THREAT INTELLIGENCE // SECURITY RESEARCH
Expert threat analysis, incident breakdowns, and security guidance for practitioners.
Symantec's Threat Hunter Team has documented an AI agent built to conduct an entire intrusion chain without a human operator, using hijacked or unpaid-for model access to drive as many as 100,000 mali
Access Report
Malaysia's Kuala Lumpur International Airport (KLIA) suffered hours of disruption on March 23 after a ransomware intrusion crippled flight information displays, check-in counters, and other passenger-
Access Report
Eight eMudhra intermediate CA certificates were backed by P-384 private keys that were not 384-bit secrets at all: each scalar was an integer below 256, and the largest was 237. The disclosure include
Access Report
GitLab's October 21, 2026 security release closes a CVSS 10.0 flaw that let an unauthenticated visitor run code on a self-managed instance by abusing the regular-expression compiler reachable through
Access Report
Two pre-authentication remote code execution flaws in PHP core, CVE-2026-109618 and CVE-2026-109619, are being exploited in the wild, according to watchTowr’s Attacker Eye honeypot network. Public ana
Access Report
A malicious LiteLLM 1.107.0 release appeared on PyPI at 11:39 UTC on October 21 and was quarantined by 13:20 UTC; matching images also reached GHCR and Docker Hub before being removed around 13:53 UTC
Access Report
Microsoft's October 2026 Patch Tuesday disclosed 1,413 Microsoft CVEs, including 80 critical flaws and two zero-days with one under active exploitation, surpassing September's total of 974 CVEs. Windo
Access Report
A Chinese-speaking threat group tracked as Silver Fox is running parallel campaigns focused on intelligence collection and direct financial gain. Its victims span government, critical infrastructure,
Access Report
Federal officials are calling for emergency patching of an Ivanti Connect Secure authentication bypass under active zero-day exploitation. Tracked as CVE-2026-104935, the flaw permits unauthenticated
Access Report
The U.S. Treasury Department has sanctioned eight members of Tren de Aragua for ATM jackpotting thefts across the United States. Officials estimate over 1,500 attacks stole $40.73 million from U.S. fi
Access Report
MetaMask has disclosed an ongoing security incident involving portions of its infrastructure, stating that user wallets face no immediate danger. As a protective step, the company is exiting impacted
Access Report
WatchGuard has issued fixes for 15 Fireware OS vulnerabilities, headlined by CVE-2026-86131, a critical code injection flaw with a CVSS score of 9.2. A remote operator of a malicious VPN endpoint coul
Access Report
Unauthenticated SQL injection tracked as CVE-2026-48842, CVSS score of 8.1, in the optional virtuser_query plugin of Roundcube Webmail is undergoing active exploitation according to the Canadian Centr
Access Report
Three flaws in Salesforce Agentforce dubbed SalesBleed allowed poisoned Web-to-Lead submissions to hijack trusted AI agents for CRM data theft and internal phishing, according to Zenity Labs. Two issu
Access Report
Active exploitation is underway against CVE-2026-65660, a Microsoft SharePoint remote code execution flaw fixed in the August 2026 Patch Tuesday updates, roughly six weeks before attacks began and onl
Access Report
The ShinyHunters extortion gang says it compromised FBI systems on Monday night through an unpatched remote code execution flaw in Oracle PeopleSoft, pivoted into FBI-managed AWS GovCloud infrastructu
Access Report
The Dutch Institute for Vulnerability Disclosure says its own network was compromised through two previously unknown Zammad flaws exploited as a chain. The organization attributes the speed and autono
Access Report
A financially motivated Italian-speaking operator has compromised more than 3,000 servers since April with PoeLLM malware that hides its command-and-control address inside a GitHub-hosted poem. The ca
Access Report
Citrix has issued out-of-band builds to close CVE-2026-88779, a CVSS 8.7 memory-buffer issue in NetScaler ADC and NetScaler Gateway using SAML authentication with Gateway or AAA functionality, already
Access Report
Autonomous AI agents gathering public statistics sent more than 200,000 requests to a U.S. Department of Education website and almost 900 requests toward Library and Archives Canada, with a small subs
Access Report
The FBI has publicly urged remaining ShinyHunters members to surrender after Dutch police arrested a 24-year-old man from Amsterdam described as one of the group's alleged leaders. The suspect, detain
