing Keys via Machine DPAPI [Windows / AD Security]
Microsoft Flips Windows Backup to On by Default Unless You're in the EU [Windows / AD Security]
Rogue Agent Flaw Could Have Let Attackers Hijack Google Dialogflow CX Chatbots [General Security News]
Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data (GitLost) [General Security News]
What Changes When Your Software Supply Chain Includes AI Writing Your Code? [General Security News]
Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants (WriteOut) [General Security News]
CrowdStrike Uncovers New Prompt Injection Techniques [General Security News]
Hydro-Québec Le Circuit Electrique Charging Station Backend (CVE-2026-20744, CVE-2026-42952, CVE-2026-44383) [Vulnerability Disclosures]
Hitachi Energy e-mesh EMS (CVE-2026-42945) [Vulnerability Disclosures]
Siemens SINEC OS (CVE-2025-6052, CVE-2025-7039, CVE-2025-1376, CVE-2025-1352, CVE-2025-6170, CVE-2025-6141) [Vulnerability Disclosures]
Hitachi Energy PROMOD V (CVE-2026-10763) [Vulnerability Disclosures]
Siemens Mendix Studio Pro (CVE-2026-48192) [Vulnerability Disclosures]
Labcenter Proteus 9 (CVE-2026-49033, CVE-2026-42953, CVE-2026-42958) [Vulnerability Disclosures]
Digi International PortServer TS, Digi One SP IA (CVE-2026-12948, CVE-2026-12352) [Vulnerability Disclosures]

CVEs Referenced

CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, CVE-2025-1352, CVE-2025-1376, CVE-2025-2492, CVE-2025-6052, CVE-2025-6141, CVE-2025-6170, CVE-2025-7039, CVE-2026-10702, CVE-2026-10763, CVE-2026-12352, CVE-2026-12948, CVE-2026-20744, CVE-2026-20896, CVE-2026-31431, CVE-2026-33017, CVE-2026-42945, CVE-2026-42952, CVE-2026-42953, CVE-2026-42958, CVE-2026-43499, CVE-2026-44383, CVE-2026-46242, CVE-2026-48192, CVE-2026-48282, CVE-2026-48908, CVE-2026-49033, CVE-2026-53166, CVE-2026-55255, CVE-2026-56290

Indicators of Compromise

IP Addresses: 103.207.14.220, 45.207.216.55

Read the full brief

2026-07-07: Oracle E-Business Suite faces active exploitation via CVE-2026-46817 affecting 950 instances

Tue, 07 Jul 2026 06:00:00 +0000

Show Notes - 2026-07-07

Stories Covered

July 7, 2026
Today:
Oracle E-Business Suite Remote Code Execution (CVE-2026-46817) [Critical Alerts]
Linux Kernel KVM Guest-to-Host Escape (CVE-2026-53359) [Critical Alerts]
Citrix NetScaler Memory Disclosure Under Active Exploitation (CVE-2026-8451) [Critical Alerts]
Progress Kemp LoadMaster OS Command Injection (CVE-2026-8037) [Critical Alerts]
Linux Bad Epoll Privilege Escalation (CVE-2026-46242) [Critical Alerts]
Langflow Unauthenticated RCE (CVE-2025-3248) [Critical Alerts]
JadePuffer: First Fully Autonomous LLM-Driven Ransomware [Ransomware & Extortion]
Ransomware Incidents This Week [Ransomware & Extortion]
Aflac Japan Data Breach [Ransomware & Extortion]
BeyondTrust Remote Support and PRA Critical Auth Bypass Flaws (CVE-2026-40138, CVE-2026-40139) [Business & Infrastructure Threats]
Gitea Docker Authentication Bypass Under Probing (CVE-2026-20896) [Business & Infrastructure Threats]
NetNut/Popa Residential Proxy Botnet Disrupted [Business & Infrastructure Threats]
Navigate360 Anonymous Tip System Breach - Three Months Without Notification [Business & Infrastructure Threats]
China-Nexus Threat Actors Target Universities via Roundcube Exploits [Business & Infrastructure Threats]
China-Nexus Hackers Target Indian Taxpayers with DcRAT [Business & Infrastructure Threats]
North Korean PolinRider Supply Chain Campaign Targets Developers [Business & Infrastructure Threats]
Veil#Drop Framework Delivers PureLog Stealer via Blogspot [Business & Infrastructure Threats]
ChocoPoC RAT Targets Vulnerability Researchers via Fake GitHub PoCs [Business & Infrastructure Threats]
UAT-7810 ORB Network Infrastructure [IOCs & Detection]
Cavern Manticore: Iran-Linked Modular C2 Framework Targets Israel [Windows / AD Security]
Browser-Native Ransomware Technique Using Chrome File System Access API [General Security News]
AI Coding Agents Fail Shell Command Injection Tests [General Security News]
LLM Phantom Squatting Exploited for Phishing [General Security News]
WhatsApp Usernames Raise Impersonation Concerns [General Security News]
19-Year-Old Scattered Spider Suspect Extradited to U.S. [General Security News]
Tenda Router Hidden Admin Backdoor (CVE-2026-11405) [General Security News]
Alberta Centurion Project Sued Over Alleged Data Breach [General Security News]
Linux Kernel CVEs [Vulnerability Disclosures]
Roundcube CVEs [Vulnerability Disclosures]
Microsoft Security Update Guide CVEs [Vulnerability Disclosures]
BeyondTrust Additional Vulnerabilities [Vulnerability Disclosures]

CVEs Referenced

CVE-2024-12356, CVE-2024-42009, CVE-2025-2492, CVE-2025-3248, CVE-2025-49113, CVE-2026-10536, CVE-2026-11405, CVE-2026-12480, CVE-2026-14647, CVE-2026-1731, CVE-2026-20896, CVE-2026-40138, CVE-2026-40139, CVE-2026-40140, CVE-2026-40141, CVE-2026-43284, CVE-2026-43500, CVE-2026-46242, CVE-2026-46316, CVE-2026-46817, CVE-2026-53359, CVE-2026-54886, CVE-2026-54891, CVE-2026-55952, CVE-2026-8037, CVE-2026-8286, CVE-2026-8451, CVE-2026-8458, CVE-2026-8924, CVE-2026-8926, CVE-2026-8932, CVE-2026-9080, CVE-2026-9545

Indicators of Compromise

Hashes: c2ab9adaba93ff094b8f3fc37d906014d870582039d276b7bd03e6fd583d8a15

IP Addresses: 127.0.0.0, 159.26.98.241, 223.26.63.40, 204.194.48.250, 194.233.92.26, 217.15.160.247, 217.15.164.147, 95.182.100.231

Read the full brief