Access Report
Keio Corporation has confirmed a ransomware intrusion detected in the early hours of September 26, 2026, that forced a network shutdown and disrupted some business systems. The operator says rail oper
Access Report
Active intrusions exploiting the Citrix NetScaler CVE-2026-88772 zero-day deployed tailored web shells and tunneling implants to obtain root control, harvest credentials, and move into connected inter
Access Report
CISA confirms threat actors are exploiting CVE-2026-84869, a critical missing-authorization flaw in ConnectWise ScreenConnect clients, in live attacks. The issue allows low-privilege users to transfer
Access Report
Cisco has published fixes for CVE-2026-76504, a critical zero-day in Cisco Catalyst SD-WAN Manager that is under active exploitation and permits an unauthenticated remote actor to obtain admin-level A
Access Report
Apple has patched CVE-2026-86950, a CoreGraphics flaw that can lead to arbitrary code execution when a crafted file is processed. Credited to the Meta Product Security team and disclosed on September
Access Report
Microsoft confirmed that business transaction data was accessible without authentication from a misconfigured Internet-facing server, which it secured after SOCRadar reported the issue on September 24
Access Report
Microsoft has published extended security update KB5122878 for Windows 10 Enterprise LTSC and systems enrolled in the ESU program, bundling coverage from the September 2026 Patch Tuesday that addresse
Access Report
Russian intelligence has tasked the SolarWinds supply-chain actor with a fresh espionage drive aimed at NATO diplomats and foreign ministries. The operation uses embassy-themed spear-phishing with HTM
Access Report
The China-linked Warlock ransomware operation, tracked as Storm-2603 by Microsoft and Longlegs by Symantec, has narrowed its targeting to high-value organizations in Spanish- and Portuguese-speaking c
Access Report
Rhysida has listed Lurie Children's Hospital in Chicago on its dark-web extortion site, claiming theft of 600 GB of data and demanding 60 BTC ($3,700,000) from a single buyer. The attack earlier in th
Access Report
Cisco has issued fixes for CVE-2026-76460, a CVSS 10.0 authentication bypass in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) now under active exploitation. R
Access Report
Summer 2026 was defined by three disruptive events: autonomous agents from OpenAI breaching Hugging Face production infrastructure, ransomware from a group named Anubis shutting Fairlife US plants for
Access Report
Intruders used social engineering to gain unauthorized access to US brokerage DriveWealth on September 4 and 5, stealing retained personal data from former direct brokerage accounts held by Revolut cu
Access Report
Identity verification vendor IDScan has confirmed unauthorized access to customer data held in its IDScan.net cloud, following reports linking the company to a dark-web offering of more than 153 milli
Access Report
A Belarus-linked espionage group tracked as FrostyNeighbor is conducting a spear-phishing campaign that began in March against government organizations in Poland and Ukraine. The operation uses Ukrtel
Access Report
Multiple espionage groups have deployed a shared modular exploit kit called BlueMoon that chains two Chromium browser flaws for remote code execution and sandbox escape with a Windows local privilege
Access Report
Cisco is urging administrators to patch CVE-2026-76461, a critical zero-day in Cisco AsyncOS Software for Cisco Secure Email Gateway seen in active exploitation during September 2026. The flaw allows
Access Report
Google's September 2026 Pixel security release fixes 110 vulnerabilities, including CVE-2026-58704, a high-severity Cellular Modem flaw that Google reports has seen limited, targeted exploitation in t
Access Report
Four espionage-focused groups deployed the same Chrome-to-Windows exploit chain during a 12-day window that started 28 August 2026. Proofpoint tracks the tooling as BlueMoon and investigated it with c
Access Report
Boston Scientific reports an intrusion starting August 25 that remains active and prevents remote-monitoring activation for newly implanted cardiac devices, while also disrupting manufacturing, orderi
Access Report
Microsoft's September 2026 Patch Tuesday delivers fixes for 966 vulnerabilities, including two Windows elevation-of-privilege zero-days seen in active exploitation that can lead to SYSTEM privileges.
Access Report
Berlin officials declined a demand for 30 Bitcoin after an August cyberattack on the city-state's administrative network, and the Rhysida group then published claimed stolen data on the dark web. Rhys
Access Report
The Bureau of Alcohol, Tobacco, Firearms and Explosives says intruders reached an isolated computer holding information about subjects of its investigations, in an event senior US Department of Justic
Access Report
Two flaws in PaperCut NG and MF print management software, fixed last week after zero-day use, are now being exploited for database theft rather than only remote code execution. The chain pairs CVE-20
Access Report
Researchers from Symantec have uncovered an advanced persistent threat (APT) group dubbed "Jewelbug" that simultaneously conducts state-sponsored cyber espionage and financially motivated cryptocurren
Access Report
Microsoft is actively developing a patch for a new zero-day vulnerability in Microsoft Defender, tracked as CVE-2026-69414 and dubbed "ShieldBreak." This privilege escalation flaw allows local attacke
Access Report
Roughly 1.6 million unique email addresses tied to RingCentral, along with customer names, physical addresses, and phone numbers, have been published online after a social-engineering attack that the
Access Report
Microsoft's August 2026 Patch Tuesday release covers 421 CVEs, and one of them — CVE-2026-68820, a use-after-free in the Windows Ancillary Function Driver for WinSock (afd.sys) — was already exploited
Access Report
Microsoft shipped its August 2026 Patch Tuesday bundle on Tuesday, addressing 398 new CVEs across Windows, Office, Azure, Exchange Server, SharePoint, Teams, GitHub Copilot, and .NET, with 62 rated Cr
Access Report
Microsoft's August 2026 Patch Tuesday delivers security updates for 400 vulnerabilities, including one flaw already exploited in attacks and two more disclosed publicly before patches shipped. Of the
Access Report
Security researcher Nightmare Eclipse has released ShieldBreak, a zero-day exploit that bypasses Microsoft's patch for CVE-2026-50656, the RoguePlanet Microsoft Defender privilege-escalation flaw. The
Access Report
Sophos' State of Ransomware 2026 report, based on a survey of 2,158 IT and cybersecurity leaders across 17 countries, finds identity — not vulnerability exploitation — is now the dominant root cause o
Access Report
Threat actors linked to the Clop (Cl0p) ransomware gang are actively exploiting CVE-2026-12569, a critical unsafe deserialization vulnerability rated CVSS 9.3, against Internet-exposed PTC Windchill a
Access Report
Unlimited Technology Systems (UTS), an Ohio-based medical software vendor, has disclosed that an unauthorized actor may have copied protected health information belonging to 3.8 million people during
Access Report
Hackers are actively exploiting a two-part critical flaw suite nicknamed "wp2shell" — CVE-2026-63030 and CVE-2026-60137 — in WordPress Core to deploy persistent PHP webshells and malicious plugins on
Access Report
A ransomware crew that Symantec tracks as Hyadina is breaking into U.S. organizations with a kernel-mode driver called PoisonX that somehow carries a valid Microsoft Hardware Compatibility signature.
Access Report
Swiss train builder Stadler Rail has refused to pay after receiving an extortion letter from the Everest ransomware group, which put a price of 10 million Swiss francs — roughly $12.3 million — on sto
Access Report
Microsoft's July 2026 Patch Tuesday shattered every previous record, delivering fixes for 622 unique CVEs — including three zero-days, two of them under active exploitation — and more than 60 critical
Access Report
Microsoft has shipped its July 2026 Patch Tuesday updates, closing a record-setting 570 security flaws across its product line — the largest monthly batch the company has ever released. The rollup inc
Access Report
Kaspersky has detailed a newly identified advanced persistent threat group it calls Armored Likho, which is running a mix of financially motivated and espionage operations against government bodies, e
Access Report
Accenture has acknowledged what it calls an "isolated matter" after a criminal advertised roughly 35GB of data allegedly lifted from the consulting firm's internal systems — a trove said to include so
Access Report
Microsoft has shipped a fix for a Microsoft Defender zero-day dubbed "RoguePlanet," tracked as [CVE-2026-50656](https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2026-50656), which lets a loc
Access Report
Cloud security firm Sysdig has documented what it describes as the first fully agentic, AI-driven ransomware operation: a threat actor tracked as JadePuffer used a large language model to autonomously
Access Report
Attackers are scanning the internet for badly configured proxy servers that expose access to commercial large language model (LLM) platforms, according to threat intelligence firm GreyNoise. Since lat
Access Report
Iran's oldest known state-aligned hacking crew — tracked as "Prince of Persia" or "Infy" — never actually disappeared. After roughly three years of public silence, SafeBreach researcher Tomer Bar repo
Access Report
An anonymous researcher operating under the handle "bikini" published what they describe as working exploit code for zero-day flaws spanning 15 software products and open source projects, dropping the
Access Report
Russia's long-running Gamaredon cyber-espionage group — also tracked as Aqua Blizzard, Armageddon, and BlueAlpha — has substantially modernized its toolkit and command-and-control (C2) practices, acco
Access Report
Tata Electronics, the semiconductor and electronics manufacturing arm of India's Tata Group, has confirmed it was hit by a cyberattack that affected portions of its IT infrastructure. The company says
Access Report
Microsoft, working alongside international law enforcement and several security firms, has dismantled the infrastructure behind two prolific information-stealing and loader malware families, StealC an
Access Report
Ransomware operators are increasingly turning their attention to Europe. Security firm Black Kite logged 684 ransomware attacks across the continent in the first four months of 2026 — a 55% jump over
Access Report
Microsoft has acknowledged a zero-day elevation-of-privilege flaw in Microsoft Defender, publicly nicknamed "RoguePlanet," and says it is building a security update to fix it. Now tracked as CVE-2026-
Access Report
A researcher operating under the handle Nightmare Eclipse has published a proof-of-concept exploit dubbed "RoguePlanet" that abuses a race condition in Microsoft Defender to launch a SYSTEM-level comm
Access Report
A newly published report from Acronis describes a ransomware operation that has likely been running since at least 2020, targeting home users and small or medium-sized businesses (SMBs) across Turkey.
Access Report
ServiceNow has notified customers of a security incident in which a flaw in a vulnerable API endpoint allowed unauthenticated access to data inside hosted customer instances. The company says it pushe
Access Report
Microsoft has shipped a fix for an actively exploited Exchange Server flaw that lets attackers run arbitrary JavaScript in the browsers of Outlook Web Access users. Tracked as CVE-2026-42897, the high
Access Report
A maximum-severity flaw in Ivanti Sentry was being exploited in the wild within a day of becoming public, with attackers leaning on a freely available proof-of-concept to break in. Tracked as CVE-2026
Access Report
Google says a critical flaw in Oracle's PeopleSoft software has been exploited as a zero-day by the cybercrime group ShinyHunters to steal data from organizations, with the education sector bearing th
Access Report
A security researcher operating under the handle Nightmare Eclipse (also known as Chaotic Eclipse) has published a fresh proof-of-concept exploit for an unpatched Windows flaw, arriving just after Mic
Access Report
Radware's ZombieAgent attack revives its ShadowLeak technique against ChatGPT, bypassing OpenAI's fix to exfiltrate user data one character at a time — another reminder that indirect prompt injection remains unsolved.
Access Report
Google and Recorded Future report that China-, Russia-, and other state-linked groups burned at least two dozen edge-device zero-days in a year to pre-position inside defense industrial base networks for persistent access.
Access Report
The Nitrogen ransomware group claims it stole 8TB of data from Foxconn, including material tied to Dell, Google, Apple, and Nvidia. Foxconn confirmed a cyberattack on North American factories that are now resuming production.
Access Report
The Dutch Data Protection Authority confirmed it was breached through Ivanti EPMM zero-days (CVE-2026-1281, CVE-2026-1340) in a January 29 attack that also exposed staff data at the Council for the Judiciary.
Access Report
Rapid7 attributes a fake Chaos ransomware intrusion to Iran's MuddyWater APT — a false-flag espionage operation that used Microsoft Teams social engineering, credential theft, and data exfiltration without ever encrypting files.
Access Report
Check Point warns that CVE-2026-50751 (CVSS 9.3), an authentication-bypass zero-day in its VPN and firewall gateways, has been exploited since May 7, including by a Qilin ransomware affiliate. Hotfixes and IoCs are available.
Access Report
CISA has ordered federal agencies to patch CVE-2026-32202, a zero-click NTLM hash-leak Windows zero-day that Akamai found lingering after an incomplete fix for the APT28-linked CVE-2026-21510.
Access Report
Microsoft's first Patch Tuesday of 2026 addresses 112 CVEs, led by an actively exploited Desktop Window Manager zero-day (CVE-2026-20805) and including NTFS remote-code-execution and VBS Enclave privilege-escalation flaws.
Access Report
Microsoft confirmed active in-the-wild exploitation of CVE-2026-42897 (CVSS 8.1), a cross-site scripting zero-day in Exchange Server's Outlook Web Access. With no patch yet, admins are urged to apply temporary mitigations immediately.
Access Report
Apple patched CVE-2026-20700, a memory-corruption zero-day in the dyld component of iPhones and iPads that was already used in sophisticated targeted attacks. CISA added it to its KEV catalog; fixes ship in iOS and iPadOS 26.3.
Access Report
Google and Mandiant say China-linked UNC6201 abused a critical hardcoded-credential zero-day (CVE-2026-22769) in Dell RecoverPoint for Virtual Machines since mid-2024, deploying the GrimBolt and BrickStorm backdoors.
Access Report
Researchers used a poisoned Google Calendar invite to hijack Gemini and control a smart home — among 14 indirect prompt-injection attacks shown at Black Hat. Google says it has shipped fixes.
Access Report
Google's Threat Intelligence Group says criminals used AI to discover and weaponize a 2FA-bypass zero-day for a planned mass-hacking campaign, in what it calls the first confirmed real-world case.
Access Report
Six federal agencies warn that Iran-linked hackers are disrupting programmable logic controllers at US water, energy, and government sites, exploiting internet-exposed Rockwell/Allen-Bradley devices.
Access Report
Russia's APT28 hijacked more than 18,000 routers across 120+ countries for espionage before an FBI-led operation dismantled the DNS-hijacking network, officials and researchers said.
Access Report
Foxconn confirmed a cyberattack on its North American factories after the Nitrogen ransomware gang claimed to have stolen 8 TB of data, including files tied to Intel, Apple, Google, Dell, and Nvidia.
Access Report
A breach and extortion attempt by ShinyHunters forced Instructure to put Canvas in maintenance mode during US finals week, disrupting thousands of schools and exposing student data.
Access Report
A cyberattack knocked the Canvas learning platform offline during US finals week. Instructure linked it to a breach claimed by ShinyHunters, exposing names, emails, student IDs, and messages.
Access Report
Microsoft is patching two actively exploited Defender zero-days — RedSun (CVE-2026-41091, SYSTEM escalation) and UnDefend (CVE-2026-45498, which blocks definition updates). CISA ordered agencies to fix them by June 3.
Access Report
Token Security showed how an over-permissioned role and lingering secrets in Zapier's AWS Lambda sandbox could chain into a near-total takeover, reaching private repos and an NPM publishing token.
Access Report
Attackers have exploited a patched SQL injection flaw (CVE-2026-26980) in the Ghost CMS to compromise more than 700 websites — including DuckDuckGo, Harvard, and Oxford — injecting ClickFix malware, per Qianxin.
Access Report
Mandiant says attackers exploited a hardcoded-machineKey zero-day (CVE-2026-5426) in the KnowledgeDeliver LMS, using ViewState deserialization to deploy Godzilla web shells and a Cobalt Strike backdoor.
Access Report
This week's threat intelligence roundup covers Microsoft Edge's plaintext password exposure in process memory, new industrial control system zero-days, and US officials considering dramatically shorte
Access Report
2026 has become a watershed year for AI-enabled cyberattacks. What was once theoretical — AI discovering vulnerabilities, generating exploits, and automating full attack chains — is now a documented r
Access Report
Cybersecurity researchers have disclosed a broad China-aligned espionage campaign targeting government and defense sectors across South, East, and Southeast Asia, along with one European government be
Access Report
Cybersecurity researchers disclosed a critical vulnerability in NGINX Plus and NGINX Open Source that remained undetected for 18 years. Dubbed NGINX Rift, the flaw allows unauthenticated remote code e
Access Report
GitHub confirmed that roughly 3,800 internal repositories were breached after one of its employees installed a malicious VS Code extension, tracing the attack to the broader TanStack npm supply-chain
Access Report
Microsoft has warned of two actively exploited vulnerabilities in Microsoft Defender, with CISA adding both to its Known Exploited Vulnerabilities catalog and requiring federal agency patching by June
Access Report
China-linked threat actors use a coordinated ecosystem to obtain zero-day vulnerabilities — not just individual discoveries. Understanding this pipeline is critical for defenders facing persistent nat
Access Report
A ransomware attack targeting a third-party emergency alert system used across the United States has resulted in a data breach and significant disruptions, leaving cities and counties unable to send e
Access Report
Pennsylvania pharma giant West Pharmaceutical Services experienced a significant ransomware incident on May 4, prompting immediate action to contain the attack and causing global operational disruptio
Access Report
The Iran-linked APT actor MuddyWater has been observed performing an intrusion masquerading as a ransomware attack, according to Rapid7 research. The intrusion relied on social engineering tactics com
Access Report
Google's Threat Intelligence Group has identified what it believes is the first documented case of cybercriminals using AI to discover and weaponize a zero-day vulnerability for a large-scale attack c
Access Report
A suspected North Korean threat actor inserted malicious code into Axios, a widely used JavaScript library downloaded approximately 100 million times weekly across enterprises, startups, and governmen
Access Report
A new report from Google found evidence that state-sponsored hacking groups have leveraged AI tool Gemini at nearly every stage of the cyber attack cycle.
Access Report
A security researcher has published proof-of-concept exploits for two unpatched Microsoft Windows vulnerabilities called YellowKey and GreenPlasma. YellowKey functions as a BitLocker bypass, while Gre
Access Report
Cybersecurity firm Trellix disclosed a data breach after attackers gained unauthorized access to a portion of its source code repository.
Access Report
CISA has given U.S. government agencies two weeks to secure their Windows systems against a Microsoft Defender privilege escalation vulnerability that has been exploited in zero-day attacks.
Access Report
Microsoft released its May 2026 Patch Tuesday updates addressing 120 vulnerabilities, with no zero-day exploits disclosed this month.
Access Report
Educational technology company Instructure has confirmed a cybersecurity incident affecting its Canvas learning management system. The ShinyHunters extortion gang has claimed responsibility for the at
Access Report
Cisco is alerting organizations to a critical authentication bypass vulnerability in its Catalyst SD-WAN Controller and Manager platforms. Tracked as CVE-2026-20182 with a maximum severity rating of 1
Access Report
CVE-2026-24061 is a CVSS 9.8 auth bypass in GNU InetUtils telnetd giving unauthenticated remote attackers instant root shell access. Active exploitation confirmed — patch now.
Access Report
CVE-2026-41940 is a critical cPanel & WHM authentication bypass exploited as a zero-day, affecting 70M+ domains. Patch immediately to all supported versions.
Access Report
CVE-2026-31431 "Copy Fail" is a Linux kernel logic flaw letting unprivileged users gain root via a 732-byte Python script on Ubuntu, RHEL, SUSE, and Amazon Linux.
Access Report
CVE-2026-24061 is a critical GNU InetUtils telnetd flaw letting unauthenticated remote attackers gain instant root shell access via argument injection.
Access Report
SafeBreach Labs uncovers the root cause of CVE-2026-24061, a CVSS 9.8 GNU telnetd auth-bypass flaw enabling unauthenticated RCE as root on Linux systems.
Access Report
Dirty Frag (CVE-2026-43284) is a deterministic Linux LPE exploiting ESP and RxRPC kernel flaws. Learn what's affected and how to mitigate now.
Access Report
PCPJack is a cloud worm credential-theft framework targeting Kubernetes, Docker, and Redis — evicting TeamPCP malware while harvesting enterprise and financial credentials.
Access Report
Microsoft researchers expose how prompt injection in AI agent frameworks escalates to remote code execution — learn which systems are at risk and how to defend them.
Access Report
Dirty Frag is an actively exploited Linux local privilege escalation vulnerability targeting kernel memory-fragment handling, enabling root access post-compromise via SSH, web shells, or containers.
Access Report
Copy Fail and DirtyFrag exploit Linux page cache corruption to gain root access. Learn how these CVEs work and how to detect them with EQL and auditd.
Access Report
CVE-2026-21440 is a critical CVSS 9.2 path traversal flaw in @adonisjs/bodyparser enabling arbitrary file writes and remote code execution. Patch now.
Access Report
Deep dive into the Axios npm supply chain attack: how WAVESHAPER.V2 RAT was deployed, indicators of compromise, and mitigation steps to protect your pipeline.
Access Report
This week's threat intelligence roundup covers the Medtronic data breach, AI-powered phishing kits, cPanel zero-day exploitation, and VECT 2.0 ransomware wiping files.
Access Report
Unit 42 tracks wormable npm supply chain attacks targeting CI/CD pipelines in 2026. Learn how Shai-Hulud and Mini Shai-Hulud work and how to protect your org.
Access Report
CI/CD pipelines are the new crown jewels for attackers. Learn how LLM-augmented signal detection catches GitHub Actions, GitLab CI, and Azure DevOps abuse before secrets are stolen.
Access Report
CVE-2026-31431 "Copy Fail" lets local users gain root in seconds by corrupting the Linux page cache via AF_ALG sockets. Learn the root cause, impact, and detection.
Access Report
CVE-2026-31431 "Copy Fail" lets attackers escalate to root on Linux across cloud and Kubernetes environments. A working exploit is in the wild — patch now.
Access Report
CVE-2026-41940 is a CVSS 9.8 authentication bypass in cPanel & WHM exploited in the wild. Learn the technical details, affected versions, and how to patch now.
Access Report
Kaspersky reveals DAEMON Tools versions 12.5.0.2421–2434 are trojanized with backdoors hitting 100+ countries. Here's what you need to know now.
Access Report
CVE-2026-31431 is a deterministic Linux kernel logic bug that chains AF_ALG and splice() into a stealthy 4-byte page cache write, granting root without races or recompilation.
Access Report
Project Glasswing's Mythos AI uncovered decades-old vulnerabilities at scale — yet fewer than 1% were patched, revealing a critical remediation gap in cybersecurity.
Access Report
CVE-2026-33825, a CVSS 7.8 Microsoft Defender privilege escalation flaw dubbed BlueHammer, is being actively exploited using public PoC code. Patch now.
Access Report
UNC6692 impersonated IT help desks on Microsoft Teams to deploy SNOW malware, targeting 77% senior employees in a 30-day campaign. Learn how to defend against this threat.
Access Report
Vercel confirmed a security breach after threat actors linked to ShinyHunters claimed to sell stolen data including API keys, source code, and employee records.
Access Report
Adobe patches CVE-2026-34621, an actively exploited Acrobat Reader flaw enabling remote code execution via malicious PDFs since December 2025.
Access Report
Medusa ransomware group Storm-1175 exploits zero-days within hours, targeting healthcare, finance, and education across the US, UK, and Australia.
Access Report
April 2026 brought wave after wave of cloud threats — from TeamPCP's supply chain cascade to a Telnetd RCE hitting 23% of cloud environments. Here's what matters.
Access Report
North Korea's APT37 threat group is leveraging Facebook accounts and trojanized PDFelement installers to deliver RokRAT malware for espionage and data theft.
Access Report
Palo Alto Networks and SonicWall release critical patches for high-severity vulnerabilities in Cortex platforms and SMA1000 firewalls. Here's what you need to know.
Access Report
North Korean APT37 (ScarCruft) has weaponized a Chinese Android game platform to distribute BirdCall spyware, targeting Korean-speaking users with advanced surveillance capabilities.
Access Report
AI is dramatically lowering the barrier for cybercriminals in 2026, enabling a 7M-user breach and accelerating exploits at unprecedented scale. Here's what defenders need to know.
Access Report
NASCAR confirms a March–April 2025 ransomware attack exposed names and Social Security numbers. Medusa group claims 1TB stolen and demands $4M ransom.
Access Report
TeamPCP's "Mini Shai Hulud" npm supply chain attack compromised SAP ecosystem packages to steal CI/CD secrets, cloud credentials, and Kubernetes tokens at scale.
Access Report
Google has patched CVE-2025-14174, a high-severity Chrome zero-day actively exploited in the wild, now linked to two newly patched Apple zero-days.
Access Report
The European Space Agency confirmed a breach after hacker '888' claimed to sell 200GB of stolen data including source code, credentials, and API tokens from ESA systems.
Access Report
Marks & Spencer confirms personal customer data was stolen in a DragonForce ransomware attack, exposing names, addresses, and order history for millions.
Access Report
North Korean APT ScarCruft compromised sqgame.net since late 2024, deploying BirdCall malware targeting Android and Windows users for surveillance and data theft.
Access Report
The iClicker website was compromised in a ClickFix attack that tricked millions of students and instructors into executing malware via a fake CAPTCHA prompt.
Access Report
Microsoft's April 2026 Patch Tuesday addresses 165 CVEs including an actively exploited SharePoint zero-day (CVE-2026-32201) added to CISA's KEV catalog.
Access Report
A Rhysida ransomware attack on Cookeville Regional Medical Center exposed data of 337,000 patients — SSNs, financial records, and medical histories now freely online.
Access Report
AI-powered attackers are exploiting VPN vulnerabilities faster than security teams can respond. Learn what the April 2026 Patch Tuesday fixes mean for your remote access security.
Access Report
NIST is shifting to a risk-based CVE prioritization model, focusing on high-impact vulnerabilities. Here's what security teams need to know about the NVD changes.
Access Report
Microsoft patches 167 CVEs including a SharePoint zero-day and BlueHammer in Windows Defender. Plus Adobe and Chrome emergency fixes you need now.
Access Report
Microsoft's April 2026 Patch Tuesday patches 165 vulnerabilities including an actively exploited SharePoint zero-day (CVE-2026-32201). Here's what you need to know.
Access Report
Adobe has patched CVE-2026-34621, an actively exploited Acrobat Reader flaw enabling remote code execution via malicious PDFs. Update immediately to stay protected.
Access Report
AI agents don't create new vulnerability types — they amplify existing ones. Learn how CVE-2026-26144 signals a dangerous new era of AI-powered exploitation.
Access Report
NIST restricts CVE enrichment after a 263% surge in vulnerability submissions since 2020, prioritizing KEV catalog and federal software while thousands of CVEs shift to "Not Scheduled."
Access Report
Three critical Microsoft Defender zero-days actively exploited since April 10, 2026 enable privilege escalation and denial-of-service attacks — two remain unpatched.
Access Report
Microsoft patched a record-breaking 167 vulnerabilities this Patch Tuesday, including a SharePoint zero-day and the BlueHammer Windows Defender flaw. Here's what you need to know.
Access Report
This week's cybersecurity roundup covers critical zero-days, high-profile data breaches, AI-driven threats, and lessons from Deloitte, TSA, and Mazda vulnerabilities.
Access Report
CISA adds CVE-2026-1340, a critical Ivanti EPMM code injection flaw with a 9.8 severity score, to its Known Exploited Vulnerabilities catalog amid thousands of attacks.
Access Report
CISA added CVE-2026-35616, a Fortinet FortiClient EMS improper access control vulnerability, to its KEV Catalog due to active exploitation. Learn what to do now.
Access Report
Fortinet patches CVE-2026-35616 (CVSS 9.1) in FortiClient EMS, actively exploited since March 31, 2026, enabling privilege escalation on vulnerable endpoints.
Access Report
Iranian threat group Boggy Serpens (MuddyWater) escalates cyberespionage with AI-enhanced malware, Rust-based tools, and trusted relationship compromises targeting critical infrastructure.
Access Report
CISA adds CVE-2026-33017 and CVE-2026-33634 to its KEV catalog as attackers exploit Langflow RCE within 20 hours and compromise Trivy's supply chain.
Access Report
Two chained vulnerabilities in Progress ShareFile's Storage Zones Controller allow unauthenticated remote code execution. Patch to version 5.12.4 immediately.
Access Report
GitHub Security Lab unites developers and security researchers to protect open source software—discover their mission, research findings, and the Advisory Database.
Access Report
CVE-2026-2441 is a CVSS 8.8 Chrome use-after-free vulnerability in Blink CSS actively exploited in the wild. Learn the technical details, impact, and how to patch now.
Access Report
CVE-2026-21440 is a CVSS 9.2 critical path traversal flaw in @adonisjs/bodyparser enabling arbitrary file write and remote code execution. Patch now.
Access Report
A critical unauthenticated RCE flaw (CVE-2026-33017, CVSS 9.3) in Langflow ≤1.8.13 allows full server compromise via unsafe Python exec(). Patch now.
Access Report
Critical CVSS 9.8 zero-days in Ivanti EPMM enable unauthenticated RCE. Discover attacker tradecraft, webshell deployment tactics, and how to respond.
Access Report
CVE-2026-33017 is a critical unauthenticated RCE in Langflow AI pipelines, actively exploited within 20 hours of disclosure. Learn attacker tactics and how to defend.
Access Report
Researchers chained two ShareFile vulnerabilities — an auth bypass and RCE flaw — to fully compromise on-prem Storage Zone Controllers without authentication.
Access Report
Cisco confirms a breach tied to the Trivy supply chain attack, with threat actors stealing source code from 300+ repositories and multiple AWS credentials.
Access Report
North Korean hackers compromised the Axios npm package — 400M monthly downloads — injecting malware targeting Linux, Windows, and macOS. Here's what you need to know.
Access Report
Two chained vulnerabilities in Progress ShareFile allow unauthenticated attackers to exfiltrate files and execute remote code on exposed Storage Zone Controllers.
Access Report
Discover how ransomware tactics have evolved and what organizations can do to protect themselves against these sophisticated threats.
Access Report
Learn step-by-step how to implement Zero Trust principles in your organization to enhance your security posture.
Access Report
Comprehensive guide on data breach prevention, detection, and response for cybersecurity professionals.
Access Report
Learn how to build an efficient GPU server for cybersecurity tasks like password cracking, malware analysis, and cryptocurrency forensics.
Access Report
Technical analysis of the APT34 Jason tool - a .NET GUI for brute-forcing Microsoft Exchange accounts via EWS/OAB to harvest emails.
Access Report
Analysis of the international cybercrime operation leading to the arrest of a notorious hacker in Thailand, with over $295,000 in assets seized.
Access Report
Detailed technical analysis of the largest crypto heist in history and lessons for securing digital assets.
Access Report
Analyzing the latest supply chain attack vectors and how organizations can defend against them.
Access Report
Technical analysis of cyber attacks in Albania based on the Albanian cybersecurity report.
Access Report